From 9d94b38331189368178feabd9b144683b3e9ef83 Mon Sep 17 00:00:00 2001
From: Vadim Yalovets <vadim.yalovets@percona.com>
Date: Wed, 19 Aug 2026 18:50:44 +0300
Subject: [PATCH] add openssl3 to el8

---
 packaging/rpm/binlog-server.spec           | 19 +++++++++++++++++--
 packaging/scripts/binlog-server_builder.sh | 19 +++++++++++++++++++
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/packaging/rpm/binlog-server.spec b/packaging/rpm/binlog-server.spec
index 8ec5388..4e51246 100644
--- a/packaging/rpm/binlog-server.spec
+++ b/packaging/rpm/binlog-server.spec
@@ -7,6 +7,17 @@
 %global release %{rpm_release}%{?dist}
 %global optflags %(echo %{optflags} | sed 's/-specs=[^ ]*annobin[^ ]*//g')
 
+# el8's system openssl-devel is OpenSSL 1.1.1, but the opensslpp module
+# (PBS-39 encryption support) needs OpenSSL 3.0 EVP APIs. openssl3-devel
+# (from EPEL, or oracle-epel-release-el8 on Oracle Linux) installs side by
+# side under /usr/{include,lib64}/openssl3, so it has to be pointed to
+# explicitly instead of relying on CMake's default OpenSSL discovery.
+%if 0%{?rhel} == 8
+%global pbs_openssl3_cmake_opts -DOPENSSL_ROOT_DIR=/usr/lib64/openssl3 -DOPENSSL_INCLUDE_DIR=/usr/include/openssl3 -DOPENSSL_CRYPTO_LIBRARY=/usr/lib64/openssl3/libcrypto.so -DOPENSSL_SSL_LIBRARY=/usr/lib64/openssl3/libssl.so
+%else
+%global pbs_openssl3_cmake_opts %{nil}
+%endif
+
 Name:           percona-binlog-server
 Version:        %{percona_binlog_server_version}
 Release:        %{release}
@@ -16,6 +27,10 @@ License:        GPLv2
 URL:            https://github.com/Percona-Lab/percona-binlog-server
 Source0:        %{name}-%{version}.tar.gz
 
+%if 0%{?rhel} == 8
+BuildRequires: openssl3-devel
+%endif
+
 %description
 Percona Binary Log Server is a command-line utility that acts as an enhanced version of mysqlbinlog in --read-from-remote-server mode. It serves as a replication client and can stream binary log events from a remote Oracle MySQL Server / Percona Server for MySQL both to a local filesystem and to a cloud storage (currently AWS S3). The tool is capable of automatically reconnecting to the remote server and resuming operations from the point where it was previously stopped.
 
@@ -67,7 +82,7 @@ mkdir -p debug
 
   # Build Percona Binlog Server
   cd ../..
-  cmake ./percona-binlog-server-%{version} --preset %{BUILD_PRESET_DEBUG}
+  cmake ./percona-binlog-server-%{version} --preset %{BUILD_PRESET_DEBUG} %{pbs_openssl3_cmake_opts}
   cmake --build ./percona-binlog-server-%{version}-build-%{BUILD_PRESET_DEBUG} --parallel
 )
 
@@ -113,7 +128,7 @@ mkdir -p release
 
   # Build Percona Binlog Server
   cd ../..
-  cmake ./percona-binlog-server-%{version} --preset %{BUILD_PRESET_RELEASE}
+  cmake ./percona-binlog-server-%{version} --preset %{BUILD_PRESET_RELEASE} %{pbs_openssl3_cmake_opts}
   cmake --build ./percona-binlog-server-%{version}-build-%{BUILD_PRESET_RELEASE} --parallel
 )
 
diff --git a/packaging/scripts/binlog-server_builder.sh b/packaging/scripts/binlog-server_builder.sh
index 5b37290..07aa0eb 100644
--- a/packaging/scripts/binlog-server_builder.sh
+++ b/packaging/scripts/binlog-server_builder.sh
@@ -134,17 +134,24 @@ get_system() {
         ARCH=$(echo $(uname -m) | sed -e 's:i686:i386:g')
         OS_NAME="el$RHEL"
         OS="rpm"
+        if [ -f /etc/oracle-release ]; then
+            IS_ORACLE=1
+        else
+            IS_ORACLE=0
+        fi
     elif [ -f /etc/amazon-linux-release ]; then
         GLIBC_VER_TMP="$(rpm glibc -qa --qf %{VERSION})"
         RHEL=$(rpm --eval %amzn)
         ARCH=$(echo $(uname -m) | sed -e 's:i686:i386:g')
         OS_NAME="amzn$RHEL"
         OS="rpm"
+        IS_ORACLE=0
     else
         GLIBC_VER_TMP="$(dpkg-query -W -f='${Version}' libc6 | awk -F'-' '{print $1}')"
         ARCH=$(uname -m)
         OS_NAME="$( . /etc/os-release && echo $VERSION_CODENAME)"
         OS="deb"
+        IS_ORACLE=0
     fi
     export GLIBC_VER=".glibc${GLIBC_VER_TMP}"
     return
@@ -189,6 +196,10 @@ install_deps() {
             if [ "x${RHEL}" = "x10" ]; then
                 dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm
                 /usr/bin/crb enable
+            elif [ "x${RHEL}" = "x8" -a "x${IS_ORACLE}" = "x1" ]; then
+                # Oracle Linux mirrors EPEL under ol8_developer_EPEL but needs
+                # its own release package rather than Fedora's epel-release
+                yum -y install oracle-epel-release-el8
             else
                 yum -y install epel-release
             fi
@@ -202,6 +213,14 @@ install_deps() {
         yum -y install libatomic
         if [ "x${RHEL}" != "x2023" ]; then
             yum -y install curl openssl-devel
+            if [ "x${RHEL}" = "x8" ]; then
+                # PBS-39 encryption support needs OpenSSL 3.0 EVP APIs that
+                # el8's system openssl-devel (1.1.1) does not provide.
+                # openssl3-devel from EPEL installs side by side under
+                # /usr/{include,lib64}/openssl3 and is pointed to explicitly
+                # in packaging/rpm/binlog-server.spec's cmake configure step.
+                yum -y install openssl3-devel
+            fi
             if [ "x$RHEL" = "x8" -o "x$RHEL" = "x9" ]; then
                 yum -y install gcc-toolset-14-gcc gcc-toolset-14-gcc-c++ gcc-toolset-14-binutils
                 source /opt/rh/gcc-toolset-14/enable