From bb40a370d6e42e4109b54f7f6c18449184ff36fb Mon Sep 17 00:00:00 2001
From: lijunlong <lijunlong@openresty.com>
Date: Sun, 18 Oct 2026 16:23:58 +0800
Subject: [PATCH 1/2] tests: update CI nginx to 1.31.7.

Update the current nginx CI input from 1.31.6 to 1.31.7 and
align any corresponding job names. Preserve other dependency versions
and existing job coverage.

Validate the changed YAML and shell steps, check the staged diff,
and verify the nginx.org source archive reports version 1.31.7.
Full builds and regression suites were not run locally.
---
 .github/workflows/build_and_test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index 094cca46..9f19380b 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -15,8 +15,8 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - name: "nginx 1.31.6 + OpenSSL"
-            NGINX_VERSION: "1.31.6"
+          - name: "nginx 1.31.7 + OpenSSL"
+            NGINX_VERSION: "1.31.7"
 
     services:
       redis:

From dcc6d9b1d5e7d92c81f9191c9ab3e7299571e544 Mon Sep 17 00:00:00 2001
From: lijunlong <lijunlong@openresty.com>
Date: Sun, 18 Oct 2026 17:58:11 +0800
Subject: [PATCH 2/2] tests: trust GTS Root R4 in Google SSL tests.

Google can serve certificate chains rooted at GTS Root R4, while the
shared Google test CA file only trusts GTS Root R1. This makes the SSL
verification test fail with an unable-to-get-local-issuer error.

Append the public R4 root from Google's official PKI repository while
retaining R1 for endpoints that still use that chain.

Verify the official root certificate and pass all 504 assertions in
t/129-ssl-socket.t and t/170-ssl-session-reuse.t with nginx 1.31.7 and
OpenSSL 3.5.7. Local tests use system DNS and a 50 ms startup delay to
accommodate local DNS access and nginx restart timing.
---
 t/cert/google.crt | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/t/cert/google.crt b/t/cert/google.crt
index a13aa056..46a1d823 100644
--- a/t/cert/google.crt
+++ b/t/cert/google.crt
@@ -29,3 +29,17 @@ Z6tGn6D/Qqc6f1zLXbBwHSs09dR2CQzreExZBfMzQsNhFRAbd03OIozUhfJFfbdT
 2tIMPNuzjsmhDYAPexZ3FL//2wmUspO8IFgV6dtxQ/PeEMMA3KgqlbbC1j+Qa3bb
 bP6MvPJwNQzcmRk13NfIRmPVNnGuV/u3gm3c
 -----END CERTIFICATE-----
+
+-----BEGIN CERTIFICATE-----
+MIICCTCCAY6gAwIBAgINAgPlwGjvYxqccpBQUjAKBggqhkjOPQQDAzBHMQswCQYD
+VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIG
+A1UEAxMLR1RTIFJvb3QgUjQwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAw
+WjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2Vz
+IExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjQwdjAQBgcqhkjOPQIBBgUrgQQAIgNi
+AATzdHOnaItgrkO4NcWBMHtLSZ37wWHO5t5GvWvVYRg1rkDdc/eJkTBa6zzuhXyi
+QHY7qca4R9gq55KRanPpsXI5nymfopjTX15YhmUPoYRlBtHci8nHc8iMai/lxKvR
+HYqjQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
+BBSATNbrdP9JNqPV2Py1PsVq8JQdjDAKBggqhkjOPQQDAwNpADBmAjEA6ED/g94D
+9J+uHXqnLrmvT/aDHQ4thQEd0dlq7A/Cr8deVl5c1RxYIigL9zC2L7F8AjEA8GE8
+p/SgguMh1YQdc4acLa/KNJvxn7kjNuK8YAOdgLOaVsjh4rsUecrNIdSUtUlD
+-----END CERTIFICATE-----