# changelog

author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-9
changelog:
  - Don't duplicate libsss_autofs.so in two packages
  - Set explicit package contents instead of globbing


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.2-10
changelog:
  - New upstream release 1.8.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
  - Several fixes to case-insensitive domain functions
  - Fix for GSSAPI binds when the keytab contains unrelated principals
  - Fixed several segfaults
  - Workarounds added for LDAP servers with unreadable RootDSE
  - SSH knownhostproxy will no longer enter an infinite loop preventing login
  - The provided SYSV init script now starts SSSD earlier at startup and stops
    it later during shutdown
  - Assorted minor fixes for issues discovered by static analysis tools


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.3-11
changelog:
  - New upstream release 1.8.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
  - Numerous manpage and translation updates
  - LDAP: Handle situations where the RootDSE isn't available anonymously
  - LDAP: Fix regression for users using non-standard LDAP attributes for user
    information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-1.beta1
changelog:
  - New upstream release 1.9.0 beta 1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
  - Add native support for autofs to the IPA provider
  - Support for ID-mapping when connecting to Active Directory
  - Support for handling very large (> 1500 users) groups in Active Directory
  - Support for sub-domains (will be used for dealing with trust relationships)
  - Add a new fast in-memory cache to speed up lookups of cached data on
    repeated requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-2.beta1
changelog:
  - Fix several regressions since 1.5.x
  - Ensure that the RPM creates the /var/lib/sss/mc directory
  - Add support for Netscape password warning expiration control
  - Rebuild against libldb 1.1.6


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-5.beta2
changelog:
  - New upstream release 1.9.0 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
  - Add support for the Kerberos DIR cache for storing multiple TGTs
    automatically
  - Major performance enhancement when storing large groups in the cache
  - Major performance enhancement when performing initgroups() against Active
    Directory
  - SSSDConfig data file default locations can now be set during configure for
    easier packaging


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-7.beta2
changelog:
  - Switch unicode library from libunistring to Glib
  - Drop unnecessary explicit Requires on keyutils
  - Guarantee that versioned Requires include the correct architecture


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-8.beta3
changelog:
  - New upstream release 1.9.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
  - Add a new PAC responder for dealing with cross-realm Kerberos trusts
  - Terminate idle connections to the NSS and PAM responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-9.beta4
changelog:
  - New upstream release 1.9.0 beta 4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
  - Add a new AD provider to improve integration with Active Directory 2008 R2
    or later servers
  - SUDO integration was completely rewritten. The new implementation works
    with multiple domains and uses an improved refresh mechanism to download
    only the necessary rules
  - The IPA authentication provider now supports subdomains
  - Fixed regression for setups that were setting default_tkt_enctypes
    manually by reverting a previous workaround.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-12.beta5
changelog:
  - New upstream release 1.9.0 beta 5
  - Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
  - Many fixes for the support for setting default SELinux user context from
    FreeIPA, most notably fixed the specificity evaluation
  - Fixed an incorrect default in the krb5_canonicalize option of the AD
    provider which was preventing password change operation
  - The shadowLastChange attribute value is now correctly updated with the
    number of days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-13.beta6
changelog:
  - New upstream release 1.9.0 beta 6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
  - A new option, override_shell was added. If this option is set, all users
    managed by SSSD will have their shell set to its value.
  - Fixes for the support for setting default SELinux user context from FreeIPA.
  - Fixed a regression introduced in beta 5 that broke LDAP SASL binds
  - The SSSD supports the concept of a Primary Server and a Back Up Server in
    failover
  - A new command-line tool sss_seed is available to help prime the cache with
    a user record when deploying a new machine
  - SSSD is now able to discover and save the domain-realm mappings
    between an IPA server and a trusted Active Directory server.
  - Packaging changes to fix ldconfig usage in subpackages (#843995)
  - Rebuild against libldb 1.1.9


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-14.beta6
changelog:
  - Don't discard HBAC rule processing result if SELinux is on
    Resolves: rhbz#846792 (CVE-2012-3462)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-18.beta6
changelog:
  - Change the default ccache location to DIR:/run/user/${UID}/krb5cc
    and patch man page accordingly
  - Resolves: rhbz#851304


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.4-3
changelog:
  - Recreate Kerberos ccache directory if it's missing
  - Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
                            directory /run/user/UID/ccdir does not exist


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-4.beta1
changelog:
  - Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
    in ding-libs
  - Fix SSH integration with fully-qualified domains
  - Add the ability to dynamically discover the NetBIOS name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-6.beta1
changelog:
  - Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
                            realm join
  - Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
                            default for AD Provider
  - Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
                            parent directory when logging in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-7.beta1
changelog:
  - Apply a couple of patches from upstream git that resolve crashes when
    ID mapping object was not initialized properly but needed later


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-8.beta2
changelog:
  - New upstream release 1.10 beta2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
  - BuildRequire libcmocka-devel in order to run all upstream tests during build
  - BuildRequire libnl3 instead of libnl1
  - No longer BuildRequire initscripts, we no longer use /sbin/service
  - Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
    older krb5-libs version


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-9.beta2
changelog:
  - Fix typo in Requires that prevented an upgrade (#973916)
  - Use a hardcoded version in Conflicts, not less-than-current


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-11.beta2
changelog:
  - Apply a number of patches from upstream to fix issues found post-beta,
    in particular:
    -- segfault with a high DEBUG level
    -- Fix IPA password migration (upstream #1873)
    -- Fix fail over when retrying SRV resolution (upstream #1886)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-14
changelog:
  - Fix Obsoletes: to account for dist tag
  - Convert post and pre scripts to run on the sssd-common subpackage
  - Remove old conversion from SYSV


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-16
changelog:
  - Move sssd_pac to the sssd-ipa and sssd-ad subpackages
  - Trim out RHEL5-specific macros since we don't build on RHEL 5
  - Trim out macros for Fedora older than F18
  - Update libldb requirement to 1.1.16
  - Trim RPM changelog down to the last year


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0.2beta2
changelog:
  - Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
                        pam libraries


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-0.4.beta2
changelog:
  - Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
                        Process /usr/libexec/sssd/sssd_nss was killed by
                        signal 11 (SIGSEGV)
  - Resolves: #996214 - sssd proxy_child segfault


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-2
changelog:
  - Backport simplification of ccache management from 1.11.1
  - Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-3
changelog:
  - Fix multicast checks in the SSSD
  - Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
                             code getting the host info


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-1
changelog:
  - New upstream release 1.11.2
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.3-1
changelog:
  - New upstream release 1.11.3
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.4-1
changelog:
  - New upstream release 1.11.4
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.5-1
changelog:
  - New upstream release 1.11.5
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.1-2
changelog:
  - Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
                             private group from server


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.2-6
changelog:
  - Fix regressions and bugs in sssd upstream 1.12.2
  - https://fedorahosted.org/sssd/ticket/{id}
  - Regressions: #2471, #2475, #2483, #2487, #2529, #2535
  - Bugs: #2287, #2445


author: Sumit Bose <sbose@redhat.com> - 1.12.2-7
changelog:
  - Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
                             crash in wbinfo
                             - in addition to the patch libwbclient.so is
                               filtered out of the Provides list of the package


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-1
changelog:
  - New upstream release 1.12.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
  - Fix spelling errors in description (fedpkg lint)


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-2
changelog:
  - Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
  - Resolves: rhbz#1179379 - gzip: stdin: file size changed while
                             zipping when rotating logfile


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-3
changelog:
  - Apply a number of patches from upstream to fix issues found 1.12.3
  - Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
                             interfaces, or isn't documented to be able to
  - Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
                            not running
  - Resolves: upstream #2557  authentication failure with user from AD


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-4
changelog:
  - Decrease priority of sssd-libwbclient 20 -> 5
  - It should be lower than priority of samba veriosn of libwbclient.
  - https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-6
changelog:
  - Fix double free in monitor
  - Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
                          sssd killed by SIGABRT


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-2
changelog:
  - Add support for python3 bindings
  - Add requirement to python3 or python3 bindings
  - Resolves: rhbz#1014594 - sssd: Support Python 3


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-5
changelog:
  - Fix regressions with ipa and SELinux
  - Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
                               context on client is staff_u


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-6
changelog:
  - Fix slow login with ipa and SELinux
  - Resolves: upstream #2624 - Only set the selinux context if the context
                               differs from the local one


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-8
changelog:
  - Backport important patches from upstream 1.13 prerelease
  - Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
                             attribute for group name
  - Resolves: upstream #2335 - Investigate using the krb5 responder
                               for driving the PAM conversation with OTPs
  - Enable cmocka tests for secondary architectures


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-4
changelog:
  - Fix ipa-migration bug
  - Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
                               migration mode


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-6
changelog:
  - Fix OTP bug
  - Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
                               entered separately


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-2
changelog:
  - Fix few segfaults
  - Resolves: upstream #2811 - PAM responder crashed if user was not set
  - Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-3
changelog:
  - python-sssdconfig: Fix parssing sssd.conf without config_file_version
  - Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-5
changelog:
  - Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
                             groups during getgrnam and getgrgid
  - Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
                             in call to 'print'


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-6
changelog:
  - Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
                             prompts (e.g. Password + Token)
  - Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
                             by remote host" if locale not available


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.4-3
changelog:
  - Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
                             sssd_ifp killed by SIGSEGV


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-2
changelog:
  - Backport important patches from upstream 1.14.2 prerelease
  - Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
                               boot
  - Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-3
changelog:
  - Fix regression with krb5_map_user
  - Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
  - Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
                             default if nonexistent domain is mentioned


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.2-2
changelog:
  - Resolves: rhbz#1369130 - nss_sss should not link against libpthread
  - Resolves: rhbz#1392916 - sssd failes to start after update
  - Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
                             on the directory /etc/sssd


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.0-4
changelog:
  - Cherry-pick patches from upstream that enable the files provider
  - Enable the files domain
  - Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
    which is superseded by the files domain autoconfiguration
  - Related: rhbz#1357418 - SSSD fast cache for local users


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.2
changelog:
  - Fix issue with IPA + SELinux in containers
  - Resolves: upstream https://fedorahosted.org/sssd/ticket/3297


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.3
changelog:
  - Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
  - Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
                             file from package sssd-common-1.15.1-1.fc25.x86_64
  - Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-4
changelog:
  - Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
                             access on the sock_file system_bus_socket
  - Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
                             fails to download desktop profile data
  - Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
  - Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
                              after applying ID Views for them in IPA server
  - Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
                              mapping is applied


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-5
changelog:
  - Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database access on
                             the sock_file system_bus_socket


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.16.0-5
changelog:
  - Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
                              setnetgrent_result_timeout
  - Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
                              or machine swaps
  - Resolves: failure in glibc tests
              https://sourceware.org/bugzilla/show_bug.cgi?id=22530
  - Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
                              auth_provider ldap, login fails if the LDAP server
                              is not allowing anonymous binds
  - Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
                              corrected with AD
  - Resolves: upstream#3586 - Give a more detailed debug and system-log message
                              if krb5_init_context() failed
  - Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
                             in /etc/systemd/system
  - Backport few upstream features from 1.16.1


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.0-12
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Resolves: upstream#3621 - FleetCommander integration must not require
                              capability DAC_OVERRIDE


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-2
changelog:
  - Resolves: upstream#3573 - sssd won't show netgroups with blank domain
  - Resolves: upstream#3660 - confdb_expand_app_domains() always fails
  - Resolves: upstream#3658 - Application domain is not interpreted correctly
  - Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
                              json_loads()
  - Resolves: upstream#3386 - KCM: Payload buffer is too small
  - Resolves: upstream#3666 - Fix usage of str.decode() in our tests
  - A few KCM misc fixes


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-3
changelog:
  - Resolves: upstream#3684 - A group is not updated if its member is removed
                              with the cleanup task, but the group does not
                              change
  - Resolves: upstream#3558 - sudo: report error when two rules share cn
  - Tone down shutdown messages for socket activated responders
  - IPA: Qualify the externalUser sudo attribute
  - Resolves: upstream#3550 - refresh_expired_interval does not work with
                              netgrous in 1.15
  - Resolves: upstream#3402 - Support alternative sources for the files provider
  - Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
  - Resolves: upstream#3679 - Make nss netgroup requests more robust
  - Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
                              configured
  - Resolves: upstream#3469 - extend sss-certmap man page regarding priority
                              processing
  - Improve docs/debug message about GC detection
  - Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
                              list out of bound?
  - Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
                              set.
  - Document which principal does the AD provider use
  - Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
                              defined, but contains no SIDs
  - Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
  - Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
                             Provider returned an error
                             [org.freedesktop.sssd.Error.DataProvider.Fatal]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-1
changelog:
  - Update to 1.16.2 release
  - Cleanup unused global definitions
  - Remove python2 references from the spec file
  - Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-2
changelog:
  - Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
                             fails with the KCM ccache


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-4
changelog:
  - Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                             users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-7
changelog:
  - Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
                             differs from the default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-8
changelog:
  - Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
                              /usr/libexec/sssd/sssd_be killed by 11 crash
                              func _dbus_list_unlink


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-9
changelog:
  - Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
                             commands in man pages since local provider
                             is deprecated


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-10
changelog:
  - Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
                             started due to a misconfiguration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-11
changelog:
  - Resolves: rhbz#1628122 - Printing incorrect information about domain
                             with sssctl utility


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-16
changelog:
  - Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
                            PKCS#11 URI


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-17
changelog:
  - Related: rhbz#1637131 - pam_unix unable to match fully qualified username
                            provided by sssd during smartcard auth using gdm


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-18
changelog:
  - Related: rhbz#1638006 - Files: The files provider always enumerates
                            which causes duplicate when running getent passwd


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-19
changelog:
  - Add OSCP checks for p11_child
  - Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                            users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-21
changelog:
  - Related: rhbz#1638150 - session not recording for local user when groups defined
  - Also add silence a Coverity warning, which is related to rhbz#1637131


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-23
changelog:
  - Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
                             with smart card


author: Michal Židek <mzidek@redhat.com> - 2.0.0-24
changelog:
  - Resolves: rhbz#1646168 - sssctl access-report always prints an error message
  - Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
                             configuration without having to restart the whole
                             sssd
  - Resolves: rhbz#1640576 - sssctl reports incorrect information about local
                             user's cache entry expiration time
  - Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
  - Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys


author: Michal Židek <mzidek@redhat.com> - 2.0.0-25
changelog:
  - Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
                             for D-bus, resulting in a crash


author: Michal Židek <mzidek@redhat.com> - 2.0.0-27
changelog:
  - Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
                             if ID provider is authenticated with GSSAPI


author: Michal Židek <mzidek@redhat.com> - 2.0.0-29
changelog:
  - Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
                             /usr/libexec/sssd/proxy_child killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.0.0-30
changelog:
  - Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
                        retrieve AD users through IPA Trust


author: Michal Židek <mzidek@redhat.com> - 2.0.0-32
changelog:
  - Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
              and libtevent to avoid an issue in GPO processing


author: Michal Židek <mzidek@redhat.com> - 2.0.0-33
changelog:
  - Resolves: rhbz#1646113 - Missing concise documentation about valid options
                             for sssd-files-provider


author: Michal Židek <mzidek@redhat.com> - 2.0.0-34
changelog:
  - Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
                             kdestroy caused by KCM returning a wrong error
                             code during the delete operation


author: Michal Židek <mzidek@redhat.com> - 2.0.0-36
changelog:
  - Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
                             suggests using * for backend sss


author: Michal Židek <mzidek@redhat.com> - 2.0.0-38
changelog:
  - Resolves: rhbz#1578014 - sssd does not work under non-root user
  - Note: Actually the patches were in the 2.0.0-37, this one just adds this
          changelog because it was missing.


author: Michal Židek <mzidek@redhat.com> - 2.0.0-39
changelog:
  - Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
                             1.x, this can result in time outs


author: Michal Židek <mzidek@redhat.com> - 2.0.0-40
changelog:
  -Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
                            UnknownProperty: Unknown property


author: Michal Židek <mzidek@redhat.com> - 2.0.0-41
changelog:
  -Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
                            subdomain service name being used


author: Michal Židek <mzidek@redhat.com> - 2.0.0-42
changelog:
  - Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
                             of gen_new to avoid a subsequent switch call
                             failure


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-43
changelog:
  - Resolves: rhbz#1672780 - gdm login not prompting for username when smart
                             card maps to multiple users


author: Michal Židek <mzidek@redhat.com> - 2.0.0-45
changelog:
  - Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
    done here in order to unblock gating changes before rebase.
  - Related: rhbz#1682305


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-2
changelog:
  - Resolves: rhbz#1673443 - sssd man pages: The default value of
                             "ldap_user_home_directory" is not mentioned
                             with AD server configuration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-3
changelog:
  - Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
                             no members


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-4
changelog:
  - Resolves: rhbz#1283798 - sssd failover does not work on connecting to
                             non-responsive ldaps:// server


author: Michal Židek <mzidek@redhat.com> - 2.2.0-6
changelog:
  - Resolves: rhbz#1726945 - negative cache does not use values from
                             'filter_users' config option for known domains


author: Michal Židek <mzidek@redhat.com> - 2.2.0-7
changelog:
  - Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
                             not FIPS140 compliant


author: Michal Židek <mzidek@redhat.com> - 2.2.0-8
changelog:
  - Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
                             repository
                           - This just required a raise in release number
                             and changelog for the record.


author: Michal Židek <mzidek@redhat.com> - 2.2.0-10
changelog:
  - Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
                             the trailing colon


author: Michal Židek <mzidek@redhat.com> - 2.2.0-11
changelog:
  - Resolves: rhbz#1733372 - permission denied on logs when running sssd as
                             non-root user


author: Michal Židek <mzidek@redhat.com> - 2.2.0-13
changelog:
  - Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
              systemd-user service in the account phase in RHEL-8


author: Michal Židek <mzidek@redhat.com> - 2.2.0-14
changelog:
  - Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
                             should not cause files domain entries to be
                             qualified, this can break sudo access


author: Michal Židek <mzidek@redhat.com> - 2.2.0-15
changelog:
  - Resolves: rhbz#1736265 - Smart Card auth of local user: endless
                             loop if wrong PIN was provided


author: Michal Židek <mzidek@redhat.com> - 2.2.0-16
changelog:
  - Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
                             the IP address of the machine updated in IPA upon
                             sssd.service startup


author: Michal Židek <mzidek@redhat.com> - 2.2.0-17
changelog:
  - Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
                             keyring
  - Also apply a patch to fix gating tests issue


author: Michal Židek <mzidek@redhat.com> - 2.2.0-18
changelog:
  - Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
  - Also sync. kcm multihost tests with master


author: Michal Židek <mzidek@redhat.com> - 2.2.0-19
changelog:
  - Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
                             new ones (kcm)


author: Michal Židek <mzidek@redhat.com> - 2.2.3-2
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              PART2: Fix gating issue.


author: Michal Židek <mzidek@redhat.com> - 2.2.3-3
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              Increasing version number to pick latest libldb


author: Michal Židek <mzidek@redhat.com> - 2.2.3-4
changelog:
  * Resolves: rhbz#1781728 - sssctl config-check command does not give proper
                             error messages with line numbers


author: Michal Židek <mzidek@redhat.com> - 2.2.3-5
changelog:
  * Resolves: rhbz#1744500 - [Doc]Provide explanation on escape character
                             for match rules sss-certmap


author: Michal Židek <mzidek@redhat.com> - 2.2.3-9
changelog:
  * Resolves: rhbz#1783190 - [abrt] [faf] sssd:
                             raise(): /usr/libexec/sssd/sssd_autofs killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.2.3-10
changelog:
  * Resolves: rhbz#1583592 - [RFE] Add configurable randomness to SSSD ldap
                             connection timeout


author: Michal Židek <mzidek@redhat.com> - 2.2.3-14
changelog:
  - Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
                             specified up to the seconds


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-16
changelog:
  - Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
                             omitted and auth_provider is krb5


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-17
changelog:
  - Resolves: rhbz#1718193 - p11_child should have an option to skip
                             C_WaitForSlotEvent if the PKCS#11 module
                             does not implement it properly


author: Michal Židek <mzidek@redhat.com> - 2.2.3-18
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
                             information


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate
                             (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
  - Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
  - Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
  - Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.1
changelog:
  - Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
  - Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
  - Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
  - Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
  - Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
  - Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.2
changelog:
  - Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
  - Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
  - Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 1.6.1-6
changelog:
  - Fix v1.6.1-implicit-fallthrough.patch compatibility with gcc < 7.
  - Use %ldconfig_scriptlets.
    https://fedoraproject.org/wiki/Packaging:Scriptlets#Shared_Libraries


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 1.6.1-7
changelog:
  - Add: BuildRequires: gcc
    https://fedoraproject.org/wiki/Packaging:C_and_C%2B%2B#BuildRequires_and_Requires


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 1.6.1-8
changelog:
  - Enable tests (PTUNIT) and man pages (MAN).
  - Change BuildRequires: gcc -> gcc-c++ as PTUNIT tests require C++.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.0.4-19
changelog:
  - Python 2 binary package renamed to python2-libiptcdata
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Pavel Cahyna <pcahyna@redhat.com> - 1.4.8-4
changelog:
  - Remove KDE bits
  - Provide: mkisofs (as genisoimage does)
  - Increase alternative priority to win over genisoimage
  - Update RHEL conditionals for lib{isofs,burn} renaming to match those packages


author: Robert Scheck <robert@fedoraproject.org> 1.4.2-3
changelog:
  - Move large documentation into -doc subpackage (#744416)
  - Reworked spec file to build libisofs1 for RHEL >= 6 (#744416)


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-16_1
changelog:
  - [RHEL] Apply 'Add missing dependencies to the tests package'
  - [RHEL] Apply 'Update patch from upstream'


author: Sahana Prasad <sahana@redhat.com> - 1.1.5-3
changelog:
  - Enables building on old kernels [sync fix in Fedora from omosnance].
  - This is required for covscans as they run on RHEL7 machines.


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-1
changelog:
  - Update to new upstream release 1.4.0
    Resolves: RHEL-5366
  - Add a patch to fix auxiliary tests in FIPS mode
    Resolves: RHEL-2406
  - Add a patch to zeroize kcapi-hasher for FIPS 140-3
    Resolves: RHEL-15290
  - Add a patch to allow overriding target file in kcapi-hasher
    Resolves: RHEL-15300


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-2
changelog:
  - Backport fixes for kcapi-hasher target option
    Related: RHEL-15300
  - Fix kcapi tests in FIPS mode
    Resolves: RHEL-2406


author: Akira TAGOH <tagoh@redhat.com> - 0.6.2-8
changelog:
  - Suppress documentation in Flatpak builds
    Resolves: rhbz#1896257
  - build gir with non-parallel to avoid strange behavior.


author: David King <dking@redhat.com> - 2.6.2-17
changelog:
  - Fix CVE-2018-11577 (#1585906)
  - Fix CVE-2018-11684 (#1588632)
  - Fix CVE-2018-11685 (#1588637)
  - Fix CVE-2018-12085 (#1589942)


author: Ana Cabral <acabral@redhat.com> - 1.26.0-2
changelog:
  - Add Conflicts tag because the bash-completion scripts moved
    from the main package to the utils sub package causing a file
    conflict on multilib systems between the old 32 bit main
    package and the new 64 bit utils sub package.


author: Martin Gansser <martinkg@fedoraproject.org> - 1:0.9.57-1
changelog:
  - Update to 0.9.57
  - Dropped dependency on libgcrypt
  - Dropped dependency on openssl
  - Update tarball link to "https:"
  - Add examples from doc/examples


author: Stephen Gallagher <sgallagh@redhat.com> - 2.5.0-2
changelog:
  - Fix memory corruption error using Module.search_rpms() from python
  - Speed up valgrind tests
  - Resolves: rhbz#1714766


author: Karel Zak <kzak@redhat.com> 2.32.1-40
changelog:
  - fix #2121699 - fstrim -av fails to trim root filesystem on Red Hat Coreos 
  - fix #2142496 - update upstream tests
  - fix #2149394 - umount outputs inaccurate error message when umount() fails with EACCES
  - fix #2159544 - lslogins "Password is locked" status changed in util-linux-2.32.1-38
  - fix #2160321 - [last] ut->ut_user is not null terminated


author: Karel Zak <kzak@redhat.com> 2.32.1-43
changelog:
  - fix #2117355 - Add additional documentation for fstab
  - fix #2184728 - libuuid - downport cache related patch
  - fix #2188894 - The swapon man page of -p(priority) option shows incorrect.
  - fix #2227097 - wall(1) fail when trying to use seat0


author: Karel Zak <kzak@redhat.com> 2.32.1-46
changelog:
  - fix RHEL-13741 - lscpu: avoid EBUSY on cpuinfo_max_freq
  - fix RHEL-18451 - logger: initialize socket credentials control union
  - fix RHEL-16070 - util-linux: issues in libblkid
  - fix RHEL-6274 - lslogins incorrect account expiration field


author: Richard W.M. Jones <rjones@redhat.com> - 0.7-0.1.alpha
changelog:
  - New upstream version 0.7alpha.
  - No tarball was uploaded so temporarily use tarball from github.
  - Fixes CVE-2018-14679 libmspack: off-by-one error in the CHM PMGI/PMGL
    chunk number validity checks


author: Richard W.M. Jones <rjones@redhat.com> - 0.7-0.2.alpha.4
changelog:
  - Fix for CVE-2019-1010305
  - Remove "fix" for CVE-2018-14680 as this fix is included in base tar ball.
    resolves: rhbz#1736745, rhbz#1736743


author: Dominik Mierzejewski <dominik@greysector.net> - 1.1.13-2
changelog:
  - Use https source URL
  - Drop obsolete spec elements
  - Use license macro
  - Update libusbx-devel build dependency
  - Drop ancient (F15) Obsoletes:
  - Tighten file list


author: David Tardon <dtardon@redhat.com> - 0.3.11-3
changelog:
  - Resolves: rhbz#1461763 CVE-2017-9433 Out-of-bounds write in the
    MsWrd1Parser::readFootnoteCorrespondence function


author: Hangbin Liu <haliu@redhat.com> - 1.7-1
changelog:
  - Update to 1.7
  - libndp: apply filter to raw socket to only accept ND messages
  - libndp: move ndp_sock_{open,close}() after msg parsing functions
  - ndptool: Fix compilation on musl libc


author: Hangbin Liu <haliu@redhat.com> - 1.7-2
changelog:
  - ndptool: add -T target support (rhbz 1666194)
  - ndptool: fix target parameter typo (rhbz 1666194)
  - libndp: close sockfd after using to avoid handle leak (rhbz 1666194)
  - libndp: fix nd_msg typo when setting target address (rhbz 1666194)


author: Hangbin Liu <haliu@redhat.com> - 1.7-3
changelog:
  - ndptool: add -D dest support (rhbz 1697595)
  - ndptool: fix potential memory leak caused by strdup (rhbz 1697595)


author: Jiri Pirko <jpirko@redhat.com> - 1.2-1
changelog:
  - Update to 1.2
  - libndp: silently ignore packets with optlen 0
  - libndp: fix processing for larger options
  - libndp: do not fail on receiving non-ndp packets


author: Jiri Pirko <jpirko@redhat.com> - 1.2-2
changelog:
  - libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf() [1044084] [1091720]


author: Jiri Pirko <jiri@mellanox.com> - 1.6-1
changelog:
  - Update to 1.6
  - libndb: reject redirect and router advertisements from non-link-local
  - libndp: validate the IPv6 hop limit
  - libndp: revert API change for ndp_msg_send() and add ndp_msg_send_with_flags()
  - libndp: fix type of field "na" in "struct ndp_msgna"
  - ndptool: add option to send messages types
  - libndp: add option flags to send messages
  - Add SubmittingPatches howto


author: Robert Scheck <robert@fedoraproject.org> 1.1.6-7
changelog:
  - Run autoreconf to recognize aarch64 (#925813)
  - Conditionalized usage of %{_lib} vs %{_libdir} for RHEL < 7
  - Tight run-time dependencies between sub-packages via %{?_isa}


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-0
changelog:
  - resolves: rhbz#2222894 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-1
changelog:
  - related: rhbz#2190417 - Update to version 4.18.6
  - resolves: rhbz#2232564 - Fix the rpc dsgetinfo command


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.3-1
changelog:
  - resolves: RHEL-16483 - Update to version 4.19.3
  - resolves: RHEL-11361
              - Fix CVE-2023-3961 CVE-2023-4091 CVE-2023-42669
  - resolves: RHEL-2228  - Logging Format Enhancement
  - resolves: RHEL-1965  - Fix smbget issues with DFS shares
  - resolves: RHEL-2108  - Fix force user/group issues with 'allow trusted domains = yes'
  - resolves: RHEL-17122 - Fix memory corruption in libnss_winbind


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-2
changelog:
  - Fix error in PREIN scriptlet in rpm package samba-common
  - related: RHEL-16483 - Update to version 4.19.4


author: Steve Dickson <steved@redhat.com> 2.3.3-59
changelog:
  - Covscan Scan: Wrong Check of Return Value (bz 2151966)
  - Covscan Scan: Clang (experimental) (bz 2151971)


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el8]
changelog:
  - chain: Correctly check realloc() call (Phil Sutter) [1778952]
  - flowtable: Correctly check realloc() call (Phil Sutter) [1778952]
  - chain: Fix memleak in error path of nftnl_chain_parse_devs() (Phil Sutter) [1778952]
  - flowtable: Fix memleak in error path of nftnl_flowtable_parse_devs() (Phil Sutter) [1778952]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el8]
changelog:
  - set_elem: Introduce support for NFTNL_SET_ELEM_KEY_END (Phil Sutter) [1795223]
  - set: Add support for NFTA_SET_DESC_CONCAT attributes (Phil Sutter) [1795223]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795223]


author: Phil Sutter <psutter@redhat.com> [1.1.5-5.el8]
changelog:
  - set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754]
  - expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478]
  - set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478]


author: Tomas Hoger <thoger@redhat.com> - 0.1.13-11
changelog:
  - Add conditional for building with(out) gst010 / GStreamer 0.10 support.
  - Disable gst010 plugin by default.


author: Stefan Becker <chemobejk@gmail.com> - 0.1.14-3
changelog:
  - update to 0.1.14-70-gfb2f1f7 with alternate server fixes for SIPE
  - add autoreconf build step
  - remove examples subpackage as examples are no longer installed


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-4.20171128gitfb2f1f7
changelog:
  - enable make check again
  - make tests pass in Koji
  - disable test-new-dribble that sometimes hangs indefinitely
  - make tests compile on i686
  - make the package build on armv7hl
  - make the package build on Fedora 28
  - avoid build failure if gstreamer-plugins-base-devel is installed
  - move autoreconf invocation to %prep
  - use Name Version Release that explicitly identifies an SCM snapshot (#1541646)


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-6.20171128gitfb2f1f7
changelog:
  - temporarily make the upstream test-suite run on Intel arches only
  - disable test-send-recv, which fails in Koji


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-7.20180504git34d6044
changelog:
  - component: accept TURN in nice_component_verify_remote_candidate() (#1541646)
  - update to 0.1.14-85-g34d6044 (#1541646)


author: Thomas Haller <thaller@redhat.com> - 1.8.28-1
changelog:
  - Update to 1.8.28 release
  - move org.gnome.nm-applet.gschema.xml from network-manager-applet to here.
  - introduce wireless security dialogs


author: Ana Cabral <acabral@redhat.com> - 1.8.36-1
changelog:
  - Update to 1.8.36 release (rh #2062686)
  - Include OWE wireless security (rh #2060327)
  - Fix OWE wireless security entry in Hidden Networks dialog (rh #2057514)


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.2.0-4
changelog:
  - Resolves: rhbz#1649632 - libosinfo test suite should collect+report all
                             failures, not exit on first error


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.5.0-3
changelog:
  - Resolves: rhbz#1727843 - CVE-2019-13313 libosinfo: osinfo-install-script
                             option leaks password via command line argument


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.8.0-1
changelog:
  - Resolves: rhbz#1815158 - Rebase to libosinfo the latest upstream release
  - Resolves: rhbz#1754394 - Provide information about UEFI support for guests (libosinfo)
  - Resolves: rhbz#1032520 - WHQL'ed drivers should be made available for Boxes/libosinfo users


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.1.24-19
changelog:
  - remove old stuff https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/MRWOMRZ6KPCV25EFHJ2O67BCCP3L4Y6N/


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Bastien Nocera <bnocera@redhat.com> - 1.22.0-6
changelog:
  + libpeas-1.22.0-6
  - Remove python2 loader, all GNOME apps using libpeas were ported to Python3
    when ported to GTK+ 3.x, and obsolete libpeas-loader-python
  - Resolves: #1559090


author: Peter Robinson <pbrobinson@fedoraproject.org> 2.0.0-1
changelog:
  - Update to upstream 2.0.0
  - Fixes the following CVEs plus others
  - CVE-2017-6440 CVE-2017-6439 CVE-2017-6438 CVE-2017-6437 CVE-2017-6436
  - CVE-2017-6435 CVE-2017-5836 CVE-2017-5835 CVE-2017-5834 CVE-2017-5545
  - CVE-2017-5209


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.0.0-4
changelog:
  - Python 2 binary package renamed to python2-libplist
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Bastien Nocera <bnocera@redhat.com> - 2.0.0-10
changelog:
  + libplist-2.0.0-10
  - The Python3 Cython binary is now called "cython" not "cython3"
  - Resolves: #1611726


author: Dan Winship <danw@redhat.com> - 0.4.15-5.1
changelog:
  - Drop python2 subpackage (#1559092)
  - Drop PAC runner based on the "pacrunner" package (#1569023)
  - Replace pacrunner-crash-fix patch with version from RHEL7
  - Drop kde subpackage (#1538147)


author: Carl Byington <carl@five-ten-sg.com> 0.6.71-1
changelog:
  - fedora python naming scheme changes
  - Zachary Travis - Add support for the OST 2013 format, and
    Content-Disposition filename key fix for outlook compatibility


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.71-4
changelog:
  - Python 2 binary package renamed to python2-libpst
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tomáš Mráz <tmraz@redhat.com> 1.4.4-1
changelog:
  - Translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer
  - pam_pwquality: Abort the retry loop if user requests it
  - Allow setting retry, enforce_for_root, and local_users_only options
    in the pwquality.conf config file


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1919026 libpwquaily rpm requires cracklib to function but RPM missing requirement [updated]


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.3-11
changelog:
  Correctly set socket directory permissions when
    qb_ipcs_connection_auth_set() is called
    Resolves: rhbz#1836146


author: Angus Salkeld <asalkeld@redhat.com> - 0.4.0-2
changelog:
  - remove "." from Summary
  - Add "check-devel to BuildRequires
  - Add "make check" to check section
  - Changed a buildroot to RPM_BUILD_ROOT
  - Document alphatag, numcomm and dirty variables.


author: Angus Salkeld <asalkeld@redhat.com> - 0.4.1-1
changelog:
  - SPEC: add procps to BuildRequire
  - SPEC: remove automake and autoconf from BuildRequire
  - SPEC: remove call to ./autogen.sh
  - SPEC: update to new upstream version 0.4.1
  - LOOP: check read() return value
  - DOCS: add missing @param on new timeout argument
  - BUILD: only set -g and -O options if explicitly requested.
  - BUILD: Remove unneccessary check for library "dl"
  - BUILD: improve the release build system


author: Angus Salkeld <asalkeld@redhat.com> - 0.5.1-1
changelog:
  - Rebased to 0.5.1 which includes:
  - LOOP: make the return more consistent in qb_loop_timer_expire_time_get()
  - LOG: add string.h to qblog.h
  - Add a qb_strerror_r wrapper.
  - don't let an invalid time stamp provoke a NULL dereference
  - LOG: move priority check up to prevent unnecessary format.
  - rename README to README.markdown


author: Angus Salkeld <asalkeld@redhat.com> - 0.6.0-1
changelog:
  - Rebased to 0.6.0 which includes (#734457):
  - Add a stop watch
  - LOG: serialize the va_list, don't snprintf
  - LOG: change active list into array access
  - atomic: fix qb_atomic_pointer macros
  - LOG: allow the thread priority to be set.
  - Fix splint warning on ubuntu 11.04


author: Angus Salkeld <asalkeld@redhat.com> - 0.10.0-1
changelog:
  - LOOP: handle errors from the poll function
  - LOOP: make the item type applicable to jobs too.
  - LOOP: fix the todo calculations.
  - TEST: check for a single job causing a cpu spin
  - LOOP: prevent jobs from consuming too much cpu.
  - Get coverity to ignore this warning.
  - Change example code to use fgets instead of gets
  - LOG: pass the result of qb_log_thread_start() back to the user
  - Fix some issues found by clang
  - Add clang-analyzer check
  - Add a split timer to the stopwatch.
  - IPC: merge common code into new function
  - IPC: better handle a disconnect been called from within connection_created()
  - IPC: fix scary typo
  - IPC: fix server error handling


author: Angus Salkeld <asalkeld@redhat.com> - 0.10.1-1
changelog:
  - Fix "make distcheck" add include path to AM_CPPFLAGS
  - Bump the version to 0.10.1
  - clang: Remove unused code
  - TEST: make the ipc failure test closer to corosync's case.
  - RB: add a debug message if trying to read a message of the wrong size
  - IPC: split up the recv into chuncks of 2 seconds. (#788742)
  - Be more consistent with the internal logs.
  - LOOP: make it possible to pass in NULL as the default loop instance
  - RB: use the proper struct not the typedef in the implementation.
  - RB: Fix potential mem leak
  - Don't mix enums (QB_TRUE/TRUE)
  - use random() not rand()
  - Remove dead code
  - set umask before calling mkstemp()
  - Use safer versions of string functions (strcpy -> strlcpy)
  - Increase the coverity aggressiveness
  - TEST: make the loop ratelimit test more forgiving.


author: Angus Salkeld <asalkeld@redhat.com> - 0.11.1-1
changelog:
  - configue libqb to not use epoll as it seems broken (#800865)
  - LOOP: remove some old timerfd code.
  - TEST: add a test to check the order of the jobs
  - LOOP: when new jobs are added they are added to the head instead of the tail.
  - LOG: Now the array is self locking we can make the lookup array dynamic
  - Add locking to the array when growing.
  - IPC: make the _request_q_len_get() function more obvious.
  - IPC: fix multiple receives from qb_ipc_us_recv()
  - IPC: make sure that the wrong union member is not written to.
  - TIMER: check for null timer handle

  Wed Mar 7 2012  Angus Salkeld <asalkeld@redhat.com> - 0.11.0-1
  - ARRAY: cleanup the pointer sizeof()
  - LOG: turn off __attribute__(section) for powerpc (not working)
  - TESTS: move the util tests into "slow-tests" (i.e. optional)
  - TEST: make the test_priority the same type as in the callsite
  - LOG: make the log arrays manually grow-able since we need to lock the calls.
  - RB: fix test failure on ppc
  - RB: change the name of the size to word_size to be more clear
  - TEST: add some more signal tests.
  - LOOP: fix deletion of signal handlers when they are pending
  - LOOP: signal handlers were always added as high priority.
  - TEST: deal with mac's limited sed
  - check: add debugging to the configure options and remove unused options
  - TEST: properly clear the filters
  - LOG: expose the mechanism to get a dynamic callsite.
  - Revert part of my COARSE grained timer commit
  - Remove timerfd usage and go back to timelist.
  - UTIL: if possible use COARSE resolution clocks - they are much faster.
  - ARRAY: save memory (in the bins array) and allow holes in the array
  - LOOP: add qb_loop_timer_is_running()
  - LOOP: allow stop() and run() to be called with NULL loop instance.
  - LOOP: fix doxygen parameter comment
  - LOG: add stdout target
  - LOOP: add a function to delete jobs
  - LOG: remove debug printf's
  - LOG: remove an old/incorrect doxygen comment.
  - LOG: add a hostname %H format specifier.
  - LOG: Add qb_log_filter_fn_set()


author: Angus Salkeld <asalkeld@redhat.com> - 0.13.0-1
changelog:
  - Remove unneccessary __attribute__ ((aligned(8))) from internal headers
  - IPC: add a new function to get (and alloc) the extended stats.
  - Revert "Add the event queue length to the connection stats."
  - IPC: cleanup better on a failed client connect.
  - IPC(soc): be more consistent with control struct size
  - IPC: kill a compiler warning
  - IPC(soc): pass in the correct size into munmap()
  - TEST: Use /bin/sh not /bin/bash
  - TEST: check for lost shared mem on bsd too
  - rb: cleanup the semaphores
  - Fix some small issues in ./check
  - Cleanup the .gitignore files
  - configure.ac tweaks
  - Remove HZ and use sysconf instead.
  - SUN_LEN() macro is present if __EXTENSIONS__ is defined on Illumos
  - PF_UNIX is a POSIX standard name
  - Test for log facility names
  - IPC: drop log message to debug.
  - IPC: fix retrying of partial recv's and sends.
  - IPC: initialize enough shared mem for all 3 one way connections.
  - IPC: keep retrying to recv the socket message if partially recv'ed (part 2)
  - IPC: keep retrying to recv the socket message if partially recv'ed
  - IPC: handle the server shutdown better
  - IPC: handle a connection disconnect from the server better
  - IPC: make it possible to send events in the connected callback.
  - Add the event queue length to the connection stats.
  - IPC: add a is_connected client side function.
  - Fix typo in ./check
  - docs: clarify the need to use request/response headers
  - Remove unused local variable
  - IPC: change the socket recv function to read the response header.
  - Add some special commands into the ipc example
  - TEST: improve the tracing in the ipc tests.
  - Make "make (s)rpm" work more reliably
  - TEST: add a test to confirm we get the events we send.
  - TEST: reuse send_and_check for events.
  - IPC: make it possible for a root client to talk to a non-root server.
  - Run ./Lindent in the examples directory
  - Add some debug code to the ipcclient example
  - IPC: make sure ipc (socket) clients can connect to a server running as root.
  - IPC: allow qb to bump the max_message_size
  - IPC: check for a sane minimum max_message_size
  - add rpl_sem.h loop_poll_int.h to noinst_headers
  - Handle errors more consistently
  - call recv_ready on socket types
  - Handle a recv of size 0
  - make bsd shm path better by default.
  - Fix kqueue on freebsd.
  - Get the example socket includes right.
  - Fix kqueue compiling.
  - POLL: seperate out the poll/epoll and add kqueue
  - Test existence of getpeer* functions
  - Add inet header to tcpclient example
  - Don't link with setpshared if unavailable
  - NetBSD doesn't have semun defined
  - Use MADV_NOSYNC only on systems where available
  - Use SCHED_BATCH only on platforms where available
  - Fix a bug introduced by the bsd patch.
  - Cleanup the selection of semaphores to use
  - Fix some leaks in the logging.
  - Try and improve the portability on bsd variants.


