as
, but the
+tokenizer emits the SelfClosingTagToken token incorrectly. When the
+parser is used to parse foreign content, this results in an incorrect
+DOM.
+
+Thanks to Sean Ng (https://ensy.zip) for reporting this issue.
+
+Fixes golang/go#73070
+Fixes CVE-2025-22872
+
+Change-Id: I65c18df6d6244bf943b61e6c7a87895929e78f4f
+Reviewed-on: https://go-review.googlesource.com/c/net/+/661256
+Reviewed-by: Neal Patel ).
++ //
++ // To avoid this, we check that the last non-bracket character of the tag
++ // (z.raw.end-2) isn't the same character as the last non-quote character of
++ // the last attribute of the tag (z.pendingAttr[1].end-1), if the tag has
++ // attributes.
++ nAttrs := len(z.attr)
++ if z.err == nil && z.buf[z.raw.end-2] == '/' && (nAttrs == 0 || z.raw.end-2 != z.attr[nAttrs-1][1].end-1) {
+ return SelfClosingTagToken
+ }
+ return StartTagToken
+--
+2.34.1
+
diff --git a/SPECS/caddy/Caddyfile b/SPECS/caddy/Caddyfile
new file mode 100644
index 000000000..e36677f83
--- /dev/null
+++ b/SPECS/caddy/Caddyfile
@@ -0,0 +1,36 @@
+# The Caddyfile is an easy way to configure your Caddy web server.
+#
+# https://caddyserver.com/docs/caddyfile
+
+
+# The configuration below serves a welcome page over HTTP on port 80. To use
+# your own domain name with automatic HTTPS, ensure your A/AAAA DNS record is
+# pointing to this machine's public IP, then replace `http://` with your domain
+# name. Refer to the documentation for full instructions on the address
+# specification.
+#
+# https://caddyserver.com/docs/caddyfile/concepts#addresses
+http:// {
+
+ # Set this path to your site's directory.
+ root * /usr/share/caddy
+
+ # Enable the static file server.
+ file_server
+
+ # Another common task is to set up a reverse proxy:
+ # reverse_proxy localhost:8080
+
+ # Or serve a PHP site through php-fpm:
+ # php_fastcgi localhost:9000
+
+ # Refer to the directive documentation for more options.
+ # https://caddyserver.com/docs/caddyfile/directives
+
+}
+
+
+# As an alternative to editing the above site block, you can add your own site
+# block files in the Caddyfile.d directory, and they will be included as long
+# as they use the .caddyfile extension.
+import Caddyfile.d/*.caddyfile
diff --git a/SPECS/caddy/caddy-api.service b/SPECS/caddy/caddy-api.service
new file mode 100644
index 000000000..255a28907
--- /dev/null
+++ b/SPECS/caddy/caddy-api.service
@@ -0,0 +1,28 @@
+# caddy-api.service
+#
+# For using Caddy with its API.
+#
+# This unit is "durable" in that it will automatically resume
+# the last active configuration if the service is restarted.
+#
+# See https://caddyserver.com/docs/install for instructions.
+
+[Unit]
+Description=Caddy web server
+Documentation=https://caddyserver.com/docs/
+After=network.target
+
+[Service]
+Type=notify
+User=caddy
+Group=caddy
+ExecStart=/usr/bin/caddy run --environ --resume
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=full
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
diff --git a/SPECS/caddy/caddy.service b/SPECS/caddy/caddy.service
new file mode 100644
index 000000000..ad63c7f93
--- /dev/null
+++ b/SPECS/caddy/caddy.service
@@ -0,0 +1,34 @@
+# caddy.service
+#
+# For using Caddy with a config file.
+#
+# WARNING: This service does not use the --resume flag, so if you
+# use the API to make changes, they will be overwritten by the
+# Caddyfile next time the service is restarted. If you intend to
+# use Caddy's API to configure it, add the --resume flag to the
+# `caddy run` command or use the caddy-api.service file instead.
