rhbz#2425930

restore patches deleted by merge
ceph-19.2.3, python rhbz#2396683
2026-01-02 13:38:29 -05:00 · 2025-10-20 11:26:31 -04:00 · 2025-10-17 07:11:18 -04:00 · 2025-10-17 07:10:07 -04:00 · 2025-10-16 11:35:20 -04:00 · 2025-09-22 07:36:28 -04:00
37 changed files with 3748 additions and 1475 deletions
@@ -0,0 +1,55 @@
+--- ceph-15.2.2/src/common/crc32c_intel_fast_zero_asm.s.orig	2020-05-26 08:34:32.226201974 -0400
+++ ceph-15.2.2/src/common/crc32c_intel_fast_zero_asm.s	2020-05-26 17:19:32.497201974 -0400
+@@ -1,5 +1,5 @@
+ ;
+-; Copyright 2012-2013 Intel Corporation All Rights Reserved.
+; Copyright 2012-2015 Intel Corporation All Rights Reserved.
+ ; All rights reserved.
+ ;
+ ; http://opensource.org/licenses/BSD-3-Clause
+@@ -59,6 +59,19 @@
+ 	xor     rbx, rbx                ;; rbx = crc1 = 0;
+ 	xor     r10, r10                ;; r10 = crc2 = 0;
+ 
+	cmp	len, %%bSize*3*2
+	jbe	%%non_prefetch
+
+ %assign i 0
+ %rep %%bSize/8 - 1
+	crc32   rax, bufptmp  ;; update crc0
+	crc32   rbx, bufptmp  ;; update crc1
+	crc32   r10, bufptmp  ;; update crc2
+	%assign i (i+8)
+ %endrep
+	jmp %%next %+ %1
+
+%%non_prefetch:
+  %assign i 0
+  %rep %%bSize/8 - 1
+ 	crc32   rax, bufptmp  ;; update crc0
+@@ -66,6 +79,8 @@
+ 	crc32   r10, bufptmp  ;; update crc2
+ 	%assign i (i+8)
+  %endrep
+
+%%next %+ %1:
+ 	crc32   rax, bufptmp  ;; update crc0
+ 	crc32   rbx, bufptmp  ;; update crc1
+ ; SKIP  ;crc32  r10, bufptmp  ;; update crc2
+@@ -180,12 +195,15 @@
+ %define crc_init_dw     r8d
+ %endif
+ 
+-
+	endbranch
+ 	push    rdi
+ 	push    rbx
+ 
+ 	mov     rax, crc_init           ;; rax = crc_init;
+ 
+	cmp	len, 8
+	jb	less_than_8
+
+ ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+ ;; 1) ALIGN: ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+ 
@@ -1,13 +0,0 @@
-diff --git a/src/common/CMakeLists.txt b/src/common/CMakeLists.txt
-index 65ba10b0f1..eeedc29c37 100644
--- a/src/common/CMakeLists.txt
-+++ b/src/common/CMakeLists.txt
-@@ -165,7 +165,7 @@ elseif(HAVE_ARMV8_CRC)
-     crc32c_aarch64.c)
- endif(HAVE_INTEL)
- 
-add_library(crc32 ${crc32_srcs})
-+add_library(crc32 STATIC ${crc32_srcs})
- if(HAVE_ARMV8_CRC)
-   set_target_properties(crc32 PROPERTIES
-     COMPILE_FLAGS "${CMAKE_C_FLAGS} ${ARMV8_CRC_COMPILE_FLAGS}")
@@ -1,11 +1,8 @@
--- ceph-14.2.6/src/common/bit_str.h.orig	2020-01-24 11:37:20.547679336 -0500
-+++ ceph-14.2.6/src/common/bit_str.h	2020-01-24 11:37:55.351904895 -0500
-@@ -14,7 +14,10 @@
- #ifndef CEPH_COMMON_BIT_STR_H
- #define CEPH_COMMON_BIT_STR_H
- 
-+#include <cstdint>
-+#include <iosfwd>
+--- ceph-15.1.0/src/common/bit_str.h.orig	2020-02-03 09:47:20.047149798 -0500
+++ ceph-15.1.0/src/common/bit_str.h	2020-02-03 09:47:50.213149798 -0500
+@@ -17,6 +17,7 @@
+ #include <cstdint>
+ #include <iosfwd>
 #include <functional>
 +#include <ostream>
 
@@ -1,10 +0,0 @@
--- ceph-14.2.6/src/librbd/api/PoolMetadata.h.orig	2020-01-24 12:39:23.738816885 -0500
-+++ ceph-14.2.6/src/librbd/api/PoolMetadata.h	2020-01-24 12:39:36.522902386 -0500
-@@ -8,6 +8,7 @@
- #include "include/rados/librados_fwd.hpp"
- 
- #include <map>
-+#include <string>
- 
- namespace librbd {
- 
@@ -1,135 +0,0 @@
-From 8db2a44c9438749be98d41fb309f10d5084805df Mon Sep 17 00:00:00 2001
-From: Jeff Layton <jlayton@redhat.com>
-Date: Fri, 17 Jan 2020 07:48:12 -0500
-Subject: [PATCH] mount.ceph: remove arbitrary limit on size of name= option
-
-Aaron was getting back -ERANGE errors when trying to mount using
-a long name= option. The issue is that the destination buffer for the
-"key=" string is not big enough to hold long names.
-
-When I overhauled the mount.ceph code recently, I made this buffer much
-smaller than before figuring that it didn't need to be any larger than
-the length of "secret=<base64 encoded key>".
-
-In the case where the secret is set in the keyring though, this buffer
-needs to be able to hold a string like "key=client.<cephx name>". The
-cephx name can be of arbitrary length, however.
-
-Rework the code to just safe_cat the strings directly into the options
-buffer, eliminating an extra copy and the need for an arbitrary limit.
-This also allows us to remove get_secret_option() from the the common
-code as well.
-
-Fixes: https://tracker.ceph.com/issues/43649
-Reported-by: Aaron <aarongmldt@gmail.com>
-Signed-off-by: Jeff Layton <jlayton@redhat.com>
---
- src/common/secret.h    |  7 ------
- src/mount/mount.ceph.c | 45 ++++++++++++++++++++++++-------------
- src/mount/mount.ceph.h |  3 ---
- 4 files changed, 30 insertions(+), 75 deletions(-)
-
-diff --git a/src/common/secret.h b/src/common/secret.h
-index b681fa1ec7..5d2ad179dd 100644
--- a/src/common/secret.h
-+++ b/src/common/secret.h
-@@ -7,13 +7,6 @@ extern "C" {
- 
- int read_secret_from_file(const char *filename, char *secret, size_t max_len);
- 
-/*
- * Attempts to add the secret to the kernel, but falls back to
- * the old secret= option if the kernel is too old.
- */
-int get_secret_option(const char *secret, const char *key_name,
-		      char *secret_option, size_t secret_option_len);
-
- int set_kernel_secret(const char *secret, const char *key_name);
- 
- int is_kernel_secret(const char *key_name);
-diff --git a/src/mount/mount.ceph.c b/src/mount/mount.ceph.c
-index e970648c59..133bc554f5 100644
--- a/src/mount/mount.ceph.c
-+++ b/src/mount/mount.ceph.c
-@@ -425,24 +425,39 @@ static void ceph_mount_info_free(struct ceph_mount_info *cmi)
- 	free(cmi->cmi_conf);
- }
- 
-static int finalize_options(struct ceph_mount_info *cmi)
-+static int append_key_or_secret_option(struct ceph_mount_info *cmi)
- {
-	int pos;
-+	int pos = strlen(cmi->cmi_opts);
- 
-	if (cmi->cmi_secret[0] || is_kernel_secret(cmi->cmi_name)) {
-		int ret;
-		char secret_option[SECRET_OPTION_BUFSIZE];
-+	if (!cmi->cmi_secret[0] && !is_kernel_secret(cmi->cmi_name))
-+		return 0;
- 
-		ret = get_secret_option(cmi->cmi_secret, cmi->cmi_name,
-					secret_option, sizeof(secret_option));
-		if (ret < 0)
-+	if (pos)
-+		pos = safe_cat(&cmi->cmi_opts, &cmi->cmi_opts_len, pos, ",");
-+
-+	/* when parsing kernel options (-o remount) we get '<hidden>' as the secret */
-+	if (cmi->cmi_secret[0] && (strcmp(cmi->cmi_secret, "<hidden>") != 0)) {
-+		int ret = set_kernel_secret(cmi->cmi_secret, cmi->cmi_name);
-+		if (ret < 0) {
-+			if (ret == -ENODEV || ret == -ENOSYS) {
-+				/* old kernel; fall back to secret= in options */
-+				pos = safe_cat(&cmi->cmi_opts,
-+					       &cmi->cmi_opts_len, pos,
-+					       "secret=");
-+				pos = safe_cat(&cmi->cmi_opts,
-+					       &cmi->cmi_opts_len, pos,
-+					       cmi->cmi_secret);
-+				return 0;
-+			}
-+			fprintf(stderr, "adding ceph secret key to kernel failed: %s\n",
-+				strerror(-ret));
- 			return ret;
-
-		pos = strlen(cmi->cmi_opts);
-		if (pos)
-			pos = safe_cat(&cmi->cmi_opts, &cmi->cmi_opts_len, pos, ",");
-		pos = safe_cat(&cmi->cmi_opts, &cmi->cmi_opts_len, pos, secret_option);
-+		}
- 	}
-+
-+	pos = safe_cat(&cmi->cmi_opts, &cmi->cmi_opts_len, pos, "key=");
-+	pos = safe_cat(&cmi->cmi_opts, &cmi->cmi_opts_len, pos, cmi->cmi_name);
-+
- 	return 0;
- }
- 
-@@ -493,9 +508,9 @@ int main(int argc, char *argv[])
- 	/* Ensure the ceph key_type is available */
- 	modprobe();
- 
-	retval = finalize_options(&cmi);
-+	retval = append_key_or_secret_option(&cmi);
- 	if (retval) {
-		fprintf(stderr, "couldn't finalize options: %d\n", retval);
-+		fprintf(stderr, "couldn't append secret option: %d\n", retval);
- 		retval = EX_USAGE;
- 		goto out;
- 	}
-diff --git a/src/mount/mount.ceph.h b/src/mount/mount.ceph.h
-index c563597c43..b61176923d 100644
--- a/src/mount/mount.ceph.h
-+++ b/src/mount/mount.ceph.h
-@@ -21,9 +21,6 @@ extern "C" {
- /* Max Including null terminator */
- #define SECRET_BUFSIZE (MAX_SECRET_LEN + 1)
- 
-/* Buffer size for secret= option */
-#define SECRET_OPTION_BUFSIZE (sizeof("secret=") + MAX_SECRET_LEN + 1)
-
- /* 2k should be enough for anyone? */
- #define MON_LIST_BUFSIZE	2048
- 
-- 
-2.24.1
-
@@ -0,0 +1,27 @@
+From 1999108aeb1f6f93a19ea7bb64c6ae8b87d1b264 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Thu, 20 Jan 2022 05:33:13 -0800
+Subject: [PATCH] CET: Add CET marker to crc32c_intel_fast_zero_asm.s
+
+Add .note.gnu.property section to crc32c_intel_fast_zero_asm.s to mark
+for IBT and SHSTK compatibility.
+---
+ src/common/crc32c_intel_fast_zero_asm.s | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/common/crc32c_intel_fast_zero_asm.s b/src/common/crc32c_intel_fast_zero_asm.s
+index 216ecf639f3..2e291d858f3 100644
+--- a/src/common/crc32c_intel_fast_zero_asm.s
+++ b/src/common/crc32c_intel_fast_zero_asm.s
+@@ -654,4 +654,8 @@ slversion crc32_iscsi_zero_00, 00,   02,  0014
+ %ifidn __OUTPUT_FORMAT__, elf64
+ ; inform linker that this doesn't require executable stack
+ section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+ %endif
+-- 
+2.34.1
+
@@ -0,0 +1,172 @@
+From bbcc1a69f787881f16156f3c789052942a564103 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Thu, 20 Jan 2022 05:35:49 -0800
+Subject: [PATCH] isa-l/CET: Add CET marker to x86-64 crc32 assembly codes
+
+Add .note.gnu.property section to x86-64 crc32 assembly codes to mark
+for IBT and SHSTK compatibility.
