x86_64 GetPageSpeed extras (testing) repository for CentOS/RHEL 8

Update: nginx-mod-1.30.4-61.el8.gps

Fri, 28 Aug 2026 10:47:34 +0000

Package: nginx-mod
Summary: High-performance web server

Description:
nginx [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server. This version adds some patches to improve performance: * HPACK by Cloudflare * Dynamic TLS records Built with OpenSSL 3.5 (ABI-isolated openssl35 package) to support HTTP/3 with post-quantum X25519MLKEM768 key exchange, ensuring you're at the forefront of web technology. Be careful using this in production. This package merely addresses all the crazy folks who want you to compile NGINX to get the above features. The compiled NGINX is evil for many reasons. For more info, see: https://www.getpagespeed.com/server-setup/where-compilation-went-wrong The lesser, as well as faster evil is here. Packaged install is easier to use in production and is also easier to roll back to stable NGINX version in case there's an issue with those patches.

Changes:

nginx-mod-1.30.4-61.el8.gps.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-08-27): - nginx-mod-ech: publish rotated keys to DNS. New nginx-ech-publish runs as the second ExecStart of nginx-ech-rotate.service, so after every successful rotation the HTTPS record is republished instead of going stale (stale records silently downgrade every first visit to the retry-config path). Provider-agnostic: drop-in provider scripts under libexec, Cloudflare shipped first, configured via /etc/sysconfig/nginx-ech-publish and inert until a provider is set. The cloudflare provider reuses certbot's /root/.cloudflare.ini and treats a failed record lookup as a hard error, never as "no record exists", so it cannot create duplicate HTTPS records.
nginx-mod-1.30.4-60.el8.gps.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-08-25): - nginx-mod-ech: roll the generated include back when "nginx -t" fails during a rotation. Previously a rotation that tripped over an unrelated config error left the new include committed, so the configuration stayed unloadable and the next reload by anything else (logrotate, a certificate renewal) failed too. Now the include is restored and nothing is reloaded.
nginx-mod-1.30.4-59.el8.gps.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-08-25): - new subpackage nginx-mod-ech: ECH key generation and rotation. Ships nginx-ech-keygen (--init / --rotate / --print-dns / --list), a nginx-ech-rotate systemd timer defaulting to daily, and /etc/sysconfig/nginx-ech-rotate. Keys live in /etc/nginx/ech as 0640 root:nginx; the newest is advertised in ECH retry-configs and ECH_RETAIN-1 older ones stay loaded so clients holding a cached ECHConfigList still decrypt. The conf.d include is generated by the tool rather than shipped, so installing the package alone can never point nginx at key files that do not exist. The timer is not enabled on install.
nginx-mod-1.30.4-58.el8.gps.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-08-24): - enable Encrypted Client Hello (ECH, RFC 9849): rebuilt against openssl35 3.5.7-5 which carries the ECH backport (DEfO/OpenSSL 4.0 implementation on the 3.5 LTS line). Adds ssl_ech_file directive plus $ssl_ech_status and $ssl_ech_outer_server_name variables. ECH engages only when ssl_ech_file is configured; without it behavior is unchanged.
nginx-mod-1.30.4-57.el8.gps.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-08-23): - link against openssl35 (OpenSSL 3.5 LTS, ABI-isolated private prefix) instead of quictls: native OpenSSL QUIC API, real 0-RTT, post-quantum X25519MLKEM768 key exchange, CVE stream tracked to April 2030

Update: nginx-mod-ech-1.30.4-61.el8.gps

Fri, 28 Aug 2026 10:47:34 +0000

Package: nginx-mod-ech
Summary: Encrypted Client Hello key management for NGINX-MOD

