# changelog

author: Lubomir Rintel <lkundrak@v3.sk> - 1.10.2-1
changelog:
  - Update to 1.10.2 release (rh #1543498)
  - Don't grab cdc_ether devices on Sierra QMI modems (rh #1712031)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.40.16-5
changelog:
  - support bond port prio property (rh #1920398)
  - team: don't try to connect to teamd in update_connection() (rh #2182029)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.32-2
changelog:
  - Resolve issues found by rpmdiff
    - add explicit Requires: on subpackages to avoid the need to test
      interoperability between the various combinations of old and new
      subpackages


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.32-3
changelog:
  - Add a patch to resolve one more issue found by rpmdiff/rpminspect:
    fix getaddrinfo detection to avoid using gethostbyname.


author: Kamil Dudka <kdudka@redhat.com> 2.2.52-14
changelog:
  - drop obsolete BuildRoot and Group tags
  - fix spurious acl_check() failure on setfacl --restore (#1451826)


author: Kamil Dudka <kdudka@redhat.com> 2.2.52-15
changelog:
  - setfacl.1: document the meaning of '-' in perms (#1337039)
  - avoid failure of %check when building as root (#1085389)
  - apply patches automatically to ease maintenance


author: Al Stone <ahs3@redhat.com> - 20190108-1
changelog:
  - Update to 20190108 source tree, including patch refeshes.
  - Replace use of strncpy() with memcpy() when moving ASCII bytes around;
    the tables use "strings" but they are seldom null terminated, causing
    GCC9 to complain.  Closes BZ#1674629.


author: Al Stone <ahs3@redhat.com> - 20190509-2
changelog:
  - Added an arm7hl specific fix acenv.h; GCC9 on arm7hl can now deal
    with misalignments so the unaligned patch could be relaxed a bit
  - the templates test was failing because of the backup left behind
    by the patch macro, so change the invocation of the macro.


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 20190509-5.0.1
changelog:
  - Fix upgrade and downgrade warning (xuchunmei)
    * remove %pre to avoid warning when upgrade from old version
    * exec "alternatives --install" to avoid missing of acpixtract and acpidump
      when downgrade to old version
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build (Liwei Gei)
  - ignore mismatched ACPI Warning message at misc tests


author: Sumit Bose <sbose@redhat.com> - 0.8.2-6
changelog:
  - [abrt] [faf] adcli: raise(): /usr/sbin/adcli killed by 6 [#1806260]
  - No longer able to delete computer from AD using adcli [#1846882]
  - adcli: presetting $computer in $domain domain failed: Cannot set computer
    password: Authentication error [#1846878]
  - Typo in adcli update --help option [#1791611]
  - Manpage and help does not explain the use of "-C" option [#1791545]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-8
changelog:
  - Add --use-ldaps option to adcli update as well [#1883467]
  - Cannot join a pre-staged Computer Account on AD in Custom OU using Delegated
    user [#1734764]
  - missing documentation for required AD rights for adcli join and net
    join [#1852080]
  - [RFE] Add new mode to just create an AD account to be able to connect to
    LDAP [#1854112]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-10
changelog:
  - [RFE] Adcli and Realm Error Code Optimization Request [#1889386]
  - [RFE] adcli should allow to modify DONT_EXPIRE_PASSWORD attribute [#1769644]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-12
changelog:
  - [RFE] Allow adcli to create AD user with password as well as set or reset
    existing user password [#1952828]
  - [RFE] add option to populate "managed by" computer attribute [#1690920]


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.20-7
changelog:
  - the ownership of the spool directory should be root as at is configured
    with daemon username root
  - document the -n option


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-1
changelog:
  - Update to new 3.10.3 stable version.
  - Remove ppc64/ppc64le related patches.
  - All packages now use -A option to specify the target CPU/Architecture instead of 
  sed substitutions and auto detection. The packages should now be less dependant on the 
  builder machine used.
  - Base package for each architecture should now be configured to be compatible with the 
  most basic machine of given type.
  - In addittion to base package, added some optimized packages for more advanced CPUs for
  most architectures.
  - Dropped sse2/sse3 subpackages for ix86


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-6
changelog:
  * Pass all required compiler/linker flags
  - use annobin plugin
  - generate assembler build notes
  Related: #1624098


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-8
changelog:
  * Update the s390 subpackages:
  - The base pakcage is now optimized to z13
  - New subpackage is introduced: z14
  - All remaining subpackages for s390 are being deprecated
  - Clean up of the spec file 
  - Some commented out subpackages were removed form the spec
  - These subpackages were not built/shipped -> no change from the users point of view
  Resolves: #1782560
  Resolves: #1780286
  Resolves: #1782561


author: Kamil Dudka <kdudka@redhat.com> 2.4.47-19
changelog:
  - fix test-suite failure with perl-5.26.0 (#1473853)
  - apply patches automatically to ease maintenance
  - update URL of the upstream source tarball


author: Steve Grubb <sgrubb@redhat.com> 3.0-0.15.20191104git1c2f876
changelog:
  resolves: rhbz#1757986 - Rebase audit package on 8.2 for updates
  resolves: rhbz#1767054 - move audit rules to shared data directory
  resolves: rhbz#1746018 - Breakup 30-ospp-v42.rules into more granular files
  resolves: rhbz#1740798 - auditctl(8) needs clarification for backlog_limit
  resolves: rhbz#1497279 - Add option to interpret fields in audit syslog plugin


author: Sergio Correia <scorreia@redhat.com> - 3.0.5-1
changelog:
  - Rebase audit package on 8.6
    Resolves: rhbz#1939406
    Resolves: rhbz#1906065
    Resolves: rhbz#1921447
    Resolves: rhbz#1927884
    Resolves: rhbz#1921658


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-2
changelog:
  - Adjust sample-rules dir permissions
    Resolves: rhbz#2054727 - /usr/share/audit/sample-rules is no longer readable by non-root users


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-3
changelog:
  - Fix path normalization in auparse
    Resolves: rhbz#2062612 - auparse missing information when used with --format-text


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-4
changelog:
  - Drop ProtectHome from auditd.service as it interferes with rules
    Resolves: rhbz#2071727 - Default systemd service config blocks audit watch rules in some directories


author: Richard W.M. Jones <rjones@redhat.com> - 1.13.0-2
changelog:
  - Parse auto_reset_crashkernel in kdump
    resolves: rhbz#2042772
  - Add new directives and options for chrony


author: Richard W.M. Jones <rjones@redhat.com> - 1.13.0-4
changelog:
  - Fix parsing of /usr/lib/tmpfiles.d/provision.conf
  - Fix parsing of /etc/kernel/cmdline
    resolves: rhbz#2155136, rhbz#2159282


author: Pavel Březina <pbrezina@redhat.com> - 1.1-1
changelog:
  - Rebase to authselect-1.1 (RHBZ #1685516)
  - Notify that oddjob-mkhomedir needs to be enabled manually (RHBZ #1694103)
  - Ask for smartcard insertion when smartcard authentication is required (RHBZ #1674397)
  - Update translations (RHBZ #1689973)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.1-1
changelog:
  - Rebase to authselect-1.2.1 (RHBZ #1810471)
  - CLI commands are now correctly translated (RHBZ #1816009)
  - Remove unsupported features from sssd profile description (RHBZ #1830251)
  - add `with-files-access-provider` to sssd profile (RHBZ #1734094)
  - switch to pam_usertype module (RHBZ #1773567)
  - fix typo in sssd profile description (RHBZ #1787638)
  - add minimal profile (RHBZ #1654018)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.2-2
changelog:
  - try_first_pass option no longer works on some PAM modules in RHEL8 (RHBZ #1949070)
  - Need to localize the description of --debug option in authselect show (RHBZ #1970408)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.5-1
changelog:
  - Rebase to 1.2.5 (RHBZ #2080238)
  - sssd profile with-smartcard no longer prevents local users from accessing cron (RHBZ #2070325)
  - backup-restore now works correctly (RHBZ #2066535)
  - add with-subid to sssd profile (RHBZ #2063750)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.6-1
changelog:
  - Rebase to 1.2.6 (RHBZ #2142805)
  - Update translations (RHBZ #2139696)
  - Change password hashing algorithm from yescrypt back to sha512 (RHBZ #2151140)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.6-2
changelog:
  - Fix Japanese translations (RHBZ #2216755)
  - Update translations (RHBZ #2189557)
  - Do not prompt for password twice when changing password of local user (RHBZ #2179607)


author: Ian Kent <ikent@redhat.com> - 5.1.4-93
changelog:
  - bz2165143 - Autofs reports can't connect to sssd, retry for 10 seconds when
    real problem is empty LDAP object
    - improve handling of ENOENT in sss setautomntent().
    - dont immediately call function when waiting.
  - Resolves: rhbz#2165143


author: Ian Kent <ikent@redhat.com> - 5.1.4-102
changelog:
  - bz2177998 - deadlock while reading amd maps
    - fix return status of mount_autofs().
    - don't close lookup at umount.
    - fix deadlock in lookups.
    - dont delay expire.
    - make amd mapent search function name clear.
    - rename statemachine() to signal_handler().
    - make signal handling consistent.
    - fix incorrect print format specifiers in get_pkt().
    - eliminate last remaining state_pipe usage.
    - add function master_find_mapent_by_devid().
    - use device id to locate autofs_point when setting log priotity.
    - add command pipe handling functions.
    - switch to application wide command pipe.
    - get rid of unused field submnt_count.
    - fix mount tree startup reconnect.
    - fix unterminated read in handle_cmd_pipe_fifo_message() (Coverity).
  - Resolves: rhbz#2177998


author: Ian Kent <ikent@redhat.com> - 5.1.4-103
changelog:
  - bz2177998 - deadlock while reading amd maps
    - rebuild to avoid possible NVR problems.
  - Related: rhbz#2177998


author: Ian Kent <ikent@redhat.com> - 5.1.4-104
changelog:
  - bz2208408 - autofs fails to start with combination of +auto.master and
    local direct map lookups after upgrading to 5.1.4-93.el8
    - fix memory leak in sasl_do_kinit() (Coverity).
    - fix fix mount tree startup reconnect.
  - Resolves: rhbz#2208408


author: Ian Kent <ikent@redhat.com> - 5.1.4-105
changelog:
  - bz2207801 - amd map format netgoup selector function not working
    - fix date for revision 104 changelog entry.
    - fix use_ignore_mount_option description.
    - include addtional log info for mounts.
    - fix amd selector function matching.
    - get rid entry thid field.
    - continue expire immediately after submount check.
    - add buffer length checks to autofs mount_mount().
    - eliminate realpath from mount of submount.
    - eliminate root param from autofs mount and umount.
    - remove redundant fstat from do_mount_direct().
    - get rid of strlen call in handle_packet_missing_direct().
    - remove redundant stat call in lookup_ghost().
    - set mapent dev and ino before adding to index.
    - change to use printf functions in amd parser.
    - dont call umount_subtree_mounts() on parent at umount.
    - dont take parent source lock at mount shutdown.
    - eliminate buffer usage from handle_mounts_cleanup().
    - fix possible use after free in handle_mounts_exit().
    - make submount cleanup the same as top level mounts.
    - eliminate some more alloca usage.
    - add soucre parameter to module functions.
    - add ioctlfd open helper.
    - make open files limit configurable.
  - Resolves: rhbz#2207801


author: Ian Kent <ikent@redhat.com> - 5.1.4-106
changelog:
  - bz2214444 - The sss lookup modules handles error return incorrectly
    in some cases
    - fix some sss error return cases.
  - Resolves: rhbz#2214444


author: Ian Kent <ikent@redhat.com> - 5.1.4-107
changelog:
  - bz2216877 - When looking up included maps, sometimes autofs does not
    consult all the included files in order
    - fix incorrect matching of cached wildcard key
  - Resolves: rhbz#2216877


author: Ian Kent <ikent@redhat.com> - 5.1.4-108
changelog:
  - bz2216877 - When looking up included maps, sometimes autofs does not
    consult all the included files in order
    - fix the "fix incorrect matching of cached wildcard key" patch.
  - Related: rhbz#2216877


author: Ian Kent <ikent@redhat.com> - 5.1.4-109
changelog:
  - bz2213267 - filesystems mount and expire immediately
    - fix expire retry looping.
  - Resolves: rhbz#2213267


author: Kevin Fenzi <kevin@scrye.com> - 1.07.1-1https://bugs.archlinux.org/task/53546
changelog:
  - Update to 1.07.1
  - Fixes a bug that breaks kernel builds ( https://bugs.archlinux.org/task/53546 )


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-4
changelog:
  - Tighten cache protection against record from forwarders (CVE-2021-25220)
  - Include test of forwarders


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-5
changelog:
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Yara Ahmad <yahmad@redhat.com> - 2.30-121
changelog:
  - Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (#2164700)


author: Xue haolin <xuehaolin@openanolis.org> - 2.30-123.0.1
changelog:
  - Rebrand to Anolis OS.
  - Add loongarch support. (lixing@loongson.cn)
  - Fixup LoongArch wrong debug line. (lixing@loongson.cn)
  - Add LoongArch missing opcode. (lixing@loongson.cn)
  - Fixup gas SIGSEGV for extremely long function name. (lixing@loongson.cn)
  - change loong64 to loongarch64. (lixing@loongson.cn)
  - Add ifunc support. (lixing@loongson.cn)
  - Delete R_LARCH_NONE for eh_frame. (lixing@loongson.cn)
  - Fixup pr21964 bug. (lixing@loongson.cn)
  - Add 3A6000 opcode. (lixing@loongson.cn)
  - Fix some testsuite error. (lixing@loongson.cn)


author: Iryna Shcherbina <ishcherb@redhat.com> - 1.2.0-2
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Tomas Orsava <torsava@redhat.com> - 1.2.0-9
changelog:
  - Switch hardcoded python3 shebangs into the %{__python3} macro
  - Add missing BuildRequires on python3-devel so that %{__python3} macro is
    defined


author: Gopal Tiwari <gtiwari@redhat.com> - 5.56-1
changelog:
  + bluez-5.56-1
  - Fixing (#1965057)
  - Removing bccmd, enabling hid2hci as upstream removed the support in bluez-5.56


author: Christian Kellner <ckellner@redhat.com> - 0.1-2
changelog:
  - Set database path to /var/lib/boltd, create it during
    installation, which is needed for the service file to work.


author: Christian Kellner <ckellner@redhat.com> - 0.8-1
changelog:
  - bolt 0.8 upstream release with pre-boot ACL and IOMMU support
    D-Bus Configuration moved from sysconfdir to datadir
    Resolves: #1629715


author: Christian Kellner <ckellner@redhat.com> - 0.8-2
changelog:
  - Rebuilt for fixed gating.yaml (remove missing tier1 gate)
  - Unset env NOTIFY_SOCKET for no socket case in test-unix


author: Marian Csontos <mcsontos@redhat.com> 1.3-1
changelog:
  - Check for duplicates consistently in the clone and edit commands.
  - Apply correct command line precedence to --add-opts and --del-opts.
  - Correctly merge multiple --add/del-opts when editing or cloning.
  - Correctly propagate --add/del-opts in boom edit commands.
  - Enhanced logging of --add/del-opts merge logic.
  - The default Python interpreter is now /usr/bin/python.
  - Fixed re-ordering of options modifications when read from disk.
  - Do not set BootParams attributes for anonymous option words.
  - Make lvm_root_lv validation checks more strict.
  - Improve BootParams.from_entry() parameter recovery debug logging.
  - Include sample OsProfile for Fedora 32.
  - Re-set sandbox state in test suite to ensure run-to-run consistency.
  - Improve compatibility with Red Hat BLS implementation.
  - Allow non-boom managed entries to be listed and displayed.
  - Handle quirks in Red Hat's use of the BLS machine_id key.
  - Allow grub2 bootloader variables to be expanded when cloning entries.
  - Simplify clone_entry logic and make consistent with edit_entry.
  - Ensure stable ordering of legacy boot entry configuration.


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.19.1.el8_8]
changelog:
  - crypto: jitter - correct health test during initialization (Vladis Dronov) [2215079 2214270]
  - rbd: get snapshot context after exclusive lock is ensured to be held (Ilya Dryomov) [2216769 2214973]
  - rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting (Ilya Dryomov) [2216769 2214973]
  - PCI: hv: Add a per-bus mutex state_lock (Vitaly Kuznetsov) [2216543 2184863]
  - Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" (Vitaly Kuznetsov) [2216543 2184863]
  - PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (Vitaly Kuznetsov) [2216543 2184863]
  - PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (Vitaly Kuznetsov) [2216543 2184863]
  - PCI: hv: Fix a race condition bug in hv_pci_query_relations() (Vitaly Kuznetsov) [2216543 2184863]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.20.1.el8_8]
changelog:
  - block: make sure local irq is disabled when calling __blkcg_rstat_flush (Ming Lei) [2220810 2208904]
  - blk-cgroup: Flush stats before releasing blkcg_gq (Ming Lei) [2220810 2208904]
  - PCI: vmd: Add quirk to configure PCIe ASPM and LTR (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Create feature grouping for client products (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Use PCI_VDEVICE in device list (Myron Stowe) [2211198 2136922]
  - PCI/ASPM: Add pci_enable_link_state() (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Fix secondary bus reset for Intel bridges (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Disable MSI remapping after suspend (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Add DID 8086:7D0B and 8086:AD0B for Intel MTL SKUs (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Use devm_kasprintf() instead of simple kasprintf() (Myron Stowe) [2211198 2136922]
  - powerpc/pseries: unregister VPA when hot unplugging a CPU (Mamatha Inamdar) [2193375 2143007]
  - net/sched: cls_tcindex: downgrade to imperfect hash (Davide Caratti) [2192307 2192308] {CVE-2023-1829}
  - powerpc/papr_scm: Update the NUMA distance table for the target node (Mamatha Inamdar) [2212451 2183474]
  - hvcs: Synchronize hotplug remove with port free (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Use vhangup in hotplug remove (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Get reference to tty in remove (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Use driver groups to manage driver attributes (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Use dev_groups to manage hvcs device attributes (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Fix hvcs port reference counting (Mamatha Inamdar) [2212373 2167962]
  - tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() (Mamatha Inamdar) [2212373 2167962]
  - scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity (Tomas Henzl) [2216498 2160149]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.21.1.el8_8]
changelog:
  - ipmi: msghandler: kABI implementation was wrong (Tony Camuso) [2213189 2182345]
  - ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms' (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: Add a timer between request retries (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: Remove rtc_us_timer (Tony Camuso) [2211667 2174220]
  - ipmi_ssif: Rename idle state and check (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: resend_msg() cannot fail (Tony Camuso) [2211667 2174220]
  - ipmi/watchdog: use strscpy() to instead of strncpy() (Tony Camuso) [2211667 2174220]
  - ipmi: ssif_bmc: Convert to i2c's .probe_new() (Tony Camuso) [2211667 2174220]
  - ipmi: fix use after free in _ipmi_destroy_user() (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: Increase the message retry time (Tony Camuso) [2211667 2174220]
  - ipmi: Fix some kernel-doc warnings (Tony Camuso) [2211667 2174220]
  - ipmi: ssif_bmc: Use EPOLLIN instead of POLLIN (Tony Camuso) [2211667 2174220]
  - ipmi: fix msg stack when IPMI is disconnected (Tony Camuso) [2211667 2174220]
  - ipmi: fix memleak when unload ipmi driver (Tony Camuso) [2211667 2174220]
  - ipmi: fix long wait in unload when IPMI disconnect (Tony Camuso) [2211667 2174220]
  - ipmi: kcs: Poll OBF briefly to reduce OBE latency (Tony Camuso) [2211667 2174220]
  - ipmi: ssif_bmc: Add SSIF BMC driver (Tony Camuso) [2211667 2174220]
  - ipmi: Remove unused struct watcher_entry (Tony Camuso) [2211667 2174220]
  - ipmi: kcs: aspeed: Update port address comments (Tony Camuso) [2211667 2174220]
  - ipmi: Add __init/__exit annotations to module init/exit funcs (Tony Camuso) [2211667 2174220]
  - ipmi:ipmb: Don't call ipmi_unregister_smi() on a register failure (Tony Camuso) [2211667 2174220]
  - ipmi:ipmb: Fix a vague comment and a typo (Tony Camuso) [2211667 2174220]
  - ipmi: Fix comment typo (Tony Camuso) [2211667 2174220]
  - char: ipmi: modify NPCM KCS configuration (Tony Camuso) [2211667 2174220]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.22.1.el8_8]
changelog:
  - mm: avoid unnecessary page fault retires on shared memory types (Nico Pache) [2221100 2213877]
  - mm: remove redundant check about FAULT_FLAG_ALLOW_RETRY bit (Nico Pache) [2221100 2213877]
  - mm: Allow the [page|pfn]_mkwrite callbacks to drop the mmap_sem (Nico Pache) [2221100 2213877]
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ricardo Robaina) [2196352 2196353] {CVE-2023-2002}
  - mm/memcg: Fix mem_cgroup_id_get_online() underflow problem (Waiman Long) [2221010]
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Davide Caratti) [2216989 2214027] {CVE-2023-35788}
  - netfilter: conntrack: gre: don't set assured flag for clash entries (Florian Westphal) [2223542]
  - netfilter: conntrack: allow insertion clash of gre protocol (Florian Westphal) [2223542]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.23.1.el8_8]
changelog:
  - ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (Petr Oros) [2224515 2153356]
  - ceph: fix use-after-free bug for inodes when flushing capsnaps (Xiubo Li) [2218271 2209299]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.24.1.el8_8]
changelog:
  - x86/cpu/amd: Add a Zenbleed fix (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu/amd: Move the errata checking functionality up (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/amd: Cache debug register values in percpu variables (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/microcode/AMD: Track patch allocation size explicitly (David Arcari) [2226831 2226832] {CVE-2023-20593}
  - x86/microcode: Print previous version of microcode after reload (David Arcari) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Load microcode during restore_processor_state() (David Arcari) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/pm: Fix false positive kmemleak report in msr_build_context() (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/speculation: Restore speculation related MSRs during S3 resume (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: remove leftover comment for filechk utility (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Reinitialize IA32_FEAT_CTL MSR on BSP during wakeup (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/rdrand: Sanity-check RDRAND output (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - firmware: refactor firmware/Makefile (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: remove redundant 'set -e' from filechk_offsets (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: do not redirect the first prerequisite for filechk (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: move bin2c back to scripts/ from scripts/basic/ (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - libceph: harden msgr2.1 frame segment length checks (Ilya Dryomov) [2227073 2222256]
  - iavf: fix reset task race with iavf_remove() (Petr Oros) [2228161 2223604]
  - iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies (Petr Oros) [2228161 2223604]
  - Revert "iavf: Do not restart Tx queues after reset task failure" (Petr Oros) [2228161 2223604]
  - Revert "iavf: Detach device during reset task" (Petr Oros) [2228161 2223604]
  - iavf: Wait for reset in callbacks which trigger it (Petr Oros) [2228161 2223604]
  - iavf: use internal state to free traffic IRQs (Petr Oros) [2228161 2223604]
  - iavf: Fix out-of-bounds when setting channels on remove (Petr Oros) [2228161 2223604]
  - iavf: Fix use-after-free in free_netdev (Petr Oros) [2228161 2223604]
  - iavf: make functions static where possible (Petr Oros) [2228161 2223604]
  - iavf: fix err handling for MAC replace (Petr Oros) [2228161 2223604]
  - iavf: remove some unused functions and pointless wrappers (Petr Oros) [2228161 2223604]
  - iavf: remove mask from iavf_irq_enable_queues() (Petr Oros) [2228161 2223604]
  - iavf: send VLAN offloading caps once after VFR (Petr Oros) [2228161 2223604]
  - i40e: Wait for pending VF reset in VF set callbacks (Ivan Vecera) [2228163 2203921]
  - i40e: Add helper for VF inited state check with timeout (Ivan Vecera) [2228163 2203921]
  - ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() (Mark Langsdorf) [2218025 2215625]
  - locking/semaphore: Add might_sleep() to down_*() family (Mark Langsdorf) [2218025 2215625]
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (Davide Caratti) [2219660 2218676] {CVE-2023-3090}
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Phil Sutter) [2216165 2214963] {CVE-2023-3390}
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Phil Sutter) [2216165 2214963] {CVE-2023-3390}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Phil Sutter) [2216165 2214963] {CVE-2023-3390}


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.25.1.el8_8]
changelog:
  - netfilter: nft_set_pipapo: fix improper element removal (Phil Sutter) [2227508 2225276] {CVE-2023-4004}
  - perf/x86/rapl: Add support for Intel Emerald Rapids (Michael Petlan) [2230162 2165766]
  - perf/x86/intel/cstate: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/intel: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/intel/uncore: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/msr: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/msr: Add Sapphire Rapids CPU support (Michael Petlan) [2230152 2156802]
  - netfilter: xt_owner: Add supplementary groups option (Phil Sutter) [2229715 2136194]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.26.1.el8_8]
changelog:
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Cathy Avery) [2230743 1986067]
  - kernfs: Improve kernfs_notify() poll notification latency (Ian Kent) [2208540]
  - crypto: rng - Fix lock imbalance in crypto_del_rng (Herbert Xu) [2232215]
  - net: stmmac: propagate feature flags to vlan (Corinna Vinschen) [2219907 2174701]
  - scsi: storvsc: Handle SRB status value 0x30 (Cathy Avery) [2231988 2218133]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.27.1.el8_8]
changelog:
  - gfs2: Fix freeze consistency check in gfs2_trans_add_meta (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: gfs2_freeze_lock_shared cleanup (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Replace sd_freeze_state with SDF_FROZEN flag (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rework freeze / thaw logic (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename SDF_{FS_FROZEN => FREEZE_INITIATOR} (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Reconfiguring frozen filesystem already rejected (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename gfs2_freeze_lock{ => _shared } (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename the {freeze,thaw}_super callbacks (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename remaining "transaction" glock references (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: init system threads before freeze lock (Bob Peterson) [2231825 2095340]
  - cifs: fix bogus cifs_mount error handling in RHEL8 (Jeffrey Layton) [2229128 2215018]
  - cifs: missing null pointer check in cifs_mount (Jay Shin) [2229128 2215018]
  - x86/cpu: Add CPU model numbers for Meteor Lake (Prarit Bhargava) [2230158 2156826]
  - redhat/configs: enable CONFIG_INTEL_UNCORE_FREQ_CONTROL for x86_64 (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Return error on write frequency (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: Add client processors (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: add Emerald Rapids support (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: Use sysfs_emit() to instead of scnprintf() (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: Prevent driver loading in guests (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: fix uncore_freq_common_init() error codes (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Split common and enumeration part (David Arcari) [2230158 2156826]
  - platform/x86/intel/uncore-freq: Display uncore current frequency (David Arcari) [2230158 2156826]
  - platform/x86/intel/uncore-freq: Use sysfs API to create attributes (David Arcari) [2230158 2156826]
  - platform/x86/intel/uncore-freq: Move to uncore-frequency folder (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-frequency: use default_groups in kobj_type (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-frequency: Move to intel sub-directory (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Add Sapphire Rapids server support (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: make uncore_root_kobj static (David Arcari) [2230158 2156826]
  - platform/x86: Convert to new CPU match macros (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Add release callback (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Fix static checker issue and potential race condition (David Arcari) [2230158 2156826]
  - MAINTAINERS: Update for the intel uncore frequency control (David Arcari) [2230158 2156826]
  - platform/x86: Add support for Uncore frequency control (David Arcari) [2230158 2156826]
  - scsi: storvsc: Remove errant duplicate code (Cathy Avery) [2233227 2211725]
  - scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices (Cathy Avery) [2233227 2211725]
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225647 2225103] {CVE-2023-3776}
  - iavf: remove active_cvlans and active_svlans bitmaps (Stefan Assmann) [2232399 2153349]
  - iavf: refactor VLAN filter states (Stefan Assmann) [2232399 2153349]
  - iavf: do not track VLAN 0 filters (Stefan Assmann) [2232399 2153349]
  - iavf: fix non-tunneled IPv6 UDP packet type and hashing (Stefan Assmann) [2232399 2153349]
  - iavf: fix inverted Rx hash condition leading to disabled hash (Stefan Assmann) [2232399 2153349]
  - net/sched: move struct tc_mqprio_qopt_offload from pkt_cls.h to pkt_sched.h (Stefan Assmann) [2232399 2153349]
  - iavf/iavf_main: actually log ->src mask when talking about it (Stefan Assmann) [2232399 2153349]
  - iavf: Fix VF driver counting VLAN 0 filters (Stefan Assmann) [2232399 2153349]
  - iavf: Change information about device removal in dmesg (Stefan Assmann) [2232399 2153349]
  - iavf: Replace __FUNCTION__ with __func__ (Stefan Assmann) [2232399 2153349]
  - net: Remove the obsolte u64_stats_fetch_*_irq() users (drivers). (Stefan Assmann) [2232399 2153349]
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Florian Westphal) [2221725 2221046] {CVE-2023-35001}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27_rc2.an8]
changelog:
  - anolis: kbuild: fix error remind bug for libelf check (Yuanhe Shu)
  - anolis: configs: enable RCU_TORTURE_TEST for arm64 (Erwei Deng)
  - erofs: use kill_anon_super() to kill super in fscache mode (Jia Zhu)
  - hardirq/nmi: Allow nested nmi_enter() (Peter Zijlstra)
  - cachefiles: make on-demand request distribution fairer (Xin Yin)
  - anolis: cachefiles: refactor cachefiles_ondemand_daemon_read() (Jingbo Xu)
  - cachefiles: fix error return code in cachefiles_ondemand_copen() (Sun Ke)
  - anolis: erofs: update page for .readpages() in fscache mode (Jingbo Xu)
  - anolis: cachefiles: fix volume key setup for cachefiles_open (Jingbo Xu)
  - anolis: cachefiles: replace BUG_ON() with WARN_ON() (Jingbo Xu)
  - xfs: Sanity check flags of Q_XQUOTARM call (Jan Kara)
  - anolis: configs: enable CONFIG_LOCK_TORTURE_TEST for arm64 (Erwei Deng)
  - vfio/pci: Handle concurrent vma faults (liuxinwei)
  - anolis: revert: pci: shorten waiting time in pci_reset_secondary_bus (Yang Su)
  - io_uring: don't convert to jiffies for waiting on timeouts (Jens Axboe)
  - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Warn about Spectre v2 LFENCE mitigation (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) {CVE-2022-0001,CVE-2022-0002}
  - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) {CVE-2022-0001,CVE-2022-0002}
  - xen/blkfront: fix leaking data in shared pages (Ziyang Zhang) {CVE-2022-26365}
  - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (Jianglei Nie) {CVE-2022-3542}
  - scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg() (Gu Mi)
  - scsi: qla2xxx: Set the qpair in SRB to NULL when SRB is released (Gu Mi)
  - scsi: qla2xxx: Move ABTS code behind qpair (Gu Mi)
  - scsi: qla2xxx: Fix out of order Termination and ABTS response (Gu Mi)
  - scsi: qla2xxx: Add logic to detect ABTS hang and response completion (Gu Mi)
  - dm verity: set DM_TARGET_IMMUTABLE feature flag (Sarthak Kukreti) {CVE-2022-2503}
  - bitops: protect variables in set_mask_bits() macro (Miklos Szeredi)
  - anolis: mm: kidled: improve efficiency of scanning valid PFNs (Rongwei Wang)
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Pawan Gupta)
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Pawan Gupta)
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Pawan Gupta)
  - x86/speculation: Add a common function for MD_CLEAR mitigation update (Pawan Gupta)
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Pawan Gupta)
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)
  - x86/cpu: Add Jasper Lake to Intel family (Zhang Rui)
  - x86/cpu: Add Elkhart Lake to Intel family (Gayatri Kammela)
  - perf: Fix sys_perf_event_open() race against self (Peter Zijlstra) {CVE-2022-1729}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27_rc3.an8]
changelog:
  - anolis: sched/fair: fix sched_group_identity_enabled read error (Cruz Zhao)
  - mm: fix a race on nr_swap_pages (Zhaoyang Huang)
  - anolis: sched/fair: fix group identity fast path omits select_idle_core() (Cruz Zhao)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.an8]
changelog:
  - xfs: fix an ABBA deadlock in xfs_rename (Darrick J. Wong)
  - xfs: Fix deadlock between AGI and AGF when target_ip exists in xfs_rename() (kaixuxia)
  - iomap: Fix negative assignment to unsigned sis->pages in iomap_swapfile_activate (Ritesh Harjani)
  - ext4: prevent partial update of the extent blocks (Zhang Yi)
  - ext4: check for inconsistent extents between index and leaf block (Zhang Yi)
  - ext4: check for out-of-order index extents in ext4_valid_extent_entries() (Zhang Yi)
  - ext4: add check to prevent attempting to resize an fs with sparse_super2 (Josh Triplett)
  - ext4: add reserved GDT blocks check (Zhang Yi)
  - anolis: mm: avoid shmem_getpage_gfp sleep in atomic (Rongwei Wang)
  - anolis: mm: gup:remove FOLL_GET_PGSTABLE flag checking (Simon Guo)
  - anolis: psi: fix compile error when cgroup disabled (Joseph Qi)
  - anolis: io_uring: fix compile error when cgroup disabled (Joseph Qi)
  - anolis: erofs: make fscache and RAFS mode mutually exclusive (Jingbo Xu)
  - anolis: erofs: force bootstrap_path to be regular file (Jingbo Xu)
  - anolis: erofs: make bootstrap_path mandatory in RAFS mode (Jingbo Xu)
  - anolis: erofs: fix erofs_is_fscache_mode() (Jingbo Xu)
  - net: Fix gro aggregation for udp encaps with zero csum (Daniel Borkmann)
  - anolis: rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs (leoliu)
  - USB: HCD: Fix URB giveback issue in tasklet function (leoliu-oc)
  - anolis: iommu: SMMU will be passthrough on PHYTIUM FT2000 & FT2500 Socs due to hardware limitation (Gu Mi)
  - printk: Drop console_sem during panic (Stephen Brennan)
  - printk: Avoid livelock with heavy printk during panic (Stephen Brennan)
  - printk: disable optimistic spin during panic (Stephen Brennan)
  - printk: Add panic_in_progress helper (Stephen Brennan)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.1.an8]
changelog:
  - anolis: bpf: add reserve fields for bpf structures (Tianchen Ding)
  - xprtrdma: fix incorrect header size calculations (Colin Ian King) {CVE-2022-0812}
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Linus Torvalds) {CVE-2022-4378}
  - proc: avoid integer type confusion in get_proc_long (Linus Torvalds) {CVE-2022-4378}
  - KVM: x86: do not report a vCPU as preempted outside instruction boundaries (Paolo Bonzini) {CVE-2022-39189}
  - nvme: ensure subsystem reset is single threaded (Keith Busch) {CVE-2022-3169}
  - nvme: Wait for reset state when required (Keith Busch) {CVE-2022-3169}
  - nvme-pci: Allow PCI bus-level PM to be used if ASPM is disabled (Rafael J. Wysocki) {CVE-2022-3169}
  - PCI/ASPM: Add pcie_aspm_enabled() (Rafael J. Wysocki) {CVE-2022-3169}
  - nvme-pci: use host managed power state for suspend (Keith Busch) {CVE-2022-3169}
  - nvme: introduce nvme_sync_io_queues (Chao Leng) {CVE-2022-3169}
  - nvme: include admin_q sync with nvme_sync_queues (Edmund Nadolski) {CVE-2022-3169}
  - nvme-pci: Sync queues on reset (Keith Busch) {CVE-2022-3169}
  - nvme: export get and set features (Keith Busch) {CVE-2022-3169}
  - nvme: Prevent resets during paused controller state (Keith Busch) {CVE-2022-3169}
  - nvme: restrict management ioctls to admin (Keith Busch) {CVE-2022-3169}
  - sch_sfb: Don't assume the skb is still around after enqueueing to child (Toke Høiland-Jørgensen) {CVE-2022-3586}
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - KVM: arm64: Check arm64_get_bp_hardening_data() didn't return NULL (James Morse)
  - arm64: Use the clearbhb instruction in mitigations (James Morse)
  - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly)
  - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse)
  - arm64: Mitigate spectre style branch history side channels (James Morse)
  - KVM: arm64: Add templates for BHB mitigation sequences (James Morse)
  - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse)
  - arm64: Add percpu vectors for EL1 (James Morse)
  - arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse)
  - arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse)
  - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse)
  - arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse)
  - arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse)
  - arm64: entry: Move trampoline macros out of ifdef'd section (James Morse)
  - arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse)
  - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse)
  - arm64: entry: Move the trampoline data page before the text page (James Morse)
  - arm64: entry: Free up another register on kpti's tramp_exit path (James Morse)
  - arm64: entry: Make the trampoline cleanup optional (James Morse)
  - arm64: entry.S: Add ventry overflow sanity checks (James Morse)
  - arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual)
  - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose)
  - arm64: Add part number for Arm Cortex-A77 (Rob Herring)
  - ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (Ard Biesheuvel)
  - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 (Ard Biesheuvel)
  - ARM: 9196/1: spectre-bhb: enable for Cortex-A15 (Ard Biesheuvel)
  - ARM: fix Thumb2 regression with Spectre BHB (Russell King (Oracle))
  - ARM: Spectre-BHB: provide empty stub for non-config (Randy Dunlap)
  - ARM: fix build warning in proc-v7-bugs.c (Russell King (Oracle))
  - ARM: Do not use NOCROSSREFS directive with ld.lld (Nathan Chancellor)
  - ARM: fix co-processor register typo (Russell King (Oracle))
  - kbuild: add CONFIG_LD_IS_LLD (Sami Tolvanen)
  - ARM: fix build error when BPF_SYSCALL is disabled (Emmanuel Gil Peyrot)
  - ARM: include unprivileged BPF status in Spectre V2 reporting (Russell King (Oracle))
  - ARM: Spectre-BHB workaround (Russell King (Oracle))
  - ARM: use LOADADDR() to get load address of sections (Russell King (Oracle))
  - ARM: early traps initialisation (Russell King (Oracle))
  - ARM: report Spectre v2 status through sysfs (Russell King (Oracle))
  - arm/arm64: smccc/psci: add arm_smccc_1_1_get_conduit() (Mark Rutland)
  - arm/arm64: Provide a wrapper for SMCCC 1.1 calls (Steven Price)
  - xen/netfront: fix leaking data in shared pages (Roger Pau Monne) {CVE-2022-33740}
  - powerpc/32: Fix overread/overwrite of thread_struct via ptrace (Michael Ellerman) {CVE-2022-32981}
  - floppy: disable FDRAWCMD by default (Willy Tarreau) {CVE-2022-33981,CVE-2022-1836}
  - x86/speculation: Add LFENCE to RSB fill sequence (Pawan Gupta) {CVE-2022-26373}
  - x86/speculation: Add RSB VM Exit protections (Daniel Sneddon) {CVE-2022-26373}
  - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf) {CVE-2022-26373}
  - x86/entry: Add kernel IBRS implementation (Peter Zijlstra) {CVE-2022-26373}
  - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra) {CVE-2022-26373}
  - x86/cpufeatures: Move RETPOLINE flags to word 11 (Peter Zijlstra) {CVE-2022-26373}
  - xen/arm: Fix race in RB-tree based P2M accounting (Oleksandr Tyshchenko) {CVE-2022-33744}
  - tcp: drop the hash_32() part from the index calculation (Willy Tarreau) {CVE-2022-32296}
  - tcp: increase source port perturb table to 2^16 (Willy Tarreau) {CVE-2022-32296}
  - tcp: dynamically allocate the perturb table used by source ports (Willy Tarreau) {CVE-2022-32296}
  - tcp: add small random increments to the source port (Kangjie Xu) {CVE-2022-32296}
  - tcp: resalt the secret every 10 seconds (Eric Dumazet) {CVE-2022-32296}
  - tcp: use different parts of the port_offset for index and offset (Willy Tarreau) {CVE-2022-32296}
  - tcp: change source port randomizarion at connect() time (Willy Tarreau) {CVE-2022-32296}
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet) {CVE-2022-3521}
  - af_key: Do not call xfrm_probe_algs in parallel (Herbert Xu) {CVE-2022-3028}
  - mISDN: fix use-after-free bugs in l1oip timer handlers (Duoming Zhou) {CVE-2022-3565}
  - vsock: Fix memory leak in vsock_connect() (Peilin Ye) {CVE-2022-3629}
  - nfp: fix use-after-free in area_cache_get() (Jialiang Wang) {CVE-2022-3545}
  - netfilter: nf_conntrack_irc: Fix forged IP logic (David Leadbeater) {CVE-2022-2663}
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz) {CVE-2022-42895}
  - igmp: Add ip_mc_list lock in ip_check_mc_rcu (Liu Jian) {CVE-2022-20141}
  - net/x25: Fix null-ptr-deref caused by x25_disconnect (Duoming Zhou) {CVE-2022-1516}
  - arm64: fix oops in concurrently setting insn_emulation sysctls (haibinzhang (张海斌))
  - efi: capsule-loader: Fix use-after-free in efi_capsule_write (Hyunwoo Kim) {CVE-2022-40307}
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song) {CVE-2022-3628}
  - usb: mon: make mmapped memory read only (Tadeusz Struk) {CVE-2022-43750}
  - r8152: Rate limit overflow messages (Andrew Gaul) {CVE-2022-3594}
  - atm: idt77252: fix use-after-free bugs caused by tst_timer (Duoming Zhou) {CVE-2022-3635}
  - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write (Hyunwoo Kim) {CVE-2022-39842}
  - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls (Chen-Yu Tsai) {CVE-2022-20369}
  - sr9700: sanity check for packet length (Oliver Neukum) {CVE-2022-26966}
  - parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled (Helge Deller)
  - pci_iounmap'2: Electric Boogaloo: try to make sense of it all (Linus Torvalds)
  - asm-generic/io.h: Fix !CONFIG_GENERIC_IOMAP pci_iounmap() implementation (Lorenzo Pieralisi)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.2.an8]
changelog:
  - anolis: nfsd: remove nfsd_reply_cache_shutdown() in nfsd_exit_net (Yuanhe Shu)
  - RDMA/core: Don't infoleak GRH fields (Leon Romanovsky) {CVE-2021-3923}
  - vgacon: Fix for missing check in scrollback handling (Yunhai Zhang) {CVE-2020-14331}
  - btrfs: fix race between quota disable and quota assign ioctls (Filipe Manana) {CVE-2023-1611}
  - Fix double fget() in vhost_net_set_backend() (Al Viro)
  - seq_buf: Fix overflow in seq_buf_putmem_hex() (Yun Zhou) {CVE-2023-28772}
  - drm/nouveau/mmu: add more general vmm free/node handling functions (Ben Skeggs) {CVE-2023-0030}
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (ly929421) {CVE-2023-1118}
  - USB: core: Prevent nested device-reset calls (Alan Stern) {CVE-2022-4662}
  - Bluetooth: L2CAP: Fix u8 overflow (zzzzzzzzzy9) {CVE-2022-45934}
  - drm/amdkfd: Check for null pointer after calling kmemdup (Jiasheng Jiang) {CVE-2022-3108}
  - l2tp: Serialize access to sk_user_data with sk_callback_lock (Jakub Sitnicki) {CVE-2022-4129}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy) {CVE-2022-3564}
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima) {CVE-2022-3524}
  - nfc: fix refcount leak in llcp_sock_connect() (Xiaoming Ni)
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (Luiz Augusto von Dentz) {CVE-2022-20566}
  - netfilter: nf_tables: fix null deref due to zeroed list head (张钰 10307750)
  - nfc: fix refcount leak in llcp_sock_bind() (Xiaoming Ni)
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet) {CVE-2023-0590}
  - nfc: fix memory leak in llcp_sock_connect() (Xiaoming Ni)
  - net/sched: tcindex: update imperfect hash filters respecting rcu (Pedro Tammela) {CVE-2023-1281}
  - net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim) {CVE-2023-23454}
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jann Horn) {CVE-2022-2964}
  - net: mpls: fix stale pointer if allocation fails during device rename (Jakub Kicinski) {CVE-2023-26545}
  - sctp: fail if no bound addresses can be used for a given scope (Marcelo Ricardo Leitner) {CVE-2023-1074}
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (Herbert Xu) {CVE-2023-0394}
  - net: sched: disallow noqueue for qdisc classes (Frederick Lawler) {CVE-2022-47929}
  - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim) {CVE-2023-23455}
  - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (Szymon Heidrich) {CVE-2023-23559}
  - net: mvpp2: fix mvpp2 debugfs leak (Russell King (Oracle)) {CVE-2022-3535}
  - memcg: enable accounting of ipc resources (Vasily Averin) {CVE-2021-3759}
  - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (Jann Horn) {CVE-2022-42703}
  - hv_netvsc: Add check for kvmalloc_array (Jiasheng Jiang) {CVE-2022-3107}
  - NFC: netlink: fix sleep in atomic bug when firmware download timeout (feng.wei) {CVE-2022-1975}
  - anolis: x86/kasan: Map shadow for percpu pages on demand (Xuchun Shang)
  - anolis: x86/kasan: Add helpers to align shadow addresses up and down (Xuchun Shang)
  - net/ulp: prevent ULP without clone op from entering the LISTEN status (Paolo Abeni) {CVE-2023-0461}
  - x86/mm: Randomize per-cpu entry area (Peter Zijlstra) {CVE-2023-0597}
  - anolis: random32: put prandom_init in a earlier step (Xuchun Shang) {CVE-2023-0597}
  - x86/hw_breakpoint: Prevent data breakpoints on direct GDT (Lai Jiangshan) {CVE-2023-0597}
  - x86/hw_breakpoint: Add within_area() to check data breakpoints (Lai Jiangshan) {CVE-2023-0597}
  - x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area (Andy Lutomirski) {CVE-2023-0597}
  - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise (Ingo Molnar) {CVE-2023-0597}
  - xen/netback: don't call kfree_skb() with interrupts disabled (Juergen Gross)
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz) {CVE-2022-42896}
  - net: sched: sch_teql: fix null-pointer dereference (Pavel Tikhomirov)
  - tcp/dccp: fix possible race __inet_lookup_established() (Eric Dumazet)
  - power: supply: wm8350-power: Add missing free in free_charger_irq (Jiasheng Jiang) {CVE-2022-3111}
  - media: em28xx: initialize refcount before kref_get (Dongliang Mu) {CVE-2022-3239}
  - media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai) {CVE-2022-41218}
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Clement Lecigne) {CVE-2023-0266}
  - drivers: net: slip: fix NPD bug in sl_tx_timeout() (Duoming Zhou) {CVE-2022-41858}
  - xen/netfront: force data bouncing when backend is untrusted (Roger Pau Monne) {CVE-2022-33741}
  - tcp: Fix data races around icsk->icsk_af_ops. (Kuniyuki Iwashima) {CVE-2022-3566}
  - anolis: bond: broadcast ARP or ND messages to all slaves (Tony Lu)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.3.an8]
changelog:
  - nvme-pci: rerun irq setup on IO queue init errors (Keith Busch)
  - nvme-pci: refactor nvme_disable_io_queues (Christoph Hellwig)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.4.an8]
changelog:
  - iommu/vt-d: Fix agaw for a supported 48 bit guest address width (Gu Mi)
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso) {CVE-2023-32233}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.5.an8]
changelog:
  - iomap: Support inline data with block size < page size (Matthew Wilcox (Oracle))
  - iomap: support reading inline data from non-zero pos (Gao Xiang)
  - iomap: Don't create iomap_page objects for inline files (Andreas Gruenbacher)
  - selinux: fix race condition when computing ocontext SIDs (gcc_2023)
  - virtio_blk: fix the discard_granularity and discard_alignment queue limits (Christoph Hellwig)
  - virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero (Xie Yongji)
  - ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (Ye Bin)
  - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline (Eric Whitney)
  - ext4: fix corruption when online resizing a 1K bigalloc fs (Baokun Li)
  - ext4: avoid resizing to a partial cluster size (Kiselev, Oleg)
  - ext4: reduce computation of overhead during resize (Kiselev, Oleg)
  - ext4: fix extent status tree race in writeback error recovery path (Eric Whitney)
  - ext4: update s_overhead_clusters in the superblock during an on-line resize (Theodore Ts'o)
  - ext4: force overhead calculation if the s_overhead_cluster makes no sense (Theodore Ts'o)
  - ext4: fix avefreec in find_group_orlov (Pan Dong)
  - isolcpus: Affine unbound kernel threads to housekeeping cpus (Marcelo Tosatti)
  - kthread: Switch to cpu_possible_mask (Marcelo Tosatti)
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo) {CVE-2023-35001}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (D. Wythe) {CVE-2023-3117}
  - sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello) {CVE-2023-1077}
  - relayfs: fix out-of-bounds access in relay_file_read (Zhang Zhengming) {CVE-2023-3268}
  - kernel/relay.c: fix read_pos error when multiple readers (Pengcheng Yang) {CVE-2023-3268}
  - drm/i915/gvt: fix double free bug in split_2MB_gtt_entry (Zheng Wang) {CVE-2022-3707}
  - usb: gadget: rndis: prevent integer overflow in rndis_set_response() (Dan Carpenter) {CVE-2022-20423}
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (Zheng Wang) {CVE-2023-1989}
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang) {CVE-2023-30772}
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function (Miaoqian Lin) {CVE-2023-23000}
  - HID: check empty report_list in hid_validate_values() (Pietro Borrello) {CVE-2023-1073}
  - staging: rtl8712: fix use after free bugs (Dan Carpenter) {CVE-2022-4095}
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang) {CVE-2023-1855}
  - HID: roccat: Fix use-after-free in roccat_read() (Hyunwoo Kim) {CVE-2022-41850}
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang) {CVE-2023-1990}
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman) {CVE-2023-0458}
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang) {CVE-2023-1670}
  - media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors (shi.xue) {CVE-2020-0404}
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (Baisong Zhong) {CVE-2023-28328}
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen) {CVE-2023-2194}
  - drm/vmwgfx: Validate the box size for the snooped cursor (Zack Rusin) {CVE-2022-36280}
  - x86/bugs: Flush IBP in ib_prctl_set() (Rodrigo Branco) {CVE-2023-0045}
  - drm/msm/dpu: Add check for pstates (Jiasheng Jiang) {CVE-2023-3220}
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang) {CVE-2023-35825}
  - tap: tap_open(): correctly initialize socket uid (Pietro Borrello) {CVE-2023-1076}
  - tun: tun_chr_open(): correctly initialize socket uid (Pietro Borrello) {CVE-2023-1076}
  - net: add sock_init_data_uid() (Pietro Borrello) {CVE-2023-1076}
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Hangyu Hua) {CVE-2023-35788}
  - net/sched: Retire tcindex classifier (Jamal Hadi Salim) {CVE-2023-1829}
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei) {CVE-2023-26607}
  - ntfs: fix use-after-free in ntfs_ucsncmp() (ChenXiaoSong)
  - fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu) {CVE-2023-2985}
  - rds: rds_rm_zerocopy_callback() use list_first_entry() (Pietro Borrello) {CVE-2023-1078}
  - arm64: PCI: Preserve firmware configuration when desired (Benjamin Herrenschmidt)
  - arm64: PCI: Allow resource reallocation if necessary (Benjamin Herrenschmidt)
  - xen/blkfront: force data bouncing when backend is untrusted (Roger Pau Monne) {CVE-2022-33742.}
  - virtio_net: suppress cpu stall when free_unused_bufs (Wenliang Wang)
  - virtio_net: split free_unused_bufs() (Xuan Zhuo)
  - ext4: correct the misjudgment in ext4_iget_extra_inode (Baokun Li) {CVE-2023-2513}
  - ext4: correct max_inline_xattr_value_size computing (Baokun Li) {CVE-2023-2513}
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li) {CVE-2023-2513}
  - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (Baokun Li) {CVE-2023-2513}
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer) {CVE-2023-2269}
  - ext4: avoid cycles in directory h-tree (Jan Kara) {CVE-2022-1184}
  - ext4: verify dir block before splitting it (Jan Kara) {CVE-2022-1184}
  - ovl: enable RCU'd ->get_acl() (Miklos Szeredi)
  - anolis: Revert "anolis: erofs,ovl: bypass [override|revert]_creds for overlayfs" (Jingbo Xu)
  - anolis: Revert "anolis: erofs,ovl: enable RCU'd ->get_acl()" (Jingbo Xu)
  - anolis: virtio-blk: skip BUG_ON() in virtio_queue_rq() for discard command (fupan)


