aarch64 GetPageSpeed extras (testing) repository for CentOS/RHEL 9

Update: nginx-module-pagespeed-1.30.6+2.1.0~beta13-1.el9.gps

Thu, 15 Oct 2026 04:23:03 +0000

Package: nginx-module-pagespeed
Summary: PageSpeed dynamic module for NGINX

Description:
PageSpeed dynamic module for nginx.

Changes:

nginx-module-pagespeed-1.30.6+2.1.0~beta13-1.el9.gps.aarch64 [11.2 MiB]	Changelog by Danila Vershinin (2026-10-03): - Bump to libpagespeed v2.1.0-beta13: AVIF and hardening update. - Recompresses existing still AVIF images safely. Adds an 8 MiB HTML token passthrough limit and a 32 MiB native-fetch body limit, a sprite resolution guard, SRI-safe resource handling, image-option bounds, s-maxage removal when caching is disabled, and a WebP rewritten-URL fallback for Safari 16+ and Firefox 132+.
nginx-module-pagespeed-1.30.5+2.1.0~beta13-1.el9.gps.aarch64 [11.2 MiB]	Changelog by Danila Vershinin (2026-10-03): - Bump to libpagespeed v2.1.0-beta13: AVIF and hardening update. - Recompresses existing still AVIF images safely. Adds an 8 MiB HTML token passthrough limit and a 32 MiB native-fetch body limit, a sprite resolution guard, SRI-safe resource handling, image-option bounds, s-maxage removal when caching is disabled, and a WebP rewritten-URL fallback for Safari 16+ and Firefox 132+.
nginx-module-pagespeed-1.30.5+2.1.0~beta12-1.el9.gps.aarch64 [11.2 MiB]	Changelog by Danila Vershinin (2026-09-24): - Bump to libpagespeed v2.1.0-beta12: security and correctness update. - Fixes two cross-site scripting issues in generated inline scripts (inline-image deduplication and low-res image preview), an integer overflow in numeric HTML character reference decoding, an image resolution-limit bypass via crafted PNG dimensions, and adds a JavaScript tokenizer depth ceiling (denial-of-service hardening). Also fixes six JavaScript minifier output-corruption classes, CSS math-function zero-unit stripping, case-insensitive CSS URL rebasing, animated WebP for three-digit browser versions, in-place Vary header token merging, CSP gating for combine_javascript, and async/defer script inlining.
nginx-module-pagespeed-1.30.5+2.1.0~beta11-1.el9.gps.aarch64 [11.1 MiB]	Changelog by Danila Vershinin (2026-08-06): - Bump to libpagespeed v2.1.0-beta11: enable the nginx-native fetcher for same-origin HTTP resources and make graceful worker shutdown null-safe when UseNativeFetcher is disabled. Add a post-smoke graceful-quit regression gate. - Package the Apache-2.0 license from its current monorepo location.
nginx-module-pagespeed-1.30.4+2.1.0~beta11-1.el9.gps.aarch64 [11.1 MiB]	Changelog by Danila Vershinin (2026-08-06): - Bump to libpagespeed v2.1.0-beta11: enable the nginx-native fetcher for same-origin HTTP resources and make graceful worker shutdown null-safe when UseNativeFetcher is disabled. Add a post-smoke graceful-quit regression gate. - Package the Apache-2.0 license from its current monorepo location.
nginx-module-pagespeed-1.30.4+2.1.0~beta10-3.el9.gps.aarch64 [6.3 MiB]	Changelog by Danila Vershinin (2026-05-14): - Rebuild after scripts/smoke.sh fix (curl removed from install line — conflicted with rpmbuilder's pre-installed curl-minimal). Forces a fresh NVR so build/deploy/smoke actually runs against an updated checkout rather than the cached -2 artifact.
nginx-module-pagespeed-1.30.3+2.1.0~beta10-3.el9.gps.aarch64 [6.4 MiB]	Changelog by Danila Vershinin (2026-05-14): - Rebuild after scripts/smoke.sh fix (curl removed from install line — conflicted with rpmbuilder's pre-installed curl-minimal). Forces a fresh NVR so build/deploy/smoke actually runs against an updated checkout rather than the cached -2 artifact.

Update: nginx-module-pagespeed-selinux-1.30.6+2.1.0~beta13-1.el9.gps

Thu, 15 Oct 2026 04:23:03 +0000

Package: nginx-module-pagespeed-selinux
Summary: SELinux policy module required to run NGINX PageSpeed module

Description:
This package contains SELinux policy module necessary to run NGINX PageSpeed module.