+
+[Unit]
+Description=Caddy web server
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=caddy
+Group=caddy
+ExecStartPre=/usr/bin/caddy validate --config /etc/caddy/Caddyfile
+RestartSec=30
+Restart=on-failure
+ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
+ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=full
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
diff --git a/SPECS/caddy/caddy.signatures.json b/SPECS/caddy/caddy.signatures.json
new file mode 100644
index 000000000..da8730e8a
--- /dev/null
+++ b/SPECS/caddy/caddy.signatures.json
@@ -0,0 +1,14 @@
+{
+ "Signatures": {
+ "Caddyfile": "c6e7715a31ed0f848905aa014683aa2c6f21e67309ba6c3a56d4726a6ddc1671",
+ "caddy.service": "8ae211e682bb4dfe4c9f3638824661cd2748b448dcb26271f0a1a9f59590c4c3",
+ "caddy-api.service": "15e8707b9d2db29bbd0d1d36cad04835512f60bfb567f76997b902457083e431",
+ "caddy.sysusers": "b244d33b92833a3c3c186337579cb24ce29289d7c6a72ebde447b3ae1c79fd4f",
+ "create-vendor-tarball.sh": "70b325f869e53dc297cf003bc8eabe43fcf00fcfaf457b178ed45e1127aaf662",
+ "poweredby-black.png": "4691c0d3bd2156db97b76d12f0c98662fe8869f30fe2c07631ffb43bda09e6a1",
+ "poweredby-white.png": "e128419a13a91428ea9985fd54c91b8e80061c4d72b4ee913e616b3c823fcdd6",
+ "0001-Disable-commands-that-can-alter-the-binary.patch": "1ef152b99af5a3a549254c845145ea9142abd571fb92c370acb3604dc77a1415",
+ "caddy-2.9.1.tar.gz": "beb52478dfb34ad29407003520d94ee0baccbf210d1af72cebf430d6d7dd7b63",
+ "caddy-2.9.1-vendor.tar.gz": "3a7bc2b669f1cc55273d9486fd651473ca5de02131c4de292bffac0aaab82837"
+ }
+}
diff --git a/SPECS/caddy/caddy.spec b/SPECS/caddy/caddy.spec
new file mode 100644
index 000000000..c3f9cad3e
--- /dev/null
+++ b/SPECS/caddy/caddy.spec
@@ -0,0 +1,801 @@
+%global goipath github.com/caddyserver/caddy
+
+Summary: Web server with automatic HTTPS
+Name: caddy
+Version: 2.9.1
+Release: 13%{?dist}
+Distribution: Edge Microvisor Toolkit
+Vendor: Intel Corporation
+# main source code is Apache-2.0
+# see comments above provides tags for bundled license breakdown
+License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND MIT AND BSD-2-Clause-Views AND CC0-1.0 AND ISC AND MPL-2.0
+URL: https://caddyserver.com
+Source0: https://%{goipath}/archive/v%{version}/caddy-%{version}.tar.gz
+
+# vendored dependencies
+Source1: caddy-%{version}-vendor.tar.gz
+Source2: create-vendor-tarball.sh
+
+# based on reference files upstream
+# https://github.com/caddyserver/dist
+Source10: Caddyfile
+Source20: caddy.service
+Source21: caddy-api.service
+Source22: caddy.sysusers
+Source30: poweredby-white.png
+Source31: poweredby-black.png
+
+# downstream only patch to disable commands that can alter the binary
+Patch1: 0001-Disable-commands-that-can-alter-the-binary.patch
+Patch2: CVE-2025-22869.patch
+Patch3: CVE-2024-45339.patch
+Patch4: CVE-2025-22872.patch
+BuildRequires: go-rpm-macros
+# https://github.com/caddyserver/caddy/commit/2028da4e74cd41f0f7f94222c6599da1a371d4b8
+BuildRequires: golang >= 1.24.4
+BuildRequires: golang < 1.25
+# dario.cat/mergo : BSD-3-Clause
+Provides: bundled(golang(dario.cat/mergo)) = 1.0.1
+# filippo.io/edwards25519 : BSD-3-Clause
+Provides: bundled(golang(filippo.io/edwards25519)) = 1.1.0
+# github.com/AndreasBriese/bbloom : MIT AND CC0-1.0
+Provides: bundled(golang(github.com/AndreasBriese/bbloom)) = 46b345b
+# github.com/BurntSushi/toml : MIT
