From 9bee00de9ce2c3825b94c3ce66aad0bb0008fc34 Mon Sep 17 00:00:00 2001
From: Tim Wojtulewicz <tim@corelight.com>
Date: Fri, 5 Sep 2025 13:28:14 -0700
Subject: [PATCH] CI: Add centos stream 10 build

---
 .cirrus.yml                    | 11 +++++++-
 ci/centos-stream-10/Dockerfile | 49 ++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 ci/centos-stream-10/Dockerfile

diff --git a/.cirrus.yml b/.cirrus.yml
index f8a3f46daa..7b759a22d0 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -254,13 +254,22 @@ fedora41_task:
 
 centosstream9_task:
   container:
-    # Stream 9 EOL: Around Dec 2027
+    # Stream 9 EOL: 31 May 2027
     dockerfile: ci/centos-stream-9/Dockerfile
     << : *RESOURCES_TEMPLATE
   << : *CI_TEMPLATE
   << : *ONLY_IF_PR_MASTER_RELEASE
   << : *SKIP_IF_PR_NOT_FULL_CI
 
+centosstream10_task:
+  container:
+    # Stream 10 EOL: 01 January 2030
+    dockerfile: ci/centos-stream-10/Dockerfile
+    << : *RESOURCES_TEMPLATE
+  << : *CI_TEMPLATE
+  << : *ONLY_IF_PR_MASTER_RELEASE
+  << : *SKIP_IF_PR_NOT_FULL_CI
+
 debian13_task:
   container:
     # Debian 13 (trixie) EOL: TBD
diff --git a/ci/centos-stream-10/Dockerfile b/ci/centos-stream-10/Dockerfile
new file mode 100644
index 0000000000..9c5e033346
--- /dev/null
+++ b/ci/centos-stream-10/Dockerfile
@@ -0,0 +1,49 @@
+FROM quay.io/centos/centos:stream10
+
+# A version field to invalidate Cirrus's build cache when needed, as suggested in
+# https://github.com/cirruslabs/cirrus-ci-docs/issues/544#issuecomment-566066822
+ENV DOCKERFILE_VERSION 20250905
+
+# dnf config-manager isn't available at first, and
+# we need it to install the CRB repo below.
+RUN dnf -y install 'dnf-command(config-manager)'
+
+# What used to be powertools is now called "CRB".
+# We need it for some of the packages installed below.
+# https://docs.fedoraproject.org/en-US/epel/
+RUN dnf config-manager --set-enabled crb
+RUN dnf -y install \
+    https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm
+
+# The --nobest flag is hopefully temporary. Without it we currently hit
+# package versioning conflicts around OpenSSL.
+RUN dnf -y --nobest install \
+    bison \
+    ccache \
+    cmake \
+    cppzmq-devel \
+    diffutils \
+    flex \
+    gcc \
+    gcc-c++ \
+    git \
+    jq \
+    libpcap-devel \
+    make \
+    openssl \
+    openssl-devel \
+    procps-ng \
+    python3 \
+    python3-devel \
+    python3-pip\
+    sqlite \
+    swig \
+    tar \
+    which \
+    zlib-devel \
+  && dnf clean all && rm -rf /var/cache/dnf
+
+# Set the crypto policy to allow SHA-1 certificates - which we have in our tests
+RUN dnf -y --nobest install crypto-policies-scripts && update-crypto-policies --set LEGACY
+
+RUN pip3 install websockets junit2html