author: Angus Salkeld <asalkeld@redhat.com> - 0.14.0-1
changelog:
  LOG: fix threaded logging.
  Add user control of the permissions that are set on the shared mem files
  LOG: Restrict string trucation during serialization to when a precision is specified
  LOG: Gracefully fail when the caller exceeds QB_LOG_MAX_LEN
  LOG: Observe field widths when serializing string arguments
  RB: use the same mechanism in reclaim as read/peek to detect end-of-ring
  Add needs_response_ack option to ./check
  RB: fix wrong sem_flg IPC_NOWAIT option
  TESTS: fix warning about unused functions
  Remove D_FORTIFY_SOURCE from check.
  Open shared mem file in /dev/shm only for linux
  Don't use msg_flags on solaris (recvmsg).
  Turn off attribute_section on solaris
  ipc example: add -e (events) option
  IPC: if the server returns EAGAIN or ETIMEOUT the check the connection
  LOG: make it possible to fsync() on each file log.
  IPC: make sure that the created callback happens before dispatches
  LOG: fix the printing of %p in the blackbox
  IPC: On bsd's use the notifier for responses
  IPC: interpret ECONNRESET and EPIPE as ENOTCONN
  cleanup some warnings
  config: use newer AC_COMPILE_IFELSE()
  blackbox: fix %p formatting
  LOG: put all fields in the blackbox (added priority and tags)
  example: make the priority uint8_t
  Remove strerror out of check_funcs
  RB: fix compiler warning.
  Add replacement function stpcpy
  Add missing AC_TYPE_UINT16_T to configure.ac
  Use AC_FUNC_STRERROR_R and STRERROR_R_CHAR_P
  Add stpcpy strcasecmp to the check_funcs
  Move some conditional defines into code (from the configure script)
  Remove some unused configure checks
  Remove message queues
  Check for union semun properly
  Blackbox: provide more space for log messages when reading from the blackbox.
  Add the blackbox reader manpage to the spec file
  Enable error logging for the blackbox reader
  RB: Read the file size into an initialized variable of the correct size
  Add a tool to dump the blackbox.
  RB: to be safer save the read and write pointers at the top of the blackbox
  avoid unwarranted use of strncpy: use memcpy instead
  blackbox: fix the print_from_file()
  RB: add an option to not use any semaphores
  LOG: tweak the blackbox format string
  LOG: accept NULL strings into the blackbox
  LOG: protect close and reload from calling log
  Add benchmark option (-b) to examples/ipcclient
  TEST: make rbreader/writer more like the other benchmarking apps
  IPC: log the connection description in all logs
  TEST: re-organise the ipc test suites
  IPC: only modify the dispatch if we get EAGAIN
  Correctly display timestamp in blackbox


author: Angus Salkeld <asalkeld@redhat.com> - 0.14.1-1
changelog:
  RB: set the new read pointer after clearing the header (#839605).
  RB: improve the debug print outs
  RB: be more explicit about the word alignment
  RB: cleanup the macros for wrapping the index
  RB: use sem_getvalue as a tie breaker when read_pt == write_pt
  RB: if read or peek don't get the message then re-post to the semaphore
  RB: convert the rb_peek() status into a recv like status.
  RB: use internal reclaim function
  IPC: use calloc instead of malloc to fix valgrind warnings
  Upgrade the doxygen config.
  Fix a valgrind error.


author: Angus Salkeld <asalkeld@redhat.com> - 0.14.2-1
changelog:
  Get libqb building on cygwin.
  ipc_us: slightly more robust cmsg handling
  ipc_us: on Linux, set SO_PASSCRED on the sending socket too
  ipc_us: clear request unused fields
  TEST: Include writing and reading the blackbox in the log_long_msg test
  LOG: fix qb_vsnprintf_deserialize()
  blackbox: fix 64-bit big-endian issues
  Remove IPC_NEEDS_RESPONSE_ACK and turn off shm ipc on solaris
  Define unix path max for openbsd
  Only turn on ipc_needs_response_ack=yes for solaris
  Some improvements to kqueue usage.
  kqueue: drop log message to trace.
  Fix splint warning
  openbsd requires netinet/in.h before arpa/inet.h
  Avoid strcpy() use strlcpy() instead.
  Fix kqueue complile warnings
  openbsd doesn't have EBADMSG
  openbsd has a different UNIX_PATH_MAX
  LOG: change qb_vsprintf_serialize() into qb_vsnprintf_serialize()
  TEST: increase timeout to 6 secs as the recv timeout is 5 secs
  TEST: get the logic right - grrr.
  Turn off attribute_section on netbsd
  Some missing pshared semaphore checks
  Cleanup the checks for pshared semaphores
  Add a config check for pthread_mutexattr_setpshared
  Remove uses of timersub and use qb_util_stopwatch
  RB: change the #error to ENOTSUP if no usable shared process sem
  LOOP-KQUEUE: fix reference before assignment.
  build: fix libqb.pc creation and make maintainer-clean
  LOG: Make sure the semaphores are initialized.
  build: remove bashism in cc support check
  Catch disconnected sockets on Solaris
  Don't free rb->shared_hdr in qb_rb_create_from_file()
  Check error return of qb_ipcs_uc_recv_and_auth()
  Fix removal of automatically installed doc files when building rpms
  Add the mailing list to the travis email notifications.
  Work around debian not setting the arch path in splint.
  Remove color-tests and parallel-tests automake options.
  Add travis continuous integration config
  LOG: Invoke custom log filter function if tag changes
  tests/rbwriter: don't ignore write failure
  ipcs: avoid use-after-free for size-0 || disconnect-request


author: Angus Salkeld <asalkeld@redhat.com> - 0.14.3-1
changelog:
  IPC: Pass the timeout to poll() if the recv function returns EAGAIN
  LOG: make the format comparison safe and sane
  LOG: don't break on empty callsites, just ignore them
  LOG: use the array callback to register new callsites
  array: add a mechanism to get a callback when a bin is allocated
  Solaris based operating systems don't define MSG_NOSIGNAL and SO_NOSIGPIPE.
  Make sure atomic's are initialized (for non-gcc atomic).


author: Angus Salkeld <asalkeld@redhat.com> - 0.14.4-1
changelog:
  LOG: prevent the last char of the blackbox message from getting lost.
  Example: make the blackbox example more practical.
  Add the processing which remove notifier at skiplist_destroy function
  Add the processing which remove hash node and notifier at hashtable_destroy function
  Unify to QB_TRUE/QB_FALSE a boolean value
  Document the default prefix in INSTALL
  Unify the list processing with qb_list function
  Add travis link to the readme.
  Fix return code which is an error occurred at pthread function
  TEST: add a progam to compare the speed of vsnprintf and qb_vsnprintf_serialize
  LOG: add a test for a padded hex int.
  Fedora's splint has a strange syntax error, don't fail on it.
  LOG: fix truncation in some messages that get padded.
  Fix the blackbox formatter when specifing the string len/precision
  Fix strlcpy and strlcat functions
  IPC: don't over log on disconnect
  Make sure we don't use the format string whilst it is getting changed.
  ptrie: deref the current node in trie_iter_free()
  LOG: fix the format comparison to avoid generating multiple entries.
  LOG: set the return code when calloc fails
  IPC: call poll if we are mid message and get EAGAIN
  Remove extra ";"
  IPC: set the error more correctly when qb_sys_mmap_file_open() fails.
  Make sure that mmap'ed files smaller than a page size are written to.
  example/test: check for error in qb_ipc_run()
  example: check for error in qb_ipc_run()
  TEST: fix typo s/,/; in check_ipc.c


author: David Vossel <dvossel@redhat.com> - 0.16.0-1
changelog:
  Bump version to 0.16.0 ... do not use version 0.15.0
  Update release gpg sign key
  Bump the version to 0.15.0
  Merge pull request #83 from davidvossel/master
  Low: ipc_socket: Output send event failure as debug instead of error
  Low: ipcserver.c: Fix example server's glib mainloop implementation
  High: ipc_socket.c: Detect EOF connection on connection STREAM socket
  Merge pull request #81 from davidvossel/dgram_max_msg
  Low: tests: Add dgram max size detection test
  Low: ipc_socket.c: Handle the unlikely event of an EAGAIN or EINTR during dgram max size detection
  Merge pull request #82 from davidvossel/master
  Fixes detect disconnect on send for tcp example
  Fixes sem leak
  Fixes less-than-zero comparision of unsigned int
  fixes double close
  Fixes double close
  Fixes double fd close
  Fixes fd leak
  Prevent use after free in benchmark util
  Fixes use ater free in shm disconnect
  Fixes use after free during ipcs client disconnect
  Remove dead code
  Low: check_ipc.c: Verify dgram max size during tests
  High: ipcc: Add abilty to verify dgram kernel buffer size meets max msg value
  Fixes travis build error
  Merge pull request #80 from davidvossel/master
  Low: check_ipc.c: fix debug message to only display once.
  High: ringbuffer: Make max_size of ringbuffer accurate so shm ipc max msg size value is honored
  Low: ipcs: For shm ipc, always retry outstanding notifications when next event is sent
  Low: tests: Added test to verify sending ipc msg equal to max size succeeds
  Merge pull request #79 from davidvossel/master
  Merge pull request #78 from davidvossel/master
  Fix: ipcs: Fixes compile time issue reported by travis
  Merge pull request #77 from davidvossel/stress_tests_fixes
  Low: loop_pool_kqueue: remove potentially noisy dbug statement
  Low: tests: rework bulk event msg ipc test
  Account for fbsd ENOBUFS during stress test
  Low: tests: Adds ipc event stress test to testsuite
  Low: ipc_socket: In fbsd send() returns ENOBUFS when dgram queue is full, this should be treated similar to EAGAIN
  High: kqueue: Properly enable kqueue filter in poll loop
  Low: ipcs: Attempt to resend outstanding event notifications during event send
  Merge pull request #75 from davidvossel/ref_count_cleanup
  Low: qbipcs.h: update ipcs connection iterator documentation
  Merge pull request #74 from davidvossel/ref_count_cleanup
  Fix: ipcs: Disconnect shm ipc connection when poll socket returns error on msg receive
  Fix: ipcs: Properly disconnect client connection on POLLNVAL or any other error causing connection removal from mainloop.
  Simplify internal ipcs ref counting, add comments and document api behavior
  Simplifies connection ref counting without changing behavior
  Low remove ref-count error in example ipcserver.
  Merge pull request #73 from davidvossel/ref_count_cleanup
  Merge pull request #72 from davidvossel/master
  Low: tests: Verify reading valid blackbox file works
  Fix: refcount leak
  Fix: ringbuffer: Add file header version field and detect reading corrupted blackbox files using hash value
  Fix: tests: On some platforms -ECONNRESET is returned rather than -ENOTCONN after server failure
  Fix: tests: Make blackbox_segfault.sh not depend on bash
  Hopefully this is the last travis link fix
  Fix travis icon (travis is case sensitive)
  Fix the github links
  Merge pull request #70 from yuusuke/fix_logging
  fix a problem when the character string beyond the number of the maximum characters is passed
  Merge pull request #68 from r1mikey/upstream
  Add a IPC service context pointer and accessors from both the connection and service level.
  Enable distcheck on the travis tests
  Add atomic_int.h to noinst_HEADERS
  Use the new atomic ops in the ringbuffer
  Add internal support for the new __atomic gcc builtins
  Rename the configure macros from atomic to sync
  ringbuffer: use atomic ops on ringbuffer chunk magic
  Remove some test code mistakenly committed to the example program.
  IPC: make each connection ref the owning service
  Indicate when/why qb_rb_force_close() fails to remove share memory files
  Typo fixed in configure
  Fix "make srpm"
  Remove doxygen from travis deps to try and get the job working.
  Fix make distcheck
  Merge pull request #60 from t-matsuo/fix-makefile-of-tests
  add file_change_bytes into check_PROGRAMS and fix a typo
  Deal better with corrupt blackbox files.
  Merge pull request #58 from inouekazu/fix_connection_state_checking
  IPC: fix the connection state checking
  LOG: copy the function/filename for dynamic callsites
  Deal with /dev/shm issue on Travis builders
  Properly discover SO_NOSIGPIPE and MSG_SIGNAL
  IPC: fix call to QB_SUN_LEN
  list: don't splice empty lists onto the head.
  rpl_sem: make destroy more compliant
  test: fix unused-but-set-variable warning
  test: fix missing-format-attribute warning
  RB: make the "sem" abstraction into a notifier
  IPC: clean up the connection state checking
  Use dgram sockets for message oriented communications
  IPC: don't interpret EMSGSIZE and ENOMSG as a disconnect
  POLL: prevent a spin if the fd is not removed from the mainloop
  add TAGS and ~ files to .gitignore
  docs: install qb-blackbox.8 if doxygen is not available.
  IPC: seperate ipc_us.c into 2 files
  IPC: move utility functions to unix.c
  IPC: make sure we return a consistent error when the message is too big.


author: David Vossel <dvossel@redhat.com> - 0.17.0-1
changelog:
  Fix: build: Allow 'make rpm' to work with lightweight tags for release candidates
  Fix: spec: reference correct url in spec file
  Doc: update broken doxygen link to something that exists
  Bump version to 0.17.0
  Low: ipc_socket: further optimize max msg size calculations for fbsd portability tests
  Low: ipc_socket: Allow socket max msg size to be calculated more accurately
  Fix: fixes travis compile time error
  Low: tests: Fixes compile time issue with make check
  High: ipcs: Prevent ipc server use after free.
  Low: ipc: Remove ipc connection reference given to dispatch functions
  High: ipc: Fixes memory leak in server connection accept when client partially connects
  IPC: Increase the listen backlog of IPC server
  Low: ipcs: Clarifications to the ipcs server callback documentation.
  Fix rb.test to avoid overwriting memory during reading.
  Low: example: Update client/server example to use server enforced buffer size
  Low: Client side buffer retrieval regression test
  Feature: New api function to retrieve client buffer size
  Low: check_ipc.c: Verify server enforced buffer sizes work
  Feature: Enforce buffer size limits on the server side
  Low: regession tests for regex log filters
  Feature: Filter logs using regex patter on function, format, or filename
  ipc_setup: Set SO_PASSCRED on listener socket
  Fix: log: Filtering by function and file must match exactly, no substring matches
  Low: blackbox: Abort blackbox logging on ringbuffer overwrite reclaim error
  High: ipcs: Api function allowing server to retrieve client connection's ipc buffer size
  Low: ringbuffer: Abort during chunk reclaim if OVERWRITE flag is set and reclaim fails.
  High: blackbox: unique blackbox ringbuffer files per pid
  Low: ipc_socket: Fixes fd leak in socket ipc client disconnection
  Use sizeof to get the correct size of the sockaddr_un sun_path member in a portable way. Fixes corosync on Mac OS X.
  Detect the max signal value that can be used using NSIG macro
  Avoid double-decrement of level->todo


author: David Vossel <dvossel@redhat.com> - 0.17.1-1
changelog:
  Fix: ipcs: Correctly allocate receive buffer size
  Fix: ipc_socket: Signalhandler must be resetted to Default, use only cleanup_sigpipe to return from qb_ipc_dgram_sock_setup.
  Fix: trie: allow modifying the trie map during the notify callback
  Fix: fix invalid option when run 'ipcclient -h'
  Fix: epoll: don't miss poll events under high load
  Fix: ipc_shm: fix error handling in qb_ipcs_shm_connect()
  Fix: ringbuffer: fix size in qb_rb_create_from_file()
  Fix: ringbuffer: fix qb_rb_open_2() debug format string
  Fix: trie: fixes regression caused by ref count refactoring
  Fix: ipcc: Properly timeout during recv when timeout value is provided


author: Jan Pokorný <jpokorny+rpm-libqb@redhat.com> - 0.17.2-1
changelog:
  - Update to libqb-0.17.2 + fix check_ipc tests, for list of changes see:
    https://github.com/ClusterLabs/libqb/releases/tag/v0.17.2


author: Jan Pokorný <jpokorny+rpm-libqb@redhat.com> - 1.0-1
changelog:
  - Update to libqb-1.0, for list of changes see, in order:
    https://github.com/ClusterLabs/libqb/releases/tag/v1.0rc1
    https://github.com/ClusterLabs/libqb/releases/tag/v1.0rc2
    https://github.com/ClusterLabs/libqb/releases/tag/v1.0rc3
    https://github.com/ClusterLabs/libqb/releases/tag/v1.0rc4
    https://github.com/ClusterLabs/libqb/releases/tag/v1.0
  - Adapt spec file per the upstream version (drop defattr statements,
    autogen.sh call with %build, conditionalize build process)
  - Add gcc as an explicit BuildRequires (required per the new guidelines)
  - Do not depend on the rpmbuild-imposed man page archiving method


author: Jan Pokorný <jpokorny+rpm-libqb@redhat.com> - 1.0.1-1
changelog:
  - Update to libqb-1.0.1, for list of changes see:
    https://github.com/ClusterLabs/libqb/releases/tag/v1.0.1
  - Move qb-blackbox manual page from libqb-devel to libqb
    (where the utility itself resides)


author: Jan Pokorný <jpokorny+rpm-libqb@redhat.com> - 1.0.2-1
changelog:
  - Update to libqb-1.0.2, for list of changes see:
    https://github.com/ClusterLabs/libqb/releases/tag/v1.0.2


author: Jan Pokorný <jpokorny+rpm-libqb@redhat.com> - 1.0.2-4
changelog:
  - Mitigate changed treatment of orphaned sections in ld.bfd/binutils-2.29,
    resulting in logging facility silently out of order (rhbz#1478089)


author: Jan Pokorný <jpokorny+rpm-libqb@redhat.com> - 1.0.2-6
changelog:
  - Better approach so as to mitigate changed treatment of orphaned sections
    in ld.bfd/binutils-2.29, resulting in logging facility silently out of order
    (rhbz#1478089)
  - Related to that, build commands now shown in full to ease the sanity checking
  - Adapt spec file per the upstream version (conditionalizing build through
    --enable-syslog-tests no longer relevant since v1.0.2)


author: Jan Pokorný <jpokorny+rpm-libqb@redhat.com> - 1.0.2-14
changelog:
  - Evolution of the previous (rhbz#1478089)
  - Make -devel package dependency on the main package arch-qualified


author: Jan Pokorný <jpokorny+rpm-libqb@redhat.com> - 1.0.3-1
changelog:
  - Update to libqb-1.0.3, for list of changes see:
    https://github.com/ClusterLabs/libqb/releases/tag/v1.0.3


author: Nils Philippsen <nils@tiptoe.de> - 2.1.2-1
changelog:
  - version 2.1.2
  - tidy up spec file
  - use %license for license file
  - require same arch main from devel package


author: Attila Lakatos <alakatos@redhat.com> - 1.6.1-1
changelog:
  - Rebase to 1.6.1
    resolves: RHEL-12892
  - Fix warnings reported by rpmlint
  - Enable support for zlib/zstd compression and GSSAPI


author: Jiri Vymazal <jvymazal@redhat.com> - 1.2.13-1
changelog:
  - rebase to 1.2.13
    resolves: rhbz#1425638
  - added patch for GnuTLS crypto-policy adherence
    resolves: rhbz#1179317
  - added autoconf, automake and libtool because package
    has patches now


author: Attila Lakatos <alakatos@redhat.com> - 1.9.0-1
changelog:
  - rebase to 1.9.0
  - add patch to comply with crypto policies
  - add support for openssl
    resolves: rhbz#1932783
  - Properly end TLS connections
    resolves: rhbz#1886400


author: Martin Kutlak <mkutlak@redhat.com> - 2.9.5-10
changelog:
  - reportclient: Search for required packages recursively
  - reportclient: Find and download required debuginfo packages
  - report-client: Find debuginfos in own method
  - Resolves: rhbz#1783897


author: Michal Židek <mzidek@redhat.com> - 2.9.5-12
changelog:
  - Resolves: rhbz#1835388 - abrt-addon-ccpp causes failures during openscap scans on CCE-27119-7
  - This is just libreport side (abrt also needs to be patched)


author: Arkady L. Shane <tigro@msvsphere-os.ru> - 2.9.5-15.inferit
changelog:
  - Added support for MSVSphere bug tracker
  - Removed libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla


author: Sergio Durigan Junior <sergiodj@redhat.com> - 0.0.4-12
changelog:
  - Resolves: rhbz#1786466 Do not use %{?_isa} for GDB dependency. Recommend
    GDB, instead of requiring it.


author: Nils Philippsen <nils@tiptoe.de> - 0.1.9-1
changelog:
  - version 0.1.9
  - change license to BSD (2-clause)
  - require gcc, alsa-lib-devel, fftw-devel for building


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-2.1
changelog:
  - Use Python distutils to install SELinux python bindings (#1719771)
  - Move  sefcontext_compile to -utils package (#1612518)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-6
changelog:
  - Describe fcontext regular expressions (#1904059)
  - Strip spaces before values in config (#2012145)


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-5
changelog:
  - Revert "genhomedircon: check usepasswd" (rhbz#1871786)
  - semanage.conf - improve usepasswd=False explanation (rhbz#1871786)
  - semanage.conf - expand list of ignoredirs (rhbz#1871786)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-7
changelog:
  - Trivial style fixes
  - Free contents of modkey in semanage_direct_remove
  - Fix USE_AFTER_FREE (CWE-672) in semanage_direct_write_langext()
  - add missing include to boolean_record.c
  - move module hashing into libsemanage
  - move compressed file handling into a separate object
  - clean up semanage_direct_commit() a bit
  - optionally rebuild policy when modules are changed externally
  - add command-line option to detect module changes (#2049186)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-9
changelog:
  - allow spaces in user/group names (#2042408)
  - always write kernel policy when check_ext_changes is specified (#2089802)


author: Dan Walsh <dwalsh@redhat.com> 1.1.3-1
changelog:
  - Update from NSA
    * Merged errno fix from Joshua Brindle (Tresys).
    * Merged fix for semod_build_modules_list leak on error path
      from Serge Hallyn (IBM).  Bug found by Coverity.
    * Merged several fixes from Serge Hallyn (IBM).  Bugs found by
      Coverity.
    * Fixed several other bugs and warnings.
    * Merged patch to move module read/write code from libsemanage
      to libsepol from Jason Tang (Tresys).  
    * Merged relay records patch from Ivan Gyurdiev.
    * Merged key extract patch from Ivan Gyurdiev.

  - Initial version
  - Created by Stephen Smalley <sds@epoch.ncsc.mil>


author: Dan Walsh <dwalsh@redhat.com> 1.1.6-1
changelog:
  - Update from NSA
    * Merged semod.conf template patch from Dan Walsh (Red Hat),
    but restored location to /usr/share/semod/semod.conf.
    * Fixed several bugs found by valgrind.
    * Fixed bug in prior patch for the semod_build_module_list leak.
    * Merged errno fix from Joshua Brindle (Tresys).
    * Merged fix for semod_build_modules_list leak on error path
      from Serge Hallyn (IBM).  Bug found by Coverity.


author: Dan Walsh <dwalsh@redhat.com> 1.3.1-1
changelog:
  - Update from NSA
    * Merged stub functionality for managing user and port records,
    and record table code from Ivan Gyurdiev.
    * Updated version for release.


author: Dan Walsh <dwalsh@redhat.com> 1.3.2-1
changelog:
  - Update from NSA
    * Merged stub iterator functionality from Ivan Gyurdiev.
    * Merged interface record patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.3-1
changelog:
  - Update from NSA
    * Merged boolean record, stub record handler, and status codes 
      patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.5-1
changelog:
  - Update from NSA
    * Split interfaces from semanage.[hc] into handle.[hc], modules.[hc].
    * Separated handle create from connect interface.
    * Added a constructor for initialization.
    * Moved up src/include/*.h to src.
    * Created a symbol map file; dropped dso.h and hidden markings.


author: Dan Walsh <dwalsh@redhat.com> 1.3.7-1
changelog:
  - Update from NSA
    * Merged patch series from Ivan Gyurdiev.
      (pointer typedef elimination, file renames, dbase work, backend
       separation)
    * Split interfaces from semanage.[hc] into handle.[hc], modules.[hc].
    * Separated handle create from connect interface.
    * Added a constructor for initialization.
    * Moved up src/include/*.h to src.
    * Created a symbol map file; dropped dso.h and hidden markings.


author: Dan Walsh <dwalsh@redhat.com> 1.3.10-1
changelog:
  - Update from NSA
    * Updated for changes to libsepol, and to only use types and interfaces
    provided by the shared libsepol.


author: Dan Walsh <dwalsh@redhat.com> 1.3.11-1
changelog:
  - Update from NSA
    * Fixed semanage_install_active() to use the same logic for
    selecting a policy version as semanage_expand_sandbox().  Dropped
    dead code from semanage_install_sandbox().


author: Dan Walsh <dwalsh@redhat.com> 1.3.14-1
changelog:
  - Update from NSA
    * Updated to use get interfaces for hidden sepol_module_package type.
    * Changed semanage_expand_sandbox and semanage_install_active
    to generate/install the latest policy version supported  by libsepol
    by default (unless overridden by semanage.conf), since libselinux
    will now downgrade automatically for load_policy.
    * Merged new callback-based error reporting system and ongoing
    database work from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.18-1
changelog:
  - Update from NSA
    * Merged bugfix patch from Ivan Gyurdiev.
    * Merged seuser database patch from Ivan Gyurdiev.
    Merged direct user/port databases to the handle from Ivan Gyurdiev.
    * Removed obsolete include/semanage/commit_api.h (leftover).
    Merged seuser record patch from Ivan Gyurdiev.
    * Merged boolean and interface databases from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.20-1
changelog:
  - Update from NSA
    * Merged user and port APIs - policy database patch from Ivan
    Gyurdiev.
    * Converted calls to sepol link_packages and expand_module interfaces
    from using buffers to using sepol handles for error reporting, and 
    changed direct_connect/disconnect to create/destroy sepol handles.


author: Dan Walsh <dwalsh@redhat.com> 1.3.20-1
changelog:
  - Update from NSA
    * Changed default args for load_policy to be null, as it no longer
      takes a pathname argument and we want to preserve booleans.
    * Merged move local dbase initialization patch from Ivan Gyurdiev.
    * Merged acquire/release read lock in databases patch from Ivan Gyurdiev.
    * Merged rename direct -> policydb as appropriate patch from Ivan Gyurdiev.
    * Added calls to sepol_policy_file_set_handle interface prior
      to invoking sepol operations on policy files.
    * Updated call to sepol_policydb_from_image to pass the handle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.24-1
changelog:
  - Update from NSA
    * Merged default database from Ivan Gyurdiev.
    * Merged removal of connect requirement in policydb backend from
      Ivan Gyurdiev.
    * Merged commit locking fix and lock rename from Joshua Brindle.
    * Merged transaction rollback in lock patch from Joshua Brindle.
    * Changed default args for load_policy to be null, as it no longer
      takes a pathname argument and we want to preserve booleans.
    * Merged move local dbase initialization patch from Ivan Gyurdiev.
    * Merged acquire/release read lock in databases patch from Ivan Gyurdiev.
    * Merged rename direct -> policydb as appropriate patch from Ivan Gyurdiev.
    * Added calls to sepol_policy_file_set_handle interface prior
      to invoking sepol operations on policy files.
    * Updated call to sepol_policydb_from_image to pass the handle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.28-1
changelog:
  - Update from NSA
    * Merged interface renaming patch from Ivan Gyurdiev.
    * Merged policy component patch from Ivan Gyurdiev.
    * Renamed 'check=' configuration value to 'expand-check=' for 
      clarity.
    * Changed semanage_commit_sandbox to check for and report errors 
      on rename(2) calls performed during rollback.
    * Added optional check= configuration value to semanage.conf 
      and updated call to sepol_expand_module to pass its value
      to control assertion and hierarchy checking on module expansion.
    * Merged fixes for make DESTDIR= builds from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.30-1
changelog:
  - Update from NSA
    * Fixed policy file leaks in semanage_load_module and
      semanage_write_module.
    * Merged further database work from Ivan Gyurdiev.
    * Fixed bug in semanage_direct_disconnect.


author: Dan Walsh <dwalsh@redhat.com> 1.3.32-1
changelog:
  - Update from NSA
    * Merged resync to sepol changes and transaction fix patches from
      Ivan Gyurdiev.
    * Merged reorganize users patch from Ivan Gyurdiev.
    * Merged remove unused relay functions patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.34-1
changelog:
  - Update from NSA
    * Merged resync to sepol changes and booleans fixes/improvements 
      patches from Ivan Gyurdiev.
    * Merged support for genhomedircon/homedir template, store selection,
      explicit policy reload, and semanage.conf relocation from Joshua
      Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.35-1
changelog:
  - Update from NSA
    * Merged sepol handle passing, seusers support, and policydb cache
      patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.38-1
changelog:
  - Upgrade to latest from NSA
    * Merged dbase policydb list and count change from Ivan Gyurdiev.
    * Merged enable dbase and set relay patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.39-1
changelog:
  - Upgrade to latest from NSA
    * Merged record interface, dbase flush, common database code,
      and record bugfix patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.41-1
changelog:
  - Upgrade to latest from NSA
    * Merged interface parse/print, context_to_string interface change,
      move assert_noeof, and order preserving patches from Ivan Gyurdiev.
          * Added src/dso.h in preparation for other changes.
    * Merged install seusers, handle/error messages, MLS parsing,
      and seusers validation patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.43-1
changelog:
  - Upgrade to latest from NSA
    * Merged seuser parser resync, dbase tracking and cleanup, strtol
      bug, copyright, and assert space patches from Ivan Gyurdiev.
    * Added src/*_internal.h in preparation for other changes.
     * Added hidden/hidden_proto/hidden_def to src/debug.[hc] and
            src/seusers.[hc].


author: Dan Walsh <dwalsh@redhat.com> 1.3.48-1
changelog:
  - Upgrade to latest from NSA
    * Disabled calls to port dbase for merge and commit and stubbed
      out calls to sepol_port interfaces since they are not exported.
    * Merged rename instead of copy patch from Joshua Brindle (Tresys).
    * Added hidden_def/hidden_proto for exported symbols used within 
      libsemanage to eliminate relocations.  Wrapped type definitions
      in exported headers as needed to avoid conflicts.  Added
      src/context_internal.h and src/iface_internal.h.
    * Added semanage_is_managed() interface to allow detection of whether
      the policy is managed via libsemanage.  This enables proper handling
      in setsebool for non-managed systems.
    * Merged semanage_set_reload_bools() interface from Ivan Gyurdiev,
      to enable runtime control over preserving active boolean values
      versus reloading their saved settings upon commit.


author: Dan Walsh <dwalsh@redhat.com> 1.3.51-1
changelog:
  - Upgrade to latest from NSA
    * Clear modules modified flag upon disconnect and commit.
          * Added tracking of module modifications and use it to
      determine whether expand-time checks should be applied
      on commit.
    * Reverted semanage_set_reload_bools() interface.


author: Dan Walsh <dwalsh@redhat.com> 1.3.52-1
changelog:
  - Upgrade to latest from NSA
    * Merged cleanup patch from Ivan Gyurdiev.
      This renames semanage_module_conn to semanage_direct_handle,
      and moves sepol handle create/destroy into semanage handle
      create/destroy to allow use even when disconnected (for the
      record interfaces).


author: Dan Walsh <dwalsh@redhat.com> 1.3.53-1
changelog:
  - Upgrade to latest from NSA
    * Merged move seuser validation patch from Ivan Gyurdiev.
    * Merged hidden declaration fixes from Ivan Gyurdiev,
      with minor corrections.


author: Dan Walsh <dwalsh@redhat.com> 1.3.56-1
changelog:
  - Upgrade to latest from NSA
    * Fixed free->key_free bug.
    * Merged clear obsolete patch from Ivan Gyurdiev.
    * Merged modified swigify patch from Dan Walsh 
      (original patch from Joshua Brindle).
    * Merged move genhomedircon call patch from Chad Sellers.


author: Dan Walsh <dwalsh@redhat.com> 1.3.59-1
changelog:
  - Add additional swig objects
    * Merged wrap char*** for user_get_roles patch from Joshua Brindle.
    * Merged remove defrole from sepol patch from Ivan Gyurdiev.
    * Merged swig wrappers for modifying users and seusers from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.61-1
changelog:
  - Upgrade to latest from NSA
    * Merged Makefile python definitions patch from Dan Walsh.
    * Removed is_selinux_mls_enabled() conditionals in seusers and users
      file parsers.


author: Dan Walsh <dwalsh@redhat.com> 1.3.63-1
changelog:
  - Upgrade to latest from NSA
    * Dropped handle from user_del_role interface.
    * Removed defrole interfaces.


author: Dan Walsh <dwalsh@redhat.com> 1.3.64-1
changelog:
  - Upgrade to latest from NSA
    * Changed semanage_handle_create() to set do_reload based on
      is_selinux_enabled().  This prevents improper attempts to
      load policy on a non-SELinux system.


author: Dan Walsh <dwalsh@redhat.com> 1.5.1-1
changelog:
  - Upgrade to latest from NSA
    * Added file-mode= setting to semanage.conf, default to 0644.
      Changed semanage_copy_file and callers to use this mode when
      installing policy files to runtime locations.


author: Dan Walsh <dwalsh@redhat.com> 1.5.1-2
changelog:
  - Upgrade to latest from NSA
    * Merged toggle modified flag in policydb_modify, fix memory leak
      in clear_obsolete, polymorphism vs headers fix, and include guards
      for internal headers patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.3-1
changelog:
  - Upgrade to latest from NSA
    * Merged further header cleanups from Ivan Gyurdiev.
    * Merged toggle modified flag in policydb_modify, fix memory leak
      in clear_obsolete, polymorphism vs headers fix, and include guards
      for internal headers patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.4-1
changelog:
  - Upgrade to latest from NSA
    * Merged patch series from Ivan Gyurdiev.
      This includes patches to:
      - separate file rw code from linked list
      - annotate objects
      - fold together internal headers
      - support ordering of records in compare function
      - add active dbase backend, active booleans
      - return commit numbers for ro database calls
      - use modified flags to skip rebuild whenever possible
      - enable port interfaces
      - update swig interfaces and typemaps
      - add an API for file_contexts.local and file_contexts
      - flip the traversal order in iterate/list
      - reorganize sandbox_expand
      - add seusers MLS validation
      - improve dbase spec/documentation
      - clone record on set/add/modify


author: Dan Walsh <dwalsh@redhat.com> 1.5.6-1
changelog:
  - Upgrade to latest from NSA
    * Clarified error messages from parse_module_headers and 
      parse_base_headers for base/module mismatches.
    * Merged string and file optimization patch from Russell Coker.
    * Merged swig header reordering patch from Ivan Gyurdiev.
    * Merged toggle modify on add patch from Ivan Gyurdiev.
    * Merged ports parser bugfix patch from Ivan Gyurdiev.
    * Merged fcontext swig patch from Ivan Gyurdiev.
    * Merged remove add/modify/delete for active booleans patch from Ivan Gyurdiev.
    * Merged man pages for dbase functions patch from Ivan Gyurdiev.
    * Merged pywrap tests patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.8-1
changelog:
  - Upgrade to latest from NSA
    * Re-applied string and file optimization patch from Russell Coker,
      with bug fix.
    * Reverted string and file optimization patch from Russell Coker.
    * Clarified error messages from parse_module_headers and 
      parse_base_headers for base/module mismatches.


author: Dan Walsh <dwalsh@redhat.com> 1.5.9-1
changelog:
  - Upgrade to latest from NSA
    * Merged const in APIs patch from Ivan Gyurdiev.
    * Merged validation of local file contexts patch from Ivan Gyurdiev.
    * Merged compare2 function patch from Ivan Gyurdiev.
    * Merged hidden def/proto update patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.14-1
changelog:
  - Upgrade to latest from NSA
    * Merged disallow port overlap patch from Ivan Gyurdiev.
    * Merged join prereq and implementation patches from Ivan Gyurdiev.
    * Merged join user extra data part 2 patch from Ivan Gyurdiev.
    * Merged bugfix patch from Ivan Gyurdiev.
    * Merged remove add_local/set_local patch from Ivan Gyurdiev.
    * Merged user extra data part 1 patch from Ivan Gyurdiev.
    * Merged size_t -> unsigned int patch from Ivan Gyurdiev.
    * Merged calloc check in semanage_store patch from Ivan Gyurdiev,
      bug noticed by Steve Grubb.
    * Merged cleanups after add/set removal patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.15-1
changelog:
  - Upgrade to latest from NSA
    * Merged pywrap Makefile diff from Dan Walsh.
    * Merged cache management patch from Ivan Gyurdiev.
    * Merged bugfix for dbase_llist_clear from Ivan Gyurdiev.
    * Merged remove apply_local function patch from Ivan Gyurdiev.
    * Merged only do read locking in direct case patch from Ivan Gyurdiev.
    * Merged cache error path memory leak fix from Ivan Gyurdiev.
    * Merged auto-generated file header patch from Ivan Gyurdiev.
    * Merged pywrap test update from Ivan Gyurdiev.
    * Merged hidden defs update from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.18-1
changelog:
  - Upgrade to latest from NSA
    * Merged seuser -> seuser_local rename patch from Ivan Gyurdiev.
    * Merged set_create_store, access_check, and is_connected interfaces
      from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.5.19-1
changelog:
  - Upgrade to latest from NSA
    * Merged fname parameter patch from Ivan Gyurdiev.
    * Merged more size_t -> unsigned int fixes from Ivan Gyurdiev.
    * Merged seusers.system patch from Ivan Gyurdiev.
    * Merged improve port/fcontext API patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.21-1
changelog:
  - Upgrade to latest from NSA
    * Merged seuser/user_extra support patch from Joshua Brindle.
    * Merged remote system dbase patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.23-1
changelog:
  - Upgrade to latest from NSA
    * Merged optionals in base patch from Joshua Brindle.
    * Merged treat seusers/users_extra as optional sections patch from
      Ivan Gyurdiev.
    * Merged parse_optional fixes from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.26-1
changelog:
  - Upgrade to latest from NSA
    * Merged paths array patch from Ivan Gyurdiev.
    * Merged bug fix patch from Ivan Gyurdiev.
    * Merged improve bindings patch from Ivan Gyurdiev.
    * Merged use PyList patch from Ivan Gyurdiev.  
    * Merged memory leak fix patch from Ivan Gyurdiev.
    * Merged nodecon support patch from Ivan Gyurdiev.
    * Merged cleanups patch from Ivan Gyurdiev.
    * Merged split swig patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.28-1
changelog:
  - Upgrade to latest from NSA
    * Merged bug fix for fcontext validate handler from Ivan Gyurdiev.
    * Merged base_merge_components changes from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.6-1
changelog:
  - Make work on RHEL4
  - Upgrade to latest from NSA
    * Merged abort early on merge errors patch from Ivan Gyurdiev.
    * Cleaned up error handling in semanage_split_fc based on a patch
      by Serge Hallyn (IBM) and suggestions by Ivan Gyurdiev.
    * Merged MLS handling fixes from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.2-1
changelog:
  - Upgrade to latest from NSA
    * Merged Makefile PYLIBVER definition patch from Dan Walsh.
    * Merged man page reorganization from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.3-1
changelog:
  - Fix to work with new version of swig
  - Upgrade to latest from NSA
    * Merged corrected fix for descriptor leak from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.6-1
changelog:
  - Upgrade to latest from NSA
    * Merged updated file context sorting patch from Christopher
      Ashworth, with bug fix for escaped character flag.
    * Merged file context sorting code from Christopher Ashworth 
      (Tresys Technology), based on fc_sort.c code in refpolicy.
    * Merged python binding t_output_helper removal patch from Dan Walsh.
    * Regenerated swig files.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.8-1
changelog:
  - Upgrade to latest from NSA
    * Updated default location for setfiles to /sbin to
      match policycoreutils.  This can also be adjusted via 
      semanage.conf using the syntax:
      [setfiles]
      path = /path/to/setfiles
      args = -q -c $@ $<
      [end]


author: Dan Walsh <dwalsh@redhat.com> - 1.6.9-1
changelog:
  - Upgrade to latest from NSA
    * Merged several fixes from Serge Hallyn:
         dbase_file_cache:  deref of uninit data on error path.
         dbase_policydb_cache:  clear fp to avoid double fclose
         semanage_fc_sort:  destroy temp on error paths


author: Dan Walsh <dwalsh@redhat.com> - 1.6.12-1
changelog:
  - Upgrade to latest from NSA
    * Merged support for read operations on read-only fs from 
      Caleb Case (Tresys Technology).


author: Dan Walsh <dwalsh@redhat.com> - 1.6.15-1
changelog:
  - Upgrade to latest from NSA
    * Merged separate local file contexts patch from Chris PeBenito.
    * Merged patch to make most copy errors non-fatal from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.16-1
changelog:
  - Upgrade to latest from NSA
    * Make most copy errors fatal, but allow exceptions for
      file_contexts.local, seusers, and netfilter_contexts if
      the source file does not exist in the store.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.17-1
changelog:
  - Upgrade to latest from NSA
    * Merged patch to skip reload if no active store exists and
      the store path doesn't match the active store path from Dan Walsh.
    * Merged patch to not destroy sepol handle on error path of
      connect from James Athey.
    * Merged patch to add genhomedircon path to semanage.conf from
      James Athey.


author: Dan Walsh <dwalsh@redhat.com> - 1.9.1-1
changelog:
  - Upgrade to latest from NSA
    * Merged patch to compile wit -fPIC instead of -fpic from
      Manoj Srivastava to prevent hitting the global offest table
      limit. Patch changed to include libselinux and libsemanage in
      addition to libsepol.


author: Dan Walsh <dwalsh@redhat.com> - 1.9.2-1
changelog:
  - Upgrade to latest from NSA
    * Merged patch to optionally reduce disk usage by removing 
      the backup module store and linked policy from Karl MacMillan
    * Merged patch to correctly propagate return values in libsemanage


author: Dan Walsh <dwalsh@redhat.com> - 1.10.1-1
changelog:
  - Upgrade to latest from NSA
    * Merged python binding fix from Dan Walsh.
    * Updated version for stable branch.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.0-1
changelog:
  - Upgrade to latest from NSA
    * Merged Makefile test target patch from Caleb Case.
    * Merged get_commit_number function rename patch from Caleb Case.
    * Merged strnlen -> strlen patch from Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.1-1
changelog:
  - Merged dbase_file_flush patch from Dan Walsh.
  - This removes any mention of specific tools (e.g. semanage)
  - from the comment header of the auto-generated files,
  - since there are multiple front-end tools.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.2-1
changelog:
  - Upgrade to latest from NSA
  - Merged optimizations from Stephen Smalley.
  -    do not set all booleans upon commit, only those whose values have changed
  -    only install the sandbox upon commit if something was rebuilt


author: Dan Walsh <dwalsh@redhat.com> - 2.0.3-1
changelog:
  - Upgrade to latest from NSA
    * Fix to libsemanage man patches so whatis will work better from Dan Walsh


author: Dan Walsh <dwalsh@redhat.com> - 2.0.4-1
changelog:
  - Upgrade to latest from NSA
    * Allow dontaudits to be turned off via semanage interface when
      updating policy


author: Dan Walsh <dwalsh@redhat.com> - 2.0.6-1
changelog:
  - Upgrade to latest from NSA
    * Change to use getpw* function calls to the _r versions from Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.9-1
changelog:
  - Upgrade to latest from NSA
    * Pass CFLAGS to CC even on link command, per Dennis Gilmore.
    * Clear errno on non-fatal errors to avoid reporting them upon a
      later error that does not set errno.
    * Improve reporting of system errors, e.g. full filesystem or read-only filesystem from Stephen Smalley.