+---
+ crc/crc32_gzip_refl_by16_10.asm | 9 +++++++++
+ crc/crc32_gzip_refl_by8.asm     | 9 +++++++++
+ crc/crc32_gzip_refl_by8_02.asm  | 9 +++++++++
+ crc/crc32_ieee_01.asm           | 8 ++++++++
+ crc/crc32_ieee_02.asm           | 9 +++++++++
+ crc/crc32_ieee_by16_10.asm      | 9 +++++++++
+ crc/crc32_ieee_by4.asm          | 9 +++++++++
+ crc/crc32_iscsi_00.asm          | 8 ++++++++
+ crc/crc32_iscsi_01.asm          | 8 ++++++++
+ 9 files changed, 78 insertions(+)
+
+diff --git a/src/isa-l/crc/crc32_gzip_refl_by16_10.asm b/src/isa-l/crc/crc32_gzip_refl_by16_10.asm
+index 40236f6..b16874d 100644
+--- a/src/isa-l/crc/crc32_gzip_refl_by16_10.asm
+++ b/src/isa-l/crc/crc32_gzip_refl_by16_10.asm
+@@ -566,3 +566,12 @@ global no_ %+ FUNCTION_NAME
+ no_ %+ FUNCTION_NAME %+ :
+ %endif
+ %endif ; (AS_FEATURE_LEVEL) >= 10
+
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/isa-l/crc/crc32_gzip_refl_by8.asm b/src/isa-l/crc/crc32_gzip_refl_by8.asm
+index 62f7e7d..97b0c4a 100644
+--- a/src/isa-l/crc/crc32_gzip_refl_by8.asm
+++ b/src/isa-l/crc/crc32_gzip_refl_by8.asm
+@@ -622,3 +622,12 @@ dq 0x0706050403020100, 0x000e0d0c0b0a0908
+ 
+ ;;;       func        core, ver, snum
+ slversion crc32_gzip_refl_by8, 01,   00,  002c
+
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/isa-l/crc/crc32_gzip_refl_by8_02.asm b/src/isa-l/crc/crc32_gzip_refl_by8_02.asm
+index 80d849e..1d5a75f 100644
+--- a/src/isa-l/crc/crc32_gzip_refl_by8_02.asm
+++ b/src/isa-l/crc/crc32_gzip_refl_by8_02.asm
+@@ -553,3 +553,12 @@ pshufb_shf_table:
+ ;       dq 0x060504030201008f, 0x0e0d0c0b0a090807 ; shl 1  (16-15) / shr15
+ dq 0x8786858483828100, 0x8f8e8d8c8b8a8988
+ dq 0x0706050403020100, 0x000e0d0c0b0a0908
+
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/isa-l/crc/crc32_ieee_01.asm b/src/isa-l/crc/crc32_ieee_01.asm
+index 32495ed..cfc443b 100644
+--- a/src/isa-l/crc/crc32_ieee_01.asm
+++ b/src/isa-l/crc/crc32_ieee_01.asm
+@@ -653,3 +653,11 @@ dq 0x0706050403020100, 0x000e0d0c0b0a0908
+ ;;;       func        core, ver, snum
+ slversion crc32_ieee_01, 01,   06,  0011
+ 
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/isa-l/crc/crc32_ieee_02.asm b/src/isa-l/crc/crc32_ieee_02.asm
+index 8a472b0..dd7096a 100644
+--- a/src/isa-l/crc/crc32_ieee_02.asm
+++ b/src/isa-l/crc/crc32_ieee_02.asm
+@@ -649,3 +649,12 @@ pshufb_shf_table:
+ ;	dq 0x060504030201008f, 0x0e0d0c0b0a090807 ; shl 1  (16-15) / shr15
+ dq 0x8786858483828100, 0x8f8e8d8c8b8a8988
+ dq 0x0706050403020100, 0x000e0d0c0b0a0908
+
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/isa-l/crc/crc32_ieee_by16_10.asm b/src/isa-l/crc/crc32_ieee_by16_10.asm
+index 200fd93..2afd597 100644
+--- a/src/isa-l/crc/crc32_ieee_by16_10.asm
+++ b/src/isa-l/crc/crc32_ieee_by16_10.asm
+@@ -582,3 +582,12 @@ global no_ %+ FUNCTION_NAME
+ no_ %+ FUNCTION_NAME %+ :
+ %endif
+ %endif ; (AS_FEATURE_LEVEL) >= 10
+
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/isa-l/crc/crc32_ieee_by4.asm b/src/isa-l/crc/crc32_ieee_by4.asm
+index 39bed5a..847d0bd 100644
+--- a/src/isa-l/crc/crc32_ieee_by4.asm
+++ b/src/isa-l/crc/crc32_ieee_by4.asm
+@@ -563,3 +563,12 @@ SHUF_MASK	dq 0x08090A0B0C0D0E0F, 0x0001020304050607
+ 
+ ;;;       func             core, ver, snum
+ slversion crc32_ieee_by4, 05,   02,  0017
+
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/isa-l/crc/crc32_iscsi_00.asm b/src/isa-l/crc/crc32_iscsi_00.asm
+index 4f81e3a..3d6b2d1 100644
+--- a/src/isa-l/crc/crc32_iscsi_00.asm
+++ b/src/isa-l/crc/crc32_iscsi_00.asm
+@@ -669,3 +669,11 @@ DD 0x54851c7f,0x89e3d7c4,0xeba4fdf8,0x36c23643
+ ;;;       func            core, ver, snum
+ slversion crc32_iscsi_00, 00,   04,  0014
+ 
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/isa-l/crc/crc32_iscsi_01.asm b/src/isa-l/crc/crc32_iscsi_01.asm
+index 2a81517..c048413 100644
+--- a/src/isa-l/crc/crc32_iscsi_01.asm
+++ b/src/isa-l/crc/crc32_iscsi_01.asm
+@@ -588,3 +588,11 @@ K_table:
+ ;;;       func            core, ver, snum
+ slversion crc32_iscsi_01, 01,   04,  0015
+ 
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+-- 
+2.34.1
+
@@ -0,0 +1,100 @@
+From 72e6d27e08c86c16e8931739a5e6ecbc06b102d5 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Thu, 20 Jan 2022 05:40:56 -0800
+Subject: [PATCH] spdk/isa-l/CET: Add CET marker to x86-64 crc32 assembly codes
+
+Add .note.gnu.property section to x86-64 crc32 assembly codes to mark
+for IBT and SHSTK compatibility.
+---
+ crc/crc32_gzip_refl_by8.asm | 9 +++++++++
+ crc/crc32_ieee_01.asm       | 8 ++++++++
+ crc/crc32_ieee_by4.asm      | 9 +++++++++
+ crc/crc32_iscsi_00.asm      | 8 ++++++++
+ crc/crc32_iscsi_01.asm      | 8 ++++++++
+ 5 files changed, 42 insertions(+)
+
+diff --git a/src/spdk/isa-l/crc/crc32_gzip_refl_by8.asm b/src/spdk/isa-l/crc/crc32_gzip_refl_by8.asm
+index 62f7e7d..97b0c4a 100644
+--- a/src/spdk/isa-l/crc/crc32_gzip_refl_by8.asm
+++ b/src/spdk/isa-l/crc/crc32_gzip_refl_by8.asm
+@@ -622,3 +622,12 @@ dq 0x0706050403020100, 0x000e0d0c0b0a0908
+ 
+ ;;;       func        core, ver, snum
+ slversion crc32_gzip_refl_by8, 01,   00,  002c
+
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/spdk/isa-l/crc/crc32_ieee_01.asm b/src/spdk/isa-l/crc/crc32_ieee_01.asm
+index 32495ed..cfc443b 100644
+--- a/src/spdk/isa-l/crc/crc32_ieee_01.asm
+++ b/src/spdk/isa-l/crc/crc32_ieee_01.asm
+@@ -653,3 +653,11 @@ dq 0x0706050403020100, 0x000e0d0c0b0a0908
+ ;;;       func        core, ver, snum
+ slversion crc32_ieee_01, 01,   06,  0011
+ 
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/spdk/isa-l/crc/crc32_ieee_by4.asm b/src/spdk/isa-l/crc/crc32_ieee_by4.asm
+index 39bed5a..847d0bd 100644
+--- a/src/spdk/isa-l/crc/crc32_ieee_by4.asm
+++ b/src/spdk/isa-l/crc/crc32_ieee_by4.asm
+@@ -563,3 +563,12 @@ SHUF_MASK	dq 0x08090A0B0C0D0E0F, 0x0001020304050607
+ 
+ ;;;       func             core, ver, snum
+ slversion crc32_ieee_by4, 05,   02,  0017
+
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/spdk/isa-l/crc/crc32_iscsi_00.asm b/src/spdk/isa-l/crc/crc32_iscsi_00.asm
+index 4f81e3a..3d6b2d1 100644
+--- a/src/spdk/isa-l/crc/crc32_iscsi_00.asm
+++ b/src/spdk/isa-l/crc/crc32_iscsi_00.asm
+@@ -669,3 +669,11 @@ DD 0x54851c7f,0x89e3d7c4,0xeba4fdf8,0x36c23643
+ ;;;       func            core, ver, snum
+ slversion crc32_iscsi_00, 00,   04,  0014
+ 
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+diff --git a/src/spdk/isa-l/crc/crc32_iscsi_01.asm b/src/spdk/isa-l/crc/crc32_iscsi_01.asm
+index 2a81517..c048413 100644
+--- a/src/spdk/isa-l/crc/crc32_iscsi_01.asm
+++ b/src/spdk/isa-l/crc/crc32_iscsi_01.asm
+@@ -588,3 +588,11 @@ K_table:
+ ;;;       func            core, ver, snum
+ slversion crc32_iscsi_01, 01,   04,  0015
+ 
+%ifidn __OUTPUT_FORMAT__, elf64
+; inform linker that this doesn't require executable stack
+section .note.GNU-stack noalloc noexec nowrite progbits
+; inform linker that this is compatible with IBT and SHSTK
+section .note.gnu.property  note  alloc noexec align=8
+DD 0x00000004,0x00000010,0x00000005,0x00554e47
+DD 0xc0000002,0x00000004,0x00000003,0x00000000
+%endif
+-- 
+2.34.1
+
@@ -0,0 +1,23 @@
+--- ceph-16.2.6-681-gfdc003bc/src/tracing/bluestore.tp.orig	2021-12-07 08:02:04.682972474 -0500
+++ ceph-16.2.6-681-gfdc003bc/src/tracing/bluestore.tp	2021-12-07 08:03:13.840771852 -0500
+@@ -1,3 +1,9 @@
+
+#ifdef __x86_64__
+#undef STAP_SDT_ARG_CONSTRAINT
+#define STAP_SDT_ARG_CONSTRAINT norx
+#endif
+
+ #include "include/int_types.h"
+ 
+ TRACEPOINT_EVENT(bluestore, transaction_state_duration,
+--- ceph-16.2.6-681-gfdc003bc/src/tracing/librbd.tp.orig	2021-12-07 09:50:16.467579483 -0500
+++ ceph-16.2.6-681-gfdc003bc/src/tracing/librbd.tp	2021-12-07 09:50:47.620026940 -0500
+@@ -1,3 +1,8 @@
+#ifdef __x86_64__
+#undef STAP_SDT_ARG_CONSTRAINT
+#define STAP_SDT_ARG_CONSTRAINT norx
+#endif
+
+ #include "tracing/tracing-common.h"
+ #include "include/rbd/librbd.h"
+ #include "include/int_types.h"
@@ -0,0 +1,19 @@
+--- ceph-18.0.0-3078-gc4847bf8/src/rgw/driver/dbstore/CMakeLists.txt.orig	2023-05-10 08:23:50.000000000 -0400
+++ ceph-18.0.0-3078-gc4847bf8/src/rgw/driver/dbstore/CMakeLists.txt	2023-05-11 08:21:13.794152904 -0400
+@@ -24,7 +24,7 @@
+     dbstore_mgr.cc
+     )
+ 
+-add_library(dbstore_lib ${dbstore_srcs})
+add_library(dbstore_lib STATIC ${dbstore_srcs})
+ target_include_directories(dbstore_lib
+     PUBLIC "${CMAKE_SOURCE_DIR}/src/rgw"
+     PUBLIC "${CMAKE_SOURCE_DIR}/src/rgw/store/rados"
+@@ -49,6 +49,7 @@
+ 
+ # add pthread library
+ set (CMAKE_LINK_LIBRARIES ${CMAKE_LINK_LIBRARIES} pthread)
+set (CMAKE_LINK_LIBRARIES ${CMAKE_LINK_LIBRARIES} global)
+ 
+ find_package(gtest QUIET)
+ if(WITH_TESTS)
@@ -0,0 +1,42 @@
+--- ceph-18.1.2/src/common/subsys_types.h.orig	2023-06-27 15:59:59.000000000 -0400
+++ ceph-18.1.2/src/common/subsys_types.h	2023-07-04 19:36:55.941238973 -0400
+@@ -54,7 +54,7 @@
+ #undef DEFAULT_SUBSYS
+ }
+ 
+-constexpr static std::uint8_t
+constexpr static uint8_t
+ ceph_subsys_get_max_default_level(const std::size_t subidx) {
+   const auto item = ceph_subsys_get_as_array()[subidx];
+   return std::max(item.log_level, item.gather_level);
+--- ceph-18.1.2/src/msg/async/crypto_onwire.h.orig	2023-06-27 15:59:59.000000000 -0400
+++ ceph-18.1.2/src/msg/async/crypto_onwire.h	2023-07-04 19:36:55.957238704 -0400
+@@ -95,7 +95,7 @@
+   // Transmitter can append extra bytes of ciphertext at the -final step.
+   // This method return how much was added, and thus let client translate
+   // plaintext size into ciphertext size to grab from wire.