author: Qinyun Tan <qinyuntan@linux.alibaba.com> [4.19.91-27.6.an8]
changelog:
  - driver core: auxiliary bus: make remove function return void (Greg Kroah-Hartman)
  - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Peter Ujfalusi)
  - driver core: auxiliary bus: Fix calling stage for auxiliary bus init (Dave Jiang)
  - driver core: auxiliary bus: Fix auxiliary bus shutdown null auxdrv ptr (Dave Jiang)
  - anolis: config: Add AUXILIARY_BUS support in anolis defconfig (cuishw)
  - Add auxiliary bus support (Dave Ertman)
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan) {CVE-2023-3776}
  - net: tun: fix bugs for oversize packet when napi frags enabled (Ziyang Xuan) {CVE-2023-3812}
  - tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS (Yunjian Wang) {CVE-2023-3812}
  - anolis: configs: disable CONFIG_BPFILTER (Tianchen Ding)
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Pablo Neira Ayuso)
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Pablo Neira Ayuso)
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Pablo Neira Ayuso)
  - anolis: Revert "netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE" (tangbin)
  - anolis: mm: unlock zdm_lock after delete zdm (Ning Zhang)
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung) {CVE-2023-31436}
  - perf script python: Add Python3 support to tests/attr.py (Tony Jones)
  - nvme-pci: Fix controller freeze wait disabling (Keith Busch)
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng) {CVE-2023-3090}
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela) {CVE-2023-3611}
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Lee Jones) {CVE-2023-3609}
  - gfs2: Don't deref jdesc in evict (Bob Peterson) {CVE-2023-3212,CVE-2023-3212}
  - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (Zixuan Fu) {CVE-2023-3111}
  - btrfs: check return value of btrfs_commit_transaction in relocation (Josef Bacik) {CVE-2023-3111}
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong) {CVE-2023-2124}
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus) {CVE-2023-34256}
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen) {CVE-2023-0459}
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai) {CVE-2023-31084}
  - anolis: sched/isolation: fix a memory leak in procfs (Tianchen Ding)
  - KVM: nVMX: add missing consistency checks for CR0 and CR4 (Paolo Bonzini) {CVE-2023-30456}
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie) {CVE-2023-2162}
  - bpf: fix buggy r0 retval refinement for tracing helpers (Daniel Borkmann)
  - erofs: fix misbehavior of unsupported chunk format check (Gao Xiang)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-12_rc3.an8]
changelog:
  - mm/hwpoison: check the subpage, not the head page (Matthew Wilcox (Oracle))
  - filemap: Correct the conditions for marking a folio as accessed (Matthew Wilcox (Oracle))
  - anolis: arm64: drivers/perf: fix DDRSS PMU interrupt initialization (Shuai Xue)
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo) {CVE-2022-2588}
  - posix-cpu-timers: Cleanup CPU timers before freeing them during exec (Thadeu Lima de Souza Cascardo)
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain (Thadeu Lima de Souza Cascardo) {CVE-2022-2586}
  - netfilter: nf_tables: do not allow CHAIN_ID to refer to another table (Thadeu Lima de Souza Cascardo) {CVE-2022-2586}
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Thadeu Lima de Souza Cascardo) {CVE-2022-2586}
  - anolis: net/smc: Fix NULL pointer in smc_getname while first contact clcsock release (D. Wythe)
  - anolis: net/smc: skip smc_llc_flow_initiate while SMC-1RTT (D. Wythe)
  - anolis: net/smc: fix SMC_CLC_DECL_ERR_REGRMB without smc_server_lgr_pending (D. Wythe)
  - anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending (D. Wythe)
  - anolis: Revert "anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending" (D. Wythe)
  - anolis: Revert "anolis: net/smc: fix SMC_CLC_DECL_ERR_REGRMB without smc_server_lgr_pending" (D. Wythe)
  - anolis: Revert "anolis: net/smc: skip smc_llc_flow_initiate while SMC-1RTT" (D. Wythe)
  - anolis: mm: fcm: do not unconditionally call fcm_fixup_vma (Xu Yu)
  - anolis: net/smc: Introduce smc dim (Guangguan Wang)
  - anolis: Revert "net/smc: Introduce rdma dim for smc" (Guangguan Wang)
  - anolis: Revert "f2fs: remove false alarm on iget failure during GC" (Gao Xiang)
  - netfilter: nf_queue: do not allow packet truncation below transport header offset (Florian Westphal) {CVE-2022-36946}
  - anolis: arm64: spectre: added a description of the parameter nospectre_bhb (Liu Song)
  - anolis: arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - anolis: random: speed up the initialization of module (Xingjun Liu)
  - anolis: random: introduce the initialization seed (Xingjun Liu)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-12_rc4.an8]
changelog:
  - anolis: net/smc: fix panic smc_tcp_syn_recv_sock() while closing listen socket (D. Wythe)
  - anolis: net/smc: fix deadlock when lgr terminating (D. Wythe)
  - anolis: Revert "anolis: net/smc: fix deadlock when lgr terminating" (D. Wythe)
  - anolis: net/smc: Reuse wr_id to recognize wc for tx or rx (Tony Lu)
  - anolis: net/smc: delay RDMA resource release until connecitons freed (Wen Gu)
  - anolis: net/smc: Use SO_REUSEADDR if keep clcsock (Tony Lu)
  - anolis: net/smc: fix SMC_CLC_DECL_ERR_REGRMB without smc_server_lgr_pending (D. Wythe)
  - anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending (D. Wythe)
  - anolis: Revert "anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending" (Tony Lu)
  - anolis: Revert "anolis: net/smc: fix SMC_CLC_DECL_ERR_REGRMB without smc_server_lgr_pending" (Tony Lu)
  - anolis: net/smc: Fix wr tasklet handler for rx/tx wc (Tony Lu)
  - anolis: net/smc: check clcsock->sk validity in fallback restore (Wen Gu)
  - anolis: net/smc: Keep first contact clcsock (Tony Lu)
  - anolis: Revert "anolis: net/smc: Keep first contact clcsock" (Wen Gu)
  - anolis: configs: let PCIe PMU driver be built in (Shuai Xue)
  - anolis: drivers/perf: add a separate config for DesignWare PCIe controller PMU (Shuai Xue)
  - anolis: drivers/perf: clean up unused variable (Shuai Xue)
  - anolis: drivers/perf: simplify extended capability founding (Shuai Xue)
  - anolis: drivers/perf: simplify Root Port check (Shuai Xue)
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Dongliang Mu) {CVE-2022-2978}
  - anolis: mm: fcm: do not unconditionally call fixup ops (Xu Yu)
  - anolis: Revert "anolis: mm: fcm: do not unconditionally call fcm_fixup_vma" (Xu Yu)
  - anolis: arm_mpam: Fix the problem that error interrupt handling cannot exit normally (Shawn Wang)
  - anolis: arm_mpam: Fix wrong type conversion for dev_id in mpam_irq_handler() (Shawn Wang)
  - anolis: arm64: Remove GPL from pv_ops export for ARM/ARM64 (Shawn Wang)
  - anolis: fs/resctrl: Refine the outputs of last_cmd_status (Shawn Wang)
  - anolis: fs/resctrl: Extend the maximum number of CLOSIDs to 64 (Shawn Wang)
  - anolis: fs/resctrl: Clear the staged configs when destroying schemata list (Shawn Wang)
  - anolis: fs/resctrl: Fix the wrong if statement in resctrl_closid_is_dirty() (Shawn Wang)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-12.an8]
changelog:
  - ip: fix triggering of 'icmp redirect' (Nicolas Dichtel)
  - anolis: Revert "anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending" (Wen Gu)
  - anolis: Revert "anolis: net/smc: fix SMC_CLC_DECL_ERR_REGRMB without smc_server_lgr_pending" (Wen Gu)
  - anolis: net/smc: Fix NULL sndbuf_desc in smc_cdc_tx_handler() (D. Wythe)
  - anolis: net/smc: Stop the CLC flow if there's no link to map RMBs on (Wen Gu)
  - anolis: net/smc: Fix UAF when fallback after lgr create (Tony Lu)
  - anolis: net/smc: Avoid use-after-free of smcibcq tasklet (Wen Gu)
  - anolis: net/smc: Restore rx queue depth (Tony Lu)
  - anolis: net/smc: Fix task hung in SMC-R terminating all link groups (Wen Gu)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-12.2.an8]
changelog:
  - xfs: fix up non-directory creation in SGID directories (Christoph Hellwig) {CVE-2021-4037}
  - io_uring/af_unix: defer registered files gc to io_uring release (Pavel Begunkov) {CVE-2022-2602}