  - Fix segfault in genhomedircon when using bad user names


author: Dan Walsh <dwalsh@redhat.com> - 2.0.10-1
changelog:
  - Upgrade to latest from NSA
    * Fix error checking on getpw*_r functions from Todd Miller.
    * Make genhomedircon skip invalid homedir contexts from Todd Miller.
    * Set default user and prefix from seusers from Dan Walsh.
    * Add swigify Makefile target from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.11-1
changelog:
  - Upgrade to latest from NSA
    * Fix ordering of file_contexts.homedirs from Todd Miller and Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.12-1
changelog:
  - Upgrade to latest from NSA
    * ustr cleanups from James Antill.
    * Ensure that /root gets labeled even if using the default context from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.14-1
changelog:
  - Upgrade to latest from NSA
    * Call rmdir() rather than remove() on directory removal so that errno isn't polluted from Stephen Smalley.
    * Allow handle_unknown in base to be overridden by semanage.conf from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.15-1
changelog:
  - Update to upstream
    * Fix genhomedircon handling of shells and missing user context template from Dan Walsh.
    * Copy the store path in semanage_select_store from Dan Walsh.
  - Add expand-check=0 to semanage.conf


author: Dan Walsh <dwalsh@redhat.com> - 2.0.16-1
changelog:
  - Update to upstream
    * Merged fix for genhomedircon handling of missing HOME_DIR or HOME_ROOT templates from Caleb Case.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.18-1
changelog:
  - Update to upstream
    * Fix spurious out of memory error reports.
    * Merged second version of fix for genhomedircon handling from Caleb Case.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.19-1
changelog:
  - Update to upstream
    * Fix genhomedircon to not override a file context with a homedir context from Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.20-1
changelog:
  - Update to upstream
    * Use sepol_set_expand_consume_base to reduce peak memory usage when
    using semodule


author: Dan Walsh <dwalsh@redhat.com> - 2.0.22-1
changelog:
  - Update to upstream
    * Free policydb before fork from Joshua Brindle.
    * Drop the base module immediately after expanding to permit memory re-use from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.23-1
changelog:
  - Update to upstream
    * Use vfork rather than fork for libsemanage helpers to reduce memory overhead as suggested by Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.25-1
changelog:
  - Update to upstream
    * Do not call genhomedircon if the policy was not rebuilt from Stephen Smalley.
      Fixes semanage boolean -D seg fault (bug 441379).


author: Dan Walsh <dwalsh@redhat.com> - 2.0.26-1
changelog:
  - Update to upstream
    * Fix bug in genhomedircon fcontext matches logic from Dan Walsh.
    Strip any trailing slash before appending /*$.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.27-1
changelog:
  - Update to upstream
    * Modify genhomedircon to skip groupname entries.
    Ultimately we need to expand them to the list of users to support per-role homedir labeling when using the groupname syntax.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.28-1
changelog:
  - Update to upstream
    * allow fcontext and seuser changes without rebuilding the policy from Dan Walsh


author: Dan Walsh <dwalsh@redhat.com> - 2.0.31-1
changelog:
  - Update to upstream
    * Policy module compression (bzip) support from Dan Walsh.
    * Hard link files between tmp/active/previous from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.35-1
changelog:
  - Revert hard linking of files between tmp/active/previous.
  - Enable configuration of bzip behavior from Stephen Smalley.
  -   bzip-blocksize=0 to disable compression and decompression support.
  -   bzip-blocksize=1..9 to set the blocksize for compression.
  -   bzip-small=true to reduce memory usage for decompression.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.36-1
changelog:
  - Update to upstream
    * Changed bzip-blocksize=0 handling to support existing compressed
    modules in the store.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.37-1
changelog:
  - Update to upstream
    * Fix persistent dontaudit support to rebuild policy if the 
          dontaudit state is changed from Chad Sellers.
  - Move load_policy to /sbin


author: Dan Walsh <dwalsh@redhat.com> - 2.0.38-1
changelog:
  - Update to upstream
    * Change semodule upgrade behavior to install even if the module
      is not present from Dan Walsh.
    * Make genhomedircon trim excess '/' from homedirs from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.41-1
changelog:
  - Update to upstream
    * Add pkgconfig file from Eamon Walsh.
    * Add semanage_set_check_contexts() function to disable calling
    setfiles


author: Dan Walsh <dwalsh@redhat.com> - 2.0.43-1
changelog:
  - Update to upstream
    * Move libsemanage.so to /usr/lib
    * Add NAME lines to man pages from Manoj Srivastava<srivasta@debian.org>


author: Dan Walsh <dwalsh@redhat.com> - 2.0.44-1
changelog:
  - Update to upstream
  	* Replace usage of fmemopen() with sepol_policy_file_set_mem() since
  	  glibc < 2.9 does not support binary mode ('b') for fmemopen'd
  	  streams.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.45-1
changelog:
  - Update to upstream
  	* Add enable/disable patch support from Dan Walsh.
  	* Add usepasswd flag to semanage.conf to disable genhomedircon using
  	  passwd from Dan Walsh.
  	* regenerate swig wrappers


author: David Malcolm <dmalcolm@redhat.com> - 2.0.46-2
changelog:
  - big reworking of the support-multiple-python-builds patch to deal with
  PEP 3149: the latest Python 3.2 onwards uses include paths and library names
  that don't fit prior naming patterns, and so we must query python3-config for
  this information.  To complicate things further, python 2's python-config
  doesn't understand all of the options needed ("--extension-suffix").  I've
  thus added new Makefile variables as needed, to be supplied by the specfile by
  invoking the appropriate config tool (or by hardcoding the old value for
  "--extension-suffix" i.e. ".so")
  - rework python3 manifest for PEP 3149, and rebuild for newer python3


author: Dan Walsh <dwalsh@redhat.com> - 2.0.46-5
changelog:
  - Change libsemanage mechanism for handling disabled modules. Now it will only create a flag for a module 
  indicating the module is disabled.  MODULE.pp.disabled, it will no longer rename the module.  This way we can
  ship active modules in rpm.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.2-1
changelog:
  -Update to upstream
  2.1.2 2011-08-17
  	* print error debug info for buggy fc
  	* introduce semanage_set_root and friends
  	* throw exceptions in python rather than return
  	* python3 support.
  	* patch for MCS/MLS in user files

  2.1.1 2011-08-01
  	* Remove generated files, expand .gitignore
  	* Use -Werror and change a few prototypes to support it


author: Dan Walsh <dwalsh@redhat.com> - 2.1.4-1
changelog:
  -Update to upstream
  	* Create a new preserve_tunables flag
  	* tree: default make target to all not
  	* fix semanage_store_access_check calling arguments


author: Dan Walsh <dwalsh@redhat.com> - 2.1.5-1
changelog:
  - Upgrade to upstream
  	* regenerate .pc on VERSION change
  	* maintain mode even if umask is tighter
  	* semanage.conf man page
  	* create man5dir if not exist


author: Dan Walsh <dwalsh@redhat.com> - 2.1.6-1
changelog:
  -Update to upstream
  	* add ignoredirs config for genhomedircon
  	* Fallback_user_level can be NULL if you are not using MLS


author: Dan Walsh <dwalsh@redhat.com> - 2.1.7-1
changelog:
  - Update to upstream 
  	* Alternate path for semanage.conf
  	* do not link against libpython, this is considered bad in Debian
  	* Allow to build for several ruby version
  	* fallback-user-level


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-1
changelog:
  - Update to upstream 
  	* remove build warning when build swig c files
  	* additional makefile support for rubywrap
  	* ignore 80 column limit for readability
  	* semanage_store: fix snprintf length argument by using asprintf
  	* Use default semanage.conf as a fallback
  	* use after free in python bindings


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-3
changelog:
  - Attempt to allocate memory for selinux_binary_policy_path and free memory 
  - allocated by asprintf.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.9-1
changelog:
  - Update to upstream 
  	* libsemanage: do not set soname needlessly
  	* libsemanage: remove PYTHONLIBDIR and ruby equivalent
  	* do boolean name substitution
  	* Fix segfault for building standard policies.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.9-2
changelog:
  - Fix handling of missing semanage permissive -d foo, not failing correctly
  - Previous to this fix the first module beginning with foo would get deleted.


author: Dan Walsh <dwalsh@redhat.com> 2.1.9-3
changelog:
  - Update to latest patches from eparis/Upstream
  -    libsemanage: fixes from coverity
  -    libsemange: redo genhomedircon minuid


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-1
changelog:
  - Update to upstream 
  	* Add sefcontext_compile to compile regex everytime policy is rebuilt
  	* Cleanup/fix enable/disable/remove module.
  	* redo genhomedircon minuid
  	* fixes from coverity
  	* semanage_store: do not leak memory in semanage_exec_prog
  	* genhomedircon: remove useless conditional in get_home_dirs
  	* genhomedircon: double free in get_home_dirs
  	* fcontext_record: do not leak on error in semanage_fcontext_key_create
  	* genhomedircon: do not leak on failure in write_gen_home_dir_context
  	* semanage_store: do not leak fd 
  	* genhomedircon: do not leak shells list
  	* semanage_store: do not leak on strdup failure 
  	* semanage_store: rewrite for readability


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-6
changelog:
  - Remove dependance on selinux-policy, /etc/selinux should be owned by libsemanage, and selinux-policy can require it.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-7
changelog:
  - Move handling of role audit records into the library
  - Patch stops semanage from removing user record while in use


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-10
changelog:
  - Do not write error message to screen when looking for previous record for auditing.
  - Add mls_range from user record if the MLS range is not specified by the seuser add record.
  - Error out if seuser or mls range is not specified when adding user records


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-14
changelog:
  - Cleanup handling of missing mls_range to fix problems with useradd -Z
  - Fix auditing of login record changes, roles were not working correctly.
  Resolves: #952237


author: Dan Walsh <dwalsh@redhat.com> - 2.2-1
changelog:
  - Update to upstream 
  	* Avoid duplicate list entries from Dan Walsh.
  	* Add audit support to libsemanage from Dan Walsh.
  	* Remove policy.kern and replace with symlink from Dan Walsh.
  	* Apply a MAX_UID check for genhomedircon from Laurent Bigonville.
  	* Fix man pages from Laurent Bigonville.


author: Petr Lautrbach <plautrba@redhat.com> 2.4-2
changelog:
  - semanage_migrate_store: use /usr/bin/python3
  - move semanage_migrate_store script to libsemanage-python3


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-5
changelog:
  - Sort object files for deterministic linking order
  - Support overriding Makefile RANLIB
  - Respect CC and PKG_CONFIG environment variable


author: Petr Lautrbach <plautrba@redhat.com> 2.5-8
changelog:
  - Fixes bug preventing the installation of base modules
  - make distclean target work
  - Do not always print a module name warning
  - Use pp module name instead of filename when installing module
  - tests: Do not force using gcc
  - genhomedircon: remove hardcoded refpolicy strings
  - genhomedircon: add support for %group syntax
  - genhomedircon: generate contexts for logins mapped to the default user
  - Validate and compile file contexts before installing
  - Swap tcp and udp protocol numbers


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-1
changelog:
  - Update to upstream release 2017-08-04
  - Use 'sefcontext_compile -r' when it's run during SELinux policy build


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.7-2
changelog:
  - Python 2 binary package renamed to python2-libsemanage
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
  - Python 3 binary package renamed to python3-libsemanage


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-10
changelog:
  - properly check return value of iterate function
  - Use umask(0077) for fopen() write operations
  - Return commit number if save-previous false
  - Allow tmp files to be kept if a compile fails
  - build: follow standard semantics for DESTDIR and PREFIX
  - Improve warning for installing disabled module
  - silence clang static analyzer report
  - remove access() check to make setuid programs work


author: Petr Lautrbach <lautrbach@redhat.com> - 2.9-11
changelog:
  - Set new restorecon handle before doing restorecon (RHEL-73348)
  - Mute error messages from selinux_restorecon


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-5
changelog:
  - cil: Create new keep field for type attribute sets
  - build: follow standard semantics for DESTDIR and PREFIX
  - cil: show an error when cil_expr_to_string() fails


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-6
changelog:
  - Prevent freeing unitialized value in ibendport handling
  - Add support for the SCTP portcon keyword
  - Export sepol_polcap_getnum/name functions


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-3
changelog:
  - cil: Fix out-of-bound read of file context pattern ending with "\"
  - cil: Destroy classperms list when resetting classpermission (#1983517)
  - cil: Destroy classperm list when resetting map perms (#1983521)
  - cil: cil_reset_classperms_set() should not reset classpermission (#1983525)
  - cil: Set class field to NULL when resetting struct cil_classperms
  - cil: More strict verification of constraint leaf expressions
  - cil: Exit with an error if declaration name is a reserved word
  - cil: Allow permission expressions when using map classes
  - cil: Reorder checks for invalid rules when building AST
  - cil: Cleanup build AST helper functions
  - cil: Create new first child helper function for building AST
  - cil: Remove unused field from struct cil_args_resolve
  - cil: Destroy disabled optional blocks after pass is complete
  - cil: Check if name is a macro parameter first
  - cil: fix NULL pointer dereference in __cil_insert_name
  - cil: Report disabling an optional block only at high verbose levels
  - cil: Use AST to track blocks and optionals when resolving
  - cil: Reorder checks for invalid rules when resolving AST
  - cil: Sync checks for invalid rules in booleanifs
  - cil: Check for statements not allowed in optional blocks (#1983530)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10
changelog:
  - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function
    i2alaw_array in alaw (#1673085)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-11
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985028)


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.17-1
changelog:
  - Update to 0.7.17
  - selected bug fixes:
    * repo_write: fix handling of nested flexarray
    * improve choicerule generation a bit more to cover more cases
    * harden testcase parser against repos being added too late
    * support python-3.10
    * check /var/lib/rpm macro in rpmdb code
  - new features:
    * handle default/visible/langonly attributes in comps parser
    * support multiple collections in updateinfo parser
    * add '-D' option in rpmdb2solv to set the dbpath


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.19-1
changelog:
  - Update to 0.7.19
  - repo_add_conda: add flag to skip v2 packages
  - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt
  - fix error handling in solv_xfopen_fd()
  - fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.20-5
changelog:
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Rex Dieter <rdieter@fedoraproject.org> - 0.2.8-5
changelog:
  - BR: libgs-devel (f28+)
  - .spec cleanup/cosmetics (drop deprecated tags, use %autosetup/%license, tighten subpkg dep)


author: David Tardon <dtardon@redhat.com> - 0.0.3-3
changelog:
  - Resolves: rhbz#1458800 CVE-2017-9432 Stack-buffer overflow in the
    StarWriterStruct::DatabaseName::read


author: Tony Asleson <tasleson@redhat.com> - 1.9.1-7
changelog:
  - Remove valgrind dependency as not being used and causing
    build to fail as it pulls in python3.11


author: Kamil Dudka <kdudka@redhat.com> - 1.2.20-16
changelog:
  - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646)
  - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644)


author: Xin Long <lxin@redhat.com> - 1.29-1
changelog:
  - man teamd.conf: update some parameter default values [1732587]
  - 1.29 release
  - teamd: add port_master_ifindex_changed for link_watch_port_watch_ops
  - initscripts: fix if/fi align
  - teamd: fix a json object memleak in get_port_obj() [1767685]
  - libteam: set netlink event socket as non-blocking [1684389]
  - libteam: double NETLINK_RCVBUF to fix -ENOMEM error
  - teamd: add a default value 1000 for link_watch.interval


author: Xin Long <lxin@redhat.com> - 1.29-2
changelog:
  - teamd/lacp: fix segfault due to NULL pointer dereference [1758073]
  - teamd: fix build error in expansion of macro teamd_log_dbgx [1758073]
  - teamd: update ctx->hwaddr after setting team dev to new hwaddr
  - libteam: wapper teamd_log_dbg with teamd_log_dbgx [1758073]


author: Xin Long <lxin@redhat.com> - 1.31-1
changelog:
  - 1.31 release
  - utils/bond2team: remove TYPE in ifcfg file [1858518]
  - utils/bond2team: keep delivering config to file if stdout not supplied [1858518]
  - teamd/lacp: silence ignore none LACP frames
  - Send LACP PDU right after the Actor state has been changed
  - Skip setting the same hwaddr to a lag port if not needed
  - Make all netlink socket RCVBUF sizes configurable
  - Don't return an error when timerfd socket return 0
  - Fix ifinfo_link_with_port race condition with newlink
  - teamd: fix possible race in master ifname callback
  - 1.30 release
  - teamd: Disregard current state when considering port enablement [1851460]


author: Xin Long <lxin@redhat.com> - 1.31-4
changelog:
  - teamd: do no remove the ports on shutdown with -N [2148856]
  - teamd: stop iterating callbacks when a loop restart is requested [2148855]


author: Daiki Ueno <dueno@redhat.com> - 0.1.24-1
changelog:
  - Update to 0.1.24
  - Apply patch from upstream, which fixes scim-thai FTBFS with GCC6 (Closes: #1308117)


author: Matej Mužila <mmuzila@redhat.com> - 4.0.9-23
changelog:
  - Fix various CVEs
  - Resolves: CVE-2022-0561 CVE-2022-0562 CVE-2022-22844 CVE-2022-0865
    CVE-2022-0891 CVE-2022-0924 CVE-2022-0909 CVE-2022-0908 CVE-2022-1355


author: Matej Mužila <mmuzila@redhat.com> - 4.0.9-29
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
  - Resolves: RHEL-4683 RHEL-4685 RHEL-4686 RHEL-4687 RHEL-4688


author: Ondrej Sloup <osloup@redhat.com> - 4.0.9-30
changelog:
  - Bump specfile to retrigger gating
  - Add tests folder for standard beakerlib
  - Related: RHEL-4683 RHEL-4685 RHEL-4686 RHEL-4687 RHEL-4688


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - enable zip and jpeg codecs
  - change defattr in normal package to 0755
  - add defattr to -devel package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move man pages from devel package to the regular one
  - integrate Frank Warmerdam's fixed .fax handling code (keep until next release
    of libtiff)
  - fix fax2ps breakage (bug #8345)


author: Phil Knirsch <phil@redhat.de>
changelog:
  - Fixed ia64 problem with tiffinfo. Was general 64 bit arch problem where s390x
    and ia64 were missing (#52129).


author: Matthias Clasen <mclasen@redhat.com> - 3.7.1-3
changelog:
  - Drop the largefile patch again
  - Fix a problem with the handling of alpha channels
  - Fix an integer overflow in tiffdump (#143576)


author: Matthias Saou <http://freshrpms.net/> 3.7.4-2
changelog:
  - Remove useless explicit dependencies.
  - Minor spec file cleanups.
  - Move make check to %check.
  - Add _smp_mflags.


author: Matthias Clasen <mclasen@redhat.com>
changelog:
  - Fix several vulnerabilities (CVE-2006-3460 CVE-2006-3461
    CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465)


author: Jindrich Novy <jnovy@redhat.com> - 3.8.2-6
changelog:
  - fix CVE-2006-2193, tiff2pdf buffer overflow (#194362)
  - fix typo in man page for tiffset (#186297)
  - use %{?dist}


author: Tom Lane <tgl@redhat.com> 3.8.2-8
changelog:
  - Restore static library to distribution, in a separate -static subpackage
  Resolves: #219905
  - Don't apply multilib header hack to unrecognized architectures
  Resolves: #233091
  - Remove documentation for programs we don't ship
  Resolves: #205079
  Related: #185145


author: Tom Lane <tgl@redhat.com> 3.8.2-11
changelog:
  - Fix LZW decoding vulnerabilities (CVE-2008-2327)
  Related: #458674
  - Use -fno-strict-aliasing per rpmdiff recommendation


author: Tom Lane <tgl@redhat.com> 3.9.2-1
changelog:
  - Update to libtiff 3.9.2; stop carrying a lot of old patches
  Resolves: #520734
  - Split command-line tools into libtiff-tools subpackage
  Resolves: #515170
  - Use build system's libtool instead of what package contains;
    among other cleanup this gets rid of unwanted rpath specs in executables
  Related: #226049


author: Tom Lane <tgl@redhat.com> 3.9.2-3
changelog:
  - Apply Adam Goode's fix for Warmerdam's fix
  Resolves: #552360
  Resolves: #533353
  - Add some defenses to prevent tiffcmp from crashing on downsampled JPEG
    images; this isn't enough to make it really work correctly though
  Related: #460322


author: Tom Lane <tgl@redhat.com> 3.9.4-1
changelog:
  - Update to libtiff 3.9.4, for numerous bug fixes including fixes for
    CVE-2010-1411, CVE-2010-2065, CVE-2010-2067
  Resolves: #554371
  Related: #460653, #588784, #601274, #599576, #592361, #603024
  - Add fixes for multiple SIGSEGV problems
  Resolves: #583081
  Related: #603081, #603699, #603703


author: Tom Lane <tgl@redhat.com> 3.9.4-3
changelog:
  - Add patch for CVE-2011-0192
  Resolves: #681672
  - Fix non-security-critical potential SIGSEGV in gif2tiff
  Related: #648820


author: Tom Lane <tgl@redhat.com> 3.9.4-4
changelog:
  - Fix incorrect fix for CVE-2011-0192
  Resolves: #684007
  Related: #688825
  - Add fix for CVE-2011-1167
  Resolves: #689574


author: Tom Lane <tgl@redhat.com> 3.9.5-1
changelog:
  - Update to libtiff 3.9.5, incorporating all our previous patches plus other
    fixes, notably the fix for CVE-2009-5022
  Related: #695885


author: Tom Lane <tgl@redhat.com> 4.0.1-1
changelog:
  - Update to libtiff 4.0.1, adds BigTIFF support and other features;
    library soname is bumped from libtiff.so.3 to libtiff.so.5
  Resolves: #782383
  - Temporarily package 3.9.5 shared library (only) in libtiff-compat subpackage
    so that dependent packages won't be broken while rebuilding proceeds


author: Tom Lane <tgl@redhat.com> 4.0.2-1
changelog:
  - Update to libtiff 4.0.2, includes fix for CVE-2012-2113
    (note that CVE-2012-2088 does not apply to 4.0.x)
  - Update libtiff-compat to 3.9.6 and add patches to it for
    CVE-2012-2088, CVE-2012-2113
  Resolves: #832866


author: Tom Lane <tgl@redhat.com> 4.0.2-5
changelog:
  - Add accessor functions for opaque type TIFFField (backport of not-yet-released
    upstream feature addition; needed to fix freeimage)


author: Tom Lane <tgl@redhat.com> 4.0.2-6
changelog:
  - Remove compat subpackage; no longer needed
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: Tom Lane <tgl@redhat.com> 4.0.3-2
changelog:
  - Add upstream patches for CVE-2012-4447, CVE-2012-4564
    (note: CVE-2012-5581 is already fixed in 4.0.3)
  Resolves: #880907


author: Nikola Forró <nforro@redhat.com> - 4.0.9-19
changelog:
  - Fix CVE-2020-35521 (#1945539)
  - Fix CVE-2020-35522 (#1945555)
  - Fix CVE-2020-35523 (#1945542)
  - Fix CVE-2020-35524 (#1945546)


author: Matej Mužila <mmuzila@redhat.com> - 4.0.9-32
changelog:
  - Fix CVE-2023-6228 CVE-2023-52356 CVE-2023-25433 CVE-2018-15209
  - Resolves: RHEL-30682 RHEL-30520 RHEL-30474 RHEL-5406


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.0-14
changelog:
  - iscsi: CHAP auth algorithm selection fixes (#2188991)
  - tests: Use stronger passphrases for LUKS tests
  - lvm2: Improve uevent processing (#2039772)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.0-16
changelog:
  - iscsi: Fix login on firmware-discovered nodes (#2213193)
  - tests: Extend iscsi method call timeouts (#2213715)


author: Robert Scheck <robert@fedoraproject.org> 0.9.12-15
changelog:
  - Added patch to avoid a /usr/@DATADIRNAME@/locale/ directory
  - Use %{_udevrulesdir} macro rather /etc/udev/rules.d/ (#1226681)


author: Jeff Moyer <jmoyer@redhat.com> - 1.0.7-2.el8
changelog:
  - Fix versioning.  The installed library is 1.0.7, make the rpm match.
  - bump release number for build, which includes -fPIC fix
  - Related: rhbz#1862551


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1.1.11-32
changelog:
  - FTBFS: <sys/sysmacros.h> included where "major" and "minor" macros are in use
    (cdrkit-1.1.11-sysmacros.patch added)
  - https://bugzilla.redhat.com/show_bug.cgi?id=1263599 - man page clarified
    (cdrkit-1.1.11-manpagefix.patch modified)


author: Petr Pisar <ppisar@redhat.com> - 1.1.11-35
changelog:
  - perl dependency renamed to perl-interpreter
    <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-16
changelog:
  - Use 2048bit keys in tests
  - Resolves: rhbz#1611729 - [RHEL8-S-BUILD] libuser Fails Scratch Build on rhel-8.0


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-17
changelog:
  - Resolves: rhbz#1558151 - libuser needs audit events around the account
                             lifecycle


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-19
changelog:
  - Resolves: rhbz#1602600 -  Please review important issues found by covscan
                              in "libuser-0.62-14.el8+7" package


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-20
changelog:
  - Resolves: rhbz#1637398 - libuser-python3 should be renamed to comply
                             with Packaging Guidelines


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-23
changelog:
  - Actually apply the patch from the previous build
  - Resolves: rhbz#1670997 - Amend the user lifecycle auditing


author: Björn Esser <bjoern.esser@gmail.com> - 2.0.1-5
changelog:
  - Introduce doc-subpackage
  - Use unified %_pkgdocdir
  - Updated Patch0 and use on el <= 6, only
  - Rename Patch0 --> Patch 1000
  - Clean-up indentation


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.1.6-14
changelog:
  - build with hardening LDFLAGS (#1548717)
  - remove obsolete macro and comments
  - add gcc to build requirements


author: Stephen Gallagher <sgallagh@redhat.com> - 0.9.3-0.2.git09b0222
changelog:
  - Fixes from package review
  - Removed doubly-listed include directory
  - Update git tarball to the latest upstream code


author: Stephen Gallagher <sgallagh@redhat.com> - 1:0.9.4-4.gitdc559a5
changelog:
  - Bump epoch for the version downgrade
  - The 0.9.7 version hit the Rawhide repo due to the mass rebuild, we need a
    clean upgrade path.


author: T.C. Hollingsworth <tchollingsworth@gmail.com> - 1:0.10.0-2.git5462dab
changelog:
  - drop the patchlevel from the SONAME since libuv will retain binary
    compatibility for the life of the 0.10.x series


author: Stephen Gallagher <sgallagh@redhat.com> - 1:0.10.5-2
changelog:
  - Add patch to properly report soname version information
    This patch will be included upstream in 0.10.6 and can be dropped then.
  - Remove Bundles(ev) as this has not been true since 0.9.5


author: T.C. Hollingsworth <tchollingsworth@gmail.com> - 1:0.10.5-3
changelog:
  - don't sed the soname in the spec anymore; the patch takes care of it now
  - drop leftover global define for git revision


author: T.C. Hollingsworth <tchollingsworth@gmail.com> - 1:0.10.33-1
changelog:
  - new upstream release 0.10.33
    https://github.com/joyent/libuv/blob/v0.10.33/ChangeLog
  - update URL to point to the new libuv.org


author: T.C. Hollingsworth <tchollingsworth@gmail.com> - 1:0.10.33-2
changelog:
  - add missing %{_?isa} to devel requires of main package
  - fix some issues with the pkgconfig file and Group reported by Michael Schwendt


author: Harald Hoyer <harald@redhat.com> - 16-1
changelog:
  - libvarlink 16
  - fixed coverity issues
  - Resolves: #1638294 - Interface name validation rule update


author: Fabiano Fidêncio <fidencio@redhat.com> 3.0.0-1
changelog:
  - Update to 3.0.0 release
  - Resolves: rhbz#1754396 - Provide support for getting "firmwares" info from Domain Capabilities
  - Resolves: rhbz#1753670 - Enable bochs-display for UEFI guests (libvirt-glib)


author: David Tardon <dtardon@redhat.com> - 0.1.5-5
changelog:
  - fix char background color in some cases
  - fix handling of bitmaps in Windows Bitmap format that contain a color
    palette


author: Petr Pisar <ppisar@redhat.com> - 0.9.11-9
changelog:
  - Fix CVE-2018-15127 (Heap out-of-bounds write in
    rfbserver.c:rfbProcessFileTransferReadBuffer()) (bug #1662997)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 0.9.11-16
changelog:
  - Fix CVE-2019-20839
    Resolves: #1851032
  - Fix CVE-2018-21247
    Resolves: #1852516
  - Fix CVE-2020-14405
    Resolves: #1860527
  - Fix CVE-2020-14397
    Resolves: #1861152


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.8-6
changelog:
  - Python 2 binary package renamed to python2-libvoikko
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Mike FABIAN <mfabian@redhat.com> - 4.1.1-1
changelog:
  - Rebase to 4.1.1 from Fedora 29 (provides only python3-libvoikko,
    removes python2-libvoikko)
  - Resolves: rhbz#1636062


author: Mike FABIAN <mfabian@redhat.com> - 4.1.1-2
changelog:
  - Fix man file names for Flatpak builds, exclude __pycache__ files from Flatpak builds
  - Resolves: rhbz#1896322


author: David King <amigadave@amigadave.com> - 1.3.5-1
changelog:
  - Update to 1.3.5 (#1197923)
  - Use license macro for COPYING
  - Tighten subpackage dependencies
  - Use make_install and make_build macros
  - Use pkgconfig for BuildRequires
  - Remove unnecessary Requires from devel subpackage
  - Remove obsolete Obsoletes


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
changelog:
  - Fix for CVE-2019-9232, CVE-2019-9433, CVE-2019-9371, CVE-2019-2126
  - Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
  - Remove php-cli BR


author: Tom "spot" Callaway <tcallawa@redhat.com> 0.9.0-2
changelog:
  - fix permissions on binaries
  - rename generic binaries to v8_*
  - link shared library to -lm, -lpthread to resolve missing weak symbols


author: Tom "spot" Callaway <tcallawa@redhat.com> 0.9.0-7
changelog:
  - update to git revision 8389f1967c5f8b3819cca80705b1b4ba04132b93
  - upstream fix for bz 599147
  - proper shared library support


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-11
changelog:
  - Add patch to fix integer overflows.
  - Fix compilation by including limits.h
  - Resolves: RHEL-40650


author: Tomas Popela <tpopela@redhat.com> - 1.0.0-8
changelog:
  - Add fix for mzbz#1819244
  - Fix tools subpackage dependency
  - Bump the release to "8" to accommodate the 8.7.0.z release bumps


author: Tomas Popela <tpopela@redhat.com> - 1.0.0-9
changelog:
  - Bump the release to "9" to accommodate the 9.1.0.z release bumps as
    libwebp-1.0.0-8.el9 < libwebp-1.0.0-8.el8_7


author: Caolán McNamara <caolanm@redhat.com> - 0.2.9-1
changelog:
  - Resolves: rhbz#1602602 new version with covscan warnings fixed
  - all cve fixes merged to that new upstream


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.5-3
changelog:
  - Fix wrong SSL_CTX_set_cipher_list() retval check
  - Explicitly disable build of java bindings (build fails if java-devel is installed)


author: Björn Esser <besser82@fedoraproject.org> - 4.0.1-5
changelog:
  - Add patch to update to recent development branch
  - Re-enable SUNMD5 support as it is BSD licensed now
  - Build compatibility symbols for glibc only
  - Skip failing testsuite once


author: Daniel Veillard <veillard@redhat.com> 2.6.27-1
changelog:
  - upstream release 2.6.27 see http://xmlsoft.org/news.html
  - very large amount of bug fixes reported upstream


author: Daniel Veillard <veillard@redhat.com> 2.7.0-1.fc10
changelog:
  - upstream release of 2.7.0
  - switch to XML 1.0 5th edition
  - switch to RFC 3986 for URI parsing
  - better entity handling
  - option to remove hardcoded limitations in the parser
  - more testing
  - a new API to allocate entity nodes
  - and lot of fixes and clanups


author: Daniel Veillard <veillard@redhat.com> 2.7.2-1.fc10
changelog:
  - new release 2.7.2
  - Fixes the known problems in 2.7.1
  - increase the set of options when saving documents


author: Daniel Veillard <veillard@redhat.com> - 2.7.3-1
changelog:
  - new release 2.7.3
  - limit default max size of text nodes
  - special parser mode for PHP
  - bug fixes and more compiler checks


author: Daniel Veillard <veillard@redhat.com> - 2.7.4-1
changelog:
  - upstream release 2.7.4
  - symbol versioning of libxml2 shared libs
  - very large number of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.7-1
changelog:
  - Upstream release of 2.7.7
  - fix serious trouble with zlib >= 1.2.4
  - xmllint new option --xpath
  - various HTML parser improvements
  - includes a number of nug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.8-1
changelog:
  - Upstream release of 2.7.8
  - various bug fixes, including potential crashes
  - new non-destructive formatting option
  - date parsing updated to RFC 5646


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-0rc1
changelog:
  - upstream release candidate 1 of 2.9.0
  - introduce a small API change, but ABI compatible, see
    https://mail.gnome.org/archives/xml/2012-August/msg00005.html
    patches for php, gcc/libjava and evolution-data-connector are upstream
    Grab me in cases of problems veillard@redhat.com
  - many bug fixes including security aspects and small improvements


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-1
changelog:
  - upstream release of 2.9.0
  - A few new API entry points
  - More resilient push parser mode
  - A lot of portability improvement
  - Faster XPath evaluation
  - a lot of bug fixes and smaller improvement


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-2
changelog:
  - remaining cleanups from merge bug rhbz#226079
  - do not put the docs in the main package, only in -devel rhbz#864731


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-1
changelog:
  - upstream release of 2.9.1
  - a couple more API entry point
  - compatibility with python3
  - a lot of bug fixes


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.9.2-8
changelog:
  - Remove executable permissions from documentation.  Complies with packaging
    guidelines and solves issue of libxml2-python3 package depending on python2


author: Daniel Veillard <veillard@redhat.com> - 2.9.2-1
changelog:
  - upstream release of 2.9.3
  - Fixes for CVE-2015-8035, CVE-2015-7942, CVE-2015-7941, CVE-2015-1819
    CVE-2015-7497, CVE-2015-7498, CVE-2015-5312, CVE-2015-7499, CVE-2015-7500
    and CVE-2015-8242
  - many other bug fixes


author: Kevin Fenzi <kevin@scrye.com> - 2.9.4-1
changelog:
  - Update to 2.9.4.
  - Apply very hacky patch that removes the no longer in python-3.6 PyVerify_fd symbol.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.9.4-5
changelog:
  - Python 2 binary package renamed to python2-libxml2
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: David King <dking@redhat.com> - 2.9.7-10
changelog:
  - Fix CVE-2021-3516 (#1956976)
  - Fix CVE-2021-3517 (#1957001)
  - Fix CVE-2021-3518 (#1957028)
  - Fix CVE-2021-3537 (#1957284)


author: David King <dking@redhat.com> - 2.9.7-21.1
changelog:
  - Fix CVE-2025-6021 (RHEL-96498)
  - Fix CVE-2025-49794 (RHEL-96398)
  - Fix CVE-2025-49796 (RHEL-96424)


author: Tomas Korbar <tkorbar@redhat.com> - 0.16.105-1
changelog:
  - Change specfile accordingly to mosvald's review
  - Remove obsolete ldconfig scriptlets
  - libyang-devel-doc changed to noarch package
  - Add python_provide macro to python3-libyang subpackage
  - Remove obsolete Requires from libyang-cpp-devel
  - Start using cmake with smp_mflags macro


author: Michal Ruprich <mruprich@redhat.com> - 0.16.105-4
changelog:
  - Resolves: #1780311 - CVE-2019-19333 libyang: stack-based buffer overflow in make_canonical when bits leaf type is used
  - Resolves: #1780313 - CVE-2019-19334 libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used


author: Aaron Conole <aconole@redhat.com> - 1.0.1-14.git036e314
changelog:
  - Update to branch-1.1 compatibility
  - Fixes to avoid assert in the agent state machine
  - Remove the memory constraint on the event socket buffer (#1554110)