+Provides: bundled(golang(github.com/BurntSushi/toml)) = 1.4.0
+# github.com/Masterminds/goutils : Apache-2.0
+Provides: bundled(golang(github.com/Masterminds/goutils)) = 1.1.1
+# github.com/Masterminds/semver/v3 : MIT
+Provides: bundled(golang(github.com/Masterminds/semver/v3)) = 3.3.0
+# github.com/Masterminds/sprig/v3 : MIT
+Provides: bundled(golang(github.com/Masterminds/sprig/v3)) = 3.3.0
+# github.com/Microsoft/go-winio : MIT
+Provides: bundled(golang(github.com/Microsoft/go-winio)) = 0.6.0
+# github.com/alecthomas/chroma/v2 : MIT
+Provides: bundled(golang(github.com/alecthomas/chroma/v2)) = 2.14.0
+# github.com/antlr4-go/antlr/v4 : BSD-3-Clause
+Provides: bundled(golang(github.com/antlr4-go/antlr/v4)) = 4.13.0
+# github.com/aryann/difflib : MIT
+Provides: bundled(golang(github.com/aryann/difflib)) = ff5ff6d
+# github.com/beorn7/perks : MIT
+Provides: bundled(golang(github.com/beorn7/perks)) = 1.0.1
+# github.com/caddyserver/certmagic : Apache-2.0
+Provides: bundled(golang(github.com/caddyserver/certmagic)) = 0.21.6
+# github.com/caddyserver/zerossl : MIT
+Provides: bundled(golang(github.com/caddyserver/zerossl)) = 0.1.3
+# github.com/cenkalti/backoff/v4 : MIT
+Provides: bundled(golang(github.com/cenkalti/backoff/v4)) = 4.3.0
+# github.com/cespare/xxhash : MIT
+Provides: bundled(golang(github.com/cespare/xxhash)) = 1.1.0
+# github.com/cespare/xxhash/v2 : MIT
+Provides: bundled(golang(github.com/cespare/xxhash/v2)) = 2.3.0
+# github.com/chzyer/readline : MIT
+Provides: bundled(golang(github.com/chzyer/readline)) = 1.5.1
+# github.com/cpuguy83/go-md2man/v2 : MIT
+Provides: bundled(golang(github.com/cpuguy83/go-md2man/v2)) = 2.0.4
+# github.com/davecgh/go-spew : ISC
+Provides: bundled(golang(github.com/davecgh/go-spew)) = 1.1.1
+# github.com/dgraph-io/badger : Apache-2.0
+Provides: bundled(golang(github.com/dgraph-io/badger)) = 1.6.2
+# github.com/dgraph-io/badger/v2 : Apache-2.0
+Provides: bundled(golang(github.com/dgraph-io/badger/v2)) = 2.2007.4
+# github.com/dgraph-io/ristretto : Apache-2.0 AND MIT
+Provides: bundled(golang(github.com/dgraph-io/ristretto)) = 0.1.0
+# github.com/dgryski/go-farm : MIT
+Provides: bundled(golang(github.com/dgryski/go-farm)) = a6ae236
+# github.com/dlclark/regexp2 : MIT
+Provides: bundled(golang(github.com/dlclark/regexp2)) = 1.11.0
+# github.com/dustin/go-humanize : MIT
+Provides: bundled(golang(github.com/dustin/go-humanize)) = 1.0.1
+# github.com/felixge/httpsnoop : MIT
+Provides: bundled(golang(github.com/felixge/httpsnoop)) = 1.0.4
+# github.com/francoispqt/gojay : MIT
+Provides: bundled(golang(github.com/francoispqt/gojay)) = 1.2.13
+# github.com/fxamacker/cbor/v2 : MIT
+Provides: bundled(golang(github.com/fxamacker/cbor/v2)) = 2.6.0
+# github.com/go-chi/chi/v5 : MIT
+Provides: bundled(golang(github.com/go-chi/chi/v5)) = 5.0.12
+# github.com/go-jose/go-jose/v3 : Apache-2.0 AND BSD-3-Clause
+Provides: bundled(golang(github.com/go-jose/go-jose/v3)) = 3.0.3
+# github.com/go-kit/kit : MIT
+Provides: bundled(golang(github.com/go-kit/kit)) = 0.13.0
+# github.com/go-kit/log : MIT
+Provides: bundled(golang(github.com/go-kit/log)) = 0.2.1
+# github.com/go-logfmt/logfmt : MIT
+Provides: bundled(golang(github.com/go-logfmt/logfmt)) = 0.6.0
+# github.com/go-logr/logr : Apache-2.0
+Provides: bundled(golang(github.com/go-logr/logr)) = 1.4.2