Description:
Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule, plus nginx-ech-publish, which republishes the rotated ECHConfigList in the HTTPS DNS record through provider drop-in scripts (Cloudflare shipped; more under /usr/libexec/nginx-ech-publish). The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". Set a provider in /etc/sysconfig/nginx-ech-publish and that record is republished automatically after every rotation. ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Changes:

nginx-mod-ech-1.30.4-61.el8.gps.x86_64 [28 KiB]

Changelog by Danila Vershinin (2026-08-27):

- nginx-mod-ech: publish rotated keys to DNS. New nginx-ech-publish runs as
  the second ExecStart of nginx-ech-rotate.service, so after every successful
  rotation the HTTPS record is republished instead of going stale (stale
  records silently downgrade every first visit to the retry-config path).
  Provider-agnostic: drop-in provider scripts under libexec, Cloudflare
  shipped first, configured via /etc/sysconfig/nginx-ech-publish and inert
  until a provider is set. The cloudflare provider reuses certbot's
  /root/.cloudflare.ini and treats a failed record lookup as a hard error,
  never as "no record exists", so it cannot create duplicate HTTPS records.

nginx-mod-ech-1.30.4-60.el8.gps.x86_64 [24 KiB]

Changelog by Danila Vershinin (2026-08-25):

- nginx-mod-ech: roll the generated include back when "nginx -t" fails during
  a rotation. Previously a rotation that tripped over an unrelated config
  error left the new include committed, so the configuration stayed
  unloadable and the next reload by anything else (logrotate, a certificate
  renewal) failed too. Now the include is restored and nothing is reloaded.

nginx-mod-ech-1.30.4-59.el8.gps.x86_64 [23 KiB]

Changelog by Danila Vershinin (2026-08-25):

- new subpackage nginx-mod-ech: ECH key generation and rotation. Ships
  nginx-ech-keygen (--init / --rotate / --print-dns / --list), a
  nginx-ech-rotate systemd timer defaulting to daily, and
  /etc/sysconfig/nginx-ech-rotate. Keys live in /etc/nginx/ech as
  0640 root:nginx; the newest is advertised in ECH retry-configs and
  ECH_RETAIN-1 older ones stay loaded so clients holding a cached
  ECHConfigList still decrypt. The conf.d include is generated by the tool
  rather than shipped, so installing the package alone can never point nginx
  at key files that do not exist. The timer is not enabled on install.

Update: nginx-1.30.4-64.el8.gps

Wed, 26 Aug 2026 19:02:35 +0000

Package: nginx
Summary: High performance web server

Description:
nginx [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server.

Changes:

nginx-1.30.4-64.el8.gps.x86_64 [1.0 MiB]

Changelog by Danila Vershinin (2026-08-27):

- nginx-ech: new subpackage for ECH (RFC 9849) key generation and rotation,
  at parity with nginx-mod-ech (shared nginx-ech-keygen implementation)
- assert ECH is live at build time: a bogus ssl_ech_file must fail the
  configuration test instead of degrading to a silent no-op

nginx-1.30.4-63.el8.gps.x86_64 [1.0 MiB]

Changelog by Danila Vershinin (2026-08-20):

- link against openssl35 (OpenSSL 3.5 LTS, ABI-isolated private prefix)
  instead of quictls: native OpenSSL QUIC API, real 0-RTT, post-quantum
  X25519MLKEM768 key exchange, CVE stream tracked to April 2030

Update: nginx-ech-1.30.4-64.el8.gps

Wed, 26 Aug 2026 19:02:35 +0000

Package: nginx-ech
Summary: Encrypted Client Hello key management for NGINX

Description:
Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule. The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Changes:

nginx-ech-1.30.4-64.el8.gps.x86_64 [18 KiB]

Changelog by Danila Vershinin (2026-08-27):

- nginx-ech: new subpackage for ECH (RFC 9849) key generation and rotation,
  at parity with nginx-mod-ech (shared nginx-ech-keygen implementation)
- assert ECH is live at build time: a bogus ssl_ech_file must fail the
  configuration test instead of degrading to a silent no-op