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.0.4-0.27.20111007git
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
  - Explicitly include <sys/sysmacros.h> due to glibc-headers changes.
  Definition of major and minor macros is no longer transitively included
  through <sys/types.h>, hence make it explicit.
  Ref:
  https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=NEWS;hb=HEAD


author: Brian C. Lane <bcl@redhat.com> 27.0-1
changelog:
  - Bump version to 27.0 (bcl@redhat.com)
  - Try all packages when installpkg --optional is used. (bcl@redhat.com)
  - Add support for aarch64 live images (bcl@redhat.com)
  - pylint: Ignore different argument lengths for dnf callback. (bcl@redhat.com)
  - Adds additional callbacks keyword for start() (jmracek@redhat.com)
  - Add ppc64-diag for Power64 platforms (pbrobinson@gmail.com)
  - livemedia-creator: Add release license files to / of the iso (bcl@redhat.com)
  - lorax: Add release license files to / of the iso (bcl@redhat.com)
  - INSTALL_ROOT and LIVE_ROOT are not available during %post (bcl@redhat.com)
  - Add --noverifyssl to lorax (#1430483) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 27.2-1
changelog:
  - Remove filegraft from arm.tmpl (#1457906) (bcl@redhat.com)
  - Use anaconda-core to detect buildarch (sgallagh@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 27.5-1
changelog:
  - runtime-cleanup: preserve a couple more gstreamer libs (awilliam@redhat.com)
  - perl is needed on all arches now (dennis@ausil.us)


author: Brian C. Lane <bcl@redhat.com> 27.6-1
changelog:
  - Add creation of a bootable s390 iso (#1478448) (bcl@redhat.com)
  - Add mk-s360-cdboot utility (#1478448) (bcl@redhat.com)
  - Fix systemctl command (#1478247) (bcl@redhat.com)
  - Add version output (#1335456) (bcl@redhat.com)
  - Include the dracut fips module in the initrd (#1341280) (bcl@redhat.com)
  - Make sure loop device is setup (#1462150) (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 27.7-1
changelog:
  - Make 64-bit kernel on 32-bit firmware work for x86 efi machines (pjones@redhat.com)
  - Don't install rdma bits on 32-bit ARM (#1483278) (awilliam@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 27.9-1
changelog:
  - x86.tmpl: initially define compressargs as empty string (awilliam@redhat.com)
  - x86.tmpl: ensure efiarch64 is defined (awilliam@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 27.11-1
changelog:
  - s390 doesn't need to graft product.img and updates.img into /images (#1496461) (bcl@redhat.com)
  - distribute the mk-s390-cdboot utility (dan@danny.cz)
  - update graft variable in s390 template (dan@danny.cz)


author: Brian C. Lane <bcl@redhat.com> 28.0-1
changelog:
  - Add make test target and update .gitignore (atodorov@redhat.com)
  - Add first unit test so we can start collecting coverage (atodorov@redhat.com)
  - Convert mk-s390-cdboot to python3 (#1497141) (bcl@redhat.com)
  - Update false positives (atodorov@redhat.com)
  - Rename parameters to match names that dnf uses (atodorov@redhat.com)
  - Don't override 'line' from outer scope (atodorov@redhat.com)
  - Add swaplabel command (vponcova@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.2-1
changelog:
  - Add documentation about mock changes (#1473880) (bcl@redhat.com)
  - Log a more descriptive error when setfiles fails (#1499771) (bcl@redhat.com)
  - Add /usr/share/lorax/templates.d ownership to lorax-templates-generic
    (bcl@redhat.com)
  - Add dependencies for SE/HMC (vponcova@redhat.com)
  - Allow installpkgs to do version pinning through globbing (claudioz@fb.com)
  - Storaged re-merged with udisks2 upstream (sgallagh@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.3-1
changelog:
  - Add --old-chroot to the mock example cmdlines (bcl@redhat.com)
  - Don't try and install kernel-PAE on i686 any more (awilliam@redhat.com)
  - New lorax documentation - 28.2 (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.4-1
changelog:
  - Write the --variant string to .buildstamp as 'Variant=' (bcl@redhat.com)
  - Run the pylorax tests with 'make test' (bcl@redhat.com)
  - Fix installpkg exclude operation (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.5-1
changelog:
  - Don't try to build efi images for basearch=i386. (pjones@redhat.com)
  - LMC: Make the QEMU RNG device optional (yturgema@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.6-1
changelog:
  - add system-logos dependency for syslinux (pbrobinson@gmail.com)
  - Really don't try to build EFI images on i386 (awilliam@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.7-1
changelog:
  - Fix _install_branding (bcl@redhat.com)
  - livemedia-creator --no-virt requires a system-logos package (bcl@redhat.com)
  - Revert "add system-logos dependency for syslinux" (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.9-1
changelog:
  - Update default releasever to Fedora 28 (bcl@redhat.com)
  - Update Copyright year to 2018 in Sphinx docs (bcl@redhat.com)
  - make docs now also builds html (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.10-1
changelog:
  - Fix anaconda metapackage name (mkolman@redhat.com)
  - Include the anaconda-install-env-deps metapackage (mkolman@redhat.com)
  - Update the URL in lorax.spec to point to new Lorax location (bcl@redhat.com)
  - New lorax documentation - 28.9 (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.11-1
changelog:
  - Update the generated html docs (bcl@redhat.com)
  - Update the README with relevant URLs (bcl@redhat.com)
  - Fix documentation for enabling lorax-composer.socket (bcl@redhat.com)
  - Add support for systemd socket activation (bcl@redhat.com)
  - Add documentation for lorax-composer and composer-cli (bcl@redhat.com)
  - Move lorax-composer and composer-cli argument parsing into modules (bcl@redhat.com)
  - Update composer templates for use with Fedora (bcl@redhat.com)
  - Add new cmdline args to compose_args settings (bcl@redhat.com)
  - lorax-composer also requires tar (bcl@redhat.com)
  - Remove temporary files after run_compose (bcl@redhat.com)
  - Add --proxy to lorax-composer cmdline (bcl@redhat.com)
  - Pass the --tmp value into run_creator and cleanup after a crash (bcl@redhat.com)
  - Add --tmp to lorax-composer and set default tempdir (bcl@redhat.com)
  - Set lorax_templates to the correct directory (bcl@redhat.com)
  - Adjust the disk size estimates to match Anaconda (bcl@redhat.com)
  - Skip creating groups with the same name as a user (bcl@redhat.com)
  - Add user and group creation to blueprint (bcl@redhat.com)
  - Add blueprint customization support for hostname and ssh key (bcl@redhat.com)
  - Update setup.py for lorax-composer and composer-cli (bcl@redhat.com)
  - Add composer-cli and tests (bcl@redhat.com)
  - Fix the compose arguments for the Fedora version of Anaconda (bcl@redhat.com)
  - Add selinux check to lorax-composer (bcl@redhat.com)
  - Update test_server for blueprint and Yum to DNF changes. (bcl@redhat.com)
  - Convert Yum usage to DNF (bcl@redhat.com)
  - workspace read and write needs UTF-8 conversion (bcl@redhat.com)
  - Return an empty list if depsolve results are empty (bcl@redhat.com)
  - The git blob needs to be bytes (bcl@redhat.com)
  - Remove bin and sbin from nose (bcl@redhat.com)
  - Update the test blueprints (bcl@redhat.com)
  - Ignore more pylint errors (bcl@redhat.com)
  - Use default commit sort order instead of TIME (bcl@redhat.com)
  - Add lorax-composer and the composer kickstart templates (bcl@redhat.com)
  - Update pylorax.api.projects for DNF usage (bcl@redhat.com)
  - Update dnfbase (formerly yumbase) for DNF support (bcl@redhat.com)
  - Move core of livemedia-creator into pylorax.creator (bcl@redhat.com)
  - Update dnfbase tests (bcl@redhat.com)
  - Convert lorax-composer yum base object to DNF (bcl@redhat.com)
  - Use 2to3 to convert the python2 lorax-composer code to python3 (bcl@redhat.com)
  - Add the tests from lorax-composer branch (bcl@redhat.com)
  - Update .dockerignore (bcl@redhat.com)
  - Update lorax.spec for lorax-composer (bcl@redhat.com)
  - livemedia-creator: Move core functions into pylorax modules (bcl@redhat.com)
  - Check selinux state before creating output directory (bcl@redhat.com)
  - really kill kernel-bootwrapper on ppc (dan@danny.cz)
  - Use Fedora 28 for Dockerfile.test (bcl@redhat.com)
  - Enable testing in Travis and collecting of coverage history (atodorov@redhat.com)
  - Remove -boot-info-table from s390 boot.iso creation (#1478448) (bcl@redhat.com)
  - change installed packages on ppc (dan@danny.cz)
  - drop support for 32-bit ppc (dan@danny.cz)
  - remove redundant mkdir (dan@danny.cz)


author: Brian C. Lane <bcl@redhat.com> 28.12-1
changelog:
  - templates: Stop using gconfset (walters@verbum.org)
  - Add support for version globs to blueprints (bcl@redhat.com)
  - Update atlas blueprint (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.13-1
changelog:
  - New lorax documentation - 28.13 (bcl@redhat.com)
  - Override Sphinx documentation version with LORAX_VERSION (bcl@redhat.com)
  - Add support for sources to composer-cli (bcl@redhat.com)
  - Fix DNF related issues with source selection (bcl@redhat.com)
  - Fix handling bad source repos and add a test (bcl@redhat.com)
  - Speed up test_dnfbase.py (bcl@redhat.com)
  - Make sure new sources show up in the source/list output (bcl@redhat.com)
  - Fix make_dnf_dirs (bcl@redhat.com)
  - Update test_server for rawhide (bcl@redhat.com)
  - Add support for user defined package sources API (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.14-1
changelog:
  - New lorax documentation - 28.14 (bcl@redhat.com)
  - Add --dracut-arg support to lorax (bcl@redhat.com)
  - gevent has deprecated .wsgi, should use .pywsgi instead (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.14.1-1
changelog:
  - Add requires on lorax-templates-rhel (bcl@redhat.com)
  - Check the compose templates at startup (bcl@redhat.com)
  - Install 'hostname' in runtime-install (for iSCSI) (awilliam@redhat.com)
  - Fix a couple typos in lorax-composer docs. (bcl@redhat.com)
  - Require python3-dnf v3.0.0 or later (bcl@redhat.com)
  - DNF 3: progress callback constants moved to dnf.transaction (awilliam@redhat.com)
  - Include example blueprints in the rpm (bcl@redhat.com)
  - Make sure /run/weldr has correct ownership and permissions (bcl@redhat.com)
  - Allow more than 1 bash build in tests (bcl@redhat.com)
  - Add redhat.exec to s390 .treeinfo (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.14.2-1
changelog:
  - New lorax documentation - 28.14.2 (bcl@redhat.com)
  - Add dnf.transaction to list of modules for sphinx to ignore (bcl@redhat.com)
  - Document that you shouldn't run lorax-composer twice. (clumens@redhat.com)
  - Add PIDFile to the .service file. (clumens@redhat.com)
  - Don't activate default auto connections after switchroot (rvykydal@redhat.com)
  - Use system-logos in live-iso.ks (bcl@redhat.com)
  - Update rsync version in http-server.toml (bcl@redhat.com)
  - Log and exit on metadata update errors at startup (bcl@redhat.com)
  - Check /projects responses for null values. (bcl@redhat.com)
  - Clarify error message from /source/new (bcl@redhat.com)
  - Support loading groups from the kickstart template files.  (clumens@redhat.com)
  - Include groups in depsolving. (clumens@redhat.com)
  - Add help output to each subcommand. (clumens@redhat.com)
  - Split the help output into its own module. (clumens@redhat.com)
  - If the help subcommand is given, print the help output. (clumens@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.14.3-1
changelog:
  - Update to use only qemu-kvm (bcl@redhat.com)
  - Fix help output on the compose subcommand. (clumens@redhat.com)
  - Add timestamps to "compose-cli compose status" output. (clumens@redhat.com)
  - And then add real output to the status command. (clumens@redhat.com)
  - Add the beginnings of a new status subcommand. (clumens@redhat.com)
  - composer-cli: Fix non-zero epoch in projets info (bcl@redhat.com)
  - Adjust test_server and test blueprints so they depsolve (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.14.4-1
changelog:
  - Fix bash_completion.d typo (bcl@redhat.com)
  - Move disklabel and UEFI support to compose.py (bcl@redhat.com)
  - Fix more tests. (clumens@redhat.com)
  - Change INVALID_NAME to INVALID_CHARS. (clumens@redhat.com)
  - Update composer-cli for the new error return types. (clumens@redhat.com)
  - Add default error IDs everywhere else. (clumens@redhat.com)
  - Add error IDs to things that can go wrong when running a compose.  (clumens@redhat.com)
  - Add error IDs for common source-related errors. (clumens@redhat.com)
  - Add error IDs for unknown modules and unknown projects. (clumens@redhat.com)
  - Add error IDs for when an unknown commit is requested. (clumens@redhat.com)
  - Add error IDs for when an unknown blueprint is requested.  (clumens@redhat.com)
  - Add error IDs for when an unknown build UUID is requested.  (clumens@redhat.com)
  - Add error IDs for bad state conditions. (clumens@redhat.com)
  - Change the error return type for bad limit= and offset=. (clumens@redhat.com)
  - Don't sort error messages. (clumens@redhat.com)
  - Run as root/weldr by default. (clumens@redhat.com)
  - Fix bash completion of compose info (bcl@redhat.com)
  - Add + to the allowed API string character set (bcl@redhat.com)
  - Add job_* timestamp support to compose status (bcl@redhat.com)
  - Add etc/bash_completion.d/composer-cli (wwoods@redhat.com)
  - composer-cli: clean up "list" commands (wwoods@redhat.com)
  - Drop .decode from UTF8_TEST_STRING (bcl@redhat.com)
  - Add input string checks to the branch and format arguments (bcl@redhat.com)
  - Add a test for invalid characters in the API route (bcl@redhat.com)
  - Fix logging argument (bcl@redhat.com)
  - Update get_system_repo for dnf (bcl@redhat.com)
  - Update ConfigParser usage for Py3 (bcl@redhat.com)
  - Update StringIO use for Py3 (bcl@redhat.com)
  - Add a test for the pylorax.api.timestamp functions (bcl@redhat.com)
  - Fix write_timestamp for py3 (bcl@redhat.com)
  - Return a JSON error instead of a 404 on certain malformed URLs.  (clumens@redhat.com)
  - Return an error if /modules/info doesn't return anything.  (clumens@redhat.com)
  - Update documentation (#409). (clumens@redhat.com)
  - Use constants instead of strings (#409). (clumens@redhat.com)
  - Write timestamps when important events happen during the compose (#409).  (clumens@redhat.com)
  - Return multiple timestamps in API results (#409). (clumens@redhat.com)
  - Add a new timestamp.py file to the API directory (#409). (clumens@redhat.com)
  - Use the first enabled system repo for the test (bcl@redhat.com)
  - Show more details when the system repo delete test fails (bcl@redhat.com)
  - Add composer-cli function tests (bcl@redhat.com)
  - Add a test library (bcl@redhat.com)
  - composer-cli: Add support for Group to blueprints diff (bcl@redhat.com)
  - Update status.py to use new handle_api_result (bcl@redhat.com)
  - Update sources.py to use new handle_api_result (bcl@redhat.com)
  - Update projects.py to use new handle_api_result (bcl@redhat.com)
  - Update modules.py to use new handle_api_result (bcl@redhat.com)
  - Update compose.py to use new handle_api_result (bcl@redhat.com)
  - Update blueprints.py to use new handle_api_result (bcl@redhat.com)
  - Modify handle_api_result so it can be used in more places (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.14.5-1
changelog:
  - Fix composer-cli blueprints changes to get correct total (bcl@redhat.com)
  - Fix blueprints/list and blueprints/changes to return the correct total (bcl@redhat.com)
  - Add tests for limit=0 routes (bcl@redhat.com)
  - Add a function to get_url_json_unlimited to retrieve the total (bcl@redhat.com)
  - Fix tests related to blueprint name changes (bcl@redhat.com)
  - Add 'example' to the example blueprint names (bcl@redhat.com)
  - Use urllib.parse instead of urlparse (bcl@redhat.com)
  - In composer-cli, request all results (dshea@redhat.com)
  - Add tests for /compose/status filter arguments (dshea@redhat.com)
  - Allow '*' as a uuid in /compose/status/<uuid> (dshea@redhat.com)
  - Add filter arguments to /compose/status (dshea@redhat.com)
  - Only include specific blueprints in the rpm (bcl@redhat.com)
  - composer-cli should not log to a file by default (bcl@redhat.com)
  - Add documentation for using a DVD as the package source (bcl@redhat.com)
  - Set TCP listen backlog for API socket to SOMAXCONN (lars@karlitski.net)
  - Bring back import-state.service (rvykydal@redhat.com)
  - Fix a little bug in running "modules list". (clumens@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.14.6-1
changelog:
  - Drop mod_auth_openidc from httpd example blueprint (bcl@redhat.com)
  - Bump required dnf version to 3.2.0 for module_platform_id support (bcl@redhat.com)
  - Add support for DNF 3.2 module_platform_id config value (bcl@redhat.com)
  - Fix /compose/cancel API documentation (bcl@redhat.com)


author: Brian C. Lane <bcl@redhat.com> 28.14.7-1
changelog:
  - Ignore a pylint warning about UnquotingConfigParser get args (bcl@redhat.com)
    Related: rhbz#1613058
  - Ditch all use of pyanaconda's simpleconfig (awilliam@redhat.com)
    Related: rhbz#1613058
  - Require python3-librepo (jwboyer@redhat.com)
    Resolves: rhbz#1624423


author: Brian C. Lane <bcl@redhat.com> 28.14.10-1
changelog:
  - Add tito support for Related/Resolves to the branch (bcl)
    Related: rhbz#1613058
  - Always update repo metadata when building an image (bcl)
    Resolves: rhbz#1631561
  - Add a test for repo metadata expiration (bcl)
    Related: rhbz#1631561
  - Add tests for setting root password and ssh key with blueprints (bcl)
    Related: rhbz#1626120
  - Use rootpw for setting the root password instead of user (bcl)
    Related: rhbz#1626122
  - Lock the root account, except on live-iso (bcl)
    Resolves: rhbz#1626122


author: Brian C. Lane <bcl@redhat.com> 28.14.11-1
changelog:
  - Add beakerlib to Dockerfile.test (bcl)
    Related: rhbz#1613058
  - New cli test covering basic compose commands (atodorov) (atodorov)
  - Execute bash tests for composer-cli (atodorov) (atodorov)
  - Add virt guest agents to the qcow2 compose (dshea)
    Resolves: rhbz#1628645
  - Add a vmdk compose type. (dshea)
    Resolves: rhbz#1628646
  - Add a vhd compose type for Azure images (dshea)
    Resolves: rhbz#1628648
  - Add an ami compose type for AWS images (dshea)
    Resolves: rhbz#1628647
  - Remove --fstype from the generated part line (dshea)
    Related: rhbz#1628647
    Related: rhbz#1628648


author: Brian C. Lane <bcl@redhat.com> 28.14.13-1
changelog:
  - New lorax documentation - 28.14.12 (bcl)
    Related: rhbz#1635763
  - Adjust the composer-cli tests for the rename to composer (bcl)
    Related: rhbz#1635763
  - Rename composer-cli to composer (lars)
    Resolves: rhbz#1635763
  - Add and enable cloud-init for ami images (lars)
    Related: rhbz#1628647
  - Make no-virt generated images sparser (dshea)
    Related: rhbz#1628645
    Related: rhbz#1628646
    Related: rhbz#1628648
    Related: rhbz#1628647


author: Brian C. Lane <bcl@redhat.com> 28.14.14-1
changelog:
  - Update cli tests to use composer-cli name (bcl)
    Related: rhbz#1635763
  - Revert "Rename composer-cli to composer" (bcl)
    Related: rhbz#1635763


author: Brian C. Lane <bcl@redhat.com> 28.14.15-1
changelog:
  - Add an openstack image type (bcl)
    Resolves: rhbz#1628645
  - Add cloud-init to vhd images. (dshea)
    Related: rhbz#1628648
  - Replace /etc/machine-id with an empty file (dshea)
    Related: rhbz#1628648
    Related: rhbz#1628645
    Related: rhbz#1628647
    Related: rhbz#1628646


author: Brian C. Lane <bcl@redhat.com> 28.14.16-1
changelog:
  - Fix vhd images (vponcova)
    Related: rhbz#1628648
  - Update depsolving with suggestions from dnf (bcl)
    Resolves: rhbz#1638683


author: Brian C. Lane <bcl@redhat.com> 28.14.17-1
changelog:
  - Update documentation for - 28.14.17 (bcl)
    Related: rhbz#1645189
  - lorax-composer: Install selinux-policy-targeted in images (bcl)
    Resolves: rhbz#1645189
  - Remove setfiles from mkrootfsimage (bcl)
    Related: rhbz#1645189
  - Remove SELinux Permissive checks (bcl)
    Resolves: rhbz#1645189
  - New lorax documentation - 28.14.17 (bcl)
    Related: rhbz#1639132
  - Build manpages for composer-cli and lorax-composer (bcl)
    Resolves: rhbz#1639132
  - Add --no-system-repos to lorax-composer (bcl)
    Resolves: rhbz#1650363


author: Brian C. Lane <bcl@redhat.com> 28.14.18-1
changelog:
  - New lorax documentation - 28.14.18 (bcl)
    Related: rhbz#1656642
  - Add openstack to the image type list in the docs (dshea)
    Related: rhbz#1628645
  - lorax-composer: Handle packages with multiple builds (bcl)
    Resolves: rhbz#1656642
  - Adjust test_drtfr_gpgkey to pass on Fedora 28 and RHEL 8 (bcl)
    Related: rhbz#1655876
  - Update the projects tests to use DNF Repo object (bcl)
    Related: rhbz#1655876
  - dnf changed the type of gpgkey to a tuple (bcl)
    Resolves: rhbz#1655876
  - lorax-composer: Add CDN repo checks to startup and compose start. (bcl)
    Resolves: rhbz#1655623
  - lorax-composer: Check for CDN only repos (bcl)
    Related: rhbz#1655623
  - There is no support for edk2-ovmf on arm/arm64 (bcl)
    Resolves: rhbz#1655512
  - lorax-composer: Check the queue and results at startup (bcl)
    Resolves: rhbz#1647985


author: Brian C. Lane <bcl@redhat.com> 28.14.19-1
changelog:
  - lorax: Save information about rootfs filesystem size and usage (bcl)
    Resolves: rhbz#1659625
  - lorax-composer: Cancel running Anaconda process (bcl)
    Resolves: rhbz#1656691
  - Add cancel_func to virt and novirt_install functions (bcl)
    Resolves: rhbz#1656691
  - lorax-composer: Check for STATUS before deleting (bcl)
    Related: rhbz#1656691
  - Check for existing CANCEL request, and exit on FINISHED (bcl)
    Related: rhbz#1656691


author: Brian C. Lane <bcl@redhat.com> 28.14.20-1
changelog:
  - Revert "lorax-composer: Cancel running Anaconda process" (bcl)
    Related: rhbz#1656691
  - Make sure cancel_func is not None (bcl)
    Related: rhbz#1656691
  - Increase boot.iso rootfs to 3GiB (bcl)
    Resolves: rhbz#1661169


author: Brian C. Lane <bcl@redhat.com> 28.14.21-1
changelog:
  - Remove unneeded else from for/else loop. It confuses pylint (bcl)
    Related: rhbz#1664485
  - Allow customizations to be specified as a toml list (dshea)
    Resolves: rhbz#1664485
  - New lorax documentation - 28.14.21 (bcl)
    Related: rhbz#1650295
  - Update the example livemedia-creator kickstarts for RHEL8 (bcl)
    Resolves: rhbz#1650295
  - Change default releasever to 8 (bcl)
    Related: rhbz#1650295


author: Brian C. Lane <bcl@redhat.com> 28.14.22-1
changelog:
  - Report an error if the blueprint doesn't exist (bcl)
    Related: rhbz#1653934
  - tmux is version 2.8 on Fedora 28 (atodorov)
    Related: rhbz#1653934
  - Disable pylint no-member errors for 2 dnf constants (atodorov)
    Related: rhbz#1653934
  - Backport cloud image tests to RHEL 8 (atodorov)
    Related: rhbz#1653934


author: Brian C. Lane <bcl@redhat.com> 28.14.23-1
changelog:
  - lorax: Move default tmp dir to /var/tmp/lorax (bcl)
    Resolves: rhbz#1668408
  - Expand parameters as separate words (jstodola)
    Related: rhbz#1653934
  - Add /usr/local/bin to PATH for tests (atodorov) (atodorov)
  - Do not generate journal.xml from beakerlib (atodorov)
    Related: rhbz#1653934
  - Use any tmux version (atodorov)
    Related: rhbz#1653934
  - Make test scripts executable with chmod +x (atodorov)
    Related: rhbz#1653934


author: Brian C. Lane <bcl@redhat.com> 28.14.24-1
changelog:
  - Add a ppc64le template for live iso creation (bcl)
    Related: rhbz#1673744
  - Move the package requirements for live-iso setup out of the template (bcl)
    Resolves: rhbz#1673744
  - Remove exclusions from lorax-composer templates (bcl)
    Related: rhbz#1673744
  - Add LiveTemplateRunner to parse per-arch live-iso package requirements (bcl)
    Related: rhbz#1673744
  - Move the run part of LoraxTemplateRunner into new TemplateRunner class (bcl)
    Related: rhbz#1673744
  - lorax-composer: Use reqpart --add-boot for partitioned disk templates (bcl)
    Related: rhbz#1673744
  - livemedia-creator: Add support for reqpart kickstart command (bcl)
    Related: rhbz#1673744
  - Fix make_appliance and the libvirt.tmpl (bcl)
    Related: rhbz#1673744
  - Add get_file_magic to tests/lib.py (bcl)
    Related: rhbz#1673744
  - Clarify the ks repo only error message (bcl)
    Related: rhbz#1673744
  - Add tests to test_creator.py (bcl)
    Related: rhbz#1673744
  - Add some tests for creator.py (bcl)
    Related: rhbz#1673744
  - Make the lorax-composer ks templates more generic (bcl)
    Related: rhbz#1673744
  - Add some extra cancel_func protection to QEMUInstall (bcl)
    Related: rhbz#1684316
  - installer: make sure cancel_func has a value (yuvalt)
    Resolves: rhbz#1684316
  - Update VMware datastore location to unblock tests (chrobert)
    Related: rhbz#1678937
  - Allow overriding $CLI outside test scripts (atodorov)
    Related: rhbz#1678937
  - Use make ci inside test-in-copy target (atodorov)
    Related: rhbz#1678937
  - New test: Build live-iso and boot with KVM (atodorov)
  - New test: Build qcow2 compose and test it with QEMU-KVM (atodorov)
  - Removed remnants of fedora branding. (47631017+jakub-vavra)
    Resolves: rhbz#1672583
  - Drop auth from the kickstart examples (bcl)
    Resolves: rhbz#1672583
  - New test: Verify tar images with Docker and systemd-nspawn (atodorov)
  - Update OpenStack flavor and network settings in tests (atodorov)
  - Use existing storage account (jstodola)
  - Record date/time of VM creation (jstodola)
  - Make sure compose build tests run with SELinux in enforcing mode (jikortus)


author: Brian C. Lane <bcl@redhat.com> 28.14.25-1
changelog:
  - New lorax documentation - 28.14.25 (bcl)
    Related: rhbz#1687743
  - lorax-composer: pass customization.kernel append to extra_boot_args (bcl)
    Resolves: rhbz#1687743
  - Improve logging for template syntax errors (bcl)
    Related: rhbz#1687743
  - Add extra boot args to the livemedia-creator iso templates (bcl)
    Related: rhbz#1687743
  - lorax-composer: Add the ability to append to the kernel command-line (bcl)
    Related: rhbz#1687743
  - lorax-composer: Return UnknownBlueprint errors when using deleted blueprints (bcl)
    Resolves: rhbz#1683441
  - lorax-composer: Delete workspace copy when deleting blueprint (bcl)
    Related: rhbz#1683441
  - Remove 3G minimum from lorax-composer (bcl)
    Resolves: rhbz#1677741


author: Brian C. Lane <bcl@redhat.com> 28.14.26-1
changelog:
  - Only use repos with valid urls for test_server.py (bcl)
    Related: rhbz#1678937
  - Use strict=False when reading repo files (bcl)
    Related: rhbz#1678937
  - tests: Skip docs if not installed (bcl)
    Related: rhbz#1678937
  - tests: Make sure example-development is present for delete test (bcl)
    Related: rhbz#1678937
  - tests: Make it easier to update version globs (bcl)
    Related: rhbz#1678937
  - tests: Select the group to use based on the release (bcl)
    Related: rhbz#1678937
  - Add requirements-test.txt (bcl)
    Related: rhbz#1678937
  - Fix the google cloud boot console settings (dshea)
    Related: rhbz#1689140
  - Add a compose type for alibaba. (dshea)
    Resolves: rhbz#1689140
  - Add a compose check for google cloud images. (dshea)
    Related: rhbz#1689140
  - Add a compose type for Google Compute Engine (dshea) (dshea)
  - Add a new output type, tar-disk. (dshea)
    Related: rhbz#1689140
  - Support compressing single files. (dshea)
    Related: rhbz#1689140
  - Add an option to align the image size to a multiplier. (dshea)
    Related: rhbz#1689140
  - Pass ssl certificate options to anaconda (lars)
    Resolves: rhbz#1663950
  - Add checks for disabled root account (jikortus)
  - Fixup lorax.spec bugs (bcl)
    Related: rhbz#1678937


author: Brian C. Lane <bcl@redhat.com> 28.14.27-1
changelog:
  - Add kernel to ext4-filesystem template (bcl)
    Resolves: rhbz#1709792
  - Switch the --virt-uefi method to use SecureBoot (bcl)
    Resolves: rhbz#1691661
  - qemu wasn't restoring the terminal if it was terminated early (bcl)
    Resolves: rhbz#1691632
  - Revert "lorax-composer: Add CDN repo checks to startup and compose start." (bcl)
    Related: rhbz#1691969
  - Revert "lorax-composer: Check for CDN only repos" (bcl)
    Related: rhbz#1691969
  - Add test for passing custom option on kernel command line (jikortus)
    Related: rhbz#1687743
  - Use verify_image function as a helper for generic tests (jikortus)
    Related: rhbz#1704172
  - Change [[modules]] to [[packages]] in tests (atodorov)
    Related: rhbz#1698368
  - Add new test to verify compose paths exist (atodorov)
    Related: rhbz#1698368
  - Add new sanity tests for blueprints (atodorov)
    Related: rhbz#1698368
  - Update VMware info for VMware testing (chrobert)
    Related: rhbz#1678937
  - Add test for starting compose with deleted blueprint (jikortus)
    Related: rhbz#1699303
  - Fixes for locked root account test (jikortus)
    Related: rhbz#1698473
  - Fix lorax.spec bz reference (bcl)
    Related: rhbz#1678937


author: Brian C. Lane <bcl@redhat.com> 28.14.28-1
changelog:
  - Create a lorax-docs package with the html docs (bcl)
    Resolves: rhbz#1695274
  - Fix path to generic.prm (jstodola)
    Resolves: rhbz#1714107


author: Brian C. Lane <bcl@redhat.com> 28.14.29-1
changelog:
  - tests: Update openssh-server to version * (bcl)
    Related: rhbz#1678937
  - Remove repos.git related tests (bcl)
    Related: rhbz#1709595
  - composer-cli: Update diff support for customizations and repos.git (bcl)
    Related: rhbz#1709595
  - Add support for customizations and repos.git to /blueprints/diff/ (bcl)
    Related: rhbz#1709595
  - tests: Update custom-base with customizations (bcl)
    Related: rhbz#1709595
  - Change customizations.firewall to append items instead of replace (bcl)
    Resolves: rhbz#1709595
  - Update customizations.services documentation (bcl)
    Related: rhbz#1709595
  - lorax-composer: Add services support to blueprints (bcl)
    Related: rhbz#1709595
  - lorax-composer: Add firewall support to blueprints (bcl)
    Related: rhbz#1709595
  - lorax-composer: Add locale support to blueprints (bcl)
    Related: rhbz#1709595
  - lorax-composer: Fix customizations when creating a recipe (bcl)
    Related: rhbz#1709595
  - Update docs for new timezone section (bcl)
    Related: rhbz#1709595
  - lorax-composer: Add timezone support to blueprint (bcl)
    Related: rhbz#1709595
  - Proposal for adding to the blueprint customizations (bcl)
    Related: rhbz#1709595


author: Brian C. Lane <bcl@redhat.com> 28.14.30-1
changelog:
  - New lorax documentation - 28.14.30 (bcl)
    Related: rhbz#1709594
  - Assert that RuntimeErrors have correct messages (egoode)
    Related: rhbz#1709594
  - More descriptive error for a bad ref in repos.git (egoode)
    Related: rhbz#1709594
  - Add more tests for gitrpm.py (bcl)
    Related: rhbz#1709594
  - lorax-composer: Fix installing files from [[repos.git]] to / (bcl)
    Related: rhbz#1709594
  - Add tests using repos.git in blueprints (bcl)
    Related: rhbz#1709594
  - Move git repo creation into tests/lib.py (bcl)
    Related: rhbz#1709594
  - rpmgit: catch potential errors while running git (bcl)
    Related: rhbz#1709594
  - tests: Add test for Recipe.freeze() function (bcl)
    Related: rhbz#1709594
  - Add repos.git support to lorax-composer builds (bcl)
    Related: rhbz#1709594
  - Add pylorax.api.gitrpm module and tests (bcl)
    Related: rhbz#1709594
  - Add support for [[repos.git]] section to blueprints (bcl)
    Resolves: rhbz#1709594
  - [tests] Handle blueprints in setup_tests/teardown_tests correctly (atodorov)
    Related: rhbz#1714298
  - tests: Set BLUEPRINTS_DIR in all cases (lars)
    Related: rhbz#1714298


author: Brian C. Lane <bcl@redhat.com> 28.14.31-1
changelog:
  - tests: Document Azure setup (atodorov) (atodorov)
  - tests: unskip Azure scenario (atodorov) (atodorov)
  - Support CI testing against a bots project PR (martin) (martin)
  - Makefile: Update bots target for moved GitHub project (sanne.raymaekers)
  - Skip azure, live-iso & qcow2 tests due to infra issues (atodorov)
    Related: rhbz#1724073
  - tests: Add check to make sure the compose actually finished (bcl)
    Related: rhbz#1724073
  - Backport Cockpit CI changes for RHEL 8 (atodorov)
    Related: rhbz#1724073
  - tests: Drop sort from compose types test (bcl)
  - New test: assert toml files in git workspace (atodorov)
  - Use passwd --status for locked root account check (jikortus)
    Related: rhbz#1728571


author: Brian C. Lane <bcl@redhat.com> 28.14.32-1
changelog:
  - tests: Add tests for recipe checking functions (bcl)
    Related: rhbz#1716596
  - lorax-composer: Add basic case check to check_recipe_dict (bcl)
    Related: rhbz#1716596
  - lorax-composer: Add basic recipe checker function (bcl)
    Resolves: rhbz#1716596
  - Add live iso support to s390 (bcl)
    Related: rhbz#1746424
  - Disable some compose types on other architectures (bcl)
    Resolves: rhbz#1751998
  - aarch64: Fix live-iso creation on aarch64 (bcl)
    Resolves: rhbz#1752002


author: Brian C. Lane <bcl@redhat.com> 28.14.33-1
changelog:
  - New lorax documentation - 28.14.33 (bcl)
    Related: rhbz#1761653
  - docs: Increase root filesystem to 2000 in rhel-minimal.ks (bcl)
    Resolves: rhbz#1730937
  - Update ppc64le isolabel to match x86_64 logic (bcl)
    Related: rhbz#1757338
  - set inst.stage2 for ppc64le image (dan)
    Related: rhbz#1757338
  - docs: Override macboot/nomacboot documentation (bcl)
    Resolves: rhbz#1761653
  - tests: Keep beakerlib repo on the VM for tests which need it (atodorov)
    Related: rhbz#1769525
  - tests: unskip Qcow2 and Live-ISO scenarios (atodorov)
    Related: rhbz#1769525
  - tests: Ensure failure if beakerlib results file not found (atodorov)
    Related: rhbz#1769525
  - tests: Documentation updates (atodorov)
    Related: rhbz#1769525
  - tests: Use host repositories for make vm (atodorov)
    Related: rhbz#1769525
  - Remove unused make targets (atodorov)
    Related: rhbz#1769525
  - DRY when setting up, running & parsing results for beakerlib tests (atodorov)
    Related: rhbz#1769525
  - tests: Use journalctl -g to check for failed login (bcl)
    Related: rhbz#1769525
  - tests: Fix check_root_account when used with tar liveimg test (bcl)
    Related: rhbz#1769525
  - tests: Use the same asserts as before (atodorov)
    Related: rhbz#1769525
  - tests: switch to using podman instead of docker (atodorov)
    Related: rhbz#1769525
  - tests: Remove nested vm from tar liveimg kickstart test (bcl)
    Related: rhbz#1769525
  - tests: Use --http0.9 for curl ssh test (bcl)
    Related: rhbz#1769525
  - test: Boot the live-iso faster, and login using ssh key (bcl)
    Related: rhbz#1769525
  - tests: Split testing the image into a separate script (bcl)
    Related: rhbz#1769525
  - test: Split up the test class to allow booting other images (bcl)
    Related: rhbz#1769525
  - [tests] Collect compose logs after each build (atodorov)
    Related: rhbz#1769525
  - [tests] Use a function to wait for compose to finish (jikortus)
    Related: rhbz#1769525
  - [tests] Use functions for starting and stopping lorax-composer (atodorov)
    Related: rhbz#1769525
  - tests: Add kickstart tar installation test (jikortus)
    Related: rhbz#1733975
  - tests: add option to disable kernel command line parameters check (jikortus)
    Related: rhbz#1733975
  - tests: Use a loop to wait for VM and sshd to start (bcl)
    Related: rhbz#1733975
  - tests: Drop an old bug reference (bcl) (bcl)


author: Brian C. Lane <bcl@redhat.com> 28.14.34-1
changelog:
  - lorax-composer: Add cloud-init support to the vhd image (bcl)
    Resolves: rhbz#1754711
  - Add dmidecode on supported architectures (bcl)
    Related: rhbz#1714793


author: Brian C. Lane <bcl@redhat.com> 28.14.35-1
changelog:
  - tests: If TEST_OS isn't specified then match the host OS (atodorov)
    Related: rhbz#1769525
  - tests: enable compose_ext4 test to use CDN repos (jrusz)
    Related: rhbz#1777265
  - Add more lines to .gitignore (jrusz)
    Related: rhbz#1777265
  - Remove all repo files & install composer-cli from host repos (atodorov)
    Related: rhbz#1769525
  - Always remove lorax-composer & composer-cli RPMs before installing them (atodorov)
    Related: rhbz#1769525
  - Always remove existing VM image before building new one (atodorov)
    Related: rhbz#1769525


author: Brian C. Lane <bcl@redhat.com> 28.14.36-1
changelog:
  - composer-cli: Only display the available compose types (bcl)
    Related: rhbz#1751998
  - composer-cli: Return int from handle_api_result not bool (bcl)
    Related: rhbz#1779301
  - Add support for API v1 commands upload, and providers (bcl)
    Resolves: rhbz#1779301


author: Brian C. Lane <bcl@redhat.com> 28.14.37-1
changelog:
  - composer-cli: Add python3-pytoml to composer-cli requirements (bcl)
    Related: rhbz#1779301
  - composer-cli: Remove unneeded % from API WARNING message (bcl)
    Related: rhbz#1779301
  - Use mkisofs for the s390 live-iso template (bcl)
    Related: rhbz#1746424


author: Brian C. Lane <bcl@redhat.com> 28.14.38-1
changelog:
  - composer-cli: Increase DELETE timeout to 120s (bcl)
    Resolves: rhbz#1788461
  - Add test for running composer with --no-system-repos option (jikortus)
    Related: rhbz#1785154


author: Brian C. Lane <bcl@redhat.com> 28.14.39-1
changelog:
  - tests: Enable Elastic Network Adapter support for AWS (atodorov)
    Related: rhbz#1789308
  - AWS test: take into account different instance type for non x86 (atodorov)
    Related: rhbz#1789308
  - lorax-composer: Enable ami on aarch64 (bcl)
    Resolves: rhbz#1789308
  - Add test for canceling a running compose (jrusz)
    Related: rhbz#1788461


author: Brian C. Lane <bcl@redhat.com> 28.14.40-1
changelog:
  - tests: run ssh commands in batch mode (jrusz)
    Related: rhbz#1785154
  - tests: remove --test=2 from compose_sanity (jrusz)
    Related: rhbz#1788461
  - Add tests for metapackages and package name globs (bcl)
    Related: rhbz#1791612
  - tests: Check for cloud-init presence in azure image (jrusz)
    Related: rhbz#1754711


author: Brian C. Lane <bcl@redhat.com> 28.14.41-1
changelog:
  - tests: Add new test to run 'test' and 'check' in cockpit ci (jrusz)
    Related: rhbz#1785154
  - tests: rpm now returns str, drop decode() call (bcl)
    Related: rhbz#1785154
  - tests: Switch to using CentOS8 for the Docker tests (bcl)
    Related: rhbz#1785154
  - tests: Finish switch to using example-development in composer tests (bcl)
    Related: rhbz#1785154
  - tests: this_is_rhel function return true for CentOS or RHEL (bcl)
    Related: rhbz#1785154
  - tests: Disable pylint preexec-fn warning (bcl)
    Related: rhbz#1785154
  - pylint: whitelist the rpm module (bcl)
    Related: rhbz#1785154
  - tests: Use unittest.mock (bcl)
    Related: rhbz#1785154
  - Test & cleanup script for Alibaba cloud (atodorov)
    Related: rhbz#1785154


author: Brian C. Lane <bcl@redhat.com> 28.14.42-1
changelog:
  - lorax: Restore the 98dracut-systemd service files to the install.img (bcl)
    Related: rhbz#1805405
  - lorax: Add eject back into the boot.iso (bcl)
    Related: rhbz#1805405


author: Brian C. Lane <bcl@redhat.com> 28.14.43-1
changelog:
  - New lorax documentation - 28.14.43 (bcl)
    Related: rhbz#1826479
  - tests: Add tests for variant branding detection (bcl)
    Related: rhbz#1826479
  - lorax: Update how the release package is chosen (bcl)
    Resolves: rhbz#1826479
  - tests: Add tests for branding (bcl)
    Related: rhbz#1826479
  - Move get_dnf_base_object into a module (bcl)
    Related: rhbz#1826479
  - lorax: Add --skip-branding cmdline argument (bcl)
    Resolves: rhbz#1826479


author: Brian C. Lane <bcl@redhat.com> 28.14.44-1
changelog:
  - rsyslog: Disable journal ratelimits during install (bcl)
    Resolves: rhbz#1752754
  - Update datastore for VMware testing (chrobert)
    Related: rhbz#1825190


author: Brian C. Lane <bcl@redhat.com> 28.14.45-1
changelog:
  - lmc-no-virt: Add requirement on anaconda-install-env-deps (bcl)
    Resolves: rhbz#1827911
  - Fix cherry-pick of extra multipath.conf line (bcl)
    Related: rhbz#1676777
  - Use smarter multipath detection logic. (dlehman)
    Resolves: rhbz#1676777


author: Brian C. Lane <bcl@redhat.com> 28.14.47-1
changelog:
  - lorax-composer: Add deprecation notice to documentation (bcl)
    Related: rhbz#1844649
  - composer-cli: Add documentation for uploads and osbuild-composer (bcl)
    Related: rhbz#1844649
  - composer-cli: Remove the upload and providers commands (bcl)
    Related: rhbz#1844649
  - composer-cli: Return a better error with no value (bcl)
    Related: rhbz#1844649
  - tests: rhel8-branch uses nose not pytest (bcl)
    Related: rhbz#1844649
  - tests: Add tests for composer-cli compose start JSON POST (bcl)
    Related: rhbz#1844649
  - composer-cli: Update bash completion for start-ostree (bcl)
    Related: rhbz#1844649
  - composer-cli: Add new start-ostree command (bcl)
    Resolves: rhbz#1844649
  - composer-cli: Add support for --size to compose start (bcl)
    Related: rhbz#1844649
  - composer-cli: pytoml load() needs an open file not a string (bcl)
    Resolves: rhbz#1843704
  - test: Put VM image overlay into /var/tmp (martin) (martin)
    Related: rhbz#1825190


author: Brian C. Lane <bcl@redhat.com> 28.14.48-1
changelog:
  - composer-cli: Disable retry counter on connection timeout (bcl)
    Related: rhbz#1848727
  - composer-cli: Change timeout to 5 minutes (bcl)
    Resolves: rhbz#1848727


author: Brian C. Lane <bcl@redhat.com> 28.14.49-1
changelog:
  - include generic.ins for s390 boot iso (dan)
    Related: rhbz#1844517
  - Fix the bug referenced in the last build (bcl)
    Resolves: rhbz#1848727


author: Brian C. Lane <bcl@redhat.com> 28.14.50-1
changelog:
  - composer-cli: Make start-ostree parent and ref optional (bcl)
    Resolves: rhbz#1859680
  - composer-cli: Add a get_arg function (bcl)
    Related: rhbz#1859680