+# github.com/go-logr/stdr : Apache-2.0
+Provides: bundled(golang(github.com/go-logr/stdr)) = 1.2.2
+# github.com/go-sql-driver/mysql : MPL-2.0
+Provides: bundled(golang(github.com/go-sql-driver/mysql)) = 1.7.1
+# github.com/go-task/slim-sprig : MIT
+Provides: bundled(golang(github.com/go-task/slim-sprig)) = 52ccab3
+# github.com/golang/glog : Apache-2.0
+Provides: bundled(golang(github.com/golang/glog)) = 1.2.2
+# github.com/golang/protobuf : BSD-3-Clause
+Provides: bundled(golang(github.com/golang/protobuf)) = 1.5.4
+# github.com/golang/snappy : BSD-3-Clause
+Provides: bundled(golang(github.com/golang/snappy)) = 0.0.4
+# github.com/google/cel-go : Apache-2.0
+Provides: bundled(golang(github.com/google/cel-go)) = 0.21.0
+# github.com/google/certificate-transparency-go : Apache-2.0
+Provides: bundled(golang(github.com/google/certificate-transparency-go)) = 74a5dd3
+# github.com/google/go-tpm : Apache-2.0
+Provides: bundled(golang(github.com/google/go-tpm)) = 0.9.0
+# github.com/google/go-tspi : Apache-2.0
+Provides: bundled(golang(github.com/google/go-tspi)) = 0.3.0
+# github.com/google/pprof : Apache-2.0
+Provides: bundled(golang(github.com/google/pprof)) = ec68065
+# github.com/google/uuid : BSD-3-Clause
+Provides: bundled(golang(github.com/google/uuid)) = 1.6.0
+# github.com/grpc-ecosystem/grpc-gateway/v2 : BSD-3-Clause
+Provides: bundled(golang(github.com/grpc-ecosystem/grpc-gateway/v2)) = 2.22.0
+# github.com/huandu/xstrings : MIT
+Provides: bundled(golang(github.com/huandu/xstrings)) = 1.5.0
+# github.com/inconshreveable/mousetrap : Apache-2.0
+Provides: bundled(golang(github.com/inconshreveable/mousetrap)) = 1.1.0
+# github.com/jackc/chunkreader/v2 : MIT
+Provides: bundled(golang(github.com/jackc/chunkreader/v2)) = 2.0.1
+# github.com/jackc/pgconn : MIT
+Provides: bundled(golang(github.com/jackc/pgconn)) = 1.14.3
+# github.com/jackc/pgio : MIT
+Provides: bundled(golang(github.com/jackc/pgio)) = 1.0.0
+# github.com/jackc/pgpassfile : MIT
+Provides: bundled(golang(github.com/jackc/pgpassfile)) = 1.0.0
+# github.com/jackc/pgproto3/v2 : MIT
+Provides: bundled(golang(github.com/jackc/pgproto3/v2)) = 2.3.3
+# github.com/jackc/pgservicefile : MIT
+Provides: bundled(golang(github.com/jackc/pgservicefile)) = 091c0ba
+# github.com/jackc/pgtype : MIT
+Provides: bundled(golang(github.com/jackc/pgtype)) = 1.14.0
+# github.com/jackc/pgx/v4 : MIT
+Provides: bundled(golang(github.com/jackc/pgx/v4)) = 4.18.3
+# github.com/klauspost/compress : BSD-3-Clause AND Apache-2.0 AND MIT
+Provides: bundled(golang(github.com/klauspost/compress)) = 1.17.11
+# github.com/klauspost/cpuid/v2 : MIT
+Provides: bundled(golang(github.com/klauspost/cpuid/v2)) = 2.2.9
+# github.com/libdns/libdns : MIT
+Provides: bundled(golang(github.com/libdns/libdns)) = 0.2.2
+# github.com/manifoldco/promptui : BSD-3-Clause
+Provides: bundled(golang(github.com/manifoldco/promptui)) = 0.9.0
+# github.com/mattn/go-colorable : MIT
+Provides: bundled(golang(github.com/mattn/go-colorable)) = 0.1.13
+# github.com/mattn/go-isatty : MIT
+Provides: bundled(golang(github.com/mattn/go-isatty)) = 0.0.20
+# github.com/mgutz/ansi : MIT
+Provides: bundled(golang(github.com/mgutz/ansi)) = d51e80e
+# github.com/mholt/acmez/v3 : Apache-2.0 AND BSD-3-Clause
+Provides: bundled(golang(github.com/mholt/acmez/v3)) = 3.0.0
+# github.com/miekg/dns : BSD-3-Clause