Changes:

nginx-module-pagespeed-selinux-1.30.6+2.1.0~beta13-1.el9.gps.aarch64 [13 KiB]	Changelog by Danila Vershinin (2026-10-03): - Bump to libpagespeed v2.1.0-beta13: AVIF and hardening update. - Recompresses existing still AVIF images safely. Adds an 8 MiB HTML token passthrough limit and a 32 MiB native-fetch body limit, a sprite resolution guard, SRI-safe resource handling, image-option bounds, s-maxage removal when caching is disabled, and a WebP rewritten-URL fallback for Safari 16+ and Firefox 132+.
nginx-module-pagespeed-selinux-1.30.5+2.1.0~beta13-1.el9.gps.aarch64 [13 KiB]	Changelog by Danila Vershinin (2026-10-03): - Bump to libpagespeed v2.1.0-beta13: AVIF and hardening update. - Recompresses existing still AVIF images safely. Adds an 8 MiB HTML token passthrough limit and a 32 MiB native-fetch body limit, a sprite resolution guard, SRI-safe resource handling, image-option bounds, s-maxage removal when caching is disabled, and a WebP rewritten-URL fallback for Safari 16+ and Firefox 132+.
nginx-module-pagespeed-selinux-1.30.5+2.1.0~beta12-1.el9.gps.aarch64 [13 KiB]	Changelog by Danila Vershinin (2026-09-24): - Bump to libpagespeed v2.1.0-beta12: security and correctness update. - Fixes two cross-site scripting issues in generated inline scripts (inline-image deduplication and low-res image preview), an integer overflow in numeric HTML character reference decoding, an image resolution-limit bypass via crafted PNG dimensions, and adds a JavaScript tokenizer depth ceiling (denial-of-service hardening). Also fixes six JavaScript minifier output-corruption classes, CSS math-function zero-unit stripping, case-insensitive CSS URL rebasing, animated WebP for three-digit browser versions, in-place Vary header token merging, CSP gating for combine_javascript, and async/defer script inlining.
nginx-module-pagespeed-selinux-1.30.5+2.1.0~beta11-1.el9.gps.aarch64 [12 KiB]	Changelog by Danila Vershinin (2026-08-06): - Bump to libpagespeed v2.1.0-beta11: enable the nginx-native fetcher for same-origin HTTP resources and make graceful worker shutdown null-safe when UseNativeFetcher is disabled. Add a post-smoke graceful-quit regression gate. - Package the Apache-2.0 license from its current monorepo location.
nginx-module-pagespeed-selinux-1.30.4+2.1.0~beta11-1.el9.gps.aarch64 [12 KiB]	Changelog by Danila Vershinin (2026-08-06): - Bump to libpagespeed v2.1.0-beta11: enable the nginx-native fetcher for same-origin HTTP resources and make graceful worker shutdown null-safe when UseNativeFetcher is disabled. Add a post-smoke graceful-quit regression gate. - Package the Apache-2.0 license from its current monorepo location.
nginx-module-pagespeed-selinux-1.30.4+2.1.0~beta10-3.el9.gps.aarch64 [12 KiB]	Changelog by Danila Vershinin (2026-05-14): - Rebuild after scripts/smoke.sh fix (curl removed from install line — conflicted with rpmbuilder's pre-installed curl-minimal). Forces a fresh NVR so build/deploy/smoke actually runs against an updated checkout rather than the cached -2 artifact.
nginx-module-pagespeed-selinux-1.30.3+2.1.0~beta10-3.el9.gps.aarch64 [12 KiB]	Changelog by Danila Vershinin (2026-05-14): - Rebuild after scripts/smoke.sh fix (curl removed from install line — conflicted with rpmbuilder's pre-installed curl-minimal). Forces a fresh NVR so build/deploy/smoke actually runs against an updated checkout rather than the cached -2 artifact.

Update: tenantd-proxysql-0.5.4-1.el9

Sun, 16 Aug 2026 15:28:14 +0000

Package: tenantd-proxysql
Summary: tenantd Phase 4 ProxySQL secondary front door (enterprise, optional)

Description:
Optional ProxySQL integration shipping per-tenant delay-throttle query rules via the proxysql admin socket. Enterprise-tier only. Operator provides their own ProxySQL install; this package ships the bootstrap config snippet and the tenantctl proxysql-enroll/remove subcommand wiring.

Changes:

tenantd-proxysql-0.5.4-1.el9.noarch [12 KiB]

Changelog by GetPageSpeed, Inc. (2026-08-16):

- Accept tenantctl-migrate apply as a compatibility alias for --commit.
- Ship tenantctl(8), tenantctl-migrate(8), and the public operator
  documentation in the main RPM for offline discovery after installation.

tenantd-proxysql-0.5.3-1.el9.noarch [12 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

tenantd-proxysql-0.5.2-1.el9.noarch [12 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

Update: tenantd-whm-plugin-0.5.4-1.el9

Sun, 16 Aug 2026 15:28:14 +0000

Package: tenantd-whm-plugin
Summary: WHM/Jupiter UI for tenantd (package profiles, per-user state)

Description:
WHM (cPanel) Jupiter-chrome plugin that renders configured tenantd package profiles and the live per-user slice state, with write-side forms for editing package limits and swapping a user's package.

Changes:

tenantd-whm-plugin-0.5.4-1.el9.noarch [19 KiB]

Changelog by GetPageSpeed, Inc. (2026-08-16):

- Accept tenantctl-migrate apply as a compatibility alias for --commit.
- Ship tenantctl(8), tenantctl-migrate(8), and the public operator
  documentation in the main RPM for offline discovery after installation.

tenantd-whm-plugin-0.5.3-1.el9.noarch [18 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

tenantd-whm-plugin-0.5.2-1.el9.noarch [19 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.