author: Brian C. Lane <bcl@redhat.com> 28.14.51-1
changelog:
  - tests: Overwrite rhel-8.json when testing with osbuild-composer (atodorov)
    Related: rhbz#1825190
  - tests: Allow skipping image build in compose sanity test (atodorov)
    Related: rhbz#1825190
  - Set BACKEND=osbuild-composer if running that test scenario (atodorov)
    Related: rhbz#1825190
  - tests: Don't check info after compose cancel with osbuild-composer (atodorov)
    Related: rhbz#1825190
  - tests: Compare blueprints as TOML objects, not strings (atodorov)
    Related: rhbz#1825190
  - tests: Remove lorax-composer specific checks (atodorov)
    Related: rhbz#1825190
  - tests: Remove compose after we're done (atodorov)
    Related: rhbz#1825190
  - tests: don't use beakerlib in blueprint (lars)
    Related: rhbz#1825190
  - tests: don't depend on internal state of composer (lars)
    Related: rhbz#1825190
  - tests: Do not rely on example blueprints (atodorov)
    Related: rhbz#1825190
  - tests: Special case compose types for osbuild-composer (atodorov)
    Related: rhbz#1825190
  - tests: Don't check example blueprints if we don't have to (atodorov)
    Related: rhbz#1825190
  - tests: Use BACKEND env variable instead of hard-coded values (atodorov)
    Related: rhbz#1825190
  - tests: Disable non-cli test scenarios b/c osbuild-composer (atodorov)
    Related: rhbz#1825190


author: Brian C. Lane <bcl@redhat.com> 28.14.53-1
changelog:
  - tests: Push example blueprints b/c they may not exist (atodorov)
    Related: rhbz#1825190
  - rhel-livemedia.ks: Add anaconda-live package to the example kickstart (bcl)
    Related: rhbz#1691319
  - Switch VMware testing env to improve stability results (chrobert)
    Related: rhbz#1825190


author: Brian C. Lane <bcl@redhat.com> 28.14.56-1
changelog:
  - Switch to using upstream mk-s390image for s390 cdboot.img creation (bcl)
    Related: rhbz#1892404
  - Add --squashfs-only option to drop inner rootfs.img layer (marmarek)
    Resolves: rhbz#1846282


author: Brian C. Lane <bcl@redhat.com> 28.14.57-1
changelog:
  - fixes #543 qemu -nodefconfig deprecated (afm404)
    Resolves: rhbz#1904168
  - sshd_config: Apply suggested changes (bcl)
    Resolves: rhbz#1872892


author: Brian C. Lane <bcl@redhat.com> 28.14.58-1
changelog:
  - composer-cli: Add support for start-ostree --url URL (bcl)
    Resolves: rhbz#1929381
  - tests: Override rhel-8-beta.json repositories for osbuild-composer (atodorov)
  - tests: Remove systemctl for osbuild-composer (atodorov)
  - tests: Start osbuild-composer.socket (bcl)
  - test: Fix vm.install for non-LVM cloud images (martin)


author: Brian C. Lane <bcl@redhat.com> 28.14.59-1
changelog:
  - Backport mkksiso to RHEL 8.5.0 (bcl)
    Resolves: rhbz#1955355
  - Move manpages into the correct subpackages (bcl)
    Resolves: rhbz#1928962
  - composer-cli: Update documentation URLs (bcl)
    Resolves: rhbz#1915361
  - Use wildcard for grub2 modules in livemedia.ks example (bcl)
    Related: rhbz#1973530
  - runtime-install: Install ipcalc (bcl)
    Related: rhbz#1958314
  - test: Add new osbuild-composer expected types (martin) (martin)
  - test: Fix URL to bots testmap (martin) (martin)


author: Brian C. Lane <bcl@redhat.com> 28.14.60-1
changelog:
  - New lorax documentation - 28.14.59 (bcl)
    Related: rhbz#1955355
  - docs: Add missing mkksiso.1 manpage (bcl)
    Related: rhbz#1955355
  - docs: Fix reference in composer-cli.rst (bcl)
    Related: rhbz#1915361
  - Makefile: Use user-mode podman and fix docs-in-docker target (bcl)
    Related: rhbz#1955355


author: Brian C. Lane <bcl@redhat.com> 28.14.63-1
changelog:
  - Handle all possible dnf group_install errors (bcl)
    Related: rhbz#1947958
  - runtime-install: Install nvme-cli tool (bcl)
    Related: rhbz#1903339


author: Brian C. Lane <bcl@redhat.com> 28.14.64-1
changelog:
  - mkksiso: Check the length of the filenames (bcl)
    Related: rhbz#2028048
  - mkksiso: Check the iso's arch against the host's (bcl)
    Related: rhbz#2028048
  - mkksiso: Add missing implantisomd5 tool requirements (bcl)
    Related: rhbz#2028048
  - mkksiso: Raise error if no volume id is found (bcl)
    Related: rhbz#2028048
  - mount: Add aarch64 and s390x support to IsoMountopoint (bcl)
    Resolves: rhbz#2028089
  - mkksiso: Skip mkefiboot for non-UEFI isos (bcl)
    Resolves: rhbz#2028097
  - mkksiso: Add -joliet-long (bcl)
    Resolves: rhbz#2028044
  - mkksiso: Return 1 on errors (bcl)
    Resolves: rhbz#2028048
  - Increase boot.iso rootfs to 4GiB (bcl)
    Resolves: rhbz#2028059
  - Fix specfile to match the one from dist-git (bcl)
    Related: rhbz#2001942


author: Brian C. Lane <bcl@redhat.com> 28.14.67-1
changelog:
  - mkksiso: Fix the order of the ppc mkisofs command (bcl)
    Related: rhbz#2049205
  - mkksiso: mkfsiso argument order matters (bcl)
    Resolves: rhbz#2049205
  - mkksiso: Improve debug message about unsupported arch (bcl)
    Related: rhbz#2049190
  - mkksiso: Add kickstart to s390x cdboot.prm (bcl)
    Resolves: rhbz#2049190


author: Brian C. Lane <bcl@redhat.com> 28.14.69-1
changelog:
  - runtime-cleanup: Use branding package name instead of product.name (bcl)
    Related: rhbz#2052154
  - treebuilder: Add branding package to template variables (bcl)
    Related: rhbz#2052154
  - api: Read substitution variables from the host (bcl)
    Resolves: rhbz#2095053
  - tests: Switch to using centos:stream8 for Dockerfile.test (bcl)
    Related: rhbz#2095053


author: Brian C. Lane <bcl@redhat.com> 28.14.70-1
changelog:
  - templates: Update runtime-* templates (bcl)
    Resolves: rhbz#2042101
  - templates: Don't include redhat.exec on s390 (bcl)
    Related: rhbz#2042101
  - templates: Drop non-64bit PPC support from live grub.cfg (bcl)
    Related: rhbz#2042101
  - templates: Update config_files for inst.* usage (bcl)
    Related: rhbz#2042101
  - tests: Run the 'test-in-docker' tests for github PRs (bcl)
    Resolves: rhbz#2095578


author: Brian C. Lane <bcl@redhat.com> 28.14.71-1
changelog:
  - Makefile: skip running pylint for 'make ci' (bcl)
    Related: RHEL-24416
  - templates: Remove libreport bugzilla plugins (bcl)
    Resolves: RHEL-24416


author: Arkady L. Shane <tigro@msvsphere-os.ru> - 28.14.71-1.inferit
changelog:
  - templates: Fixed UTF-8 handling in replace command
  - templates: Added iconv command to convert from UTF-8 to another encoding
  - remove libreport-rhel-anaconda-bugzilla depend


author: Omair Majid <omajid@redhat.com> - 2.8.1-9
changelog:
  - Build with standard distro-wide optimization flags even on s390 and s390x
  - Resolves: rhbz#1630591


author: Alexander Kurtakov <akurtako@redhat.com> 0:5.4.1-2
changelog:
  - Organize Sources numbering.
  - Drop old jpackage header - package has nothing in common anymore.
  - Drop 3+ years old provides/obsoletes.
  - Move old changelog to separate file to ease working with the spec file.


author: Mat Booth <mat.booth@redhat.com> - 0:7.7.0-1
changelog:
  - Update to latest upstream release
  - Drop deprecated uima analyzers sub-package
  - Added nori Korean analyzers sub-package


author: Mat Booth <mat.booth@redhat.com> - 0:8.1.1-3
changelog:
  - Drop spatial, morfologik, replicator, demo and benchmark modules due to missing deps
  - Fix obsoletes when built in minimal mode


author: Kamil Dudka <kdudka@redhat.com> - 2.8.9-0.23.dev19
changelog:
  - do not require 'rsh' installed at build time (#1581747)
  - update to the latest upstream pre-release


author: Jakub Martisko <jamartis@redhat.com> - 1.8.3-5
changelog:
  - Fix a renamed variable in one of the patches
  - Since the variable was used in an assert, the regular build did not fail, but the QA builds did.
  - Related: RHEL-87362


author: Parag Nemade <pnemade AT redhat DOT com> - 1.7.0-7
changelog:
  - Add missing BuildRequires: glibc-locale-source
  - Resolves:rh#996429 - Mapping of ਠ is improper as per standard
  - Resolves:rh#903272 - [gu_IN] use Devanagari U0965 instead of U0AE5 in inscript2 map


author: Parag Nemade <pnemade AT redhat DOT com> - 1.8.0-0.1.RC1
changelog:
  - Update to 1.8.0 (#1523967)
  - Resolves:rh#1487512 - Can't enter words beginning "ld" with Tibetan-ewts keyboard


author: Zuzana Miklankova <zmiklank@redhat.com> - 2.7.1-1
changelog:
  - Update to 2.7.1
  - Retain compatibility with jna4
  - Adjust pom.xml, so that the rpm Requires jna and jna-platform
    Resolves: #2043212


author: Zuzana Miklankova <zmiklank@redhat.com> - 2.7.1-2
changelog:
  - autogenerate the Requires only for jna, not jna-platform
  - change required version of jna-platform to 'any' in pom.xml
    Resolves: #2089627


author: Parag Nemade <pnemade AT redhat DOT com> - 0.2.4-38
changelog:
  - Resolves:rh#2180735 - move marisa-devel in rhel8 CRB repository
    also fix missing gating test execution


author: Deepak Bhole <dbhole@redhat.com> - 0:2.2.1-2
changelog:
  - Added support for dumping mapping info (in debug mode)
  - Add a custom depmap
  - Added empty-dep
  - Added proper requirements
  - Fixed classworlds jar name used at runtime
  - Install individual components
  - Install poms and mappings
  - Remove non maven items from shaded uber jar
  - Create dependency links in $M2_HOME/lib at install time


author: Alexander Kurtakov <akurtako@redhat.com> 2.2.1-10
changelog:
  - Remove buildnumber-maven-plugins deps now that is fixed.
  - Use new package names in BR/R.
  - Use global instead of define.


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 2.2.1-14
changelog:
  - Remove old depmaps from -depmap.xml file
  - Fix argument quoting for mvn scripts (Resolves rhbz#647945)


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 2.2.1-17
changelog:
  - Add conditional BRs to enable ff merge between f14 and f15
  - Remove jackrabbit dependency from pom files


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 2.2.1-23
changelog:
  - Split artifact-manager and project into subpackages
  - Fix resolver to process poms and fragments from datadir
  - No more need to update_maven_depmap after this update


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 2.2.1-44
changelog:
  - Don't depend on plexus-container-default
  - Unset M2_HOME before calling mvn-rpmbuild
  - Remove test dependencies


author: Michal Srb <msrb@redhat.com> - 2.2.1-45
changelog:
  - Add missing BR: maven-install-plugin (Resolves: #979504)
  - Migrate to plexus-containers-container-default


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 2.2.1-47
changelog:
  - Remove code related to bootstrapping
  - Remove empty-dep JAR and POM
  - Remove local depmap
  - Use mfiles to simplify %files sections
  - Remove handling of custom settings.xml
  - Build with XMvn


author: Tomas Radej <tradej@redhat.com> - 1:1.0-4
changelog:
  - Installing folders separately with -m 755
  - Installing NOTICE in javadoc subpackage
  - Fixed changelog


author: Jaromir Capik <jcapik@redhat.com> 2.2.1-2
changelog:
  - Migration from plexus-maven-plugin to plexus-containers-component-metadata
  - Missing modello dependency added
  - Minor spec file changes according to the latest guidelines


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 2.3.2-4
changelog:
  - Add few missing (Build)requires
  - Remove post(un) scriptlets with update_maven_depmap
  - Use new add_maven_depmap macro


author: Tomas Radej <tradej@redhat.com> - 2.4-1
changelog:
  - Updated to the upstream version
  - Partially removed a test because of a legacy class use
  - Removed exception checking as it has already been done


author: Tania Bento <tbento@redhat.com> 0:1.0-0.1.a7.3jpp.1
changelog:
  - Fixed %Release.
  - Fixed %BuildRoot.
  - Removed %Vendor.
  - Removed %Distribution.
  - Removed %post and %postun sections for javadoc.
  - Fixed instructios on how to generate source drop.
  - Fixed %Summary.
  - Added gcj support option.
  - Marked configuration file as %config(noreplace) in %files section.


author: Andrew Overholt <overholt@redhat.com> 0:1.0-0.5.a10
changelog:
  - Update to 1.0 alpha 10 courtesy of Deepak Bhole
  - Remove gcj support
  - Add patch to build against iText 2.x (with back-ported XML classes)


author: Mary Ellen Foster <mefoster at gmail.com> 0:1.1.2-1
changelog:
  - Update to 1.1.2
  - Add update_maven_depmap to post and postun
  - Temporarily disable javadoc until maven2-plugin-javadoc is rebuilt against
    the new doxia


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:1.1.3-1
changelog:
  - New bugfix version
  - Fix javadoc generation error
  - Use %{_mavenpomdir} macro
  - Update BRs to latest maven plugin names
  - Use new plexus-containers components
  - Remove/update old patches


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:1.1.4-1
changelog:
  - Update to 1.1.4
  - Migrate from tomca5 to tomca6
  - Versionless jars and javadocs
  - Remove old skip-plugin patch
  - Replace add-default-role-hint patch with remove-plexus-component patch
  - Rename few jakarta BRs/Rs to apache names


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:1.2-1
changelog:
  - Update to latest upstream (1.2)
  - Use maven 3 to build
  - Remove version limits on BR/R (not valid anymore anyway)
  - Remove "assert" patch (no explanation for it's existence)


author: Michal Srb <msrb@redhat.com> - 0:1.2-5
changelog:
  - Migrated to plexus-components-component-default (Resolves: #878553)
  - Removed custom depmap and its occurrence in spec file
  - Fixed various rpmlint warnings


author: Michael Simacek <msimacek@redhat.com> - 0:1.5-1
changelog:
  - Update to upstream version 1.5
  - Move back RenderingContext.java that was moved to doxia-sitetools which
    doesn't have a release yet


author: Mary Ellen Foster <mefoster at gmail.com> 0:1.1.2-1
changelog:
  - Update to 1.1.2
  - Temporarily disable javadoc until maven2-plugin-javadoc is rebuilt against
    the new doxia


author: Mary Ellen Foster <mefoster at gmail.com> 0:1.1.2-2
changelog:
  - Add (Build)Requirement maven-shared-reporting-impl,
    plexus-containers-container-default, jakarta-commons-configuration


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.1.3-1
changelog:
  - Update to 1.1.3
  - Enable javadoc generation again
  - Update maven plugins BRs
  - Make dependency on maven-doxia unversioned


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.2-1
changelog:
  - Update to latest version (1.2)
  - Use maven 3 to build
  - Remove version limits on BR/R (not valid anymore anyway)


author: Jaromir Capik <jcapik@redhat.com> - 1.2-2
changelog:
  - Migration from plexus-maven-plugin to plexus-containers-component-metadata
  - Minor spec file changes according to the latest guidelines


author: Michal Srb <msrb@redhat.com> - 1.3-1
changelog:
  - Update to upstream version 1.3
  - Migrate from maven-doxia to doxia subpackages (#889145)
  - Build with xmvn
  - Replace patches with pom_ macros
  - Remove unnecessary depmap


author: Jaromir Capik <jcapik@redhat.com> - 1.0.1-4
changelog:
  - Migration to plexus-containers-component-metadata
  - Maven3 compatibility patches
  - Minor spec file changes according to the latest guidelines


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.1.1-1
changelog:
  - Update to upstream version 1.1.1
  - Convert patches to POM macro
  - Remove patch for bug 748074, upstreamed


author: Tania Bento <tbento@redhat.com> 0:1.5.3-2jpp.1
changelog:
  - Fixed %Release.
  - Fixed %BuildRoot.
  - Removed %Vendor.
  - Removed %Distribution.
  - Removed period at the end of %Summary.
  - Removed %post and %postun sections for javadoc.
  - Removed %post and %postun sections for booter-javadoc.
  - Added gcj support option.
  - Fixed instructions on how to generate source drop.


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.6-1
changelog:
  - Rename subpackages to not repeat "maven" twice
  - Update to latest upstream version
  - Add common jar to files
  - Introduce maven-failsafe-plugin sub-package
  - Cleanups


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.7.2-1
changelog:
  - Update to latest version (2.7.2)
  - Add common-junit* jars to distribution
  - Versionless javadocs
  - Use maven 3 to build


author: Tomas Radej <tradej@redhat.com> - 1:1.2.1-2
changelog:
  - Added licence text
  - Changed maven target from install to package
  - Creating directories in Install


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 3.0.0-1
changelog:
  - Update to upstream version 3.0.0
  - Remove legacy obsoletes/provides
  - Update to current packaging guidelines


author: Weinan Li <weli@redhat.com> -1.5-3
changelog:
  - R: maven-shared-invoker
  - R: maven-shared-reporting-api
  - R: maven-shared-reporting-impl
  - Remove BR: maven2-plugin-changes
  - Add BR: maven-shared-invoker


author: Michal Srb <msrb@redhat.com> - 1.8-4
changelog:
  - Migrate from maven-doxia to doxia subpackages (Resolves: #909238)
  - Remove unnecessary BR on maven-doxia-tools


author: Alexander Kurtakov <akurtako@redhat.com> 2.3.1-1
changelog:
  - Update to 2.3.1.
  - Keep plexus-container-default on the dependency tree.
  - Drop depmap - not needed now.


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 3.0-4
changelog:
  - Add fedora local resolver
  - Fix quoting of arguments to mvn scripts
  - Add javadoc subpackage
  - Make jars versionless and remove unneeded clean section


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 3.0-5
changelog:
  - Fix bugs #667625 #667614 and #667636
  - Install maven metadata so they are not downloaded when mvn is run
  - Rename mvn3-local to mvn-local
  - Add more comments to resolver patch


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 3.0.2-2
changelog:
  - Added mvn-rpmbuild script to be used in spec files
  - mvn-local is now mixed mode (online with javadir priority)
  - Changed mvn.jpp to mvn.local


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 3.0.3-5
changelog:
  - Process fragments directly instead of maven2-depmap.xml
  - Expect fragments in /usr/share/maven-fragments
  - Resolve poms also from /usr/share/maven-poms


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 3.0.3-6
changelog:
  - Fix handling of fallback default_poms
  - Add empty-dep into maven package to not require maven2 version


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 3.0.4-2
changelog:
  - Make javadoc noarch
  - Make compilation source level 1.5
  - Fix borked tarball unpacking (reason unknown)


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 3.0.4-12
changelog:
  - Look into maven.repo.local first to handle corner-case packages (#865599)
  - Finish handling of compatibility packages
  - Disable animal-sniffer temporarily in Fedora as well


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 3.1.0-9
changelog:
  - Synchronize JAR list in lib/ with upstream release
  - Remove test dependencies on aopalliance and cglib


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 3.1.0-10
changelog:
  - Add dependencies of wagon-http-shaded to plexus.core
  - Remove objectweb-asm from plexus.core
  - Add explicit requires
  - Resolves: rhbz#1023872


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1:3.6.2-9
changelog:
  - Turn hard dependency on java-devel into a weak dependencny
  - Add missing Requires on which
  - Resolves: rhbz#2129825, rhbz#2008121


author: Christopher Tubbs <ctubbsii@fedoraproject.org> - 1:3.6.3-6
changelog:
  - Remove unneeded commons-logging from runtime class path (rhbz#1883751)
  - Also remove redundant commons-codec


author: Mat Booth <mat.booth@redhat.com> - 3.0.1-2
changelog:
  - Fix build against new maven-archiver, which removed some deprecated methods
    that this plugin was using


author: Jaromir Capik <jcapik@redhat.com> - 0:2.7-2
changelog:
  - Removal of plexus-maven-plugin (not needed)
  - Migration to maven3
  - Removal of unwanted file duplicates
  - Minor spec file changes according to the latest guidelines


author: Alexander Kurtakov <akurtako@redhat.com> 1:1.2-2
changelog:
  - Fix line lengths and use macroses consistently.
  - Add comment for the tests skip.
  - Add missing requires and set permissions.


author: Yong Yang <yyang@redhat.com> 1:1.2-2.6
changelog:
  - Add more maven depmap for maven-test-tools and maven-plugin-testing-tools for backward compatibility


author: Tomas Radej <tradej@redhat.com> - 2.1-1
changelog:
  - Updated to latest upstream version
  - Cleanup - removed patches, old files etc.
  - Added requires to subpackages


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 3.0.0-4
changelog:
  - Remove legacy obsoletes/provides
  - Remove dependency on junit-addons
  - Remove build-dependency on maven-invoker-plugin


author: Pierre-Yves Chibon <pingou@pingoured.fr> - 1.4-1
changelog:
  - Update to 1.4
  - Add BR on jdependency >= 0.6
  - Add patch to add dependency on maven-artifact-manager


author: Matt Wringe <mwringe@redhat.com> - 0:1.0-0.1.a5.3jpp.1
changelog:
  - Merge in the changes neeeded to build without jetty
  - Fix rpmlint issues
  - Generate new *-build.xml files from pom.xml files as origins of
    *-project files is unknown.
  - Remove maven1 project.xml files from sources
  - Comment out various section requiring maven or javadocs
    (to be re-enabled at a future time). Note that the ant:ant task
    for maven2 does not currently generate javadocs.


author: Michal Schorm <mschorm@redhat.com> - 0.996-2.12
changelog:
  - Bump version for 'mysql' module rebuild
    We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo
  - Resolves: #2180411


author: Lyude Paul <lyude@redhat.com> - 8.4.0-2.20181118git1830dcb
changelog:
  - Start using proper git version strings for rawhide
  - Enabling building of wayland and freetype demos


author: Kyle McMartin <kyle@redhat.com> - 10.0.2-4.20140118
changelog:
  - Fix up building drivers on AArch64, enable LLVM there.
  - Eliminate some F17 cruft from the spec, since we don't support it anymore.
  - Conditionalize with_radeonsi on with_llvm instead of ppc,s390 && >F-17.
  - Conditionalize libvdpau_radeonsi.so.1* on with_radeonsi instead of simply
    with_llvm to fix a build failure on AArch64.


author: Kyle McMartin <kyle@redhat.com> - 10.0.2-6.20140118
changelog:
  - Fix accidentally inverted logic that meant radeonsi_dri.so went missing
    on all architectures instead of just ppc and s390. Sorry!


author: Igor Gnatenko <i.gnatenko.brain@gmail.com> - 10.1-1.20140305
changelog:
  - mesa: Bump version to 10.1 (final) (Ian Romanick)
  - glx/dri2: fix build failure on HURD (Julien Cristau)
  - i965: Validate (and resolve) all the bound textures. (Chris Forbes)
  - i965: Widen sampler key bitfields for 32 samplers (Chris Forbes)


author: Igor Gnatenko <i.gnatenko.brain@gmail.com> - 10.1.1-3.20140430
changelog:
  - Update to today snapshot
  - apply as downstream patches for reporting GPU max frequency on r600 (FD.o #73511)


author: Igor Gnatenko <i.gnatenko.brain@gmail.com> - 10.2-0.1.rc1.20140505
changelog:
  - Enable omx on x86 and arm (RHBZ #1094199) (kwizart)
  - Split _with_xa from _with_vmware (RHBZ #1094199) (kwizart)
  - Add _with_xa when arch is arm and _with_freedreeno (RHBZ #1094199) (kwizart)


author: Igor Gnatenko <i.gnatenko.brain@gmail.com> - 10.2-0.3.rc1.20140505
changelog:
  - Move gallium-pipe to the correct sub-package (RHBZ #1094588) (kwizart)
  - Move egl_gallium.so to the correct location (RHBZ #1094588) (kwizart)
  - Switch from with to enable for llvm shared libs (kwizart)


changelog: - Rebase to 'master' branch (f381c27c548aa28b003c8e188f5d627ab4105f76 commit)
author:
  Igor Gnatenko <i.gnatenko.brain@gmail.com> - 10.3-0.devel.1.f381c27c548aa28b003c8e188f5d627ab4105f76


changelog: - c40d7d6d948912a4d51cbf8f0854cf2ebe916636 commit
author:
  Igor Gnatenko <i.gnatenko.brain@gmail.com> - 10.3-0.devel.2.c40d7d6d948912a4d51cbf8f0854cf2ebe916636


changelog: - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
author:
  Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 10.3-0.devel.2.c40d7d6d948912a4d51cbf8f0854cf2ebe916636.1


changelog: - 10.4 c2867f5b3626157379ef0d4d5bcaf5180ca0ec1f
author:
  Igor Gnatenko <i.gnatenko.brain@gmail.com> - 10.4-0.devel.1.c2867f5b3626157379ef0d4d5bcaf5180ca0ec1f


changelog: - 80771e47b6c1e47ab55f17311e1d4e227a9eb3d8 commit
author:
  Igor Gnatenko <i.gnatenko.brain@gmail.com> - 10.4-0.devel.2.80771e47b6c1e47ab55f17311e1d4e227a9eb3d8


changelog: - add swrast to dri driver list
author:
  Igor Gnatenko <i.gnatenko.brain@gmail.com> - 10.4-0.devel.2.1.80771e47b6c1e47ab55f17311e1d4e227a9eb3d8


author: Igor Gnatenko <i.gnatenko.brain@gmail.com> - 11.3.0-0.1.gitea2bff1
changelog:
  - 11.3.0 (gitea2bff1)
  - Add SWR state-tracker (but disable because build is broken)
  - Use gallium-osmesa instead of classic osmesa (RHBZ #1305588)
  - Remove very old changelogs


author: Hans de Goede <hdegoede@redhat.com> - 17.0.0-0.4.rc2
changelog:
  - Update eglext.h to 20161230 version this brings in some new defines needed
    by some apps / libraries


author: Hans de Goede <hdegoede@redhat.com> - 17.0.0-0.5.rc2
changelog:
  - Fix GLX_SGIX_fbconfig extension dispatching with glvnd, this fixes games such
    as "The Binding of Isaac: Rebirth" and "Crypt of the NecroDancer" from Steam


author: Hans de Goede <hdegoede@redhat.com> - 17.0.1-3
changelog:
  - Fix glXGetDriverConfig not working with glvnd (rhbz#1429894)
  - Fix indirect rendering, add libGLX_indirect.so.0 symlink (rhbz#1427174)


author: Adam Jackson <ajax@redhat.com> - 18.3.0-0.2
changelog:
  - Mesa 18.3.0 RC2
  - Drop python3 build system backport
  - Drop no-longer-necessary big-endian build fix
  - Re-enable 10bpc fbconfigs


author: José Expósito <jexposit@redhat.com> - 23.1.4-3
changelog:
  - Fix off-by-one error for newblock allocation in dlist_alloc
    Resolves: https://issues.redhat.com/browse/RHEL-40566


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 0.55.3-3
changelog:
  - build: use PIE objects for static libraries
    Resolves: rhbz#1899620
    (meson builds QEMU with PIC objects instead of PIE)


author: Uri Lublin <uril@redhat.com> - 2.30-2
changelog:
  - Remove PROVIDE() qualifiers from definition of __CTOR_LIST__ and __DTOR_LIST__
    Resolves: rhbz#1846152


author: Erik van Pienbroek <epienbro@fedoraproject.org> - 101-1
changelog:
  - Update config.{guess,sub} in %mingw_configure (#1288256)
  - Regenerated list of default win32 DLL's


author: Uri Lublin <uril@redhat.com> - 2.4.8-1
changelog:
  - Update to 2.4.8 and pick up CVEs fixes
  - Resolves: rhbz#2050504 CVE-2022-23990
  - Resolves: rhbz#2057023 CVE-2022-25236
  - Resolves: rhbz#2057037 CVE-2022-25235
  - Resolves: rhbz#2057094 CVE-2022-25313
  - Resolves: rhbz#2057099 CVE-2022-25314
  - Resolves: rhbz#2057127 CVE-2022-25315


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 1.14.1-2
changelog:
  - ExclusiveArch: i686, x86_64
    Related: rhbz#1615874
  - BuildRequires: python3-devel
    Related: rhbz#1615874


author: Erik van Pienbroek <epienbro@fedoraproject.org> - 5.0-0.2.rc2.v5.x.git65a0c3.20160723
changelog:
  - Update to 20160204 snapshot of the v5.x branch (git rev 65a0c3)
  - Backported patch to build failure of latest wine-gecko


author: Erik van Pienbroek <epienbro@fedoraproject.org> - 1.0.2h-1
changelog:
  - Synced with native openssl-1.0.2h-1
  - Fixes RHBZ #1332591 #1332589 #1330104 #1312861 #1312857 #1307773 #1302768


author: Christophe Fergeau <cfergeau@redhat.com> - 1.0.2k-1
changelog:
  - Sync with rhel 7.6 OpenSSL 1.0.2k+patches in order to get the latest security
    fixes
  - Related: rhbz#1615874


author: Erik van Pienbroek <epienbro@fedoraproject.org> - 8.38-1
changelog:
  - Update to 8.38
  - Fixes various CVE's:
    RHBZ #1236660, #1249905, #1250947, #1256453, #1256454, #1287616,
    RHBZ #1287619, #1287626, #1287628, #1287631, #1287634, #1287640,
    RHBZ #1287642, #1287648, #1287650, #1287656, #1287658, #1287661,
    RHBZ #1287663, #1287668, #1287670, #1287673, #1287675, #1287692,
    RHBZ #1287694, #1287698, #1287700, #1287704, #1287706, #1287720,
    RHBZ #1287722


author: Uri Lublin <uril@redhat.com> - 3.26.0.0-1
changelog:
  - Rebase to sqlite 3.26.0
  - Fix CVE-2019-8457  CVE-2019-13752 CVE-2019-13753 CVE-2019-13734
  - Fix CVE-2019-19924 CVE-2019-19923 CVE-2019-19925 CVE-2019-19959
  - Fix CVE-2019-20218 CVE-2020-6405  CVE-2020-9327  CVE-2019-5018
  - Fix CVE-2019-16168
    Resolves: rhbz#1826898
  - Fix CVE-2020-13632
    Resolves: rhbz#1845615
  - Fix CVE-2020-13631
    Resolves: rhbz#1845475
  - Fix CVE-2020-13630
    Resolves: rhbz#1845212
  - Fix CVE-2020-13434
    Resolves: rhbz#1845851
  - Fix CVE-2020-15358


author: Pavel Raiskup <praiskup@redhat.com> 41.3-1
changelog:
  - move anolis-7 to eol directory (msuchy@redhat.com)
  - move opensuse-leap-15.4 to eol directory (msuchy@redhat.com)
  - configs: the stream9 image is "ready" for Mock bootstrap
  - enable bootstrap container for CentOS Stream 10 (carlwgeorge@gmail.com)
  - configs: replace `powerpc64le` with `ppc64le` in the `%_host_cpu` macro
  - fix EOL template locations for CentOS7/EPEL7 (thomas.mendorf@ebf.com)


author: Pavel Raiskup <praiskup@redhat.com> 41.5-1
changelog:
  - Fedora 39 EOL
  - fix openSUSE-tumbleweed update failure during the second build (duli4868@gmail.com)
  - use non development bootstrap image for CentOS Stream 10 (romain.geissler@amadeus.com)
  - remove ELN ResilientStorage repos (yselkowi@redhat.com)
  - update ELN bootstrap image (yselkowi@redhat.com)
  - Add epel and epel-testing repos to the EPEL 10 config (carlwgeorge@gmail.com)


author: Miroslav Suchý <msuchy@redhat.com> 42.2-1
changelog:
  - fix: expand Oracle Linux distro_id from ol to oraclelinux
    (avi.miller@oracle.com)
  - Navy Linux 8 configuration fixes (adil@linux.com)
  - EuroLinux end-of-life (praiskup@redhat.com)
  - bugfix: upgrade openeuler chroots to latest release and fix gpg check failed
    in 20.03 (pkwarcraft@gmail.com)
  - Add Azure Linux 3 configuration (negativo17@gmail.com)
  - Add Azure Linux 2 configuration (negativo17@gmail.com)
  - Add Kylin 10 configuration files (negativo17@gmail.com)
  - Add AlmaLinux Kitten 10 + EPEL 10 configs (ngompa@almalinux.org)
  - Add AlmaLinux Kitten 10 configs (ngompa@almalinux.org)
  - Add openSUSE Leap 15.6, move openSUSE Leap 15.5 to eol (negativo17@gmail.com)


author: Pavel Raiskup <praiskup@redhat.com> 42.3-1
changelog:
  - Fedora 40 EOL
  - Add RHEL 10 template and configs (carlwgeorge@gmail.com)
  - disable copying ca-trust dirs with Azure Linux 3 (reubeno@users.noreply.github.com)
  - Add epel-z-10 template (carlwgeorge@gmail.com)
  - Update Azure Linux configurations (scaronni@nvidia.com)
  - make opensuse-leap-15.5.tpl eol
  - fix the leap image reference to 15.6


author: Pavel Raiskup <praiskup@redhat.com> 42.4-1
changelog:
  - fix sysusers packaging practice once more
  - configuration file owned by `root:root`
  - Rocky Linux 10 configs added (label@rockylinux.org)
  - missing config for AlmaLinux Kitten x86_64_v2 added (jhernandez@cloudlinux.com)
  - config for AlmaLinux Kitten 10 x86_64_v2 added (jonathan@almalinux.org)
  - AlmaLinux 10 configs added (jonathan@almalinux.org)


author: Mat Booth <mat.booth@redhat.com> - 2.23.9-1
changelog:
  - Update to latest upstream version
  - Switch to maven build system using a custom pom to avoid a dep on gradle


author: Roman Kennke <rkennke@redhat.com> 1.9.0-2
changelog:
  - Include upstream Maven pom.xml in package
  - Added missing Requires for cglib, junit4, hamcrest, objenesis
  - Added source tarball generating script to sources


author: Roman Kennke <rkennke@redhat.com> 1.9.0-4
changelog:
  - Fix groupId of cglib dependency
  - Add additional depmap for mockito-all
  - Update depmap on post and postun
  - Fix version in pom


author: Roman Kennke <rkennke@redhat.com> 1.9.0-6
changelog:
  - Place JavaDoc in directly under %{_javadocdir}/%{name} instead
    of %{_javadocdir}/%{name}/javadoc


author: Severin Gehwolf <sgehwolf@redhat.com> 1.9.0-10
changelog:
  - More Import-Package fixes. Note that fix-cglib-refs.patch is
    not suitable for upstream: issue id=373


author: Omair Majid <omajid@redhat.com> - 1.9.0-17
changelog:
  - Use .mfiles to pick up xmvn metadata
  - Don't use obsolete _mavenpomdir and _mavendepmapfragdir macros
  - Fix FTBFS


author: Mat Booth <mat.booth@redhat.com> - 1.10.19-10
changelog:
  - Explicitly import more cglib packages in OSGi metadata to prevent mockito
    failing under certain circumstances during Eclipse test suites


author: Tania Bento <tbento@redhat.com> 0:1.0-0.1.a8.4jpp.1
changelog:
  - Fixed %Release.
  - Fixed %License.
  - Fixed %BuildRoot.
  - Removed %Vendor.
  - Removed %Distribution.
  - Defined _with_gcj_support and gcj_support.
  - Fixed instructions on how to generate the source drop.


author: Matt Wringe <mwringe@redhat.com> 0:1.0-0.1.a8.4jpp.2
changelog:
  - Change license to MIT to reflex the actual license specified in the
    source headers.
  - fix various rpmlint issues


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:1.4-3
changelog:
  - Fix pom filenames (remove poms of integration tests) Resolves rhbz#655818
  - Use jpackage_script macro to generate script


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.5-5
changelog:
  - Add JPP depmap for maven-project to override versionless depmap
  - Add missing BR/R: maven-project
  - Remove unneeded BR: jpa_api


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.7-2
changelog:
  - Build with xmvn
  - Use better description
  - Simplify build-requires
  - Update to current packaging guidelines


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-1
changelog:
  - Import into RHEL
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jan Vcelak <jvcelak@fedoraproject.org>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jeff Law <law@redhat.com>
        Lukas Zachar <lzachar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Tom Stellard <tstellar@redhat.com>


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-3
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: Jarod Wilson <jarod@redhat.com> - 3.2.1-8
changelog:
  - Remove python2 bits entirely, fix mpi lib dependencies
  - Remove obsolete Provides/Obsoletes for mpich2
  - Resolves: rhbz#1628628


author: Honggang Li <honli@redhat.com> - 3.3.2-8
changelog:
  - Sync with Fedora build
  - Update to latest upstream release 3.3.2
  - Resolves: rhbz#1657316, rhbz#1732982, rhbz#1850080


author: Jan Grulich <jgrulich@redhat.com> - 3.32.2-72
changelog:
  - Do not use DMA buffers for screencast when the client doesn't support it
  - Use DMA buffers only for i195 drivers
    Resolves: RHEL-4405


author: Michael Simacek <msimacek@redhat.com> - 2.13.02-1
changelog:
  - Update to upstream version 2.13.02
  - Resolves: CVE-2017-17810, CVE-2017-17811, CVE-2017-17812, CVE-2017-17813,
    CVE-2017-17814, CVE-2017-17815, CVE-2017-17816, CVE-2017-17817,
    CVE-2017-17818, CVE-2017-17819, CVE-2017-17820


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-5.20180224
changelog:
  - fix crash in parsing of terminfo use capability (CVE-2018-10754)
  - add gcc-c++ to build requirements


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-8.20180224
changelog:
  - fix buffer overflow in terminfo entry hashtable (CVE-2019-17594)
  - handle missing character after backslash in terminfo entry (CVE-2019-17595)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-27
changelog:
  - fix memory leak due of proc file creating (#2105957)
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
  - fix memory leak when ipv6 disable set to 1 (#2151537)
  - fix proxy timeout issue (#2160723)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-30
changelog:
  - fix crash when configured as proxy - issue 82 (RHEL-14454)
  - log once truncating issue (RHEL-13597)
  - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808,
    CVE-2022-24809 and CVE-2022-24810 (RHEL-26650)


author: Erik Troan <ewt@redhat.com>
changelog:
  - added a patch to use our own route.h, rather then glibc's (which has
    alignment problems on Alpha's) -- I only applied this patch on the Alpha,
    though it should be safe everywhere


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated to ppp-2.3.3, build against glibc-2.0.6 - previous patches not
    required any more.
  - added buildroot
  - fixed the PAM support, which was really, completely broken and against any
    standards (session support is still not here... :-( )
  - we build against running kernel and pray that it will work
  - added a samples patch; updated glibc patch


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - New version 2.3.9 required for kernel 2.3.13 and will be required
    for new initscripts.  auth patch removed; 2.3.9 does the same thing
    more readably than the previous patch.


author: Nalin Dahyabhai <nalin@redhat.com> 2.4.1-2
changelog:
  - add buildprereq on pam-devel (#49559)
  - add patch to respond to CBCP LCP requests (#15738)
  - enable cbcp support at build-time
  - change the Copyright: tag to a License: tag


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - add patch:
  	* Thu Jun 06 2002 Phil Knirsch <pknirsch@redhat.com>
  	- Fixed varargs problem for s390/s390x.


author: Thomas Woerner <twoerner@redhat.com> 2.4.2-5
changelog:
  - example scripts are using change_resolv_conf to modify /etc/resolv.conf
    (#132482)
  - require new libpcap library (>= 0.8.3-6) with a fix for inbound/outbound
    filter processing
  - not using internal libpcap structures anymore, fixes inbound/outbound
    filter processing (#128053)


author: David Woodhouse <dwmw2@redhat.com> 2.4.2-6.2
changelog:
  - Link pppoatm plugin against libresolv.
  - Revert to linux-atm headers without the workaround for #127098


author: Thomas Woerner <twoerner@redhat.com> 2.4.3-1
changelog:
  - new version 2.4.3
    - updated patches: make, lib64, dontwriteetc, fix, fix64, no_strip,
      radiusplugin
    - dropped patches: bpf, signal, pcap, pppoatm, pkgcheck


author: Thomas Woerner <twoerner@redhat.com> 2.4.3-2
changelog:
  - dropped all executable bits in scripts directory to prevent rpm requiring
    programs used in there


author: Thomas Woerner <twoerner@redhat.com> 2.4.4-1
changelog:
  - new version 2.4.4 with lots of fixes
  - fixed reesolv.conf docs (#165072)
    Thanks to Matt Domsch for the initial patch
  - enabled CBCP (#199278)


author: Martin Nagy <mnagy@redhat.com> 2.4.4-6
changelog:
  - call closelog earlier (#222295)
  - fix ChapMS2 (#217076)
  - moving header files to new -devel package (#203542)


author: Jiri Skala <jskala@redhat.com> - 2.4.4-14
changelog:
  - fixed #519042 - ppp package is missing URL in spec
  - fixed #524575 - ppp: no_strip patch modifies backup files created by previous patches


author: Jiri Skala <jskala@redhat.com> - 2.4.5-10
changelog:
  - fixes #613717 - Missing line in example script ip-up.local.add
  - removed /usr/kerberos/include from eaptls patch


author: Jiri Skala <jskala@redhat.com> - 2.4.5-12
changelog:
  - fixes #637513 - Missing: README.eap-tls
  - updated to latest eaptls upstream
  - fixes #637886 - EAP-TLS not working with enabled PPP Multilink Framing option


author: Jiri Skala <jskala@redhat.com> - 2.4.5-18
changelog:
  - fixes #682381 - hardcodes eth0
  - fixes #708260 - SELinux is preventing access on the file LCK..ttyUSB3