+Provides: bundled(golang(github.com/miekg/dns)) = 1.1.62
+# github.com/mitchellh/copystructure : MIT
+Provides: bundled(golang(github.com/mitchellh/copystructure)) = 1.2.0
+# github.com/mitchellh/go-ps : MIT
+Provides: bundled(golang(github.com/mitchellh/go-ps)) = 1.0.0
+# github.com/mitchellh/reflectwalk : MIT
+Provides: bundled(golang(github.com/mitchellh/reflectwalk)) = 1.0.2
+# github.com/onsi/ginkgo/v2 : MIT
+Provides: bundled(golang(github.com/onsi/ginkgo/v2)) = 2.13.2
+# github.com/pires/go-proxyproto : Apache-2.0
+Provides: bundled(golang(github.com/pires/go-proxyproto)) = b718e7c
+# github.com/pkg/errors : BSD-2-Clause
+Provides: bundled(golang(github.com/pkg/errors)) = 0.9.1
+# github.com/pmezard/go-difflib : BSD-3-Clause
+Provides: bundled(golang(github.com/pmezard/go-difflib)) = 1.0.0
+# github.com/prometheus/client_golang : Apache-2.0
+Provides: bundled(golang(github.com/prometheus/client_golang)) = 1.19.1
+# github.com/prometheus/client_model : Apache-2.0
+Provides: bundled(golang(github.com/prometheus/client_model)) = 0.5.0
+# github.com/prometheus/common : Apache-2.0
+Provides: bundled(golang(github.com/prometheus/common)) = 0.48.0
+# github.com/prometheus/procfs : Apache-2.0
+Provides: bundled(golang(github.com/prometheus/procfs)) = 0.12.0
+# github.com/quic-go/qpack : MIT
+Provides: bundled(golang(github.com/quic-go/qpack)) = 0.5.1
+# github.com/quic-go/quic-go : MIT
+Provides: bundled(golang(github.com/quic-go/quic-go)) = 0.48.2
+# github.com/rs/xid : MIT
+Provides: bundled(golang(github.com/rs/xid)) = 1.5.0
+# github.com/russross/blackfriday/v2 : BSD-2-Clause
+Provides: bundled(golang(github.com/russross/blackfriday/v2)) = 2.1.0
+# github.com/shopspring/decimal : MIT
+Provides: bundled(golang(github.com/shopspring/decimal)) = 1.4.0
+# github.com/shurcooL/sanitized_anchor_name : MIT
+Provides: bundled(golang(github.com/shurcooL/sanitized_anchor_name)) = 1.0.0
+# github.com/sirupsen/logrus : MIT
+Provides: bundled(golang(github.com/sirupsen/logrus)) = 1.9.3
+# github.com/slackhq/nebula : MIT
+Provides: bundled(golang(github.com/slackhq/nebula)) = 1.6.1
+# github.com/smallstep/certificates : Apache-2.0
+Provides: bundled(golang(github.com/smallstep/certificates)) = 0.26.1
+# github.com/smallstep/go-attestation : Apache-2.0
+Provides: bundled(golang(github.com/smallstep/go-attestation)) = 413678f
+# github.com/smallstep/nosql : Apache-2.0
+Provides: bundled(golang(github.com/smallstep/nosql)) = 0.6.1
+# github.com/smallstep/pkcs7 : MIT
+Provides: bundled(golang(github.com/smallstep/pkcs7)) = 3b98ecc
+# github.com/smallstep/scep : MIT
+Provides: bundled(golang(github.com/smallstep/scep)) = aee96d7
+# github.com/smallstep/truststore : Apache-2.0
+Provides: bundled(golang(github.com/smallstep/truststore)) = 0.13.0
+# github.com/spf13/cast : MIT
+Provides: bundled(golang(github.com/spf13/cast)) = 1.7.0
+# github.com/spf13/cobra : Apache-2.0
+Provides: bundled(golang(github.com/spf13/cobra)) = 1.8.1
+# github.com/spf13/pflag : BSD-3-Clause
+Provides: bundled(golang(github.com/spf13/pflag)) = 1.0.5
+# github.com/stoewer/go-strcase : MIT
+Provides: bundled(golang(github.com/stoewer/go-strcase)) = 1.2.0
+# github.com/stretchr/testify : MIT
+Provides: bundled(golang(github.com/stretchr/testify)) = 1.9.0
+# github.com/tailscale/tscert : BSD-3-Clause
+Provides: bundled(golang(github.com/tailscale/tscert)) = d3f8340