+-  virtual std::uint32_t get_extra_size_at_final() = 0;
+  virtual uint32_t get_extra_size_at_final() = 0;
+ 
+   // Instance of RxHandler must be reset before doing any decrypt-update
+   // step. This applies also to situation when decrypt-final was already
+--- ceph-18.1.2/src/rocksdb/table/block_based/data_block_hash_index.h.orig	2023-05-24 15:55:23.000000000 -0400
+++ ceph-18.1.2/src/rocksdb/table/block_based/data_block_hash_index.h	2023-07-04 19:36:55.971238469 -0400
+@@ -8,6 +8,7 @@
+ #include <cstdint>
+ #include <string>
+ #include <vector>
+#include <cstdint>
+ 
+ #include "rocksdb/slice.h"
+ 
+--- ceph-18.1.2/src/rocksdb/util/string_util.h.orig	2023-05-24 15:55:23.000000000 -0400
+++ ceph-18.1.2/src/rocksdb/util/string_util.h	2023-07-04 19:36:55.991238133 -0400
+@@ -11,6 +11,7 @@
+ #include <string>
+ #include <unordered_map>
+ #include <vector>
+#include <cstdint>
+ 
+ #include "rocksdb/rocksdb_namespace.h"
+ 
@@ -0,0 +1,17 @@
+--- ceph-18.0.0-2726-g7cea3740/src/rgw/rgw_amqp.cc.orig	2023-03-14 18:22:35.636864260 -0400
+++ ceph-18.0.0-2726-g7cea3740/src/rgw/rgw_amqp.cc	2023-03-14 18:24:36.362756771 -0400
+@@ -2,10 +2,10 @@
+ // vim: ts=8 sw=2 smarttab ft=cpp
+ 
+ #include "rgw_amqp.h"
+-#include <amqp.h>
+-#include <amqp_ssl_socket.h>
+-#include <amqp_tcp_socket.h>
+-#include <amqp_framing.h>
+#include <rabbitmq-c/amqp.h>
+#include <rabbitmq-c/ssl_socket.h>
+#include <rabbitmq-c/tcp_socket.h>
+#include <rabbitmq-c/framing.h>
+ #include "include/ceph_assert.h"
+ #include <sstream>
+ #include <cstring>
@@ -0,0 +1,24 @@
+--- ceph-18.0.0-2950-g1c931bc4/cmake/modules/BuildBoost.cmake.orig	2023-04-28 18:30:19.133064577 -0400
+++ ceph-18.0.0-2950-g1c931bc4/cmake/modules/BuildBoost.cmake	2023-04-28 18:31:55.290354383 -0400
+@@ -104,12 +104,21 @@
+   set(user_config ${CMAKE_BINARY_DIR}/user-config.jam)
+   # edit the user-config.jam so b2 will be able to use the specified
+   # toolset and python
+if(CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64")
+  file(WRITE ${user_config}
+    "using ${toolset}"
+    " : "
+    " : ${CMAKE_CXX_COMPILER}"
+    " : <compileflags>-fPIC <compileflags>-w <compileflags>-fcf-protection <compileflags>-Wno-everything" 
+    " ;\n")
+else()
+   file(WRITE ${user_config}
+     "using ${toolset}"
+     " : "
+     " : ${CMAKE_CXX_COMPILER}"
+     " : <compileflags>-fPIC <compileflags>-w <compileflags>-Wno-everything"
+     " ;\n")
+endif()
+   if(with_python_version)
+     find_package(Python3 ${with_python_version} QUIET REQUIRED
+       COMPONENTS Development)
@@ -0,0 +1,61 @@
+--- ceph-17.2.6/src/boost/libs/context/src/asm/make_x86_64_sysv_elf_gas.S.orig	2023-04-30 14:25:35.009605033 -0400
+++ ceph-17.2.6/src/boost/libs/context/src/asm/make_x86_64_sysv_elf_gas.S	2023-04-30 14:28:32.239465067 -0400
+@@ -80,3 +80,18 @@
+ 
+ /* Mark that we don't need executable stack. */
+ .section .note.GNU-stack,"",%progbits
+
+.section .note.gnu.property
+.align=8
+
+        .byte 0x04, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x00, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x01, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x04, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x02, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+
+--- ceph-17.2.6/src/boost/libs/context/src/asm/jump_x86_64_sysv_elf_gas.S.orig	2023-04-30 14:25:35.008605050 -0400
+++ ceph-17.2.6/src/boost/libs/context/src/asm/jump_x86_64_sysv_elf_gas.S	2023-04-30 14:27:50.145210847 -0400
+@@ -89,3 +89,17 @@
+ 
+ /* Mark that we don't need executable stack.  */
+ .section .note.GNU-stack,"",%progbits
+
+.section .note.gnu.property
+.align=8
+
+        .byte 0x04, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x00, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x01, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x04, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x02, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+--- ceph-17.2.6/src/boost/libs/context/src/asm/ontop_x86_64_sysv_elf_gas.S.orig	2023-04-30 14:25:35.009605033 -0400
+++ ceph-17.2.6/src/boost/libs/context/src/asm/ontop_x86_64_sysv_elf_gas.S	2023-04-30 14:29:30.402434597 -0400
+@@ -92,3 +92,17 @@
+ 
+ /* Mark that we don't need executable stack.  */
+ .section .note.GNU-stack,"",%progbits
+
+.section .note.gnu.property
+.align=8
+
+        .byte 0x04, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x00, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x01, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+        .byte 0x04, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00
+        .byte 0x05, 0x00, 0x00, 0x00, 0x47, 0x4E, 0x55, 0x00
+        .byte 0x02, 0x00, 0x00, 0xC0, 0x04, 0x00, 0x00, 0x00
+        .byte 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
@@ -0,0 +1,24 @@
+--- ceph-18.1.2/src/pybind/rbd/rbd.pyx.orig	2023-07-21 13:30:08.156825317 -0400
+++ ceph-18.1.2/src/pybind/rbd/rbd.pyx	2023-07-24 09:09:27.930137117 -0400
+@@ -371,10 +371,10 @@
+     cdef rados_ioctx_t convert_ioctx(rados.Ioctx ioctx) except? NULL:
+         return <rados_ioctx_t>ioctx.io
+ 
+-cdef int progress_callback(uint64_t offset, uint64_t total, void* ptr) with gil:
+cdef int progress_callback(uint64_t offset, uint64_t total, void* ptr) noexcept with gil:
+     return (<object>ptr)(offset, total)
+ 
+-cdef int no_op_progress_callback(uint64_t offset, uint64_t total, void* ptr):
+cdef int no_op_progress_callback(uint64_t offset, uint64_t total, void* ptr) noexcept:
+     return 0
+ 
+ def cstr(val, name, encoding="utf-8", opt=False):
+@@ -426,7 +426,7 @@
+ 
+ cdef class Completion
+ 
+-cdef void __aio_complete_cb(rbd_completion_t completion, void *args) with gil:
+cdef void __aio_complete_cb(rbd_completion_t completion, void *args) noexcept with gil:
+     """
+     Callback to oncomplete() for asynchronous operations
+     """
@@ -0,0 +1,18 @@
+--- ceph/src/CMakeLists.txt.orig	2023-11-01 11:53:53.618167190 -0400
+++ ceph/src/CMakeLists.txt	2023-11-01 13:52:51.292643490 -0400
+@@ -625,6 +625,7 @@
+ add_subdirectory(perfglue)
+ 
+ add_library(rados_snap_set_diff_obj OBJECT librados/snap_set_diff.cc)
+add_dependencies(rados_snap_set_diff_obj legacy-option-headers)
+ 
+ option(WITH_LIBRADOSSTRIPER "build with libradosstriper support" ON)
+ 
+@@ -881,6 +882,7 @@
+     add_library(krbd STATIC krbd.cc
+       $<TARGET_OBJECTS:parse_secret_objs>)
+     target_link_libraries(krbd keyutils::keyutils)
+    add_dependencies(krbd legacy-option-headers)
+   endif()
+   add_subdirectory(librbd)
+   if(WITH_FUSE)
@@ -0,0 +1,41 @@
+From f5d3e9146d9ceb12858bc94d60090bd851b1c088 Mon Sep 17 00:00:00 2001
+From: Adam Emerson <aemerson@redhat.com>
+Date: Wed, 20 Dec 2023 13:51:21 -0500
+Subject: [PATCH] test/neorados: Use two fewer GTest internals
+
+To get coroutine tests working, I used some internals. Two of these
+are no longer available in newer versions. Since they can be
+implemented with regular old C++ features, use those.
+
+This fixes an FTBFS on Fedora Rawhide introduced in
+`35231f7251ed70d8d817ee7e727d9763669d101f`.
+
+Signed-off-by: Adam Emerson <aemerson@redhat.com>
+---
+ src/test/neorados/common_tests.h | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/src/test/neorados/common_tests.h b/src/test/neorados/common_tests.h
+index 9610f08f643f3..396432e417e84 100644
+--- a/src/test/neorados/common_tests.h
+++ b/src/test/neorados/common_tests.h
+@@ -391,10 +391,14 @@ class NeoRadosECTest : public NeoRadosTestBase {
+   public:                                                                      \
+     GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)() = default;            \
+     ~GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)() override = default;  \
+-    GTEST_DISALLOW_COPY_AND_ASSIGN_(GTEST_TEST_CLASS_NAME_(test_suite_name,    \
+-							   test_name));        \
+-    GTEST_DISALLOW_MOVE_AND_ASSIGN_(GTEST_TEST_CLASS_NAME_(test_suite_name,    \
+-							   test_name));        \
+    GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)(			       \
+      const GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)&) = delete;     \
+    GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)& operator =(	       \
+      const GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)&) = delete;     \
+    GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)(			       \
+      GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)&&) = delete;	       \
+    GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)& operator =(	       \
+      GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)&&) = delete;	       \
+ 									       \
+   private:                                                                     \
+     boost::asio::awaitable<void> CoTestBody() override;                        \
+
@@ -0,0 +1,19 @@
+--- ceph-18.2.3/src/mgr/PyModule.cc.orig	2024-06-06 16:31:10.340731851 -0400
+++ ceph-18.2.3/src/mgr/PyModule.cc	2024-06-07 12:58:49.913571410 -0400
+@@ -342,6 +342,16 @@
+   return ceph_module;
+ }
+ 
+// FIXME
+// Removed in Python 3.13 API, but kept for the stable ABI
+#ifdef __cplusplus
+extern "C" {
+#endif
+PyAPI_FUNC(void) PySys_SetPath(const wchar_t *);
+#ifdef __cplusplus
+}
+#endif
+
+ int PyModule::load(PyThreadState *pMainThreadState)
+ {
+   ceph_assert(pMainThreadState != nullptr);
@@ -0,0 +1,15 @@
+--- ceph-19.1.0/src/common/crc32c_ppc_asm.S.orig	2024-07-10 10:55:06.255480790 -0400
+++ ceph-19.1.0/src/common/crc32c_ppc_asm.S	2024-07-10 12:53:42.844075490 -0400
+@@ -54,11 +54,8 @@
+ 	/* byte reverse permute constant */
+ 	.octa 0x0F0E0D0C0B0A09080706050403020100
+ 
+-#ifdef CRC32_CONSTANTS_HEADER
+-#include CRC32_CONSTANTS_HEADER
+-#else
+#define __ASSEMBLY__
+ #include "crc32c_ppc_constants.h"
+-#endif
+ 
+ 	.text
+ 
@@ -0,0 +1,21 @@
+--- ceph-19.1.0/src/cpp_redis/CMakeLists.txt.orig	2024-07-11 15:16:22.487082035 -0400
+++ ceph-19.1.0/src/cpp_redis/CMakeLists.txt	2024-07-11 15:17:57.226534456 -0400
+@@ -174,6 +174,7 @@
+   set_target_properties(${PROJECT} PROPERTIES COMPILE_DEFINITIONS "__CPP_REDIS_USE_CUSTOM_TCP_CLIENT=${USE_CUSTOM_TCP_CLIENT}")
+ endif(USE_CUSTOM_TCP_CLIENT)
+ 
+install(TARGETS ${PROJECT} DESTINATION ${CMAKE_INSTALL_LIBDIR}/ceph)
+ 
+ ###
+ # examples
+--- ceph-19.1.0/src/cpp_redis/tacopie/CMakeLists.txt.orig	2024-01-30 21:47:59.000000000 -0500
+++ ceph-19.1.0/src/cpp_redis/tacopie/CMakeLists.txt	2024-07-12 07:37:23.584654640 -0400
+@@ -162,6 +162,8 @@
+ ENDIF(SELECT_TIMEOUT)
+ 
+ 
+install(TARGETS ${PROJECT} DESTINATION ${CMAKE_INSTALL_LIBDIR}/ceph)
+
+ ###
+ # examples
+ ###
@@ -0,0 +1,28 @@
+--- ceph-19.1.0/src/common/crc32c_ppc_fast_zero_asm.S.orig	2024-07-26 07:18:50.733484175 -0400
+++ ceph-19.1.0/src/common/crc32c_ppc_fast_zero_asm.S	2024-07-26 07:17:48.449531183 -0400
+@@ -45,8 +45,10 @@
+ 
+ /* unsigned int barrett_reduction(unsigned long val) */
+ FUNC_START(barrett_reduction)
+-	lis	r4,.constants@ha
+-	la	r4,.constants@l(r4)
+/*	lis	r4,.constants@ha      */
+/*	la	r4,.constants@l(r4)   */
+	addis	r4,r4,.constants@toc@ha
+	addi	r4,r4,.constants@toc@l
+ 
+ 	li	r5,16
+ 	vxor	v1,v1,v1	/* zero v1 */
+@@ -83,8 +85,10 @@
+ 
+ /* unsigned int barrett_reduction_reflected(unsigned long val) */
+ FUNC_START(barrett_reduction_reflected)
+-	lis	r4,.bit_reflected_constants@ha
+-	la	r4,.bit_reflected_constants@l(r4)
+/*	lis	r4,.bit_reflected_constants@ha      */
+/*	la	r4,.bit_reflected_constants@l(r4)   */
+	addis	r4,r4,.bit_reflected_constants@toc@ha
+	addi	r4,r4,.bit_reflected_constants@toc@l
+ 
+ 	li	r5,16
+ 	vxor	v1,v1,v1	/* zero v1 */
@@ -0,0 +1,55 @@
+diff --git a/src/common/openssl_opts_handler.cc b/src/common/openssl_opts_handler.cc
+index 81d0c4786..d9866f197 100644
+--- a/src/common/openssl_opts_handler.cc
+++ b/src/common/openssl_opts_handler.cc
+@@ -16,7 +16,10 @@
+ 
+ #include <openssl/bio.h>
+ #include <openssl/conf.h>
+#include <openssl/err.h>
+#ifndef OPENSSL_NO_ENGINE
+ #include <openssl/engine.h>
+#endif
+ #include <mutex>
+ #include <vector>
+ #include <algorithm>
+@@ -116,11 +119,13 @@ void load_module(const string &engine_conf)
+ #pragma GCC diagnostic push
+ #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+ 
+#ifndef OPENSSL_NO_ENGINE
+ #pragma clang diagnostic push
+ #pragma clang diagnostic ignored "-Wdeprecated-declarations"
+   ENGINE_load_builtin_engines();
+ #pragma clang diagnostic pop
+ #pragma GCC diagnostic pop
+#endif
+ 
+   if (CONF_modules_load(
+           conf, nullptr,
+diff --git a/src/crypto/openssl/openssl_crypto_accel.cc b/src/crypto/openssl/openssl_crypto_accel.cc
+index f99844a38..4944205dd 100644
+--- a/src/crypto/openssl/openssl_crypto_accel.cc
+++ b/src/crypto/openssl/openssl_crypto_accel.cc
+@@ -14,7 +14,6 @@
+ 
+ #include "crypto/openssl/openssl_crypto_accel.h"
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
+ #include "common/debug.h"
+ 
+ // -----------------------------------------------------------------------------
+diff --git a/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/civetweb.c b/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/civetweb.c
+index fea9e6f98..c7eddb20b 100644
+--- a/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/civetweb.c
+++ b/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/civetweb.c
+@@ -1744,7 +1744,9 @@ typedef struct SSL_CTX SSL_CTX;
+ #include <openssl/conf.h>
+ #include <openssl/crypto.h>
+ #include <openssl/dh.h>
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L)
+ #include <openssl/engine.h>
+#endif
+ #include <openssl/err.h>
+ #include <openssl/opensslv.h>
+ #include <openssl/pem.h>
@@ -0,0 +1,16 @@
+--- ceph-19.2.0/src/mds/CMakeLists.txt.orig	2024-12-20 17:15:47.632569537 -0500
+++ ceph-19.2.0/src/mds/CMakeLists.txt	2024-12-20 17:16:48.945481957 -0500
+@@ -45,12 +45,11 @@
+   QuiesceDbManager.cc
+   QuiesceAgent.cc
+   MDSRankQuiesce.cc
+-  BoostUrlImpl.cc
+   ${CMAKE_SOURCE_DIR}/src/common/TrackedOp.cc
+   ${CMAKE_SOURCE_DIR}/src/common/MemoryModel.cc
+   ${CMAKE_SOURCE_DIR}/src/osdc/Journaler.cc
+   ${CMAKE_SOURCE_DIR}/src/mgr/MDSPerfMetricTypes.cc)
+ add_library(mds STATIC ${mds_srcs})
+ target_link_libraries(mds PRIVATE
+-  heap_profiler cpu_profiler osdc ${LUA_LIBRARIES})
+  boost_url heap_profiler cpu_profiler osdc ${LUA_LIBRARIES})
+ target_include_directories(mds PRIVATE "${LUA_INCLUDE_DIR}")
@@ -0,0 +1,20 @@
+--- ceph-19.2.0/src/rocksdb/db/blob/blob_file_meta.h.orig	2025-01-16 08:16:41.762758595 -0500