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-13_rc1.an8]
changelog:
  - configs: refresh the ANCK default configs (Qiao Ma)
  - usb: mon: make mmapped memory read only (Tadeusz Struk) {CVE-2022-43750}
  - fsdax: add dax_iomap_cow_copy() for dax zero (Shiyang Ruan)
  - fsdax: replace mmap entry in case of CoW (Shiyang Ruan)
  - fsdax: introduce dax_iomap_cow_copy() (Shiyang Ruan)
  - fsdax: output address in dax_iomap_pfn() and rename it (Shiyang Ruan)
  - fsdax: set a CoW flag when associate reflink mappings (Shiyang Ruan)
  - fsdax: introduce dax_lock_mapping_entry() (Shiyang Ruan)
  - dax: introduce holder for dax_device (Shiyang Ruan)
  - fsdax: fix function description (Shiyang Ruan)
  - xfs: add xfs_zero_range and xfs_truncate_page helpers (Shiyang Ruan)
  - fsdax: factor out a dax_fault_actor() helper (Shiyang Ruan)
  - fsdax: factor out helpers to simplify the dax fault code (Shiyang Ruan)
  - anolis: cachefiles: reset object->private to NULL when it's freed (Jingbo Xu)
  - anolis: mm: hugetext: Split cold adaptive thp (Rongwei Wang)
  - anolis: mm: hugetext: Update adaptive entries (Rongwei Wang)
  - anolis: mm: hugetext: Adapt executable and anonymous vma (Rongwei Wang)
  - anolis: mm: hugetext: Implement principal part (Rongwei Wang)
  - anolis: mm: hugetext: Introduce max_nr_hugetext (Rongwei Wang)
  - anolis: net/smc: replace mutex rmbs_lock and sndbufs_lock with rw_semaphore (D. Wythe)
  - anolis: net/smc: reduce unnecessary blocking in smcr_lgr_reg_rmbs() (D. Wythe)
  - anolis: net/smc: use read semaphores to reduce unnecessary blocking in smc_buf_create() & smcr_buf_unuse() (D. Wythe)
  - anolis: net/smc: llc_conf_mutex refactor, replace it with rw_semaphore (D. Wythe)
  - anolis: net/smc: make SMC_LLC_FLOW_RKEY run concurrently (D. Wythe)
  - anolis: net/smc: allow confirm/delete rkey response deliver multiplex (D. Wythe)
  - anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending (D. Wythe)
  - anolis: net/smc: fix application data exception (D. Wythe)
  - anolis: net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() (D. Wythe)
  - anolis: Revert "anolis: net/smc: Avoid syscall block by async smc_conn_free" (D.Wythe)
  - anolis: Revert "anolis: net/smc: queue free_work to smc_close_wq instead of smc_hs_wq" (D.Wythe)
  - anolis: Revert "anolis: net/smc: do not use free work if fallback" (D.Wythe)
  - anolis: sched/fair: fix sched_group_identity_enabled read error (Cruz Zhao)
  - anolis: net/smc: Introduce lockfree cq for smc (Guangguan Wang)
  - anolis: net/smc: Do not clear snd buffer when buffer reuse (Guangguan Wang)
  - anolis: net/smc: remove redundant SMC_CMD_MAX_ATTR definition (Guangguan Wang)
  - anolis: net/smc: Introduce dim proc file (Guangguan Wang)
  - anolis: net/smc: add cq event_handler to get async event info (Guangguan Wang)
  - anolis: net/smc: disable multiple flag should keep in lgr struct (Guangguan Wang)
  - anolis: net/smc: Workaround for SMCv2 support with eRDMA devices (Wen Gu)
  - anolis: net/smc: Fix NULL sndbuf_desc in smc_cdc_tx_handler() (D. Wythe)
  - anolis: net/smc: Fix UAF when fallback after lgr create (Tony Lu)
  - anolis: net/smc: Avoid use-after-free of smcibcq tasklet (Wen Gu)
  - anolis: net/smc: Restore rx queue depth (Tony Lu)
  - anolis: net/smc: Fix task hung in SMC-R terminating all link groups (Wen Gu)
  - anolis: net/smc: fix panic smc_tcp_syn_recv_sock() while closing listen socket (D. Wythe)
  - anolis: net/smc: fix deadlock when lgr terminating (D. Wythe)
  - anolis: net/smc: Reuse wr_id to recognize wc for tx or rx (Tony Lu)
  - anolis: net/smc: delay RDMA resource release until connecitons freed (Wen Gu)
  - anolis: net/smc: Use SO_REUSEADDR if keep clcsock (Tony Lu)
  - anolis: net/smc: Fix wr tasklet handler for rx/tx wc (Tony Lu)
  - anolis: net/smc: check clcsock->sk validity in fallback restore (Wen Gu)
  - anolis: net/smc: Keep first contact clcsock (Tony Lu)
  - anolis: net/smc: Fix NULL pointer in smc_getname while first contact clcsock release (D. Wythe)
  - anolis: net/smc: skip smc_llc_flow_initiate while SMC-1RTT (D. Wythe)
  - anolis: net/smc: Introduce smc dim (Guangguan Wang)
  - anolis: net/smc: change clcsock_release_lock from mutex to rw_semaphore (Guangguan Wang)
  - anolis: net/smc: check sk_ack_backlog before kernel_accept (Guangguan Wang)
  - anolis: net/smc: do not call cancel smc_listen_work when smc use fallback (Guangguan Wang)
  - anolis: net/smc: only cancel connect_work when connect nonblock (Guangguan Wang)
  - anolis: net/smc: Introduce multiple tcp listen works to enhance tcp_listen_work (Guangguan Wang)
  - anolis: net/smc: smc_sock_alloc after kernel_accept (Guangguan Wang)
  - anolis: net/smc: move sk_acceptq_{removed,add} into accept_q_lock's protection (Guangguan Wang)
  - anolis: net/smc: remove sock lock in smc_tcp_listen_work (Guangguan Wang)
  - anolis: net/smc: optimize for smc_accept_poll (Guangguan Wang)
  - anolis: net/smc: double check whether accept queue is empty before schedule_timeout (Guangguan Wang)
  - anolis: net/smc: only add wait queue when smc_accept_dequeue get null (Guangguan Wang)
  - anolis: net/smc: do not use free work if fallback (Guangguan Wang)
  - anolis: net/smc: queue free_work to smc_close_wq instead of smc_hs_wq (D. Wythe)
  - anolis: net/smc: remove useless path (Guangguan Wang)
  - anolis: net/smc: Change listen wq to unbound highpri wq (Guangguan Wang)
  - anolis: net/smc: Use diff TCP EXPR MAGIC to avoid network middleware do simple echo (D. Wythe)
  - anolis: net/smc: Fix potential leaks on queued_smc_hs (D. Wythe)
  - anolis: net/smc: remove solicited flag for wr send (Guangguan Wang)
  - anolis: net/smc: remove redundant ib_req_notify_cq (Guangguan Wang)
  - anolis: net/smc: clear ib_cq errno when ib_create_cq failed (Guangguan Wang)
  - anolis: net/smc: introduce 1RTT to SMC-R (D. Wythe)
  - anolis: net/smc: poll_cq one more time if the polled cqe is less than SMC_WR_MAX_POLL_CQE (Guangguan Wang)
  - anolis: net/smc: remove redundant ib_req_notify_cq (Guangguan Wang)
  - anolis: net/smc: combine send cq and recv cq into one cq (Guangguan Wang)
  - anolis: net/smc: move wc loop out of smc_wr_rx_process_cqes (Guangguan Wang)
  - anolis: net/smc: Avoid syscall block by async smc_conn_free (D. Wythe)
  - anolis: net/smc: Disable confirm rkey message exchange when only one link exists (D. Wythe)
  - anolis: net/smc: Release lock before waiting for CLC accept message (D. Wythe)
  - anolis: net/smc: compress frequency of credits announcement by cdc msg (Guangguan Wang)
  - anolis: net/smc: do not send msg in receiving process when tx is not blocked. (Guangguan Wang)
  - anolis: net/smc: Avoid clcsock access panic (Wen Gu)
  - anolis: net/smc: Fix NULL sk pointer when access clcsock (Tony Lu)
  - anolis: net/smc: don't req_notify until all CQEs drained (Wen Gu)
  - anolis: net/smc: Introduce rtoken validity check before sending (Wen Gu)
  - anolis: net/smc: Introduce a sysctl to disable {a}symmetric link group (Wen Gu)
  - anolis: net/smc: Multiple CQs per IB devices (Tony Lu)
  - anolis: net/smc: Introduce smc_ib_cq to bind link and cq (Tony Lu)
  - anolis: net/smc: Introduce link-related proc file (Guangguan Wang)
  - anolis: net/smc: Support rq flow control in smc-r link layer (Guangguan Wang)
  - anolis: net/smc: Add sysctl conrtol for handshake limiation (D. Wythe)
  - anolis: net/smc: Avoid unmapping bufs from unused links (Wen Gu)
  - anolis: net/smc: allow different subnet communication (Tony Lu)
  - anolis: net/smc: don't call ib_req_notify_cq in the send routine (Dust Li)
  - anolis: net/smc: Add TX and RX diagnosis information (Tony Lu)
  - anolis: net/smc: Introduce TCP to SMC replacement netlink commands (Tony Lu)
  - anolis: net/smc: Introduce SMC-R-related proc files (Tony Lu)
  - anolis: net/smc: Introduce sysctl tcp2smc (Tony Lu)
  - anolis: net/smc: Expose SMCPROTO_SMC and SMCPROTO_SMC6 to userspace (Tony Lu)
  - net/smc: Fix possible leaked pernet namespace in smc_init() (Chen Zhongjin)
  - net/smc: Fix an error code in smc_lgr_create() (Dan Carpenter)
  - net/smc: Support SO_REUSEPORT (Tony Lu)
  - net/smc: Unbind r/w buffer size from clcsock and make them tunable (Tony Lu)
  - net/smc: Introduce a specific sysctl for TEST_LINK time (Wen Gu)
  - net/smc: Stop the CLC flow if no link to map buffers on (Wen Gu)
  - net/smc: Remove redundant refcount increase (Yacan Liu)
  - net/smc: Enable module load on netlink usage (Stefan Raspl)
  - net/smc: Pass on DMBE bit mask in IRQ handler (Stefan Raspl)
  - s390/ism: Cleanups (Stefan Raspl)
  - net/smc: Eliminate struct smc_ism_position (Heiko Carstens)
  - anolis: net/smc: Revert all Anolis patches (Tony Lu)
  - anolis: cachefiles: add restore command to recover inflight ondemand read requests (Jia Zhu)
  - anolis: cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode (Jia Zhu)
  - anolis: cachefiles: resend an open request if the read request's object is closed (Jia Zhu)
  - anolis: cachefiles: extract ondemand info field from cachefiles_object (Jia Zhu)
  - anolis: cachefiles: introduce object ondemand state (Jia Zhu)
  - anolis: fscache: export fscache_object_wq (Jingbo Xu)
  - erofs: fix use-after-free of fsid and domain_id string (Jingbo Xu)
  - erofs: protect s_inodes with s_inode_list_lock for fscache (Dawei Li)
  - erofs: introduce 'domain_id' mount option (Jia Zhu)
  - erofs: Support sharing cookies in the same domain (Jia Zhu)
  - erofs: introduce a pseudo mnt to manage shared cookies (Jia Zhu)
  - erofs: introduce fscache-based domain (Jia Zhu)
  - erofs: code clean up for fscache (Jia Zhu)
  - anolis: erofs: fix the name of erofs_fscache_super_index_def (Jingbo Xu)
  - anolis: configs: Enable SM3/4 algorithm for default configs (Tianjia Zhang)
  - anolis: fscrypt: Add SM4 XTS/CTS symmetric algorithm support (Tianjia Zhang)
  - anolis: blk-crypto: Add support for SM4-XTS blk crypto mode (Tianjia Zhang)
  - anolis: mm: kidled: Fix sleeping when irqs are disabled in allocate_slab() (Shawn Wang)
  - anolis: RDMA/erdma: Update and bugfix (Kai)
  - anolis: Rename ycc to alicc due to some tech adjustments (Guanjun)
  - anolis: xfs: account extra freespace btree splits for multiple allocations (Gao Xiang)
  - anolis: sched: Support cpu burst in cgroup v2 (Yi Tao)
  - erofs: use kill_anon_super() to kill super in fscache mode (Jia Zhu)
  - cachefiles: make on-demand request distribution fairer (Xin Yin)
  - anolis: cachefiles: refactor cachefiles_ondemand_daemon_read() (Jingbo Xu)
  - cachefiles: fix error return code in cachefiles_ondemand_copen() (Sun Ke)
  - anolis: cachefiles: fix volume key setup for cachefiles_open (Jingbo Xu)
  - anolis: cachefiles: replace BUG_ON() with WARN_ON() (Jingbo Xu)
  - x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly (Chang S. Bae)
  - x86/fpu: Exclude dynamic states from init_fpstate (Chang S. Bae)
  - x86/fpu: Fix the init_fpstate size check with the actual size (Chang S. Bae)
  - x86/fpu: Configure init_fpstate attributes orderly (Chang S. Bae)
  - anolis: virtio-net: open napi for tx (Xuan Zhuo)
  - anolis: defconfigs: enable pmt feature as default on x86 platform (yjia)
  - anolis: mm: add switch for file zero page (Kaihao Bai)
  - anolis: mm: avoid MMAP_POPULATE filling zero page (Kaihao Bai)
  - anolis: mm: support filling in zero page if read fault in file hole (Kaihao Bai)
  - anolis: mm: mark zero page special and avoid being counted (Kaihao Bai)
  - anolis: mm: support unmapping zeropage of the same file offset (Kaihao Bai)
  - anolis: mm: add zero page judgement helper (Kaihao Bai)
  - crypto: arm64 - Fix unused variable compilation warnings of cpu_feature (Tianjia Zhang)
  - crypto: arm64/sm4 - add CE implementation for GCM mode (Tianjia Zhang)
  - crypto: arm64/sm4 - add CE implementation for CCM mode (Tianjia Zhang)
  - crypto: arm64/sm4 - add CE implementation for cmac/xcbc/cbcmac (Tianjia Zhang)
  - crypto: arm64/sm4 - add CE implementation for XTS mode (Tianjia Zhang)
  - crypto: arm64/sm4 - add CE implementation for CTS-CBC mode (Tianjia Zhang)
  - crypto: arm64/sm4 - export reusable CE acceleration functions (Tianjia Zhang)
  - crypto: arm64/sm4 - simplify sm4_ce_expand_key() of CE implementation (Tianjia Zhang)
  - crypto: arm64/sm4 - refactor and simplify CE implementation (Tianjia Zhang)
  - crypto: tcrypt - add SM4 cts-cbc/xts/xcbc test (Tianjia Zhang)
  - crypto: testmgr - add SM4 cts-cbc/xts/xcbc test vectors (Tianjia Zhang)
  - crypto: arm64/sm4 - refactor and simplify NEON implementation (Tianjia Zhang)
  - crypto: arm64/sm3 - add NEON assembly implementation (Tianjia Zhang)
  - crypto: arm64/sm3 - raise the priority of the CE implementation (Tianjia Zhang)
  - crypto: scatterwalk - remove duplicate function declarations (Tianjia Zhang)
  - crypto: ccm - use local variables instead of indirect references (Tianjia Zhang)
  - nilfs2: fix leak of nilfs_root in case of writer thread creation failure (Ryusuke Konishi) {CVE-2022-3646}
  - swiotlb: fix passing local variable to debugfs_create_ulong() (Tianyu Lan)
  - swiotlb: remove unused fields in io_tlb_mem (Chao Gao)
  - swiotlb: split up the global swiotlb lock (Tianyu Lan)
  - swiotlb: don't override user specified size in swiotlb_adjust_size (Christoph Hellwig)
  - swiotlb: dynamically allocate io_tlb_default_mem (Christoph Hellwig)
  - swiotlb: move global variables into a new io_tlb_mem structure (Claire Chang)
  - sched: Clear ttwu_pending after enqueue_task() (Tianchen Ding)
  - anolis: revert: pci: shorten waiting time in pci_reset_secondary_bus (Yang Su)
  - anolis: configs: enable CONFIG_NUMA_AWARE_SPINLOCKS for x86 and arm64 (Jing Zhang)
  - anolis: arm64: qspinlock: add CNA support for arm64 (Jing Zhang)
  - locking/qspinlock: Introduce the shuffle reduction optimization into CNA (Alex Kogan)
  - locking/qspinlock: Avoid moving certain threads between waiting queues in CNA (Alex Kogan)
  - locking/qspinlock: Introduce starvation avoidance into CNA (Alex Kogan)
  - locking/qspinlock: Introduce CNA into the slow path of qspinlock (Alex Kogan)
  - locking/qspinlock: Refactor the qspinlock slow path (Alex Kogan)
  - locking/qspinlock: Rename mcs lock/unlock macros and make them more generic (Alex Kogan)
  - anolis: arm64: paravirt: Merge pv_qspinlock_ops structure into pv_lock_ops (Jing Zhang)
  - anolis: mm: gup: allow to follow _PAGE_DEVMAP && !ZONE_DEVICE pages optionally (Zhu Yanhai)
  - io_uring: don't keep looping for more events if we can't flush overflow (Jens Axboe)
  - io_uring: don't convert to jiffies for waiting on timeouts (Jens Axboe)
  - io_uring: refactor io_cqring_wait (Pavel Begunkov)
  - io_uring: refactor scheduling in io_cqring_wait (Pavel Begunkov)
  - anolis: pci: shorten waiting time in pci_reset_secondary_bus (Yang Su)
  - anolis: sched: disable optimizing stack frame pointer of __schedule (Erwei Deng)
  - SEAM/TDX: Enable tdx config (shiqiangzhang)
  - SEAM: TDX: add IA32_TSX_CTRL MSR save/restore around TDH.SYS.INIT, TDH.SYS.LP.INIT and TDH.VP.ENTER (Chenyi Qiang)
  - KVM: TDX: Add perfmon support for TD (Chao Gao)
  - KVM: TDX: Restore MSR_IA32_DS_AREA after TD exit (Chao Gao)
  - TDX/SEAM: Load P-SEAMLDR via kernel if BIOS doesn't load it (shiqiangzhang)
  - X86: TDX: Restore GS.base after loading NP-SEAMLDR (shiqiangzhang)
  - KVM: VMX: Use the kernel's version of VMXOFF (Sean Christopherson)
  - KVM: VMX: Move Intel PT shenanigans out of VMXON/VMXOFF flows (Sean Christopherson)
  - x86/virt: Mark flags and memory as clobbered by VMXOFF (David P. Reed)
  - anolis: rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs (leoliu-oc)
  - anolis: memcg: Support memory.wmark_min_adj in cgroup v2 (Yi Tao)
  - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level() (Ryusuke Konishi) {CVE-2022-3621}
  - devlink: Fix use-after-free after a failed reload (Ido Schimmel) {CVE-2022-3625}
  - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (Jianglei Nie) {CVE-2022-3542}
  - anolis: io_uring: fix another race of kthread park and wait for completion (Xiaoguang Wang)
  - io_uring: check sqring and iopoll_list before shedule (Xiaoguang Wang)
  - io_uring: check kthread parked flag before sqthread goes to sleep (Hao Xu)
  - anolis: IDXD: Clear 'Cache Control' for batch descriptor (Jiangbo Wu)
  - anolis: mm: kidled: consider CONFIG_MEMORY_HOTPLUG uncertainty (Rongwei Wang)
  - nilfs2: fix use-after-free bug of struct nilfs_root (Ziyang Zhang) {CVE-2022-3649}
  - sched/fair: Adjust the allowed NUMA imbalance when SD_NUMA spans multiple LLCs (Mel Gorman)
  - sched/fair: Improve consistency of allowed NUMA balance calculations (Mel Gorman)
  - crypto: ccp - During shutdown, check SEV data pointer before using (Tom Lendacky)
  - anolis: bpf: add reserve fields for bpf structures (Tianchen Ding)
  - anolis: iommu/svm: fix a bug of dereferencing null ptr (Xuchun Shang)
  - x86/speculation: Add RSB VM Exit protections (Daniel Sneddon)
  - x86/speculation: Add LFENCE to RSB fill sequence (Pawan Gupta)
  - anolis: crypto: iax: Fix deflate crash caused by global shared tfm (Kun(llfl))
  - anolis: perf arm-spe: Don't update pid/tid if has set it (Jing Zhang)
  - mm/mremap: hold the rmap lock in write mode when moving page table entries. (Aneesh Kumar K.V)
  - anolis: perf tools: fix adding extraneous files to perf (Jing Zhang)
  - io_uring/af_unix: defer registered files gc to io_uring release (Pavel Begunkov) {CVE-2022-2602}
  - anolis: erofs,ovl: enable RCU'd ->get_acl() (Jingbo Xu)
  - vfs: add rcu argument to ->get_acl() callback (Miklos Szeredi)
  - anolis: erofs,ovl: bypass [override|revert]_creds for overlayfs (Jingbo Xu)
  - anolis: irqbypass: optimize list traversal and lock contention (Zhiheng Tao)
  - anolis: arm_mpam: Fix kernel boot failure when the firmware does not support MPAM (Shawn Wang)
  - anolis: iommu/vt-d: Retain PASID entry if guest switched remapping mode (Yang Weijiang)
  - anolis: crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM (chench)
  - anolis: crypto: tdm: Compile the tdm driver into ccp.ko (chench)
  - anolis: crypto: ccp: Add psp mutex enable ioctl support (chench)
  - anolis: crypto: ccp: concurrent psp access support between user and kernel space (chench)
  - anolis: tpm: Fix keyctl failure of loading an encrypted key (chench)
  - anolis: tpm: keyring service support creating encrypted key from user provided plaintext key (chench)
  - anolis: alinux: tpm: add Hygon TPM2 driver (chench)
  - anolis: crypto: tdm: Add Hygon TDM driver (chench)
  - anolis: crypto: ccp: Add another mailbox interrupt support for PSP sending command to X86 (chench)
  - anolis: crypto: ccp: Add a new interface for X86 sending command to PSP (chench)
  - anolis: sched: introduce HT_STABLE feature (Peng Wang)
  - anolis: mm: kidled: improve efficiency of scanning valid PFNs (Rongwei Wang)
  - anolis: iommu/vt-d: Fix qemu warning caused by intel_pasid_setup_second_level() called twice (Yi Sun)
  - anolis: iommu/vt-d: Only enable SLT if guest is passthrough mode (Yi Sun)
  - x86/sgx: Drop 'page_index' from sgx_backing (Sean Christopherson)
  - x86/sgx: Set active memcg prior to shmem allocation (Kristen Carlson Accardi)
  - selftests/sgx: Page removal stress test (Reinette Chatre)
  - selftests/sgx: Test reclaiming of untouched page (Reinette Chatre)
  - selftests/sgx: Test invalid access to removed enclave page (Reinette Chatre)
  - selftests/sgx: Test faulty enclave behavior (Reinette Chatre)
  - selftests/sgx: Test complete changing of page type flow (Reinette Chatre)
  - selftests/sgx: Introduce TCS initialization enclave operation (Reinette Chatre)
  - selftests/sgx: Introduce dynamic entry point (Reinette Chatre)
  - selftests/sgx: Test two different SGX2 EAUG flows (Reinette Chatre)
  - selftests/sgx: Add test for TCS page permission changes (Reinette Chatre)
  - selftests/sgx: Add test for EPCM permission changes (Reinette Chatre)
  - Documentation/x86: Introduce enclave runtime management section (Reinette Chatre)
  - x86/sgx: Free up EPC pages directly to support large page ranges (Reinette Chatre)
  - x86/sgx: Support complete page removal (Reinette Chatre)
  - x86/sgx: Support modifying SGX page type (Reinette Chatre)
  - x86/sgx: Tighten accessible memory range after enclave initialization (Reinette Chatre)
  - x86/sgx: Support adding of pages to an initialized enclave (Reinette Chatre)
  - x86/sgx: Support restricting of enclave page permissions (Reinette Chatre)
  - x86/sgx: Support VA page allocation without reclaiming (Reinette Chatre)
  - x86/sgx: Export sgx_encl_page_alloc() (Jarkko Sakkinen)
  - x86/sgx: Export sgx_encl_{grow,shrink}() (Reinette Chatre)
  - x86/sgx: Keep record of SGX page type (Reinette Chatre)
  - x86/sgx: Create utility to validate user provided offset and length (Reinette Chatre)
  - x86/sgx: Make sgx_ipi_cb() available internally (Reinette Chatre)
  - x86/sgx: Move PTE zap code to new sgx_zap_enclave_ptes() (Reinette Chatre)
  - x86/sgx: Rename sgx_encl_ewb_cpumask() as sgx_encl_cpumask() (Reinette Chatre)
  - x86/sgx: Export sgx_encl_ewb_cpumask() (Reinette Chatre)
  - x86/sgx: Support loading enclave page without VMA permissions check (Reinette Chatre)
  - x86/sgx: Add wrapper for SGX2 EAUG function (Reinette Chatre)
  - x86/sgx: Add wrapper for SGX2 EMODT function (Reinette Chatre)
  - x86/sgx: Add wrapper for SGX2 EMODPR function (Reinette Chatre)
  - x86/sgx: Add short descriptions to ENCLS wrappers (Reinette Chatre)
  - x86/sgx: Ensure no data in PCMD page after truncate (Reinette Chatre)
  - x86/sgx: Fix race between reclaimer and page fault handler (Reinette Chatre)
  - x86/sgx: Obtain backing storage page with enclave mutex held (Reinette Chatre)
  - x86/sgx: Mark PCMD page as dirty when modifying contents (Reinette Chatre)
  - x86/sgx: Disconnect backing page references from dirty status (Reinette Chatre)
  - x86/sgx: Free backing memory after faulting the enclave page (Jarkko Sakkinen)
  - x86/sgx: Fix missing poison handling in reclaimer (Reinette Chatre)
  - x86/sgx: Fix NULL pointer dereference on non-SGX systems (Dave Hansen)
  - x86/sgx: Add an attribute for the amount of SGX memory in a NUMA node (Jarkko Sakkinen)
  - x86/sgx: Fix minor documentation issues (Reinette Chatre)
  - selftests/sgx: Add test for multiple TCS entry (Reinette Chatre)
  - selftests/sgx: Enable multiple thread support (Reinette Chatre)
  - selftests/sgx: Add page permission and exception test (Reinette Chatre)
  - selftests/sgx: Rename test properties in preparation for more enclave tests (Reinette Chatre)
  - selftests/sgx: Provide per-op parameter structs for the test enclave (Jarkko Sakkinen)
  - selftests/sgx: Fix corrupted cpuid macro invocation (Jarkko Sakkinen)
  - selftests/sgx: Add a new kselftest: Unclobbered_vdso_oversubscribed (Jarkko Sakkinen)
  - selftests/sgx: Move setup_test_encl() to each TEST_F() (Jarkko Sakkinen)
  - selftests/sgx: Encpsulate the test enclave creation (Jarkko Sakkinen)
  - selftests/sgx: Dump segments and /proc/self/maps only on failure (Jarkko Sakkinen)
  - selftests/sgx: Create a heap for the test enclave (Jarkko Sakkinen)
  - selftests/sgx: Make data measurement for an enclave segment optional (Jarkko Sakkinen)
  - selftests/sgx: Assign source for each segment (Jarkko Sakkinen)
  - selftests/sgx: Fix a benign linker warning (Sean Christopherson)
  - anolis: efi: cper: fix raw data register iteration (Shuai Xue)
  - perf arm-spe: augment the data source type with neoverse_spe list (Jing Zhang)
  - perf c2c: Update documentation for new display option 'peer' (Leo Yan)
  - perf c2c: Use 'peer' as default display for Arm64 (Leo Yan)
  - perf c2c: Sort on peer snooping for load operations (Leo Yan)
  - perf c2c: Refactor display string (Leo Yan)
  - perf c2c: Refactor node header (Leo Yan)
  - perf c2c: Rename dimension from 'percent_hitm' to 'percent_costly_snoop' (Leo Yan)
  - perf c2c: Use explicit names for display macros (Leo Yan)
  - perf c2c: Add mean dimensions for peer operations (Leo Yan)
  - perf c2c: Add dimensions of peer metrics for cache line view (Leo Yan)
  - perf c2c: Add dimensions for peer load operations (Leo Yan)
  - perf c2c: Output statistics for peer snooping (Leo Yan)
  - perf mem: Add statistics for peer snooping (Leo Yan)
  - perf arm-spe: Use SPE data source for neoverse cores (Ali Saidi)
  - perf mem: Print snoop peer flag (Leo Yan)
  - perf tools: Sync addition of PERF_MEM_SNOOPX_PEER (Ali Saidi)
  - perf arm64: Add missing -I for tools/arch/arm64/include/ to find asm/sysreg.h when building arm_spe.h (Leo Yan)
  - tools headers arm64: Sync arm64's cputype.h with the kernel sources (Arnaldo Carvalho de Melo)
  - tools arm64: Import cputype.h (Ali Saidi)
  - tools: arm64: Import sysreg.h (Raghavendra Rao Ananta)
  - perf c2c: Update documentation for store metric 'N/A' (Leo Yan)
  - perf c2c: Add dimensions for 'N/A' metrics of store operation (Leo Yan)
  - perf mem: Add stats for store operation with no available memory level (Leo Yan)
  - anolis: perf c2c: split c2c and spe-c2c (Jing Zhang)
  - nvme: handle effects after freeing the request (Keith Busch)
  - anolis: sched: make __balance_callback() noinline (Cruz Zhao)
  - KEYS: asymmetric: enforce SM2 signature use pkey algo (Tianjia Zhang)
  - sign-file: Fix confusing error messages (Tianjia Zhang)
  - crypto: arm64/sm4 - Fix wrong dependency of NEON/CE implementation (Tianjia Zhang)
  - crypto: sm3,sm4 - move into crypto directory (Jason A. Donenfeld)
  - crypto: arm64/sm4 - add ARMv8 Crypto Extensions implementation (Tianjia Zhang)
  - crypto: arm64/sm4 - add ARMv8 NEON implementation (Tianjia Zhang)
  - crypto: arm64/sm4-ce - rename to sm4-ce-cipher (Tianjia Zhang)
  - crypto: sm4 - export sm4 constant arrays (Tianjia Zhang)
  - crypto: tcrypt - remove all multibuffer ahash tests (Tianjia Zhang)
  - crypto: tcrypt - add asynchronous speed test for SM3 (Tianjia Zhang)
  - crypto: x86/sm3 - add AVX assembly implementation (Tianjia Zhang)
  - crypto: sm3 - make dependent on sm3 library (Tianjia Zhang)
  - crypto: sm2 - make dependent on sm3 library (Tianjia Zhang)
  - crypto: arm64/sm3-ce - make dependent on sm3 library (Tianjia Zhang)
  - crypto: sm3 - create SM3 stand-alone library (Tianjia Zhang)
  - crypto: s390/sha512 - Use macros instead of direct IV numbers (Tianjia Zhang)
  - crypto: sparc/sha - remove duplicate hash init function (Tianjia Zhang)
  - crypto: powerpc/sha - remove duplicate hash init function (Tianjia Zhang)
  - crypto: mips/sha - remove duplicate hash init function (Tianjia Zhang)
  - crypto: sha256 - remove duplicate generic hash init function (Tianjia Zhang)
  - net/tls: simplify the tls_set_sw_offload function (Tianjia Zhang)
  - mm/mprotect.c: optimize error detection in do_mprotect_pkey() (Tianjia Zhang)
  - crypto: public_key: Remove redundant header file from public_key.h (Tianjia Zhang)
  - ACPI: APEI: do not add task_work to kernel thread to avoid memory leak (Shuai Xue)
  - dmaengine: idxd: fix RO device state error after been disabled/reset (Fengqian Gao)
  - dmaengine: idxd: Make max batch size attributes in sysfs invisible for Intel IAA (Xiaochen Shen)
  - dmaengine: idxd: Fix max batch size for Intel IAA (Xiaochen Shen)
  - anolis: driver/crypto: Introduce HGSC_CERT_IMPORT API. (fangbaoshun)
  - perf evsel: Make evsel__env() always return a valid env (Kim Phillips)
  - scsi: target: tcmu: Make cmd_ring_size changeable via configfs (Guixin Liu)
  - scsi: target: tcmu: Adjust names of variables and definitions (Bodo Stroesser)
  - mm,hwpoison: check mm when killing accessing process (Shuai Xue)
  - mailbox: pcc: Fix an invalid-load caught by the address sanitizer (Liu Song)
  - anolis: RDMA/erdma: User interface for comp vector num and bugfix (Kai)
  - watchdog: wdat_wdt: Stop watchdog when uninstalling module (Liu Xinpeng)
  - watchdog: wdat_wdt: Using the existing function to check parameter timeout (Liu Xinpeng)
  - perf/x86/intel: Update the FRONTEND MSR mask on Sapphire Rapids (Kan Liang)
  - perf/x86/intel/uncore: Fix Intel SPR M3UPI event constraints (Kan Liang)
  - perf/x86/intel/uncore: Fix Intel SPR M2PCIE event constraints (Kan Liang)
  - perf/x86/intel/uncore: Fix Intel SPR IIO event constraints (Kan Liang)
  - perf/x86/intel/uncore: Fix Intel SPR CHA event constraints (Kan Liang)
  - perf/x86/intel/uncore: Fix invalid unit check (Kan Liang)
  - perf/x86/intel: Fix instructions:ppp support in Sapphire Rapids (Kan Liang)
  - perf/x86/intel: Add more events requires FRONTEND MSR on Sapphire Rapids (Kan Liang)
  - perf/x86/intel/uncore: Fix a kernel WARNING triggered by maxcpus=1 (Kan Liang)
  - platform/x86/intel-uncore-freq: Add Sapphire Rapids server support (Artem Bityutskiy)
  - xfs: fix up non-directory creation in SGID directories (Christoph Hellwig) {CVE-2021-4037}
  - anolis: arm64: add CPU freq sample on pcct non-support (Guanghui Feng)
  - anolis: sched: support group identity in cgroup v2 (Yi Tao)
  - intel_idle: make SPR C1 and C1E be independent (Artem Bityutskiy)
  - intel_idle: Fix false positive RCU splats due to incorrect hardirqs state (Waiman Long)
  - io_uring: disable polling pollfree files (Pavel Begunkov) {CVE-2022-3176}
  - anolis: configs: enable CONFIG_WIREGUARD for x86 and arm64 (Qiao Ma)
  - anolis: configs: refresh anolis default configs (Qiao Ma)
  - anolis: arm64: drivers/perf: modify the return value of unsupport event in m1_cmn_pmu (Gou Hao)
  - anolis: Kconfig: Enable group identity (Yi Tao)
  - anolis: configs: Enable group identity (Yi Tao)
  - anolis: sched/fair: Group Identity flips using stop_machine() (Cruz Zhao)
  - anolis: sched/fair: Introduce fast path for group identity unused (Cruz Zhao)
  - anolis: sched/fair: Introduce sysctl interface to enable group identity (Cruz Zhao)
  - net: hinic: avoid kernel hung in hinic_get_stats64() (Qiao Ma)
  - net: hinic: fix bug that ethtool get wrong stats (Qiao Ma)
  - anolis: xfs: check atomic write flag before set (Joseph Qi)
  - anolis: xfs: restrict atomic set ioctl permission (Joseph Qi)
  - printk: Drop console_sem during panic (Stephen Brennan)
  - printk: Avoid livelock with heavy printk during panic (Stephen Brennan)
  - printk: disable optimistic spin during panic (Stephen Brennan)
  - printk: Add panic_in_progress helper (Stephen Brennan)
  - scsi: mpt3sas: Fix incorrectly assigned error return and check (Gu Mi)
  - scsi: mpt3sas: Stop fw fault watchdog work item during system shutdown (Gu Mi)
  - scsi: mpt3sas: Transition IOC to Ready state during shutdown (Gu Mi)
  - scsi: mpt3sas: Handle firmware faults during second half of IOC init (Gu Mi)
  - scsi: mpt3sas: Handle firmware faults during first half of IOC init (Gu Mi)
  - scsi: mpt3sas: Fix incorrect system timestamp (Gu Mi)
  - scsi: mpt3sas: Signedness bug in _base_get_diag_triggers() (Gu Mi)
  - scsi: mpt3sas: Handle trigger page after firmware update (Gu Mi)
  - scsi: mpt3sas: Add persistent MPI trigger page (Gu Mi)
  - scsi: mpt3sas: Add persistent SCSI sense trigger page (Gu Mi)
  - scsi: mpt3sas: Add persistent Event trigger page (Gu Mi)
  - scsi: mpt3sas: Add persistent Master trigger page (Gu Mi)
  - scsi: mpt3sas: Add persistent trigger pages support (Gu Mi)
  - scsi: mpt3sas: Sync time periodically between driver and firmware (Gu Mi)
  - anolis: erofs: implement fscache-based data readahead (Jingbo Xu)
  - anolis: fscache,cachefiles: add fscache_prepare_read() helper (Jingbo Xu)
  - anolis: cachefiles: maintain a file descriptor to the backing file (Jingbo Xu)
  - perf tools: Set COMPAT_NEED_REALLOCARRAY for CONFIG_AUXTRACE=1 (Arnaldo Carvalho de Melo)
  - KVM: Fix references to non-existent KVM_CAP_TRIPLE_FAULT_EVENT (Sean Christopherson)
  - KVM: VMX: Enable Notify VM exit (Tao Xu)
  - KVM: selftests: Add a test to get/set triple fault event (Chenyi Qiang)
  - KVM: x86: Extend KVM_{G,S}ET_VCPU_EVENTS to support pending triple fault (Chenyi Qiang)
  - KVM: VMX: Remove redundant handling of bus lock vmexit (Hao Xiang)
  - KVM: nVMX: Fix nested bus lock VM exit (Chenyi Qiang)
  - KVM: X86: Add the Document for KVM_CAP_X86_BUS_LOCK_EXIT (Chenyi Qiang)
  - KVM: VMX: Enable bus lock VM exit (Chenyi Qiang)
  - KVM: X86: Reset the vcpu->run->flags at the beginning of vcpu_run (Chenyi Qiang)
  - x86/bus_lock: Don't assume the init value of DEBUGCTLMSR.BUS_LOCK_DETECT to be zero (Chenyi Qiang)
  - KVM: X86: Add support for the emulation of DR6_BUS_LOCK bit (Chenyi Qiang)
  - KVM: X86: Rename DR6_INIT to DR6_ACTIVE_LOW (Chenyi Qiang)
  - KVM: X86: Expose bus lock debug exception to guest (Paolo Bonzini)
  - KVM: VMX: read/write MSR_IA32_DEBUGCTLMSR from GUEST_IA32_DEBUGCTL (Like Xu)
  - KVM: Expose AVX_VNNI instruction to guset (Jiaqing Huang)
  - KVM: x86: Expose AVX512_FP16 for supported CPUID (Jiaqing Huang)
  - KVM: VMX: enable IPI virtualization (Chao Gao)
  - kvm: selftests: Add KVM_CAP_MAX_VCPU_ID cap test (Zeng Guang)
  - KVM: x86: Allow userspace to set maximum VCPU id for VM (Zeng Guang)
  - KVM: Move kvm_arch_vcpu_precreate() under kvm->lock (Zeng Guang)
  - KVM: VMX: Clean up vmx_refresh_apicv_exec_ctrl() (Zeng Guang)
  - KVM: x86: Support interrupt dispatch in x2APIC mode with APIC-write VM exit (Zeng Guang)
  - KVM: VMX: Report tertiary_exec_control field in dump_vmcs() (Robert Hoo)
  - KVM: VMX: Detect Tertiary VM-Execution control when setup VMCS config (Robert Hoo)
  - KVM: VMX: Extend BUILD_CONTROLS_SHADOW macro to support 64-bit variation (Robert Hoo)
  - anolis: configs: enable CONFIG_PAGE_PREZERO on x86 (Xu Yu)
  - anolis: mm: prezero: add page clear engine with DMA device hardware offloading (Xiaochen Shen)
  - anolis: dmaengine: add a new DMA flag for direct data writes to be nontemporal (Xiaochen Shen)
  - anolis: dmaengine: idxd: add memset operation (Dave Jiang)
  - anolis: mm: prezero: make anon THP use __GFP_ZERO (Xiaochen Shen)
  - anolis: mm: prezero: allocate page from tail for __GFP_ZERO (Xu Yu)
  - anolis: mm: prezero: pass gfp parameter to rmqueue_bulk (Xu Yu)
  - anolis: mm: prezero: set PG_zeroed after free to buddy (Xu Yu)
  - anolis: mm: prezero: introduce kprezerod (Xiaochen Shen)
  - anolis: mm: prezero: add pre-zeroed page statistics (Xiaochen Shen)
  - anolis: mm: prezero: manage pre-zeroed pages (Xiaochen Shen)
  - anolis: mm: prezero: clear page->private out of post_alloc_hook (Xiaochen Shen)
  - anolis: mm: prezero: clear page->private when free pages (Xu Yu)
  - anolis: mm: prezero: introduce PAGE_ZEROED bit (Xiaochen Shen)
  - anolis: mm: prezero: introduce PG_zeroed flag (Xu Yu)
  - anolis: mm: prezero: introduce PAGE_PREZERO config (Xiaochen Shen)
  - anolis: crypto/ycc: Fix error config for the register REG_RING_CFG (Guanjun)
  - perf/x86/amd/core: Fix reloading events for SVM (Sandipan Das)
  - perf/x86/amd: Run AMD BRS code only on supported hw (Borislav Petkov)
  - perf/x86/amd: Fix AMD BRS period adjustment (Peter Zijlstra)
  - perf/x86/amd: Remove unused variable 'hwc' (Zucheng Zheng)
  - perf script ibs: Support new IBS bits in raw trace dump (Ravi Bangoria)
  - perf tool ibs: Sync AMD IBS header file (Ravi Bangoria)
  - perf report: Add support to print a textual representation of IBS raw sample data (Kim Phillips)
  - perf evlist: Use the right prefix for 'struct evlist' sample id lookup methods (Arnaldo Carvalho de Melo)
  - perf evlist: Use the right prefix for 'struct evlist' sample parsing methods (Arnaldo Carvalho de Melo)
  - perf evlist: Use the right prefix for 'struct evlist' raw samples methods (Arnaldo Carvalho de Melo)
  - perf report: Add tools/arch/x86/include/asm/amd-ibs.h (Kim Phillips)
  - perf env: Add perf_env__cpuid, perf_env__{nr_}pmu_mappings (Kim Phillips)
  - perf/x86/ibs: Add new IBS register bits into header (Ravi Bangoria)
  - perf header: Record non-CPU PMU capabilities (Ravi Bangoria)
  - perf inject: Keep some features sections from input file (Adrian Hunter)
  - libperf: Add preadn() (Adrian Hunter)
  - perf header: Store PMU caps in an array of strings (Ravi Bangoria)
  - perf header: Pass "cpu" pmu name while printing caps (Ravi Bangoria)
  - perf header: Support HYBRID_CPU_PMU_CAPS feature (Jin Yao)
  - perf header: Support HYBRID_TOPOLOGY feature (Jin Yao)
  - perf pmu: Add hybrid helper functions (Jin Yao)
  - perf pmu: Save detected hybrid pmus to a global pmu list (Jin Yao)
  - perf pmu: Parse pmu caps sysfs only once (Ravi Bangoria)
  - perf record ibs: Warn about sampling period skew (Ravi Bangoria)
  - perf/amd/ibs: Advertise zen4_ibs_extensions as pmu capability (Ravi Bangoria)
  - perf/amd/ibs: Add support for L3 miss filtering (Ravi Bangoria)
  - perf/amd/ibs: Use ->is_visible callback for dynamic (Ravi Bangoria)
  - perf/x86/amd/uncore: Add PerfMonV2 DF event format (Sandipan Das)
  - perf/x86/amd/uncore: Detect available DF counters (Sandipan Das)
  - perf/x86/amd/uncore: Use attr_update for format attributes (Sandipan Das)
  - perf/x86/amd/uncore: Use dynamic events array (Sandipan Das)
  - perf/x86/amd/core: Add PerfMonV2 overflow handling (Sandipan Das)
  - perf/x86/amd/core: Add PerfMonV2 counter control (Sandipan Das)
  - perf/x86/amd/core: Detect available counters (Sandipan Das)
  - perf/x86/amd/core: Detect PerfMonV2 support (Sandipan Das)
  - x86/msr: Add PerfCntrGlobal* registers (Sandipan Das)
  - x86/cpufeatures: Add PerfMonV2 feature bit (Sandipan Das)
  - perf report: Add "addr_from" and "addr_to" sort dimensions (Stephane Eranian)
  - perf/x86/amd: Add idle hooks for branch sampling (Stephane Eranian)
  - ACPI: Add perf low power callback (Stephane Eranian)
  - perf/x86/amd: Make Zen3 branch sampling opt-in (Stephane Eranian)
  - perf/x86/amd: Add AMD branch sampling period adjustment (Stephane Eranian)
  - perf/x86/amd: Enable branch sampling priv level filtering (Stephane Eranian)
  - perf/x86/amd: Add branch-brs helper event for Fam19h BRS (Stephane Eranian)
  - perf/x86/amd: Add AMD Fam19h Branch Sampling support (Stephane Eranian)
  - x86/cpufeatures: Add AMD Fam19h Branch Sampling feature (Stephane Eranian)
  - perf/core: Add perf_clear_branch_entry_bitfields() helper (Stephane Eranian)
  - x86/events/amd/iommu: Remove redundant assignment to variable (Colin Ian King)
  - perf/x86/amd/ibs: Add bitfield definitions in new (Kim Phillips)
  - perf/amd/uncore: Allow the driver to be built as a module (Kim Phillips)
  - x86/cpu: Add get_llc_id() helper function (Kim Phillips)
  - perf/amd/uncore: Clean up header use, use <linux/ include paths instead of <asm/ (Kim Phillips)
  - perf/amd/uncore: Simplify code, use free_percpu()'s built-in check for NULL (Kim Phillips)
  - PCI/ERR: Retain status from error notification (Keith Busch)
  - anolis: mm: Add ioremap_nohuge() func support (Xin Hao)
  - crypto: iax: Break out of loop after list del in del_iax_wq() (Tom Zanussi)
  - crypto: iax: fix incorrect desc ptr being used for error out (Dave Jiang)
  - crypto: iax: fix usage of uninit ptr in iax_compress() call (Dave Jiang)
  - crypto: iax: remove double free on iax_device (Dave Jiang)
  - crypto: Enable iax_crypto_enable and iax_crypto_disable (Tom Zanussi)
  - crypto: Update IDXD support for IAX crypto (Tom Zanussi)
  - crypto: iax - Add IAX crypto stats (Tom Zanussi)
  - crypto: iax - Add async interface support (Tom Zanussi)
  - crypto: iax - Introduce iax hardware compression accelerator (Tom Zanussi)
  - lib/hexdump: Allow print_hexdump() to print rowsize of 8 (Tom Zanussi)
  - dmaengine: idxd: Add private_data to struct idxd_wq (Tom Zanussi)
  - dmaengine: idxd: Export wq resource management functions (Tom Zanussi)
  - dmaengine: idxd: Export descriptor management functions (Tom Zanussi)
  - dmaengine: idxd: add external module driver support for dsa_bus_type (Dave Jiang)
  - EDAC/i10nm: Release mdev/mbase when failing to detect HBM (Qiuxu Zhuo)
  - EDAC/skx_common: Set the memory type correctly for HBM memory (Qiuxu Zhuo)
  - EDAC/mc: Add new HBM2 memory type (Naveen Krishna Chatradhi)
  - EDAC/i10nm: Add support for high bandwidth memory (Qiuxu Zhuo)
  - anolis: virtio_mem: arm enable virtio_mem (jingshan)
  - mm/ioremap: fix iomap_max_page_shift (Christophe Leroy)
  - anolis: ovl: change pr_warn() to pr_warn_ratelimited() (Joseph Qi)
  - scsi: mpt3sas: Fix incorrect 4GB boundary check (Gu Mi)
  - scsi: mpt3sas: Force reply post array allocations to be within same 4 GB region (Gu Mi)
  - scsi: mpt3sas: Force reply post buffer allocations to be within same 4GB region (Gu Mi)
  - scsi: mpt3sas: Force reply buffer allocations to be within same 4 GB region (Gu Mi)
  - scsi: mpt3sas: Force sense buffer allocations to be within same 4 GB region (Gu Mi)
  - scsi: mpt3sas: Force chain buffer allocations to be within same 4 GB region (Gu Mi)
  - scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region (Gu Mi)
  - ip: fix triggering of 'icmp redirect' (Nicolas Dichtel)
  - ecryptfs: fix uid translation for setxattr on security.capability (Miklos Szeredi)
  - ovl: show "userxattr" in the mount data (Giuseppe Scrivano)
  - ovl: unprivieged mounts (Miklos Szeredi)
  - ovl: do not get metacopy for userxattr (Miklos Szeredi)
  - ovl: do not fail because of O_NOATIME (Miklos Szeredi)
  - ovl: do not fail when setting origin xattr (Miklos Szeredi)
  - ovl: user xattr (Miklos Szeredi)
  - ovl: check privs before decoding file handle (Miklos Szeredi)
  - vfs: verify source area in vfs_dedupe_file_range_one() (Miklos Szeredi)
  - vfs: move cap_convert_nscap() call into vfs_setxattr() (Miklos Szeredi)
  - anolis: Revert "anolis: crypto/ycc: Add hash algorithm support" (Guanjun)
  - anolis: Revert "anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending" (Wen Gu)
  - anolis: Revert "anolis: net/smc: fix SMC_CLC_DECL_ERR_REGRMB without smc_server_lgr_pending" (Wen Gu)
  - anolis: net/smc: Fix NULL sndbuf_desc in smc_cdc_tx_handler() (D. Wythe)
  - anolis: net/smc: Stop the CLC flow if there's no link to map RMBs on (Wen Gu)
  - anolis: net/smc: Fix UAF when fallback after lgr create (Tony Lu)
  - anolis: net/smc: Avoid use-after-free of smcibcq tasklet (Wen Gu)
  - anolis: net/smc: Restore rx queue depth (Tony Lu)
  - anolis: net/smc: Fix task hung in SMC-R terminating all link groups (Wen Gu)
  - anolis: PHYTIUM: config: Add PHYTIUM ft2500 chip HW support (Xin Hao)
  - anolis: PHYTIUM: smmu: one device per iommu group for VF/PF passthrough (Wang Yinfeng)
  - anolis: PHYTIUM: Add cputypes and machine support (Wang Yinfeng)
  - anolis: PHYTIUM: rtc: Add Phytium rtc device support (Chen Baozi)
  - anolis: PHYTIUM: ACPI: APD: Add clock frequency for for phytium i2c control (Xin Hao)
  - anolis: PHYTIUM: ft2000: fixed smmu tlb timeout by msi iommu map (Zou Cao)
  - anolis: PHYTIUM: iommu: add iommu_hwfix to work around arm-smmu hw issues (Zou Cao)
  - anolis: PHYTIUM: Fix S2500 can't produce kdump core file (liwencheng)
  - anolis: PHYTIUM: irqchip: Add Phytium 2500 GIC ITS driver (liwencheng)
  - perf arm-spe: Don't set data source if it's not a memory operation (Leo Yan)
  - perf mem: Trace physical address for Arm SPE events (Leo Yan)
  - perf arm-spe: Fix SPE events with phys addresses (Timothy Hayes)
  - perf arm-spe: Fix addresses of synthesized SPE events (Timothy Hayes)
  - perf docs: Add man page entry for Arm SPE (James Clark)
  - perf arm-spe: Use advertised caps/min_interval as default sample_period (German Gomez)
  - perf arm-spe: Synthesize SPE instruction events (German Gomez)
  - perf arm-spe: Add SPE total latency as PERF_SAMPLE_WEIGHT (Namhyung Kim)
  - perf arm-spe: Support hardware-based PID tracing (German Gomez)
  - perf arm-spe: Save context ID in record (German Gomez)
  - perf arm-spe: Update --switch-events docs in 'perf record' (German Gomez)
  - perf arm-spe: Track task context switch for cpu-mode events (Namhyung Kim)
  - perf arm-spe: Print size using consistent format (Andrew Kilroy)
  - perf arm-spe: Snapshot mode test (German Gomez)
  - perf arm-spe: Implement find_snapshot callback (German Gomez)
  - perf arm-spe: Add snapshot mode support (German Gomez)
  - perf arm-spe: Remove redundant checking for "full_auxtrace" (Leo Yan)
  - perf arm-spe: Enable timestamp for per-cpu mode (Leo Yan)
  - perf arm-spe: Correct sample flags for dummy event (Leo Yan)
  - perf arm-spe: Correct sample flags for SPE event (Leo Yan)
  - perf arm-spe: Avoid potential buffer overrun (Ian Rogers)
  - perf arm-spe: Set sample's data source field (Leo Yan)
  - perf arm-spe: Synthesize memory event (Leo Yan)
  - perf arm-spe: Fill address info for samples (Leo Yan)
  - perf arm-spe: Store operation type in packet (Leo Yan)
  - perf arm-spe: Store memory address in packet (Leo Yan)
  - perf arm-spe: Enable sample type PERF_SAMPLE_DATA_SRC (Leo Yan)
  - perf c2c: Add local variables for output metrics (Leo Yan)
  - perf c2c: Refactor node display (Leo Yan)
  - perf c2c: Fix argument type for percent() (Leo Yan)
  - perf c2c: Refactor display filter (Leo Yan)
  - perf c2c: Refactor hist entry validation (Leo Yan)
  - perf c2c: Rename for shared cache line stats (Leo Yan)
  - perf arm-spe: Add support for ARMv8.3-SPE (Wei Li)
  - perf arm_spe: Decode memory tagging properties (Andre Przywara)
  - perf arm-spe: Add more sub classes for operation packet (Leo Yan)
  - perf arm-spe: Refactor operation packet handling (Leo Yan)
  - perf arm-spe: Add new function arm_spe_pkt_desc_op_type() (Leo Yan)
  - perf arm-spe: Remove size condition checking for events (Leo Yan)
  - perf arm-spe: Refactor event type handling (Leo Yan)
  - perf arm-spe: Add new function arm_spe_pkt_desc_event() (Leo Yan)
  - perf arm-spe: Refactor counter packet handling (Leo Yan)
  - perf arm-spe: Add new function arm_spe_pkt_desc_counter() (Leo Yan)
  - perf arm-spe: Refactor context packet handling (Leo Yan)
  - perf arm_spe: Fixup top byte for data virtual address (Leo Yan)
  - perf arm-spe: Refactor address packet handling (Leo Yan)
  - perf arm-spe: Add new function arm_spe_pkt_desc_addr() (Leo Yan)
  - perf arm-spe: Refactor packet header parsing (Leo Yan)
  - perf arm-spe: Refactor printing string to buffer (Leo Yan)
  - perf arm-spe: Fix packet length handling (Leo Yan)
  - perf arm-spe: Refactor arm_spe_get_events() (Leo Yan)
  - perf arm-spe: Refactor payload size calculation (Leo Yan)
  - perf arm-spe: Fix a typo in comment (Leo Yan)
  - perf arm-spe: Include bitops.h for BIT() macro (Leo Yan)
  - anolis: configs: enable ACPI PCC by default on arm64 (Guanjun)
  - mailbox: pcc: Handle all PCC subtypes correctly in pcc_mbox_irq (Sudeep Holla)
  - ACPI: PCC: Implement OperationRegion handler for the PCC Type 3 subtype (Sudeep Holla)
  - ACPICA: Add support for PCC Opregion special context data (Sudeep Holla)
  - mailbox: pcc: Move bulk of PCCT parsing into pcc_mbox_probe (Sudeep Holla)
  - mailbox: pcc: Add support for PCCT extended PCC subspaces(type 3/4) (Sudeep Holla)
  - mailbox: pcc: Drop handling invalid bit-width in {read,write}_register (Sudeep Holla)
  - mailbox: pcc: Avoid accessing PCCT table in pcc_send_data and pcc_mbox_irq (Sudeep Holla)
  - mailbox: pcc: Add PCC register bundle and associated accessor functions (Sudeep Holla)
  - mailbox: pcc: Rename doorbell ack to platform interrupt ack register (Sudeep Holla)
  - mailbox: pcc: Use PCC mailbox channel pointer instead of standard (Sudeep Holla)
  - mailbox: pcc: Add pcc_mbox_chan structure to hold shared memory region info (Sudeep Holla)
  - mailbox: pcc: Consolidate subspace doorbell register parsing (Sudeep Holla)
  - mailbox: pcc: Consolidate subspace interrupt information parsing (Sudeep Holla)
  - mailbox: pcc: Refactor all PCC channel information into a structure (Sudeep Holla)
  - mailbox: pcc: Fix kernel doc warnings (Sudeep Holla)
  - anolis: ACPICA: Support using op_region by PCC master subspace (Guanjun)
  - anolis: Add a boot command line for rich container (Erwei Deng)
  - anolis: net/smc: fix panic smc_tcp_syn_recv_sock() while closing listen socket (D. Wythe)
  - anolis: net/smc: fix deadlock when lgr terminating (D. Wythe)
  - anolis: Revert "anolis: net/smc: fix deadlock when lgr terminating" (D. Wythe)
  - anolis: net/smc: Reuse wr_id to recognize wc for tx or rx (Tony Lu)
  - anolis: net/smc: delay RDMA resource release until connecitons freed (Wen Gu)
  - anolis: net/smc: Use SO_REUSEADDR if keep clcsock (Tony Lu)
  - anolis: net/smc: fix SMC_CLC_DECL_ERR_REGRMB without smc_server_lgr_pending (D. Wythe)
  - anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending (D. Wythe)
  - anolis: Revert "anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending" (Tony Lu)
  - anolis: Revert "anolis: net/smc: fix SMC_CLC_DECL_ERR_REGRMB without smc_server_lgr_pending" (Tony Lu)
  - anolis: net/smc: Fix wr tasklet handler for rx/tx wc (Tony Lu)
  - anolis: net/smc: check clcsock->sk validity in fallback restore (Wen Gu)
  - anolis: net/smc: Keep first contact clcsock (Tony Lu)
  - anolis: Revert "anolis: net/smc: Keep first contact clcsock" (Wen Gu)
  - anolis: configs: let PCIe PMU driver be built in (Shuai Xue)
  - anolis: drivers/perf: add a separate config for DesignWare PCIe controller PMU (Shuai Xue)
  - anolis: drivers/perf: clean up unused variable (Shuai Xue)
  - anolis: drivers/perf: simplify extended capability founding (Shuai Xue)
  - anolis: drivers/perf: simplify Root Port check (Shuai Xue)
  - anolis: idxd: remove unused functions (Xuchun Shang)
  - powercap: RAPL: Add AMD Fam19h RAPL support (Kim Phillips)
  - powercap: Add AMD Fam17h RAPL support (Victor Ding)
  - powercap/intel_rapl_msr: Convert rapl_msr_priv into pointer (Victor Ding)
  - x86/msr-index: sort AMD RAPL MSRs by address (Victor Ding)
  - iommu/vt-d: Enable write protect propagation from guest (Jacob Pan)
  - iommu/vt-d: remove redundant trace.o option (Lu Baolu)
  - iommu/vt-d: Delete svm_lookup_device_by_sid() (Lu Baolu)
  - iommu/vt-d: Delete handle_single_prq_event() (Lu Baolu)
  - iommu/vt-d: Delete handle_bad_prq_event() (Lu Baolu)
  - iommu/vt-d: Global devTLB flush when present context entry changed (Sanjay Kumar)
  - iommu/vt-d: Disable spin lock and cpu_relax() in qi (Lu Baolu)
  - iommu/vt-d: Monitor queued invalidation execution time (Lu Baolu)
  - iommu/vt-d: Make PRQ size and allocation dynamic (Jacob Pan)
  - iommu/vt-d: fix missing invalidation when changing a present SL-only PGTT type to a Nested type. (Sanjay Kumar)
  - intel_idle: Add a new flag to initialize the AMX state (Chang S. Bae)
  - x86/fpu: Add a helper to prepare AMX state for low-power CPU idle (Chang S. Bae)
  - cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE (Peter Zijlstra)
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Dongliang Mu) {CVE-2022-2978}
  - anolis: mm: fcm: do not unconditionally call fixup ops (Xu Yu)
  - anolis: Revert "anolis: mm: fcm: do not unconditionally call fcm_fixup_vma" (Xu Yu)
  - anolis: arm_mpam: Fix the problem that error interrupt handling cannot exit normally (Shawn Wang)
  - anolis: arm_mpam: Fix wrong type conversion for dev_id in mpam_irq_handler() (Shawn Wang)
  - iommu: Stop exporting iommu_map_sg_atomic() (John Garry)
  - iommu: Take lock before reading iommu group default domain type (Sai Praneeth Prakhya)
  - iommu/vt-d: Avoid GFP_ATOMIC where it is not needed (Christophe JAILLET)
  - iommu/vt-d: Add PRQ handling latency sampling (Lu Baolu)
  - iommu/vt-d: Move capability check code to cap_audit files (Kyung Min Park)
  - iommu/vt-d: Fix compile error [-Werror=implicit-function-declaration] (Lu Baolu)
  - iommu: Delete iommu_domain_window_disable() (John Garry)
  - iommu: use the __iommu_attach_device() directly for deferred attach (Lianbo Jiang)
  - dma-iommu: use static-key to minimize the impact in the fast-path (Lianbo Jiang)
  - iommu/vt-d: Add qi_submit trace event (Lu Baolu)
  - iommu: Delete iommu_dev_has_feature() (John Garry)
  - dma-iommu: remove __iommu_dma_mmap (Christoph Hellwig)
  - iommu: Improve the performance for direct_mapping (Yong Wu)
  - iommu/vt-d: Remove set but not used variable (Lu Baolu)
  - iommu: return error code when it can't get group (Yang Yingliang)
  - iommu: Add support to change default domain of an iommu group (Sai Praneeth Prakhya)
  - iommu: Move def_domain type check for untrusted device into core (Lu Baolu)
  - dma-mapping: remove the {alloc,free}_noncoherent methods (Christoph Hellwig)
  - iova: Stop exporting some more functions (John Garry)
  - iova: Make has_iova_flush_queue() private (John Garry)
  - iova: Delete copy_reserved_iova() (John Garry)
  - iommu: Stop exporting alloc_iova_mem() (John Garry)
  - iommu: Stop exporting free_iova_mem() (John Garry)
  - iommu: Delete split_and_remove_iova() (John Garry)
  - iommu: avoid taking iova_rbtree_lock twice (Cong Wang)
  - iommu/iova: Free global iova rcache on iova alloc failure (Vijayanand Jitta)
  - iommu/iova: Retry from last rb tree node if iova search fails (Vijayanand Jitta)
  - filemap: Correct the conditions for marking a folio as accessed (Matthew Wilcox (Oracle))
  - anolis: arm64: drivers/perf: fix DDRSS PMU interrupt initialization (Shuai Xue)
  - iommu/vt-d: Fix 5 level issue (Yi Sun)
  - ext4: do not call FC trace event in ext4_fc_commit() if FS does not support FC (Ritesh Harjani)
  - ext4: improve fast_commit performance and scalability (Ritesh Harjani)
  - ext4: inline data inode fast commit replay fixes (Harshad Shirwadkar)
  - ext4: commit inline data during fast commit (Harshad Shirwadkar)
  - ext4: remove expensive flush on fast commit (Daejun Park)
  - iommu/vtd-: Fix regression issue in intel_svm_free_async_fn (Yi Liu)
  - iommu/vt-d: Fruther fix PASID race (Yi Liu)
  - iommu/vt-d: Fix A-B-C-A dead lock issue which results in PRQ timeout (Yi Liu)
  - ntb: intel: add Intel NTB LTR vendor support for gen4 NTB (Zheng Wu)
  - anolis: fs/resctrl: Refine the outputs of last_cmd_status (Shawn Wang)
  - iommu: Delete iommu_dma_free_cpu_cached_iovas() (John Garry)
  - iommu/vt-d: Remove IOVA domain rcache flushing for CPU offlining (John Garry)
  - iommu/vt-d: Fix incorrect invalidation when tearing down a pasid table entry (Sanjay Kumar)
  - iommu/vt-d: remove useless parameters of flush_iotlb_all (Lu Baolu)
  - iommu/vt-d: do not clear pte only if it is gIOVA case (Lu Baolu)
  - iommu/vt-d: Fix an issue in intel_svm_free_async_fn() (Liu Yi L)
  - iommu/vt-d: Allow disabling PRQ timeout (Jacob Pan)
  - dmaengine: idxd: move wq pasid configuration until when needed (Dave Jiang)
  - dmaengine: idxd: remove shared wq restriction on config load (Dave Jiang)
  - vfio: Support bind/unbind guest page table to default PASID (Yi Sun)
  - vfio/type1: Support page response for IOMMU-capable Mdev (Liu Yi L)
  - vfio/type1: Handle page response from VM (Liu Yi L)
  - vfio/type1: Allow invalidating first-level/stage IOMMU cache (Liu Yi L)
  - vfio/type1: Support binding guest page tables to PASID (Liu Yi L)
  - iommu/vtd: Fix some gpasid related issues (Yi Sun)
  - iommu/vt-d: Fix pasid bind issue (Yi Sun)
  - iommu/vt-d: Fix gpasid bind/unbind issue (Yi Sun)
  - iommu/vt-d: Calculate and set flags for handle_mm_fault (Jacob Pan)
  - iommu/vt-d: Ignore pte present check if it is not nested PASID entry (Sun, Yi Y)
  - iommu/vt-d: Support bind/unbind guest pt to def PASID (!VFIO) (Liu Yi L)
  - iommu: make sure unregistration of fault handler never fails (Jacob Pan)
  - iommu: support multiple fault handler data per device (Jacob Pan)
  - iommu/vt-d: Check pasid ownership in intel_svm_page_response (Liu, Yi L)
  - iommu: add domain argument to page response (Jacob Pan)
  - anolis: configs: enable CONFIG_YITIAN_CPER_RAWDATA as default (Shuai Xue)
  - anolis: configs: set CONFIG_CRYPTO_DEV_YCC to m on arm64 (Guanjun)
  - anolis: crypto/ycc: optimize the flow of device error (Guanjun)
  - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo) {CVE-2022-2588}
  - anolis: efi: cper: add DDR raw data support for Yitian (Shuai Xue)
  - anolis: efi: cper: refactor raw data handling for Yitian (Shuai Xue)
  - anolis: efi: cper: check Yitian raw data signature (Shuai Xue)
  - anolis: efi: cper: move Yitian specific raw data handling into CONFIG_YITIAN_CPER_RAWDATA (Shuai Xue)
  - posix-cpu-timers: Cleanup CPU timers before freeing them during exec (Thadeu Lima de Souza Cascardo)
  - anolis: mm: change del_pid permission to write only (zhaoxinchao)
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain (Thadeu Lima de Souza Cascardo) {CVE-2022-2586}
  - netfilter: nf_tables: do not allow CHAIN_ID to refer to another table (Thadeu Lima de Souza Cascardo) {CVE-2022-2586}
  - tools/power/x86/intel-speed-select: Fix warning for perf_cap.cpu (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Display error on turbo mode disabled (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: fix build failure when using -Wl,--as-needed (Herton R. Krzesinski)
  - tools/power/x86/intel-speed-select: v1.12 release (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: HFI support (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: OOB daemon mode (Srinivas Pandruvada)
  - kbuild: replace $(if A,A,B) with $(or A,B) (Masahiro Yamada)
  - tools/power/x86/intel-speed-select: v1.11 release (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Update max frequency (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: v1.10 release (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Fix uncore memory frequency display (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: v1.9 release (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Drop __DATE__ and __TIME__ macros (Antonio Terceiro)
  - tools/power/x86/intel-speed-select: Add options to force online (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Process mailbox read error for core-power (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Update version to 1.8 (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Add new command to get/set TRL (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Add new command turbo-mode (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Update version for v5.11 (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Account for missing sysfs for die_id (Srinivas Pandruvada)
  - tools/power/x86/intel-speed-select: Read TRL from mailbox (Srinivas Pandruvada)
  - Revert "iommu/vt-d: Update the virtual command related registers" (Lu Baolu)
  - ioasid: Revert range adjustment (Jacob Pan)
  - iommu/vt-d: Flush the kernel PASID if used by the device (Jacob Pan)
  - iommu/vt-d: Check model and stepping for PASID PT SRE support (Jacob Pan)
  - ioasid: Reserve a global PASID for in-kernel DMA (Jacob Pan)
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Thadeu Lima de Souza Cascardo) {CVE-2022-2586}
  - mm,hwpoison: send SIGBUS to PF_MCE_EARLY processes on action required events (Aili Yao)
  - mm/hwpoison: check the subpage, not the head page (Matthew Wilcox (Oracle))
  - anolis: net/smc: Fix NULL pointer in smc_getname while first contact clcsock release (D. Wythe)
  - anolis: net/smc: skip smc_llc_flow_initiate while SMC-1RTT (D. Wythe)
  - anolis: net/smc: fix SMC_CLC_DECL_ERR_REGRMB without smc_server_lgr_pending (D. Wythe)
  - anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending (D. Wythe)
  - anolis: Revert "anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending" (D. Wythe)
  - anolis: Revert "anolis: net/smc: fix SMC_CLC_DECL_ERR_REGRMB without smc_server_lgr_pending" (D. Wythe)
  - anolis: Revert "anolis: net/smc: skip smc_llc_flow_initiate while SMC-1RTT" (D. Wythe)
  - anolis: mm: fcm: do not unconditionally call fcm_fixup_vma (Xu Yu)
  - anolis: net/smc: Introduce smc dim (Guangguan Wang)
  - anolis: Revert "net/smc: Introduce rdma dim for smc" (Guangguan Wang)
  - netfilter: nf_queue: do not allow packet truncation below transport header offset (Florian Westphal) {CVE-2022-36946}
  - anolis: arm64: spectre: added a description of the parameter nospectre_bhb (Liu Song)
  - anolis: arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - anolis: configs: support SMR zoned device (Guanjun)
  - anolis: drivers: base: cacheinfo: export get_cpu_cacheinfo symbol (Guanjun)
  - anolis: random: speed up the initialization of module (Xingjun Liu)
  - anolis: random: introduce the initialization seed (Xingjun Liu)
  - anolis: arm_mpam: Add hypervisor mode detection before accessing MPAM registers (Shawn Wang)
  - anolis: Revert "f2fs: remove false alarm on iget failure during GC" (Gao Xiang)
  - anolis: crypto/ycc: fix unexpected logic when devices probing (Guanjun)
  - anolis: arm64: Remove GPL from pv_ops export for ARM/ARM64 (Shawn Wang)
  - anolis: fs/resctrl: Extend the maximum number of CLOSIDs to 64 (Shawn Wang)
  - anolis: io_uring: cleanup unused parameter 'in_async' (Joseph Qi)
  - anolis: iommu: Fix bug of iommu sync/clear dirty log (Fengqian Gao)
  - anolis: configs: remove vestigal UAO support (Shuai Xue)
  - arm64: extable: fix load_unaligned_zeropad() reg indices (Evgenii Stepanov)
  - arm64: uaccess: avoid blocking within critical sections (Mark Rutland)
  - arm64: extable: remove unused ex_handler_t definition (Jisheng Zhang)
  - arm64: vmlinux.lds.S: remove `.fixup` section (Mark Rutland)
  - arm64: extable: add load_unaligned_zeropad() handler (Mark Rutland)
  - arm64: extable: add a dedicated uaccess handler (Mark Rutland)
  - arm64: extable: add `type` and `data` fields (Mark Rutland)
  - arm64: extable: use `ex` for `exception_table_entry` (Mark Rutland)
  - arm64: extable: make fixup_exception() return bool (Mark Rutland)
  - arm64: extable: consolidate definitions (Mark Rutland)
  - arm64: assembler: add conditional cache fixups (Mark Rutland)
  - arm64: assembler: replace `kaddr` with `addr` (Mark Rutland)
  - arm64: gpr-num: support W registers (Mark Rutland)
  - arm64: factor out GPR numbering helpers (Mark Rutland)
  - arm64: kvm: use kvm_exception_table_entry (Mark Rutland)
  - anolis: arm64: lib: __arch_copy_in_user(): fold fixups into body (Shuai Xue)
  - arm64: lib: __arch_copy_to_user(): fold fixups into body (Mark Rutland)
  - arm64: lib: __arch_copy_from_user(): fold fixups into body (Mark Rutland)
  - arm64: lib: __arch_clear_user(): fold fixups into body (Mark Rutland)
  - arm64: Rewrite __arch_clear_user() (Robin Murphy)
  - arm64: mark __system_matches_cap as __maybe_unused (Mark Rutland)
  - arm64: uaccess: remove vestigal UAO support (Mark Rutland)
  - arm64: uaccess: remove redundant PAN toggling (Mark Rutland)
  - arm64: uaccess: remove addr_limit_user_check() (Mark Rutland)
  - arm64: uaccess: remove set_fs() (Mark Rutland)
  - arm64: uaccess cleanup macro naming (Mark Rutland)
  - arm64: uaccess: split user/kernel routines (Mark Rutland)
  - arm64: alternatives: Split up alternative.h (Will Deacon)
  - arm64: uaccess: move uao_* alternatives to asm-uaccess.h (Mark Rutland)
  - arm64: uaccess: refactor __{get,put}_user (Mark Rutland)
  - arm64: uaccess: simplify __copy_user_flushcache() (Mark Rutland)
  - arm64: uaccess: rename privileged uaccess routines (Mark Rutland)
  - arm64: sdei: explicitly simulate PAN/UAO entry (Mark Rutland)
  - arm64: sdei: move uaccess logic to arch/arm64/ (Mark Rutland)
  - arm64: head.S: always initialize PSTATE (Mark Rutland)
  - arm64: head.S: cleanup SCTLR_ELx initialization (Mark Rutland)
  - arm64: head.S: rename el2_setup -> init_kernel_el (Mark Rutland)
  - arm64: add C wrappers for SET_PSTATE_*() (Mark Rutland)
  - arm64: ensure ERET from kthread is illegal (Mark Rutland)
  - vfio/pci: Expose PCIe PASID capability to userspace (Liu Yi L)
  - vfio/pci: Emulate PASID/PRI capability for VFs (Liu Yi L)
  - anolis: fs/resctrl: Clear the staged configs when destroying schemata list (Shawn Wang)
  - anolis: fs/resctrl: Fix the wrong if statement in resctrl_closid_is_dirty() (Shawn Wang)
  - cachefiles: narrow the scope of flushed requests when releasing fd (Jia Zhu)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-13_rc2.an8]
changelog:
  - configs: refresh the ANCK default configs (Qiao Ma)
  - RDMA/mlx5: Set local port to one when accessing counters (Chris Mi)
  - RDMA/mlx5: Add missing check for return value in get namespace flow (Maor Gottlieb)
  - net/mlx5: DR, Fix uninitialized var warning (YueHaibing)
  - net/mlx5e: Fix use-after-free when reverting termination table (Roi Dayan)
  - net/mlx5: Fix uninitialized variable bug in outlen_write() (YueHaibing)
  - net/mlx5: Fix handling of entry refcount when command is not issued to FW (Moshe Shemesh)
  - net/mlx5: Fix FW tracer timestamp calculation (Moshe Shemesh)
  - net/mlx4: Check retval of mlx4_bitmap_init (Peter Kosyh)
  - net/mlx5e: E-Switch, Fix comparing termination table instance (Roi Dayan)
  - net/mlx5: Allow async trigger completion execution on single CPU systems (Roy Novich)
  - net/mlx5: Fix crash during sync firmware reset (Suresh Devarakonda)
  - net/mlx5: Fix possible use-after-free in async command interface (Tariq Toukan)
  - net/mlx5e: Do not increment ESN when updating IPsec ESN state (Hyong Youb Kim)
  - net/mlx5e: Properly disable vlan strip on non-UL reps (Vlad Buslov)
  - net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS (Maxim Mikityanskiy)
  - net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version (Gal Pressman)
  - anolis: configs: Make the SM3/4 arm64 optimization be modularized (Tianjia Zhang)
  - anolis: fsdax: fix wrong arg passing in dax_insert_entry (Xiaoguang Wang)
  - KVM: SEV: add cache flush to solve SEV cache incoherency issues (Bitao Hu) {CVE-2022-0171}
  - proc: avoid integer type confusion in get_proc_long (Linus Torvalds) {CVE-2022-3567}
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Linus Torvalds) {CVE-2022-4378}
  - anolis: cachefiles: add missing lock protection when polling (Jingbo Xu)
  - KVM: x86: do not report a vCPU as preempted outside instruction boundaries (Paolo Bonzini) {CVE-2022-39189}
  - tcp: Fix data races around icsk->icsk_af_ops. (Kuniyuki Iwashima) {CVE-2022-3566}
  - net: mvpp2: fix mvpp2 debugfs leak (Russell King (Oracle)) {CVE-2022-3535}
  - can: j1939: j1939_session_destroy(): fix memory leak of skbs (Fedor Pchelkin) {CVE-2022-3633}
  - ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference (David Ahern) {CVE-2022-3435}
  - anolis: x86/setup: Preserve _ENC flag when initrd is being relocated (Zelin Deng)
  - anolis: mm/early_ioremap.c: Always build early_memremap_prot() in x86 (Zelin Deng)
  - x86/mce: Remove redundant call to irq_work_queue() (Gabriele Paoloni)
  - libbpf: Fix use-after-free in btf_dump_name_dups (Xu Kuohai) {CVE-2022-3534}
  - anolis: mm: gup:remove FOLL_GET_PGSTABLE flag checking (Simon Guo)
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Zhengchao Shao) {CVE-2022-3564}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy) {CVE-2022-3564}
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima) {CVE-2022-3524}
  - ipv6: Fix data races around sk->sk_prot. (Kuniyuki Iwashima) {CVE-2022-3567}
  - sch_sfb: Don't assume the skb is still around after enqueueing to child (Toke Høiland-Jørgensen) {CVE-2022-3586}
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet) {CVE-2022-3521}
  - wifi: cfg80211: fix BSS refcounting bugs (Johannes Berg) {CVE-2022-42720}
  - wifi: cfg80211: avoid nontransmitted BSS list corruption (Johannes Berg) {CVE-2022-42721}
  - wifi: mac80211: fix crash in beacon protection for P2P-device (Johannes Berg) {CVE-2022-42722}
  - wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() (Johannes Berg) {CVE-2022-41674}
  - netfilter: nf_conntrack_irc: Fix forged IP logic (David Leadbeater) {CVE-2022-2663}
  - af_key: Do not call xfrm_probe_algs in parallel (Herbert Xu) {CVE-2022-3028}
  - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb (Pavel Skripkin) {CVE-2022-1679}
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz) {CVE-2022-42895}
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz) {CVE-2022-42896}
  - anolis: vfio:mdev:idxd: fix vdcm device migration pages memory leak (Fengqian Gao)
  - anolis: fs/resctrl: fix can not write "pseudo-locksetup" to mode file (Gou Hao)
  - anolis: psi: fix compile error when cgroup disabled (Joseph Qi)
  - anolis: io_uring: fix compile error when cgroup disabled (Joseph Qi)
  - anolis: x86/rapl: fix potentially NULL pointer access in rapl_cpu_offline. (Kun(llfl))
  - mISDN: fix use-after-free bugs in l1oip timer handlers (Duoming Zhou) {CVE-2022-3565}
  - nfp: fix use-after-free in area_cache_get() (Jialiang Wang) {CVE-2022-3545}
  - vsock: Fix memory leak in vsock_connect() (Peilin Ye) {CVE-2022-3629}
  - anolis: Fix mouse enumeration issue after wakeup from s4 (leoliu-oc)
  - anolis: arm_mpam: Fix wrong MMIO space size for msc platform device (Shawn Wang)
  - anolis: arm_mpam: Clear mpam_msc properly when driver probing failed (Shawn Wang)
  - efi: capsule-loader: Fix use-after-free in efi_capsule_write (Hyunwoo Kim) {CVE-2022-40307}
  - bpf: Don't use tnum_range on array range checking for poke descriptors (Daniel Borkmann) {CVE-2022-2905}
  - anolis: XHCI:Fix some device identify fail when enable xHCI runtime suspend (leoliu-oc)
  - USB: HCD: Fix URB giveback issue in tasklet function (leoliu-oc)
  - anolis: xhci: fix issue of cross page boundary in TRB prefetch (leoliu-oc)
  - r8152: Rate limit overflow messages (Andrew Gaul) {CVE-2022-3594}
  - video: fbdev: i740fb: Error out if 'pixclock' equals zero (Zheyu Ma) {CVE-2022-3061}
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song) {CVE-2022-3628}
  - atm: idt77252: fix use-after-free bugs caused by tst_timer (Duoming Zhou) {CVE-2022-3635}
  - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write (Hyunwoo Kim) {CVE-2022-39842}
  - nvme: restrict management ioctls to admin (Keith Busch) {CVE-2022-3169}
  - nvme: ensure subsystem reset is single threaded (Keith Busch) {CVE-2022-3169}
  - mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page (Baolin Wang)
  - scsi: stex: Properly zero out the passthrough command structure (Linus Torvalds) {CVE-2022-40768}
  - anolis: iommu: SMMU will be passthrough on PHYTIUM FT2000 & FT2500 Socs due to hardware limitation (Gu Mi)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-13.an8]
changelog:
  - anolis: cachefiles: fix potential NULL in error path (Jingbo Xu)
  - fsdax,xfs: set the shared flag when file extent is shared (Shiyang Ruan)
  - fsdax: zero the edges if source is HOLE or UNWRITTEN (Shiyang Ruan)
  - fsdax: invalidate pages when CoW (Shiyang Ruan)
  - fsdax: introduce page->share for fsdax in reflink mode (Shiyang Ruan)
  - anolis: net/smc: Extended supports up to 128K RC links (Wen Gu)
  - parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled (Helge Deller)
  - pci_iounmap'2: Electric Boogaloo: try to make sense of it all (Linus Torvalds)
  - wifi: mac80211: fix MBSSID parsing use-after-free (Johannes Berg) {CVE-2022-42719}
  - netfilter: nf_tables: disallow binding to already bound chain (Pablo Neira Ayuso) {CVE-2022-39190}
  - anolis: net/smc: Update 5-tuple used for eRDMA iWARP link when modify QP (Wen Gu)
  - anolis: net/smc: Reserve ports for eRDMA iWARP link (Wen Gu)
  - anolis: net/smc: Introduce a new mode for eRDMA iWARP (Wen Gu)
  - anolis: RDMA/erdma: Support oob connection attr modification (Kai)
  - anolis: net/smc: Fix hung caused by non-zero lnk_cnt in smc_smcr_terminate_all (Wen Gu)
  - anolis: crypto: arm64/sm4 - Fix possible crash in GCM cryption (Tianjia Zhang)