+# github.com/urfave/cli : MIT
+Provides: bundled(golang(github.com/urfave/cli)) = 1.22.14
+# github.com/x448/float16 : MIT
+Provides: bundled(golang(github.com/x448/float16)) = 0.8.4
+# github.com/yuin/goldmark : MIT
+Provides: bundled(golang(github.com/yuin/goldmark)) = 1.7.8
+# github.com/yuin/goldmark-highlighting/v2 : MIT
+Provides: bundled(golang(github.com/yuin/goldmark-highlighting/v2)) = 37449ab
+# github.com/zeebo/blake3 : CC0-1.0
+Provides: bundled(golang(github.com/zeebo/blake3)) = 0.2.4
+# go.etcd.io/bbolt : MIT
+Provides: bundled(golang(go.etcd.io/bbolt)) = 1.3.9
+# go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp)) = 0.56.0
+# go.opentelemetry.io/contrib/propagators/autoprop : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/contrib/propagators/autoprop)) = 0.42.0
+# go.opentelemetry.io/contrib/propagators/aws : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/contrib/propagators/aws)) = 1.17.0
+# go.opentelemetry.io/contrib/propagators/b3 : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/contrib/propagators/b3)) = 1.17.0
+# go.opentelemetry.io/contrib/propagators/jaeger : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/contrib/propagators/jaeger)) = 1.17.0
+# go.opentelemetry.io/contrib/propagators/ot : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/contrib/propagators/ot)) = 1.17.0
+# go.opentelemetry.io/otel : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/otel)) = 1.31.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/otel/exporters/otlp/otlptrace)) = 1.31.0
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc)) = 1.31.0
+# go.opentelemetry.io/otel/metric : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/otel/metric)) = 1.31.0
+# go.opentelemetry.io/otel/sdk : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/otel/sdk)) = 1.31.0
+# go.opentelemetry.io/otel/trace : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/otel/trace)) = 1.31.0
+# go.opentelemetry.io/proto/otlp : Apache-2.0
+Provides: bundled(golang(go.opentelemetry.io/proto/otlp)) = 1.3.1
+# go.step.sm/cli-utils : Apache-2.0 AND BSD-2-Clause
+Provides: bundled(golang(go.step.sm/cli-utils)) = 0.9.0
+# go.step.sm/crypto : Apache-2.0 AND BSD-2-Clause
+Provides: bundled(golang(go.step.sm/crypto)) = 0.45.0
+# go.step.sm/linkedca : Apache-2.0
+Provides: bundled(golang(go.step.sm/linkedca)) = 0.20.1
+# go.uber.org/automaxprocs : MIT
+Provides: bundled(golang(go.uber.org/automaxprocs)) = 1.6.0
+# go.uber.org/mock : Apache-2.0
+Provides: bundled(golang(go.uber.org/mock)) = 0.4.0
+# go.uber.org/multierr : MIT
+Provides: bundled(golang(go.uber.org/multierr)) = 1.11.0
+# go.uber.org/zap : MIT
+Provides: bundled(golang(go.uber.org/zap)) = 1.27.0
+# go.uber.org/zap/exp : MIT
+Provides: bundled(golang(go.uber.org/zap/exp)) = 0.3.0
+# golang.org/x/crypto : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/crypto)) = 0.31.0
+# golang.org/x/crypto/x509roots/fallback : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/crypto/x509roots/fallback)) = 71ed71b
+# golang.org/x/exp : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/exp)) = 9bf2ced
+# golang.org/x/mod : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/mod)) = 0.18.0
+# golang.org/x/net : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/net)) = 0.33.0
