x86_64 GetPageSpeed extras (testing) repository for CentOS/RHEL 9

Update: htengix-1.29.3-4.el9.gps

Thu, 29 Oct 2026 15:26:23 +0000

Package: htengix
Summary: HTENGIX — NGINX with Apache .htaccess (mod_rewrite + overlay) support

Description:
HTENGIX is NGINX with Apache .htaccess compatibility statically linked in. With `htaccess on;` it reads .htaccess files from the docroot at request time (mtime-cached) and applies their mod_rewrite directives with Apache per-directory semantics: blocks, RewriteCond/RewriteRule in Apache syntax, closest-.htaccess-wins merge order, and .ht* request denial. mod_rewrite coverage is parity-tested 1:1 against Apache 2.4 on real-world WordPress and customer .htaccess fixtures. Directive categories beyond mod_rewrite (ErrorDocument, Options, Header, Expires, Order/Allow/ Deny) are not implemented yet and are skipped with a warning. Apache-style , , and overlay containers plus the ap_* directive set are also available in nginx.conf. This is a TESTING-channel preview build. Production use is not recommended yet. Source modules: https://github.com/dvershinin/nginx-module-htaccess

Changes:

htengix-1.29.3-4.el9.gps.x86_64 [979 KiB]	Changelog by Danila Vershinin (2026-10-29): - Bump bundled nginx-module-gps-license 1.9.2 -> 1.11.0: the default license token lookup now tries the canonical /etc/getpagespeed/license.jwt first (one file licenses every GetPageSpeed product on the host), then the legacy /etc/nginx/license.jwt, which keeps working forever; an explicit gps_license_token still wins. Also brings the v1.10.0 reason-aware 503 CTA with ?ref=nginx503 attribution.
htengix-1.29.3-3.el9.gps.x86_64 [978 KiB]	Changelog by Danila Vershinin (2026-09-27): - Compile the GPS license module (nginx-module-gps-license 1.9.2) in statically with package_source=htengix, enabling the free-with-footer licensing ladder for anonymous open-gate installs
htengix-1.29.3-2.el9.gps.x86_64 [939 KiB]	Changelog by Danila Vershinin (2026-06-11): - Statically link ngx_http_ap_htaccess_walker_module (htaccess on;) — it was absent from the -1 build. Walker hardened to real-world Apache parity: container handling, Apache RewriteCond dialect (%{VAR} translation, ! negation, Apache argument order), per-dir subject semantics with closest-wins merge, deepest-existing-dir fallback for pretty permalinks, and .ht* request deny. Parity-tested 1:1 against Apache 2.4: WordPress canonical and a real customer .htaccess match on all 41 request tuples (module@a184807).
htengix-1.29.3-1.el9.gps.x86_64 [928 KiB]	Changelog by Danila Vershinin (2026-06-02): - Initial HTENGIX build: NGINX mainline 1.29.3 with statically-linked ngx_http_ap_rewrite_module and ngx_http_ap_overlay_module pinned to nginx-module-htaccess@737b4d8. Provides full Apache mod_rewrite flag set plus less-than-Directory/Files/Location overlay containers. Drop-in replacement for stock nginx; testing-channel preview only.

Update: nginx-module-pagespeed-1.30.6+2.1.0~beta13-1.el9.gps

Thu, 15 Oct 2026 04:03:39 +0000

Package: nginx-module-pagespeed
Summary: PageSpeed dynamic module for NGINX

Description:
PageSpeed dynamic module for nginx.

Changes:

nginx-module-pagespeed-1.30.6+2.1.0~beta13-1.el9.gps.x86_64 [12.0 MiB]	Changelog by Danila Vershinin (2026-10-03): - Bump to libpagespeed v2.1.0-beta13: AVIF and hardening update. - Recompresses existing still AVIF images safely. Adds an 8 MiB HTML token passthrough limit and a 32 MiB native-fetch body limit, a sprite resolution guard, SRI-safe resource handling, image-option bounds, s-maxage removal when caching is disabled, and a WebP rewritten-URL fallback for Safari 16+ and Firefox 132+.
nginx-module-pagespeed-1.30.5+2.1.0~beta13-1.el9.gps.x86_64 [12.0 MiB]	Changelog by Danila Vershinin (2026-10-03): - Bump to libpagespeed v2.1.0-beta13: AVIF and hardening update. - Recompresses existing still AVIF images safely. Adds an 8 MiB HTML token passthrough limit and a 32 MiB native-fetch body limit, a sprite resolution guard, SRI-safe resource handling, image-option bounds, s-maxage removal when caching is disabled, and a WebP rewritten-URL fallback for Safari 16+ and Firefox 132+.
nginx-module-pagespeed-1.30.5+2.1.0~beta12-1.el9.gps.x86_64 [12.0 MiB]	Changelog by Danila Vershinin (2026-09-24): - Bump to libpagespeed v2.1.0-beta12: security and correctness update. - Fixes two cross-site scripting issues in generated inline scripts (inline-image deduplication and low-res image preview), an integer overflow in numeric HTML character reference decoding, an image resolution-limit bypass via crafted PNG dimensions, and adds a JavaScript tokenizer depth ceiling (denial-of-service hardening). Also fixes six JavaScript minifier output-corruption classes, CSS math-function zero-unit stripping, case-insensitive CSS URL rebasing, animated WebP for three-digit browser versions, in-place Vary header token merging, CSP gating for combine_javascript, and async/defer script inlining.
nginx-module-pagespeed-1.30.5+2.1.0~beta11-1.el9.gps.x86_64 [11.9 MiB]	Changelog by Danila Vershinin (2026-08-06): - Bump to libpagespeed v2.1.0-beta11: enable the nginx-native fetcher for same-origin HTTP resources and make graceful worker shutdown null-safe when UseNativeFetcher is disabled. Add a post-smoke graceful-quit regression gate. - Package the Apache-2.0 license from its current monorepo location.
nginx-module-pagespeed-1.30.4+2.1.0~beta11-1.el9.gps.x86_64 [11.9 MiB]	Changelog by Danila Vershinin (2026-08-06): - Bump to libpagespeed v2.1.0-beta11: enable the nginx-native fetcher for same-origin HTTP resources and make graceful worker shutdown null-safe when UseNativeFetcher is disabled. Add a post-smoke graceful-quit regression gate. - Package the Apache-2.0 license from its current monorepo location.
nginx-module-pagespeed-1.30.4+2.1.0~beta10-3.el9.gps.x86_64 [6.8 MiB]	Changelog by Danila Vershinin (2026-05-14): - Rebuild after scripts/smoke.sh fix (curl removed from install line — conflicted with rpmbuilder's pre-installed curl-minimal). Forces a fresh NVR so build/deploy/smoke actually runs against an updated checkout rather than the cached -2 artifact.
nginx-module-pagespeed-1.30.3+2.1.0~beta10-3.el9.gps.x86_64 [6.8 MiB]	Changelog by Danila Vershinin (2026-05-14): - Rebuild after scripts/smoke.sh fix (curl removed from install line — conflicted with rpmbuilder's pre-installed curl-minimal). Forces a fresh NVR so build/deploy/smoke actually runs against an updated checkout rather than the cached -2 artifact.

Update: nginx-module-pagespeed-selinux-1.30.6+2.1.0~beta13-1.el9.gps

Thu, 15 Oct 2026 04:03:39 +0000

Package: nginx-module-pagespeed-selinux
Summary: SELinux policy module required to run NGINX PageSpeed module

Description:
This package contains SELinux policy module necessary to run NGINX PageSpeed module.

Changes:

nginx-module-pagespeed-selinux-1.30.6+2.1.0~beta13-1.el9.gps.x86_64 [14 KiB]	Changelog by Danila Vershinin (2026-10-03): - Bump to libpagespeed v2.1.0-beta13: AVIF and hardening update. - Recompresses existing still AVIF images safely. Adds an 8 MiB HTML token passthrough limit and a 32 MiB native-fetch body limit, a sprite resolution guard, SRI-safe resource handling, image-option bounds, s-maxage removal when caching is disabled, and a WebP rewritten-URL fallback for Safari 16+ and Firefox 132+.
nginx-module-pagespeed-selinux-1.30.5+2.1.0~beta13-1.el9.gps.x86_64 [14 KiB]	Changelog by Danila Vershinin (2026-10-03): - Bump to libpagespeed v2.1.0-beta13: AVIF and hardening update. - Recompresses existing still AVIF images safely. Adds an 8 MiB HTML token passthrough limit and a 32 MiB native-fetch body limit, a sprite resolution guard, SRI-safe resource handling, image-option bounds, s-maxage removal when caching is disabled, and a WebP rewritten-URL fallback for Safari 16+ and Firefox 132+.
nginx-module-pagespeed-selinux-1.30.5+2.1.0~beta12-1.el9.gps.x86_64 [13 KiB]	Changelog by Danila Vershinin (2026-09-24): - Bump to libpagespeed v2.1.0-beta12: security and correctness update. - Fixes two cross-site scripting issues in generated inline scripts (inline-image deduplication and low-res image preview), an integer overflow in numeric HTML character reference decoding, an image resolution-limit bypass via crafted PNG dimensions, and adds a JavaScript tokenizer depth ceiling (denial-of-service hardening). Also fixes six JavaScript minifier output-corruption classes, CSS math-function zero-unit stripping, case-insensitive CSS URL rebasing, animated WebP for three-digit browser versions, in-place Vary header token merging, CSP gating for combine_javascript, and async/defer script inlining.
nginx-module-pagespeed-selinux-1.30.5+2.1.0~beta11-1.el9.gps.x86_64 [12 KiB]	Changelog by Danila Vershinin (2026-08-06): - Bump to libpagespeed v2.1.0-beta11: enable the nginx-native fetcher for same-origin HTTP resources and make graceful worker shutdown null-safe when UseNativeFetcher is disabled. Add a post-smoke graceful-quit regression gate. - Package the Apache-2.0 license from its current monorepo location.
nginx-module-pagespeed-selinux-1.30.4+2.1.0~beta11-1.el9.gps.x86_64 [12 KiB]	Changelog by Danila Vershinin (2026-08-06): - Bump to libpagespeed v2.1.0-beta11: enable the nginx-native fetcher for same-origin HTTP resources and make graceful worker shutdown null-safe when UseNativeFetcher is disabled. Add a post-smoke graceful-quit regression gate. - Package the Apache-2.0 license from its current monorepo location.
nginx-module-pagespeed-selinux-1.30.4+2.1.0~beta10-3.el9.gps.x86_64 [12 KiB]	Changelog by Danila Vershinin (2026-05-14): - Rebuild after scripts/smoke.sh fix (curl removed from install line — conflicted with rpmbuilder's pre-installed curl-minimal). Forces a fresh NVR so build/deploy/smoke actually runs against an updated checkout rather than the cached -2 artifact.
nginx-module-pagespeed-selinux-1.30.3+2.1.0~beta10-3.el9.gps.x86_64 [12 KiB]	Changelog by Danila Vershinin (2026-05-14): - Rebuild after scripts/smoke.sh fix (curl removed from install line — conflicted with rpmbuilder's pre-installed curl-minimal). Forces a fresh NVR so build/deploy/smoke actually runs against an updated checkout rather than the cached -2 artifact.

Update: tenantd-0.5.4-1.el9

Sun, 16 Aug 2026 15:28:14 +0000

Package: tenantd
Summary: Per-user cgroup v2 isolation + PHP-FPM slice attach for cPanel/AlmaLinux/Rocky/RHEL

Description:
tenantd places each cPanel user under a dedicated cgroup v2 slice with package-driven CPU, memory, PID, and IO limits, and runs a per-user PHP-FPM master inside that slice — so abuse by one tenant cannot starve the rest of the box. Free, closed-source isolation layer that targets stock AlmaLinux 9/10, Rocky 9/10, and RHEL 9 (no vendor kernel, no distro-level reinstall). This package ships the slice tool, systemd units, default and burst profiles, and cPanel Standardized Hooks that auto-attach the slice on account creation and tear it down on removal.

Changes:

tenantd-0.5.4-1.el9.x86_64 [85 KiB]

Changelog by GetPageSpeed, Inc. (2026-08-16):

- Accept tenantctl-migrate apply as a compatibility alias for --commit.
- Ship tenantctl(8), tenantctl-migrate(8), and the public operator
  documentation in the main RPM for offline discovery after installation.

tenantd-0.5.3-1.el9.x86_64 [71 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

tenantd-0.5.2-1.el9.x86_64 [72 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

Update: tenantd-ebpf-0.5.4-1.el9

Sun, 16 Aug 2026 15:28:14 +0000

Package: tenantd-ebpf
Summary: tenantd Phase 4 per-tenant block-IO observability (enterprise)

Description:
Optional eBPF accounting daemon (tenantd-mysql-ebpf) for per-tenant block-IO observability on a shared mysqld. Tenant identity comes from the USDT marker mysql:connection__start (with a mangled-symbol uprobe fallback for builds without stapsdt notes, e.g. acl_getroot); block-IO bytes come from the block_rq_issue kprobe. Enterprise-tier only; the daemon refuses to start unless LICENSE_TIER=enterprise. Read-only observability — cgroup v2 io is not threaded, so this cannot enforce. See docs/phase-4-ebpf.md and the design memo § 6 honest IO-gap disclosure at docs/phase-3-mysql-governor-design.md.

