haproxy: update to v3.4.1

[gladiac]

📦 Package Details

Maintainer: @gladiac

Description:

• New major LTS version. See https://www.haproxy.com/blog/announcing-haproxy-3-4
• Updated haproxy PKG_VERSION and PKG_HASH
• Added patch to insert version information into halog. This is to make the ci/cd happy.
• See changes: http://git.haproxy.org/?p=haproxy-3.4.git;a=shortlog

---

🧪 Run Testing Details

• OpenWrt Version: Master
• OpenWrt Target/Subtarget: Mediatek MT798x
• OpenWrt Device: GL.iNet GL-MT6000

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

[BKPepe]

CI/CD output:

haproxy: Use generic tests
WARNING: opening /ci/packages.adb: UNTRUSTED signature
haproxy: [pass] File /usr/sbin/haproxy is executable
HAProxy version 3.4.0-1 2026/06/20 - https://haproxy.org/
Known bugs: http://www.haproxy.org/bugs/bugs-3.4.0.html
haproxy: [pass] Version check (/usr/sbin/haproxy)
aarch64-openwrt-linux-musl-gcc -O2 -g -fwrapv -fvect-cost-model=very-cheap -Os -pipe -mcpu=generic -fno-caller-saves -fno-plt -fhonour-copts -ffile-prefix-map=/builder/build_dir/target-aarch64_generic_musl/haproxy-ssl/haproxy-3.4.0=haproxy-3.4.0 -Wl,-z,max-page-size=4096 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro -Wl,-z,pack-relative-relocs -fno-strict-aliasing -Wdeclaration-after-statement -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-clobbered -Wno-missing-field-initializers -Wno-cast-function-type -Wno-address-of-packed-member -Wtype-limits -Wshift-negative-value -Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference -fwrapv -fasynchronous-unwind-tables -Wno-null-dereference 
  CFLAGS  = -O2 -g -fwrapv -fvect-cost-model=very-cheap -Os -pipe -mcpu=generic -fno-caller-saves -fno-plt -fhonour-copts -ffile-prefix-map=/builder/build_dir/target-aarch64_generic_musl/haproxy-ssl/haproxy-3.4.0=haproxy-3.4.0 -Wl,-z,max-page-size=4096 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro -Wl,-z,pack-relative-relocs -fno-strict-aliasing -Wdeclaration-after-statement -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-clobbered -Wno-missing-field-initializers -Wno-cast-function-type -Wno-address-of-packed-member -Wtype-limits -Wshift-negative-value -Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference -fwrapv -fasynchronous-unwind-tables -Wno-null-dereference
haproxy: [warn] Binary /usr/sbin/haproxy contains a hardcoded build path
haproxy: [pass] Binary /usr/sbin/haproxy is stripped
haproxy: [pass] All linked libraries for /usr/sbin/haproxy are present
haproxy: [skip] Version check override
haproxy: Generic tests passed

I see, there is one warning, is it possible to do something with it?

[gladiac]

CI/CD output:

haproxy: Use generic tests
WARNING: opening /ci/packages.adb: UNTRUSTED signature
haproxy: [pass] File /usr/sbin/haproxy is executable
HAProxy version 3.4.0-1 2026/06/20 - https://haproxy.org/
Known bugs: http://www.haproxy.org/bugs/bugs-3.4.0.html
haproxy: [pass] Version check (/usr/sbin/haproxy)
aarch64-openwrt-linux-musl-gcc -O2 -g -fwrapv -fvect-cost-model=very-cheap -Os -pipe -mcpu=generic -fno-caller-saves -fno-plt -fhonour-copts -ffile-prefix-map=/builder/build_dir/target-aarch64_generic_musl/haproxy-ssl/haproxy-3.4.0=haproxy-3.4.0 -Wl,-z,max-page-size=4096 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro -Wl,-z,pack-relative-relocs -fno-strict-aliasing -Wdeclaration-after-statement -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-clobbered -Wno-missing-field-initializers -Wno-cast-function-type -Wno-address-of-packed-member -Wtype-limits -Wshift-negative-value -Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference -fwrapv -fasynchronous-unwind-tables -Wno-null-dereference 
  CFLAGS  = -O2 -g -fwrapv -fvect-cost-model=very-cheap -Os -pipe -mcpu=generic -fno-caller-saves -fno-plt -fhonour-copts -ffile-prefix-map=/builder/build_dir/target-aarch64_generic_musl/haproxy-ssl/haproxy-3.4.0=haproxy-3.4.0 -Wl,-z,max-page-size=4096 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro -Wl,-z,pack-relative-relocs -fno-strict-aliasing -Wdeclaration-after-statement -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-clobbered -Wno-missing-field-initializers -Wno-cast-function-type -Wno-address-of-packed-member -Wtype-limits -Wshift-negative-value -Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference -fwrapv -fasynchronous-unwind-tables -Wno-null-dereference
haproxy: [warn] Binary /usr/sbin/haproxy contains a hardcoded build path
haproxy: [pass] Binary /usr/sbin/haproxy is stripped
haproxy: [pass] All linked libraries for /usr/sbin/haproxy are present
haproxy: [skip] Version check override
haproxy: Generic tests passed

I see, there is one warning, is it possible to do something with it?

I am looking into getting rid of the hardcoded build path.

[gladiac]

@BKPepe So it turns out the hardcoded build path comes from having -fmacro-prefix-map in CFLAGS. It is designed to remove hardcoded build paths and allows for reproducible builds - however, haproxy -vv prints the whole CFLAGS among other information which is why the whole -fmacro-prefix-map=/builder/build_dir/target-aarch64_generic_musl/haproxy-ssl/haproxy-3.4.0=haproxy-3.4.0 argument is hardcoded into the binary. And that is what the ci/cd pipeline finds in the end. Removing macro-prefix-map gets rid of the problem as haproxy does not need it in the first place.

Also... actions/checkout@v7 seems to have broken the build at the moment...

[gladiac]

@BKPepe I successfully got rid of the hardcoded build path warning. The only left problem is that the halog binary does not contain any version information at all which trips up the check in the build pipeline. The version string is nowhere in the whole binary.

halog: [warn] Version check (/usr/bin/halog)
halog: First 10 lines of the last output:
  No action specified.
  Usage:
    halog [-h|--help] for long help
    halog [input_filters]* [modifiers]* [output_format] < log
      inp = [-e|-E] [-H] [-Q|-QS] [-rt|-RT <time>] [-ad <delay>] [-ac <count>]
            [-hs|-HS [min][:[max]]] [-tcn|-TCN <termcode>] [-time [min][:[max]]]
      mod = [-q] [-v] [-m <lines>] [-s <skipflds>] [-query]
      out = {-c|-u|-uc|-ue|-ua|-ut|-uao|-uto|-uba|-ubt|-hdr <block>:<field>|
             -cc|-gt|-pct|-st|-tc|-srv|-ic}
halog: [pass] Binary /usr/bin/halog does not contain any hardcoded build paths
halog: [pass] Binary /usr/bin/halog is stripped
halog: [pass] All linked libraries for /usr/bin/halog are present
halog: [skip] Version check override
halog: No executables in the package provided version 3.4.1
halog: Generic tests failed

What would be test best way to deal with this? Is there a way to tell the build pipeline that this application has no version information or to just skip the check for this binary? Or do I have to patch the version information in the help text?

[gladiac]

I opted for adding the version information into the halog binary. I think this PR is now finally ready.