+# golang.org/x/sync : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/sync)) = 0.10.0
+# golang.org/x/sys : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/sys)) = 0.28.0
+# golang.org/x/term : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/term)) = 0.27.0
+# golang.org/x/text : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/text)) = 0.21.0
+# golang.org/x/time : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/time)) = 0.7.0
+# golang.org/x/tools : BSD-3-Clause
+Provides: bundled(golang(golang.org/x/tools)) = 0.22.0
+# google.golang.org/genproto/googleapis/api : Apache-2.0
+Provides: bundled(golang(google.golang.org/genproto/googleapis/api)) = 5fefd90
+# google.golang.org/genproto/googleapis/rpc : Apache-2.0
+Provides: bundled(golang(google.golang.org/genproto/googleapis/rpc)) = 5fefd90
+# google.golang.org/grpc : Apache-2.0
+Provides: bundled(golang(google.golang.org/grpc)) = 1.67.1
+# google.golang.org/protobuf : BSD-3-Clause
+Provides: bundled(golang(google.golang.org/protobuf)) = 1.35.1
+# gopkg.in/natefinch/lumberjack.v2 : MIT
+Provides: bundled(golang(gopkg.in/natefinch/lumberjack.v2)) = 2.2.1
+# gopkg.in/yaml.v3 : Apache-2.0 AND MIT
+Provides: bundled(golang(gopkg.in/yaml.v3)) = 3.0.1
+# howett.net/plist : BSD-2-Clause-Views AND BSD-3-Clause
+Provides: bundled(golang(howett.net/plist)) = 1.0.0
+
+BuildRequires: systemd-rpm-macros
+
+%{?systemd_requires}
+%{?sysusers_requires_compat}
+Provides: webserver
+
+%description
+Caddy is an extensible server platform that uses TLS by default.
+
+%prep
+%autosetup -p 1 -a 1
+mkdir -p src/$(dirname %{goipath})
+ln -s $PWD src/%{goipath}
+
+%build
+export GO111MODULE=off
+export GOPATH=$PWD
+CGO_ENABLED=0 go build -trimpath -gcflags=-l -ldflags="-X %{goipath}.CustomVersion=v%{version}" -o bin/caddy %{goipath}/cmd/caddy
+
+
+%install
+# command
+install -D -p -m 0755 -t %{buildroot}%{_bindir} bin/caddy
+
+# man pages
+./bin/caddy manpage --directory %{buildroot}%{_mandir}/man8
+
+# config
+install -D -p -m 0644 %{S:10} %{buildroot}%{_sysconfdir}/caddy/Caddyfile
+install -d -m 0755 %{buildroot}%{_sysconfdir}/caddy/Caddyfile.d
+
+# systemd units
+install -D -p -m 0644 -t %{buildroot}%{_unitdir} %{S:20} %{S:21}
+
+# sysusers
+install -D -p -m 0644 %{S:22} %{buildroot}%{_sysusersdir}/caddy.conf
+
+# data directory
+install -d -m 0750 %{buildroot}%{_sharedstatedir}/caddy
+
+# welcome page
+install -D -p -m 0644 %{S:31} %{buildroot}%{_datadir}/caddy/poweredby.png
+ln -s ../testpage/index.html %{buildroot}%{_datadir}/caddy/index.html
+install -d -m 0755 %{buildroot}%{_datadir}/caddy/icons
+ln -s ../../pixmaps/poweredby.png %{buildroot}%{_datadir}/caddy/icons/poweredby.png
+
+# shell completions
+install -d -m 0755 %{buildroot}%{_datadir}/bash-completion/completions
+./bin/caddy completion bash > %{buildroot}%{_datadir}/bash-completion/completions/caddy
+install -d -m 0755 %{buildroot}%{_datadir}/zsh/site-functions
+./bin/caddy completion zsh > %{buildroot}%{_datadir}/zsh/site-functions/_caddy
+install -d -m 0755 %{buildroot}%{_datadir}/fish/vendor_completions.d
+./bin/caddy completion fish > %{buildroot}%{_datadir}/fish/vendor_completions.d/caddy.fish
+
+
+%check
+# ensure that the version was embedded correctly
+[[ "$(./bin/caddy version)" == "v%{version}" ]] || exit 1
+
+# run the upstream tests
+export GOPATH=$PWD
+cd src/%{goipath}
+%gotest ./...
