A similar patches as ca-certificates-sbin-dir was
applied upstream as 4f0d3ec7aa4ebc91793245ed66c0e24d7150782b , the rest
of our patch was to use mkdir -p instead of mkdir, we keep this part in
ca-certificates-mkdir-p.patch

This introduces a new patch to not depend on cryptography, which is used
only to print a warning on the console when an expired certificate is
used.

We had a mechanism to catch usage of system python2, but using not
for system python3, which cause the same kind of problems.

On old debian (9) where python3 is python3.5 this component fails to
build with an error like:

    Configuring gdbus-example-objectmanager-visibility.h with command
    Running command: /opt/slapgrid/shared/glib/60e920f1feec2451d51bb344cfcad9ab/.build/glib-2.76.3/tools/gen-visibility-macros.py 2.0 visibility-macros GDBUS_OBJECT_MANAGER_EXAMPLE /opt/slapgrid/shared/glib/60e920f1feec2451d51bb344cfcad9ab/.build/glib-2.76.3/builddir/gio/tests/gdbus-object-manager-example/gdbus-example-objectmanager-visibility.h
    --- stdout ---
    --- stderr ---
      File "/opt/slapgrid/shared/glib/60e920f1feec2451d51bb344cfcad9ab/.build/glib-2.76.3/tools/gen-visibility-macros.py", line 37
        """
        ^
    SyntaxError: invalid syntax

This is because this gen-visibility-macros.py script is executable with
a shebang:

    #!/bin/env python3

for python 3 softwares, this is slapos python, because the python
section from component/defaults.cfg injects the slapos' python in PATH,
but for python 2 software, slapos' python 2 is injected in path and
`python3` resolves to system python, which in that case fails because
f-strings are SyntaxError but more generally this showed a dependency
to system python, but we can not rely on system python here.

this is a fixup of 54a08186

For slapos-node package compilation, we use DESTDIR pointing to temp
location and PREFIX pointing to future /opt/slapos.

Without this commit, bison look at wrong directory for data:

bison: cannot open file `/opt/slapos/parts/bison/share/bison/m4sugar/m4sugar.m4'

We configure haproxy with "verify optional", which makes haproxy request
a client certificate, but accept the case where client does not present
a certificate, but as described in [1], if client present a certificate
and this certificate can not be verified, handshake is aborted. This is
not what we want, we want to treat the case of a non verified
certificate same as the case of the absence of certificate.

This configures haproxy accordingly, using "crt-ignore-err all" to allow
handshake anyway.

Once this was fixed, there was a remaining problem with
client_cert_verified acl, haproxy acl are OR, but this rule was supposed
to be a AND (client present a certificate AND it is verified), this was
rewritten to use inline condition which are AND.

[1]: https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#5.1-verify

Also adjust test_x_forwarded_for_stripped_when_no_certificate to assert
that there is no X-Forwarded-For header at all when no client
certificate.

See merge request nexedi/slapos!1433

  https://archive.fosdem.org/2023/schedule/event/innodb_change_buffer/
  https://jira.mariadb.org/browse/MDEV-27734
  https://mariadb.com/kb/en/innodb-change-buffering/

If a server reboots brutally, there will be a legacy httpd pid file stay
in the file system, and the OS may reuse the PID that remains in that
file, which will cause httpd service to fail to start even if there is
no such httpd service is running.

This commit implemented the following logic:
0. If there is no existing PID file, then run the httpd service directly
1. If the PID file exists and contains the PID used by another process,
we delete the PID file, then restart the httpd service
2. If the PID file exists and contains the PID used by another running
httpd service, we allow the httpd report the "already running" error
normally

This is the last version supporting python 2.7.

See merge request !1428

See merge request nexedi/slapos!1404