+++ ceph-19.2.0/src/rocksdb/db/blob/blob_file_meta.h	2025-01-16 08:17:37.172784779 -0500
+@@ -10,6 +10,7 @@
+ #include <memory>
+ #include <string>
+ #include <unordered_set>
+#include <cstdint>
+ 
+ #include "rocksdb/rocksdb_namespace.h"
+ 
+--- ceph-19.2.0/src/rocksdb/include/rocksdb/trace_record.h.orig	2025-01-16 09:04:19.196962397 -0500
+++ ceph-19.2.0/src/rocksdb/include/rocksdb/trace_record.h	2025-01-16 09:04:33.885701684 -0500
+@@ -8,6 +8,7 @@
+ #include <memory>
+ #include <string>
+ #include <vector>
+#include <cstdint>
+ 
+ #include "rocksdb/rocksdb_namespace.h"
+ #include "rocksdb/slice.h"
@@ -0,0 +1,257 @@
+--- ceph-19.2.0/src/rgw/driver/posix/zpp_bits.h.orig	2024-09-18 12:27:51.000000000 -0400
+++ ceph-19.2.0/src/rgw/driver/posix/zpp_bits.h	2025-01-16 14:58:48.471438398 -0500
+@@ -2687,8 +2687,12 @@
+     {
+         using type = std::remove_cvref_t<decltype(container)>;
+         using value_type = typename type::value_type;
+-        constexpr auto is_const = std::is_const_v<
+-            std::remove_reference_t<decltype(container[0])>>;
+        constexpr auto is_const =
+            std::is_const_v<std::remove_reference_t<value_type>> ||
+            requires {
+                requires std::is_const_v<
+                    std::remove_reference_t<decltype(container[0])>>;
+            };
+ 
+         if constexpr (!std::is_void_v<SizeType> &&
+                       (requires(type container) { container.resize(1); } ||
+@@ -2827,9 +2831,7 @@
+             if constexpr (requires { typename type::mapped_type; }) {
+                 using value_type = std::pair<typename type::key_type,
+                                              typename type::mapped_type>;
+-                std::aligned_storage_t<sizeof(value_type),
+-                                       alignof(value_type)>
+-                    storage;
+                alignas(value_type) std::byte storage[sizeof(value_type)];
+ 
+                 auto object = access::placement_new<value_type>(
+                     std::addressof(storage));
+@@ -2843,9 +2845,7 @@
+             } else {
+                 using value_type = typename type::value_type;
+ 
+-                std::aligned_storage_t<sizeof(value_type),
+-                                       alignof(value_type)>
+-                    storage;
+                alignas(value_type) std::byte storage[sizeof(value_type)];
+ 
+                 auto object = access::placement_new<value_type>(
+                     std::addressof(storage));
+@@ -2903,8 +2903,7 @@
+                 return result;
+             }
+         } else {
+-            std::aligned_storage_t<sizeof(value_type), alignof(value_type)>
+-                storage;
+            alignas(value_type) std::byte storage[sizeof(value_type)];
+ 
+             auto object =
+                 access::placement_new<value_type>(std::addressof(storage));
+@@ -2947,9 +2946,7 @@
+                 }
+                 return serialize_one(*std::get_if<element_type>(&variant));
+             } else {
+-                std::aligned_storage_t<sizeof(element_type),
+-                                       alignof(element_type)>
+-                    storage;
+                alignas(element_type) std::byte storage[sizeof(element_type)];
+ 
+                 auto object = access::placement_new<element_type>(
+                     std::addressof(storage));
+@@ -2996,8 +2993,7 @@
+                     return self.serialize_one(
+                         *std::get_if<Types>(&variant));
+                 } else {
+-                    std::aligned_storage_t<sizeof(Types), alignof(Types)>
+-                        storage;
+                    alignas(Types) std::byte storage[sizeof(Types)];
+ 
+                     auto object = access::placement_new<Types>(
+                         std::addressof(storage));
+@@ -3008,6 +3004,7 @@
+                         return result;
+                     }
+                     variant = std::move(*object);
+                    return errc{};
+                 }
+             }...};
+ 
+@@ -3307,7 +3304,7 @@
+     ZPP_BITS_INLINE constexpr static auto serialize(auto & serializer,
+                                                     auto & self)
+     {
+-        return serializer.template serialize_one(self.variant, self.id);
+        return serializer.serialize_one(self.variant, self.id);
+     }
+ 
+     Variant & variant;
+@@ -3448,13 +3445,14 @@
+     }
+ 
+     constexpr explicit value_or_errc(error_type error) :
+-        m_error(std::forward<decltype(error)>(error))
+        m_error(std::forward<decltype(error)>(error)),
+        m_failure(true)
+     {
+     }
+ 
+     constexpr value_or_errc(value_or_errc && other) noexcept
+     {
+-        if (other.is_value()) {
+        if (other.success()) {
+             if constexpr (!std::is_void_v<Type>) {
+                 if constexpr (!std::is_reference_v<Type>) {
+                     ::new (std::addressof(m_return_value))
+@@ -3752,16 +3750,16 @@
+                 requires(decltype(in.remaining_data()) & data) {
+                     (context.*Function)(data);
+                 }) {
+-                struct _
+                struct guard
+                 {
+                     decltype(in) archive;
+                     decltype(in.remaining_data()) data;
+-                    constexpr ~_()
+                    constexpr ~guard()
+                     {
+                         archive.position() += data.size();
+                     }
+-                } _{in, in.remaining_data()};
+-                return (context.*Function)(_.data);
+                } guard{in, in.remaining_data()};
+                return (context.*Function)(guard.data);
+             } else {
+                 return (context.*Function)();
+             }
+@@ -3776,16 +3774,16 @@
+                 requires(decltype(in.remaining_data()) & data) {
+                     Function(data);
+                 }) {
+-                struct _
+                struct guard
+                 {
+                     decltype(in) archive;
+                     decltype(in.remaining_data()) data;
+-                    constexpr ~_()
+                    constexpr ~guard()
+                     {
+                         archive.position() += data.size();
+                     }
+-                } _{in, in.remaining_data()};
+-                return Function(_.data);
+                } guard{in, in.remaining_data()};
+                return Function(guard.data);
+             } else {
+                 return Function();
+             }
+@@ -5029,9 +5027,7 @@
+                 serialize use();
+             };
+ 
+-            std::aligned_storage_t<sizeof(value_type),
+-                                   alignof(value_type)>
+-                storage;
+            alignas(value_type) std::byte storage[sizeof(value_type)];
+ 
+             auto object =
+                 access::placement_new<value_type>(std::addressof(storage));
+@@ -5111,9 +5107,7 @@
+                     return errc{};
+                 }
+             } else {
+-                std::aligned_storage_t<sizeof(value_type),
+-                                       alignof(value_type)>
+-                    storage;
+                alignas(value_type) std::byte storage[sizeof(value_type)];
+ 
+                 auto object = access::placement_new<value_type>(
+                     std::addressof(storage));
+@@ -5382,47 +5376,47 @@
+     };
+     auto align = [](auto v, auto a) { return (v + (a - 1)) / a * a; };
+ 
+-    auto h0 = big_endian{0x6a09e667u};
+-    auto h1 = big_endian{0xbb67ae85u};
+-    auto h2 = big_endian{0x3c6ef372u};
+-    auto h3 = big_endian{0xa54ff53au};
+-    auto h4 = big_endian{0x510e527fu};
+-    auto h5 = big_endian{0x9b05688cu};
+-    auto h6 = big_endian{0x1f83d9abu};
+-    auto h7 = big_endian{0x5be0cd19u};
+-
+-    std::array k{big_endian{0x428a2f98u}, big_endian{0x71374491u},
+-                 big_endian{0xb5c0fbcfu}, big_endian{0xe9b5dba5u},
+-                 big_endian{0x3956c25bu}, big_endian{0x59f111f1u},
+-                 big_endian{0x923f82a4u}, big_endian{0xab1c5ed5u},
+-                 big_endian{0xd807aa98u}, big_endian{0x12835b01u},
+-                 big_endian{0x243185beu}, big_endian{0x550c7dc3u},
+-                 big_endian{0x72be5d74u}, big_endian{0x80deb1feu},
+-                 big_endian{0x9bdc06a7u}, big_endian{0xc19bf174u},
+-                 big_endian{0xe49b69c1u}, big_endian{0xefbe4786u},
+-                 big_endian{0x0fc19dc6u}, big_endian{0x240ca1ccu},
+-                 big_endian{0x2de92c6fu}, big_endian{0x4a7484aau},
+-                 big_endian{0x5cb0a9dcu}, big_endian{0x76f988dau},
+-                 big_endian{0x983e5152u}, big_endian{0xa831c66du},
+-                 big_endian{0xb00327c8u}, big_endian{0xbf597fc7u},
+-                 big_endian{0xc6e00bf3u}, big_endian{0xd5a79147u},
+-                 big_endian{0x06ca6351u}, big_endian{0x14292967u},
+-                 big_endian{0x27b70a85u}, big_endian{0x2e1b2138u},
+-                 big_endian{0x4d2c6dfcu}, big_endian{0x53380d13u},
+-                 big_endian{0x650a7354u}, big_endian{0x766a0abbu},
+-                 big_endian{0x81c2c92eu}, big_endian{0x92722c85u},
+-                 big_endian{0xa2bfe8a1u}, big_endian{0xa81a664bu},
+-                 big_endian{0xc24b8b70u}, big_endian{0xc76c51a3u},
+-                 big_endian{0xd192e819u}, big_endian{0xd6990624u},
+-                 big_endian{0xf40e3585u}, big_endian{0x106aa070u},
+-                 big_endian{0x19a4c116u}, big_endian{0x1e376c08u},
+-                 big_endian{0x2748774cu}, big_endian{0x34b0bcb5u},
+-                 big_endian{0x391c0cb3u}, big_endian{0x4ed8aa4au},
+-                 big_endian{0x5b9cca4fu}, big_endian{0x682e6ff3u},
+-                 big_endian{0x748f82eeu}, big_endian{0x78a5636fu},
+-                 big_endian{0x84c87814u}, big_endian{0x8cc70208u},
+-                 big_endian{0x90befffau}, big_endian{0xa4506cebu},
+-                 big_endian{0xbef9a3f7u}, big_endian{0xc67178f2u}};
+    auto h0 = big_endian{std::uint32_t{0x6a09e667u}};
+    auto h1 = big_endian{std::uint32_t{0xbb67ae85u}};
+    auto h2 = big_endian{std::uint32_t{0x3c6ef372u}};
+    auto h3 = big_endian{std::uint32_t{0xa54ff53au}};
+    auto h4 = big_endian{std::uint32_t{0x510e527fu}};
+    auto h5 = big_endian{std::uint32_t{0x9b05688cu}};
+    auto h6 = big_endian{std::uint32_t{0x1f83d9abu}};
+    auto h7 = big_endian{std::uint32_t{0x5be0cd19u}};
+
+    std::array k{big_endian{std::uint32_t{0x428a2f98u}}, big_endian{std::uint32_t{0x71374491u}},
+                 big_endian{std::uint32_t{0xb5c0fbcfu}}, big_endian{std::uint32_t{0xe9b5dba5u}},
+                 big_endian{std::uint32_t{0x3956c25bu}}, big_endian{std::uint32_t{0x59f111f1u}},
+                 big_endian{std::uint32_t{0x923f82a4u}}, big_endian{std::uint32_t{0xab1c5ed5u}},
+                 big_endian{std::uint32_t{0xd807aa98u}}, big_endian{std::uint32_t{0x12835b01u}},
+                 big_endian{std::uint32_t{0x243185beu}}, big_endian{std::uint32_t{0x550c7dc3u}},
+                 big_endian{std::uint32_t{0x72be5d74u}}, big_endian{std::uint32_t{0x80deb1feu}},
+                 big_endian{std::uint32_t{0x9bdc06a7u}}, big_endian{std::uint32_t{0xc19bf174u}},
+                 big_endian{std::uint32_t{0xe49b69c1u}}, big_endian{std::uint32_t{0xefbe4786u}},
+                 big_endian{std::uint32_t{0x0fc19dc6u}}, big_endian{std::uint32_t{0x240ca1ccu}},
+                 big_endian{std::uint32_t{0x2de92c6fu}}, big_endian{std::uint32_t{0x4a7484aau}},
+                 big_endian{std::uint32_t{0x5cb0a9dcu}}, big_endian{std::uint32_t{0x76f988dau}},
+                 big_endian{std::uint32_t{0x983e5152u}}, big_endian{std::uint32_t{0xa831c66du}},
+                 big_endian{std::uint32_t{0xb00327c8u}}, big_endian{std::uint32_t{0xbf597fc7u}},
+                 big_endian{std::uint32_t{0xc6e00bf3u}}, big_endian{std::uint32_t{0xd5a79147u}},
+                 big_endian{std::uint32_t{0x06ca6351u}}, big_endian{std::uint32_t{0x14292967u}},
+                 big_endian{std::uint32_t{0x27b70a85u}}, big_endian{std::uint32_t{0x2e1b2138u}},
+                 big_endian{std::uint32_t{0x4d2c6dfcu}}, big_endian{std::uint32_t{0x53380d13u}},
+                 big_endian{std::uint32_t{0x650a7354u}}, big_endian{std::uint32_t{0x766a0abbu}},
+                 big_endian{std::uint32_t{0x81c2c92eu}}, big_endian{std::uint32_t{0x92722c85u}},
+                 big_endian{std::uint32_t{0xa2bfe8a1u}}, big_endian{std::uint32_t{0xa81a664bu}},
+                 big_endian{std::uint32_t{0xc24b8b70u}}, big_endian{std::uint32_t{0xc76c51a3u}},
+                 big_endian{std::uint32_t{0xd192e819u}}, big_endian{std::uint32_t{0xd6990624u}},
+                 big_endian{std::uint32_t{0xf40e3585u}}, big_endian{std::uint32_t{0x106aa070u}},
+                 big_endian{std::uint32_t{0x19a4c116u}}, big_endian{std::uint32_t{0x1e376c08u}},
+                 big_endian{std::uint32_t{0x2748774cu}}, big_endian{std::uint32_t{0x34b0bcb5u}},
+                 big_endian{std::uint32_t{0x391c0cb3u}}, big_endian{std::uint32_t{0x4ed8aa4au}},
+                 big_endian{std::uint32_t{0x5b9cca4fu}}, big_endian{std::uint32_t{0x682e6ff3u}},
+                 big_endian{std::uint32_t{0x748f82eeu}}, big_endian{std::uint32_t{0x78a5636fu}},
+                 big_endian{std::uint32_t{0x84c87814u}}, big_endian{std::uint32_t{0x8cc70208u}},
+                 big_endian{std::uint32_t{0x90befffau}}, big_endian{std::uint32_t{0xa4506cebu}},
+                 big_endian{std::uint32_t{0xbef9a3f7u}}, big_endian{std::uint32_t{0xc67178f2u}}};
+ 
+     constexpr auto original_message = to_bytes<Object>();
+     constexpr auto chunk_size = 512 / CHAR_BIT;
@@ -0,0 +1,42 @@
+--- ceph-19.2.0/src/googletest/googletest/CMakeLists.txt.orig	2025-01-23 07:43:33.314970694 -0500
+++ ceph-19.2.0/src/googletest/googletest/CMakeLists.txt	2025-01-23 07:44:13.529250429 -0500
+@@ -63,6 +63,8 @@
+   set_up_hermetic_build()
+ endif()
+ 
+option(BUILD_SHARED_LIBS "Build shared libraries (DLLs)." OFF)
+
+ # These commands only run if this is the main project
+ if(CMAKE_PROJECT_NAME STREQUAL "gtest" OR CMAKE_PROJECT_NAME STREQUAL "googletest-distribution")
+ 
+@@ -126,9 +128,9 @@
+ # are used for other targets, to ensure that gtest can be compiled by a user
+ # aggressive about warnings.