+
+%pre
+%sysusers_create_compat %{S:22}
+
+%systemd_post caddy.service
+
+if [ -x %{_sbindir}/getsebool ]; then
+ # connect to ACME endpoint to request certificates
+ setsebool -P httpd_can_network_connect on
+fi
+if [ -x %{_sbindir}/semanage -a -x %{_sbindir}/restorecon ]; then
+ # file contexts
+ semanage fcontext --add --type httpd_exec_t '%{_bindir}/caddy' 2> /dev/null || :
+ semanage fcontext --add --type httpd_sys_content_t '%{_datadir}/caddy(/.*)?' 2> /dev/null || :
+ semanage fcontext --add --type httpd_config_t '%{_sysconfdir}/caddy(/.*)?' 2> /dev/null || :
+ semanage fcontext --add --type httpd_var_lib_t '%{_sharedstatedir}/caddy(/.*)?' 2> /dev/null || :
+ restorecon -r %{_bindir}/caddy %{_datadir}/caddy %{_sysconfdir}/caddy %{_sharedstatedir}/caddy || :
+fi
+if [ -x %{_sbindir}/semanage ]; then
+ # QUIC
+ semanage port --add --type http_port_t --proto udp 80 2> /dev/null || :
+ semanage port --add --type http_port_t --proto udp 443 2> /dev/null || :
+ # admin endpoint
+ semanage port --add --type http_port_t --proto tcp 2019 2> /dev/null || :
+fi
+
+%preun
+%systemd_preun caddy.service
+
+%postun
+%systemd_postun_with_restart caddy.service
+
+if [ $1 -eq 0 ]; then
+ if [ -x %{_sbindir}/getsebool ]; then
+ # connect to ACME endpoint to request certificates
+ setsebool -P httpd_can_network_connect off
+ fi
+ if [ -x %{_sbindir}/semanage ]; then
+ # file contexts
+ semanage fcontext --delete --type httpd_exec_t '%{_bindir}/caddy' 2> /dev/null || :
+ semanage fcontext --delete --type httpd_sys_content_t '%{_datadir}/caddy(/.*)?' 2> /dev/null || :
+ semanage fcontext --delete --type httpd_config_t '%{_sysconfdir}/caddy(/.*)?' 2> /dev/null || :
+ semanage fcontext --delete --type httpd_var_lib_t '%{_sharedstatedir}/caddy(/.*)?' 2> /dev/null || :
+ # QUIC
+ semanage port --delete --type http_port_t --proto udp 80 2> /dev/null || :
+ semanage port --delete --type http_port_t --proto udp 443 2> /dev/null || :
+ # admin endpoint
+ semanage port --delete --type http_port_t --proto tcp 2019 2> /dev/null || :
+ fi
+fi
+
+%files
+%license LICENSE
+%doc README.md AUTHORS
+%{_bindir}/caddy
+%{_mandir}/man8/caddy*.8*
+%{_datadir}/caddy
+%{_unitdir}/caddy.service
+%{_unitdir}/caddy-api.service
+%{_sysusersdir}/caddy.conf
+%attr(0750,caddy,caddy) %{_sysconfdir}/caddy
+%config(noreplace) %{_sysconfdir}/caddy/Caddyfile
+%dir %{_sysconfdir}/caddy/Caddyfile.d
+%attr(0750,caddy,caddy) %dir %{_sharedstatedir}/caddy
+%{_datadir}/bash-completion/completions/caddy
+%{_datadir}/zsh/site-functions/_caddy
+%{_datadir}/fish/vendor_completions.d/caddy.fish
+
+%changelog
+* Tue DEc 16 2025 Andy
".
+- if z.err == nil && z.buf[z.raw.end-2] == '/' {
++ // Look for a self-closing token (e.g.
).
++ //
++ // Originally, we did this by just checking that the last character of the
++ // tag (ignoring the closing bracket) was a solidus (/) character, but this
++ // is not always accurate.
++ //
++ // We need to be careful that we don't misinterpret a non-self-closing tag
++ // as self-closing, as can happen if the tag contains unquoted attribute
++ // values (i.e.