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-32
changelog:
  - don't ship /var/lock/ppp in rpm payload and create it in %post instead
  - fix installation of tmpfiles.d configuration
  - enable hardened build
  - fix bogus dates in changelog
  - compile all binaries with hardening flags


author: Michal Sekletar <msekleta@redhat.com> - 2.4.7-7
changelog:
  - prevent running into issues caused by undefined behavior (pointers of incompatible types aliasing the same object)


author: Phil Sutter <psutter@redhat.com> [0.9.3-22.el8]
changelog:
  - json: Drop pointless assignment in exthdr_expr_json() (Phil Sutter) [1999059]
  - parser_json: Fix for memleak in tcp option error path (Phil Sutter) [1999059]
  - parser_bison: Fix for implicit declaration of isalnum (Phil Sutter) [1999059]
  - parser_json: Fix error reporting for invalid syntax (Phil Sutter) [1994141]


author: Phil Sutter <psutter@redhat.com> [0.9.3-23.el8]
changelog:
  - tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set") (Phil Sutter) [1908127]
  - segtree: Fix segfault when restoring a huge interval set (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-24.el8]
changelog:
  - tests: shell: better parameters for the interval stack overflow test (Phil Sutter) [1908127]
  - tests: shell: $NFT needs to be invoked unquoted (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-25.el8]
changelog:
  - mnl: do not build nftnl_set element list (Phil Sutter) [2047821]
  - tests: py: add dnat to port without defining destination address (Phil Sutter) [2030773]
  - evaluate: fix inet nat with no layer 3 info (Phil Sutter) [2030773]
  - evaluate: attempt to set_eval flag if dynamic updates requested (Phil Sutter) [2039594]
  - src: support for restoring element counters (Phil Sutter) [2039594]
  - netlink: remove unused parameter from netlink_gen_stmt_stateful() (Phil Sutter) [2039594]


author: Phil Sutter <psutter@redhat.com> [0.9.3-26.el8]
changelog:
  - libnftables: call nft_cmd_expand() only with CMD_ADD (Phil Sutter) [2073287]
  - src: add CMD_OBJ_SETELEMS (Phil Sutter) [2073287]
  - src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTS (Phil Sutter) [2073287]
  - rule: fix element cache update in __do_add_setelems() (Phil Sutter) [2073287]
  - rule: memleak in __do_add_setelems() (Phil Sutter) [2073287]
  - tests: shell: auto-removal of chain hook on netns removal (Phil Sutter) [2070924]
  - mnl: do not use expr->identifier to fetch device name (Phil Sutter) [2070924]


author: Phil Sutter <psutter@redhat.com> [1.0.4-1.el8]
changelog:
  - Synchronize patch level with nftables-1.0.4-10.el9 (Phil Sutter) [2211076]
  - Rebase onto version 1.0.4 (Phil Sutter) [2211076]


author: Phil Sutter <psutter@redhat.com> [1.0.4-2.el8]
changelog:
  - Add expected error records for testsuite runs (Phil Sutter) [2211076]
  - tests: monitor: Summarize failures per test case (Phil Sutter) [2211076]


author: Phil Sutter <psutter@redhat.com> [1.0.4-3.el8]
changelog:
  - spec: Rename variables to avoid a clash (Phil Sutter) [INTERNAL]
  - rule: check address family in set collapse (Phil Sutter) [RHEL-5160]


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180)
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13
changelog:
  - User no longer prompted for a password when listing keys an empty system db (#527048)
  - Fix setup-nsssysinit to handle more general formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13.1
changelog:
  - Require nss-softoken of same architecture as nss (#527867)
  - Merge setup-nsssysinit.sh improvements from F-12 (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1
changelog:
  - Update to 3.12.5
  - Patch to allow ssl/tls clients to interoperate with servers that require renogiation


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.5
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Remove redundant header from the pem module


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.6
changelog:
  - Fix nsssysinit to enable apps to use system cert store, patch contributed by David Woodhouse (#546221)
  - Fix spec so sysinit requires coreutils for post install scriplet (#547067)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-1.1
changelog:
  - Using SSL_RENEGOTIATE_TRANSITIONAL as default while on transition period
  - Disabling ssl tests suites until bug 539183 is resolved


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-3
changelog:
  - Add sed to sysinit requires as setup-nsssysinit.sh requires it (#576071)
  - Update PayPalEE test cert with unexpired one (#580207)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Update pem source tar to pick up the following bug fixes:
  - PEM - Allow collect objects to search through all objects
  - PEM - Make CopyObject return a new shallow copy
  - PEM - Fix memory leak in pem_mdCryptoOperationRSAPriv


author: Elio Maldonado <emaldona@redhat.com> - 3.12.7-2
changelog:
  - Define NSS_USE_SYSTEM_SQLITE and remove unneeded patch
  - Add comments regarding an unversioned provides which triggers rpmlint warning
  - Build requires nss-softokn-devel >= 3.12.7


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Prevent disabling of nss-sysinit on package upgrade (#636787)
  - Create pkcs11.txt with correct permissions regardless of umask (#636792)
  - Setup-nsssysinit.sh reports whether nss-sysinit is turned on or off (#636801)
  - Added provides pkcs11-devel-static to comply with packaging guidelines (#609612)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-3
changelog:
  - Replace posttrans sysinit scriptlet with a triggerpostun one (#636787)
  - Fix and cleanup the setup-nsssysinit.sh script (#636792, #636801)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8.99.2-1
changelog:
  - Update to NSS_3_12_9_BETA2
  - Fix libpnsspem crash when cacert dir contains other directories (#642433)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-5
changelog:
  - Fix the earlier infinite recursion patch (#499444)
  - Remove a header that now nss-softokn-freebl-devel ships


author: Christopher Aillon <caillon@redhat.com> - 3.12.9-6
changelog:
  - Revert patches for 499444 as they use a C++ reserved word and
    cause compilation of Firefox to fail


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-10
changelog:
  - Fix cms headers to not use c++ reserved words (#676036)
  - Reenabling Bug 499444 patches
  - Fix to swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.10-4
changelog:
  - Enable pluggable ecc support (#712556)
  - Disable the nssdb write-access-on-read-only-dir tests when user is root (#646045)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.11-3
changelog:
  - Fix attempt to free initilized pointer (#717338)
  - Fix leak on pem_CreateObject when given non-existing file name (#734760)
  - Fix pem_Initialize to return CKR_CANT_LOCK on multi-treaded calls (#736410)


author: Elio Maldonado Batiz <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Rebuild with nss-softokn from 3.12 in the buildroot
  - Allows the pem module to statically link against 3.12.x freebl
  - Required for using nss-3.13.x with nss-softokn-3.12.y for a merge inrto rhel git repo
  - Build will be temprarily placed on buildroot override but not pushed in bodhi


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-5
changelog:
  - Statically link the pem module against system freebl found in buildroot
  - Disabling sha224-related powerup selftest until we update softokn
  - Disable sha224 and pss tests which nss-softokn 3.12.x doesn't support


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-6
changelog:
  - Removed unwanted /usr/include/nss3 in front of the normal cflags include path
  - Removed unnecessary patch dealing with CERTDB_TERMINAL_RECORD, it's visible


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-7
changelog:
  - Resolves: Bug 750376 - nss 3.13 breaks sssd TLS
  - Fix how pem is built so that nss-3.13.x works with nss-softokn-3.12.y
  - Only patch blapitest for the lack of sha224 on system freebl
  - Completed the patch to make pem link against system freebl


author: elio maldonado <emaldona@redhat.com> - 3.13.1-9
changelog:
  - Revert to using current nss_softokn_version
  - Patch to deal with lack of sha224 is no longer needed


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-10
changelog:
  - Resolves: Bug 770682 - nss update breaks pidgin-sipe connectivity
  - NSS_SSL_CBC_RANDOM_IV set to 0 by default and changed to 1 on user request


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Pick up fixes from RHEL
  - Resolves: rhbz#800674 - Unable to contact LDAP Server during winsync
  - Resolves: rhbz#800682 - Qpid AMQP daemon fails to load after nss update
  - Resolves: rhbz#800676 - NSS workaround for freebl bug that causes openswan to drop connections


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-1
changelog:
  - Update to NSS_3_13_4_RTM
  - Update the nss-pem source archive to the latest version
  - Remove no longer needed patches
  - Resolves: Bug 806043 - use pem files interchangeably in a single process
  - Resolves: Bug 806051 - PEM various flaws detected by Coverity
  - Resolves: Bug 806058 - PEM pem_CreateObject leaks memory given a non-existing file name


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-2
changelog:
  - Resolves: Bug 805723 - Library needs partial RELRO support added
  - Patch coreconf/Linux.mk as done on RHEL 6.2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-4
changelog:
  - Resolves: Bug 830410 - Missing Requires %{?_isa}
  - Use Requires: %{name}%{?_isa} = %{version}-%{release} on tools
  - Drop zlib requires which rpmlint reports as error E: explicit-lib-dependency zlib
  - Enable sha224 portion of powerup selftest when running test suites
  - Require nspr 4.9.1


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-8
changelog:
  - Rebase pem sources to fedora-hosted upstream to pick up two fixes from rhel-6.3
  - Resolves: rhbz#847460 - Fix invalid read and free on invalid cert load
  - Resolves: rhbz#847462 - PEM module may attempt to free uninitialized pointer
  - Remove unneeded fix gcc 4.7 c++ issue in secmodt.h that actually undoes the upstream fix


author: Elio Maldonado <emaldona@redhat.com> - 3.14-0.1.rc.1
changelog:
  - Update to NSS_3_14_RC1
  - update nss-589636.patch to apply to httpdserv
  - turn off ocsp tests for now
  - remove no longer needed patches
  - remove headers shipped by nss-util


author: Elio Maldonado <emaldona@redhat.com> - 3.14-2
changelog:
  - Add secmodt.h to the headers installed by nss-devel
  - nss-devel must install secmodt.h which moved from softoken to pk11wrap with nss-3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-5
changelog:
  - Fix the spec file so sechash.h gets installed
  - Resolves: rhbz#871882 - missing header: sechash.h in nss 3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-6
changelog:
  - Fix a previous unwanted merge from f18
  - Update the SS_SSL_CBC_RANDOM_IV patch to match new sources while
  - Keeping the patch disabled while we are still in rawhide and
  - State in comment that patch is needed for both stable and beta branches
  - Update .gitignore to download only the new sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-7
changelog:
  - Add a dummy source file for testing /preventing fedpkg breakage
  - Helps test the fedpkg new-sources and upload commands for breakage by nss updates
  - Related to Bug 872124 - nss 3.14 breaks fedpkg new-sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-8
changelog:
  - Fix pk11wrap locking which fixes 'fedpkg new-sources' and 'fedpkg update' hangs
  - Bug 872124 - nss-3.14 breaks fedpkg new-sources
  - Fix should be considered preliminary since the patch may change upon upstream approval


author: Elio Maldonado <emaldona@redhat.com> - 3.14-9
changelog:
  - Disable bypass code at build time and return failure on attempts to enable at runtime
  - Bug 806588 - Disable SSL PKCS #11 bypass at build time


author: Elio Maldonado <emaldona@redhat.com> - 3.14-11
changelog:
  - Bug 879978 - Install the nssck.api header template in a place where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3


author: Elio Maldonado <emaldona@redhat.com> - 3.14-12
changelog:
  - Bug 879978 - Install the nssck.api header template where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3/templates


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - sync up pem rsawrapr.c with softoken upstream changes for nss-3.14.3
  - Resolves: rhbz#908257 - CVE-2013-1620 nss: TLS CBC padding timing attack
  - Resolves: rhbz#896651 - PEM module trashes private keys if login fails
  - Resolves: rhbz#909775 - specfile support for AArch64
  - Resolves: rhbz#910584 - certutil -a does not produce ASCII output


author: Kai Engert <kaie@redhat.com> - 3.14.3-9
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta1.1
changelog:
  - Update to NSS_3_15_BETA1
  - Update spec file, patches, and helper scripts on account of a shallower source tree


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta1.2
changelog:
  - Fix incorrect path that hid failed test from view
  - Add ocsp to the test suites to run but ...
  - Temporarily disable the ocsp stapling tests
  - Do not treat failed attempts at ssl pkcs11 bypass as fatal errors


author: Elio Maldonado <emaldona@redhat.com> - 3.15-5
changelog:
  - Install man pages for nss-tools and the nss-config and setup-nsssysinit scripts
  - Resolves: rhbz#606020 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Fix errors in the man pages
  - Resolves: rhbz#984106 - Add missing option descriptions to man pages for {cert|cms|crl}util
  - Resolves: rhbz#982856 - Fix path to script in man page for nss-sysinit


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Add man page for pkcs11.txt configuration file and cert and key databases
  - Resolves: rhbz#985114 - Provide man pages for the nss configuration files


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Cleanup spec file to address most rpmlint errors and warnings
  - Using double percent symbols to fix macro-in-comment warnings
  - Ignore unversioned-explicit-provides nss-system-init per spec comments
  - Ignore invalid-url Source0 as it comes from the git lookaside cache
  - Ignore invalid-url Source12 as it comes from the git lookaside cache


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-5
changelog:
  - Resolves: rhbz#996639 - Minor bugs in nss man pages
  - Fix some typos and improve description and see also sections


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-7
changelog:
  - Update pem sources to pick up a patch applied upstream which a faulty merge had missed
  - The pem module should not require unique file basenames


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
  - Update to NSS_3_15_2_RTM
  - Update iquote.patch on account of modified prototype on cert.h installed by nss-devel


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-2
changelog:
  - Use the full sources from upstream
  - Bug 1019245 - ECDHE in openssl available -> NSS needs too for Firefox/Thunderbird


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-1
changelog:
  - Update to NSS_3_15_3_RTM
  - Resolves: Bug 1031897 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws
  - Fix option descriptions for setup-nsssysinit manpage
  - Fix man page of nss-sysinit wrong path and other flaws
  - Document email option for certutil manpage
  - Remove unused patches


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3.1-1
changelog:
  - Update to nss-3.15.3.1 (hg tag NSS_3_15_3_1_RTM)
  - Resolves: Bug 1040282 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117)
  - Resolves: Bug 1040192 - nss-3.15.3.1 is available


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-1
changelog:
  - Update to nss-3.15.4 (hg tag NSS_3_15_4_RTM)
  - Resolves: Bug 1049229 - nss-3.15.4 is available
  - Update pem sources to latest from the interim upstream for pem
  - Remove no longer needed patches
  - Update pem/rsawrapr.c patch on account of upstream changes to freebl/softoken
  - Update iquote.patch on account of upstream changes


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-3
changelog:
  - Update pem sources to latest from nss-pem upstream
  - Pick up pem fixes verified on RHEL and applied upstream
  - Fix a problem where same files in two rpms created rpm conflict
  - Move some nss-sysinit manpages tar archives to the %files the
  - All man pages are listed by name so there shouldn't be wildcard inclusion
  - Add support for ppc64le, Resolves: Bug 1052545


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-5
changelog:
  - Revert previous change that moved some sysinit manpages
  - Restore nss-sysinit manpages tar archives to %files sysinit
  - Removing spurious wildcard entry was the only change needed


author: Elio Maldonado <emaldona@redhat.com> - 3.15.5-1
changelog:
  - Update to nss-3.15.5
  - Temporarily requiring only nss_softokn_version >= 3.15.4
  - Fix location of sharedb files and their manpages
  - Move cert9.db, key4.db, and pkcs11.txt to the main package
  - Move nss-sysinit manpages tar archives to the main package
  - Resolves: Bug 1066877 - nss-3.15.5 is available
  - Resolves: Bug 1067091 - Move sharedb files to the %files section


author: Elio Maldonado <emaldona@redhat.com> - 3.16.0-1
changelog:
  - Update to nss-3.16.0
  - Cleanup the copying of the tools man pages
  - Update the iquote.patch on account of the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-1
changelog:
  - Update to nss-3.16.1
  - Update the iquote patch on account of the rebase
  - Improve error detection in the %section
  - Resolves: Bug 1094702 - nss-3.16.1 is available


author: Jaromir Capik <jcapik@redhat.com> - 3.16.1-2
changelog:
  - Replacing ppc64 and ppc64le with the power64 macro
  - Related: Bug 1052545 - Trivial change for ppc64le in nss spec


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-4
changelog:
  - Remove unwanted source directories at end of %prep so it truly does it
  - Skip the cipher suite already run as part of the nss-softokn build


author: Elio Maldonado <emaldona@redhat.com> - 3.17.3-2
changelog:
  - Install pp man page in alternative location
  - Resolves: Bug 987189 - nss-tools RPM conflicts with perl-PAR-Packer


author: Elio Maldonado <emaldona@redhat.com> - 3.17.3-3
changelog:
  - Resolves: Bug 987189 - nss-tools RPM conflicts with perl-PAR-Packer
  - Install pp man page in %{_datadir}/doc/nss-tools/pp.1
  - Use %{_mandir} instead of /usr/share/man as more generic


author: Elio Maldonado <emaldona@redhat.com> - 3.17.4-2
changelog:
  - Disable SSL2 support at build time
  - Fix syntax errors in various shell scripts
  - Resolves: Bug 1189952 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.17.4-3
changelog:
  - Commented out the export NSS_NO_SSL2=1 line to not disable ssl2
  - Backing out from disabling ssl2 until the patches are fixed


author: Elio Maldonado <emaldona@redhat.com> - 3.17.4-5
changelog:
  - Disable export suites and SSL2 support at build time
  - Fix syntax errors in various shell scripts
  - Resolves: Bug 1189952 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.19.2-3
changelog:
  - Create on the fly versions of sslcov.txt and sslstress.txt that disable tests for SSL2 and EXPORT ciphers


author: Elio Maldonado <emaldona@redhat.com> - 3.20.0-3
changelog:
  - Fix patches that disable ssl2 and export cipher suites support
  - Fix libssl patch that disable ssl2 & export cipher suites to not disable RSA_WITH_NULL ciphers
  - Fix syntax errors in patch to skip ssl2 and export cipher suite tests
  - Turn ssl2 off by default in the tstclnt tool
  - Disable ssl stress tests containing TLS RC4 128 with MD5


author: Elio Maldonado <emaldona@redhat.com> - 3.20.0-5
changelog:
  - Enable ECC cipher-suites by default [hrbz#1185708]
  - Implement corrections requested in code review


author: Elio Maldonado <emaldona@redhat.com> - 3.20.0-6
changelog:
  - Enable ECC cipher-suites by default [hrbz#1185708]
  - Split the enabling patch in two for easier maintenance
  - Remove unused patches rendered obsolete by prior rebase


author: Elio Maldonado Batiz <emaldona@redhat.com> - 3.21.1-2
changelog:
  - Update to NSS 3.21
  - Package listsuites as part of the unsupported tools set
  - Resolves: Bug 1279912 - nss-3.21 is available
  - Resolves: Bug 1258425 - Use __isa_bits macro instead of list of 64-bit
  - Resolves: Bug 1280032 - Package listsuites as part of the nss unsupported tools set


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-4
changelog:
  - Update %{nss_util_version} and %{nss_softokn_version} to 3.21.0
  - Resolves: Bug 1284095 - all https fails with sec_error_no_token


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-6
changelog:
  - Resolves: Bug 1299040 - Enable ssl_gtests upstream test suite
  - Remove 'export NSS_DISABLE_GTESTS=1' go ssl_gtests are built
  - Use %define when specifying the nss_tests to run


author: Elio Maldonado <emaldona@redhat.com> - 3.23.0-3
changelog:
  - Update pem sources to latest from nss-pem upstream
  - Resolves: Bug 1300652 - [PEM] insufficient input validity checking while loading a private key


author: Elio Maldonado <emaldona@redhat.com> - 3.23.0-5
changelog:
  - Load policy file if /etc/pki/nssdb/policy.cfg exists
  - Resolves: Bug 1157720 - NSS should enforce the system-wide crypto policy


author: Elio Maldonado <emaldona@redhat.com> - 3.23.0-7
changelog:
  - Change the POLICY_PATH to "/etc/crypto-policies/back-ends"
  - Regenerate the check policy patch with hg to provide more context


author: Elio Maldonado <emaldona@redhat.com> - 3.24.0-2.1
changelog:
  - Rebase to NSS 3.24.0
  - Restore setting the policy file location
  - Make ssl tests scripts aware of policy
  - Ajust tests data expected result for policy


author: Elio Maldonado <emaldona@redhat.com> - 3.24.0-2.2
changelog:
  - Allow application requests to disable SSL v2 to succeed
  - Resolves: Bug 1342158 - nss-3.24 does no longer support ssl V2, installation of IPA fails because nss init fails


author: Elio Maldonado <emaldona@redhat.com> - 3.24.0-2.3
changelog:
  - Apply the patch that was last introduced
  - Renumber and reorder some of the patches
  - Resolves: Bug 1342158


author: Elio Maldonado <emaldona@redhat.com> - 3.25.0-5
changelog:
  - Add support for conditionally ignoring the system policy (#1157720)
  - Remove unneeded test scripts patches in order to run more tests
  - Remove unneeded test data modifications from the spec file


author: Daiki Ueno <dueno@redhat.com> - 3.26.0-2
changelog:
  - Rebase to NSS 3.26.0
  - Update check policy file patch to better match what was upstreamed
  - Remove conditionally ignore system policy patch as it has been upstreamed
  - Skip ectest as well as ecperf, which are built as part of nss-softokn
  - Fix rpmlint error regarding %define usage


author: Daiki Ueno <dueno@redhat.com> - 3.28.1-4
changelog:
  - Add "Conflicts" with older firefox packages which don't have support
    for smaller curves added in NSS 3.28.1


author: Daiki Ueno <dueno@redhat.com> - 3.28.1-5
changelog:
  - Disable TLS 1.3
  - Add "Conflicts" with packages using older Mozilla codebase, which is
    not compatible with NSS 3.28.1
  - Remove NSS_ECC_MORE_THAN_SUITE_B setting, as it was removed in upstream


author: Daiki Ueno <dueno@redhat.com> - 3.31.0-3
changelog:
  - Move signtool to %_libdir/nss/unsupported-tools, for:
    https://fedoraproject.org/wiki/Changes/NSSSigntoolDeprecation


author: Kai Engert <kaie@redhat.com> - 3.33.0-4
changelog:
  - Update tests to be compatible with default NSS DB changed to sql
    (the default was changed in the nss-util package).


author: Daiki Ueno <dueno@redhat.com> - 3.33.0-6
changelog:
  - Make sure 32bit nss-pem always be installed with 32bit nss in
    multlib environment, patch by Kamil Dudka


author: Kai Engert <kaie@redhat.com> - 3.35.0-4
changelog:
  - Fix a compiler error with gcc 8, mozbz#1434070
  - Set NSS_FORCE_FIPS=1 at %build time, and remove from %check.


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-1.0
changelog:
  - Update to NSS 3.36.0
  - Add gcc-c++ to BuildRequires (C++ is needed for gtests)
  - Make test failure detection robuster


author: Daiki Ueno <dueno@redhat.com> - 3.36.1-1.0
changelog:
  - Update to NSS 3.36.1
  - Remove nss-3.14.0.0-disble-ocsp-test.patch
  - Fix partial injection of LDFLAGS
  - Remove NSS_NO_PKCS11_BYPASS, which is no-op in upstream


author: Kai Engert <kaie@redhat.com> - 3.36.1-1.2
changelog:
  - Backport upstream addition of nss-policy-check utility, rhbz#1428746,
    includes required fixes for mozbz#1296263 and mozbz#1474875


author: Daiki Ueno <dueno@redhat.com> - 3.38.0-1.1
changelog:
  - Install crypto-policies configuration file for
    https://fedoraproject.org/wiki/Changes/NSSLoadP11KitModules
  - Port enable-fips-when-system-is-in-fips-mode.patch from RHEL-7
  - Use %ldconfig_scriptlets
  - Remove needless use of %defattr, by Jason Tibbitts


author: Daiki Ueno <dueno@redhat.com> - 3.39.0-1.2
changelog:
  - Update nss-dsa.patch to not advertise DSA signature algorithm
  - Update PayPal test certs for testing


author: Daiki Ueno <dueno@redhat.com> - 3.39.0-1.3
changelog:
  - Backport upstream fixes for rhbz#1649026, rhbz#1608895, rhbz#1644854
  - Document PKCS #11 URI
  - Add warning when adding module with modutil while p11-kit is enabled


author: Bob Relyea <rrelyea@redhat.com> - 3.39.0-1.4
changelog:
  - Support for IKE/IPsec typical PKIX usage so libreswan can use nss
    without rejecting certs based on EKU


author: Daiki Ueno <dueno@redhat.com> - 3.41.0-3
changelog:
  - Fix the last change
  - Add --no-reload option to update-crypto-policies to avoid
    unnecessary restart of daemons


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-1
changelog:
  - Update to NSS 3.44
  - Define NSS_SEED_ONLY_DEV_URANDOM=1 to exclusively use getentropy
  - Use %autosetup
  - Clean up manual pages generation
  - Clean up %check
  - Remove prelink dependency, which is not available in RHEL-8
  - Remove upstreamed patches


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
  - Disable TLS 1.3 under FIPS mode
  - Disable RSASSA-PKCS1-v1_5 in TLS 1.3
  - Fix post-handshake auth transcript calculation if
    SSL_ENABLE_SESSION_TICKETS is set
  - Revert the change to use XDG basedirs (mozilla#818686)


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-6
changelog:
  - Add continuous RNG test required by FIPS
  - fipstest: use CKM_TLS12_MASTER_KEY_DERIVE instead of vendor specific mechanism


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-8
changelog:
  - CKM_NSS_IKE1_APP_B_PRF_DERIVE was missing from the mechanism list, preventing
    PK11_Derive*() from using it. Add gtests for the PK11_Derive interface for
    all the CKM_NSS_IKE*_DERIVE mechanism.


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-12
changelog:
  - Install cmac.h required by blapi.h (#1764513)
  - Fix out-of-bounds write in NSC_EncryptUpdate (#1775913)


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-2
changelog:
  - Fix regression in MD5 disablement (#1849938)
  - Include rsa_pkcs1_* in signature_algorithms extension (#1847945)


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-3
changelog:
  - Disable NSS_HASH_ALG_SUPPORT as well for MD5 (#1849938)
  - Adjust for update-crypto-policies packaging change (#1848649)
  - Fix compilation with -Werror=strict-prototypes (#1843417)


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-7
changelog:
  - Fix attribute decryption issue where the private key components
    integrity check on private attributes where not being checked.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-11
changelog:
  - Fix issue with upgradedb where upgradedb expects standard to
    generate dbm databases, not sql databases (default in RHEL8)


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-12
changelog:
  - fips need to reject small primes even if they are approved
  - code to autodetect whether or not to use the cache needs to do so
    in a way that doesn't mess with filesystem negative file caching.
  - add kdf selftests


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-14
changelog:
  - Add support for enable/disable in policy. Now if your policy
    file has disallow=x enable=y it will act just like our other 
    libraries.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-16
changelog:
  - Fix the following CVE
  - CVE-2020-12403 chacha-poly issues
  - CVE-2020-12400 constant time ECC.
  - CVE-2020-6829  constant time ECC.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-4
changelog:
  - Better fix for the sdb timeout. The issue wasn't a race, it was
    the sqlite timeout waiting to begin a transaction under heavy
    thread usage.


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
changelog:
  - Rebase to NSS 3.79
  - Set FIPS Module ID
  - skip attribute verification on attributes with default values
  - don't export trust objects if they are default trust objects from dbm
  - add dbtool to nss-tools


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-5
changelog:
  - FIPS 140-3 changes
  -  Reject Small RSA keys, 1024 bit keys are marked as FIP OK when verifying, reject
     signature keys by policy
  -  Allow applications to retrigger selftests on demand.


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-8
changelog:
  - Update fips default for pk12util to AES rather than TDES
  - Fix bug in pkcs12 files with null passwords


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-10
changelog:
  - Fix QA found failures:
  -  remove extra '+' from sslpolicy.txt file causing test error values
  -  only use GRND_RANDOM if the kernel is in FIPS mode.


author: Bob Relyea <rrelyea@redhat.com> - 3.90.0-4
changelog:
  - FIPS review changes
  -   add PORT_SafeZero to avoid compiler optimizing a way zeroing memory.
  -   update the indicators for this release
  -   allow hashing of longer than int32 values in a single PKCS #11 call.


author: Bob Relyea <rrelyea@redhat.com> - 3.90.0-5
changelog:
  - Pick up validated constant time implementations of p256, p384, and p521
    from upsream
  - More Fips indicator changes


author: Bob Relyea <rrelyea@redhat.com> - 3.101.0-2
changelog:
  - Fix MD-5 decode issue in pkcs #12
  - turn off policy processing for pkcs12 and smime
  - update the restore defaults for pkcs12


author: Bob Relyea <rrelyea@redhat.com> - 3.101.0-6
changelog:
  - fix param encoding in pkcs12 pbamac encoding
  - add support for certificate compression in selfserv and tstclient


author: Bob Relyea <rrelyea@redhat.com> - 3.112.0-3
changelog:
  - restore CONCATENATE functions accidentally remvoed in the last patch
  - fix big endian issue in tstclnt and selfserv in certificate compression


author: Ralph Apel <r.apel@r-apel.de> - 0:3.1-3jpp
changelog:
  - Add poms and depmap frags with groupId of org.objectweb.asm !
  - Add asm-all.jar 
  - Add -javadoc Requires post and postun
  - Restore Vendor, Distribution


author: David Walluck <dwalluck@redhat.com> 0:3.1-4
changelog:
  - remove Class-Path from MANIFEST.MF
  - add unversioned javadoc symlink
  - remove javadoc scriptlets
  - fix directory ownership
  - remove build requirement on dos2unix


author: Mat Booth <mat.booth@redhat.com> - 6.1.1-1
changelog:
  - Update to latest upstream relase for Java 10 support
  - Switch to maven build
  - Now executing test suites


author: Guido Grazioli <guido.grazioli@gmail.com> 1.2-4
changelog:
  - Drop buildroot and %clean section
  - Drop use of maven2-settings.xml and jpp-depmap.xml
  - Install unversioned jars
  - Clean up of needed patch and mvn-jpp execution


author: Jiri Vanek <jvanek@redhat.com> 1.2-9
changelog:
  - Added patch2 - JRockitInstantntiatorCharacters.patch to fix unmappable characters
  - Added build requires  apache-resource-bundles and  maven-remote-resources-plugin


author: Richard W.M. Jones <rjones@redhat.com> - 1.7.4-2
changelog:
  - Add all upstream patches since 1.7.4, including fixes for OCaml 4.07.
  - Use autosetup.
  - Remove obsolete old patch.


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.8.2-3
changelog:
  - Fix CVE-2019-13224
    Resolves: RHEL-6970
  - Fix CVE-2019-16163
    Resolves: RHEL-9506
  - Fix CVE-2019-19012
    Resolves: RHEL-9511
  - Fix CVE-2019-19203
    Resolves: RHEL-9510
  - Fix CVE-2019-19204
    Resolves: RHEL-9509


author: Tomasz Kłoczko <kloczek@fedoraproject.org> - 1.18.2-4
changelog:
  - remove support for no longer supported Fedora versions (<=25)
  - fix: add %{_libdir}/cmake/OpenAL directory to devel
  - fix: s/_datarootdir/_datadir/ as this package does not uses datarootdir
    but datadir
  - fix: add %{_datadir}/openal to main package as well and to %exclude
    %{_datadir}/openal/{alsoftrc.sample,presets/presets.txt} as those files
    are not needed
  - removed Group fields
    (https://fedoraproject.org/wiki/Packaging:Guidelines#Tags_and_Sections)
  - add use more macros (%autosetup, %make_build, %make_install)


author: Hans de Goede <hdegoede@redhat.com> - 1.18.2-5
changelog:
  - Allow pulseaudio to move openal-soft output streams (rhbz#1544381)
  - Fix release -4 not building (rhbz#1544012)
  - Drop unnecessary qt-devel BuildRequires (we also BuildRequire qt5-devel)


author: Nikola Forró <nforro@redhat.com> - 0.3.15-1
changelog:
  - Rebase to version 0.3.15
  - Use gcc-toolset-11 to benefit from POWER 10 optimizations
    resolves: #1983218


author: Nikola Forró <nforro@redhat.com> - 0.3.15-3
changelog:
  - Fix missing header files in openblas-devel subpackage by enabling
    gcc-toolset-11 in %install as well
    related: #1983218


author: Than Ngo <than@redhat.com> - 3.21.0-7
changelog:
  - Resolves: #2222595, p11sak tool: slot option does not accept argument 0 for slot index 0
  - Resolves: #2222594, p11sak fails as soon as there reside non-key objects


author: Than Ngo <than@redhat.com> - 3.22.0-2
changelog:
  - timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)
  Resolves: RHEL-22791


author: Jiri Kucera <jkucera@redhat.com> - 3.4.6-2
changelog:
  - fix cmakes location
  - remove -DENABLE_PKG_CONFIG=OFF (it was neither defined nor used)
  - remove confusing comment
  - WITH_GDAL=OFF (gdal dependency has been already removed)
    Related: #1694647


author: Jiri Kucera <jkucera@redhat.com> - 3.4.6-5
changelog:
  - Move libopencv_{calib3d,cvv,hfs}.so.* to their proper packages
  - Fix issues found by rpmdiff
    Related: #1694647


author: Nikola Forró <nforro@redhat.com> - 2.4.0-1
changelog:
  - Rebase to 2.4.0
  - Resolves: CVE-2018-5727 (#1538467)
  - Resolves: CVE-2018-5785 (#1538556)
  - Resolves: CVE-2018-20845 (#1730679)
  - Resolves: CVE-2018-20847 (#1734337)
  - Resolves: CVE-2019-12973 (#1739076)
  - Resolves: CVE-2020-15389 (#1855115)
  - Resolves: CVE-2020-27814 (#1908965)
  - Resolves: CVE-2020-27823 (#1906222)
  - Resolves: CVE-2020-27824 (#1906216)
  - Resolves: CVE-2020-27842 (#1908165)
  - Resolves: CVE-2020-27843 (#1908164)
  - Resolves: CVE-2020-27845 (#1908168)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 1.2.7
  - fix some bugs from bugzilla (#4885, #4887, #4888, #4967)
  - take include files out of base package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add -D_REENTRANT to make threaded stuff more stable, even though it looks
    like the sources define it, too
  - mark *.ph files in migration tools as config files


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move the defaults for databases and whatnot to /var/lib/ldap (bug #10714)
  - fix some possible string-handling problems


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.10
  - add revamped version of patch from kos@bastard.net to allow execution as
    any non-root user
  - remove test suite from %build because of weirdness in the build system


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - more minimalistic fix for bug #11111 after consultation with OpenLDAP team
  - backport replacement for the ldapuser patch


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.11
  - add condrestart logic to init script
  - munge migration scripts so that you don't have to be
    /usr/share/openldap/migration to run them
  - add code to create pid files in /var/run


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak init script to return error codes properly
  - change initscripts dependency to one on /etc/init.d


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - switch to gdbm; I'm getting off the db merry-go-round
  - tweak the init script some more
  - add instdir to @INC in migration scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - split off clients and servers to shrink down the package and remove the
    base package's dependency on Perl
  - make certain that the binaries have sane permissions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build a semistatic slurpd with threads, everything else without
  - disable reverse lookups, per email on OpenLDAP mailing lists
  - make sure the execute bits are set on the shared libraries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add the nis.schema and inetorgperson.schema to the default server config
  - make ldapadd a hard link to ldapmodify because they're identical binaries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.0.6
  - add buildprereq on cyrus-sasl-devel, krb5-devel, openssl-devel
  - take the -s flag off of slapadd invocations in migration tools
  - add the cosine.schema to the default server config, needed by inetorgperson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - try adding the suffix first when doing online migrations
  - force ldapadd to use simple authentication in migration scripts
  - add indexing of a few attributes to the default configuration
  - add commented-out section on using TLS to default configuration


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add missing required attributes to conversion scripts to comply with schema
  - add schema for mail aliases, autofs, and kerberosSecurityObject rooted in
    our own OID tree to define attributes and classes migration scripts expect
  - tweak automounter migration script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - reorganize the patch list to separate MigrationTools and OpenLDAP patches
  - switch to Luke Howard's rfc822MailMember schema instead of the aliases.schema
  - configure slapd to run as the non-root user "ldap" (#19370)
  - chdir() before chroot() (we don't use chroot, though) (#19369)
  - disable saving of the pid file because the parent thread which saves it and
    the child thread which listens have different pids


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add Norbert Klasen's patch (via Del) to fix searches using ldaps URLs
    (OpenLDAP ITS #889)
  - add "-h ldaps:///" to server init when TLS is enabled, in order to support
    ldaps in addition to the regular STARTTLS (suggested by Del)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change automount object OID from 1.3.6.1.1.1.2.9 to 1.3.6.1.1.1.2.13,
    per mail from the ldap-nis mailing list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add support for additional OPTIONS, SLAPD_OPTIONS, and SLURPD_OPTIONS in
    a /etc/sysconfig/ldap file (#23549)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - back out pidfile patches, which interact weirdly with Linux threads
  - mark non-standard schema as such by moving them to a different directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build dummy certificate in %post, use it in default config
  - configure-time shenanigans to help a confused configure script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move shared libraries to /lib
  - redo init script for better internationalization (#26154)
  - don't use ldaprc files in the current directory (#38402) (patch from
    hps@intermeta.de)
  - add BuildPrereq on tcp wrappers since we configure with
    --enable-wrappers (#43707)
  - don't overflow debug buffer in mail500 (#41751)
  - don't call krb5_free_creds instead of krb5_free_cred_contents any
    more (#43159)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - require cyrus-sasl-md5 (support for DIGEST-MD5 is required for RFC
    compliance) by name (follows from #43079, which split cyrus-sasl's
    cram-md5 and digest-md5 modules out into cyrus-sasl-md5)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a build-time requirement on pam-devel
  - add a build-time requirement on a sufficiently-new libtool to link
    shared libraries to other shared libraries (which is needed in order
    for prelinking to work)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.12-1
changelog:
  - update to 2.0.12 to pull in fixes for setting of default TLS options, among
    other things
  - update to migration tools 39
  - drop tls patch, which was fixed better in this release


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable kbind support (deprecated, and I suspect unused)
  - configure with --with-kerberos=k5only instead of --with-kerberos=k5
  - build slapd with threads


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.20-2
changelog:
  - temporarily disable optimizations for ia64 arches
  - specify pthreads at configure-time instead of letting configure guess


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.22-2
changelog:
  - switch to an internalized Berkeley DB as the ldbm back-end  (NOTE: this breaks
    access to existing on-disk directory data)
  - add slapcat/slapadd with gdbm for migration purposes
  - remove Kerberos dependency in client libs (the direct Kerberos dependency
    is used by the server for checking {kerberos} passwords)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-1
changelog:
  - update to 2.0.25 "stable", ldbm-over-gdbm (putting off migration of LDBM
    slapd databases until we move to 2.1.x)
  - use %{_smp_mflags} when running make
  - update to MigrationTools 44
  - enable dynamic module support in slapd


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-2
changelog:
  - change LD_FLAGS to refer to /usr/kerberos/_libdir instead of
    /usr/kerberos/lib, which might not be right on some arches


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - incorporate fixes from SuSE's security audit, except for fixes to ITS 1963,
    1936, 2007, 2009, which were included in 2.0.26.
  - add two more patches for db 4.1.24 from sleepycat's updates page
  - use openssl pkgconfig data, if any is available


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.27-8
changelog:
  - back down to db 4.0.x, which 2.0.x can compile with in ldbm-over-db setups
  - tweak SuSE patch to fix a few copy-paste errors and a NULL dereference


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.1.17
  - disable the shell backend, not expected to work well with threads
  - drop the kerberosSecurityObject schema, the krbName attribute it
    contains is only used if slapd is built with v2 kbind support


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - install the db utils for the bundled libdb as %{_sbindir}/slapd_db_*
  - install slapcat/slapadd from 2.0.x for migration purposes


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-0
changelog:
  - 2.1.22 now badged stable
  - be more aggressive in what we index by default
  - use/require libtool 1.5


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - actually require newer libtool, as was intended back in 2.1.22-0, noted as
    missed by Jim Richardson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build bundled libdb for slapd dynamically to make the package smaller,
    among other things
  - on tls-capable arches, build libdb both with and without shared posix
    mutexes, otherwise just without
  - disable posix mutexes unconditionally for db 4.0, which shouldn't need
    them for the migration cases where it's used
  - update to MigrationTools 45


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-8
changelog:
  - add another section to the ABI note for the TLS libdb so that it's marked as
    not needing an executable stack (from Arjan Van de Ven)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-1
changelog:
  - change logging facility used from daemon to local4 (#112730, reversing #11047)
    BEHAVIOR CHANGE - SHOULD BE MENTIONED IN THE RELEASE NOTES.