author: Colin Walters <walters@verbum.org> - 0.1.7-1
changelog:
  - New upstream version;
    https://github.com/projectatomic/bubblewrap/releases/tag/v0.1.7
  - Resolves: #1411814


author: Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-6
changelog:
  - Resolves: rhbz#1989425 - CVE-2021-3672 c-ares: missing input validation of host names may lead to Domain Hijacking [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-7
changelog:
  - Resolves: rhbz#2170867 - c-ares: buffer overflow in config_sortlist() due to missing string length check [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-9
changelog:
  - Resolves: rhbz#2238293 - CVE-2020-22217 c-ares: read-heap-buffer-overflow in ares_parse_soa_reply [rhel-8] [rhel-8.9.0.z]


author: Bob Relyea <rrelyea@redhat.com> - 2020.2.41-81
changelog:
  - Update to CKBI 2.41 from NSS 3.53.0
  -    Removing:
  -     # Certificate "AddTrust Low-Value Services Root"
  -     # Certificate "AddTrust External Root"
  -     # Certificate "UTN USERFirst Email Root CA"
  -     # Certificate "Certplus Class 2 Primary CA"
  -     # Certificate "Deutsche Telekom Root CA 2"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "Certinomis - Root CA"
  -    Adding:
  -     # Certificate "Entrust Root Certification Authority - G4"


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-81
changelog:
  - Update to CKBI 2.48 from NSS 3.64
  -    Removing:
  -     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "Taiwan GRCA"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
  -     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
  -    Adding:
  -     # Certificate "Microsoft ECC Root Certificate Authority 2017"
  -     # Certificate "Microsoft RSA Root Certificate Authority 2017"
  -     # Certificate "e-Szigno Root CA 2017"
  -     # Certificate "certSIGN Root CA G2"
  -     # Certificate "Trustwave Global Certification Authority"
  -     # Certificate "Trustwave Global ECC P256 Certification Authority"
  -     # Certificate "Trustwave Global ECC P384 Certification Authority"
  -     # Certificate "NAVER Global Root Certification Authority"
  -     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
  -     # Certificate "GlobalSign Secure Mail Root R45"
  -     # Certificate "GlobalSign Secure Mail Root E45"
  -     # Certificate "GlobalSign Root R46"
  -     # Certificate "GlobalSign Root E46"


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-82
changelog:
  - Update to CKBI 2.48 from NSS 3.66
  -    Removing:
  -     # Certificate "QuoVadis Root CA"
  -     # Certificate "Sonera Class 2 Root CA"
  -     # Certificate "Trustis FPS Root CA"
  -    Adding:
  -     # Certificate "GLOBALTRUST 2020"
  -     # Certificate "ANF Secure Server Root CA"
  -     # Certificate "Certum EC-384 CA"
  -     # Certificate "Certum Trusted Root CA"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-81
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "GlobalSign Root CA - R2"
  -     # Certificate "DST Root CA X3"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2"
  -    Adding:
  -     # Certificate "TunTrust Root CA"
  -     # Certificate "HARICA TLS RSA Root CA 2021"
  -     # Certificate "HARICA TLS ECC Root CA 2021"
  -     # Certificate "HARICA Client RSA Root CA 2021"
  -     # Certificate "HARICA Client ECC Root CA 2021"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "vTrus ECC Root CA"
  -     # Certificate "vTrus Root CA"
  -     # Certificate "ISRG Root X2"
  -     # Certificate "HiPKI Root CA - G1"
  -     # Certificate "Telia Root CA v2"
  -     # Certificate "D-TRUST BR Root CA 1 2020"
  -     # Certificate "D-TRUST EV Root CA 1 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-80.0
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Adding:
  -     # Certificate "CAEDICOM Root"
  -     # Certificate "I.CA Root CA/RSA"
  -     # Certificate "MULTICERT Root Certification Authority 01"
  -     # Certificate "Certification Authority of WoSign G2"
  -     # Certificate "CA WoSign ECC Root"
  -     # Certificate "CCA India 2015 SPL"
  -     # Certificate "Swedish Government Root Authority v3"
  -     # Certificate "Swedish Government Root Authority v2"
  -     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "OpenTrust Root CA G2"
  -     # Certificate "OpenTrust Root CA G3"
  -     # Certificate "Certplus Root CA G1"
  -     # Certificate "Certplus Root CA G2"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Thailand National Root Certification Authority - G1"
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Certification Authority of WoSign"
  -     # Certificate "CA 沃通根证书"
  -     # Certificate "SSC GDL CA Root B"
  -     # Certificate "SAPO Class 2 Root CA"
  -     # Certificate "SAPO Class 3 Root CA"
  -     # Certificate "SAPO Class 4 Root CA"
  -     # Certificate "CA Disig Root R1"
  -     # Certificate "Autoridad Certificadora Raíz Nacional de Uruguay"
  -     # Certificate "ApplicationCA2 Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Halcom Root CA"
  -     # Certificate "Swisscom Root EV CA 2"
  -     # Certificate "CFCA GT CA"
  -     # Certificate "Digidentity L3 Root CA - G2"
  -     # Certificate "SITHS Root CA v1"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "IGC/A AC racine Etat francais"
  -     # Certificate "PersonalID Trustworthy RootCA 2011"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "Swiss Government Root CA II"
  -     # Certificate "Swiss Government Root CA I"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "LuxTrust Global Root"
  -     # Certificate "AC1 RAIZ MTIN"
  -     # Certificate "Microsoft Root Certificate Authority 2011"
  -     # Certificate "CCA India 2011"
  -     # Certificate "ANCERT Certificados Notariales V2"
  -     # Certificate "ANCERT Certificados CGN V2"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "China Internet Network Information Center EV Certificates Root"
  -     # Certificate "Verizon Global Root CA"
  -     # Certificate "SwissSign Silver Root CA - G3"
  -     # Certificate "SwissSign Platinum Root CA - G3"
  -     # Certificate "SwissSign Gold Root CA - G3"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "SITHS CA v3"
  -     # Certificate "Certinomis - Autorité Racine"
  -     # Certificate "ANF Server CA"
  -     # Certificate "Thawte Premium Server CA"
  -     # Certificate "Thawte Server CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "KEYNECTIS ROOT CA"
  -     # Certificate "I.CA - Standard Certification Authority, 09/2009"
  -     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
  -     # Certificate "VI Registru Centras RCSC (RootCA)"
  -     # Certificate "CCA India 2007"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Actalis Authentication CA G1"
  -     # Certificate "A-Trust-Qual-03"
  -     # Certificate "AddTrust External CA Root"
  -     # Certificate "ECRaizEstado"
  -     # Certificate "Configuration"
  -     # Certificate "FNMT-RCM"
  -     # Certificate "StartCom Certification Authority"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "E-ME SSI (RCA)"
  -     # Certificate "ACEDICOM Root"
  -     # Certificate "Autoridad Certificadora Raiz de la Secretaria de Economia"
  -     # Certificate "Correo Uruguayo - Root CA"
  -     # Certificate "CNNIC ROOT"
  -     # Certificate "Common Policy"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "Cisco Root CA 2048"
  -     # Certificate "CA Disig"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "UCA Global Root"
  -     # Certificate "UCA Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Starfield Services Root Certificate Authority"
  -     # Certificate "I.CA - Qualified root certificate"
  -     # Certificate "I.CA - Standard root certificate"
  -     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
  -     # Certificate "Japanese Government"
  -     # Certificate "AdminCA-CD-T01"
  -     # Certificate "Admin-Root-CA"
  -     # Certificate "Izenpe.com"
  -     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
  -     # Certificate "Halcom CA FO"
  -     # Certificate "Halcom CA PO 2"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "ACNLB"
  -     # Certificate "state-institutions"
  -     # Certificate "state-institutions"
  -     # Certificate "SECOM Trust Systems CO.,LTD."
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "D-TRUST Root Class 2 CA 2007"
  -     # Certificate "D-TRUST Root Class 3 CA 2007"
  -     # Certificate "SSC Root CA A"
  -     # Certificate "SSC Root CA B"
  -     # Certificate "SSC Root CA C"
  -     # Certificate "Autoridad de Certificacion de la Abogacia"
  -     # Certificate "Root CA Generalitat Valenciana"
  -     # Certificate "VAS Latvijas Pasts SSI(RCA)"
  -     # Certificate "ANCERT Certificados CGN"
  -     # Certificate "ANCERT Certificados Notariales"
  -     # Certificate "ANCERT Corporaciones de Derecho Publico"
  -     # Certificate "GLOBALTRUST"
  -     # Certificate "Certipost E-Trust TOP Root CA"
  -     # Certificate "Certipost E-Trust Primary Qualified CA"
  -     # Certificate "Certipost E-Trust Primary Normalised CA"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "IGC/A"
  -     # Certificate "S-TRUST Authentication and Encryption Root CA 2005:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "Swisscom Root CA 1"
  -     # Certificate "Microsec e-Szigno Root CA"
  -     # Certificate "LGPKI"
  -     # Certificate "AC RAIZ DNIE"
  -     # Certificate "Common Policy"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 1"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Staat der Nederlanden Root CA"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Global CA 2"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root Certification Authority"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Microsoft Root Authority"
  -     # Certificate "Microsoft Root Certificate Authority"
  -     # Certificate "Microsoft Root Certificate Authority 2010"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "UTN-USERFirst-Object"
  -     # Certificate "BYTE Root Certification Authority 001"
  -     # Certificate "CISRCA1"
  -     # Certificate "ePKI Root Certification Authority - G2"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "SSL.com EV Root Certification Authority RSA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "ACA ROOT"
  -     # Certificate "Security Communication ECC RootCA1"
  -     # Certificate "Security Communication RootCA3"
  -     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
  -     # Certificate "Network Solutions RSA Certificate Authority"
  -     # Certificate "Network Solutions ECC Certificate Authority"
  -     # Certificate "Australian Defence Public Root CA"
  -     # Certificate "SI-TRUST Root"
  -     # Certificate "Halcom Root Certificate Authority"
  -     # Certificate "Application CA G3 Root"
  -     # Certificate "GLOBALTRUST 2015"
  -     # Certificate "Microsoft ECC Product Root Certificate Authority 2018"
  -     # Certificate "emSign Root CA - G2"
  -     # Certificate "emSign Root CA - C2"
  -     # Certificate "Microsoft ECC TS Root Certificate Authority 2018"
  -     # Certificate "DigiCert CS ECC P384 Root G5"
  -     # Certificate "DigiCert CS RSA4096 Root G5"
  -     # Certificate "DigiCert RSA4096 Root G5"
  -     # Certificate "DigiCert ECC P384 Root G5"
  -     # Certificate "HARICA Code Signing RSA Root CA 2021"
  -     # Certificate "HARICA Code Signing ECC Root CA 2021"
  -     # Certificate "Microsoft Identity Verification Root Certificate Authority 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-80.2
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "Izenpe.com"
  -     # Certificate "state-institutions"
  -     # Certificate "GlobalSign"
  -     # Certificate "Common Policy"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "AC Raíz Certicámara S.A."


