From 01a8dd08c6f4ac0ee33ff9241678e9fe19ab5a25 Mon Sep 17 00:00:00 2001
From: Dario Cillerai <dcillera@redhat.com>
Date: Mon, 27 Oct 2025 16:33:48 +0100
Subject: [PATCH] Correct some flaws in the build

Signed-off-by: Dario Cillerai <dcillera@redhat.com>
---
 source/common/quic/BUILD                      | 36 ++++++++++---------
 .../tls/cert_validator/default_validator.cc   |  4 +--
 .../tls/tls_certificate_selector_test.cc      |  2 +-
 3 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/source/common/quic/BUILD b/source/common/quic/BUILD
index bb4c44fb882..c44d4a489aa 100644
--- a/source/common/quic/BUILD
+++ b/source/common/quic/BUILD
@@ -92,13 +92,18 @@ envoy_cc_library(
     name = "quic_stat_names_lib",
     srcs = ["quic_stat_names.cc"],
     hdrs = ["quic_stat_names.h"],
-    tags = ["nofips"],
-    deps = [
-        "//envoy/stats:stats_interface",
-        "//source/common/stats:symbol_table_lib",
-        "@com_github_google_quiche//:quic_core_error_codes_lib",
-        "@com_github_google_quiche//:quic_core_types_lib",
-    ],
+    deps = select({
+        "//bazel:disable_http3": [
+            "//envoy/stats:stats_interface",
+            "//source/common/stats:symbol_table_lib",
+        ],
+        "//conditions:default": [
+            "//envoy/stats:stats_interface",
+            "//source/common/stats:symbol_table_lib",
+            "@com_github_google_quiche//:quic_core_error_codes_lib",
+            "@com_github_google_quiche//:quic_core_types_lib",
+        ],
+    }),
 )
 
 envoy_cc_library(
@@ -585,13 +590,12 @@ envoy_cc_library(
 
 envoy_cc_library(
     name = "send_buffer_monitor_lib",
-    srcs = ["send_buffer_monitor.cc"],
-    hdrs = ["send_buffer_monitor.h"],
-    tags = ["nofips"],
-    deps = [
+    srcs = envoy_select_enable_http3(["send_buffer_monitor.cc"]),
+    hdrs = envoy_select_enable_http3(["send_buffer_monitor.h"]),
+    deps = envoy_select_enable_http3([
         "//source/common/common:assert_lib",
         "@com_github_google_quiche//:quic_core_session_lib",
-    ],
+    ]),
 )
 
 envoy_cc_library(
@@ -687,13 +691,13 @@ envoy_cc_library(
 
 envoy_cc_library(
     name = "cert_compression_lib",
-    srcs = ["cert_compression.cc"],
-    hdrs = ["cert_compression.h"],
+    srcs = envoy_select_enable_http3(["cert_compression.cc"]),
+    hdrs = envoy_select_enable_http3(["cert_compression.h"]),
     external_deps = ["ssl"],
-    deps = [
+    deps = envoy_select_enable_http3([
         "//bazel/foreign_cc:zlib",
         "//source/common/common:assert_lib",
         "//source/common/common:logger_lib",
         "//source/common/runtime:runtime_lib",
-    ],
+    ]),
 )
diff --git a/source/common/tls/cert_validator/default_validator.cc b/source/common/tls/cert_validator/default_validator.cc
index 506c4b7d455..184d4ff426a 100644
--- a/source/common/tls/cert_validator/default_validator.cc
+++ b/source/common/tls/cert_validator/default_validator.cc
@@ -88,7 +88,7 @@ absl::StatusOr<int> DefaultCertValidator::initializeSslContexts(std::vector<SSL_
 
     for (auto& ctx : contexts) {
       X509_STORE* store = SSL_CTX_get_cert_store(ctx);
-      // RH - Restore reloadable feature check to avoid failure of RevokedIntermediateCertificate test
+      // OpenSSL: restore reloadable feature check to avoid failure of RevokedIntermediateCertificate test
       if (Runtime::runtimeFeatureEnabled("envoy.reloadable_features.enable_intermediate_ca")) {
         X509_STORE_set_flags(store, X509_V_FLAG_PARTIAL_CHAIN);
       }
@@ -146,7 +146,7 @@ absl::StatusOr<int> DefaultCertValidator::initializeSslContexts(std::vector<SSL_
 
     for (auto& ctx : contexts) {
       X509_STORE* store = SSL_CTX_get_cert_store(ctx);
-      // RH - Restore reloadable feature check to avoid failure of RevokedIntermediateCertificate test
+      // OpenSSL: restore reloadable feature check to avoid failure of RevokedIntermediateCertificate test
       if (Runtime::runtimeFeatureEnabled("envoy.reloadable_features.enable_intermediate_ca")) {
         X509_STORE_set_flags(store, X509_V_FLAG_PARTIAL_CHAIN);
       }
diff --git a/test/common/tls/tls_certificate_selector_test.cc b/test/common/tls/tls_certificate_selector_test.cc
index 94cd4956bc9..acb3e5fe589 100644
--- a/test/common/tls/tls_certificate_selector_test.cc
+++ b/test/common/tls/tls_certificate_selector_test.cc
@@ -354,7 +354,7 @@ TEST_P(TlsCertificateSelectorFactoryTest, Failed) {
   testUtil(Ssl::SelectionResult::SelectionStatus::Failed);
 }
 
-// RH dcillera: disabled because it selects cert async
+// Disabled because it selects cert async (not yet supported with OpenSSL)
 TEST_P(TlsCertificateSelectorFactoryTest, DISABLED_Pending) {
   testUtil(Ssl::SelectionResult::SelectionStatus::Pending);
 }