+ cxx_library(gtest "${cxx_strict}" src/gtest-all.cc)
+-set_target_properties(gtest PROPERTIES VERSION ${GOOGLETEST_VERSION})
+#set_target_properties(gtest PROPERTIES VERSION ${GOOGLETEST_VERSION})
+ cxx_library(gtest_main "${cxx_strict}" src/gtest_main.cc)
+-set_target_properties(gtest_main PROPERTIES VERSION ${GOOGLETEST_VERSION})
+#set_target_properties(gtest_main PROPERTIES VERSION ${GOOGLETEST_VERSION})
+ # If the CMake version supports it, attach header directory information
+ # to the targets for when we are part of a parent build (ie being pulled
+ # in via add_subdirectory() rather than being a standalone build).
+--- ceph-19.2.0/src/googletest/googlemock/CMakeLists.txt.orig	2025-01-23 07:40:52.399853240 -0500
+++ ceph-19.2.0/src/googletest/googlemock/CMakeLists.txt	2025-01-23 07:43:18.466236642 -0500
+@@ -54,6 +54,7 @@
+ # if they are the same (the default).
+ add_subdirectory("${gtest_dir}" "${gmock_BINARY_DIR}/${gtest_dir}")
+ 
+option(BUILD_SHARED_LIBS "Build shared libraries (DLLs)." OFF)
+ 
+ # These commands only run if this is the main project
+ if(CMAKE_PROJECT_NAME STREQUAL "gmock" OR CMAKE_PROJECT_NAME STREQUAL "googletest-distribution")
+@@ -100,7 +101,7 @@
+ else()
+   cxx_library(gmock "${cxx_strict}" src/gmock-all.cc)
+   target_link_libraries(gmock PUBLIC gtest)
+-  set_target_properties(gmock PROPERTIES VERSION ${GOOGLETEST_VERSION})
+  #  set_target_properties(gmock PROPERTIES VERSION ${GOOGLETEST_VERSION})
+   cxx_library(gmock_main "${cxx_strict}" src/gmock_main.cc)
+   target_link_libraries(gmock_main PUBLIC gmock)
+   set_target_properties(gmock_main PROPERTIES VERSION ${GOOGLETEST_VERSION})
@@ -0,0 +1,11 @@
+--- ceph-19.2.0/src/tracing/CMakeLists.txt.orig	2025-01-23 17:51:43.874162594 -0500
+++ ceph-19.2.0/src/tracing/CMakeLists.txt	2025-01-23 17:54:21.877186735 -0500
+@@ -6,6 +6,8 @@
+ set(header_dir ${working_dir}/tracing)
+ file(MAKE_DIRECTORY ${header_dir})
+ 
+set(CMAKE_C99_EXTENSION_COMPILE_OPTION "-std=gnu23")
+
+ add_custom_target(tracepoint_libraries)
+ 
+ file(GLOB tps "*.tp")
@@ -0,0 +1,30 @@
+--- ceph-19.2.0/src/test/neorados/common_tests.h.orig	2024-09-18 12:27:51.000000000 -0400
+++ ceph-19.2.0/src/test/neorados/common_tests.h	2025-01-26 19:31:32.545762972 -0500
+@@ -47,6 +47,18 @@
+ 
+ #include "gtest/gtest.h"
+ 
+#if !defined(GTEST_DISALLOW_COPY_AND_ASSIGN_)
+#define GTEST_DISALLOW_COPY_AND_ASSIGN_(type) \
+  type(type const&) = delete;                 \
+  type& operator=(type const&) = delete
+#endif
+
+#if !defined(GTEST_DISALLOW_MOVE_AND_ASSIGN_)
+#define GTEST_DISALLOW_MOVE_AND_ASSIGN_(type) \
+  type(type&&) noexcept = delete;             \
+  type& operator=(type&&) noexcept = delete
+#endif
+
+ /// \file test/neorados/common_tests.h
+ ///
+ /// \brief Tools for testing neorados code
+@@ -398,7 +410,7 @@
+ 									       \
+   private:                                                                     \
+     boost::asio::awaitable<void> CoTestBody() override;                        \
+-    static ::testing::TestInfo *const test_info_ GTEST_ATTRIBUTE_UNUSED_;      \
+    static ::testing::TestInfo *const test_info_ __attribute__((unused));      \
+   };                                                                           \
+ 									       \
+   ::testing::TestInfo *const GTEST_TEST_CLASS_NAME_(test_suite_name,           \
@@ -0,0 +1,52 @@
+--- ceph-19.2.2/src/pybind/cephfs/setup.py.orig	2025-05-29 15:51:00.656323008 -0400
+++ ceph-19.2.2/src/pybind/cephfs/setup.py	2025-05-29 15:52:13.215102123 -0400
+@@ -1,11 +1,11 @@
+ import os
+-import pkgutil
+import importlib.util
+ import shutil
+ import subprocess
+ import sys
+ import tempfile
+ import textwrap
+-if not pkgutil.find_loader('setuptools'):
+if not importlib.util.find_spec('setuptools'):
+     from distutils.core import setup
+     from distutils.extension import Extension
+ else:
+--- ceph-19.2.2/src/pybind/rbd/setup.py.orig	2025-05-29 15:48:35.863759314 -0400
+++ ceph-19.2.2/src/pybind/rbd/setup.py	2025-05-29 15:50:05.529742462 -0400
+@@ -1,11 +1,11 @@
+ import os
+-import pkgutil
+import importlib.util
+ import shutil
+ import subprocess
+ import sys
+ import tempfile
+ import textwrap
+-if not pkgutil.find_loader('setuptools'):
+if not importlib.util.find_spec('setuptools'):
+     from distutils.core import setup
+     from distutils.extension import Extension
+ else:
+--- ceph-19.2.2/src/pybind/rgw/setup.py.orig	2025-05-29 15:44:13.673781032 -0400
+++ ceph-19.2.2/src/pybind/rgw/setup.py	2025-05-29 15:48:23.444285313 -0400
+@@ -1,5 +1,5 @@
+-import pkgutil
+-if not pkgutil.find_loader('setuptools'):
+import importlib.util
+if not importlib.util.find_spec('setuptools'):
+     from distutils.core import setup
+     from distutils.extension import Extension
+ else:
+--- ceph-19.2.2/src/pybind/rados/setup.py.orig	2025-05-29 15:50:14.768095133 -0400
+++ ceph-19.2.2/src/pybind/rados/setup.py	2025-05-29 15:50:46.003687955 -0400
+@@ -1,5 +1,5 @@
+-import pkgutil
+-if not pkgutil.find_loader('setuptools'):
+import importlib.util
+if not importlib.util.find_spec('setuptools'):
+     from distutils.core import setup
+     from distutils.extension import Extension
+ else:
@@ -0,0 +1,845 @@
+diff -ur ceph-19.2.2/src/s3select.orig/include/encryption_internal_19.h ceph-19.2.2/src/s3select/include/encryption_internal_19.h
+--- ceph-19.2.2/src/s3select.orig/include/encryption_internal_19.h	2025-07-07 13:17:09.262618668 -0400
+++ ceph-19.2.2/src/s3select/include/encryption_internal_19.h	2025-07-07 13:08:00.746355226 -0400
+@@ -0,0 +1,114 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#pragma once
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "parquet/properties.h"
+#include "parquet/types.h"
+
+using parquet::ParquetCipher;
+
+namespace parquet {
+namespace encryption {
+
+constexpr int kGcmTagLength = 16;
+constexpr int kNonceLength = 12;
+
+// Module types
+constexpr int8_t kFooter = 0;
+constexpr int8_t kColumnMetaData = 1;
+constexpr int8_t kDataPage = 2;
+constexpr int8_t kDictionaryPage = 3;
+constexpr int8_t kDataPageHeader = 4;
+constexpr int8_t kDictionaryPageHeader = 5;
+constexpr int8_t kColumnIndex = 6;
+constexpr int8_t kOffsetIndex = 7;
+
+/// Performs AES encryption operations with GCM or CTR ciphers.
+class AesEncryptor {
+ public:
+  static AesEncryptor* Make(ParquetCipher::type alg_id, int key_len, bool metadata,
+                            std::vector<AesEncryptor*>* all_encryptors);
+
+  ~AesEncryptor();
+
+  /// Size difference between plaintext and ciphertext, for this cipher.
+  int CiphertextSizeDelta();
+
+  /// Encrypts plaintext with the key and aad. Key length is passed only for validation.
+  /// If different from value in constructor, exception will be thrown.
+  int Encrypt(const uint8_t* plaintext, int plaintext_len, const uint8_t* key,
+              int key_len, const uint8_t* aad, int aad_len, uint8_t* ciphertext);
+
+  /// Encrypts plaintext footer, in order to compute footer signature (tag).
+  int SignedFooterEncrypt(const uint8_t* footer, int footer_len, const uint8_t* key,
+                          int key_len, const uint8_t* aad, int aad_len,
+                          const uint8_t* nonce, uint8_t* encrypted_footer);
+
+  void WipeOut();
+
+ private:
+  /// Can serve one key length only. Possible values: 16, 24, 32 bytes.
+  explicit AesEncryptor(ParquetCipher::type alg_id, int key_len, bool metadata);
+  // PIMPL Idiom
+  class AesEncryptorImpl;
+  std::unique_ptr<AesEncryptorImpl> impl_;
+};
+
+/// Performs AES decryption operations with GCM or CTR ciphers.
+class AesDecryptor {
+ public:
+  static AesDecryptor* Make(ParquetCipher::type alg_id, int key_len, bool metadata,
+                            std::vector<AesDecryptor*>* all_decryptors);
+
+  ~AesDecryptor();
+  void WipeOut();
+
+  /// Size difference between plaintext and ciphertext, for this cipher.
+  int CiphertextSizeDelta();
+
+  /// Decrypts ciphertext with the key and aad. Key length is passed only for
+  /// validation. If different from value in constructor, exception will be thrown.
+  int Decrypt(const uint8_t* ciphertext, int ciphertext_len, const uint8_t* key,
+              int key_len, const uint8_t* aad, int aad_len, uint8_t* plaintext);
+
+ private:
+  /// Can serve one key length only. Possible values: 16, 24, 32 bytes.
+  explicit AesDecryptor(ParquetCipher::type alg_id, int key_len, bool metadata);
+  // PIMPL Idiom
+  class AesDecryptorImpl;
+  std::unique_ptr<AesDecryptorImpl> impl_;
+};
+
+std::string CreateModuleAad(const std::string& file_aad, int8_t module_type,
+                            int16_t row_group_ordinal, int16_t column_ordinal,
+                            int16_t page_ordinal);
+
+std::string CreateFooterAad(const std::string& aad_prefix_bytes);
+
+// Update last two bytes of page (or page header) module AAD
+void QuickUpdatePageAad(const std::string& AAD, int16_t new_page_ordinal);
+
+// Wraps OpenSSL RAND_bytes function
+void RandBytes(unsigned char* buf, int num);
+
+}  // namespace encryption
+}  // namespace parquet
+diff -ur ceph-19.2.2/src/s3select.orig/include/encryption_internal_20.h ceph-19.2.2/src/s3select/include/encryption_internal_20.h
+--- ceph-19.2.2/src/s3select.orig/include/encryption_internal_20.h	2025-07-07 13:17:09.262618668 -0400
+++ ceph-19.2.2/src/s3select/include/encryption_internal_20.h	2025-07-07 13:08:00.746536155 -0400
+@@ -0,0 +1,141 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#pragma once
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "arrow/util/span.h"
+#include "parquet/properties.h"
+#include "parquet/types.h"
+
+using parquet::ParquetCipher;
+
+namespace parquet::encryption {
+
+constexpr int32_t kGcmTagLength = 16;
+constexpr int32_t kNonceLength = 12;
+
+// Module types
+constexpr int8_t kFooter = 0;
+constexpr int8_t kColumnMetaData = 1;
+constexpr int8_t kDataPage = 2;
+constexpr int8_t kDictionaryPage = 3;
+constexpr int8_t kDataPageHeader = 4;
+constexpr int8_t kDictionaryPageHeader = 5;
+constexpr int8_t kColumnIndex = 6;
+constexpr int8_t kOffsetIndex = 7;
+constexpr int8_t kBloomFilterHeader = 8;
+constexpr int8_t kBloomFilterBitset = 9;
+
+/// Performs AES encryption operations with GCM or CTR ciphers.