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-80.0
changelog:
  - Update to CKBI 2.60_v7.0.306 from NSS 3.91
  -    Removing:
  -     # Certificate "Camerfirma Global Chambersign Root"
  -     # Certificate "Staat der Nederlanden EV Root CA"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "CCA India 2007"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -    Adding:
  -     # Certificate "DigiCert TLS ECC P384 Root G5"
  -     # Certificate "DigiCert TLS RSA4096 Root G5"
  -     # Certificate "DigiCert SMIME ECC P384 Root G5"
  -     # Certificate "DigiCert SMIME RSA4096 Root G5"
  -     # Certificate "Certainly Root R1"
  -     # Certificate "Certainly Root E1"
  -     # Certificate "E-Tugra Global Root CA RSA v3"
  -     # Certificate "E-Tugra Global Root CA ECC v3"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
  -     # Certificate "BJCA Global Root CA1"
  -     # Certificate "BJCA Global Root CA2"
  -     # Certificate "Symantec Enterprise Mobile Root for Microsoft"
  -     # Certificate "A-Trust-Root-05"
  -     # Certificate "ADOCA02"
  -     # Certificate "StartCom Certification Authority G2"
  -     # Certificate "ATHEX Root CA"
  -     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "America Online Root Certification Authority 1"
  -     # Certificate "Juur-SK"
  -     # Certificate "ComSign CA"
  -     # Certificate "ComSign Secured CA"
  -     # Certificate "ComSign Advanced Security CA"
  -     # Certificate "Global Chambersign Root"
  -     # Certificate "Sonera Class2 CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "VeriSign, Inc."
  -     # Certificate "GTE CyberTrust Global Root"
  -     # Certificate "Equifax Secure Global eBusiness CA-1"
  -     # Certificate "Equifax"
  -     # Certificate "Class 1 Primary CA"
  -     # Certificate "Swiss Government Root CA III"
  -     # Certificate "Application CA G4 Root"
  -     # Certificate "SSC GDL CA Root A"
  -     # Certificate "GlobalSign Code Signing Root E45"
  -     # Certificate "GlobalSign Code Signing Root R45"
  -     # Certificate "Entrust Code Signing Root Certification Authority - CSBR1"


author: David Howells <dhowells@redhat.com> 0.10.6-1
changelog:
  - Note the correct licence.
  - Handle malformed kernel status correctly.
  - Permit culling to be disabled on the command line with the -N flag.
  - Suspend culling when cache space is short and cache objects are pinned.


author: David Howells <dhowells@redhat.com> 0.10.8-1
changelog:
  - Use systemd interaction macros in specfile installation sections [RH BZ 850053].
  - Fix the service file to use /usr/sbin/ rather than /sbin/.
  - Turn on RELRO and PIE build hardening in RPM builds.


author: Jan Macku <jamacku@redhat.com> - 1.15-1
changelog:
  - spec: sync specfile with Fedora
  - makefile: Use rpmdev-bumpspec's legacy date option
  - Add feature to generate specfile entry, commit and archive


author: Jan Macku <jamacku@redhat.com> - 1.16-1
changelog:
  - alternatives: add --keep-foreign (#57)
  - Translations update from Weblate
  - ci: Onboard chkconfig to Packit
  - zanata: remove zanata related stuff
  - Use make macros
  - alternatives: use one function for path cleaning
  - CI: specify more closely when to run CI
  - Add basic CI and README
  - spec: sync specfile with Fedora


author: Miroslav Lichvar <mlichvar@redhat.com> 3.3-2
changelog:
  - move pidfile to /var/run/chrony to allow chronyd to remove it on exit
    (#1584585)
  - avoid blocking in getrandom system call (#1592425)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.3-3
changelog:
  - fix PIDFile in local chronyd.service on upgrades from chrony < 3.3-2
    (#1614800)
  - add workaround for late reload of unit file (#1614751)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.5-1
changelog:
  - update to 3.5 (#1685469 #1677218)
  - fix shellcheck warnings in helper scripts (#1711948)
  - update ntp2chrony script


author: Miroslav Lichvar <mlichvar@redhat.com> 4.1-1
changelog:
  - update to 4.1 (#1895003 #1847853 #1929157)
  - add NetworkManager dispatcher script to add servers from DHCP even without
    dhclient (#1933139)
  - restrict permissions of /var/lib/chrony and /var/log/chrony (#1939295)
  - reset chrony-helper state after stopping chronyd (#1971697)
  - add gcc-c++ and make to build requirements
  - move default paths in /var/run to /run


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2-1
changelog:
  - update to 4.2 (#2062356)
  - fix chrony-helper to delete sources by their original name (#2061660)
  - update ntp2chrony script (#2018045 #2063766)


author: David King <amigadave@amigadave.com> - 0.16-1
changelog:
  - Update to 0.16 (#1144863)
  - Remove clean section and BuildRoot tag
  - Update URL and Sourc0
  - Use license macro for COPYING
  - Use parallel make flags
  - Preserve timestamps during install


author: Jeff Layton <jlayton@redhat.com> - 6.7-5
changelog:
  - more updates, switch to rst for manpages
  - update mount.cifs manpage to describe defaults better (BZ#1474539)


author: Sachin Prabhu <sprabhu@redhat.com> - 6.8-3
changelog:
  - Add manual gating tests
  - docs: cleanup rst formating
  - mount.cifs.rst: document new (no)handlecache mount option
  - manpage: update mount.cifs manpage with info about rdma option
  - checkopts: add python script to cross check mount options
  - mount.cifs.rst: document missing options, correct wrong ones
  - checkopts: report duplicated options in man page
  - mount.cifs.rst: more cleanups
  - mount.cifs.rst: document vers=3 mount option
  - mount.cifs.rst: document vers=3.02 mount option
  - cifs: Allow DNS resolver key to expire
  - mount.cifs: be more verbose and helpful regarding mount errors
  - Update mount.cifs with vers=default mount option and SMBv3.0.2
  - mount.cifs.rst: update vers=3.1.1 option description
  - getcifsacl: Do not go to parse_sec_desc if getxattr fails.
  - getcifsacl: Improve help usage and add -h option.
  - setcifsacl: fix adding ACE when owner sid in unexpected location
  - cifs.upcall: fix a compiler warning
  - mount.cifs Add various missing parms from the help text
  - mount.cifs: add more options to help message
  - mount.cifs: detect GMT format of snapshot version
  - Update man page for mount.cifs to add new options
  - mount.cifs.rst: mention kernel version for snapshots
  - Fix authors and maintainers


author: Packit <hello@packit.dev> - 297-1
changelog:
  - users: allow administrators to change the user shell
  - Enable Python bridge on Fedora 38 and CentOS/RHEL 9


author: Packit <hello@packit.dev> - 299-1
changelog:
  - Kdump: Show location of kdump to verify the successful configuration test
  - Storage: Support for no-overprovisioning with Stratis
  - Storage: Cockpit can now add caches to encrypted Stratis pools


author: Packit <hello@packit.dev> - 300-1
changelog:
  - Celebrating the Nürnberg life release!
  - Storage: Support for growing block devices of a Stratis pool


author: Kamil Dudka <kdudka@redhat.com> - 8.30-8
changelog:
  - df --local: recognize afs, auristorfs, and smb3 as remote fs (#1798030)
  - fix formatting of sha512sum(1) man page (#1688744)


author: Kamil Dudka <kdudka@redhat.com> - 8.30-9
changelog:
  - split: fix --number=K/N to output correct part of file (#1921246)
  - rm: do not skip files upon failure to remove an empty dir (#1905481)
  - use statx instead of stat when available (#1760300)


author: Kamil Dudka <kdudka@redhat.com> - 8.30-13
changelog:
  - ls, stat: avoid triggering automounts (#2044981)
  - make `df --direct` work again (#2058686)
  - doc: improve description of the --kibibytes option of ls (#1527391)


author: Stanislaw Gruszka <sgruszka@redhat.com> - 3.18_2018.05.31-2
changelog:
  - Update wireless-regdb to 2018.05.31
  - Remove python2 dependency
  - Use sforshee signed reulatory.bin (required by modern kernels)


author: Ondřej Pohořelský <opohorel@redhat.com> - 1.11-17.20190603git
changelog:
  - update to the latest release
  - add sed require
  - remove %clean section
  - remove obsolete Group tag
  - fix upstream URL
  - Resolves: rhbz#1696449, rhbz#1703982


author: Tomáš Mráz <tmraz@redhat.com> - 20200527-2.git63fc906
changelog:
  - explicitly enable DHE-DSS in gnutls config if enabled in policy
  - use grubby with --update-kernel=ALL to avoid breaking kernelopts
  - OSPP subpolicy: Allow GCM for SSH protocol
  - openssh: Support newly standardized ECDHE-GSS and DHE-GSS key exchanges
  - if the policy in FIPS mode is not a FIPS policy print a message
  - openssl: Add SignatureAlgorithms support
  - custom crypto policies: enable completely overriding contents of the list
    value
  - added ECDHE-ONLY.pmod policy module example
  - openssh: make LEGACY policy to prefer strong public key algorithms
  - various python code cleanups
  - update-crypto-policies: dump the current policy to
    /etc/crypto-policies/state/CURRENT.pol
  - split scripts into their own subpackage


author: Tomáš Mráz <tmraz@redhat.com> - 20200610-1.git0ac8b1f
changelog:
  - fallback to FIPS policy instead of the default-config in FIPS mode
  - java: Document properly how to override the crypto policy
  - krb5: No support for 3des anymore
  - reorder the signature algorithms to follow the order in default openssl list


author: Alexander Sosedkin <asosedkin@redhat.com> - 20210617-1.gitc776d3e
changelog:
  - implement scoped policies, e.g., cipher@SSH = ... (#1960266)
  - implement algorithm globbing, e.g., cipher@SSH = -*-CBC
  - deprecate derived properties:
    tls_cipher, ssh_cipher, ssh_group, ike_protocol
  - deprecate sha1_in_dnssec property
  - deprecate unscoped form of protocol property
  - update documentation
  - expand upstream test coverage
  - openssl: set MinProtocol / MaxProtocol separately for TLS and DTLS (#1946522)
  - support AES-192 ciphers in custom policies for non-TLS scenarios (#1876846)
  - stop claiming Camellia is disabled (#1925104)
  - disable CBC ciphers in FUTURE for everything but Kerberos (#1933016)
  - drop SHA224 from signature algorithms in FIPS:OSPP (#1934755)
  - condition ecdh-sha2-nistp384 on SECP384R1


author: Alexander Sosedkin <asosedkin@redhat.com> - 20211116-1.gitae470d6
changelog:
  - OSPP: relax -ECDSA-SHA2-512, -FFDHE-*
  - fips-mode-setup, fips-finish-install: call zipl more often (s390x-specific)
  - libssh: enable diffie-hellman-group14-sha256 support
  - openssl: fix disabling ChaCha20


author: Alexander Sosedkin <asosedkin@redhat.com> - 20221215-1.gitece0092
changelog:
  - bind: expand the list of disableable algorithms
  - tests/java: fix java.security.disableSystemPropertiesFile=true
  - stop accidentally creating /etc/crypto-policies/back-ends/.config symlink


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-4
changelog:
  - patch: Fix reencryption for custom devices with data segments
    set to use cipher_null.
  - Resolves: #1927409


author: Ondrej Kozina <okozina@redhat.com> - 2.3.7-1
changelog:
  - update to cryptsetup 2.3.7
  - fixes CVE-2021-4122
  - patch: Fix suboptimal optimization in bundled argon2.
  - patch: Fix bogus memory allocation/device read with
           invalid LUKS2 headers
  - patch: Fix typo in luksRepair prompt.
  - Resolves: #2021815 #2022301 #2031859


author: Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-4
changelog:
  - patch: Remove LUKS2 encryption data size restriction.
  - patch: Abort encryption when header and data devices are same.
  - Resolves: #2150254


author: Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-6
changelog:
  - patch: Delegate FIPS mode detection to configured crypto backend
  - patch: Disallow use of internal kenrel crypto driver names in "capi"
  - patch: Also disallow active devices with internal kernel names
  - patch: Fix init_by_name to allow unknown cipher format in dm-crypt
  - patch: Fix reencryption to fail properly for unknown cipher
  - patch: Fix activation of LUKS2 with capi format cipher and kernel
  - Resolves: #2212772 #2193342


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-46
changelog:
  - 2074684 - lp to a remote server takes a long time
  - 2074736 - CUPS is too chatty about "Removing document files." in debug mode


author: Bo Liu <liub03@inspur.com> - 7.61.1-31.0.3.2
changelog:
  - url: only reuse connections with same GSS delegation (CVE-2023-27536)
  - fix host name wildcard checking (CVE-2023-28321)


author: Simo Sorce <simo@redhat.com> - 2.1.27-0.4rc7
changelog:
  - Add patch form Upstream PR559 to use RC4 implementation from OpenSSL
  - Resolves bz#1618744
  - Fix multilib issue bz#1663120


author: Jeff Moyer <jmoyer@redhat.com> - 67-1.el8
changelog:
  - Rebase to v67.  This brings in the following features:
    - support for the 'security frozen' sysfs attribute
    - support for using pmem as system ram
    - various cleanup and bug fixes
  - Fix load-keys failure in initramfs (Jeff Moyer)
  - Resolves: bz#1724531 bz#1730673 bz#1741164 bz#1741165 bz#1749888 bz#1749889


author: Jeff Moyer <jmoyer@redhat.com> - 71.1-4.el8
changelog:
  - Pull in fixes from upstream v72 and v73 (Jeff Moyer)
    - Fix enable-namespace all reporting errors incorrectly
    - Add support for inject-smart on papr scm
  - Related: bz#2090190 bz#1986185 bz#2040074


author: Ray Strode <rstrode@redhat.com> - 1:1.12.8-22
changelog:
  - Use hangup signal instead of termination signal to
    kill sesssion monitoring script to appeach tcsh.
    Related: #2089362


author: Ray Strode <rstrode@redhat.com> - 1:1.12.8-23
changelog:
  - Address race for very short running sessions in SSH
    session monitoring script.
    Related: #2089362


author: Till Maas <opensource@till.name> - 0.104-2
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Peter Jones <pjones@redhat.com> - 8-1
changelog:
  - Update to dbxtool 8
  - Make a "make coverity" rule to scan the source
    Results at: https://scan.coverity.com/projects/rhboot-dbxtool
  - Don't try to apply anything if PK and KEK aren't enrolled
  - Add --force and --quiet for the PK/KEK checker, and use them in the
    systemd service.
    Resolves: rhbz#1489942
  - Add a .syntastic_c_config for vim's Syntastic modules
  - Use tsearch()/tfind()/tdestroy() from libc instead of ccan htables
  - Don't open the dbx file with O_RDWR|O_CREAT, use O_RDONLY.
  - Lots of minor bug fixes gcc -Wextra and friends found.


author: Peter Jones <pjones@redhat.com> - 8-2
changelog:
  - Don't use -f in dbxtool.service; that'll make it do the thing we're
    trying to avoid.
    Resolves: rhbz#1489942


author: Marian Csontos <mcsontos@redhat.com> - 2.03.14-7
changelog:
  - Fix lvm crash when recreating PV with UUID of a missing PV.
  - Fix lvconvert --type vdo-pool with --test should not write signature.
  - Use correect profile in lvmdbusd preventing messages in JSON output.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.14-8
changelog:
  - Fix [vdo_]use_compression options.
  - Fix vgimportdevices operating on incomplete VGs fails when nothing to import.
  - Fix message processing on thin-pool extension leaving devices behind.


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-30
changelog:
  - Add 0111-multipathd-factor-out-the-code-to-flush-a-map-with-n.patch
  - Add 0112-libmultipath-return-success-if-we-raced-to-remove-a-.patch
  - Add 0113-multipathd-Handle-losing-all-path-in-update_map.patch
  - Resolves: bz #2110485


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-31
changelog:
  - Add 0114-multipathd-ignore-duplicated-multipathd-command-keys.patch
    * Fixes bz #2133996
  - Add 0115-multipath-tools-use-run-instead-of-dev-shm.patch
    * Fixes bz #2133990
  - Resolves: bz #2133990, #2133996


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-32
changelog:
  - Add 0116-kpartx-hold-device-open-until-partitions-have-been-c.patch
    * Fixes bz #2128885
  - Add 0117-libmultipath-cleanup-remove_feature.patch
  - Add 0118-libmultipath-cleanup-add_feature.patch
  - Add 0119-multipath-tests-tests-for-adding-and-removing-featur.patch
  - Add 0120-libmultipath-fix-queue_mode-feature-handling.patch
  - Add 0121-multipath-tests-tests-for-reconcile_features_with_qu.patch
  - Add 0122-libmultipath-prepare-proto_id-for-use-by-non-scsi-de.patch
  - Add 0123-libmultipath-get-nvme-path-transport-protocol.patch
  - Add 0124-libmultipath-enforce-queue_mode-bio-for-nmve-tcp-pat.patch
    * Fixes bz #2022359
  - Resolves: bz #2022359, #2128885


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-33
changelog:
  - Add 0125-multipath-add-historical-service-time-to-the-man-pag.patch
    * Fixes bz #2141996
  - Modify tests/multipath_conf_syntax/main.sh
    * fix unrelated test error
  - Resolves: bz #2141996


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-34
changelog:
  - Add 0126-libmultipath-copy-mpp-hwe-from-pp-hwe.patch
    * Fixes bz #2126714
  - Cleanup multiple CI tests
  - Resolves: bz #2126714


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-35
changelog:
  - Add 0127-libmultipath-don-t-leak-memory-on-invalid-strings.patch
  - Add 0128-libmutipath-validate-the-argument-count-of-config-st.patch
  - Resolves: bz #2155560


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-36
changelog:
  - Add 0129-libmultipath-select-resize-action-even-if-reload-is-.patch
  - Add 0130-libmultipath-cleanup-ACT_CREATE-code-in-select_actio.patch
  - Add 0131-libmultipath-keep-renames-from-stopping-other-multip.patch
  - Resolves: bz #2166468


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-37
changelog:
  - Fix bugzilla linked to the changes (was previously linked to
    the wrong bug, 2162537)
  - Resolves: bz #2166468


author: Marian Csontos <mcsontos@redhat.com> - 0.8.5-3
changelog:
  - Remove obsolete pool-inactive option from thin_trim man page.
  - Check input file exists eralier, and prevent writing incorrect metadata.


author: Marian Csontos <mcsontos@redhat.com> - 0.9.0-1
changelog:
  - Update to upstream version 0.9.0.
  - Fix important issues found by static analysis.
  - Update crc32c to version 0.5 supporting non x86 architectures.
  - New tools thin_metadata_pack and thin_metadata_unpack.


author: Lukas Hrazky <lhrazky@redhat.com> - 4.7.0-8
changelog:
  - Add documentation for query api flags
  - Fix processing of download errors
  - Fix history undo on a Reason Change
  - Fix remove when no repos are enabled
  - Improve "proxy" configuration option documentation


author: Richard W.M. Jones <rjones@redhat.com> - 4.7.0-10
changelog:
  - Backport fix for leaks of libsolv's page file descriptors in Base object
    resolves: rhbz#2087734
  - Include instructions for regenerating patches.


author: Lukas Hrazky <lhrazky@redhat.com> - 4.7.0-11
changelog:
  - [doc] Describe how gpg keys are stored for `repo_ggpcheck`
  - Add only relevant pkgs to upgrade transaction (RhBug:2097757)


author: Lukas Hrazky <lhrazky@redhat.com> - 4.7.0-12
changelog:
  - Allow passing plugin parameters with dashes in names (RhBug:1980712)
  - Fix upgrade from file to noarch pkg (RhBug:2006018)
  - Add support for group upgrade rollback (RhBug:2016070)
  - Expose plugin unload method to API (RhBug:2047251)
  - Add doc related to --destdir and --downloadonly options (RhBug:2100811)
  - Set default value for variable to prevent crash (RhBug:2091636)
  - Don't include resolved advisories for obsoletes with sec. filters (RhBug:2101421)


author: Nicola Sella <nsella@redhat.com> - 4.7.0-13
changelog:
  - Add support for rollback of group upgrade rollback (RhBug:2016070)
  - Move system-upgrade plugin to core (RhBug:2054235)
  - Fix plugins unit tests + unload plugins upon their deletion (RhBug:2134309)


author: Nicola Sella <nsella@redhat.com> - 4.7.0-15
changelog:
  - Ignore processing variable files with unsupported encoding (RhBug:2141215)
  - Better explain traceback of rpm.error with dnf


author: Lukas Hrazky <lhrazky@redhat.com> - 4.0.21-12
changelog:
  - [repomanage] Use modules only from repo they are handling
  - [repomanage] Add new option --oldonly
  - Skip all non rpm tsi for transaction_action plugins
  - Update translations


author: Lukas Hrazky <lhrazky@redhat.com> - 4.0.21-13
changelog:
  - [copr] Fix 'dnf copr enable' on Fedora 35
  - [copr] Disable dnf playground command
  - [copr] Fix baseurl for centos stream chroot
  - [copr] Silence a deprecation warning in plugins/copr.py
  - [copr] Shorter verification that the project exists
  - [copr] Better error message for dnf copr enable
  - [copr] allow specifying protocol as part of --hub


author: Nicola Sella <nsella@redhat.com> - 4.0.21-17
changelog:
  - offline-upgrade: add support for security filters (RhBug:1939975,2139324)
  - Move system-upgrade plugin to core (RhBug:2054235)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.0-1
changelog:
  - New version
    Resolves: rhbz#1333781
  - Switched to autotools
  - Various spec file cosmetic fixes (e.g. used optflags)


author: Pavel Valena <pvalena@redhat.com> - 049-209.git20220815
changelog:
  - fix(95iscsi): Fix network setup
  - fix(dracut-systemd): correct service dependencies
  - feat(lvm): add new module lvmthinpool-monitor
  - fix(dracut-shutdown): add cleanup handler on failure


author: Pavel Valena <pvalena@redhat.com> - 049-218.git20221019
changelog:
  - Dracut: only login to one target at a time
  - iscsi: don't continue waiting if the root device is present
  - network: stop waiting for interfaces if root device is
  - iscsiroot: parse_iscsi_root overwrites command line args
  - iscsiroot: there's never more than one target per call
  - iscsiroot: try targets only once
  - iscsiroot: remove bashisms
  - fixup "Dracut: only login to one target at a time"
  - 35network-legacy: only skip waiting for interfaces if netroot


author: Pavel Valena <pvalena@redhat.com> - 049-221.git20221214
changelog:
  - fix(80lvmthinpool-monitor): use systemsctl instead of
  - fix(squash): build ld cache for squash loader
  - fix(network-manager): write DHCP filename option to dhcpopts


author: Lukas Czerner <lczerner@redhat.com> 1.45.4-1
changelog:
  - Rebase to the release 1.45.4 (#1783777)
  - provide rhel6/7 compatible fs_type in mke2fs.conf (#1780279)
  - fix crafted ext4 partition leads to out-of-bounds write (#1768709)
  - include note about supported rhel8 features and options (#1788573)


author: Peter Jones <pjones@redhat.com> - 3-2
changelog:
  - Always provide macros for efi_arch and efi_alt_arch (and their _upper
    variants), and make efi_has_arch and efi_has_alt_arch 0 when they will be
    wrong.  This ensures everything can always expand when we're on a non-efi
    architecture.


author: Peter Jones <pjones@redhat.com> - 15-1
changelog:
  - Update to efibootmgr 15
  - Make efibootmgr use EFIDIR / efibootmgr.efidir like fwupdate does
  - make --loader default build-time configurable
  - sanitize set_mirror()/get_mirror()
  - Add support for parsing loader options as UCS2
  - GCC 7 fixes
  - Don't use -fshort-wchar since we don't run on EFI machines.
  - Also rebuild for efivar-31-1.fc26 to get symbol versioning right.
    Resolves: rhbz#1468841


author: Peter Jones <pjones@redhat.com> - 35-1
changelog:
  - Update to efivar 35
  - fixes for older compilers
  - efi_get_variable_exists()
  - Lots of stuff to make CI work.
  - use usleep() to avoid hitting the kernel rate limiter on efivarfs
  - better EFI_GUID macro
  - add efi_guid_fwupdate (0abba7dc-e516-4167-bbf5-4d9d1c739416)


author: Peter Jones <pjones@redhat.com> - 36-1
changelog:
  - Update to efivar 36 (and some change)
    Resolves: rhbz#1635019
  - Add NVDIMM support
  - Re-written linux interface parser to handle how devices are
    partitioned better, and for cleaner code, with one file per device
    type.
  - lots of verbosity updates
  - better CI
  - analysis with clang's analyzer as well as coverity
  - Better handling of immutable bits in sysfs
  - LIBEFIVAR_OPS=help
  - lots of code cleanups.
  - Add emmc device support
  - Add SAS port expander support
  - Support for ACPI root nodes that are less common
    (i.e. ACPI Generic Container and Embedded Controller PNP nodes)
  - Make abbreviated device paths if we can't parse a device's info
  - Don't require NVME to have an EUI


author: Mark Wielaard <mjw@redhat.com> - 0.182-1
changelog:
  - Upgrade to upstream 0.182
    - backends: Support for tilegx has been removed.
    - config: New /etc/profile.d files to provide default $DEBUGINFOD_URLS.
    - debuginfod: More efficient package traversal, tolerate various
      errors during scanning, grooming progress is more visible and
      interruptible, more prometheus metrics.
    - debuginfod-client: Now supports compressed (kernel) ELF images.
    - libdwfl: Add ZSTD compression support.


author: Mark Wielaard <mjw@redhat.com> - 0.186-1
changelog:
  - Upgrade to upstream 0.186
    - debuginfod-client: Default $DEBUGINFOD_URLS is computed from
      drop-in files /etc/debuginfod/*.urls rather than
      hardcoded into the /etc/profile.d/debuginfod*
      scripts.
      Add $DEBUGINFOD_MAXSIZE and $DEBUGINFOD_MAXTIME settings
      for skipping large/slow transfers.
      Add $DEBUGINFOD_RETRY for retrying aborted lookups.
    - debuginfod: Supply extra HTTP response headers, describing
      archive/file names that satisfy the requested buildid content.
      Support -d :memory: option for in-memory databases.
      Protect against loops in federated server configurations.
      Add -r option to use -I/-X regexes for grooming stale files.
      Protect against wasted CPU from duplicate concurrent requests.
      Limit the duration of groom ops roughly to rescan (-t) times.
      Add --passive mode for serving from read-only database.
      Several other performance improvements & prometheus metrics.
    - libdw: Support for the NVIDIA Cuda line map extensions.
      DW_LNE_NVIDIA_inlined_call and DW_LNE_NVIDIA_set_function_name
      are defined in dwarf.h. New functions dwarf_linecontext and
      dwarf_linefunctionname.
    - translations: Update Japanese translation.


author: Mark Wielaard <mjw@redhat.com> - 0.187-4
changelog:
  - Upgrade to elfutils 0.187
    - debuginfod: Support -C option for connection thread pooling.
    - debuginfod-client: Negative cache file are now zero sized instead
      of no-permission files.
    - addr2line: The -A, --absolute option, which shows file names
      includingthe full compilation directory is now the
      default.  To get theold behavior use the new option --relative.
    - readelf, elflint: Recognize FDO Packaging Metadata ELF notes
    - libdw, debuginfo-client: Load libcurl lazily only when files need
      to be fetched remotely. libcurl is now never loaded when
      DEBUGINFOD_URLS is unset. And whenDEBUGINFOD_URLS is set,
      libcurl is only loaded when the debuginfod_begin function is
      called.
  - Add elfutils-0.187-csh-profile.patch
  - Add elfutils-0.187-debuginfod-client-fd-leak.patch
  - Add elfutils-0.187-mhd_no_dual_stack.patch
  - Add elfutils-0.187-mhd_epoll.patch
  - Add an explicit versioned requires from elfutils-debuginfod-client
    on elfutils-libs and elfutils-libelf.
  - Remove brew testsuite workarounds


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-8.1
changelog:
  - Fix etags local command injection vulnerability (#2184369)
  - Fix htmlfontify.el command injection vulnerability (#2184368)
  - Fix ruby-mode.el local command injection vulnerability (#2184367)
  - Fix ob-latex.el command injection vulnerability (#2184377)


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-5
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-6
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-11
changelog:
  - CVE-2022-43680 expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
  - Resolves: CVE-2022-43680


author: Chris Leech <cleech@redhat.com> - 1.0.32-6
changelog:
  - remove fcoe from SUPPORTED_DRIVERS in /etc/sysconfig/fcoe
  - add qedf to SUPPORTED_DRIVERS in /etc/sysconf/fcoe
  - added upstream fix for large fcoe ctrl numbers


author: Ondrej Vasik <ovasik@redhat.com> - 3.6-1
changelog:
  - own /usr/share/bash-completion{,/completions,/helpers} (#1504616)
  - create and own /usr/lib/debug/.dwz dir to prevent
    dangling symlink (#1508610)


author: Ondrej Vasik <ovasik@redhat.com> - 3.7-1
changelog:
  - own /usr/share/locale and /usr/lib/modules
  - own /usr/lib/sysimage
  - improve filesystem content file to include symlinks and rootdir


author: Tomas Mraz <tmraz@redhat.com> - 1.2.0-1
changelog:
  - add lib subpackage to avoid multilib on the base package
  - add ability to compute hmacs on multiple files at once
  - improved debugging with FIPSCHECK_DEBUG


author: Eric Garver <egarver@redhat.com> - 0.9.3-12
changelog:
  - feat(config): add CleanupModulesOnExit configuration option
  - change default CleanupModulesOnExit=yes


author: Akira TAGOH <tagoh@redhat.com> - 2.13.0-6
changelog:
  - Add Suggests: dejavu-sans-fonts to address pulling the unpredicted
    font package as dependency. (#1321551)


author: Akira TAGOH <tagoh@redhat.com> - 2.13.1-3
changelog:
  - Stop cleaning up .uuid file even when a directory is empty.
    resolves: rhbz#1653171
  - Use Rachana instead of Meera for serif subsitution.
    resolves: rhbz#1650491


author: Marek Kasik <mkasik@redhat.com> - 2.10.4-1
changelog:
  - Update to 2.10.4
  - Test bitmap size earlier for PNGs
  - Fix memory leak in pngshim.c
  - Enable man pages for demos
  - Resolves: #1887084, #1890211


author: Akira TAGOH <tagoh@redhat.com> - 2.10.4-3
changelog:
  - Enable HarfBuzz support
  - Add bootstrap without HarfBuzz
  - Resolves: #1853937
  - Resolves: #1906714


author: Pavel Reichl <preichl@redhat.com> - 2.9.7-16
changelog:
  - Back-port max_pages support,
  - caching symlinks in kernel page cache,
  - and in-kernel readdir caching
  - Fixed rhbz#2080000


author: Richard Hughes <richard@hughsie.com> 1.5.4-1
changelog:
  - Rebase package to include support for latest OEM hardware and to
    support deploying UEFI SecureBoot dbx updates.
  - Resolves: #1870811


author: Richard Hughes <richard@hughsie.com> 1.5.5-2
changelog:
  - Do not invalidate all remote timestamps during package install to fix rpm -V.
  - Backport some important high priority fixes from upstream.
  - Resolves: #1926382


author: Richard Hughes <richard@hughsie.com> 1.5.9-3
changelog:
  - Rebase to include the SBAT metadata section to allow fixing BootHole
  - Resolves: rhbz#1933012
  - Resolves: rhbz#1932953
  - Resolves: rhbz#1932909
  - Resolves: rhbz#1932882
  - Resolves: rhbz#1932579
  - Resolves: rhbz#1932553
  - Resolves: rhbz#1932423


author: Richard Hughes <richard@hughsie.com> 1.7.1-1
changelog:
  - New upstream release
  - Backport upstream changes
  - Include support for Dell TBT4 Docking stations
  - Resolves: rhbz#1969472
  - Resolves: rhbz#1976408


author: Richard Hughes <richard@hughsie.com> 1.7.1-2
changelog:
  - Disable the Logitech bulkcontroller plugin to avoid adding a dep to protobuf-c
    which lives in AppStream, not BaseOS.
  - Resolves: rhbz#2029333


author: Richard Hughes <richard@hughsie.com> 1.7.4-1
changelog:
  - Include support for Lenovo TBT4 Docking stations
  - Do not cause systemd-modules-load failures
  - Resolves: rhbz#2038258
  - Resolves: rhbz#2037294


author: Peter Jones <pjones@redhat.com> - 10-4
changelog:
  - Roll in some bugfixes that'll be in fwupdate-11 upstream.
    This helps fix a couple of vendors machines.


author: Weitao Zhou <zhouwt@linux.alibaba.com> 11-3.0.1
changelog:
  - Disable -Wno-address-of-packed-member to fix build failed with gcc9.2
  - Support loongarch64 platform(Liwei Ge)


author: Charles R. Anderson <cra@wpi.edu> - 2008_10_13-10
changelog:
  - Patch to apply CFLAGS/LDFLAGS to final link so RPM_OPT_FLAGS are picked up (rhbz#1548426)
  - Use CC=gcc explicitly
  - Regenerate fxload-noa3load.patch


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.1.4-7
changelog:
  - Revert previous change of adding 'awk*' symlinks for info pages (bug #1486924)
  - Added patch to correctly fix the info pages issue (bug #1486924)
  - specfile content refactored for better readability
  - Package now provides its ABI version via gawk(abi)
  - Added test for usage of correct gawk(abi) into %check section


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.2.0-1
changelog:
  - Update to latest stable release from upstream [new API version - 2.0]
  - Added latest relevant patches from upstream's gawk-4.2-stable branch


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.2.0-2
changelog:
  - 'noarch' removed from *-devel subpackage
  - added arch requirement for *-devel subpackage
  - updated the build process to use %make_build macro


author: <fjanus@redhat.com> - 1.18-2
changelog:
  - Add backward compatibility patch
  - Resolves: #2097704
  - Backport from upstream commit: 00ba17479ff31c6825f0e6f28b965f11525e83f6


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 1:1.18-2.0.1
changelog:
  - remove char *parseopt_program_doc and *parseopt_program_args in parseopt.c for compatible gcc10 build


author: Tomas Popela <tpopela@redhat.com> - 2.42.6-3
changelog:
  - Backport fixes for CVE-2021-46829 and CVE-2021-44648
  - Resolves: rhbz#2115213
  - Resolves: rhbz#2044346


author: Andrew Price <anprice@redhat.com> - 3.2.0-9
changelog:
  - gfs2_jadd: Handle out-of-space issues
  - gfs2_jadd: error handling overhaul
    Resolves: rhbz#1833141
  - gfs2.5: Update some mentions of gfs2_tool
    Resolves: rhbz#1818983


author: Andrew Price <anprice@redhat.com> - 3.2.0-11
changelog:
  - gfs2_jadd: Use fallocate to preallocate journals
  - gfs2_jadd: Don't fsync after each block written
    Resolves: rhbz#1942434


author: Rongwei Wang <rongwei.wang@linux.alibaba.com> - 2.28-225.0.4.6
changelog:
  - elf: Properly align PT_LOAD segments
  - Sync loongarch64 code to lnd.35. (lixing@loongson.cn)
  - Add patch for gb18030-2022 from upstream bug#30243 (fundawang@yeah.net)


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-57
changelog:
  - fixes bugs bz#1600379 bz#1689375 bz#1782428 bz#1798897 bz#1815462 
    bz#1889966 bz#1891403 bz#1901468 bz#1903911 bz#1908635 bz#1917488 bz#1918018 
    bz#1919132 bz#1925425 bz#1927411 bz#1927640 bz#1928676 bz#1942816 bz#1943467 
    bz#1945143 bz#1946171 bz#1957191 bz#1957641


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-60
changelog:
  - fixes bugs bz#1668303 bz#1853631 bz#1901468 bz#1904137 bz#1911665 
    bz#1962972 bz#1973566 bz#1994593 bz#1995029 bz#1997447 bz#2006205


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-9
changelog:
  - Move the .hmac files to the fipscheck subfolder
  - Make symlinks from their original location (Fedora contains the .hmac files there) pointing to their new location
  Resolves: rhbz#1980758


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-13
changelog:
  - Fix: previous commit removed one function from the library and thus broke the ABI
  - function gmpn_preinv_divrem_1 should now not be removed
  Related: rhbz#2044216


author: Daiki Ueno <dueno@redhat.com> - 3.6.16-1
changelog:
  - Update to upstream 3.6.16 release (#1956783)
  - Fix potential use-after-free in key_share handling (#1927597)
  - Fix potential use-after-free in pre_shared_key handling (#1927593)
  - Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
  - Fix cert expiration issue in tests (#1908110)


author: Zoltan Fridrich <zfridric@redhat.com> - 3.6.16-6
changelog:
  - Fix x86_64 CPU feature detection when AVX is not available (#2131152)
  - Fix timing side-channel in TLS RSA key exchange (#2162598)


author: David King <amigadave@amigadave.com> - 1.68.0-6
changelog:
  - Add Requires on python-markdown for g-ir-doc-tool (#1979144)
  - Add license texts and documentation files (#1979144)


author: Robbie Harwood <rharwood@redhat.com> - 2.02-143
changelog:
  - x86-efi: Fix an incorrect array size in kernel allocation
  - Also merge with 8.7
  - Resolves: #2031288


author: Bo Ren <rb01097748@alibaba-inc.com> - 2.02-148.0.1.1
changelog:
  - Build pc-modules package on x86_64 (geliwei@openanolis.org)
  - Add loongarch64 base support (zhangwenlong@loongson.cn)(chenguoqi@loongson.cn)
  - Fix a bug in bls_make_list, blscfg. (zhonglingh@linux.alibaba.com)
  - Delete LoongArch64 support old version due to compile error(yangqiming@loongson.cn)
  - Add LoongArch64 support(yangqiming@loongson.cn)
  - LoongArch64 support fdt and phy-addr BIOS(yangqiming@loongson.cn)
  - Remove dtb dir with correct argument (Liwei Ge)


author: Tomas Popela <tpopela@redhat.com> - 40.0-6
changelog:
  - Require the Source Code Pro font instead of only recommending it to not break
    systems updated from 9.0.0.
    Resolves: rhbz#2093975


author: Jakub Martisko <jamartis@redhat.com> - 1.9-5
changelog:
  - Fix wrong skip size in gzexe
  - Add new test dealing with the ^^ (needs autoreconf)
  - Enable make check (needs less)
    Resolves: 1705413