Changes:

tenantd-ebpf-0.5.4-1.el9.x86_64 [21 KiB]

Changelog by GetPageSpeed, Inc. (2026-08-16):

- Accept tenantctl-migrate apply as a compatibility alias for --commit.
- Ship tenantctl(8), tenantctl-migrate(8), and the public operator
  documentation in the main RPM for offline discovery after installation.

tenantd-ebpf-0.5.3-1.el9.x86_64 [20 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

tenantd-ebpf-0.5.2-1.el9.x86_64 [20 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

Update: tenantd-fleet-0.5.4-1.el9

Sun, 16 Aug 2026 15:28:14 +0000

Package: tenantd-fleet
Summary: tenantd Phase 5 central control plane (separate host)

Description:
Central tenantd-fleet daemon that ingests per-host stats over mTLS and renders the unified WHM-style dashboard at a single FQDN. Install this subpackage on the dedicated fleet host (one per customer, NOT one per tenantd-enrolled host). Per-host pushers + tenantctl fleet-enroll glue ship in the main tenantd package — operators do not install tenantd-fleet on tenant hosts.

Changes:

tenantd-fleet-0.5.4-1.el9.x86_64 [2.9 MiB]

Changelog by GetPageSpeed, Inc. (2026-08-16):

- Accept tenantctl-migrate apply as a compatibility alias for --commit.
- Ship tenantctl(8), tenantctl-migrate(8), and the public operator
  documentation in the main RPM for offline discovery after installation.

tenantd-fleet-0.5.3-1.el9.x86_64 [2.9 MiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

tenantd-fleet-0.5.2-1.el9.x86_64 [2.9 MiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

Update: tenantd-proxysql-0.5.4-1.el9

Sun, 16 Aug 2026 15:28:14 +0000

Package: tenantd-proxysql
Summary: tenantd Phase 4 ProxySQL secondary front door (enterprise, optional)

Description:
Optional ProxySQL integration shipping per-tenant delay-throttle query rules via the proxysql admin socket. Enterprise-tier only. Operator provides their own ProxySQL install; this package ships the bootstrap config snippet and the tenantctl proxysql-enroll/remove subcommand wiring.

Changes:

tenantd-proxysql-0.5.4-1.el9.noarch [12 KiB]

Changelog by GetPageSpeed, Inc. (2026-08-16):

- Accept tenantctl-migrate apply as a compatibility alias for --commit.
- Ship tenantctl(8), tenantctl-migrate(8), and the public operator
  documentation in the main RPM for offline discovery after installation.

tenantd-proxysql-0.5.3-1.el9.noarch [12 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

tenantd-proxysql-0.5.2-1.el9.noarch [12 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

Update: tenantd-whm-plugin-0.5.4-1.el9

Sun, 16 Aug 2026 15:28:14 +0000

Package: tenantd-whm-plugin
Summary: WHM/Jupiter UI for tenantd (package profiles, per-user state)

Description:
WHM (cPanel) Jupiter-chrome plugin that renders configured tenantd package profiles and the live per-user slice state, with write-side forms for editing package limits and swapping a user's package.

Changes:

tenantd-whm-plugin-0.5.4-1.el9.noarch [19 KiB]

Changelog by GetPageSpeed, Inc. (2026-08-16):

- Accept tenantctl-migrate apply as a compatibility alias for --commit.
- Ship tenantctl(8), tenantctl-migrate(8), and the public operator
  documentation in the main RPM for offline discovery after installation.

tenantd-whm-plugin-0.5.3-1.el9.noarch [18 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.

tenantd-whm-plugin-0.5.2-1.el9.noarch [19 KiB]

Changelog by GetPageSpeed, Inc. (2026-06-17):

- Pre-launch hardening sprint (2026-07-01 launch target).
- Stage B finding #23.5 (docs/phase-5-stage-b-live.md L217): tenantctl
  mysql-bootstrap no longer emits "GRANT: command not found" on stderr.
  Root cause: backtick-quoted SQL example in the unquoted heredoc body
  was being run as a shell command. Switched to double quotes.
- Stage B finding kill_cpu calibration (docs/phase-5-stage-b-live.md L230):
  phase-3-mysql-smoke.sh KILL-latency assertion bumped 5s → 10s to match
  shipping governor default (GOVERNOR_KILL_CPU_THRESHOLD_SECONDS=10.0,
  sbin/tenantd-mysql-governor:78). Governor default unchanged.
- Stage B finding ssh-smoke creds (docs/phase-5-stage-b-live.md L111+L215):
  phase-3-ssh-smoke.sh self-seeds an ephemeral ed25519 key into root/u1/u2
  authorized_keys (tagged and removed on exit) instead of depending on
  rig test-user passwords. Closes the recurring rig-provisioning trap.
- Test infra: new tests/install-smoke.sh fixture-mode harness. Boots a
  clean rockylinux:9 container, dnf-installs the four host-eligible
  subpackages (excludes whm-plugin, cPanel-only), runs structural checks
  (transaction status, scriptlet errors, systemd-analyze verify, banner,
  rpm -V, #23.5 stderr regression guard). Would have caught 13 of 17
  Stage B latents automatically.