+class PARQUET_EXPORT AesEncryptor {
+ public:
+  /// Can serve one key length only. Possible values: 16, 24, 32 bytes.
+  /// If write_length is true, prepend ciphertext length to the ciphertext
+  explicit AesEncryptor(ParquetCipher::type alg_id, int32_t key_len, bool metadata,
+                        bool write_length = true);
+
+  static std::unique_ptr<AesEncryptor> Make(ParquetCipher::type alg_id, int32_t key_len,
+                                            bool metadata, bool write_length = true);
+
+  ~AesEncryptor();
+
+  /// The size of the ciphertext, for this cipher and the specified plaintext length.
+  [[nodiscard]] int32_t CiphertextLength(int64_t plaintext_len) const;
+
+  /// Encrypts plaintext with the key and aad. Key length is passed only for validation.
+  /// If different from value in constructor, exception will be thrown.
+  int32_t Encrypt(::arrow::util::span<const uint8_t> plaintext,
+                  ::arrow::util::span<const uint8_t> key,
+                  ::arrow::util::span<const uint8_t> aad,
+                  ::arrow::util::span<uint8_t> ciphertext);
+
+  /// Encrypts plaintext footer, in order to compute footer signature (tag).
+  int32_t SignedFooterEncrypt(::arrow::util::span<const uint8_t> footer,
+                              ::arrow::util::span<const uint8_t> key,
+                              ::arrow::util::span<const uint8_t> aad,
+                              ::arrow::util::span<const uint8_t> nonce,
+                              ::arrow::util::span<uint8_t> encrypted_footer);
+
+ private:
+  // PIMPL Idiom
+  class AesEncryptorImpl;
+  std::unique_ptr<AesEncryptorImpl> impl_;
+};
+
+/// Performs AES decryption operations with GCM or CTR ciphers.
+class PARQUET_EXPORT AesDecryptor {
+ public:
+  /// \brief Construct an AesDecryptor
+  ///
+  /// \param alg_id the encryption algorithm to use
+  /// \param key_len key length. Possible values: 16, 24, 32 bytes.
+  /// \param metadata if true then this is a metadata decryptor
+  /// \param contains_length if true, expect ciphertext length prepended to the ciphertext
+  explicit AesDecryptor(ParquetCipher::type alg_id, int32_t key_len, bool metadata,
+                        bool contains_length = true);
+
+  static std::unique_ptr<AesDecryptor> Make(ParquetCipher::type alg_id, int32_t key_len,
+                                            bool metadata);
+
+  ~AesDecryptor();
+
+  /// The size of the plaintext, for this cipher and the specified ciphertext length.
+  [[nodiscard]] int32_t PlaintextLength(int32_t ciphertext_len) const;
+
+  /// The size of the ciphertext, for this cipher and the specified plaintext length.
+  [[nodiscard]] int32_t CiphertextLength(int32_t plaintext_len) const;
+
+  /// Decrypts ciphertext with the key and aad. Key length is passed only for
+  /// validation. If different from value in constructor, exception will be thrown.
+  /// The caller is responsible for ensuring that the plaintext buffer is at least as
+  /// large as PlaintextLength(ciphertext_len).
+  int32_t Decrypt(::arrow::util::span<const uint8_t> ciphertext,
+                  ::arrow::util::span<const uint8_t> key,
+                  ::arrow::util::span<const uint8_t> aad,
+                  ::arrow::util::span<uint8_t> plaintext);
+
+ private:
+  // PIMPL Idiom
+  class AesDecryptorImpl;
+  std::unique_ptr<AesDecryptorImpl> impl_;
+};
+
+std::string CreateModuleAad(const std::string& file_aad, int8_t module_type,
+                            int16_t row_group_ordinal, int16_t column_ordinal,
+                            int32_t page_ordinal);
+
+std::string CreateFooterAad(const std::string& aad_prefix_bytes);
+
+// Update last two bytes of page (or page header) module AAD
+void QuickUpdatePageAad(int32_t new_page_ordinal, std::string* AAD);
+
+// Wraps OpenSSL RAND_bytes function
+void RandBytes(unsigned char* buf, size_t num);
+
+// Ensure OpenSSL is initialized.
+//
+// This is only necessary in specific situations since OpenSSL otherwise
+// initializes itself automatically. For example, under Valgrind, a memory
+// leak will be reported if OpenSSL is initialized for the first time from
+// a worker thread; calling this function from the main thread prevents this.
+void EnsureBackendInitialized();
+
+}  // namespace parquet::encryption
+diff -ur ceph-19.2.2/src/s3select.orig/include/encryption_internal.h ceph-19.2.2/src/s3select/include/encryption_internal.h
+--- ceph-19.2.2/src/s3select.orig/include/encryption_internal.h	2024-03-26 19:23:12.000000000 -0400
+++ ceph-19.2.2/src/s3select/include/encryption_internal.h	2025-07-07 13:08:00.745633149 -0400
+@@ -17,98 +17,8 @@
+ 
+ #pragma once
+ 
+-#include <memory>
+-#include <string>
+-#include <vector>
+-
+-#include "parquet/properties.h"
+-#include "parquet/types.h"
+-
+-using parquet::ParquetCipher;
+-
+-namespace parquet {
+-namespace encryption {
+-
+-constexpr int kGcmTagLength = 16;
+-constexpr int kNonceLength = 12;
+-
+-// Module types
+-constexpr int8_t kFooter = 0;
+-constexpr int8_t kColumnMetaData = 1;
+-constexpr int8_t kDataPage = 2;
+-constexpr int8_t kDictionaryPage = 3;
+-constexpr int8_t kDataPageHeader = 4;
+-constexpr int8_t kDictionaryPageHeader = 5;
+-constexpr int8_t kColumnIndex = 6;
+-constexpr int8_t kOffsetIndex = 7;
+-
+-/// Performs AES encryption operations with GCM or CTR ciphers.
+-class AesEncryptor {
+- public:
+-  static AesEncryptor* Make(ParquetCipher::type alg_id, int key_len, bool metadata,
+-                            std::vector<AesEncryptor*>* all_encryptors);
+-
+-  ~AesEncryptor();
+-
+-  /// Size difference between plaintext and ciphertext, for this cipher.
+-  int CiphertextSizeDelta();
+-
+-  /// Encrypts plaintext with the key and aad. Key length is passed only for validation.
+-  /// If different from value in constructor, exception will be thrown.
+-  int Encrypt(const uint8_t* plaintext, int plaintext_len, const uint8_t* key,
+-              int key_len, const uint8_t* aad, int aad_len, uint8_t* ciphertext);
+-
+-  /// Encrypts plaintext footer, in order to compute footer signature (tag).
+-  int SignedFooterEncrypt(const uint8_t* footer, int footer_len, const uint8_t* key,
+-                          int key_len, const uint8_t* aad, int aad_len,
+-                          const uint8_t* nonce, uint8_t* encrypted_footer);
+-
+-  void WipeOut();
+-
+- private:
+-  /// Can serve one key length only. Possible values: 16, 24, 32 bytes.
+-  explicit AesEncryptor(ParquetCipher::type alg_id, int key_len, bool metadata);
+-  // PIMPL Idiom
+-  class AesEncryptorImpl;
+-  std::unique_ptr<AesEncryptorImpl> impl_;
+-};
+-
+-/// Performs AES decryption operations with GCM or CTR ciphers.
+-class AesDecryptor {
+- public:
+-  static AesDecryptor* Make(ParquetCipher::type alg_id, int key_len, bool metadata,
+-                            std::vector<AesDecryptor*>* all_decryptors);
+-
+-  ~AesDecryptor();
+-  void WipeOut();
+-
+-  /// Size difference between plaintext and ciphertext, for this cipher.
+-  int CiphertextSizeDelta();
+-
+-  /// Decrypts ciphertext with the key and aad. Key length is passed only for
+-  /// validation. If different from value in constructor, exception will be thrown.
+-  int Decrypt(const uint8_t* ciphertext, int ciphertext_len, const uint8_t* key,
+-              int key_len, const uint8_t* aad, int aad_len, uint8_t* plaintext);
+-
+- private:
+-  /// Can serve one key length only. Possible values: 16, 24, 32 bytes.
+-  explicit AesDecryptor(ParquetCipher::type alg_id, int key_len, bool metadata);
+-  // PIMPL Idiom
+-  class AesDecryptorImpl;
+-  std::unique_ptr<AesDecryptorImpl> impl_;
+-};
+-
+-std::string CreateModuleAad(const std::string& file_aad, int8_t module_type,
+-                            int16_t row_group_ordinal, int16_t column_ordinal,
+-                            int16_t page_ordinal);
+-
+-std::string CreateFooterAad(const std::string& aad_prefix_bytes);
+-
+-// Update last two bytes of page (or page header) module AAD
+-void QuickUpdatePageAad(const std::string& AAD, int16_t new_page_ordinal);
+-
+-// Wraps OpenSSL RAND_bytes function
+-void RandBytes(unsigned char* buf, int num);
+-
+-}  // namespace encryption
+-}  // namespace parquet
+#if ARROW_VERSION_MAJOR < 20
+#include "encryption_internal_19.h"
+#else
+#include "encryption_internal_20.h"
+#endif
+diff -ur ceph-19.2.2/src/s3select.orig/include/internal_file_decryptor_19.h ceph-19.2.2/src/s3select/include/internal_file_decryptor_19.h
+--- ceph-19.2.2/src/s3select.orig/include/internal_file_decryptor_19.h	2025-07-07 13:17:58.730837390 -0400
+++ ceph-19.2.2/src/s3select/include/internal_file_decryptor_19.h	2025-07-07 13:08:00.746893764 -0400
+@@ -0,0 +1,121 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#pragma once
+
+#include <map>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "parquet/schema.h"
+
+namespace parquet {
+
+namespace encryption {
+class AesDecryptor;
+class AesEncryptor;
+}  // namespace encryption
+
+class FileDecryptionProperties;
+
+class PARQUET_EXPORT Decryptor {
+ public:
+  Decryptor(encryption::AesDecryptor* decryptor, const std::string& key,
+            const std::string& file_aad, const std::string& aad,
+            ::arrow::MemoryPool* pool);
+
+  const std::string& file_aad() const { return file_aad_; }
+  void UpdateAad(const std::string& aad) { aad_ = aad; }
+  ::arrow::MemoryPool* pool() { return pool_; }
+
+  int CiphertextSizeDelta();
+  int Decrypt(const uint8_t* ciphertext, int ciphertext_len, uint8_t* plaintext);
+
+ private:
+  encryption::AesDecryptor* aes_decryptor_;
+  std::string key_;
+  std::string file_aad_;
+  std::string aad_;
+  ::arrow::MemoryPool* pool_;
+};
+
+class InternalFileDecryptor {
+ public:
+  explicit InternalFileDecryptor(FileDecryptionProperties* properties,
+                                 const std::string& file_aad,
+                                 ParquetCipher::type algorithm,
+                                 const std::string& footer_key_metadata,
+                                 ::arrow::MemoryPool* pool);
+
+  std::string& file_aad() { return file_aad_; }
+
+  std::string GetFooterKey();
+
+  ParquetCipher::type algorithm() { return algorithm_; }
+
+  std::string& footer_key_metadata() { return footer_key_metadata_; }
+
+  FileDecryptionProperties* properties() { return properties_; }
+
+  void WipeOutDecryptionKeys();
+
+  ::arrow::MemoryPool* pool() { return pool_; }
+
+  std::shared_ptr<Decryptor> GetFooterDecryptor();
+  std::shared_ptr<Decryptor> GetFooterDecryptorForColumnMeta(const std::string& aad = "");
+  std::shared_ptr<Decryptor> GetFooterDecryptorForColumnData(const std::string& aad = "");
+  std::shared_ptr<Decryptor> GetColumnMetaDecryptor(
+      const std::string& column_path, const std::string& column_key_metadata,
+      const std::string& aad = "");
+  std::shared_ptr<Decryptor> GetColumnDataDecryptor(
+      const std::string& column_path, const std::string& column_key_metadata,
+      const std::string& aad = "");
+
+ private:
+  FileDecryptionProperties* properties_;
+  // Concatenation of aad_prefix (if exists) and aad_file_unique
+  std::string file_aad_;
+  std::map<std::string, std::shared_ptr<Decryptor>> column_data_map_;
+  std::map<std::string, std::shared_ptr<Decryptor>> column_metadata_map_;
+
+  std::shared_ptr<Decryptor> footer_metadata_decryptor_;
+  std::shared_ptr<Decryptor> footer_data_decryptor_;
+  ParquetCipher::type algorithm_;
+  std::string footer_key_metadata_;
+  std::vector<encryption::AesDecryptor*> all_decryptors_;
+
+  /// Key must be 16, 24 or 32 bytes in length. Thus there could be up to three
+  // types of meta_decryptors and data_decryptors.
+  std::unique_ptr<encryption::AesDecryptor> meta_decryptor_[3];
+  std::unique_ptr<encryption::AesDecryptor> data_decryptor_[3];
+
+  ::arrow::MemoryPool* pool_;
+
+  std::shared_ptr<Decryptor> GetFooterDecryptor(const std::string& aad, bool metadata);
+  std::shared_ptr<Decryptor> GetColumnDecryptor(const std::string& column_path,
+                                                const std::string& column_key_metadata,
+                                                const std::string& aad,
+                                                bool metadata = false);
+
+  encryption::AesDecryptor* GetMetaAesDecryptor(size_t key_size);
+  encryption::AesDecryptor* GetDataAesDecryptor(size_t key_size);
+
+  int MapKeyLenToDecryptorArrayIndex(int key_len);
+};
+
+}  // namespace parquet
+diff -ur ceph-19.2.2/src/s3select.orig/include/internal_file_decryptor_20.h ceph-19.2.2/src/s3select/include/internal_file_decryptor_20.h
+--- ceph-19.2.2/src/s3select.orig/include/internal_file_decryptor_20.h	2025-07-07 13:17:58.730837390 -0400
+++ ceph-19.2.2/src/s3select/include/internal_file_decryptor_20.h	2025-07-07 13:08:00.747082281 -0400
+@@ -0,0 +1,148 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#pragma once
+
+#include <memory>
+#include <mutex>
+#include <string>
+#include <vector>
+
+#include "parquet/schema.h"
+
+namespace parquet {
+
+namespace encryption {
+class AesDecryptor;
+class AesEncryptor;
+}  // namespace encryption
+
+class ColumnCryptoMetaData;
+class FileDecryptionProperties;
+
+// An object handling decryption using well-known encryption parameters
+//
+// CAUTION: Decryptor objects are not thread-safe.