   * Tue Aug 07 2018 Jakub Martisko <jamartis@redhat.com> - 1.9-4
   - Fix FTBFS bug (gnulib problems)
   - more details: https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
     Resolves 1611722


author: Francisco Javier Tsao Santín <tsao@gpul.org> - 1:1.3-1
changelog:
  - Patch by Todd Lewis that adds option -x to exclude files with pcre lib 
  - This patch solves RH Bugzilla ID's 955246 1322198


author: Tomasz Kłoczko <kloczek@fedoraproject.org> - 1:1.3-4
changelog:
  - remove manually added pcre2 requires (this is autogenerated)
  - removed BuildRoot, %defattr() and Group (new Fedora Packaging Guildline)
  - do not use straight gcc and add use %{__global_ldflags}
  - use %_licensedir is no longer needed
  - minor cleanups:
  -- reformat %description to 80 col
  -- added full URLs in Source fields
  -- more macros
  -- a bit simpler %prep


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-6
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
    harfbuzz: integer overflow in the component hb-ot-shape-fallback.c


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-7
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
  - Fix Covscan compiler warning for inclusion of parenthesis
  - Update tests.yaml


author: Michal Grzedzicki <mge@fb.com> - 9.54-4
changelog:
  - backport fix for --dco-identify real max sectors calculation from upstream version 9.62 (#1959918)


author: Honggang Li <honli@redhat.com> - 32.0-4
changelog:
  - Update to upstream stable release v32.1
  - Fix mlx5 pyverbs CQ test
  - Resolves: bz1915745, bz1907377


author: Honggang Li <honli@redhat.com> - 37.1-1
changelog:
  - Update to upstream v37.1 release for features and fixes
  - Resolves: bz1982200, bz1990120, bz1982131


author: Mike FABIAN <mfabian@redhat.com> - 60.2-4
changelog:
  - Add negative-daylight-savings.patch from upstream.
    (see http://bugs.icu-project.org/trac/ticket/13566 and
    http://bugs.icu-project.org/trac/changeset/40954)


author: Parag Nemade <pnemade AT redhat DOT com> - 60.2-7
changelog:
  - Resolves:rh#1602551 - Fix specfile by adding compile options
  - also add BuildRequires for gcc and gcc-c++
  - Correct the upstream URL


author: Mike FABIAN <mfabian@redhat.com> - 60.3-1
changelog:
  - Update to 60.3 maintenance release including support for new Japanese era Reiwa (令和).
  - Resolves: rhbz#1677093


author: Mike FABIAN <mfabian@redhat.com> - 60.3-2
changelog:
  - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch
  - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch
  - Resolves: rhbz#1808238


author: Jan Macku <jamacku@redhat.com> - 10.00.10-1
changelog:
  - Allow updating rfkill switch status while in readonly root mode
  - service: Prevent variables from globbing
  - Allow updating mlocate.db while in readonly root mode


author: Jan Macku <jamacku@redhat.com> - 10.00.16-1
changelog:
  - rename_device: also support dracut-style kernel cmdline configuration
  - ifup-routes: Log when using `ip $type replace`
  - ifup-routes: Use `ip route repace` to avoid race


author: Jan Macku <jamacku@redhat.com> - 10.00.17-1
changelog:
  - ifup-routes: Revert quotes
  - ifup-routes: Use `ip replace` only on type `route`
  - ci: introduce GA ci from master to rhel8-branch
  - ci: Setup packit for RHEL8 branch
  - ci: Get rid of old ci files (travis and zanata)


author: Charalampos Stratakis <cstratak@redhat.com> - 0.6-10
changelog:
  - SPEC file cleanup
  - Added licence tag
  - Removal of old and unneeded macros
  - Use of newest python macros
  - Removed Python 2 dependency
  - Added patch for Python 3 build


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-2.el8
changelog:
  - vdpa: Enable user to set mtu of the vdpa device (Andrea Claudi) [2036880]
  - vdpa: Enable user to set mac address of vdpa device (Andrea Claudi) [2036880]
  - vdpa: Enable user to query vdpa device config layout (Andrea Claudi) [2036880]
  - vdpa: align uapi headers (Andrea Claudi) [2036880]


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-3.el8
changelog:
  - tc: u32: add json support in `print_raw`, `print_ipv4`, `print_ipv6` (Andrea Claudi) [1989591]
  - tc: u32: add support for json output (Andrea Claudi) [1989591]


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-4.el8
changelog:
  - vdpa: Update man page with added support to configure max vq pair (Andrea Claudi) [2056827]
  - vdpa: Support reading device features (Andrea Claudi) [2056827]
  - vdpa: Support for configuring max VQ pairs for a device (Andrea Claudi) [2056827]
  - vdpa: Allow for printing negotiated features of a device (Andrea Claudi) [2056827]
  - vdpa: Remove unsupported command line option (Andrea Claudi) [2056827]
  - uapi: update vdpa.h (Andrea Claudi) [2056827]
  - Update kernel headers and import virtio_net (Andrea Claudi) [2056827]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-2.el8
changelog:
  - macvlan: Add bclim parameter (Andrea Claudi) [2188134]
  - Update kernel headers (Andrea Claudi) [2188134]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-4.el8
changelog:
  - ip vrf: make ipvrf_exec SELinux-aware (Andrea Claudi) [1780023]
  - lib: add SELinux include and stub functions (Andrea Claudi) [1780023]
  - ss: make SELinux stub functions conformant to API definitions (Andrea Claudi) [1780023]
  - ss: make is_selinux_enabled stub work like in SELinux (Andrea Claudi) [1780023]


author: Liwei Ge <geliwei@openanolis.org> - 6.2.0-5.0.1
changelog:
  - delete the rt_dsfield file due to three Aones (hengqi@linux.alibaba.com)
  - [kernelself-tests]net.fib_rule_tests.sh: TEST rule4 del by pref, rule6 del by pref FAIL


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-3
changelog:
  - Fix loading of sets with dependencies on other sets (RHBZ#1647096), and
    hardcode 6.38-1.el7 for ipset-service upgrade and downgrade triggers, so that
    we don't run into issues with z-stream updates


author: Stefano Brivio <sbrivio@redhat.com> - 7.1-1
changelog:
  - Rebase to 7.1 (RHBZ#1649090):
    - Add compatibility support for strscpy()
    - Correct the manpage about the sort option
    - Add missing functions to libipset.map
    - configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
    - Implement sorting for hash types in the ipset tool
    - Fix to list/save into file specified by option (reported by Isaac Good)
    - Introduction of new commands and protocol version 7, updated kernel include files
    - Add compatibility support for async in pernet_operations
    - Use more robust awk patterns to check for backward compatibility
    - Prepare the ipset tool to handle multiple protocol version
    - Fix warning message handlin
    - Correct to test null valued entry in hash:net6,port,net6 test
    - Library reworked to support embedding ipset completely
    - Add compatibility to support kvcalloc()
    - Validate string type attributes in attr2data() (Stefano Brivio)
    - manpage: Add comment about matching on destination MAC address (Stefano Brivio)
      (RHBZ#1649079)
    - Add compatibility to support is_zero_ether_addr()
    - Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649085)
    - Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649085)
    - Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649085)
    - tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio) 
  - Fixes:
    - Fix all shellcheck warnings in init script (RHBZ#1649085)
    - Make error reporting consistent, introduce different severities (RHBZ#1683711)
    - While restoring, on invalid entries, remove them and retry (RHBZ#1683713)
    - Fix covscan SC2166 warning in init script (RHBZ#1649085)


author: Phil Sutter <psutter@redhat.com> - 1.8.4-16
changelog:
  - tests/shell: Add test for bitwise avoidance fixes
  - ebtables: Optimize masked MAC address matches
  - nft: Optimize class-based IP prefix matches
  - nft: Fix for broken address mask match detection
  - nft: cache: Make nft_rebuild_cache() respect fake cache
  - tests: shell: Improve concurrent noflush restore test a bit
  - nft: Fix for concurrent noflush restore calls
  - nft: Fix error reporting for refreshed transactions
  - nft: Make batch_add_chain() return the added batch object


author: Phil Sutter <psutter@redhat.com> - 1.8.4-17
changelog:
  - extensions: dccp: Fix for DCCP type 'INVALID'
  - tests: shell: Merge and extend return codes test
  - nft: Fix command name in ip6tables error message
  - extensions: libxt_CT: add translation for NOTRACK
  - extensions: libipt_icmp: Fix translation of type 'any'
  - tests/shell: Test for fixed extension registration
  - libxtables: Register multiple extensions in ascending order
  - libxtables: Simplify pending extension registration
  - libxtables: Make sure extensions register in revision order


author: Phil Sutter <psutter@redhat.com> - 1.8.4-18
changelog:
  - xtables-translate: Fix translation of odd netmasks
  - nft: Fix bitwise expression avoidance detection
  - xtables-monitor: 'LL=0x304' is not very convenient, print LOOPBACK instead.
  - xtables-monitor: print packet first
  - xtables-monitor: fix packet family protocol
  - xtables-monitor: fix rule printing
  - xtables-monitor: Fix ip6tables rule printing


author: Phil Sutter <psutter@redhat.com> - 1.8.4-20
changelog:
  - extensions: SECMARK: Use a better context in test case
  - extensions: sctp: Translate --chunk-types option
  - extensions: sctp: Fix nftables translation
  - extensions: SECMARK: Implement revision 1
  - nft: cache: Retry if kernel returns EINTR


author: Phil Sutter <psutter@redhat.com> - 1.8.4-21
changelog:
  - extensions: hashlimit: Fix tests with HZ=100
  - ebtables: Dump atomic waste
  - doc: ebtables-nft.8: Adjust for missing atomic-options


author: Phil Sutter <psutter@redhat.com> - 1.8.4-23
changelog:
  - libxtables: Fix unsupported extension warning corner case
  - tests: shell: Check overhead in iptables-save and -restore
  - nft: Fix EPERM handling for extensions without rev 0
  - Improve error messages for unsupported extensions
  - xshared: Fix response to unprivileged users
  - libxtables: Register only the highest revision extension
  - Use proto_to_name() from xshared in more places
  - libxtables: Boost rule target checks by announcing chain names
  - libxtables: Implement notargets hash table
  - nft: Reject standard targets as chain names when restoring
  - xshared: Merge and share parse_chain()
  - xshared: Prefer xtables_chain_protos lookup over getprotoent
  - nft: Speed up immediate parsing
  - nft: Simplify immediate parsing


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-16
changelog:
  - Moved upstream from https://fedorahosted.org/iptraf-ng/ to 
    https://github.com/iptraf-ng/iptraf-ng/ with release v1.1.4
    Fixes error in patch Patch03 - this fixes 1283773


author: Thomas Woerner <twoerner@redhat.com> 2.2.6-1
changelog:
  - New upstream version 2.2.6
    - Located at github
    - Fixes (RHBZ#1294913 and RHBZ#1375395)
  - Additional upstream patch (no_debug) to drop some debugging remains
  - Additional proposed patch to fix segmentation fault with -1 -C (RHBZ#599181)


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 20180629-11.0.1
changelog:
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Fix ping: process interrupts in ping*_receive_error_msg (forrest_ly)


author: Kairui Song <kasong@redhat.com> 2:1.4.0-3
changelog:
  - Update document and remove dead options to fix manpage scan warning (bz1612706)
  - Fix gating test error (bz1680619)


author: Chris Leech - 6.2.0.878-5.gitd791ce0
changelog:
  - 1849931, 1869438 go back to MD5 CHAP only by default
    new CHAP modes can cause issue with some targets,
    so SHA1/SHA256/SHA3-256 modes must be configured to enable now


author: Chris Leech <cleech@redhat.com> - 0.94-1
changelog:
  - new upstream location, update to 0.94
  - new devel package, upstream open-iscsi is dropping it's internal copy


author: Jarod Wilson <jarod@redhat.com> - 20220713-109.gitdfa29317
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include even newer qed firmware update (rhbz 2040269)


author: Jarod Wilson <jarod@redhat.com> - 20220726-110.git150864a4
changelog:
  - Omit unused password-protected vxge firmware files from package (rhbz 2108051)
  - Pick up latest AMD GPU firmwares


author: Lucas Zampieri <lzampier@redhat.com> - 20221102-111.git8bb75626
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - amdgpu firmware update to fix certain "multiple monitor scenarios" (rhbz 2130707)


author: Lucas Zampieri <lzampier@redhat.com> - 20230111-112.gita1ad1d5b
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Navi33 dGPU firmware (rhbz 2047480)
  - Navi31 dGPU firmware (rhbz 2047483)


author: Lucas Zampieri <lzampier@redhat.com> - 20230217-113.git83f1d778
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Qualcomm Wi-Fi - Disconnecting power cable during suspend wakes up the laptop (rhbz 2169012)


author: Patrick Talbert <ptalbert@redhat.com> - 20230404-114.git2e92a49f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Intel QAT Update - firmware for QAT (rhbz 2030316)


author: Xin Long <lxin@redhat.com> - 2.11-3
changelog:
  - Deal with warnings under gcc 8
  - Call va_end after va_copy in json_vsprintf
  - Fix bogus date in jansson.spec


author: Anna Khaitovich <akhaitov@redhat.com> - 0.13.1-0.3
changelog:
  - Don't package empty /usr/share/doc/json-c
  - Resolves: rhbz#1741076
  - Do not use --enable-rdrand
  - Resolves: rhbz#1806532


author: Pingfan Liu <piliu@redhat.com> - 2.0.24-6
changelog:
  - kdump-lib: Add the CoreOS kernel dir to the boot_dirlist
  - kdump-lib: attempt to fix BOOT_IMAGE detection
  - kdump-lib: change how ostree based systems are detected
  - kdump-lib: clear up references to Atomic/CoreOS


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-2
changelog:
  - mkdumprd: Improve error messages on non-existing NFS target directories
  - fadump: avoid non-debug kernel use for fadump case


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-3
changelog:
  - kdump.conf: use a simple generator script to maintain
  - Reduce kdump memory consumption by not letting NetworkManager manage unneeded network interfaces


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-4
changelog:
  - Don't check fs modified when dump target is lvm2 thinp
  - Add dependency of dracut lvmthinpool-monitor module
  - lvm.conf should be check modified if lvm2 thinp enabled
  - Add lvm2 thin provision dump target checker
  - Fix the sync issue for dump_fs


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-5
changelog:
  dracut-module-setup: Fix invalid rd.znet command line entry
   dracut-module-setup: Fix persistent nic name on s390


author: Youling Tang <tangyouling@loongson.cn> - 2.0.25-5.0.1
changelog:
  - Add LoongArch support
  - Add doc sub package (wb-zh951434@alibaba-inc.com)
  - Fix kexec error for kexec -s (xiangzao@linux.alibaba.com)
  - Reimplement loongarch64 support


author: David Howells <dhowells@redhat.com> - 1.5.10-1
changelog:
  - Include sys/types.h in keyutils.h.
  - The dns resolver needs limits.h.
  - Overhaul of all manual pages.
  - Some manual pages moved to Linux man-pages project.
  - Add Diffie-Helman keyctl function.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-16
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1778889


author: - Andy Walsh <awalsh@redhat.com> - 6.2.7.17-86
changelog:
  - Fixed bug which could result in empty flushes being issued to the storage
    below vdo while suspended.
  - Resolves: rhbz#2013056
  - Fixed syntax mismatch which prevented lvm from being able to configure a
    512MB UDS index.
  - Resolves: rhbz#2073203
  - Fixed a race handling timeouts of dedupe index queries.
  - Resolves: rhbz#2092075


author: - Andy Walsh <awalsh@redhat.com> - 6.2.8.1-87
changelog:
  - Fixed a bug which could produce a deadlock after multiple saves and resumes
    of a vdo.
  - Resolves: rhbz#2109047


author: - Susan LeGendre-McGhee <slegendr@redhat.com> - 6.2.8.7-88
changelog:
  - Fixed bug in read-only rebuild when the logical size of the volume is an
    exact multiple of 821 4K blocks.
  - Resolves: rhbz#2166131


author: Julien Thierry <jthierry@redhat.com> 0.9.2-2
changelog:
  - Fix unload issue under stress (rhbz#1883238)
  - Fix dnf-kpatch man file permissions (rhbz#1899341)
  - Do not replace dnf kpatch configuration file when reinstalling (rhbz#1898191)


author: Julien Rische <jrische@redhat.com> - 1.18.2-21
changelog:
  - Backport fix of memory use after free during libkrad cleanup
  - Backport support for larger RADIUS attributes in libkrad
  - Resolves: rhbz#2103125


author: Cestmir Kalina <ckalina@redhat.com> - 1.3-1
changelog:
  - Resolves: #1642134 Error restrict bugs to groups without permission while
    trying to submit RHEL8 symbols
  - New ksc reports will no longer be submitted under redhat bugzilla group.
  - At least one bugzilla group must be specified by a ksc user, otherwise ksc
    will terminate with an error.
  - Version bump to 1.3


author: Cestmir Kalina <ckalina@redhat.com> - 1.4-1
changelog:
  - Resolves: #1643187 ksc manpage lies -k can only be specified once
  - Resolves: #1645335 FILE is shown in ksc man page but no explain or effect
  - Support for multiple -k arguments added
  - Man page reworded to match ksc behaviour


author: Čestmír Kalina <ckalina@redhat.com> - 1.5-1
changelog:
  - Resolves: #1647528 ksc add feature to copy justifications between ksc...
  - Resolves: #1648026 ksc add a non-processed .ko file
  - Resolves: #1647974 piped input causes ksc to fail when asking for user input
  - Add support for justification carry over.
  - Add support for symbol filtering using -K.
  - Fix input problems when piping through to ksc.
  - Extend manpage with EXAMPLES section.
  - Version bump fo 1.5.


author: Čestmír Kalina <ckalina@redhat.com> - 1.6-1
changelog:
  - Resolves: #1729039 Extend ksc output to include environment metadata
  - Add modinfo vermagic field to the output.
  - Add kmod (provides modinfo) to requires.


author: Čestmír Kalina <ckalina@redhat.com> - 1.6-2
changelog:
  - Resolves: #1729039 Extend ksc output to include environment metadata
  - (OSCI) Add kmod to Makefile-generated Requires


author: Čestmír Kalina <ckalina@redhat.com> - 1.7-1
changelog:
  - Resolves: #1886901 Avoid divisive language
  - Resolves: #1912506 File bugs with Tracking keyword by default


author: Čestmír Kalina <ckalina@redhat.com> - 1.9-1
changelog:
  - Resolves: #2043450 ksc: Support Authorization header in bugzilla API
  - Rebase to latest ksc release


author: Čestmír Kalina <ckalina@redhat.com> - 1.9-2
changelog:
  - Resolves: #2043450 ksc: Support Authorization header in bugzilla API
  - Use platform-python in place of python3


author: Andreas Schneider <asn@redhat.com> - 2.3.0-1
changelog:
  - resolves: rhbz#1945021 - Update to version 2.3.0
  - resolves: rhbz#1897082 - Fix libldb tests on aarch64


author: Jan Macku <jamacku@redhat.com> - 0.97-1
changelog:
  - update to 0.97 (#2159588)
  - drop downstream patch - ipmi: avoid error messages on non-dell platforms


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.110-12.el8
changelog:
  - Pass in the distro-provided CFLAGS and LFLAGS. (Jeff Moyer)
  - Get rid of -nostartfiles -nostdlib (Jeff Moyer)
  - Resolves: rhbz#1630578


author: Richard Hughes <richard@hughsie.com> 0.7.16-1
changelog:
  - Update to 0.7.15
  - Add UPL short name to SPDX conversion
  - Allow parsing desktop files using as_app_parse_data()
  - Do not preserve restrictive permissions when installing AppStream files
  - Modernize the validation requirements
  - Remove relative path from icon names
  - Support loading YAML from as_store_from_bytes()
  - Update list of allowed metadata licences
  - Update the SPDX license list to v3.5


author: Richard Hughes <richard@hughsie.com> 0.7.17-1
changelog:
  - New upstream release
  - Add "icon-theme" as recognised component type
  - Fix CI by moving 'future' back a bit
  - Make default content rating values match OARS semantics
  - Properly initialize unique_id_mutex


author: Richard Hughes <richard@hughsie.com> 0.7.18-1
changelog:
  - New upstream release
  - Add content rating system APIs from gnome-software
  - Add "validate-version" command
  - Allow timestamp in the future in validate-relax
  - Don't ignore localized strings that are the same as original
  - Fix crash with invalid children of <ul/>
  - Properly initialize mutexes
  - Test launchable tags in validation


author: Marek Polacek <polacek@redhat.com> 8.5.0-13
changelog:
  - require docbook-style-xsl instead of docbook5-style-xsl (#2073888)
  - backport Default widths with -fdec-format-defaults patch (#2074614)


author: Marek Polacek <polacek@redhat.com> 8.5.0-17
changelog:
  - fix deserialization for std::normal_distribution (#2130392,
    PR libstdc++/105502)
  - initialize std::normal_distribution::_M_saved (PR libstdc++/99536)
  - reject std::make_shared<T[]> (PR libstdc++/99006)


author: Xue haolin <xuehaolin@openanolis.org> 8.5.0-18.0.1
changelog:
  - Rebrand for Anolis OS. (xuehaolin@openanolis.org)
  - Add loongarch support. (lixing@loongson.cn)
  - Fixup LoongArch configure file error. (lixing@loongson.cn)
  - rename mt file for LoongArch. (lixing@loongson.cn)
  - Fixup LoongArch atomic_exchange error. (lixing@loongson.cn)
  - Remove loongarch64 arch (wb-zh951434@alibaba-inc.com)


author: Karel Zak <kzak@redhat.com> 2.32.1-36
changelog:
  - fix #2060030 - Please backport patches for atari partition detection to RHEL 8
  - fix #2069187 - Internal testsuite for lscpu failed on aarch64
  - fix #2093166 - lslogins reports incorrect "Password is locked" status
  - fix #2059241 - rpm -V / --verify reports bad user/group/mtime for /run/uuidd
  - fix #2044592 - Move /var/log/lastlog ownership to systemd


author: Karel Zak <kzak@redhat.com> 2.32.1-40
changelog:
  - fix #2121699 - fstrim -av fails to trim root filesystem on Red Hat Coreos 
  - fix #2142496 - update upstream tests
  - fix #2149394 - umount outputs inaccurate error message when umount() fails with EACCES
  - fix #2159544 - lslogins "Password is locked" status changed in util-linux-2.32.1-38
  - fix #2160321 - [last] ut->ut_user is not null terminated


author: Weitao Zhou <zhouwt@linux.alibaba.com> 2.32.1-42.0.1
changelog:
  - [Patch] hwclock: better compatibility for both glibc2.28 and glibc2.31
  - [Patch] lscpu: add Neoverse-N2 to ARM identifiers tables (flin@linux.alibaba.com)
  - [Patch] lscpu: fix lscpu to get cpu frequency from cpuinfo on arm64 (flin@linux.alibaba.com)


author: Zoltan Fridrich <zfridric@redhat.com> - 2.26-5
changelog:
  - added CAP_PERFMON, CAP_BPF and CAP_CHECKPOINT_RESTORE capabilities
    resolves: rhbz#1946982 rhbz#1921576


author: Zoltan Fridrich <zfridric@redhat.com> - 2.48-2
changelog:
  - rebase to 2.48
    resolves: rhbz#2032813
  - fix ambient capabilities for non-root users
    resolves: rhbz#1950187


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.7.8-6
changelog:
  - Python 2 binary package renamed to python2-libcap-ng
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Nikola Forró <nforro@redhat.com> - 0.41-17
changelog:
  - backport several upstream fixes
  - set Delegate property for cgconfig service to make sure complete
    cgroup hierarchy is always created by systemd


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Make inline function __comps_objmrtree_all also static (RhBug:1793424)
  - Fix memory leaks and resource leaks
  - Fix: Check result "comps_parse_parsed_init()"


author: Filip Januš <fjanus@redhat.com> 5.3.28-42
changelog:
  - Apply the previous change only on aarch64 to limit the risk of unwanted impact
  - Resolves: #1992402


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-8
changelog:
  - Substitute all repository config options (fixes substitution of baseurl)
  - Use solvfile userdata to store and check checksums and solv versions
  - Fix handling transaction id in resolveTransactionItemReason
  - Set short action for Reason Change


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-10
changelog:
  - Do not print errors on failovermethod repo option
  - the dnf_context_remove() function accepts `<package-spec>`, doc updates
  - advisory upgrade: filter out advPkgs with different arch


author: Liu Xiaoping <lxp01404969@alibaba-inc.com> - 0.63.0-17.0.1
changelog:
  - Disable rhsm support in Anolis (geliwei@openanolis.org)
  - rebrand: fix platform compatibility (geliwei@openanolis.org)
  - Add loongarch64 to arch_map (liwei.glw@alibaba-inc.com)


author: Jerry James <loganjerry@gmail.com> - 3.1-23.20170329cvs
changelog:
  - Add gcc BR
  - Build verbosely
  - Drop obsolete --enable-widec configure option
  - Fix "unused direct shared library dependency" warning from rpmlint again
  - Fix man page error due to BSD nroff macro that is not available on Linux
  - Drop explicit R on pkgconfig from the -devel package, autogenerated


author: Vishal Vijayraghavan <vvijayra AT redhat DOT com> - 1:2.1.3-1
changelog:
  - New release of liberation-fonts 2.1.3
  - Resolves:rh#1464310 : Tilded G not works with Liberation Sans and Serif


author: Honggang Li <honli@redhat.com> - 1.11.1-1
changelog:
  - Rebase to upstream release v1.11.1
  - EFA Support requires libfabric
  - Resolves: bz1831145, bz1852636


author: Michal Schmidt <mschmidt@redhat.com> - 1.15.1-1
changelog:
  - Update to upstream release 1.15.1
  - Disable LTO on x86_64 due to memory issues (copied from Fedora)
  - Resolves: rhbz#2040450


author: DJ Delorie <dj@redhat.com> - 3.1-24
changelog:
  - Use /etc/sysconfig/libffi-force-shared-memory-check-first to
    override selinux permissions check for shared memory access (#2014228)


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
changelog:
  - make only_urandom a default in non-presence of configuration file
  - run the full FIPS selftests only when the library is called from
    application


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-3
changelog:
  - add CMAC selftest for FIPS POST
  - add continuous FIPS entropy test
  - disable non-approved FIPS hashes in the enforced FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
changelog:
  - new upstream version 1.8.5
  - AES performance improvements backported from master branch
  - FIPS module is implicit with kernel FIPS flag
  - always run the FIPS selftests if FIPS module is installed


author: Jakub Jelen <jjelen@redhat.com> - 1.8.5-6
changelog:
  - Fix for CVE-2021-40528 (#1971421)
  - Enable HW optimizations in FIPS (#1976137)
  - Performance enchancements for ChaCha20 and Poly1305 (#1855231)


author: Richard Hughes <richard@hughsie.com> 0.2.10-1
changelog:
  - New upstream version
  - Correctly detect removed devices when rescanning
  - Fix a memory leak when using control tranfers
  - Fix symbol version table up to version 0.2.9


author: Rafael Aquini <aquini@redhat.com> - 2.21-4
changelog:
  - Fix: task-size-overrun hung over 8 hours on ppc64le (1737370)
  - Introduce libhugetlbfs-tests subpkg for CI tests (1688930)


author: Rafael Aquini <aquini@redhat.com> - 2.21-12
changelog:
  - Fix: Introduce libhugetlbfs-tests subpkg for CI tests (1688930)
  - trim repetitive changelogs for interim debug builds


author: Rafael Aquini <aquini@redhat.com> - 2.21-13
changelog:
  - Fix: huge_page_setup_helper.py: SyntaxError: Missing parentheses in call to 'print' (1821938)
  - libhugetlbfs-tests: harden the testcases to satisfy EXECSHIELD RPMDiff checks (1785296)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-3
changelog:
  - Resolves: rhbz#2219351 - [sssd] SSSD enters failed state after heavy load in the system [rhel-8.8.0.z]
  - Resolves: rhbz#2196838 - [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed' [rhel-8.8.0.z]


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-16_1
changelog:
  - [RHEL] Apply 'Add missing dependencies to the tests package'
  - [RHEL] Apply 'Update patch from upstream'


author: Sahana Prasad <sahana@redhat.com> - 1.1.5-3
changelog:
  - Enables building on old kernels [sync fix in Fedora from omosnance].
  - This is required for covscans as they run on RHEL7 machines.


author: Phil Sutter <psutter@redhat.com> - 0.3-2
changelog:
  - Add missing build requirement: gcc.
  - Add source code patches to facilitate following changes.
  - Patches managed in git, so add git as another build requirement.
  - Respect build system compiler flags.
  - Use %make_build instead of plain make in %build.
  - Add %check target which performs unattended runtime test.
  - Use -D install flag instead of manual mkdir.


author: Phil Sutter <psutter@redhat.com> - 0.3-3
changelog:
  - Use %autosetup flag '-p1' instead of '-S git' to get rid of git dependency.
  - Use %license macro in %files section.
  - Added comment about included patches' upstream status.


author: Ana Cabral <acabral@redhat.com> - 1.26.0-2
changelog:
  - Add Conflicts tag because the bash-completion scripts moved
    from the main package to the utils sub package causing a file
    conflict on multilib systems between the old 32 bit main
    package and the new 64 bit utils sub package.


author: Martin Gansser <martinkg@fedoraproject.org> - 1:0.9.57-1
changelog:
  - Update to 0.9.57
  - Dropped dependency on libgcrypt
  - Dropped dependency on openssl
  - Update tarball link to "https:"
  - Add examples from doc/examples


author: Stephen Gallagher <sgallagh@redhat.com> - 2.5.0-2
changelog:
  - Fix memory corruption error using Module.search_rpms() from python
  - Speed up valgrind tests
  - Resolves: rhbz#1714766


author: Hangbin Liu <haliu@redhat.com> - 1.7-1
changelog:
  - Update to 1.7
  - libndp: apply filter to raw socket to only accept ND messages
  - libndp: move ndp_sock_{open,close}() after msg parsing functions
  - ndptool: Fix compilation on musl libc


author: Hangbin Liu <haliu@redhat.com> - 1.7-2
changelog:
  - ndptool: add -T target support (rhbz 1666194)
  - ndptool: fix target parameter typo (rhbz 1666194)
  - libndp: close sockfd after using to avoid handle leak (rhbz 1666194)
  - libndp: fix nd_msg typo when setting target address (rhbz 1666194)


author: Hangbin Liu <haliu@redhat.com> - 1.7-3
changelog:
  - ndptool: add -D dest support (rhbz 1697595)
  - ndptool: fix potential memory leak caused by strdup (rhbz 1697595)


author: Steve Dickson <steved@redhat.com> 2.3.3-59
changelog:
  - Covscan Scan: Wrong Check of Return Value (bz 2151966)
  - Covscan Scan: Clang (experimental) (bz 2151971)


author: Weitao Zhou <zhouwt@linux.alibaba.com> 2.3.3-59.0.1
changelog:
  - use extern in header files when declaring global variables for compatible gcc10 build
  - allow compilation to succeed with -fno-common
  - Add libuuid-devel buildrequires (wb-zh951434@alibaba-inc.com)
  - Disable v4client on loongarch platform (liwei.glw@alibaba-inc.com)


author: Phil Sutter <psutter@redhat.com> [1.1.4-2.el8]
changelog:
  - obj/ct_timeout: Fix NFTA_CT_TIMEOUT_DATA parser (Phil Sutter) [1758673]
  - set_elem: Validate nftnl_set_elem_set() parameters (Phil Sutter) [1758673]
  - obj/ct_timeout: Avoid array overrun in timeout_parse_attr_data() (Phil Sutter) [1758673]
  - set: Don't bypass checks in nftnl_set_set_u{32,64}() (Phil Sutter) [1758673]
  - obj/tunnel: Fix for undefined behaviour (Phil Sutter) [1758673]
  - set_elem: Fix return code of nftnl_set_elem_set() (Phil Sutter) [1758673]
  - obj: ct_timeout: Check return code of mnl_attr_parse_nested() (Phil Sutter) [1758673]


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el8]
changelog:
  - chain: Correctly check realloc() call (Phil Sutter) [1778952]
  - flowtable: Correctly check realloc() call (Phil Sutter) [1778952]
  - chain: Fix memleak in error path of nftnl_chain_parse_devs() (Phil Sutter) [1778952]
  - flowtable: Fix memleak in error path of nftnl_flowtable_parse_devs() (Phil Sutter) [1778952]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el8]
changelog:
  - set_elem: Introduce support for NFTNL_SET_ELEM_KEY_END (Phil Sutter) [1795223]
  - set: Add support for NFTA_SET_DESC_CONCAT attributes (Phil Sutter) [1795223]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795223]


author: Phil Sutter <psutter@redhat.com> [1.1.5-5.el8]
changelog:
  - set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754]
  - expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478]
  - set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478]


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.3.0-4
changelog:
  - Python 2 binary package renamed to python2-libnl3
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Bastien Nocera <bnocera@redhat.com> - 1.22.0-6
changelog:
  + libpeas-1.22.0-6
  - Remove python2 loader, all GNOME apps using libpeas were ported to Python3
    when ported to GTK+ 3.x, and obsolete libpeas-loader-python
  - Resolves: #1559090


author: Dan Winship <danw@redhat.com> - 0.4.15-5.1
changelog:
  - Drop python2 subpackage (#1559092)
  - Drop PAC runner based on the "pacrunner" package (#1569023)
  - Replace pacrunner-crash-fix patch with version from RHEL7
  - Drop kde subpackage (#1538147)


author: Tomáš Mráz <tmraz@redhat.com> 1.4.4-1
changelog:
  - Translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer
  - pam_pwquality: Abort the retry loop if user requests it
  - Allow setting retry, enforce_for_root, and local_users_only options
    in the pwquality.conf config file


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1919026 libpwquaily rpm requires cracklib to function but RPM missing requirement [updated]


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.3-11
changelog:
  Correctly set socket directory permissions when
    qb_ipcs_connection_auth_set() is called
    Resolves: rhbz#1836146


author: Remi Collet <remi@remirepo.net> - 0.11.0-1
changelog:
  - update to 0.11.0
  - add patch to not install the static library, from
    https://github.com/alanxz/rabbitmq-c/pull/665


author: Nicola Sella <nsella@redhat.com> - 1.12.0-1
changelog:
  - Update to 1.12.0
  - Decode package URL when using for local filename (RhBug:1817130)
  - Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
  - Download sources work when at least one of specified is working (RhBug:1775184)
  - Enable building on OSX


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.0-1
changelog:
  - Update to 1.14.0
  - Fix the key string parsing in url_substitution
  - When zchunk enabled and not using HTTP/S protocol, download the whole file (RhBug:1886706)
  - Add an option LRO_SSLVERIFYSTATUS to check TLS certificate revocation status (using OCSP stapling) (RhBug:1814383)
  - Fix: lr_perform() - Avoid 100% CPU usage
  - Add support for working with certificates used with proxy
  - Reposync does not re-download unchanged packages (RhBug:1931904)
  - Fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.2-1
changelog:
  - Update to 1.14.2
  - Reduce time to load metadata
  - Fix resource leaks and memory leaks
  - Remove build dependency on python3-flask


author: Lukas Hrazky <lhrazky@redhat.com> - 1.14.2-4
changelog:
  - Fix termination of va_list in lr_metadatatarget_append_error()
  - Detailed error message when using non-existing TMPDIR


author: Martin Kutlak <mkutlak@redhat.com> - 2.9.5-10
changelog:
  - reportclient: Search for required packages recursively
  - reportclient: Find and download required debuginfo packages
  - report-client: Find debuginfos in own method
  - Resolves: rhbz#1783897


author: Michal Židek <mzidek@redhat.com> - 2.9.5-12
changelog:
  - Resolves: rhbz#1835388 - abrt-addon-ccpp causes failures during openscap scans on CCE-27119-7
  - This is just libreport side (abrt also needs to be patched)


author: zhangbinchen <zhangbinchen@openanolis.org> - 2.9.5-15.0.1
changelog:
  - Disable centos sub package
  - Don't requires subscription for Anolis OS
  - Remove unused sub packages
  - cherry-pick [1acfc44 00b6684 2f29df5]


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-2.1
changelog:
  - Use Python distutils to install SELinux python bindings (#1719771)
  - Move  sefcontext_compile to -utils package (#1612518)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-6
changelog:
  - Describe fcontext regular expressions (#1904059)
  - Strip spaces before values in config (#2012145)


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-5
changelog:
  - Revert "genhomedircon: check usepasswd" (rhbz#1871786)
  - semanage.conf - improve usepasswd=False explanation (rhbz#1871786)
  - semanage.conf - expand list of ignoredirs (rhbz#1871786)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-7
changelog:
  - Trivial style fixes
  - Free contents of modkey in semanage_direct_remove
  - Fix USE_AFTER_FREE (CWE-672) in semanage_direct_write_langext()
  - add missing include to boolean_record.c
  - move module hashing into libsemanage
  - move compressed file handling into a separate object
  - clean up semanage_direct_commit() a bit
  - optionally rebuild policy when modules are changed externally
  - add command-line option to detect module changes (#2049186)


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-5
changelog:
  - cil: Create new keep field for type attribute sets
  - build: follow standard semantics for DESTDIR and PREFIX
  - cil: show an error when cil_expr_to_string() fails


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-6
changelog:
  - Prevent freeing unitialized value in ibendport handling
  - Add support for the SCTP portcon keyword
  - Export sepol_polcap_getnum/name functions