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-2
changelog:
  - fix incorrect use of find when attempting to detect a common permissions
    error in the init script (#114866)


author: Thomas Woerner <twoerner@redhat.com> 2.1.29-3
changelog:
  - removed rpath
  - added pie patch: slapd and slurpd are now pie
  - requires libtool >= 1.5.6-2 (PIC libltdl.a)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-1
changelog:
  - add compat-openldap subpackage
  - default to bdb, as upstream does, gambling that we're only going to be
    on systems with nptl now


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-2
changelog:
  - build a separate, static set of libraries for openldap-devel with the
    non-standard ntlm bind patch applied, for use by the evolution-connector
    package (#125579), and installing them under
    evolution_connector_prefix)
  - provide openldap-evolution-devel = version-release in openldap-devel
    so that evolution-connector's source package can require a version of
    openldap-devel which provides what it wants


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move slapd startup to earlier in the boot sequence (#103160)
  - update to 2.2.15 (stable-20040822)
  - change version number on compat-openldap to include the non-compat version
    from which it's compiled, otherwise would have to start 2.2.15 at release 3
    so that it upgrades correctly


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.17 (stable-20040923) (#135188)
  - move nptl libraries into arch-specific subdirectories on x86 boxes
  - require a newer glibc which can provide nptl libpthread on i486/i586


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.20-1
changelog:
  - update to 2.2.20 (stable-20050103)
  - warn about unreadable krb5 keytab files containing "ldap" keys
  - warn about unreadable TLS-related files
  - own a ref to subdirectories which we create under _libdir/tls


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.23-1
changelog:
  - update to 2.2.23 (stable-20050125)
  - update notes on upgrading from earlier versions
  - drop slapcat variations for 2.0/2.1, which choke on 2.2's config files


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.24-1
changelog:
  - update to 2.2.24 (stable 20050318)
  - export KRB5_KTNAME in the init script, in case it was set in the sysconfig
    file but not exported


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.26 (stable 20050429)
  - enable the lmpasswd scheme
  - print a warning if slaptest fails, slaptest -u succeeds, and one of the
    directories listed as the storage location for a given suffix in slapd.conf
    contains a readable file named __db.001 (#118678)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.26-1
changelog:
  - run slaptest with the -u flag if no id2entry db files are found, because
    you can't check for read-write access to a non-existent database (#156787)
  - add _sysconfdir/openldap/cacerts, which authconfig sets as the
    TLS_CACERTDIR path in /etc/openldap/ldap.conf now
  - use a temporary wrapper script to launch slapd, in case we have arguments
    with embedded whitespace (#158111)


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Add the tls-fix-connection-test patch to close
    bz#161991 openldap password disclosure issue
  - add the hop patches to prevent infinite looping when chasing referrals.
    OpenLDAP ITS #3578


author: Jay Fenlason <fenlason@redhat.com> 2.2.26-2
changelog:
  - Move the slapd.pem file to /etc/pki/tls/certs
    and edit the -config patch to match to close
    bz#143393  Creates certificates + keys at an insecure/bad place
  - also use _sysconfdir instead of hard-coding /etc


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-2
changelog:
  - Upgrade to 2.3.11, which upstream now considers stable.
  - Switch compat-openldap to 2.2.29
  - remove references to nss_ldap_build from the spec file
  - remove references to 2.0 and 2.1 from the spec file.
  - reorganize the build() function slightly in the spec file to limit the
    number of redundant and conflicting options passedto configure.
  - Remove the attempt to hardlink ldapmodify and ldapadd together, since
    the current make install make ldapadd a symlink to ldapmodify.
  - Include the -ads patches to allow SASL binds to an Active Directory
    server to work.  Nalin <nalin@redhat.com> wrote the patch, based on my
    broken first attempt.


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-3
changelog:
  - Remove Requires: cyrus-sasl and cyrus-sasl-md5 from openldap- and
    compat-openldap- to close
    bz#173313 Remove exlicit 'Requires: cyrus-sasl" + 'Requires: cyrus-sasl-md5'


author: Jay Fenlason <fenlason@redhat.com> 2.3.19-2
changelog:
  - Upgrade to 2.3.19, which upstream now considers stable
  - Modify the -config.patch, ldap.init, and this spec file to put the
    pid file and args file in an ldap-owned openldap subdirectory under
    /var/run.
  - Move back_sql* out of _sbindir/openldap , which requires
    hand-moving slapd and slurpd to _sbindir, and recreating symlinks
    by hand.
  - Retire openldap-2.3.11-ads.patch, which went upstream.
  - Update the ldap.init script to run slaptest as the ldap user rather
    than as root.  This solves
    bz#150172 Startup failure after database problem
  - Add to the servers post and preun scriptlets so that on preun, the
    database is slapcatted to /var/lib/ldap/upgrade.ldif and the
    database files are saved to /var/lib/ldap/rpmorig.  On post, if
    /var/lib/ldap/upgrade.ldif exists, it is slapadded.  This means that
    on upgrades from 2.3.16-2 to higher versions, the database files may
    be automatically upgraded.  Unfortunatly, because of the changes to
    the preun scriptlet, users have to do the slapcat, etc by hand when
    upgrading to 2.3.16-2.  Also note that the /var/lib/ldap/rpmorig
    files need to be removed by hand because automatically removing your
    emergency fallback files is a bad idea.
  - Upgrade internal bdb to db-4.4.20.  For a clean upgrade, this will
    require that users slapcat their databases into a temp file, move
    /var/lib/ldap someplace safe, upgrade the openldap rpms, then
    slapadd the temp file.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-2
changelog:
  - New upstream release
  - Include the gethostbyname_r patch so that nss_ldap won't hang
    on recursive attemts to ldap_initialize.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-3
changelog:
  - Include --enable-multimaster to close
    bz#185821: adding slapd_multimaster to the configure options
  - Upgade guide.html to the correct one for openladp-2.3.27, closing
    bz#190383: openldap 2.3 packages contain the administrator's guide for 2.2
  - Remove the quotes from around the slaptestflags in ldap.init
    This closes one part of
    bz#204593: service ldap fails after having added entries to ldap
  - include __db.* in the list of files to check ownership of in
    ldap.init, as suggested in
    bz#199322: RFE: perform cleanup in ldap.init


author: Thomas Woerner <twoerner@redhat.com> 2.3.30-1.1
changelog:
  - tcp_wrappers has a new devel and libs sub package, therefore changing build
    requirement for tcp_wrappers to tcp_wrappers-devel


author: Jay Fenlason <fenlason<redhat.com> 2.3.34-1
changelog:
  - New upstream release
  - Upgrade the scripts for migrating the database so that they might
    actually work.
  - change bind-libbind-devel to bind-devel in BuildPreReq


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-2
changelog:
  - slapadd during package update is now quiet (bz#224581)
  - use _localstatedir instead of var/ during build (bz#220970)
  - bind-libbind-devel removed from BuildRequires (bz#216851)
  - slaptest is now quiet during service ldap start, if
    there is no error/warning (bz#143697)
  - libldap_r.so now links with pthread (bz#198226)
  - do not strip binaries to produce correct .debuginfo packages
    (bz#152516)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-3
changelog:
  - do not create script in /tmp on startup (bz#188298)
  - add compat-slapcat to openldap-compat (bz#179378)
  - do not import ddp services with migrate_services.pl
    (bz#201183)
  - sort the hosts by adders, preventing duplicities
    in migrate*nis*.pl (bz#201540)
  - start slupd for each replicated database (bz#210155)
  - add ldconfig to devel post/postun (bz#240253)
  - include misc.schema in default slapd.conf (bz#147805)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-4
changelog:
  - Fix initscript return codes (#242667)
  - Provide overlays (as modules; #246036, #245896)
  - Add available modules to config file


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-6
changelog:
  - fix compat-slapcat compilation. Now it can be found in
    /usr/lib/compat-openldap/slapcat, because the tool checks argv[0]
    (#246581)


author: Jan Safranek <jsafranek@redhat.com> 2.3.37-2
changelog:
  - do not use specific automake and autoconf
  - do not distinguish between NPTL and non-NPTL platforms, we have NPTL
    everywhere
  - db-4.6.18 integrated
  - updated openldap-servers License: field to reference BDB license


author: Jan Safranek <jsafranek@redhat.com> 2.3.38-2
changelog:
  - skeleton /etc/sysconfig/ldap added
  - new SLAPD_LDAP option to turn off listening on ldap:/// (#292591)
  - fixed checking of SSL (#292611)
  - fixed upgrade with empty database


author: Jan Safranek <jsafranek@redhat.com> 2.4.7-4
changelog:
  - fixed rpmlint warnings and errors
    - /etc/openldap/schema/README moved to /usr/share/doc/openldap


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-3
changelog:
  - reworked the upgrade logic, slapcat/slapadd of the whole database
    is needed only if minor version changes (2.3.x -> 2.4.y)
  - do not try to save database in LDIF format, if openldap-servers package
    is  being removed (it's up to the admin to do so manually)


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-4
changelog:
  - bdb upgraded to 4.6.21
  - reworked upgrade logic again to run db_upgrade when bdb version
    changes


author: Jan Safranek <jsafranek@redhat.com> 2.4.11-3
changelog:
  - add SLAPD_SHUTDOWN_TIMEOUT to /etc/sysconfig/ldap, allowing admins
    to set non-default slapd shutdown timeout
  - add checkpoint to default slapd.conf file (#458679)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.15-3
changelog:
  - extended previous patch (#481310) to remove options cfMP
    from some client tools
  - correction of patch setugid (#494330)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.16-1
changelog:
  - rebase of openldap to 2.4.16
  - fixed minor issue in spec file (output looking interactive
    when installing servers)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-2
changelog:
  - changed configuration approach. Instead od slapd.conf slapd
    is using slapd.d directory now
  - fix of some issues caused by renaming of init script
  - fix of buffer overflow issue in ldif.c pointed out by new glibc


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-4
changelog:
  - updated smbk5pwd patch to be linked with libldap (#526500)
  - the last buffer overflow patch replaced with the one from upstream
  - added /etc/openldap/slapd.d and /etc/openldap/slapd.conf.bak
    to files owned by openldap-servers


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-2
changelog:
  - fixed tls connection accepting when TLSVerifyClient = allow
  - /etc/openldap/ldap.conf removed from files owned by openldap-servers
  - minor changes in spec file to supress warnings
  - some changes in init script, so it would be possible to use it when
    using old configuration style


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.22-1
changelog:
  - rebased to 2.4.22 (mostly bugfixes, added back-ldif, back-null testing support)
  - due to some possible issues pointed out in last update testing phase, I'm
    pulling back the last change (slapd can't be moved since it depends on /usr
    possibly mounted from network)


author: Rich Megginson <rmeggins@redhat.com> - 2.4.22-3
changelog:
  - added ldif.h to the public api in the devel package
  - added -lldif to the public api
  - added HAVE_MOZNSS and other flags to use Mozilla NSS for crypto


author: Jan Vcelak <jvcelak@redhat.com> - 2.4.22-6
changelog:
  - CVE-2010-0211 openldap: modrdn processing uninitialized pointer free (#605448)
  - CVE-2010-0212 openldap: modrdn processing IA5StringNormalize NULL pointer dereference (#605452)
  - obsolete configuration file moved to /usr/share/openldap-servers (#612602)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.22-7
changelog:
  - Mozilla NSS - delay token auth until needed (#616552)
  - Mozilla NSS - support use of self signed CA certs as server certs (#614545)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-1
changelog:
  - rebase to 2.4.23
  - embeded db4 library removed
  - removed bogus links in "SEE ALSO" in several man-pages (#624616)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-2
changelog:
  - fix possible infinite loop when checking permissions of TLS files (#641946)
  - removed outdated autofs.schema (#643045)
  - removed outdated README.upgrade
  - removed relics of migrationtools


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-3
changelog:
  - add support for multiple prefixed Mozilla NSS database files in TLS_CACERTDIR
  - reject non-file keyfiles in TLS_CACERTDIR (#652315)
  - TLS_CACERTDIR precedence over TLS_CACERT (#652304)
  - accept only files in hash.0 format in TLS_CACERTDIR (#650288)
  - improve SSL/TLS trace messages (#652818)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-4
changelog:
  - Mozilla NSS - implement full non-blocking semantics
    ldapsearch -Z hangs server if starttls fails (#652822)
  - updated list of all overlays in slapd.conf (#655899)
  - fix database upgrade process (#656257)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-5
changelog:
  - initscript: slaptest with '-u' to skip database opening (#667768)
  - removed slurpd options from sysconfig/ldap
  - fix: verification of self issued certificates (#657984)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-6
changelog:
  - fix: some server certificates refused with inadequate type error (#668899)
  - fix: default encryption strength dropped in switch to using NSS (#669446)
  - systemd compatibility: add configuration file (#656647, #668223)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-7
changelog:
  - fix: openldap can't use TLS after a fork() (#636956)
  - fix: openldap-server upgrade gets stuck when the database is damaged (#664433)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.24-2
changelog:
  - new: system resource limiting for slapd using ulimit
  - fix update: openldap can't use TLS after a fork() (#636956)
  - fix: possible null pointer dereference in NSS implementation
  - fix: openldap-servers upgrade hangs or do not upgrade the database (#664433)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.25-1
changelog:
  - rebase to new upstream release
  - change default database type from BDB to HDB
  - enable ldapi:/// interface by default
  - set cn=config management ACLs for root user, SASL external schema (#712495)
  - fix: server scriptlets require initscripts package (#716857)
  - fix: connection fails if TLS_CACERTDIR doesn't exist but TLS_REQCERT
    is set to 'never' (#716854)
  - fix: segmentation fault caused by double-free in ldapexop (#699683)
  - fix: segmentation fault of client tool when input line in LDIF file
    is splitted but indented incorrectly (#716855)
  - fix: segmentation fault of client tool when LDIF input file is not terminated
    by a new line character (#716858)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-2
changelog:
  - security hardening: library needs partial RELRO support added (#733071)
  - fix: NSS_Init* functions are not thread safe (#731112)
  - fix: incorrect behavior of allow/try options of VerifyCert and TLS_REQCERT (#725819)
  - fix: memleak - free the return of tlsm_find_and_verify_cert_key (#725818)
  - fix: conversion of constraint overlay settings to cn=config is incorrect (#733067)
  - fix: DDS overlay tolerance parametr doesn't function and breakes default TTL (#733069)
  - manpage fix: errors in manual page slapo-unique (#733070)
  - fix: matching wildcard hostnames in certificate Subject field does not work (#733073)
  - new feature: honor priority/weight with ldap_domain2hostlist (#733078)
  - manpage fix: wrong ldap_sync_destroy() prototype in ldap_sync(3) manpage (#717722)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-3
changelog:
  - fix: SSL_ForceHandshake function is not thread safe (#701678)
  - fix: allow unsetting of tls_* syncrepl options (#734187)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-5
changelog:
  - rebuild: openldap does not work after libdb rebase (#743824)
  - regression fix: openldap built without tcp_wrappers (#743213)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-6
changelog:
  - package cleanup:
    + hardened build: switch from LDFLAGS to RPM macros
    + remove old provides and obsoletes
    + add new slapd maintainance scripts
    + drop defattr macros, clean up permissions in specfile
    + fix rpmlint warnings: macros in comments/changelog
    + fix rpmlint warnings: non UTF-8 documentation
    + rename environment file to be more consistent (ldap -> slapd)
  - replace sysv initscript with systemd service file (#
  - new format of environment file due to switch to systemd
    (automatic conversion is performed)
  - patch OpenLDAP to skip empty command line arguments
    (arguments expansion in systemd works different than in shell)
  - CVE-2011-4079: one-byte buffer overflow in slapd (#749324)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.28-1
changelog:
  - new upstream release
    + server: support for delta-syncrepl in multi master replication
    + server: add experimental backend - MDB
    + server: dynamic configuration for passwd, perl, shell, sock, and sql backends
    + server: support passwords in APR1
    + library: support for Wahl (draft)
    + a lot of bugfixes
  - remove patches which were merged upstream
  - compile backends as modules (except BDB, HDB, and monitor)
  - reload systemd daemon after installation


author: Jan Vcelak <jvcelak@redhat.com> 2.4.28-3
changelog:
  - fix: replication (syncrepl) with TLS causes segfault (#783431)
  - fix: slapd segfaults when PEM certificate is used and key is not set (#772890)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-1
changelog:
  - new upstream release
    + MozNSS fixes
    + connection handling fixes
    + server: buxfixes in mdb backend
    + server: buxfixes in overlays (syncrepl, meta, monitor, perl, sql, dds, rwm)
  - openldap-servers now provide ldib2ldbm (#437104)
  - certificates management improvements
    + create empty Mozilla NSS certificate database during installation
    + enable builtin Root CA in generated database (#789088)
    + generate server certificate using Mozilla NSS tools instead of OpenSSL tools
    + fix: correct path to check-config.sh in service file (Jan Synáček <jsynacek@redhat.com>)
  - temporarily disable certificates checking in check-config.sh script
  - fix: check-config.sh get stuck when executing command as a ldap user


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-2
changelog:
  - fix update: provide ldif2ldbm, not ldib2ldbm (#437104)
  - Jan Synáček <jsynacek@redhat.com>:
    + unify systemctl binary paths throughout the specfile and make them usrmove compliant
    + make path to chkconfig binary usrmove compliant


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-3
changelog:
  - fix: ldap_result does not succeed for sssd (#771484)
  - Jan Synáček <jsynacek@redhat.com>:
    + fix: count constraint broken when using multiple modifications (#795766)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-4
changelog:
  - fix: missing options in manual pages of client tools (#796232)
  - fix: SASL_NOCANON option missing in ldap.conf manual page (#732915)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.30-1
changelog:
  - new upstream release
    + server: fixes in mdb backend
    + server: fixes in manual pages
    + server: fixes in syncprov, syncrepl, and pcache
  - removed patches which were merged upstream


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-1
changelog:
  - new upstream release
    + library: IPv6 url detection
    + library: rebinding to failed connections
    + server: various fixes in mdb backend
    + server: various fixes in replication
    + server: various fixes in overlays and minor backends
    + documentation fixes
  - remove patches which were merged upstream


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-2
changelog:
  - fix: nss-tools package is required by the base package, not the server subpackage
  - fix: MozNSS CA certdir does not work together with PEM CA cert file (#819536)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-3
changelog:
  - update fix: count constraint broken when using multiple modifications (#795766)
  - fix: invalid order of TLS shutdown operations (#808464)
  - fix: TLS error messages overwriting in tlsm_verify_cert() (#810462)
  - fix: reading pin from file can make all TLS connections hang (#829317)
  - CVE-2012-2668: cipher suite selection by name can be ignored (#825875)
  - fix: slapd fails to start on reboot (#829272)
  - fix: default cipher suite is always selected (#828790)
  - fix: less influence between individual TLS contexts:
    - replication with TLS does not work (#795763)
    - possibly others


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-4
changelog:
  - modify the package build process
    + fix autoconfig files to detect Mozilla NSS library using pkg-config
    + remove compiler flags which are not needed currently
    + build server, client and library together
    + avoid stray dependencies by using --as-needed linker flag
    + enable SLAPI interface in slapd


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-5
changelog:
  - fix: querying for IPv6 DNS records when IPv6 is disabled on the host (#835013)
  - fix: smbk5pwd module computes invalid LM hashes (#841560)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-1
changelog:
  - new upstream release
    + library: double free, SASL handling
    + tools: read SASL_NOCANON from config file
    + slapd: config index renumbering, duplicate error response
    + backends: various fixes in mdb, bdb/hdb, ldap
    + accesslog, syncprov: fix memory leaks in with replication
    + sha2: portability, thread safety, support SSHA256,384,512
    + documentation fixes


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-2
changelog:
  - enhancement: TLS, prefer private keys from authenticated slots
  - enhancement: TLS, allow certificate specification including token name
  - resolve TLS failures in replication in 389 Directory Server


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-3
changelog:
  - fix: some TLS ciphers cannot be enabled (#852338)
  - fix: connection hangs after fallback to second server when certificate hostname verification fails (#852476)
  - fix: not all certificates in OpenSSL compatible CA certificate directory format are loaded (#852786)
  - fix: MozNSS certificate database in SQL format cannot be used (#857373)
  - fix: libldap does not load PEM certificate if certdb is used as TLS_CACERTDIR (#857455)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.33-1
changelog:
  - new upstream release:
    + slapd: ACLs, syncrepl
    + backends: locking and memory management in MDB
    + manpages: slapo-refint
  - patch update: MozNSS certificate database in SQL format cannot be used (#860317)
  - fix: slapd.service should not use /tmp (#859019)


author: Jan Vcelak <jvcelak@fedoraproject.org> 2.4.34-1
changelog:
  - new upstream release (#917603)
  - fix: slapcat segfaults if cn=config.ldif not present (#872784)
  - use systemd-rpm macros in spec file (#850247)


author: Jan Synáček <jsynacek@redhat.com> 2.4.34-1
changelog:
  - enable perl backend (#820547)
  - package ppolicy-check-password (#829749)
  - add perl specific BuildRequires
  - fix bogus dates


author: Jan Synáček <jsynacek@redhat.com> 2.4.34-2
changelog:
  - fix: syncrepl push DELETE operation does not recover (#920482)
  - run autoreconf every build, drop autoreconf patch (#926280)


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-1
changelog:
  - new upstream release (#947235)
  - fix: slapd.service should ensure that network is up before starting (#946921)
  - fix: NSS related resource leak (#929357)


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-3
changelog:
  - fix: minor documentation fixes
  - set SASL_NOCANON to on by default (#949864)
  - remove trailing spaces


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-4
changelog:
  - do not needlessly run ldconfig after installing openldap-devel
  - fix: LDAPI with GSSAPI does not work if SASL_NOCANON=on (#960222)
  - fix: lt_dlopen() with back_perl (#960048)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.37-1
changelog:
  - new upstream release (#1023916)
  - fix: missing a linefeed at the end of file /etc/openldap/ldap.conf (#1019836)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-3
changelog:
  - remove redundant sysconfig-related stuff
  - add documentation reference to service file
  - alias slapd.service as openldap.service


author: Jan Synáček <jsynacek@redhat.com> - 2.4.40-5
changelog:
  - harden the build
  - improve check_password
  - provide an unversioned symlink to check_password.so.1.1


author: Jan Synáček <jsynacek@redhat.com> - 2.4.40-6
changelog:
  - remove openldap-fedora-systemd.patch
  - remove openldap-ldaprc-currentdir.patch
  - remove openldap-userconfig-setgid.patch
  - remove openldap-syncrepl-unset-tls-options.patch
  - remove unneeded configure flags, disable sql backend and aci
  - make mdb default after a new installation
  - remove pid file and args file
  - renumber patches and sources


author: Jan Synáček <jsynacek@redhat.com> - 2.4.40-7
changelog:
  - remove tmpfiles config since it's no longer needed
  - fix invalid ldif
  - simplify checking for missing server configuration


author: Matus Honek <mhonek@redhat.com> - 2.4.44-3
changelog:
  - fix: Setting olcTLSProtocolMin does not change supported protocols (#1375432)
  - fix: slapd should start after network-online.service (#1336487)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-9
changelog:
  - NSS: Enhance OpenLDAP to support TLSv1.3 protocol with NSS (#1435692)
  - NSS: Rearrange ciphers-, parsing-, and protocol-related patches (#1435692)


author: Matus Honek <mhonek@redhat.com> - 2.4.45-1
changelog:
  - Rebase to version 2.4.45 (#1458081)
    * fixes CVE-2017-9287 (#1456712, #1456713)
  - Update the 'sources' file with new SHA512 hashes


author: Matus Honek <mhonek@redhat.com> - 2.4.45-5
changelog:
  - Fix issues in MozNSS compatibility layer (#1400570)
    + Force write file with fsync to avoid race conditions
    + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix
    + Allow missing cert and key which is a valid usecase
    + Create extraction folder only in /tmp to simplify selinux rules
    + Fix Covscan issues


author: Matus Honek <mhonek@redhat.com> - 2.4.45-7
changelog:
  - MozNSS Compat. Layer fixes (#1400570)
    - fix incorrect parsing of CACertDir (orig. #1533955)
    - fix PIN disclaimer not always shown (orig. #1516409)
    - fix recursive directory deletion (orig. #1516409)
    - Ensure consistency of a PEM dir before usage (orig. #1516409)
      + Warn just before use of a PIN about key file extraction
    - Enable usage of NSS DB with PEM cert/key (orig. #1525485)
      + Fix a possible invalid dereference (covscan)


author: Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.4.45-9
changelog:
  - Escape macros in %changelog
  - Disable TLSMC in F29+
  - Remove obsolete Group tag
  - Don't call ldconfig in servers subpackage
  - Switch to %ldconfig_scriptlets
  - Remove unneeded Requires(post): systemd-sysv, chkconfig
  - Switch to %systemd_requires
  - Change BuildRequires: systemd-units to systemd


author: Matus Honek <mhonek@redhat.com> - 2.4.45-12
changelog:
  - MozNSS Compat. Layer: fix: libldap tlsmc continues even after it fails to extract CA certificates (#1550110)


author: Matus Honek <mhonek@redhat.com> - 2.4.45-13
changelog:
  - fix: openldap does not use Fedora build flags
    + makes use of redhat-rpm-config package
  - Drop superfluous back-sql linking patch


author: Jitka Plesnikova <jplesnik@redhat.com> - 2.4.46-2
changelog:
  - Perl 5.28 rebuild
  - MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1564161)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-3
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1598103)
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-6
changelog:
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1594928)
  - Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.46-19
changelog:
  - Bump version to 2.4.46-19
  - Resolves: RHEL-34283 - openldap: null pointer dereference in ber_memalloc_x function


author: Simon Pichugin <spichugi@redhat.com> - 2.4.46-21
changelog:
  - Bump version to 2.4.46-21
  - Resolves: RHEL-75823 - Fix double file close when first TLS connection fails


author: Honggang Li <honli@redhat.com> - 4.1.1-2
changelog:
  - fbtl-posix: link to common_ompio
  - Require environment(modules)
  - Revert upstream commit c36d7459b6331c4da82
  - Resolves: rhbz#1974780, rhbz#1971771


author: Jan Černý <jcerny@redhat.com> - 1.3.5-8
changelog:
  - Allow local DS components (rhbz#1970529)
  - Fix hostname detection in offline scan of UBI 9 images (rhbz#1893888)
  - Add an alternative source of hostname (rhbz#1977668)
  - Fix oscap-chroot errors in process58_probe caused by empty /proc (rhbz#2008922)


author: Jan Černý <jcerny@redhat.com> - 1.3.5-9
changelog:
  - Lower memory limits and improve their checking (rhbz#2021851)
  - Remove timestamp from the user manual (rhbz#2022364)


author: Jan Černý <jcerny@redhat.com> - 1.3.6-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2041781)
  - Select and exclude groups of rules on the command line
  - The boot-time remediation service for systemd's Offline Update mode


author: Jan Černý <jcerny@redhat.com> - 1.3.6-4
changelog:
  - Fix potential invalid scan results in OpenSCAP (rhbz#2111040)
  - Remove oscap-remediate service (rhbz#2111360)


author: Jan Černý <jcerny@redhat.com> - 1.3.7-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2159290)
  - Fix error when processing OVAL filters (rhbz#2126882)
  - Don't emit xmlfilecontent items if XPath doesn't match (rhbz#2139060)


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.8-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2217441)
  - Add offline support for sysctl probe (rhbz#2185791)
  - Fix systemd* probes unit enumeration (rhbz#2219533)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.0.0-15
changelog:
  - Removed dependency on net-tools
    Resolves: #1496138
  - Removed init script, Group tag and macro from changelog in spec file
  - Slightly modified openssl-1.1 fix to be able build the package
    with OpenSSL version lower than 1.1


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067146


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
changelog:
  - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
    Resolves: RHEL-14245
  - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
    Resolves: RHEL-14239


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
changelog:
  - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
    excessively long X9.42 DH keys or parameters may be very slow
    Resolves: RHEL-16538


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-12
changelog:
  - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
    (a proper fix for CVE-2020-25659)
    Resolves: RHEL-17696


author: Bernhard Rosenkrdnzer <bero@redhat.de>
changelog:
  - inital packaging
  - changes from base:
    - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
    - handle RPM_OPT_FLAGS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.5a, modified for U.S.
  - add perl as a build-time requirement
  - move certificate makefile to another package
  - disable RC5, IDEA, RSA support
  - remove optimizations for now


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - byte-compile python extensions without the build-root
  - adjust the makefile to not remove temporary files (like .key files when
    building .csr files) by marking them as .PRECIOUS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
  - add the CA.pl man page to the perl subpackage


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable some inline assembly, which on x86 is Pentium-specific
  - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
    bytes or so, causing EVP_DigestInit() to zero out stack variables in
    apps built against a version of the library without it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6
  - enable MD2
  - use the libcrypto.so and libssl.so targets to build shared libs with
  - bump the soversion to 1 because we're no longer compatible with any of
    the various 0.9.5a packages circulating around, which provide lib*.so.0


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6a
  - use the build-shared target to build shared libraries
  - bump the soversion to 2 because we're no longer compatible with
    our 0.9.5a packages or our 0.9.6 packages
  - drop the patch for making rsatest a no-op when rsa null support is used
  - put all man pages into <section>ssl instead of <section>
  - break the m2crypto modules into a separate package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a script for creating dummy certificates
  - move man pages from %{_mandir}/man?/foo.?ssl to %{_mandir}/man?ssl/foo.?


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
changelog:
  - add patches for AEP hardware support
  - add patch to keep trying when we fail to load a cert from a file and
    there are more in the file
  - add missing prototype for ENGINE_ubsec() in engine_int.h


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
changelog:
  - move man pages back to %{_mandir}/man?/foo.?ssl from
    %{_mandir}/man?ssl/foo.?
  - add an [ engine ] section to the default configuration file


author: Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
changelog:
  - upgrade to 0.9.6c
  - bump BuildArch to i686 and enable assembler on all platforms
  - synchronise with shrimpy and rawhide
  - bump soversion to 3


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
changelog:
  - add configuration stanza for x86_64 and use it on x86_64
  - build for linux-ppc on ppc
  - start running the self-tests again


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
changelog:
  - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
    to get the right behavior when passed uninitialized context structures
    (#83766)
  - build with -mcpu=ev5 on alpha family (#83828)


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
changelog:
  - add fix to guard against attempts to allocate negative amounts of memory
  - add patch for CAN-2003-0078, fixing a timing attack


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
changelog:
  - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
    attack (CAN-2003-0131)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - backport fix for engine-used-for-everything from 0.9.7b
  - backport fix for prng not being seeded causing problems, also from 0.9.7b
  - add a check at build-time to ensure that RSA is thread-safe
  - keep perlpath from stomping on the libica configure scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
    and heap corruption (CAN-2003-0545)
  - update RHNS-CA-CERT files
  - ease back on the number of threads used in the threading test


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
changelog:
  - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
    as not needing executable stacks


author: Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
changelog:
  - Use /dev/urandom instead of PRNG for libica.
  - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
  - Use latest ICA engine patch from IBM.


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
changelog:
  - add dependency on zlib-devel for the -devel package, which depends on zlib
    symbols because we enable zlib for libssl (#102962)


author: Joe Orton <jorton@redhat.com> 0.9.7a-27
changelog:
  - updated ca-bundle.crt: removed expired GeoTrust roots, added
    freessl.com root, removed trustcenter.de Class 0 root


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
changelog:
  - add an intermediate <openssl/opensslconf.h> which points to the right
    arch-specific opensslconf.h on multilib arches


author: Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
changelog:
  - new upstream source, updated patches
  - added patch so we are hopefully ABI compatible with upcoming
    0.9.7f


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
changelog:
  - reenable optimizations on ppc64 and assembly code on ia64
  - upgrade to new upstream version (no soname bump needed)
  - disable thread test - it was testing the backport of the
    RSA blinding - no longer needed
  - added support for changing serial number to
    Makefile.certificate (#151188)
  - make ca-bundle.crt a config file (#118903)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
changelog:
  - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
  - disable broken bignum assembly on x86_64


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
changelog:
  - uninitialized variable mustn't be used as input in inline
    assembly
  - reenable the x86_64 assembly again


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
changelog:
  - move certificates to _sysconfdir/pki/tls (#143392)
  - move CA directories to _sysconfdir/pki/CA
  - patch the CA script and the default config so it points to the
    CA directories


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
changelog:
  - use poll instead of select in rand (#128285)
  - fix Makefile.certificate to point to /etc/pki/tls
  - change the default string mask in ASN1 to PrintableString+UTF8String


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
changelog:
  - fix CAN-2005-0109 - use constant time/memory access mod_exp
    so bits of private key aren't leaked by cache eviction (#157631)
  - a few more fixes from upstream 0.9.7g


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
changelog:
  - add *.so.soversion as symlinks in /lib (#165264)
  - remove unpackaged symlinks (#159595)
  - fixes from upstream (constant time fixes for DSA,
    bn assembler div on ppc arch, initialize memory on realloc)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
changelog:
  - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
    disables the countermeasure against man in the middle attack in SSLv2
    (#169863)
  - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
changelog:
  - fix build (-lcrypto was erroneusly dropped) of the updated libica
  - updated ICA engine to 1.3.6-rc3


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
changelog:
  - fix stale open handles in libica (#177155)
  - fix build if 'rand' or 'passwd' in buildroot path (#178782)
  - initialize VIA Padlock engine (#186857)


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
changelog:
  - upgrade to new version, stays ABI compatible
  - there is no more linux/config.h (it was empty anyway)


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
  - add patches for BN threadsafety, AES cache collision attack hazard fix and
    pkcs7 code memleak fix from upstream CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
changelog:
  - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
  - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
  - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
  - fix CVE-2006-4343 - sslv2 client DoS (#206940)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-13
changelog:
  - allow building on ARM architectures (#245417)
  - use reference timestamps to prevent multilib conflicts (#218064)
  - -devel package must require pkgconfig (#241031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-14
changelog:
  - use localhost in testsuite, hopefully fixes slow build in koji
  - CVE-2007-3108 - fix side channel attack on private keys (#250577)
  - make ssl session cache id matching strict (#233599)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-16
changelog:
  - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801)
  - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191)
  - add alpha sub-archs (#296031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-2
changelog:
  - enable some new crypto algorithms and features
  - add some more important bug fixes from openssl CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-3
changelog:
  - set default paths when no explicit paths are set (#418771)
  - do not add tls extensions to client hello for SSLv3 (#422081)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-9
changelog:
  - fix CVE-2008-0891 - server name extension crash (#448492)
  - fix CVE-2008-1672 - server key exchange message omit crash (#448495)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-1
changelog:
  - new upstream version with necessary soname bump (#455753)
  - temporarily provide symlink to old soname to make it possible to rebuild
    the dependent packages in rawhide
  - add eap-fast support (#428181)
  - add possibility to disable zlib by setting
  - add fips mode support for testing purposes
  - do not null dereference on some invalid smime files
  - add buildrequires pkgconfig (#479493)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-6
changelog:
  - drop the temporary triggerpostun and symlinking in post
  - fix the pkgconfig files and drop the unnecessary buildrequires
    on pkgconfig as it is a rpmbuild dependency (#481419)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-7
changelog:
  - must also verify checksum of libssl.so in the FIPS mode
  - obtain the seed for FIPS rng directly from the kernel device
  - drop the temporary symlinks


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-1
changelog:
  - update to new upstream release (minor bug fixes, security
    fixes and machine code optimizations only)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-6
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS
  - make CA dir absolute path (#445344)
  - change default length for RSA key generation to 2048 (#484101)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.11.beta4
changelog:
  - update to new upstream version, no soname bump needed
  - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used
    so the compatibility with unfixed clients is not broken. The
    protocol extension is also not final.


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.12.beta4
changelog:
  - keep the beta status in version number at 3 so we do not have to rebuild
    openssh and possibly other dependencies with too strict version check


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.13.beta4
changelog:
  - disable enforcement of the renegotiation extension on the client (#537962)
  - add fixes from the current upstream snapshot


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.17.beta4
changelog:
  - upstream fix compression handling on session resumption
  - various null checks and other small fixes from upstream
  - upstream changes for the renegotiation info according to the latest draft


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.19.beta4
changelog:
  - fix CVE-2009-4355 - leak in applications incorrectly calling
    CRYPTO_free_all_ex_data() before application exit (#546707)
  - upstream fix for future TLS protocol version handling


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.21.beta5
changelog:
  - gracefully handle zero length in assembler implementations of
    OPENSSL_cleanse (#564029)
  - do not fail in s_server if client hostname not resolvable (#561260)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0c-2
changelog:
  - listen on ipv6 wildcard in s_server so we accept connections
    from both ipv4 and ipv6 (#601612)
  - fix openssl speed command so it can be used in the FIPS mode
    with FIPS allowed ciphers


author: Tomas Mraz <tmraz@redhat.com> 1.0.0c-3
changelog:
  - add -x931 parameter to openssl genrsa command to use the ANSI X9.31
    key generation method
  - use FIPS-186-3 method for DSA parameter generation
  - add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable
    to allow using MD5 when the system is in the maintenance state
    even if the /proc fips flag is on
  - make openssl pkcs12 command work by default in the FIPS mode


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-3
changelog:
  - add support for VIA Padlock on 64bit arch from upstream (#617539)
  - do not return bogus values from load_certs (#652286)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-6
changelog:
  - add support for newest Intel acceleration improvements backported
    from upstream by Intel in form of a separate engine


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-7
changelog:
  - correct openssl cms help output (#636266)
  - more tolerant starttls detection in XMPP protocol (#608239)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-8
changelog:
  - drop the separate engine for Intel acceleration improvements
    and merge in the AES-NI, SHA1, and RC4 optimizations
  - add support for OPENSSL_DISABLE_AES_NI environment variable
    that disables the AES-NI support


author: Tomas Mraz <tmraz@redhat.com> 1.0.0e-3
changelog:
  - do not use AVX instructions when osxsave bit not set
  - add direct known answer tests for SHA2 algorithms


author: Tomas Mraz <tmraz@redhat.com> 1.0.0g-1
changelog:
  - new upstream release fixing CVE-2012-0050 - DoS regression in
    DTLS support introduced by the previous release (#782795)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-0.1.beta2
changelog:
  - new upstream release from the 1.0.1 branch, ABI compatible
  - add documentation for the -no_ign_eof option


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-0.2.beta3
changelog:
  - epoch bumped to 1 due to revert to 1.0.0g on Fedora 17
  - new upstream release from the 1.0.1 branch
  - fix s390x build (#798411)
  - versioning for the SSLeay symbol (#794950)
  - add -DPURIFY to build flags (#797323)
  - filter engine provides
  - split the libraries to a separate -libs package
  - add make to requires on the base package (#783446)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-3
changelog:
  - fix DSA key generation in FIPS mode (#833866)
  - allow duplicate FIPS_mode_set(1)
  - enable build on ppc64 subarch (#834652)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-4
changelog:
  - do not move libcrypto to /lib
  - do not use environment variables if __libc_enable_secure is on
  - fix strict aliasing problems in modes


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-7
changelog:
  - add missing initialization of str in aes_ccm_init_key (#853963)
  - add important patches from upstream CVS
  - use the secure_getenv() with new glibc


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-8
changelog:
  - use 1024 bit DH parameters in s_server as 512 bit is not allowed
    in FIPS mode and it is quite weak anyway


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-11
changelog:
  - add script for renewal of a self-signed cert by Philip Prindeville (#871566)
  - allow X509_issuer_and_serial_hash() produce correct result in
    the FIPS mode (#881336)


author: Kyle McMartin <kyle@redhat.com> 1.0.1e-21
changelog:
  - [arm] use elf auxv to figure out armcap.c instead of playing silly
    games with SIGILL handlers. (#1006474)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-26
changelog:
  - make DTLS1 work in FIPS mode
  - avoid RSA and DSA 512 bits and Whirlpool in 'openssl speed' in FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-32
changelog:
  - disable verification of certificate, CRL, and OCSP signatures
    using MD5 if OPENSSL_ENABLE_MD5_VERIFY environment variable
    is not set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
changelog:
  - drop weak ciphers from the default TLS ciphersuite list
  - add back some symbols that were dropped with update to 1.0.1 branch
  - more FIPS validation requirement changes


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-36
changelog:
  - fix CVE-2013-6449 - crash when version in SSL structure is incorrect
  - more FIPS validation requirement changes


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - fix CVE-2013-4353 - Invalid TLS handshake crash
  - fix CVE-2013-6450 - possible MiTM attack on DTLS1


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - make expiration and key length changeable by DAYS and KEYLEN
    variables in the certificate Makefile (#1058108)
  - change default hash to sha256 (#1062325)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - print ephemeral key size negotiated in TLS handshake (#1057715)
  - add DH_compute_key_padded needed for FIPS CAVS testing


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1g-1
changelog:
  - new upstream release 1.0.1g
  - do not include ECC ciphersuites in SSLv2 client hello (#1090952)
  - fail on hmac integrity check if the .hmac file is empty


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1h-3
changelog:
  - make FIPS mode keygen bit length restriction enforced only when
    OPENSSL_ENFORCE_MODULUS_BITS is set
  - fix CVE-2014-0224 fix that broke EAP-FAST session resumption support


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1h-5
changelog:
  - disable SSLv2 and SSLv3 protocols by default (can be enabled
    via appropriate SSL_CTX_clear_options() call)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1i-1
changelog:
  - new upstream release fixing multiple moderate security issues
  - for now disable only SSLv2 by default


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1j-3
changelog:
  - disable SSLv3 by default again (mail servers and possibly
    LDAP servers should probably allow it explicitly for legacy
    clients)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1k-2
changelog:
  - test in the non-FIPS RSA keygen for minimal distance of p and q
    similarly to the FIPS RSA keygen


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1k-6
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1k-7
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2e-1
changelog:
  - minor upstream release 1.0.2e fixing moderate severity security issues
  - enable fast assembler implementation for NIST P-256 and P-521
    elliptic curves (#1164210)
  - filter out unwanted link options from the .pc files (#1257836)
  - do not set serial to 0 in Makefile.certificate (#1135719)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2f-1
changelog:
  - minor upstream release 1.0.2f fixing security issues
  - add support for MIPS secondary architecture


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2g-2
changelog:
  - reenable SSL2 in the build to avoid ABI break (it does not
    make the openssl vulnerable to DROWN attack)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2i-1
changelog:
  - minor upstream release 1.0.2i fixing security issues
  - move man pages for perl based scripts to perl subpackage (#1377617)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0b-4
changelog:
  - use a random seed if the supplied one did not generate valid
    parameters in dsa_builtin_paramgen2()


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0c-2
changelog:
  - EC curve NIST P-224 is now allowed, still kept disabled in TLS due
    to less than optimal security


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0c-3
changelog:
  - revert SSL_read() behavior change - patch from upstream (#1394677)
  - fix behavior on client certificate request in renegotiation (#1393579)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0e-1
changelog:
  - update to upstream version 1.1.0e
  - add documentation of the PROFILE=SYSTEM special cipher string (#1420232)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0f-1
changelog:
  - update to upstream version 1.1.0f
  - SRP and GOST is now allowed, note that GOST support requires
    adding GOST engine which is not part of openssl anymore


author: Tomáš Mráz <tmraz@redhat.com> 1.1.0g-6
changelog:
  - one more try to apply RPM_LD_FLAGS properly (#1541033)
  - dropped unneeded starttls xmpp patch (#1417017)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1-1
changelog:
  - update to the final 1.1.1 version
  - for consistent support of security policies we build
    RC4 support in TLS (not default) and allow SHA1 in SECLEVEL 2
  - use only /dev/urandom if getrandom() is not available
  - disable SM4