+class PARQUET_EXPORT Decryptor {
+ public:
+  Decryptor(std::unique_ptr<encryption::AesDecryptor> decryptor, const std::string& key,
+            const std::string& file_aad, const std::string& aad,
+            ::arrow::MemoryPool* pool);
+  ~Decryptor();
+
+  const std::string& file_aad() const { return file_aad_; }
+  void UpdateAad(const std::string& aad) { aad_ = aad; }
+  ::arrow::MemoryPool* pool() { return pool_; }
+
+  [[nodiscard]] int32_t PlaintextLength(int32_t ciphertext_len) const;
+  [[nodiscard]] int32_t CiphertextLength(int32_t plaintext_len) const;
+  int32_t Decrypt(::arrow::util::span<const uint8_t> ciphertext,
+                  ::arrow::util::span<uint8_t> plaintext);
+
+ private:
+  std::unique_ptr<encryption::AesDecryptor> aes_decryptor_;
+  std::string key_;
+  std::string file_aad_;
+  std::string aad_;
+  ::arrow::MemoryPool* pool_;
+};
+
+class InternalFileDecryptor {
+ public:
+  explicit InternalFileDecryptor(std::shared_ptr<FileDecryptionProperties> properties,
+                                 const std::string& file_aad,
+                                 ParquetCipher::type algorithm,
+                                 const std::string& footer_key_metadata,
+                                 ::arrow::MemoryPool* pool);
+
+  const std::string& file_aad() const { return file_aad_; }
+
+  std::string GetFooterKey();
+
+  ParquetCipher::type algorithm() const { return algorithm_; }
+
+  const std::string& footer_key_metadata() const { return footer_key_metadata_; }
+
+  const std::shared_ptr<FileDecryptionProperties>& properties() const {
+    return properties_;
+  }
+
+  ::arrow::MemoryPool* pool() const { return pool_; }
+
+  // Get a Decryptor instance for the Parquet footer
+  std::unique_ptr<Decryptor> GetFooterDecryptor();
+
+  // Get a Decryptor instance for column chunk metadata.
+  std::unique_ptr<Decryptor> GetColumnMetaDecryptor(
+      const std::string& column_path, const std::string& column_key_metadata,
+      const std::string& aad = "") {
+    return GetColumnDecryptor(column_path, column_key_metadata, aad, /*metadata=*/true);
+  }
+
+  // Get a Decryptor instance for column chunk data.
+  std::unique_ptr<Decryptor> GetColumnDataDecryptor(
+      const std::string& column_path, const std::string& column_key_metadata,
+      const std::string& aad = "") {
+    return GetColumnDecryptor(column_path, column_key_metadata, aad, /*metadata=*/false);
+  }
+
+  // Get a Decryptor factory for column chunk metadata.
+  //
+  // This is typically useful if multi-threaded decryption is expected.
+  // This is a static function as it accepts a null `InternalFileDecryptor*`
+  // argument if the column is not encrypted.
+  static std::function<std::unique_ptr<Decryptor>()> GetColumnMetaDecryptorFactory(
+      InternalFileDecryptor*, const ColumnCryptoMetaData* crypto_metadata,
+      const std::string& aad = "");
+  // Get a Decryptor factory for column chunk data.
+  //
+  // This is typically useful if multi-threaded decryption is expected.
+  // This is a static function as it accepts a null `InternalFileDecryptor*`
+  // argument if the column is not encrypted.
+  static std::function<std::unique_ptr<Decryptor>()> GetColumnDataDecryptorFactory(
+      InternalFileDecryptor*, const ColumnCryptoMetaData* crypto_metadata,
+      const std::string& aad = "");
+
+ private:
+  std::shared_ptr<FileDecryptionProperties> properties_;
+  // Concatenation of aad_prefix (if exists) and aad_file_unique
+  std::string file_aad_;
+  ParquetCipher::type algorithm_;
+  std::string footer_key_metadata_;
+  ::arrow::MemoryPool* pool_;
+
+  // Protects footer_key_ updates
+  std::mutex mutex_;
+  std::string footer_key_;
+
+  std::string GetColumnKey(const std::string& column_path,
+                           const std::string& column_key_metadata);
+
+  std::unique_ptr<Decryptor> GetFooterDecryptor(const std::string& aad, bool metadata);
+
+  std::unique_ptr<Decryptor> GetColumnDecryptor(const std::string& column_path,
+                                                const std::string& column_key_metadata,
+                                                const std::string& aad, bool metadata);
+
+  std::function<std::unique_ptr<Decryptor>()> GetColumnDecryptorFactory(
+      const ColumnCryptoMetaData* crypto_metadata, const std::string& aad, bool metadata);
+};
+
+void UpdateDecryptor(Decryptor* decryptor, int16_t row_group_ordinal,
+                     int16_t column_ordinal, int8_t module_type);
+
+}  // namespace parquet
+diff -ur ceph-19.2.2/src/s3select.orig/include/internal_file_decryptor.h ceph-19.2.2/src/s3select/include/internal_file_decryptor.h
+--- ceph-19.2.2/src/s3select.orig/include/internal_file_decryptor.h	2024-03-26 19:23:12.000000000 -0400
+++ ceph-19.2.2/src/s3select/include/internal_file_decryptor.h	2025-07-07 13:08:00.746720961 -0400
+@@ -17,105 +17,8 @@
+ 
+ #pragma once
+ 
+-#include <map>
+-#include <memory>
+-#include <string>
+-#include <vector>
+-
+-#include "parquet/schema.h"
+-
+-namespace parquet {
+-
+-namespace encryption {
+-class AesDecryptor;
+-class AesEncryptor;
+-}  // namespace encryption
+-
+-class FileDecryptionProperties;
+-
+-class PARQUET_EXPORT Decryptor {
+- public:
+-  Decryptor(encryption::AesDecryptor* decryptor, const std::string& key,
+-            const std::string& file_aad, const std::string& aad,
+-            ::arrow::MemoryPool* pool);
+-
+-  const std::string& file_aad() const { return file_aad_; }
+-  void UpdateAad(const std::string& aad) { aad_ = aad; }
+-  ::arrow::MemoryPool* pool() { return pool_; }
+-
+-  int CiphertextSizeDelta();
+-  int Decrypt(const uint8_t* ciphertext, int ciphertext_len, uint8_t* plaintext);
+-
+- private:
+-  encryption::AesDecryptor* aes_decryptor_;
+-  std::string key_;
+-  std::string file_aad_;
+-  std::string aad_;
+-  ::arrow::MemoryPool* pool_;
+-};
+-
+-class InternalFileDecryptor {
+- public:
+-  explicit InternalFileDecryptor(FileDecryptionProperties* properties,
+-                                 const std::string& file_aad,
+-                                 ParquetCipher::type algorithm,
+-                                 const std::string& footer_key_metadata,
+-                                 ::arrow::MemoryPool* pool);
+-
+-  std::string& file_aad() { return file_aad_; }
+-
+-  std::string GetFooterKey();
+-
+-  ParquetCipher::type algorithm() { return algorithm_; }
+-
+-  std::string& footer_key_metadata() { return footer_key_metadata_; }
+-
+-  FileDecryptionProperties* properties() { return properties_; }
+-
+-  void WipeOutDecryptionKeys();
+-
+-  ::arrow::MemoryPool* pool() { return pool_; }
+-
+-  std::shared_ptr<Decryptor> GetFooterDecryptor();
+-  std::shared_ptr<Decryptor> GetFooterDecryptorForColumnMeta(const std::string& aad = "");
+-  std::shared_ptr<Decryptor> GetFooterDecryptorForColumnData(const std::string& aad = "");
+-  std::shared_ptr<Decryptor> GetColumnMetaDecryptor(
+-      const std::string& column_path, const std::string& column_key_metadata,
+-      const std::string& aad = "");
+-  std::shared_ptr<Decryptor> GetColumnDataDecryptor(
+-      const std::string& column_path, const std::string& column_key_metadata,
+-      const std::string& aad = "");
+-
+- private:
+-  FileDecryptionProperties* properties_;
+-  // Concatenation of aad_prefix (if exists) and aad_file_unique
+-  std::string file_aad_;
+-  std::map<std::string, std::shared_ptr<Decryptor>> column_data_map_;
+-  std::map<std::string, std::shared_ptr<Decryptor>> column_metadata_map_;
+-
+-  std::shared_ptr<Decryptor> footer_metadata_decryptor_;
+-  std::shared_ptr<Decryptor> footer_data_decryptor_;
+-  ParquetCipher::type algorithm_;
+-  std::string footer_key_metadata_;
+-  std::vector<encryption::AesDecryptor*> all_decryptors_;
+-
+-  /// Key must be 16, 24 or 32 bytes in length. Thus there could be up to three
+-  // types of meta_decryptors and data_decryptors.
+-  std::unique_ptr<encryption::AesDecryptor> meta_decryptor_[3];
+-  std::unique_ptr<encryption::AesDecryptor> data_decryptor_[3];
+-
+-  ::arrow::MemoryPool* pool_;
+-
+-  std::shared_ptr<Decryptor> GetFooterDecryptor(const std::string& aad, bool metadata);
+-  std::shared_ptr<Decryptor> GetColumnDecryptor(const std::string& column_path,
+-                                                const std::string& column_key_metadata,
+-                                                const std::string& aad,
+-                                                bool metadata = false);
+-
+-  encryption::AesDecryptor* GetMetaAesDecryptor(size_t key_size);
+-  encryption::AesDecryptor* GetDataAesDecryptor(size_t key_size);
+-
+-  int MapKeyLenToDecryptorArrayIndex(int key_len);
+-};
+-
+-}  // namespace parquet
+#if ARROW_VERSION_MAJOR < 20
+#include "internal_file_decryptor_19.h"
+#else
+#include "internal_file_decryptor_20.h"
+#endif
+diff -ur ceph-19.2.2/src/s3select.orig/include/s3select_parquet_intrf.h ceph-19.2.2/src/s3select/include/s3select_parquet_intrf.h
+--- ceph-19.2.2/src/s3select.orig/include/s3select_parquet_intrf.h	2024-03-26 19:23:12.000000000 -0400
+++ ceph-19.2.2/src/s3select/include/s3select_parquet_intrf.h	2025-07-07 13:08:00.747275733 -0400
+@@ -983,6 +1002,7 @@
+       throw ParquetException("Encrypted files cannot contain more than 32767 row groups");
+     }
+ 
+#if ARROW_VERSION_MAJOR < 20
+     // The column is encrypted
+     std::shared_ptr<::parquet::Decryptor> meta_decryptor;
+     std::shared_ptr<Decryptor> data_decryptor;
+@@ -1016,6 +1036,25 @@
+                             false,
+     #endif
+                             properties_.memory_pool(), &ctx);
+#else
+    // Arrow 20+ version uses factory functions instead of shared_ptr for decryptors
+    std::function<std::unique_ptr<Decryptor>()> meta_decryptor_factory =
+        InternalFileDecryptor::GetColumnMetaDecryptorFactory(file_decryptor_.get(), crypto_metadata.get());
+    std::function<std::unique_ptr<Decryptor>()> data_decryptor_factory =
+        InternalFileDecryptor::GetColumnDataDecryptorFactory(file_decryptor_.get(), crypto_metadata.get());
+
+    const CryptoContext ctx {
+        col->has_dictionary_page(),
+        row_group_ordinal_,
+        static_cast<int16_t>(i),
+        meta_decryptor_factory,
+        data_decryptor_factory,
+    };
+
+    return PageReader::Open(stream, col->num_values(), col->compression(),
+                            false,
+                            properties_.memory_pool(), &ctx);
+#endif
+   }
+ 
+  private:
+@@ -1052,7 +1091,9 @@
+   }
+ 
+   void Close() override {
+#if ARROW_VERSION_MAJOR < 20
+     if (file_decryptor_) file_decryptor_->WipeOutDecryptionKeys();
+#endif
+   }
+ 
+   std::shared_ptr<RowGroupReader> GetRowGroup(int i) override {
+@@ -1230,9 +1271,17 @@
+   // Handle AAD prefix
+   EncryptionAlgorithm algo = file_crypto_metadata->encryption_algorithm();
+   std::string file_aad = HandleAadPrefix(file_decryption_properties, algo);
+#if ARROW_VERSION_MAJOR < 20
+   file_decryptor_ = std::make_shared<::parquet::InternalFileDecryptor>(
+       file_decryption_properties, file_aad, algo.algorithm,
+       file_crypto_metadata->key_metadata(), properties_.memory_pool());
+#else
+  // Arrow 20+ takes a shared_ptr to FileDecryptionProperties
+  file_decryptor_ = std::make_shared<::parquet::InternalFileDecryptor>(
+      std::shared_ptr<FileDecryptionProperties>(file_decryption_properties),
+      file_aad, algo.algorithm,
+      file_crypto_metadata->key_metadata(), properties_.memory_pool());
+#endif
+ 
+   int64_t metadata_offset = source_size_ - kFooterSize - footer_len + crypto_metadata_len;
+   uint32_t metadata_len = footer_len - crypto_metadata_len;
+@@ -1259,9 +1312,18 @@
+     EncryptionAlgorithm algo = file_metadata_->encryption_algorithm();
+     // Handle AAD prefix
+     std::string file_aad = HandleAadPrefix(file_decryption_properties, algo);
+#if ARROW_VERSION_MAJOR < 20
+     file_decryptor_ = std::make_shared<::parquet::InternalFileDecryptor>(
+         file_decryption_properties, file_aad, algo.algorithm,
+         file_metadata_->footer_signing_key_metadata(), properties_.memory_pool());
+#else
+    // Arrow 20+ takes a shared_ptr to FileDecryptionProperties
+    file_decryptor_ = std::make_shared<::parquet::InternalFileDecryptor>(
+        std::shared_ptr<FileDecryptionProperties>(file_decryption_properties),
+        file_aad, algo.algorithm,
+        file_metadata_->footer_signing_key_metadata(), properties_.memory_pool());
+    // In Arrow 20+, no need to set file_decryptor in metadata
+#endif
+     // set the InternalFileDecryptor in the metadata as well, as it's used
+     // for signature verification and for ColumnChunkMetaData creation.