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-3
changelog:
  - cil: Fix out-of-bound read of file context pattern ending with "\"
  - cil: Destroy classperms list when resetting classpermission (#1983517)
  - cil: Destroy classperm list when resetting map perms (#1983521)
  - cil: cil_reset_classperms_set() should not reset classpermission (#1983525)
  - cil: Set class field to NULL when resetting struct cil_classperms
  - cil: More strict verification of constraint leaf expressions
  - cil: Exit with an error if declaration name is a reserved word
  - cil: Allow permission expressions when using map classes
  - cil: Reorder checks for invalid rules when building AST
  - cil: Cleanup build AST helper functions
  - cil: Create new first child helper function for building AST
  - cil: Remove unused field from struct cil_args_resolve
  - cil: Destroy disabled optional blocks after pass is complete
  - cil: Check if name is a macro parameter first
  - cil: fix NULL pointer dereference in __cil_insert_name
  - cil: Report disabling an optional block only at high verbose levels
  - cil: Use AST to track blocks and optionals when resolving
  - cil: Reorder checks for invalid rules when resolving AST
  - cil: Sync checks for invalid rules in booleanifs
  - cil: Check for statements not allowed in optional blocks (#1983530)


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.17-1
changelog:
  - Update to 0.7.17
  - selected bug fixes:
    * repo_write: fix handling of nested flexarray
    * improve choicerule generation a bit more to cover more cases
    * harden testcase parser against repos being added too late
    * support python-3.10
    * check /var/lib/rpm macro in rpmdb code
  - new features:
    * handle default/visible/langonly attributes in comps parser
    * support multiple collections in updateinfo parser
    * add '-D' option in rpmdb2solv to set the dbpath


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.19-1
changelog:
  - Update to 0.7.19
  - repo_add_conda: add flag to skip v2 packages
  - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt
  - fix error handling in solv_xfopen_fd()
  - fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.20-5
changelog:
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Milan Crha <mcrha@redhat.com> - 2.62.2-1
changelog:
  - Update to 2.62.2
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c:get_cookies() on empty hostnames


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-2021-3634: Fix possible heap-buffer overflow when
    rekeying with different key exchange mechanism
  - Rebase to version 0.9.6
  - Rename SSHD_EXECUTABLE to SSH_EXECUTABLE in tests/torture.c
  - Resolves: rhbz#1896651, rhbz#1994600


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-6
changelog:
  - Enable client and server testing build time
  - Fix failing rekey test on arch s390x
  - Resolves: rhbz#2126342


author: Liwei Ge <liwei.glw@alibaba-inc.com> - 0.9.6-7
changelog:
  - NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)
  - authorization bypass in pki_verify_data_signature (CVE-2023-2283)


author: Tony Asleson <tasleson@redhat.com> - 1.9.1-7
changelog:
  - Remove valgrind dependency as not being used and causing
    build to fail as it pulls in python3.11


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.18.2
changelog:
  - Obsolete the python2 packages on upgrade
  - Resolves: rhbz#1567138 - libtdb: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 1.4.2-2
changelog:
  - Resolves: rhbz#1754420 - Rebase libtdb 1.4.2 for samba
  - Related: rhbz#1754420 - Fix sssd tests (tdb)


author: Xin Long <lxin@redhat.com> - 1.29-1
changelog:
  - man teamd.conf: update some parameter default values [1732587]
  - 1.29 release
  - teamd: add port_master_ifindex_changed for link_watch_port_watch_ops
  - initscripts: fix if/fi align
  - teamd: fix a json object memleak in get_port_obj() [1767685]
  - libteam: set netlink event socket as non-blocking [1684389]
  - libteam: double NETLINK_RCVBUF to fix -ENOMEM error
  - teamd: add a default value 1000 for link_watch.interval


author: Xin Long <lxin@redhat.com> - 1.29-2
changelog:
  - teamd/lacp: fix segfault due to NULL pointer dereference [1758073]
  - teamd: fix build error in expansion of macro teamd_log_dbgx [1758073]
  - teamd: update ctx->hwaddr after setting team dev to new hwaddr
  - libteam: wapper teamd_log_dbg with teamd_log_dbgx [1758073]


author: Xin Long <lxin@redhat.com> - 1.31-1
changelog:
  - 1.31 release
  - utils/bond2team: remove TYPE in ifcfg file [1858518]
  - utils/bond2team: keep delivering config to file if stdout not supplied [1858518]
  - teamd/lacp: silence ignore none LACP frames
  - Send LACP PDU right after the Actor state has been changed
  - Skip setting the same hwaddr to a lag port if not needed
  - Make all netlink socket RCVBUF sizes configurable
  - Don't return an error when timerfd socket return 0
  - Fix ifinfo_link_with_port race condition with newlink
  - teamd: fix possible race in master ifname callback
  - 1.30 release
  - teamd: Disregard current state when considering port enablement [1851460]


author: Xin Long <lxin@redhat.com> - 1.31-4
changelog:
  - teamd: do no remove the ports on shutdown with -N [2148856]
  - teamd: stop iterating callbacks when a loop restart is requested [2148855]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.37-1
changelog:
  - New upstream release 0.9.37
  - Use RHEL_ALLOW_PYTHON2_FOR_BUILD=1 for build
  - Use %{__python2}, not "python", as the Python2 interpreter


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.39-1
changelog:
  - Resolves: #1684580 - Rebase libtevent to version 0.9.36 for Samba
  - Resolves: #1597318 - libtevent uses Python 2 to build
  - Resolves: #1567139 - libtevent: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com>
changelog:
  - Remove the python2 subpackages on upgrade
  - Resolves: #1567139 - libtevent: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 0.10.0-2
changelog:
  - Resolves: #1754421 - Upgrade tevent to 0.10.0 version for samba
  - Related: #1754421 - Fix sssd tests (tevent)


author: Tom Stellard <tstellar@redhat.com> - 1.2.6-2
changelog:
  - Add BuildRequires: gcc
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_packaging


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.6-23
changelog:
  - bake in versioned requirement on automake (rhbz#1193591)
  - fix testsuite FTBFS against automake 1.16.1
  - bypass -specs=* to gcc (rhbz#985592)


author: Jeff Moyer <jmoyer@redhat.com> - 1.0.7-2.el8
changelog:
  - Fix versioning.  The installed library is 1.0.7, make the rpm match.
  - bump release number for build, which includes -fPIC fix
  - Related: rhbz#1862551


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-16
changelog:
  - Use 2048bit keys in tests
  - Resolves: rhbz#1611729 - [RHEL8-S-BUILD] libuser Fails Scratch Build on rhel-8.0


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-17
changelog:
  - Resolves: rhbz#1558151 - libuser needs audit events around the account
                             lifecycle


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-19
changelog:
  - Resolves: rhbz#1602600 -  Please review important issues found by covscan
                              in "libuser-0.62-14.el8+7" package


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-20
changelog:
  - Resolves: rhbz#1637398 - libuser-python3 should be renamed to comply
                             with Packaging Guidelines


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-23
changelog:
  - Actually apply the patch from the previous build
  - Resolves: rhbz#1670997 - Amend the user lifecycle auditing


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.1.6-14
changelog:
  - build with hardening LDFLAGS (#1548717)
  - remove obsolete macro and comments
  - add gcc to build requirements


author: Harald Hoyer <harald@redhat.com> - 16-1
changelog:
  - libvarlink 16
  - fixed coverity issues
  - Resolves: #1638294 - Interface name validation rule update


author: Michel Alexandre Salim <salimma@centosproject.org> - 1.5.1-1
changelog:
  - Rebase to the latest upstream version
  - Enable optional gz, xz/lzma, and lz4 support in the zstd tool
  - Disable amd64 assembly on non-x86_64 architectures (rhbz#2035802)
    this should avoid the issue where an executable stack is created
  - Re-enable CET protections (rhbz#2039353)
    Resolves: rhbz#2039488


author: Xin Long <lxin@redhat.com> - 1.0.18-3
changelog:
  - Added a patch to fix netinet/sctp.h not to be installed.
  - Added some fixes for kernel feature detection.


author: Aaron Conole <aconole@redhat.com> - 1.0.1-14.git036e314
changelog:
  - Update to branch-1.1 compatibility
  - Fixes to avoid assert in the agent state machine
  - Remove the memory constraint on the event socket buffer (#1554110)


author: Artem Egorenkov <aegorenk@redhat.com> - 3.6.0-7
changelog:
  - New flag for no sensors added. This flag is used in VM environment
    to make sensors binaries not fail if no sensors was detected.


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.0.4-0.27.20111007git
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
  - Explicitly include <sys/sysmacros.h> due to glibc-headers changes.
  Definition of major and minor macros is no longer transitively included
  through <sys/types.h>, hence make it explicit.
  Ref:
  https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=NEWS;hb=HEAD


author: Kamil Dudka <kdudka@redhat.com> - 3.14.0-3
changelog:
  - fix programming mistakes detected by Coverity Analysis
  - document the --version option in the logrotate(8) man page (#1611498)


author: Kamil Dudka <kdudka@redhat.com> - 3.14.0-4
changelog:
  - logrotate.8: encourage admins to use the `su` directive (#1759770)
  - do not abort globbing on broken symlink (#1723265)


author: Frank Crawford <frank@crawford.emu.id.au> - 7.5.4-2
changelog:
  - Add requires for perl-diagnostics (#1893671) and perl-lib (#1893503)
  - Add other requires as nothing is now automatically supplied


author: Lianbo Jiang <lijiang@redhat.com> - B.02.18-22
changelog:
  - Display proper logical name of network device
  - Resolves: rhbz#1724087
  - Add DIMM running speed and Print dimm rank information
  - Resolves: rhbz#1725199


author: Jan Rybar <jrybar@redhat.com> - 4.93.2-1
changelog:
  - Rebase to lsof-4.93.2
  - Upstream moved to GitHub (original unreachable) and tarball structure changed
  - Manpage patch needed to reflect the tarball changes
  - Resolves: rhbz#1778228


author: Tomas Bzatek <tbzatek@redhat.com> - 0.32-1
changelog:
  - Upgrade to 0.32 upstream snapshot (#1855766)
  - Fix NVMe device parsing (#1687841, #1845977)
  - Fix WWN string reporting (#1846559)
  - Implement SCSI identifier sort priority (#1846566)


author: Gao Xiang <hsiangkao@linux.alibaba.com> - 1.9.4-1
changelog:
  - Update to 1.9.4 in sync with Anolis 23
  - Switch back from Meson since its version is too low on Anolis 8.


author: Robert Scheck <robert@fedoraproject.org> - 1.03-13
changelog:
  - Added patch by Khem Raj to use static inlines as the external
    inline definition has changed with GCC 5 (to fix ppc64 builds)


author: Patsy Griffin Franklin <pfrankli@redhat.com> 1:4.2.1-7
changelog:
  - Fix build failure caused by automake versioning differences related
    to the glob changes. (#1589769)
  - Fix testing failure due to Perl changes related to expanding paths.


author: Nikola Forró <nforro@redhat.com> - 2.7.6.1-18
changelog:
  - schedule interrupted cache update for the next boot, instead of blocking
    system reboot/shutdown
    resolves #1874010


author: Nikola Forró <nforro@redhat.com> - 4.15-7
changelog:
  - remove rpc.3 and xdr.3 man pages documenting deprecated glibc RPC implementation
    resolves: #1980919


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-2
changelog:
  - Revert "mcstransd select correct colour range." (#1731451)
  - Fix mcstrans secolor examples (#1731451)


author: Xiao Ni <xni@redhat.com> - 4.2-6
changelog:
  - Keep udev rule close to upstream and update to latest upstream
  - Resolves rhbz#1991596, rhbz#2129088, rhbz#2107150


author: Xiao Ni <xni@redhat.com> - 4.2-7
changelog:
  - Update to latest to upstream to fix some bugs
  - Resolves rhbz#2149307, rhbz#2149473, rhbz#2151208, rhbz#2127096


author: Xiao Ni <xni@redhat.com> - 4.2-9
changelog:
  - Update to latest upstream and fix mdcheck service bug
  - Resolves rhbz#2116418, rhbz#2150862, rhbz#2159584


author: Ales Matej <amatej@redhat.com> - 3.4.0-1
changelog:
  - Update to 3.4.0
  - Fix: do not download metadata in remove command
  - Add reinstall command
  - Add "--setopt=tsflags=test" support
  - Add "--setopt=reposdir=<path>" and "--setopt=varsdir=<path1>,<path2>,..." support
  - Add "--config=<path_to_config_file>" support
  - Add "--disableplugin", "--enableplugin" support (RhBug:1781126)
  - Add "--noplugins" support
  - Add "--setopt=cachedir=<path_to_cache_directory>" support
  - Add "--installroot=<path_to_installroot_directory>" support
  - Add "--refresh" support
  - Support "install_weak_deps" conf option and "--setopt=install_weak_deps=0/1"
  - Respect reposdir from conf file
  - Respect "metadata_expire" conf file opton (RhBug:1771147)
  - [repolist] Print padding spaces only if output is terminal


author: Nicola Sella <nsella@redhat.com> - 3.4.0-3
changelog:
  - Patch: Add support for setting a platform module ID
  - Rename "update" command to "upgrade", "update" remain as compatibility alias


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - Don't set default value of "assumeyes" to TRUE
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Add commands: distro-sync, makecache
  - Add subcommands support
  - Add support for command aliases
  - Added alias "update" to "upgrade" command
  - Relicense to GPLv2+
  - Add support for setting allow_vendor_change
  - [download] Support for "--resolve", "--alldeps" and "--archlist=" arguments
  - [download] several optimizations
  - Support "--setopt=keepcache=0/1"
  - Extend "--setopt" to support repository options


author: Michal Hlavinka <mhlavink@redhat.com> 56-1
changelog:
  - Upgrade to 56 (#1479800)
  - fixes wait exit codes of co-processes when run in interactive mode (#1479320)


author: Michal Sekletar <msekleta@redhat.com> - 0.26-14
changelog:
  - start timer after the installation (#1278587)
  - make mlocate-updatedb.service of the type simple, systemd will then not wait for its completion (#1282232)


author: Javier Martinez Canillas <javierm@redhat.com> - 0.3.0-10
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs
    when mok-variables aren't present (pjones)
    Resolves: rhbz#1907418


author: Liu Xiaoping <lxp01404969@alibaba-inc.com> - 0.3.0-12.0.1
changelog:
  - Modify the WARNINGFLAGS for loongarch64 (zhangwenlong@loongson.cn)
  - Add loongarch64 in ExclusiveArch (gongwen@nfschina.com)
  - Fix build error by koji (jacob.wang@openanolis.org)


author: James Paul Turner <jamesturner246@fedoraproject.org> - 3.1.6-1
changelog:
  - Update to MPFR version 3.1.6
  - Use autosetup specfile macro for applying patches (patches 1 and 2 applied)
  - Removed iconv calls, as they were breaking .info files, which are now unicode
    resolves #1299649
  - Other minor cleanups
  - BuildRequire gcc per https://fedoraproject.org/wiki/Packaging:C_and_C%2B%2B#BuildRequires_and_Requires


author: Pavel Cahyna <pcahyna@redhat.com> - 4.0.18-15
changelog:
  - Add dependency on glibc-gconv-extra
    mtools need codepage 850, which was split from glibc into a subpackage.
    (Fedora bug #2021637, RHEL bug #2073842)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-5.20180224
changelog:
  - fix crash in parsing of terminfo use capability (CVE-2018-10754)
  - add gcc-c++ to build requirements


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-8.20180224
changelog:
  - fix buffer overflow in terminfo entry hashtable (CVE-2019-17594)
  - handle missing character after backslash in terminfo entry (CVE-2019-17595)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-19
changelog:
  - revert permission of config files to 600 (#1601060)
  - fix error message when the address specified by clientaddr option
    is wrong or cannot be bound (#1877375)
  - log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
  - fix issue with quoting empty passphrase (#1817225)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-21
changelog:
  - prevent parsing IP address twice (#1768908)
  - add support for digests detected from ECC certs (#1919714)
  - fix broken ErrorMsg at ucd-snmp (#1933150)
  - add support for intermediate certs (#1914656)
  - fix crash of certs with longer extension (#1908718)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-27
changelog:
  - fix memory leak due of proc file creating (#2105957)
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
  - fix memory leak when ipv6 disable set to 1 (#2151537)
  - fix proxy timeout issue (#2160723)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.50.20160912git
changelog:
  - Resolves: 1557470 - netstat -i cut's interface names
  - Resolves: 1566084 - netstat -agn only shows 10 character interface name for IPv4 addressing


author: Michal Ruprich <michalruprich@gmail.com> - 2.0-0.52.20160912git
changelog:
  - Resolves: #1711119 - netstat says "packetes" instead of "packets"
  - Resolves: #1670355 - Exit code on wrong parameter is zero for many net-tools binaries
  - Resolves: #1807989 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Tomáš Mráz <tmraz@redhat.com> - 3.4-4
changelog:
  - Cover the gaps in annotation coverage for assembler sources
  - Add .hmac checksums for FIPS mode integrity checking


author: Daiki Ueno <dueno@redhat.com> - 3.4.1-5
changelog:
  - Backport powerpc64 optimization patches from upstream (#1855228)
    Patch from Christopher M. Riedl.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.52.20-4
changelog:
  - Python 2 binary package renamed to python2-newt
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-8
changelog:
  - rename newt-python3 subpackage to python3-newt
  - build python3 subpackage unconditionally
  - don't use unversioned python_sitearch macro
  - drop static subpackage
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - fix description of python2-newt


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-10
changelog:
  - move snack provides to python3-newt subpackage (#1640153)
  - fix radio button selection check in snack (#1714517)


author: Steve Dickson <steved@redhat.com> 0.3.5-2
changelog:
  - nfs4_getfacl: Add new option -c/--omit-header (bz 1698281)
  - nfs4_setfacl: Skip comment field while reading ACE(s) (bz 1687299)


author: Phil Sutter <psutter@redhat.com> [0.9.3-17.el8]
changelog:
  - json: don't leave dangling pointers on hlist (Phil Sutter) [1900565]
  - json: Fix seqnum_to_json() functionality (Phil Sutter) [1900565]
  - json: echo: Speedup seqnum_to_json() (Phil Sutter) [1900565]
  - proto: Fix ARP header field ordering (Phil Sutter) [1896334]
  - proto: add sctp crc32 checksum fixup (Phil Sutter) [1895804]
  - mergesort: unbreak listing with binops (Phil Sutter) [1891790]
  - evaluate: missing datatype definition in implicit_set_declaration() (Phil Sutter) [1877022]
  - evaluate: Perform set evaluation on implicitly declared (anonymous) sets (Phil Sutter) [1877022]
  - src: store expr, not dtype to track data in sets (Phil Sutter) [1877022]


author: Phil Sutter <psutter@redhat.com> [0.9.3-19.el8]
changelog:
  - evaluate: Reject quoted strings containing only wildcard (Phil Sutter) [1818117]
  - tests: monitor: use correct $nft value in EXIT trap (Phil Sutter) [1919203]
  - monitor: Fix for use after free when printing map elements (Phil Sutter) [1919203]
  - tests: Disable tests known to fail on RHEL8 (Phil Sutter) [1919203]


author: Phil Sutter <psutter@redhat.com> [0.9.3-20.el8]
changelog:
  - src: Optimize prefix matches on byte-boundaries (Phil Sutter) [1934926]
  - src: Support odd-sized payload matches (Phil Sutter) [1934926]
  - spec: Add an rpminspect.yaml file to steer rpminspect (Phil Sutter) [1962184]
  - spec: Explicitly state dist string in Release tag (Phil Sutter) [1962184]


author: Phil Sutter <psutter@redhat.com> [0.9.3-21.el8]
changelog:
  - tests: shell: Fix bogus testsuite failure with 100Hz (Phil Sutter) [1919203]
  - doc: nft.8: Extend monitor description by trace (Phil Sutter) [1820365]
  - include: missing sctp_chunk.h in Makefile.am (Phil Sutter) [1979334]
  - exthdr: Implement SCTP Chunk matching (Phil Sutter) [1979334]
  - scanner: sctp: Move to own scope (Phil Sutter) [1979334]
  - scanner: introduce start condition stack (Phil Sutter) [1979334]
  - json: Simplify non-tcpopt exthdr printing a bit (Phil Sutter) [1979334]
  - json: tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcpopt: allow to check for presence of any tcp option (Phil Sutter) [1979334]
  - tcpopt: split tcpopt_hdr_fields into per-option enum (Phil Sutter) [1979334]
  - tcpopt: rename noop to nop (Phil Sutter) [1979334]
  - tcpopts: clean up parser -> tcpopt.c plumbing (Phil Sutter) [1979334]
  - parser: merge sack-perm/sack-permitted and maxseg/mss (Phil Sutter) [1979334]
  - tests/py: Move tcpopt.t to any/ directory (Phil Sutter) [1979334]


author: Phil Sutter <psutter@redhat.com> [0.9.3-22.el8]
changelog:
  - json: Drop pointless assignment in exthdr_expr_json() (Phil Sutter) [1999059]
  - parser_json: Fix for memleak in tcp option error path (Phil Sutter) [1999059]
  - parser_bison: Fix for implicit declaration of isalnum (Phil Sutter) [1999059]
  - parser_json: Fix error reporting for invalid syntax (Phil Sutter) [1994141]


author: Phil Sutter <psutter@redhat.com> [0.9.3-23.el8]
changelog:
  - tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set") (Phil Sutter) [1908127]
  - segtree: Fix segfault when restoring a huge interval set (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-24.el8]
changelog:
  - tests: shell: better parameters for the interval stack overflow test (Phil Sutter) [1908127]
  - tests: shell: $NFT needs to be invoked unquoted (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-25.el8]
changelog:
  - mnl: do not build nftnl_set element list (Phil Sutter) [2047821]
  - tests: py: add dnat to port without defining destination address (Phil Sutter) [2030773]
  - evaluate: fix inet nat with no layer 3 info (Phil Sutter) [2030773]
  - evaluate: attempt to set_eval flag if dynamic updates requested (Phil Sutter) [2039594]
  - src: support for restoring element counters (Phil Sutter) [2039594]
  - netlink: remove unused parameter from netlink_gen_stmt_stateful() (Phil Sutter) [2039594]


author: Phil Sutter <psutter@redhat.com> [0.9.3-26.el8]
changelog:
  - libnftables: call nft_cmd_expand() only with CMD_ADD (Phil Sutter) [2073287]
  - src: add CMD_OBJ_SETELEMS (Phil Sutter) [2073287]
  - src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTS (Phil Sutter) [2073287]
  - rule: fix element cache update in __do_add_setelems() (Phil Sutter) [2073287]
  - rule: memleak in __do_add_setelems() (Phil Sutter) [2073287]
  - tests: shell: auto-removal of chain hook on netns removal (Phil Sutter) [2070924]
  - mnl: do not use expr->identifier to fetch device name (Phil Sutter) [2070924]


author: Filip Januš <fjanus@redhat.com> - 3.1-4
changelog:
  - addiing: recommending to install 32 bit-version if 32 bit glibc is installed
  - resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1803161


author: Filip Januš <fjanus@redhat.com> - 3.1-7
changelog:
  - improve recommandation of 32 bit-version
  - resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1803161


author: Than Ngo <than@redhat.com> - 3.18.0-1
changelog:
  - Resolves: #2043845, rebase to 3.18.0
  - Resolves: #2043854, add crypto counters
  - Resolves: #2043855, support crypto profiles


author: Than Ngo <than@redhat.com> - 3.18.0-3
changelog:
  - Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
  - Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL


author: Than Ngo <than@redhat.com> - 3.19.0-1
changelog:
  - Resolves: #2126612, opencryptoki fails after generating > 500 RSA keys
  - Resolves: #2110315, rebase to 3.19.0
  - Resolves: #2110990, openCryptoki key generation with expected MKVP only on CCA and EP11 tokens
  - Resolves: #2110477, openCryptoki ep11 token: master key consistency
  - Resolves: #1984871, openCryptoki ep11 token: vendor specific key derivation


author: Michael Petlan <mpetlan@redhat.com> - 1.0.0-5
changelog:
  - Added some linker hardening flags to pass annocheck
    Related: rhbz#2031802

    * Tue Dec 14 2021 Michael Petlan <mpetlan@redhat.com> - 1.0.0-5
  - Added gating
    Related: rhbz#2031794


author: Michael Petlan <mpetlan@redhat.com> - 1.2.0-2
changelog:
  - Update to upstream 1.2.0 -- fix opencsd_tag
    Related: rhbz#2041578

    * Fri Jan 21 2022 Michael Petlan <mpetlan@redhat.com> - 1.2.0-1
  - Update to upstream 1.2.0
    Related: rhbz#2041578


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-3
changelog:
  - Unbreak the RSA-PSS mechanisms (#1595626)
  - Unbreak the signing using hashed mechanisms in CardOS and others (#1644338)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-4
changelog:
  - Unbreak the Dual CAC cards in PIV driver (#1651748)
  - Fix few more corner cases for handling different types of padding (#1595626)
  - Unbreak signature verification in pkcs11-tool (#1651748)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-6
changelog:
  - Add support for Gemalto IDPrime smart cards (#1657970)
  - Fix 2k RSA key operations with Coolkey (#1766712)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-3
changelog:
  - Support PIN change for HID Alt tokens (#1830901)
  - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572
  - Fix right padding of token labels of some cards (#1877973)


author: Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-14
changelog:
  - Upstream: add a local implementation of BSD realpath() for sftp-server (#2064249)
  - Change product name from Fedora to RHEL in openssh-7.8p1-UsePAM-warning.patch (#1953807)
  - Include caveat for crypto-policy in sshd manpage (#2044354)
  - Change log level of FIPS specific log message to verbose (#2050511)
  - Clarify force_file_perms (-m) documentation in sftp-server manpage (#1862504)
  - Minimize the use of SHA1 as a proof of possession for RSA key (#2093897)


author: Dmitry Belyavskiy - 8.0p1-17
changelog:
  - Fix parsing of IPv6 IPs in sftp client (#2151334)
  - Avoid ssh banner one-byte overflow (#2138344)
  - Avoid crash of sshd when Include folder does not exist (#2133087)


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 8.0p1-17.0.1
changelog:
  - seccomp: Allow check_nanosleep to better compatibility for both glibc2.28 and glibc2.32
  - Support loongarch64 seccomp_filter sandbox (xuezhixin@uniontech.com)
  - another case where a utimes() failure could make scp send (jiang.yong5@zte.com.cn)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067146


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-1
changelog:
  - Update to 0.4.8-1
  - RSA key generation on the token
  - RSA-OAEP and RSA-PKCS encryption support
  - RSA-PSS signature support
  - Support for OpenSSL 1.1.1 beta
  - Removed support for OpenSSL 0.9.8
  - Various bug fixes and enhancements


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-2
changelog:
  - Require OpenSSL >= 1.0.2
  - Fixed missing declaration of ERR_get_CKR_code()
  - Add support to use EC keys and tests (#1625338)
  - Exposed check_fork() API
  - Fixed memory leak of RSA objects in pkcs11_store_key()
  - Updated OpenSSL license in eng_front.c
  - Fixed build for old C dialects
  - Allow engine to use private key without PIN
  - Require DEBUG to be defined to print debug messages
  - Changed package description


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.10-1
changelog:
  - Update to 0.4.10 (#1745082)
  - Add BuildRequires for OpenSSL >= 1.0.2, required for testing
  - Print tests logs if failed during build
  - Small bug fixes such as removal of unused variable
  - Search objects in all matching tokens (#1705505)


author: Neal Gompa <ngompa13@gmail.com> - 1.74-1
changelog:
  - Update to upstream version 1.74
  - Drop merged patches
  - Rediff remaining patches
  - Move newns to /usr/libexec/os-prober (debuginfo generation works)
  - Mark copyright file as license file


author: Peter Jones <pjones@redhat.com> - 1.74-7
changelog:
  - Make gcc use -Wl,-z,now -Wl,-z,relro -pie.  Dunno why the default didn't
    pick this up.
    Resolves: rhbz#1624158


author: Daiki Ueno <dueno@redhat.com> - 0.23.21-4
changelog:
  - Fix realloc usage on proxy cleanup (#1894979)
  - Make 'trust anchor --store' preserve all attributes from .p11-kit files


author: Daiki Ueno <dueno@redhat.com> - 0.23.22-1
changelog:
  - Rebase to 0.23.22 to fix memory safety issues (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363)
  - Preserve DT_NEEDED information from the previous version, flagged by rpmdiff
  - Add xsltproc to BR


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-17
changelog:
  - pam_keyinit: thread-safe implementation. Resolves: #1997969
  - pam_motd: support multiple motd paths specified, with filename overrides. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-19
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-25
changelog:
  - pam_motd: avoid unnecessary logging. Resolves: #2091062
  - pam_lastlog: check localtime_r() return value. Resolves: #2012871
  - pam_faillock: clarify missing user faillock files after reboot. Resolves: #2062512
  - pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2082442


author: Brian C. Lane <bcl@redhat.com> - 3.2-33
changelog:
  - Switch gpt-header-move and msdos-overlap to python3 (bcl)
    Resolves: rhbz#1595810
  - Modify gpt-header-move and msdos-overlap to work with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-34
changelog:
  - Fix the length of several strncpy calls (bcl)
    Related: rhbz#1602652
  - parted.c: Always free peek_word (bcl)
    Related: rhbz#1602652
  - parted.c: Make sure dev_name is freed (bcl)
    Related: rhbz#1602652
  - t6100-mdraid-partitions: Use v0.90 metadata for the test (bcl)
  - Fix msdos-overlap to work correctly with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-35
changelog:
  - Use python3-devel in buildroot
    Resolves: rhbz#1615576
  - linux.c: Use sys/sysmacros.h for major/minor
    Resolves: rhbz#1615592


author: Brian C. Lane <bcl@redhat.com> - 3.2-37
changelog:
  - Add CI tests
    Resolves: rhbz#1653912
  - t6000-dm: Stop using private lvm root
    Related: rhbz#1653912


author: Brian C. Lane <bcl@redhat.com> - 3.2-39
changelog:
  - tests: Add a test for resizepart on a busy partition (bcl)
    Related: rhbz#1861804
  - parted: Preserve resizepart End when prompted for busy partition (bcl)
    Resolves: rhbz#1861804
  - Fix end_input usage in do_resizepart (bcl)
    Related: rhbz#1861804
  - tests: Test incomplete resizepart command (bcl)
    Related: rhbz#1861804
  - Fix resizepart iec unit end sector (psusi)
    Related: rhbz#1861804
  - libparted: Fix endian bug in bsd.c (AWilcox)
    Resolves: rhbz#1980105


author: Than Ngo <than@redhat.com> - 2.7.6-10
changelog:
  - CVE-2019-13636 , Don't follow symlinks unless --follow-symlinks is given
  - Resolves: #1665928, patch has a huge error output and segfaults when the file to be patched does not exist


author: Michal Hlavinka <mhlavink@redhat.com> - 3.7.0-1
changelog:
  - pciutils updated to 3.7.0, add support for basic DVSEC and CXL DVSEC (#1856436)
  - add support for RCEC Associated Endpoint (#1856440)


author: Petr Pisar <ppisar@redhat.com> - 8.41-6
changelog:
  - Fix returning unset groups in POSIX interface if REG_STARTEND has a non-zero
    starting offset (upstream bug #2244)


author: Petr Pisar <ppisar@redhat.com> - 8.42-2
changelog:
  - Fix handling UTF and start-of-pattern options in C++ wrapper
    (upstream bug #2283)
  - Fix an error message and locale handling in pcregrep tool


author: Petr Pisar <ppisar@redhat.com> - 8.42-3
changelog:
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256
    (bug #1619228)


author: Petr Pisar <ppisar@redhat.com> - 8.42-5
changelog:
  - Fix CVE-2019-20838 (a subject buffer overread in JIT when UTF is disabled
    and \X or \R has a greater than 1 fixed quantifier) (bug #1852252)
  - Fix CVE-2020-14155 (an integer overflow when parsing numbers after "(?C"))
    (bug #1851552)


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: Jakub Jelen <jjelen@redhat.com> - 1.9.5-1
changelog:
  - Rebase to 1.9.5 version to address race conditions (#2014641)
  - Drop dowstream polkit policy to avoid repeated authentication requests in remote sessions (#1928154)


author: Paul Howarth <paul@city-fan.org> - 1.1903-1
changelog:
  - Update to 1.1903
    - Fix documentation typos (CPAN RT#84981)
    - Add -w and -i switches to diffnew.pl (CPAN RT#69945)
    - Remove Algorithm::DiffOld from the index; the module is still distributed
      with Algorithm::Diff, but is not indexed on CPAN because this is an
      ***UNAUTHORIZED*** release of Algorithm::DiffOld
  - Add patch to generate provide for perl(Algorithm::DiffOld)
  - Drop %defattr, redundant since rpm 4.4
  - General spec tidy-up


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.54-6
changelog:
  - Adjust to sqlite-3.22.0 (bug #1543286)
  - Add new index constraint ops introduced in SQLite 3.21.0 to PerlData


author: Jan Pazdziora <jpazdziora@redhat.com> - 6.56-1
changelog:
  - 1372494 - Rebase to upstream version 6.56.
  - 1372494 - Rebase to upstream version 6.55, build failed due to
    https://rt.cpan.org/Public/Bug/Display.html?id=117404.