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1b-1
changelog:
  - update to the 1.1.1b release
  - EVP_KDF API backport from master
  - SSH KDF implementation for EVP_KDF API backport from master
  - add S390x chacha20-poly1305 assembler support from master branch


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-2
changelog:
  - do not try to use EC groups disallowed in FIPS mode
    in TLS
  - fix Valgrind regression with constant-time code


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-6
changelog:
  - backport of S390x ECC CPACF enhancements from master
  - FIPS mode: properly disable 1024 bit DSA key generation
  - FIPS mode: skip ED25519 and ED448 algorithms in openssl speed
  - FIPS mode: allow AES-CCM ciphersuites


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-8
changelog:
  - fix CVE-2019-1547 - side-channel weak encryption vulnerability
  - fix CVE-2019-1563 - padding oracle in CMS API
  - fix CVE-2019-1549 - ensure fork safety of the DRBG
  - fix handling of non-FIPS allowed EC curves in FIPS mode
  - fix TLS compliance issues


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-14
changelog:
  - fix incorrect error return value from FIPS_selftest_dsa
  - S390x: properly restore SIGILL signal handler


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-7
changelog:
  - Disallow dropping Extended Master Secret extension
    on renegotiation
  - Return alert from s_server if ALPN protocol does not match
  - SHA1 is allowed in @SECLEVEL=2 only if allowed by
    TLS SigAlgs configuration


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-9
changelog:
  - Rewire FIPS_drbg API to use the RAND_DRBG
  - Use the well known DH groups in TLS even for 2048 and 1024 bit parameters


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-12
changelog:
  - Implemented new FIPS requirements in regards to KDF and DH selftests
  - Disallow certificates with explicit EC parameters


author: Sahana Prasad <sahana@redhat.com> 1.1.1g-14
changelog:
  - Fix CVE-2021-3450 openssl: CA certificate check bypass with
    X509_V_FLAG_X509_STRICT
  - Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Daiki Ueno <dueno@redhat.com> 1.1.1g-16
changelog:
  - Use AI_ADDRCONFIG only when explicit host name is given
  - Allow only curves defined in RFC 8446 in TLS 1.3


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067145


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2100554
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090371
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098278


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
changelog:
  - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
    Resolves: RHEL-14243
  - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
    Resolves: RHEL-14237


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
changelog:
  - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
    excessively long X9.42 DH keys or parameters may be very slow
    Resolves: RHEL-16536


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-12
changelog:
  - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
    (a proper fix for CVE-2020-25659)
    Resolves: RHEL-17694


author: Fabian Deutsch <fabian.deutsch@gmx.de> - 0.4.3-2
changelog:
  - Running autoreconf to prevent building problems.
  - Added missing files to docs.
  - Added examples to devel docs.


author: Brian C. Lane <bcl@redhat.com> - 3.2-33
changelog:
  - Switch gpt-header-move and msdos-overlap to python3 (bcl)
    Resolves: rhbz#1595810
  - Modify gpt-header-move and msdos-overlap to work with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-34
changelog:
  - Fix the length of several strncpy calls (bcl)
    Related: rhbz#1602652
  - parted.c: Always free peek_word (bcl)
    Related: rhbz#1602652
  - parted.c: Make sure dev_name is freed (bcl)
    Related: rhbz#1602652
  - t6100-mdraid-partitions: Use v0.90 metadata for the test (bcl)
  - Fix msdos-overlap to work correctly with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-35
changelog:
  - Use python3-devel in buildroot
    Resolves: rhbz#1615576
  - linux.c: Use sys/sysmacros.h for major/minor
    Resolves: rhbz#1615592


author: Brian C. Lane <bcl@redhat.com> - 3.2-37
changelog:
  - Add CI tests
    Resolves: rhbz#1653912
  - t6000-dm: Stop using private lvm root
    Related: rhbz#1653912


author: Brian C. Lane <bcl@redhat.com> - 3.2-39
changelog:
  - tests: Add a test for resizepart on a busy partition (bcl)
    Related: rhbz#1861804
  - parted: Preserve resizepart End when prompted for busy partition (bcl)
    Resolves: rhbz#1861804
  - Fix end_input usage in do_resizepart (bcl)
    Related: rhbz#1861804
  - tests: Test incomplete resizepart command (bcl)
    Related: rhbz#1861804
  - Fix resizepart iec unit end sector (psusi)
    Related: rhbz#1861804
  - libparted: Fix endian bug in bsd.c (AWilcox)
    Resolves: rhbz#1980105


author: Michal Hlavinka <mhlavink@redhat.com> - 3.7.0-1
changelog:
  - pciutils updated to 3.7.0, add support for basic DVSEC and CXL DVSEC (#1856436)
  - add support for RCEC Associated Endpoint (#1856440)


author: Petr Pisar <ppisar@redhat.com> - 8.41-6
changelog:
  - Fix returning unset groups in POSIX interface if REG_STARTEND has a non-zero
    starting offset (upstream bug #2244)


author: Petr Pisar <ppisar@redhat.com> - 8.42-2
changelog:
  - Fix handling UTF and start-of-pattern options in C++ wrapper
    (upstream bug #2283)
  - Fix an error message and locale handling in pcregrep tool


author: Petr Pisar <ppisar@redhat.com> - 8.42-3
changelog:
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256
    (bug #1619228)


author: Petr Pisar <ppisar@redhat.com> - 8.42-5
changelog:
  - Fix CVE-2019-20838 (a subject buffer overread in JIT when UTF is disabled
    and \X or \R has a greater than 1 fixed quantifier) (bug #1852252)
  - Fix CVE-2020-14155 (an integer overflow when parsing numbers after "(?C"))
    (bug #1851552)


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: Jakub Jelen <jjelen@redhat.com> - 1.9.5-1
changelog:
  - Rebase to 1.9.5 version to address race conditions (#2014641)
  - Drop dowstream polkit policy to avoid repeated authentication requests in remote sessions (#1928154)


author: Paul Howarth <paul@city-fan.org> - 7.14-1
changelog:
  - Update to 7.14
    - Fix a crash bug in AnyEvent::Handle with openssl 1.1.0
    - AnyEvent::Handle->keepalive was documented (and defined) twice
    - AnyEvent::Socket::tcp_bind/tcp_server would immediately unlink a unix
      listening socket unless a guard is used; change this so that no clean-up
      will be performed unless a guard is used and document this more clearly
    - Make tcp_bind/tcp_server error messages more regular
    - Fix building on Perl without '.' in @INC
    - Add TCP_FASTOPEN/MSG_FASTOPEN and MSG_NOSIGNAL/MSG_MORE/MSG_DONTWAIT to
      constants
    - Update warnings to common::sense 3.74 standards


author: Michal Josef Špaček <mspacek@redhat.com> - 7.14-7
changelog:
  - Fix tests run by adding better algorithm
    Resolves: rhbz#2108086
  - Package tests
    Resolves: rhbz#2108086


author: Paul Howarth <paul@city-fan.org> - 0.400002-1
changelog:
  - Update to 0.400002
    - Revert whitespace changes that were inadvertantly included in previous
      release
    - Escape curly brackets in test to avoid warning in perl 5.22


author: Paul Howarth <paul@city-fan.org> - 0.12-1
changelog:
  - Update to 0.12
    - Grok dist names ending with something numeric containing underscores
  - Make %files list more explicit
  - Drop %defattr, redundant since rpm 4.4
  - Don't need to remove empty directories from the buildroot
  - Use DESTDIR rather than PERL_INSTALL_ROOT
  - Don't use macros for commands


author: Petr Pisar <ppisar@redhat.com> - 0.12-13
changelog:
  - Remove perl-CPAN-DistnameInfo RPM package from perl-App-cpanminus module with
    perl:5.30 (bug #1713592)


author: Michal Josef Špaček <mspacek@redhat.com> - 2.18-402
changelog:
  - Resolves: RHEL-9605
    - Add 2022 PAUSE public key.
    - Change default value for urllist to https://www.cpan.org
    - Use gpg --verify --output ... to disentangle data and signature


author: Paul Howarth <paul@city-fan.org> - 0.51-1
changelog:
  - Update to 0.51
    - Increase speed (CPAN RT#84838)
    - Faster constructor (CPAN RT#57353)
    - Fixed typos for CPAN RT#61304 and CPAN RT#86422
  - Classify buildreqs by usage


author: Paul Howarth <paul@city-fan.org> - 1.5-1
changelog:
  - Update to 1.5
    - Work around global destruction order issue (CPAN RT#23568/68526)
  - This release by SHAY ⇒ update source URL
  - Drop %defattr, redundant since rpm 4.4
  - Don't use macros for commands
  - Don't need to remove empty directories from the buildroot
  - Classify buildreqs by usage
  - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 0.005-1
changelog:
  - Update to 0.005
    - No longer include a Makefile.PL in the distribution
    - In documentation, use four-column indentation for all verbatim material
    - In META.{yml,json}, point to public bug tracker
    - Convert .cvsignore to .gitignore
  - Classify buildreqs by usage
  - Don't need to remote empty directories from the buildroot
  - Make %files list more explicit
  - Drop legacy Group: tag


author: Jitka Plesnikova <jplesnik@redhat.com> - 6.60-3
changelog:
  - Replace versioned MODULE_COMPAT by non-versioned perl-libs
  - Package tests
  - Resolves: rhbz#2219504


author: Paul Howarth <paul@city-fan.org> - 2:1.46-1
changelog:
  - Update to 1.46
    - Fixed the formatting for the CLDR "S" symbol, which in some cases would
      round up to 1 instead of truncating a value, e.g. the "SSS" symbol would
      format 999,999,999 nanoseconds as "1.000" (GH#71)


author: Paul Howarth <paul@city-fan.org> - 2:1.47-1
changelog:
  - Update to 1.47
    - DateTime::Duration->multiply now only allows integer multipliers (GH#73)
    - Added is_last_day_of_quarter() and is_last_day_of_year() methods (GH#72)
    - When an exception was thrown while adding a duration, the object could be
      left in a broken state with the duration partially applied; subsequent
      addition or subtraction would produce the wrong results (GH#74)
  - Add patch to support use without Sub::Util (GH#77, GH#78)


author: Paul Howarth <paul@city-fan.org> - 2:1.48-1
changelog:
  - Update to 1.48
    - The last release would die if Sub::Util was not available, but this should
      just be an optional requirement (GH#77, GH#78)


author: Paul Howarth <paul@city-fan.org> - 2:1.49-1
changelog:
  - Update to 1.49
    - Updated the ppport.h with the latest version of Devel::PPPort, which fixes
      a compilation warning when compiling with 5.27.11 (GH#81)
  - Switch upstream from search.cpan.org to metacpan.org


author: Paul Howarth <paul@city-fan.org> - 2:1.50-1
changelog:
  - Update to 1.50
    - The %F strftime pattern incorrectly zero-padded numbers less than four
      digits; according to POSIX::strftime, this should output the year as-is
      without padding (GH#83)


author: Paul Howarth <paul@city-fan.org> - 1:0.403-1
changelog:
  - Update to 0.403
    - Use DateTime->set_locale instead of ->set to set the locale; using ->set
      may actually change the local time unintentionally (GH#2)
  - Run the author and release tests too
  - Make %files list more explicit
  - Update build dependencies and drop redundant requires filter


author: Paul Howarth <paul@city-fan.org> - 1:1.70-1
changelog:
  - Update to 1.70
    - The word boundary check supposedly added in 1.67 didn't really work
      properly, and still matched too much (GH#11)
    - Added docs for several formats that have long been supported but not
      documented; these are %P, %c, %x, and %X (GH#10)
    - Altered the conversion specifier %z to accept ±HH, ±HHMM, ±HH:MM and Z;
      previously only ±HHMM were accepted (GH#13)


author: Paul Howarth <paul@city-fan.org> - 1:1.72-1
changelog:
  - Update to 1.72
    - By default, the word boundary checks added in 1.69 are now off; you can
      enable them by passing "strict => 1" to the constructor (GH#15)
    - Switched from Params::Validate to Params::ValidationCompiler
    - Require DateTime::Locale 1.05; this fixes some test failures seen on CPAN
      Testers
    - Require DateTime::TimeZone 2.09 because you should really update this on a
      regular basis
    - Require Specio 0.33 to fix other test failures seen on CPAN (I hope)


author: Paul Howarth <paul@city-fan.org> - 1:1.73-1
changelog:
  - Update to 1.73
    - The format_datetime method now checks that the object it is given isa
      DateTime object (GH#17)


author: Paul Howarth <paul@city-fan.org> - 1:1.74-1
changelog:
  - Update to 1.74
    - Fix text not to rely on a very specific exception message from Specio; this
      was broken in 0.39 (GH#18)


author: Paul Howarth <paul@city-fan.org> - 0.010-1
changelog:
  - Update to 0.010
    - No longer include a Makefile.PL in the distribution
    - In META.{yml,json}, point to public bug tracker
    - In META.json, specify type of public repository
  - Classify buildreqs by usage
  - Make %files list more specific
  - Drop legacy Group: tag


author: Paul Howarth <paul@city-fan.org> - 0.011-1
changelog:
  - Update to 0.011
    - No longer include a Makefile.PL in the distribution
    - In documentation, use four-column indentation for all verbatim material
    - In META.{yml,json}, point to public bug tracker
    - In META.json, specify type of public repository
  - Drop redundant %{?perl_default_filter}
  - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 0.14-1
changelog:
  - Update to 0.14
    - Stop relying on . being in @INC
    - Switch to ExtUtils::HasCompiler to detect presence of a compiler
  - Classify buildreqs by usage


author: Paul Howarth <paul@city-fan.org> - 0.05-10
changelog:
  - Classify buildreqs by usage
  - Simplify find commands using -empty and -delete
  - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 1:2.16-1
changelog:
  - Update to 2.16
    - docs only change: create a real link to perlref.pod
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1:2.17-1
changelog:
  - Update to 2.17
    - Unlist Compress::Zlib as a prereq; it was and still is only used by a test
      that won't run for normal user installs (CPAN RT#113886)
  - Author tests now require AUTHOR_TEST variable rather than --doit parameter


author: Paul Howarth <paul@city-fan.org> - 1:2.18-1
changelog:
  - Update to 2.18
    - Makefile.PL changes to support perls without "." in @INC; no functional
      change


author: Paul Howarth <paul@city-fan.org> - 0.21-5
changelog:
  - Fix FTBFS due to missing buildreq perl-devel
  - Simplify find command using -empty and -delete
  - Use %{_fixperms} macro rather than our own chmod incantation
  - Make %files list more explicit


author: Jason Tibbitts <tibbs@math.uh.edu> 1.05-1
changelog:
  - Specfile autogenerated by cpanspec 1.78.
  - Cleaned up the generated spec to meet current guidelines.


author: Jason L Tibbitts III <tibbs@math.uh.edu> - 1.05-2
changelog:
  - Add more build dependencies.
  - Use DESTDIR instead of cpanspec-provided PERL_INSTALL_ROOT.
  - Build with NO_PACKLIST=1 and don't bother deleting .packlist files.


author: Paul Howarth <paul@city-fan.org> - 0.14-1
changelog:
  - Update to 0.14
    - A couple of minor optimizations (GH#8)
  - BR: perl-generators
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1.41-1
changelog:
  - Update to 1.41
    - Switch to GitHub Issues
  - Author/Release tests moved to xt/, so don't bother trying to run them


author: Paul Howarth <paul@city-fan.org> - 1.42-1
changelog:
  - Update to 1.42
    - Generated exception classes are now added to %INC; if you subclass a
      generated class with "use base" then base.pm will no longer attempt to load
      the requested class (GH#8)


author: Paul Howarth <paul@city-fan.org> - 1.43-1
changelog:
  - Update to 1.43
    - The full_message() method in Exception::Class::Base now calls message()
      instead of accessing the object's hash key, which makes it easier to
      override message() in a subclass (GH#11)


author: Paul Howarth <paul@city-fan.org> - 1.44-1
changelog:
  - Update to 1.44
    - You can now pass "frame_filter", "filter_frames_early" and "skip_frames"
      to the throw() method of an exception class; these will be passed on to
      the Devel::StackTrace constructor (GH#6)


author: Paul Howarth <paul@city-fan.org> - 0.044-1
changelog:
  - Update to 0.044
    - Support { -as => CODE } to programmatically rename functions
    - Restructure documentation
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1.000000-1
changelog:
  - Update to 1.000000
    - Repackage as 1.000000
  - All shipped files are now GPL+ or Artistic
  - Drop EL-5 support
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section


author: Paul Howarth <paul@city-fan.org> - 0.3.0-1
changelog:
  - Update to 0.3.0
    - Converted the build system to Dist-Zilla
  - Switch to ExtUtils::MakeMaker-based flow


author: Paul Howarth <paul@city-fan.org> - 0.3.1-1
changelog:
  - Update to 0.3.1
    - Fixed an issue with tracking the depth of the inodes when detecting a
      symlink loop


author: Paul Howarth <paul@city-fan.org> - 0.3.2-1
changelog:
  - Update to 0.3.2
    - Made the version number consistent across the .pm files
      (https://bitbucket.org/shlomif/perl-file-find-object/issues/1/wrong-version-number)


author: Paul Howarth <paul@city-fan.org> - 1.30-9
changelog:
  - Fix "Redundant argument in sprintf" warning (CPAN RT#109673)
  - Classify buildreqs by usage
  - Simplify find command using -delete
  - Use %license where possible


author: Petr Pisar <ppisar@redhat.com> - 0.28-2
changelog:
  - Break build cycle: perl-Path-Tiny → perl-Unicode-UTF8 →
    perl-Module-Install-ReademFromPod → perl-IO-All → perl-File-MimeInfo


author: Paul Howarth <paul@city-fan.org> - 0.1011-1
changelog:
  - Update to 0.1011
    - Fixed POD typos
  - Package CONTRIBUTING.mkdn
  - Update to working source URL, unfortunately author-specific
  - Drop redundant Group: tag
  - Expand %description
  - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 0.87-1
changelog:
  - Update to 0.87
    - Fix io($dir)->all when files have unicode in names (GH#95)
    - Stop trampling $!
    - Add cmp overload to fix some windows problems (GH#74)
  - This release by FREW → update source URL
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 2.111-1
changelog:
  - Update to 2.111
    - Update maintainer's name, which is now Dianne Skoll
  - Use %license where possible


author: Paul Howarth <paul@city-fan.org> - 0.95-1
changelog:
  - Update to 0.95
    - Enable Travis-CI integration for IPC::Run
    - Use q{} and qq{} to fix problems with quotation in cmd.exe
    - Sync $VERSION across all files to address kwalitee
    - Stop side effect of altering flushing of STDOUT and STDERR (CPAN RT#109243)
    - CHILD_HANDLE should be closed with 'Close' to prevent a warning
    - Require Win32API::File on Windows
    - Better timer error message plus an additional unit test
    - Catching previously non-detected malformed time strings
    - Let Timer accept all allowable perl numbers
    - Allow the OS to choose the ephemeral port to use
    - Don't use version.pm to parse the perl version in Makefile.PL
    - perltidy
    - Do not import POSIX into local namespace (it's a memory hog)
    - Skip infinity test on perl below 5.8.9
    - Spelling fixes
    - Documentation fix: full_result returns $?, not $? >> 8
    - Fix check for reaped PID in reap_nb
    - Re-remove unnecessary use of UNIVERSAL
  - Remove redundant Group: tag


author: Paul Howarth <paul@city-fan.org> - 0.97-1
changelog:
  - Update to 0.97
    - Update meta and POD to point to GitHub issues not RT
    - Update README with pod changes
    - Fix variable name in synopsis (GH#47)
    - Fix t/run.t to work on "perl in space" (GH#100)


author: Paul Howarth <paul@city-fan.org> - 0.98-1
changelog:
  - Update to 0.98
    - Switch to using $!{EINTR}
    - Honor umask for user/group permissions on a +rw file
    - Remove commented code from CPAN RT#50739
    - Fix _write on invalid objects (GH#63)
    - Make slave the controlling terminal so more programs can be called from
      IPC::Run reliably (GH#54)
    - Prevent Not a GLOB reference in close_terminal by untieing before close
      (GH#53)
    - Fix '&' closing the stdin of the right process (GH#46)
    - Do POSIX::_exit not ::exit (GH#41)
    - Ensure child Win32 processes have same priority as parent (GH#40)
    - Add unit test for passing use of Readonly.pm (GH#38)
    - Fix GLOB test in IPC::Run::IO->new (GH#39)
    - Fix for memory leak (GH#86, CPAN RT#57990)
    - MANIFEST was updated; new tests may start shipping now


author: Paul Howarth <paul@city-fan.org> - 0.99-1
changelog:
  - Update to 0.99
    - Fixes for Windows unit tests so they skip or pass
      - t/autoflush.t
      - t/readonly.t
      - t/run_stdin-callback-return-array.t


author: Paul Howarth <paul@city-fan.org> - 2.97-1
changelog:
  - Update to 2.97 (upstream 2.97000 but stick to two-digit minor version
    downstream in case upstream changes back before version 3.x)


author: Petr Pisar <ppisar@redhat.com> - 1:0.65-13
changelog:
  - Correct misspellings in Net::LDAP::FAQ
  - Perform tests against a server
  - Net::LDAP::DSML moved to perl-Net-LDAP-DSML package due to XML dependencies


author: Petr Pisar <ppisar@redhat.com> - 1:0.66-7
changelog:
  - Fix tests subpackage test script (bug #1663063)
  - Fix a shell bang in a certificate generator script (bug #1663063)


author: Paul Howarth <paul@city-fan.org> - 0.418-1
changelog:
  - Update to 0.418
    - Divorce List::MoreUtils and List::MoreUtils::XS
    - Change license to Apache 2.0 to avoid code stealing without credits
    - Don't support Perl 5.6 out of the box any more
    - Fix CPAN RT#120235: uniq examples are incorrect
    - Remove things that will be never done from TODO list (GH#18)
    - Spelling fixes
  - Package is now noarch


author: Paul Howarth <paul@city-fan.org> - 0.419-1
changelog:
  - Update to 0.419
    - Makefile.PL failed due to unescaped paths interpolated in regex pattern
      (CPAN RT#120799)


author: Paul Howarth <paul@city-fan.org> - 0.423-1
changelog:
  - Update to 0.423
    - Sync version with List::MoreUtils::XS
    - Add some new functions: qsort (XS only), binsert, bremove, listcmp,
      arrayify (CPAN RT#17230), samples (CPAN RT#77562), minmaxstr
      (CPAN RT#106401), lower_bound, upper_bound, equal_range, frequencies
      occurrences, mode (CPAN RT#91991), zip6 (CPAN RT#42921), reduce_0,
      reduce_1, reduce_u
    - Add examples for binsert/bremove (LMU::XS GH#1)
    - Improve tests
    - Make List::MoreUtils::XS independent from List::MoreUtils
    - Improve Makefile.PL regarding some build artifacts
    - Update tests to latest List::MoreUtils::XS
    - Recommend List::MoreUtils::XS 0.423
  - BR:/R: LMU::XS ≥ 0.423 as there is no longer a bootstrapping issue


author: Paul Howarth <paul@city-fan.org> - 0.426-1
changelog:
  - Update to 0.426
    - Fix broken arrayify prototype
    - Revert removal of old List::MoreUtils::XS parts
    - Re-introduce Config::AutoConf (CPAN RT#122875)
    - Bump required version of List::MoreUtils::XS to 0.426, if XS is available


author: Paul Howarth <paul@city-fan.org> - 0.428-1
changelog:
  - Update to 0.428
    - Fix GH#22 (Upgrading from LMU 0.416 to split XS/PP version will fail),
      this time hopefully the right way (CPAN RT#123310)
    - Fix GH#29 (pairwise() PP implementation add tail undefs if array sizes
      differ)


author: Paul Howarth <paul@city-fan.org> - 0.421-1
changelog:
  - Update to 0.421
    - Fix a lot of potential memory leaks when callbacks throw exceptions
    - Add some new functions: qsort, binsert, bremove, listcmp, arrayify
      (CPAN RT#17230), samples (CPAN RT#77562), minmaxstr (CPAN RT#106401),
      lower_bound, upper_bound, equal_range, frequencies, occurances, mode
      (CPAN RT#91991), zip6 (CPAN RT#42921), reduce_0, reduce_1, reduce_u
    - Improve tests
    - Make List::MoreUtils::XS independent from List::MoreUtils
      Note that List::MoreUtils::XS doesn't guarantee API stability: this
      feature is only provided through List::MoreUtils as frontend
    - Improve configure toolchain to use Config::AutoConf 0.315
    - Speed up some inner loops by hinting the expected result
    - Fix mind screwed up issue in upper_bound and reduce elements visited in
      equal_range
    - Correct license in META (CPAN RT#122702)
    - Fix issues with -DPERL_IMPLICIT_SYS on Windows with Strawberry-Perl


author: Paul Howarth <paul@city-fan.org> - 0.422-1
changelog:
  - Update to 0.422
    - Rename 'occurances' into 'occurrences' (CPAN RT#91991, CPAN RT#122806)
    - Add DESCRIPTION to Pod clarifying the role of List::MoreUtils::XS
    - Improve Makefile.PL regarding some build artifacts


author: Paul Howarth <paul@city-fan.org> - 0.423-1
changelog:
  - Update to 0.423
    - Fix dealing with lists with one element on bremove/binsert (GH#2)
    - Add support for compilers before C99
    - Fix some 32-bit compiler warnings
    - Add support for compilers without statement expression feature


author: Paul Howarth <paul@city-fan.org> - 0.426-1
changelog:
  - Update to 0.426
    - Fix broken format in part (GH#4)
    - Fix gcc 4.7 sequence point warning (GH#5)
    - Fix incorrect padname resolving for perl > 5.21.6 (CPAN RT#122883)
    - Fix compiling issue on CentOS 4 and CentOS 5


author: Paul Howarth <paul@city-fan.org> - 0.428-1
changelog:
  - Update to 0.428
    - Fix build fails on perl ≥ 5.27.4 with -DDEBUGGING (CPAN RT#123613)
    - Update ppport.h to 3.37 for improved blead support
    - Fix context arg to croak() (CPAN RT#123869)
    - Fix one() returning true on empty list (CPAN RT#123870)
    - Pamper $a/$b/$_ refcounting bugs (CPAN RT#123868)


author: Paul Howarth <paul@city-fan.org> - 2.14-1
changelog:
  - Update to 2.14
    - MojoX should not die on missing types (CPAN RT#123298)
  - Drop EL-5 support
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section


author: Paul Howarth <paul@city-fan.org> - 2.16-1
changelog:
  - Update to 2.16
    - Collecting of IANA info had stalled: logic rewritten
    - Moved to git and GitHub
    - Move scripts and source files into MANIFEST.extra
    - Update types and extensions


author: Paul Howarth <paul@city-fan.org> - 2.17-1
changelog:
  - Update to 2.17
    - When picking a preferred type for an extension, prefer the type with the
      same minor-name
    - Remove IANA obsoleted types


author: Petr Pisar <ppisar@redhat.com> - 0.09-10
changelog:
  - Break build cycle when bootstrapping (Test::CleanNamespaces →
    Package::Stash → Module::Implementation)


author: Paul Howarth <paul@city-fan.org> - 0.16-1
changelog:
  - Update to 0.16
    - The subs installed into the caller are now named with Sub::Name; this makes
      these subs appear to be part of the caller, as opposed to an import, which
      is what we want, since each installed sub is constructed uniquely for a
      given package
  - Update patches as needed


author: Paul Howarth <paul@city-fan.org> - 0.17-1
changelog:
  - Update to 0.17
    - Remove use of namespace::autoclean
  - BR: perl-generators
  - Simplify find command using -delete
  - Author and Release Tests moved to xt/ so don't bother trying to run them


author: Paul Howarth <paul@city-fan.org> - 0.37-1
changelog:
  - Update to 0.37
    - Fix spurious warning in taint mode (GH#12)
  - Update patch for building with old Test::More versions
  - No documentation for Package::Stash::Conflicts in this release
  - Classify buildreqs by usage
  - Use %license where possible
  - Don't try to run the extra tests for EL builds as we won't have the
    dependencies


author: Paul Howarth <paul@city-fan.org> - 0.28-10
changelog:
  - Classify buildreqs by usage
  - Use %license where possible
  - Simplify find commands using -empty and -delete


author: Paul Howarth <paul@city-fan.org> - 2.2-1
changelog:
  - Update to 2.2
    - Convert to PERL_NO_GET_CONTEXT
      https://github.com/robinhouston/PadWalker/pull/2
  - Explicitly BR: perl-devel, needed for EXTERN.h


author: Paul Howarth <paul@city-fan.org> - 2.3-1
changelog:
  - Update to 2.3
    - Make tests work with -Ddefault_inc_excludes_dot (CPAN RT#120421)
  - Simplify find commands using -empty and -delete
  - Drop legacy Group: tag


author: Paul Howarth <paul@city-fan.org> - 0.015-1
changelog:
  - Update to 0.015
    - Port to Perl 5.19.4, where the C type of array indices has changed
    - Update to accommodate PERL_OP_PARENT builds of Perl 5.21.11 or later
      (which is the default from Perl 5.25.1)
    - Trigger custom op generation via Devel::CallChecker rather than by hooking
      the underlying op checker
    - Update test suite not to rely on . in @INC, which is no longer necessarily
      there from Perl 5.25.7
    - No longer include a Makefile.PL in the distribution
    - Correct dynamic_config setting to 0
    - Use boolSV() where appropriate in XS code
    - Use cBOOL() where appropriate
    - Consistently use THX_ prefix on internal function names
    - Include META.json in distribution
    - Add MYMETA.json to .cvsignore
    - Convert .cvsignore to .gitignore
    - Update for changed S_croak_xs_usage() prototype in ExtUtils::ParseXS 3.30,
      requiring the new version of that module in order to build the XS
      implementation
    - In documentation, use four-column indentation for all verbatim material
    - In META.{yml,json}, point to public bug tracker
    - Correctly classify ExtUtils::ParseXS dependency as a recommendation rather
      than a requirement
    - Avoid some compiler warnings
  - Classify buildreqs by usage
  - Drop legacy spec file elements: %defattr and Group: tag
  - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 0.24-1
changelog:
  - Update to 0.24
    - The source_for() exported by Params::ValidationCompiler did not work at all
      (GH#16)


author: Paul Howarth <paul@city-fan.org> - 0.25-1
changelog:
  - Update to 0.25
    - All exceptions now include a stack trace by default when treated as a
      string; this makes finding where validation failed a lot easier (GH#18)
    - The name for a subroutine is now used in some exception messages, even if
      Sub::Util cannot be installed


author: Paul Howarth <paul@city-fan.org> - 0.26-1
changelog:
  - Update to 0.26
    - The exceptions.t test would fail if Sub::Util was not installed (GH#19)
    - Fix test failures on Windows (GH#20)


author: Paul Howarth <paul@city-fan.org> - 0.27-1
changelog:
  - Update to 0.27
    - Fixed a bug with inlining Moose types: if a type's parent needed
      environment variables, those would not get closed over (GH#22)
    - Added a debug option to dump the source of the subroutine before it is
      eval'd


author: Paul Howarth <paul@city-fan.org> - 0.096-1
changelog:
  - Update to 0.096
    - Improved method for hiding some modules during tests
  - BR: perl-generators unconditionally


author: Paul Howarth <paul@city-fan.org> - 0.098-1
changelog:
  - Update to 0.098
    - Added 'realpath' option for 'tempfile' and 'tempdir' for situations where
      an absolute temporary path just isn't enough


author: Paul Howarth <paul@city-fan.org> - 0.100-1
changelog:
  - Update to 0.100
    - Fixed tests for eventual removal of '.' from @INC in Perl
    - Fixed filehandle mode doc typo
    - Fixed doc typo in relative() that mentioned rel2abs instead of abs2rel


author: Paul Howarth <paul@city-fan.org> - 0.104-1
changelog:
  - Update to 0.104
    - The 'absolute' method now always returns an absolute path, even if a user
      provided a relative path for the base path; the old, odd behavior was
      documented, but people often don't read docs so the new behavior avoids
      surprises
    - Added 'cached_temp' method


author: Paul Howarth <paul@city-fan.org> - 0.007-1
changelog:
  - Update to 0.007
    - Adapt to dot no longer being in @INC
    - Adapt to unicode syswrite being deprecated
  - Drop redundant Group: tag


author: Paul Howarth <paul@city-fan.org> - 2.01-1
changelog:
  - Update to 2.01
    - Disallow initialization of Readonly variables by assignment, allowed by
      Perl prototype changes in v5.16; assignment initialization of scalars sets
      scalar variables to undef and lists and hashes initialized by assignment
      are not read only
  - Use %license
  - Upstream switched to Module::Build::Tiny flow
  - Update interpreter patch


author: Paul Howarth <paul@city-fan.org> - 2.04-1
changelog:
  - Update to 2.04
    - Create mutable clones of readonly structures with Readonly::Clone (GH#13)
    - Minor typo fix (GH#21)
    - Rewording some documentation
    - No longer require an explicit version of perl in META.json or cpanfile
    - Quiet compile time warnings about function prototypes and vars being used
      only once
  - Update interpreter patch


author: Paul Howarth <paul@city-fan.org> - 2.05-1
changelog:
  - Update to 2.05
    - Fix deref when using the stupid and utterly unnecessary Readonly::Clone
  - BR: perl-generators where available
  - Bump Test::More version requirement to 0.88 due to use of done_testing
  - Update interpreter patch


author: Paul Howarth <paul@city-fan.org> - 0.200-1
changelog:
  - Update to 0.200
    - Reimplement in pure Perl, with a dynamic dependency on a new Ref::Util::XS
      module that contains the fast XS implementation
  - This release by ARC → update source URL
  - Package is now noarch


author: Paul Howarth <paul@city-fan.org> - 0.203-1
changelog:
  - Update to 0.203
    - Fix space/tab issue in Makefile
    - Don't use DynamicPrereqs for unrelated Makefile.PL snippet
    - Use of the Pure-Perl implementation can now be forced at runtime by setting
      either $Ref::Util::IMPLEMENTATION or $ENV{PERL_REF_UTIL_IMPLEMENTATION} to
      "XS"
    - Fix is_*_formatref() error messages (GH#38)
    - Speed enhancements for is_*_formatref() on 5.8+
    - Restore 5.6 and 5.8 compatibility
    - PP behaviour now matches XS for \v1.2.3 and \sub {}
    - Updated documentation to reflect the PP/XS split


author: Paul Howarth <paul@city-fan.org> - 0.116-1
changelog:
  - Update to 0.116
    - Changes rephrasing
    - Restore 5.6 compatibility
    - Replace docs with a link to Ref::Util


author: Paul Howarth <paul@city-fan.org> - 0.116-2
changelog:
  - Incorporate package review feedback (#1450440)
    - Drop EL6-isms as we need Test::More 0.94, which EL-6 will never have


author: Paul Howarth <paul@city-fan.org> - 0.117-1
changelog:
  - Update to 0.117
    - Allow the custom OPs to be deparsed with B::Deparse
    - Optimize the shared object size by moving common call checker logic into a
      function


author: Paul Howarth <paul@city-fan.org> - 1.20141117-6
changelog:
  - Package LICENSE file
  - Drop legacy spec file elements not needed for EL-6 onwards
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 0.21-1
changelog:
  - Update to 0.21
    - Remove useless use of UNIVERSAL::isa (CPAN RT#105948)
  - Classify buildreqs by usage
  - Drop obsoletes/provides for old tests sub-package
  - Drop %defattr, redundant since rpm 4.4
  - Don't need to remove empty directories from the buildroot
  - Don't use macros for common commands
  - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 0.37-1
changelog:
  - Update to 0.37
    - Possible fix for very weird failures seen under threaded Perls with some
      modules that use Specio


author: Paul Howarth <paul@city-fan.org> - 0.38-1
changelog:
  - Update to 0.38
    - Simplify checks for overloading to not call overload::Overloaded(); just
      checking the return value of overload::Method() is sufficient


author: Paul Howarth <paul@city-fan.org> - 0.39-1
changelog:
  - Update to 0.39
    - Many bug fixes and improvements to the types created by
      {any,object}_{can,does,isa}_type; in some cases, an invalid value could
      cause an exception in type check itself, and in other cases, a value that
      failed a type check would cause an exception when generating a message
      describing the failure
    - The messages describing a failure for all of these types have been improved
    - You can now create anonymous *_does and *_isa types using the exports from
      Specio::Declare


author: Paul Howarth <paul@city-fan.org> - 0.40-1
changelog:
  - Update to 0.40
    - Fixed more bugs with {any,object}_{can,does,isa}_type
      - When passed a glob (not a globref) they would die in their type check
      - On Perl 5.16 or earlier, passing a number to an any_* type would also die
    - Fixed subification overloading: if Sub::Quote was loaded, this would be
      used, but any environment variables needed for the closure would not be
      included, which broke enums, among other things


author: Paul Howarth <paul@city-fan.org> - 0.42-1
changelog:
  - Update to 0.42
    - Fixed checks for whether a class is loaded in light of upcoming
      optimization in Perl 5.28 (GH#12)
    - The Perl library claimed it provided types named LaxVersionStr and
      StrictVersionStr but they were really named LaxVersion and StrictVersion;
      the names have now been fixed to match the documentation, so they are
      LaxVersionStr and StrictVersionStr


author: Paul Howarth <paul@city-fan.org> - 0.001012-1
changelog:
  - Update to 0.001012
    - Many small performance improvements
  - BR: perl-generators
  - Simplify find command using -delete
  - Update old Test::More patch
  - Package new LICENSE file


author: Paul Howarth <paul@city-fan.org> - 0.001013-1
changelog:
  - Update to 0.001013
    - Avoid possible warnings about special variables only being used once
  - Update old Test::More patch


author: Paul Howarth <paul@city-fan.org> - 0.13-1
changelog:
  - Update to 0.13
    - Reformatted Changes to follow basic format in CPAN::Changes::Spec
    - Make tests pass without . in @INC


author: Paul Howarth <paul@city-fan.org> - 0.18-1
changelog:
  - Update to 0.18
    - Support binary and unicode symbol names (PR#8)
    - Fixed parsing error where the name contains a single colon but the last
      separator is ::


author: Paul Howarth <paul@city-fan.org> - 0.21-1
changelog:
  - Update to 0.21
    - Fix occasional segmentation fault on OpenBSD when malloc randomization
      causes nameptr to be at the beginning of the page (CPAN RT#117072)


author: Paul Howarth <paul@city-fan.org> - 1.122-1
changelog:
  - Update to 1.122
    - Added $Test::Deep::LeafWrapper to control the behavior of simple values in
      the "expected" definition
    - Documentation improvements
    - Avoid a few evals, localize $@ in a few places where eval is used
    - Goodbye tabs, hello spaces
  - BR: perl-generators
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1.123-1
changelog:
  - Update to 1.123
    - Remove test suite reliance on "." appearing @INC
    - When an object with stringification overloading fails to match a "re" test,
      its stringification is included in the diagnostics


author: Paul Howarth <paul@city-fan.org> - 1.124-1
changelog:
  - Update to 1.124
    - Avoid an uninitialized warning when array_each() compares to a
      non-reference


author: Paul Howarth <paul@city-fan.org> - 1.126-1
changelog:
  - Update to 1.126
    - If objects in the "expected" structure have an as_test_deep_cmp method, it
      will be called and its return (which should be a Test::Deep::Cmp object)
      will be used as the test for that location in the structure
    - Internal undocumented class_base routine has been replaced with a
      different, clearly private routine
    - The LeafWrapper is also used for objects with an unknown reftype (like
      LVALUE or other weird ones)


author: Paul Howarth <paul@city-fan.org> - 1.127-1
changelog:
  - Update to 1.127
    - Do not eagerly convert simple scalars into tests in the all, any and none
      tests; this was breaking LeafWrapper application
  - Drop EL-5-isms
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section


author: Steven Pritchard <steve@kspei.com> 0.093-1
changelog:
  - Specfile autogenerated by cpanspec 1.64.
  - Improve description.
  - Fix License.
  - Remove explicit dependency on Test::Tester and Test::NoWarnings.


author: Paul Howarth <paul@city-fan.org> - 0.110-1
changelog:
  - Update to 0.110
    - Allow methods() and listmethods() to work again on class methods
      (CPAN RT#77804)
  - Drop redundant BR: perl(Data::Dumper)
  - Drop arrayeach patch - similar change introduced upstream
  - Drop %defattr, redundant since rpm 4.4
  - Don't need to remove empty directories from the buildroot
  - Don't use macros for commands
  - Use DESTDIR rather than PERL_INSTALL_ROOT
  - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 0.112-1
changelog:
  - Update to 0.112
    - When printing diagnostics, differentiate the type of a blessed object from
      the name of the class itself (CPAN RT#78288)
    - Typo fixes
    - Fixes to clarity and accuracy of documentation
    - Add metadata links to repo and issue tracker
    - Added obj_isa for testing ->isa without falling back to ref($x)
    - Added the *experimental* ":v1" export group to skip importing Isa, isa, and
      blessed


author: Paul Howarth <paul@city-fan.org> - 0.113-1
changelog:
  - Update to 0.113
    - Fix a compile error (!!) in RegexpOnly
    - Fix some documentation typos
    - Add license to META file


author: Paul Howarth <paul@city-fan.org> - 0.114-1
changelog:
  - Update to 0.114
    - Improve prereqs metadata
    - Add a noneof() set test
    - regexponly hasn't worked... ever; now it does
    - Passing :preload to import loads all plugins up front
    - A few more tests have been documented
    - The many exports of Test::Deep are now documented!


author: Paul Howarth <paul@city-fan.org> - 0.117-1
changelog:
  - Update to 0.117
    - Do not lose argument(s) to import
      (https://github.com/rjbs/Test-Deep/issues/29)


author: Paul Howarth <paul@city-fan.org> - 0.119-1
changelog:
  - Update to 0.119
    - Overloading of & and | no longer can change All or Any objects found as
      arguments
    - An All as an argument to an All constructed is flattened out into its
      All-ed values; the same goes for Any
    - Remove use of Test::NoWarnings for user-facing tests