+ #if GAL_set_file_decryptor_declare_private
@@ -0,0 +1,37 @@
+From 8c78a22d2cf69892570f635735d9735169b64a75 Mon Sep 17 00:00:00 2001
+From: Peter Sabaini <peter.sabaini@canonical.com>
+Date: Wed, 11 Sep 2024 16:56:50 +0200
+Subject: [PATCH] ceph-volume: fix importlib.metadata compat
+
+The importlib.metadata library removed older shims in releases >5.0.0
+where EntryPoints objects use .select() instead of dict-like access.
+
+Fixes: https://tracker.ceph.com/issues/68032
+
+Signed-off-by: Peter Sabaini <peter.sabaini@canonical.com>
+---
+ src/ceph-volume/ceph_volume/main.py | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/ceph-volume/ceph_volume/main.py b/src/ceph-volume/ceph_volume/main.py
+index f8eca65ec497c..4f27f429e89e2 100644
+--- a/src/ceph-volume/ceph_volume/main.py
+++ b/src/ceph-volume/ceph_volume/main.py
+@@ -11,8 +11,16 @@
+     from importlib.metadata import entry_points
+ 
+     def get_entry_points(group: str):  # type: ignore
+-        return entry_points().get(group, [])  # type: ignore
+        eps = entry_points()
+        if hasattr(eps, 'select'):
+            # New importlib.metadata uses .select()
+            return eps.select(group=group)
+        else:
+            # Fallback to older EntryPoints that returns dicts
+            return eps.get(group, [])  # type: ignore
+
+ except ImportError:
+    # Fallback to `pkg_resources` for older versions
+     from pkg_resources import iter_entry_points as entry_points  # type: ignore
+ 
+     def get_entry_points(group: str):  # type: ignore
@@ -0,0 +1,53 @@
+From 5924df771f850c249396a37a62f97ac242bf2f96 Mon Sep 17 00:00:00 2001
+From: Hector Martin <marcan@marcan.st>
+Date: Wed, 20 Aug 2025 13:34:08 +0900
+Subject: [PATCH 1/2] mgr/dashboard: Make saml2 robust against module load
+ errors
+
+Loading saml2 can fail due to issues with the xmlsec package (possibly
+subinterpreter related):
+
+  File "/usr/share/ceph/mgr/dashboard/controllers/saml2.py", line 6, in <module>
+    from onelogin.saml2.auth import OneLogin_Saml2_Auth
+  File "/lib/python3.13/site-packages/onelogin/saml2/auth.py", line 12, in <module>
+    import xmlsec
+xmlsec.Error: (100, 'lxml & xmlsec libxml2 library version mismatch')
+
+Instead of taking down the entire dashboard module, treat this exception
+like a missing saml2 package.
+
+Signed-off-by: Hector Martin <marcan@marcan.st>
+---
+ src/pybind/mgr/dashboard/controllers/saml2.py | 2 +-
+ src/pybind/mgr/dashboard/services/sso.py      | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/pybind/mgr/dashboard/controllers/saml2.py b/src/pybind/mgr/dashboard/controllers/saml2.py
+index c11b18a27bc7..e859f558cdc4 100644
+--- a/src/pybind/mgr/dashboard/controllers/saml2.py
+++ b/src/pybind/mgr/dashboard/controllers/saml2.py
+@@ -8,7 +8,7 @@ try:
+     from onelogin.saml2.settings import OneLogin_Saml2_Settings
+ 
+     python_saml_imported = True
+-except ImportError:
+except Exception:
+     python_saml_imported = False
+ 
+ from .. import mgr
+diff --git a/src/pybind/mgr/dashboard/services/sso.py b/src/pybind/mgr/dashboard/services/sso.py
+index 2290e6ea3e15..38910ca4aa34 100644
+--- a/src/pybind/mgr/dashboard/services/sso.py
+++ b/src/pybind/mgr/dashboard/services/sso.py
+@@ -20,7 +20,7 @@ try:
+     from onelogin.saml2.settings import OneLogin_Saml2_Settings as Saml2Settings
+ 
+     python_saml_imported = True
+-except ImportError:
+except Exception:
+     python_saml_imported = False
+ 
+ 
+-- 
+2.50.1
+
@@ -0,0 +1,44 @@
+From 76af91b516bb31ae0a79f55f315bef2c2105a06e Mon Sep 17 00:00:00 2001
+From: Nizamudeen A <nia@redhat.com>
+Date: Thu, 26 Jun 2025 12:55:22 +0530
+Subject: [PATCH 2/2] mgr/dashboard: catch protobuf error due to mismatch in
+ version
+
+Signed-off-by: Nizamudeen A <nia@redhat.com>
+(cherry picked from commit acb0f19c4a50b2ea68f328a61a14a2da06be298b)
+
+ Conflicts:
+	src/pybind/mgr/dashboard/services/nvmeof_client.py
+ - only kept relavant portion applicable for squid
+---
+ src/pybind/mgr/dashboard/services/nvmeof_client.py | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/src/pybind/mgr/dashboard/services/nvmeof_client.py b/src/pybind/mgr/dashboard/services/nvmeof_client.py
+index e0ea6d1e48b3..be2b5edbaa52 100644
+--- a/src/pybind/mgr/dashboard/services/nvmeof_client.py
+++ b/src/pybind/mgr/dashboard/services/nvmeof_client.py
+@@ -1,3 +1,5 @@
+# pylint: disable=unexpected-keyword-arg
+
+ import functools
+ import logging
+ from collections.abc import Iterable
+@@ -9,6 +11,14 @@ from .nvmeof_conf import NvmeofGatewaysConfig
+ logger = logging.getLogger("nvmeof_client")
+ 
+ try:
+    # if the protobuf version is newer than what we generated with
+    # proto file import will fail (because of differences between what's
+    # available in centos and ubuntu).
+    # this "hack" should be removed once we update both the
+    # distros; centos and ubuntu.
+    import os
+    os.environ["PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION"] = "python"
+
+     import grpc  # type: ignore
+     import grpc._channel  # type: ignore
+     from google.protobuf.message import Message  # type: ignore
+-- 
+2.50.1
+
@@ -0,0 +1,152 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Max R. Carrara" <m.carrara@proxmox.com>
+Date: Wed, 16 Jul 2025 13:14:39 +0200
+Subject: [PATCH 58/59] pybind/mgr/restful: provide workaround for PyO3
+ ImportError
+
+Move the self-signed cert generation into a separate module
+inside python-common/ceph and run the module in a separate Python
+process.
+
+This provides a workaround for the ImportError thrown by PyO3 when
+the `restful` module is loaded in the context of multiple Python
+sub-interpreters being present. In particular, the ImportError is
+thrown by the `crypto` module of the `OpenSSL` package.
+
+Inspired by an upstream PR [0].
+
+[0]: https://github.com/ceph/ceph/pull/62951
+
+Signed-off-by: Max R. Carrara <m.carrara@proxmox.com>
+---
+ src/pybind/mgr/restful/module.py       | 24 +++------
+ src/python-common/ceph/_crypto_wrap.py | 69 ++++++++++++++++++++++++++
+ 2 files changed, 76 insertions(+), 17 deletions(-)
+ create mode 100644 src/python-common/ceph/_crypto_wrap.py
+
+diff --git a/src/pybind/mgr/restful/module.py b/src/pybind/mgr/restful/module.py
+index 0f8c78e0bd8..7f93c41f1e6 100644
+--- a/src/pybind/mgr/restful/module.py
+++ b/src/pybind/mgr/restful/module.py
+@@ -7,6 +7,7 @@ import json
+ import time
+ import errno
+ import inspect
+import subprocess
+ import tempfile
+ import threading
+ import traceback
+@@ -19,7 +20,6 @@ from . import context
+ 
+ from uuid import uuid4
+ from pecan import jsonify, make_app
+-from OpenSSL import crypto
+ from pecan.rest import RestController
+ from werkzeug.serving import make_server, make_ssl_devcert
+ 
+@@ -401,24 +401,14 @@ class Module(MgrModule):
+ 
+ 
+     def create_self_signed_cert(self):
+-        # create a key pair
+-        pkey = crypto.PKey()
+-        pkey.generate_key(crypto.TYPE_RSA, 2048)
+-
+-        # create a self-signed cert
+-        cert = crypto.X509()
+-        cert.get_subject().O = "IT"
+-        cert.get_subject().CN = "ceph-restful"
+-        cert.set_serial_number(int(uuid4()))
+-        cert.gmtime_adj_notBefore(0)
+-        cert.gmtime_adj_notAfter(10*365*24*60*60)
+-        cert.set_issuer(cert.get_subject())
+-        cert.set_pubkey(pkey)
+-        cert.sign(pkey, 'sha512')
+        cmd = ["python3", "-m", "ceph._crypto_wrap", "create_self_signed_cert"]
+
+        response = subprocess.run(cmd, capture_output=True, check=True)
+        response_obj = json.loads(response.stdout)
+ 
+         return (
+-            crypto.dump_certificate(crypto.FILETYPE_PEM, cert),
+-            crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey)
+            response_obj["cert"].encode("utf-8"),
+            response_obj["key"].encode("utf-8"),
+         )
+ 
+ 
+diff --git a/src/python-common/ceph/_crypto_wrap.py b/src/python-common/ceph/_crypto_wrap.py
+new file mode 100644
+index 00000000000..16a19a5345e
+--- /dev/null
+++ b/src/python-common/ceph/_crypto_wrap.py
+@@ -0,0 +1,69 @@
+"""CLI wrapper for cryptographic functions of the :mod:`restful` module.
+
+To be called via :func:`subprocess.run()` as a workaround for
+:class:`ImportError`s related to PyO3's current lack of sub-interpreter
+support.
+
+Note:
+    Since this module is installed as part of the ``ceph`` package,
+    it should be called like so::
+
+        python3 -m ceph._crypto_wrap create_self_signed_cert
+"""
+
+import argparse
+import sys
+import json
+
+from argparse import Namespace
+from typing import Any
+from uuid import uuid4
+
+from OpenSSL import crypto
+
+
+def _respond(data: dict[str, Any]) -> None:
+    json.dump(data, sys.stdout)
+    sys.stdout.flush()
+
+
+def create_self_signed_cert(args: Namespace) -> None:
+    cert_key_pair = _create_self_signed_cert()
+    _respond(cert_key_pair)
+
+
+def _create_self_signed_cert() -> dict[str, str]:
+    # create a key pair
+    pubkey = crypto.PKey()
+    pubkey.generate_key(crypto.TYPE_RSA, 2048)
+
+    # create a self-signed cert
+    cert = crypto.X509()
+    cert.get_subject().O = "IT"
+    cert.get_subject().CN = "ceph-restful"
+    cert.set_serial_number(int(uuid4()))
+    cert.gmtime_adj_notBefore(0)
+    cert.gmtime_adj_notAfter(10 * 365 * 24 * 60 * 60)
+    cert.set_issuer(cert.get_subject())
+    cert.set_pubkey(pubkey)
+    cert.sign(pubkey, "sha512")
+
+    return {
+        "cert": crypto.dump_certificate(crypto.FILETYPE_PEM, cert).decode(),
+        "key": crypto.dump_privatekey(crypto.FILETYPE_PEM, pubkey).decode(),
+    }
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(prog="_crypto_wrap.py")
+    subparsers = parser.add_subparsers(required=True)
+
+    parser_cssc = subparsers.add_parser("create_self_signed_cert")
+    parser_cssc.set_defaults(func=create_self_signed_cert)
+
+    args = parser.parse_args()
+    args.func(args)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,56 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Max R. Carrara" <m.carrara@proxmox.com>
+Date: Wed, 16 Jul 2025 16:31:43 +0200
+Subject: [PATCH 59/59] mgr: fix module import by making NOTIFY_TYPES in py
+ modules optional
+
+If NOTIFY_TYPES isn't an attribute of the passed class, the Python
+(sub-)interpreter raises an AttributeError that must be handled or cleared
+explicitly via the Python C-API. Unfortunately, this isn't done here,
+which means that the exception sticks around until handled.
+
+This caused a call to PyModule::load_subclass_of() to fail and
+incorrectly report the AttributeError as cause.
+
+Checking whether the class has NOTIFY_TYPES as attribute in the first
+place fixes this.
+
+Note that there's an upstream PR [0] that wasn't backported that aimed
+to fix this, but does so incorrectly, as the exception is still not
+cleared there. The warnings regarding NOTIFY_TYPES missing also occurs
+on Reef but doesn't cause any module imports to fail there. As the
+affected Ceph code has stayed mostly the same between bookworm and
+trixie releases, this suggests that some behavior between Python 3.11
+and 3.13 likely changed.
+
+Either way, avoiding the AttributeError altogether fixes this.
+
+[0]: https://github.com/ceph/ceph/pull/57106
+
+Signed-off-by: Max R. Carrara <m.carrara@proxmox.com>
+---
+ src/mgr/PyModule.cc | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/src/mgr/PyModule.cc b/src/mgr/PyModule.cc
+index 084cf3ffc1e..e6fd269dca5 100644
+--- a/src/mgr/PyModule.cc
+++ b/src/mgr/PyModule.cc
+@@ -513,11 +513,13 @@ int PyModule::register_options(PyObject *cls)
+ 
+ int PyModule::load_notify_types()
+ {
+-  PyObject *ls = PyObject_GetAttrString(pClass, "NOTIFY_TYPES");
+-  if (ls == nullptr) {
+-    derr << "Module " << get_name() << " has missing NOTIFY_TYPES member" << dendl;
+-    return -EINVAL;
+  if (!PyObject_HasAttrString(pClass, "NOTIFY_TYPES")) {
+    dout(10) << "Module " << get_name() << " has no NOTIFY_TYPES member" << dendl;
+    return 0;
+   }
+
+  PyObject *ls = PyObject_GetAttrString(pClass, "NOTIFY_TYPES");
+
+   if (!PyObject_TypeCheck(ls, &PyList_Type)) {
+     // Relatively easy mistake for human to make, e.g. defining COMMANDS
+     // as a {} instead of a []
@@ -1 +1 @@
-SHA512 (ceph-14.2.7.tar.gz) = 59f475e56053ba5e7e3a482a3a91b4d44272e6ec8051b92783de76c09c0d967a7ef76676db998968a709e48f08e90828dd8f86bd96a7c3fd111d48bfb7fd93b1
+SHA512 (ceph-19.2.3.tar.gz) = 278101d2df7bed5363b20c2b065d7a7b26252c8164511257e213ffaa58d509015558183de10bc9281bcbe4d9f85244bcac5bba4db9823e28df6a96d0b687d00a