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-416
changelog:
  - 5.26.3 bump (bug #1655526)
  - Fix CVE-2018-18311 (integer overflow leading to buffer overflow) (bug #1654920)
  - Fix CVE-2018-18312 (heap buffer overflow in regcomp.c) (bug #1654922)
  - Fix CVE-2018-18313 (heap buffer overflow read in regcomp.c) (bug #1654924)
  - Fix CVE-2018-18314 (heap based buffer overflow) (bug #1654925)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-417
changelog:
  - Fix Time-Local tests to pass after year 2019 (bug #1807120)
  - Run-require perl(Encode) by perl-libs (bug #1903503)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-419
changelog:
  - Fix CVE-2020-10543 (bug #1839273)
  - Fix CVE-2020-10878 (bug #1839276)
  - Fix a file mode of a perl-example.stp example (bug #1913693)


author: Petr Pisar <ppisar@redhat.com> - 2.12-367
changelog:
  - Fix CVE-2017-6512 (setting arbitrary mode on an arbitrary file in rmtree()
    and remove_tree()) (bug #1457834)


author: Petr Pisar <ppisar@redhat.com> - 3.28-2
changelog:
  - Introduce a build-condition on groff
  - Rename a _without_tk build-condition to
    _without_perl_Pod_Perldoc_enables_tk_test


author: Paul Howarth <paul@city-fan.org> - 1.71-5
changelog:
  - Soften Business::ISBN dependency from Requires: to Suggests: to avoid
    pulling in gd and X libraries (#1380152)


author: Petr Pisar <ppisar@redhat.com> - 3.10-2
changelog:
  - Net::libnetFAQ document replaced with a hyper link because of the Artistic
    license (CPAN RT#117888)


author: Paul Howarth <paul@city-fan.org> - 1:0.236-1
changelog:
  - Update to 0.236
    - Add Travis test configuration
    - Make test for PMC availability more reliable
    - Disable benchmark test rt62341.t as it runs out of memory on many smoker
      systems (CPAN RT#118310)
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1:0.237-1
changelog:
  - Update to 0.237
    - Don't load vars.pm (CPAN RT#132077)
  - Drop legacy Group: tag
  - Drop buildroot cleaning in %install section


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-44
changelog:
  - Use the monotonic clock for theading.Condition
  - Use the monotonic clock for the global interpreter lock
  Resolves: rhbz#2003758


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-45
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-46
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2047376, rhbz#2060435


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-50
changelog:
  - Security fix for CVE-2022-45061
  - Strip the LTO bytecode from python.o
  Resolves: rhbz#2144072, rhbz#2137707


author: zhangbinchen <zhangbinchen@openanolis.org> - 3.6.8-51.0.1.1
changelog:
  - Add Anolis platform cherry-pick [9a96461]
  - Support Loongarch for python3
  - Fix testcase fails on loongarch64


author: Miro Hrončok <mhroncok@redhat.com> - 9.0.3-13
changelog:
  - Use the system level root certificate instead of the one bundled in certifi
  - Resolves: rhbz#1655255


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-16
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-18
changelog:
  - Patch for pip install <url> allow directory traversal, leading to arbitrary file write
  Resolves: rhbz#1868016


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-20
changelog:
  - Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references
  Resolves: rhbz#1962856


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-4
changelog:
  - New subpackage platform-python-setuptools without files from /usr/bin/*
  - python3-setuptools contains only files from /usr/bin/* and depends
    on platform-python-setuptools
  - Resolves: rhbz#1641973


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-19
changelog:
  - semodule: move module hashing into libsemanage (requires libsemanage-2.9-7)
  - semodule: add command-line option to detect module changes (#2049189)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-20
changelog:
  - python: Split "semanage import" into two transactions (#2063353)
  - semodule: rename --rebuild-if-modules-changed to --refresh (#2089802)
  - selinux-autorelabel: Do not force reboot (#2093133)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-21.1
changelog:
  - python: Harden tools against "rogue" modules (#2128976)
  - Update "pathfix" arguments to match ^^^ (#2128976)
  - python: Do not query the local database if the fcontext is non-local (#2124825)


author: Jan Rybar <jrybar@redhat.com> - 0.115-7
changelog:
  - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled
  - Mitigation of regression caused by fix of CVE-2018-19788
  - Resolves: rhbz#1693781
  - Resolves: rhbz#1693814


author: Panu Matilainen <pmatilai@redhat.com> - 1.18-1
changelog:
  - Rebase to popt 1.18 (https://github.com/rpm-software-management/popt/releases/tag/popt-1.18-release)
  - Update URLs to rebooted upstream
  - Clean up ancient cruft from spec, use modern build macros


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.3.1-10
changelog:
  - Release bump and rebuild for relengs to be able to ship postfix-pcre,
    postfix-cdb, postfix-sqlite
    Resolves: rhbz#1745321


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.5.8-2
changelog:
  - Fixed cleanup crash when processing messages with whitespace only fullname
    Resolves: rhbz#1977732


author: Michal Sekletár <msekleta@redhat.com> - 0.1.0-5
changelog:
  - if interface has name in expected format print it to stdout (#1643515)
  - don't assign names to virtual devices (#1644294)


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-3
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: align manpage with procfs wording
  - watch: manpage presumes NTP on system
  - Resolves: rhbz#1827731
  - Resolves: rhbz#1829920
  - Resolves: rhbz#1583669


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-4
changelog:
  - pidof: new option to show kernel worker threads
  - pidof: empty input causes to show kernel worker threads
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640
  -


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-5
changelog:
  - version bump due to unspotted malformed backport patch
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-8
changelog:
  - vmstat: added -y option to omit first report
  - Resolves: rhbz#2027350
  - sysctl: backport config directory order, align with systemd
  - Resolves: rhbz#2111915


author: Jan Rybar <jrybar@redhat.com> - 6.6.3-2
changelog:
  - lastcomm: added new --pid option to show process PID and PPID
  - changelog update: 6.6.3-1 author change
  - spec file update: added correct access mode to created /var/account/pacct


author: Jan Rybar <jrybar@redhat.com> - 23.1
changelog:
  - Rebase to the newest upstream official release
  - Source0 updated to latest functional SourceForge URL format
  - peekfd manpage now not present if peekfd binary missing on given architecture
  - URL of the project updated
  - new tool pslog added with rebase
  - Resolves: #1460695


author: Liwei Ge <geliwei@openanolis.org> - 1.11.5-5.0.1
changelog:
  - Remove releated unversioned python macro that not supported now
    (See https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/#_macros)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.4-3
changelog:
  - Python 2 binary package renamed to python2-chardet
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:1.1.fb23-4
changelog:
  - Python 2 binary package renamed to python2-configshell
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Christian Heimes <cheimes@redhat.com> - 2.2.1-2
changelog:
  - Drop Python 2 subpackages from RHEL 8, fixes RHBZ#1589754
  - Remove unnecessary copy and shebang mangling


author: Christian Heimes <cheimes@redhat.com> - 2.3-1
changelog:
  - New upstream release 2.3
  - Fix AEAD tag truncation bug, CVE-2018-10903, RHBZ#1602755, RHBZ#1602932


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-1
changelog:
  - Rebase to upstream release 3.2.1
  - Resolves: rhbz#1873581
  - Resolves: rhbz#1778939
  - Removed dependencies on python-asn1crypto, python-idna


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-4
changelog:
  - CVE-2020-36242: Fixed a bug where certain sequences of update() calls
    when symmetrically encrypting very large payloads (>2GB) could result
    in an integer overflow, leading to buffer overflows.
  - Resolves: rhbz#1926528


author: Iryna Shcherbina <ishcherb@redhat.com> - 1:2.6.1-2
changelog:
  - Fix ambiguous Python 2 dependency declarations
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.2.4-9
changelog:
  - Python 2 binary package renamed to python2-dbus
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.2.4-10
changelog:
  - Also add Provides for the old name without %_isa
  - Use %python_provide for the python3 subpackage and drop manual Provide which
    conflicts with %python_provide in the python2 subpackage.


author: Miro Hrončok <mhroncok@redhat.com> - 0.13-1
changelog:
  - Updated to 0.13
  - Added python3 and python2 subpackages
  - Add --with tests
  - Modernize spec
  - Remove merged patch
  - Update upstream URL


author: Lumír Balhar <lbalhar@redhat.com> - 0.14-3
changelog:
  - Backport patch from upstream/rhel7 which allows pifconfig to show
    multiple IPv4 addresses for each interface
  - Move patches to dist-git
  - Resolves: rhbz#1652174


author: Tomas Popela <tpopela@redhat.com> - 3.40.1-6
changelog:
  - Fix the multilib problems by backporting fixes done by mhroncok from Fedora:
  - Move pure Python modules to a noarch subpackage
  - Ensure Python bytecode installed in multilib packages is bit-to-bit identical
    Resolves: rhbz#1915764


author: Carl George <carl@george.computer> - 1.6.1-1
changelog:
  - Latest upstream
  - Add patch0 to remove pytest-{cov,runner} deps
  - Share doc and license dir between subpackages
  - Enable EPEL PY3 build


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.9-16
changelog:
  - Python 2 binary package renamed to python2-kmod
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: John Kacur <jkacur@redhat.com> - 0.6.2-1
changelog:
  - Add bitmasklist_test
  - Clean-ups including using a more modern python spacing, tabbing, etc
  - Fix to parse number of cpus correctly on s390(x)
  Resolves: rhbz#1849215


author: John Kacur <jkacur@redhat.com> - 0.6.3-4
changelog:
  - various clean-ups including using 'with' context managers in try-except
  - Fix to ignore UnicodeDecodeError when it occurs
  Resolves: rhbz#2016204


author: John Dennis <jdennis@redhat.com> - 2.0.1-1
changelog:
  - Upgrade to upstream 2.0.1
  - port from jwt to jwcrypto (conditional build)
  - bring into alignment with rhel spec file


author: mulhern <amulhern@redhat.com> - 0.19.0
changelog:
  - Never raise a DeviceNotFoundError when iterating over a device enumeration
  - Device.subsystem() now returns None if device has no subsystem
  - Add DeprecationWarnings to deprecated Device methods
  - Replace "/" with "!" in Device.from_name() sys_name parameter
  - Add some unstable classes for parsing some kinds of values
  - Make version info more like Python's including micro numbers and levels
  - Refactor some internal modules into subdirectories
  - Work on tests and reproducers


author: mulhern <amulhern@redhat.com> - 0.20.0
changelog:
  - Remove parsing code added in previous release
  - No longer do CI for Python 2.6
  - Eliminate all wildcard imports and __all__ statements
  - No longer use deprecated Device.from_sys_path() method
  - Minor pylint induced changes
  - Documentation fixes


author: mulhern <amulhern@redhat.com> - 0.21.1
changelog:
  - Deprecate use of Device object as mapping from udev property names to values
  - Add a Properties class and a Device.properties() method for udev properties
  - Fix places where Device object was incorrectly used in a boolean context
  - Return an empty string, not None, if the property value is an empty string
  - Exceptions re-raised from libudev calls now have a message string
  - Insert a warning about using a Device in a boolean context in docs
  - Infrastructure for vagrant tests is removed
  - Various internal refactorings
  - Extensive test improvements
  - Numerous documentation fixes


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.10.0-3
changelog:
  - Python 2 binary package renamed to python2-pywbem
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tony Asleson <tasleson@redhat.com> - 0.11.0-8
changelog:
  - Fix the conflict with sblim-wbemcli: RHBZ #1757855
  - Corrected warning about multiple file inclusion


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.12-6
changelog:
  - Python 2 binary package renamed to python2-pyyaml
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miro Hrončok <mhroncok@redhat.com> - 3.12-12
changelog:
  - Rename python3-PyYAML to python3-pyyaml
  - Modernize spec
  - Fix python2 invocation

  - Cherry-picked from: https://src.fedoraproject.org/rpms/PyYAML/pull-request/2


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-20
changelog:
  - Add --path query option (#1940895)
  - Macroize find-debuginfo script location (#2019540)
  - Validate and require subkey binding sigs on PGP pubkeys (#1958480)
  - Fixes CVE-2021-3521


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
changelog:
  - Fix spurious %transfiletriggerpostun execution (#2023693)
  - Skip recorded symlinks in --setperms (#1900662)


author: Liwei Ge <geliwei@openanolis.org> - 4.14.4-26.0.1
changelog:
  - Rebrand for Anolis OS
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Support loongarch for rpm
  - Add loongarch64 support for debugedit(doupengda@loongson.cn)
  - Modify the spec to add debugedit for loongarch64(zhangwenlong@loongson.cn)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.5-5
changelog:
  - Python 2 binary package renamed to python2-schedutils
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Vit Mojzis <vmojzis@redhat.com> - 4.2.1-3
changelog:
  - Use 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fasynchronous-unwind-tables -fstack-clash-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fasynchronous-unwind-tables -fstack-clash-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fasynchronous-unwind-tables -fstack-clash-protection


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-1
changelog:
  - SETools 4.3.0 release (#1820079)
  - Revised sediff method for TE rules. This drastically reduced memory and run time.
  - Added infiniband context support to seinfo, sediff, and apol.
  - Added apol configuration for location of Qt assistant.
  - Fixed sediff issue where properties header would display when not requested.
  - Fixed sediff issue with type_transition file name comparison.
  - Fixed permission map socket sendto information flow direction.
  - Added methods to TypeAttribute class to make it a complete Python collection.
  - Genfscon now will look up classes rather than using fixed values which
    were dropped from libsepol.
  - setools requires -console, -console-analyses and -gui packages (#1820078)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-8
changelog:
  - Python 2 binary package renamed to python2-slip
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-10
changelog:
  - Also rename python-slip-dbus and python-slip-gtk to python2-*
  - Add missing %python_provide macros
  - Use new python2- names in dependencies


author: Charalampos Stratakis <cstratak@redhat.com> - 0.6.4-12
changelog:
  - Make firewalld to not log errors when running commands as root
    in the absence of polkitd.
  Resolves: rhbz#2076606


author: Tomas Orsava <torsava@redhat.com> - 1.24.2-1
changelog:
  - Rebased to 1.24.2 to fix CVE-2019-11324
  - Added patches for CVE-2019-11236 (AKA CVE-2019-9740)
  - Resolves: rhbz#1703361 rhbz#1706026


author: Lumír Balhar <lbalhar@redhat.com> - 1.24.2-3
changelog:
  - Enable TLS 1.3 post-handshake authentication
  - Adjust RECENT_DATE variable according to rules
  Resolves: rhbz#1726743


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.3.0-11
changelog:
  - Python 2 binary package renamed to python2-urwid
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: David Cantrell <dcantrell@redhat.com> - 1.3.1-2
changelog:
  - Apply upstream fix for EINTR handling in test_vterm test case
  - Apply upstream fix for test_remove_watch_file flakiness
  - Apply upstream fix for test_vterm handling of NUL characters


author: Petr Pisar <ppisar@redhat.com> - 1:4.05-17
changelog:
  - Support grace period expirations past 2038 year for XFS
  - Add a synopsis for a project quota option in the quota tool
  - Add a --filesystem option to the quota tool
  - Complain that ext4 external quota files are deprecated


author: Petr Pisar <ppisar@redhat.com> - 1:4.06-2
changelog:
  - Remove a dead code from process_file() (upstream bug #54)
  - Fix a compilation warning in quotaops.c
  - Warn when kernel XFS large time stamp does fit into (32-bit) user-space
    time_t
  - Do not use a pointless compiler-internal __P() macro


author: Aristeu Rozanski <aris@redhat.com> 0.6.7-1
changelog:
  - Bumped to 0.6.7
  - Backported patches that sit on top of 0.6.7 without being released
    Related: rhbz#2052190


author: Sumit Bose <sbose@redhat.com> - 0.16.3-19
changelog:
  - Realm join fails with error 'Failed to join domain: failed to lookup
    DC info ...'
    Resolves: rhbz#1859503
  - realm command to use option like dnshostname=fqdn
    Resolves: rhbz#1867912


author: Sumit Bose <sbose@redhat.com> - 0.16.3-20
changelog:
  - realmd should handle default_realm in krb5.conf
    Resolves: rhbz#1791016
  - [RFE] Enable LDAPS functionality in realmd join
    Resolves: rhbz#1826964


author: Sumit Bose <sbose@redhat.com> - 0.16.3-24
changelog:
  - Avoid duplicated log messages and use Samba's new CLI options
    Resolves: rhbz#2024248
    Resolves: rhbz#2028528


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is
    incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-6
changelog:
  - Adjust rngd-wake-threshold.service and post section so udevadm is not
    run in a container (bz 1975554)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-1.git.d207e0b6
changelog:
  - Update to the upstream v6.13 + tip of origin/master + onecpu
    branch + revert of 2ce93190
  - Rebuild rng-tools against the latest jitterentropy library
    3.0.2-2.git.409828cf with fixes for an important issue
  - Fix a number of issues (bz 1974103, bz 1980421, bz 1859154)


author: Vladis Dronov <vdronov@redhat.com> - 6.14-4.git.b2b7934e
changelog:
  - Update rng-tools to v6.14 @ b2b7934e (bz 2015570)
  - Update jitterentropy library to v3.3.1 @ 887c9871
  - Add a config file for storing rngd options
  - Fix a security issue found by a covscan in jitterentropy library


author: Vladis Dronov <vdronov@redhat.com> - 6.15-1
changelog:
  - Update rng-tools to v6.15 @ 172bf0e3 (bz 2075974)
  - Update jitterentropy library to v3.4.0 @ 887c9871
  - Allow rngd process to drop privileges with "-D user:group"
  - Fix an error building with jitterentropy-3.4.0
  - Add a requirement for selinux-policy of a certain version
  - Fix a build failure on ppc64
  - Small edits in test scripts


author: Vladis Dronov <vdronov@redhat.com> - 6.15-2
changelog:
  - Update rng-tools to v6.15 @ 6dcc9ec2 (bz 2124602)
  - Update jitterentropy library to v3.4.1 @ 4544e113
  - Do not require selinux-policy if it is not present


author: Vladis Dronov <vdronov@redhat.com> - 6.15-3
changelog:
  - Update rng-tools to v6.15 @ cb8cc624 (bz 2141379)
  - Update jitterentropy library to v3.4.1 @ 7bf9f85d
  - Fix a stack corruption on s390x
  - Fix a number of issues found by covscan code scanner
  - Add a jitter init timeout for tests
  - Add a start condition for the FIPS mode (bz 2154804)


author: Ondrej Vasik <ovasik@redhat.com> 0.1-13
changelog:
  - copy content of /etc/skel directory for root as posstrans,
    don't overwrite  existing files (#999114)


author: Michal Ruprich <mruprich@redhat.com> - 3.1.3-19
changelog:
  - Resolves: #2116668 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field


author: Jakub Martisko <jamartis@redhat.com> - 4.4-4
changelog:
  - When editing file inplace, the SELinux context should
    be based on the link instead of the target file itself.
    --follow-symlinks option remains unchanged
  - Resolves: #1401442


author: Jakub Martisko <jamartis@redhat.com> - 4.5-2
changelog:
  - fix "in-place edits on FUSE filesystems create files with all-zero mode bits"
  - Resolves: #1835761


author: Jakub Martisko <jamartis@redhat.com> - 4.5-5
changelog:
  - Minor cleanup - remove unused patch from the spec file too (related to 4.5-3)
  - Resolves: rhbz#1869253


author: Mahailiang <mahailiang@openanolis.org> - 4.5-5.0.1
changelog:
  - fix testsuite/inplace-selinux.sh check error
  - Sync from https://debbugs.gnu.org/cgi/bugreport.cgi?bug=35997


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-109
changelog:
  - Add the files_map_read_etc_files() interface
  Resolves: rhbz#2132230
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230
  - Allow insights-client send null signal to rpm and system cronjob
  Resolves: rhbz#2132230
  - Update rhcd policy for executing additional commands 4
  Resolves: rhbz#2132230
  - Allow insights-client connect to postgresql with a unix socket
  Resolves: rhbz#2132230
  - Allow insights-client domtrans on unix_chkpwd execution
  Resolves: rhbz#2132230
  - Add file context entries for insights-client and rhc
  Resolves: rhbz#2132230
  - Allow snmpd_t domain to trace processes in user namespace
  Resolves: rhbz#2121084
  - Allow sbd the sys_ptrace capability
  Resolves: rhbz#2124552
  - Allow pulseaudio create gnome content (~/.config)
  Resolves: rhbz#2124387


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-110
changelog:
  - Add the systemd_connectto_socket_proxyd_unix_sockets() interface
  Resolves: rhbz#208441
  - Add the dev_map_vhost() interface
  Resolves: rhbz#2122920
  - Allow init remount all file_type filesystems
  Resolves: rhbz#2122239
  - added policy for systemd-socket-proxyd
  Resolves: rhbz#2088441
  - Allow virt_domain map vhost devices
  Resolves: rhbz#2122920
  - Allow virt domains to access xserver devices
  Resolves: rhbz#2122920
  - Allow rotatelogs read httpd_log_t symlinks
  Resolves: rhbz#2030633
  - Allow vlock search the contents of the /dev/pts directory
  Resolves: rhbz#2122838
  - Allow system cronjobs dbus chat with setroubleshoot
  Resolves: rhbz#2125008
  - Allow ptp4l_t name_bind ptp_event_port_t
  Resolves: rhbz#2130168
  - Allow pcp_domain execute its private memfd: objects
  Resolves: rhbz#2090711
  - Allow samba-dcerpcd use NSCD services over a unix stream socket
  Resolves: rhbz#2121709
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-111
changelog:
  - Add domain_unix_read_all_semaphores() interface
  Resolves: rhbz#2141311
  - Allow iptables list cgroup directories
  Resolves: rhbz#2134820
  - Allow systemd-hostnamed dbus chat with init scripts
  Resolves: rhbz#2111632
  - Allow systemd to read symlinks in /var/lib
  Resolves: rhbz#2118784
  - Allow insights-client domain transition on semanage execution
  Resolves: rhbz#2141311
  - Allow insights-client create gluster log dir with a transition
  Resolves: rhbz#2141311
  - Allow insights-client manage generic locks
  Resolves: rhbz#2141311
  - Allow insights-client unix_read all domain semaphores
  Resolves: rhbz#2141311
  - Allow winbind-rpcd use the terminal multiplexor
  Resolves: rhbz#2107106
  - Allow mrtg send mails
  Resolves: rhbz#2103675
  - Allow sssd dbus chat with system cronjobs
  Resolves: rhbz#2132922
  - Allow postfix/smtp and postfix/virtual read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-112
changelog:
  - Allow ipsec_t only read tpm devices
  Resolves: rhbz#2147380
  - Allow ipsec_t read/write tpm devices
  Resolves: rhbz#2147380
  - Label udf tools with fsadm_exec_t
  Resolves: rhbz#1972230
  - Allow the spamd_update_t domain get generic filesystem attributes
  Resolves: rhbz#2144501
  - Allow cdcc mmap dcc-client-map files
  Resolves: rhbz#2144505
  - Allow insights client communicate with cupsd, mysqld, openvswitch, redis
  Resolves: rhbz#2143878
  - Allow insights client read raw memory devices
  Resolves: rhbz#2143878
  - Allow winbind-rpcd get attributes of device and pty filesystems
  Resolves: rhbz#2107106
  - Allow postfix/smtpd read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-113
changelog:
  - Allow systemd-socket-proxyd get attributes of cgroup filesystems
  Resolves: rhbz#2088441
  - Allow systemd-socket-proxyd get filesystems attributes
  Resolves: rhbz#2088441
  - Allow sysadm read ipmi devices
  Resolves: rhbz#2148561
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111
  - Allow insights-client tcp connect to various ports
  Resolves: rhbz#2151111
  - Allow insights-client work with pcp and manage user config files
  Resolves: rhbz#2151111
  - Allow insights-client dbus chat with various services
  Resolves: rhbz#2152867
  - Allow insights-client dbus chat with abrt
  Resolves: rhbz#2152867
  - Allow redis get user names
  Resolves: rhbz#2112228
  - Add winbind-rpcd to samba_enable_home_dirs boolean
  Resolves: rhbz#2143696


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-114
changelog:
  - Add interfaces in domain, files, and unconfined modules
  Resolves: rhbz#2141311
  - Allow sysadm_t read/write ipmi devices
  Resolves: rhbz#2148561
  - Allow sudodomain use sudo.log as a logfile
  Resolves: rhbz#2143762
  - Add insights additional capabilities
  Resolves: rhbz#2158779
  - Allow insights client work with gluster and pcp
  Resolves: rhbz#2141311
  - Allow prosody manage its runtime socket files
  Resolves: rhbz#2157902
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-115
changelog:
  - Fix syntax problem in redis.te
  Resolves: rhbz#2112228
  - Allow unconfined user filetransition for sudo log files
  Resolves: rhbz#2164047
  - Allow winbind-rpcd make a TCP connection to the ldap port
  Resolves: rhbz#2152642
  - Allow winbind-rpcd manage samba_share_t files and dirs
  Resolves: rhbz#2152642
  - Allow insights-client work with su and lpstat
  Resolves: rhbz#2134125
  - Allow insights-client read nvme devices
  Resolves: rhbz#2143878
  - Allow insights-client tcp connect to all ports
  Resolves: rhbz#2143878
  - Allow redis-sentinel execute a notification script
  Resolves: rhbz#2112228


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-116
changelog:
  - Allow sysadm_t run initrc_t script and sysadm_r role access
  Resolves: rhbz#2039662
  - Allow insights-client manage fsadm pid files
  Resolves: rhbz#2166802
  - Add journalctl the sys_resource capability
  Resolves: rhbz#2136189


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-117
changelog:
  - Fix opencryptoki file names in /dev/shm
  Resolves: rhbz#2028637
  - Allow system_cronjob_t transition to rpm_script_t
  Resolves: rhbz#2154242
  - Revert "Allow system_cronjob_t domtrans to rpm_script_t"
  Resolves: rhbz#2154242
  - Allow httpd work with tokens in /dev/shm
  Resolves: rhbz#2028637
  - Allow keepalived to set resource limits
  Resolves: rhbz#2168638
  - Allow insights-client manage fsadm pid files


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.2-2
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    as we don't allow tcp_wrappers in RHEL8, #1663556)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-3
changelog:
  - add pcp user to /etc/aliases (#1744089)
  - set PATH if it is empty in csh.login (#1744104)
  - lang.csh: prevent grep from failing so scripts do not end
    prematurely when tcsh -e option in use (#1678706)
  - use full path for non-builtins (#1688302)
  - add nrpe tcp port 5666 to /etc/services (#1730396)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2044589)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#1945400)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#1917934)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.44-3
changelog:
  - Fix sg_turs help invocation in an old mode (#1683343)
  - Fix sg_raw printing error about device not specified on version request (#1627657)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-9
changelog:
  - do not mistake a regular user process for a namespaced one (#1788696)
  - add HOME_MODE support in login.defs (#1777718)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-15
changelog:
  - Creation of subid and subid-devel subpackages (#2013009)
  - libsubid: creation and nsswitch support
  - libsubid: don't print error messages on stderr by default
  - libsubid: libsubid_init return false if out of memory
  - libsubid: don't return owner in list_owner_ranges API call
  - libsubid: libsubid_init don't print messages on error
  - libsubid: fix newusers when nss provides subids
  - libsubid: make shadow_logfd not extern
  - useradd: fix SUB_UID_COUNT=0
  - man: mention NSS in new[ug]idmap manpages
  - man: clarify subid delegation


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-16
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013016
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #1986782


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-17
changelog:
  - subordinateio: also compare the owner ID. Resolves: #2093311
  - Fix release sources
  - Add subid requirement for subid-devel


author: Javier Martinez Canillas <javierm@redhat.com> - 15-12
changelog:
  - Fix firmware update bug in aarch64 caused by shim ignoring arguments
    Resolves: rhbz#1830871
  - Fix a shim crash when attempting to netboot
    Resolves: rhbz#1795654


author: Peter Jones <pjones@redhat.com> - 15-13
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-1
changelog:
  - Resolves: #1869292 Statistics Support - smc-tools part
  - Resolves: #1919225 Add SMC-D Setup Check (smc-tools)
  - Resolves: #1919240 Upgrade smc-tools to latest version


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-3
changelog:
  - Patch stats.c to fix overruns
  - Patch stats.c to fix leaks
  - Patch stats.c to fix fallback counter values
  - Resolves: #1993469


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.1-1
changelog:
  - Upgrade smc-tools to latest version
  - Add User-defined EID (Enterprise ID) Support
  - Resolves: #1919228
  - Resolves: #2043841


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.1.8-1
changelog:
  - Rebase to latest github version Snappy-1.1.8
  - Also change the URL to reflect to the updated github location.


author: Jan Jansky <jjansky@redhat.com> = 4.6.0-1
changelog:
  - [ultrapath] Add new plugin for Huawei UltraPath
    Resolves: bz2187407
  - [cleaner] Use data filter for extraction
    Resolves: bz2217906
  - [discovery] Enable the plugin by containers
    Resolves: bz2222134


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: Abhi Das <adas@redhat.com> - 4.3-19
changelog:
  - rhbz#1602698 - Fix coverity issues
    rhbz#1624173 - Fix annocheck failures
    rhbz#1716278 - limit max cpus in mksquashfs
    Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-1
changelog:
  - Rebase to v5.13; drop upstream patches on top of 5.7 (#2015917).
  - Address some issues reported by covscan.


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fix CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-6
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1738326


author: Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
changelog:
  - RHEL 8.2 ERRATUM
  - rebase to 1.8.28p1
  Resolves: rhbz#1733961
  - fixed man page for always_set_home
  Resolves: rhbz#1576880
  - sudo does not work with notbefore/after
  Resolves: rhbz#1679508
  - NOTBEFORE showing value of sudoNotAfter Ldap attribute
  Resolves: rhbz#1715516
  - CVE-2019-14287 sudo
  - Privilege escalation via 'Runas' specification with 'ALL' keyword
  Resolves: rhbz#1760697


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8
changelog:
  RHEL 8.6.0 ERRATUM
  - sudoedit does not work with selinux args
  Resolves: rhbz#2029551
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#1999751
  - [RFE] pass KRB5CCNAME to pam_authenticate environment if available
  Resolves: rhbz#1917379
  - utmp resource leak in sudo
  Resolves: rhbz#1986572


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8.1
changelog:
  RHEL 8.7.0.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161220


author: Kalev Lember <klember@redhat.com> - 3.39.92-2
changelog:
  - Split sysprof-capture library and header files out to sysprof-capture-devel
  - Update minimum required glib2 version


author: Jan Tulak <jtulak@redhat.com> - 1.2-1
changelog:
  - Upstream release 1.2 which fixes:
  - use pwquality to test password strength for cryptsetup (#1141871)
  - add multipath detection support (#1309729)
  - add migrate command (#1014708)


author: Jan Tulak <jtulak@redhat.com> - 1.2-3:
changelog:
  - Gating tests implementation, which meant adding few more changes
    to the existing patches (#1681969)
  - sphinx patch was merged to python3 change
  - add seq numbers to patch files


author: Jan Tulak <jtulak@redhat.com> - 1.4-1:
changelog:
  - Bring changes from upstream 1.4 (mostly bugfixes)
  - Remove multipath from the list of default backends (rhbz#1685019)
  - Fix locale issue (rhbz#1679587)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-69
changelog:
  - logind: optionally watch utmp for login data (#2122288)
  - logind: add hashtable for finding session by leader PID (#2122288)
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2122288)
  - sd-event: add relative timer calls (#2122288)
  - logind: add option to stop idle sessions after specified timeout (#2122288)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2122288)
  - ci(lint): add shell linter - Differential ShellCheck (#2122499)
  - meson: do not compare objects of different types (#2122499)
  - journal-remote: use MHD_HTTP_CONTENT_TOO_LARGE as MHD_HTTP_PAYLOAD_TOO_LARGE is deprecated since 0.9.74 (#2122499)
  - Fix build with µhttpd 0.9.71 (#2122499)
  - ci: replace LGTM with CodeQL (#2122499)
  - ci(mergify): Update policy - Drop LGTM checks (#2122499)
  - time-util: fix buffer-over-run (#2139391)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-70
changelog:
  - basic: recognize pdfs filesystem as a network filesystem (#2094661)
  - core: move reset_arguments() to the end of main's finish (#2127131)
  - manager: move inc. of n_reloading into a function (#2136869)
  - core: Add new DBUS properties UnitsReloadStartTimestamp and UnitsLoadTimestampMontonic (#2136869)
  - core: Indicate the time when the manager started loading units the last time (#2136869)
  - core: do not touch /run/systemd/systemd-units-load from user session instances (#2136869)
  - sysctl: downgrade message when we have no permission (#2158160)
  - core: respect SELinuxContext= for socket creation (#2136738)
  - manager: use target process context to set socket context (#2136738)
  - virt: detect Amazon EC2 Nitro instance (#2117948)
  - machine-id-setup: generate machine-id from DMI product ID on Amazon EC2 (#2117948)
  - virt: use string table to detect VM or container (#2117948)
  - fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (#2117948)
  - Use BIOS characteristics to distinguish EC2 bare-metal from VMs (#2117948)
  - device: drop refuse_after (#2043524)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-71
changelog:
  - manager: limit access to private dbus socket (#2119405)
  - journalctl: do not treat EINTR as an error when waiting for events (#2161683)
  - core: bring manager_startup() and manager_reload() more inline (#2059633)
  - pam: add a call to pam_namespace (#1861836)
  - virt: Support detection for ARM64 Hyper-V guests (#2158307)
  - virt: Fix the detection for Hyper-V VMs (#2158307)
  - basic: add STRERROR() wrapper for strerror_r() (#2155520)
  - coredump: put context array into a struct (#2155520)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155520)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-72
changelog:
  - test: import logind test from debian/ubuntu test suite (#1866955)
  - test: introduce inst_recursive() helper function (#1866955)
  - tests: verify that Lock D-Bus signal is sent when IdleAction=lock (#1866955)
  - systemctl: simplify halt_main() (#2053273)
  - systemctl: shutdown don't fallback on auth fail (#2053273)
  - systemctl: reintroduce the original halt_main() (#2053273)
  - systemctl: preserve old behavior unless requested (#2053273)
  - pam_systemd: suppress LOG_DEBUG log messages if debugging is off (#2170084)
  - udev/net_id: introduce naming scheme for RHEL-8.8 (#2170499)
  - pam: add a call to pam_namespace (#1861836)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-73
changelog:
  - journald: add API to move logging from /var to /run again (#1873540)
  - journalctl: add new --relinquish and --smart-relinquish options (#1873540)
  - units: automatically revert to /run logging on shutdown if necessary (#1873540)
  - pstore: Tool to archive contents of pstore (#2158832)
  - meson: drop redundant line (#2158832)
  - pstore: drop unnecessary initializations (#2158832)
  - pstopre: fix return value of list_files() (#2158832)
  - pstore: remove temporary file on failure (#2158832)
  - pstore: do not add FILE= journal entry if content_size == 0 (#2158832)
  - pstore: run only when /sys/fs/pstore is not empty (#2158832)
  - pstore: fix use after free (#2158832)
  - pstore: refuse to run if arguments are specified (#2158832)
  - pstore: allow specifying src and dst dirs are arguments (#2158832)
  - pstore: rework memory handling for dmesg (#2158832)
  - pstore: fixes for dmesg.txt reconstruction (#2158832)
  - pstore: Don't start systemd-pstore.service in containers (#2158832)
  - units: pull in systemd-pstore.service from sysinit.target (#2158832)
  - units: drop dependency on systemd-remount-fs.service from systemd-pstore.service (#2158832)
  - units: make sure systemd-pstore stops at shutdown (#2158832)
  - pstore: Run after modules are loaded (#2158832)
  - pstore: do not try to load all known pstore modules (#2158832)
  - logind-session: make stopping of idle session visible to admins (#2156780)
  - journald: Increase stdout buffer size sooner, when almost full (#2029426)
  - journald: rework end of line marker handling to use a field table (#2029426)
  - journald: use the fact that client_context_release() returns NULL (#2029426)
  - journald: rework pid change handling (#2029426)
  - test: Add a test case for #15654 (#2029426)
  - test: Stricter test case for #15654 (Add more checks) (#2029426)
  - man: document the new _LINE_BREAK= type (#2029426)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74
changelog:
  - journald-server: always create state file in signal handler (#2174645)
  - journald-server: move relinquish code into function (#2174645)
  - journald-server: always touch state file in signal handler (#2174645)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74.1
changelog:
  - pager: set $LESSSECURE whenver we invoke a pager (#2175623)
  - test-login: always test sd_pid_get_owner_uid(), modernize (#2175623)
  - pager: make pager secure when under euid is changed or explicitly requested (#2175623)
  - test: ignore ENOMEDIUM error from sd_pid_get_cgroup() (#2175623)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74.2
changelog:
  - pstore: fix crash and forward dummy arguments instead of NULL (#2190153)
  - ci: workflow for gathering metadata for source-git automation (#2190153)
  - ci: first part of the source-git automation - commit linter (#2190153)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74.3
changelog:
  - login: add a missing error check for session_set_leader() (#2223602)
  - logind: reset session leader if we know for a fact that it is gone (#2223602)


author: Yuanhong Peng <yummypeng@linux.alibaba.com> - 239-74.0.2.3
changelog:
  - core: fix a null reference case in load_from_path()
  - sysctl: Don't pass null directive argument to '%s'
  - exit-status: introduce EXIT_EXCEPTION mapping to 255
  - main: don't freeze PID 1 in containers, exit with non-zero instead
  - Do not go into freeze when systemd crashd
  - mount-setup: change the system mount propagation to shared by default only at bootup
  - cgroup-util: make definition of CGROUP_CONTROLLER_TO_MASK() unsigned
  - cgroup: update only siblings that got realized once
  - core: add a config item to support setting the value of cpuset.clone_children when systemd is starting
  - support loongarch for systemd
  - test-catalog: Fix coredump when compiled under GCC10
  - add Iluvatar CoreX pci id (Liwei Ge)
  - seccomp: add loongarch64 support (Liwei Ge)
  - seccomp: remove loongarch64 switch(Liwei Ge)
  - umount: check LO_FLAGS_AUTOCLEAR after LOOP_CLR_FD claimed success(yuanhui)
  - fileio: when reading a full file into memory, refuse inner NUL bytes (Guorui Yu)
  - util: introduce explicit_bzero_safe for explicit memset (Guorui Yu)
  - util: introduce erase_and_free() helper (Guorui Yu)
  - util: introduce READ_FULL_FILE_SECURE flag for reading secure data (Guorui Yu)
  - fileio: introduce warn_file_is_world_accessible() (Guorui Yu)
  - fileio: read_full_file_full() also warns when file is world readable and secure flag is set (Guorui Yu)
  - basic/fileio: Fix memory leak if READ_FULL_FILE_SECURE flag is used (Guorui Yu)
  - fileio: add explicit flag for generating world executable warning when reading file (Guorui Yu)
  - fileio: add 'dir_fd' parameter to read_full_file_full() (Guorui Yu)
  - fileio: add support for read_full_file() on AF_UNIX stream sockets (Guorui Yu)
  - fileio: beef up READ_FULL_FILE_CONNECT_SOCKET to allow setting sender socket name (Guorui Yu)
  - fileio: teach read_full_file_full() to read from offset/with maximum size (Guorui Yu)
  - cryptsetup: port cryptsetup's main key file logic over to read_full_file_full() (Guorui Yu)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.30-6
changelog:
  - added "padding with zeros" info message (#1913566)
  - do not report disk error as file shrank (#1913569)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.6-2
changelog:
  - Splitted documentation to the doc subpackage
    Resolves: rhbz#1380291
  - Fixed whitespace
  - Dropped obsoleted defattr


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.8-2
changelog:
  - Reverted _module_build macro check which fixes systemtap probes on RHEL-8
    Resolves: rhbz#1579386


author: Petr Pisar <ppisar@redhat.com> - 1.8-1
changelog:
  - 1.8 bump
  - License changed from GPLv2+ to (GPLv3+ and GFDL)
  - Disable printing command failure in POSIX mode


author: Filipe Rosset <rosset.filipe@gmail.com> - 2.5-1
changelog:
  - New upstream release 2.5 - fixes rhbz #1449666
  - https://raw.githubusercontent.com/tmux/tmux/2.5/CHANGES


author: Filipe Rosset <rosset.filipe@gmail.com> - 2.5-4
changelog:
  - Fixes rhbz #1476851 tmux bell-action other not working
  - Fixes rhbz #1476892 tmux update in F26 broke tmuxinator


author: Michal Schmidt <mschmidt@redhat.com> - 1.3.9-1
changelog:
  - Upstream release 1.3.9.
  - Add fixes for build errors with OpenSSL 1.1.
  - Add fixes for NULL cipher context use in seal/unseal.
  - spec file modernization.


author: Javier Martinez Canillas <javierm@redhat.com> - 2.0.0-1
changelog:
  - Download the distributed tarball instead of the source code tarball
  - Update URLs to point to the new project location
  - Update to 2.0.0 release


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-2
changelog:
  - Fix ESYS_TR hierarchy transition.
  - Refactor fix_esys_hierarchies to return actual TSS2_RC return code.
  - tpm2_alg_util.c: fix a bug where the string rsa3072 wasn't being parsed.
  - tpm2_create.c: Fix an issue where userwithauth attr cleared if policy specified.
  - tpm2_hierarchycontrol: Fix bug where hierarchycontrol operation failed silently.
  - tpm2_nvdefine.c: Fix error reporting message.
  - tpm2_policyor: Fix silent failure for invalid/unspecified policy digest alg.
  resolves: rhbz#1854774


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-3
changelog:
  - Fix resource leak.
  - Fix to restrict policy digest size.
  - Fix incompatible pointer cast.
  - Fix error message in files_load_##name
  - Fix issue where execution couldn't reach function return.
  resolves: rhbz#1920821


author: chench <chench@hygon.cn> -4.1.1-5.0.2
changelog:
  - Add gm support for all commands.
  - Add the gm API for tools library.
  - Add commands line arguments to support gm in some commands


author: chench <chench@hygon.cn> -4.1.1-5.0.3
changelog:
  - Add gm test case for all commands.
  - This patch tests all commands for gm support. Every script test a class of commands


author: Yunying Sun <yunying.sun@intel.com> - 2.0.0-1
changelog:
  - Update to 2.0.0 release (RHBZ#1508870)
  - Remove patch file 60-tpm-udev.rules, use upstream tpm-udev.rules instead
  - Disable ESAPI to fix build errors caused by dependency to libgcrypt 1.6.0
  - Add scriptlet to fix Rpath errors
  - Update file installation paths and names accordingly


author: Yunying Sun <yunying.sun@intel.com> - 2.0.0-2
changelog:
  - Re-enable ESAPI since gcrypt dependency is not an issue for Fedora
  - Bump release version to 2.0.0-2


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-3
changelog:
  - Add tss user if doesn't exist.
  - Update exported symbols map for libtss2-mu
  - esys: Check object handle node before calling compute_session_value
  - esys: fix resource name calculation
  - esys: fix Esys_StartAuthSession called with optional params
  - esys: fix keysize of ECC curve TPM2_ECC_NISTP224
  - esys: fixup compute_encrypted_salt error handling
  - esys: use memcmp in byte array comparison
  - esys: zero out ctx->salt after startAuthSession_finish
  - mu: Remove use of VLAs for Marshalling TPML types
  - return proper error code on memory allocation failure
  - sys: match counter variable type for cmdAuthsArray->count
  - tcti-device: getPollHandles should allow num_handles query
  - tctildr: fix segmentation fault if name_conf is too big
  resolves: rhbz#1879071 rhbz#1855180


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-4
changelog:
  - Fix hmac calculation for tpm2_clear command.
  - Remove private implementation of strndup.
  resolves: rhbz#1920825 rhbz#1940861


author: John Kacur <jkacur@redhat.com> - 2.7-8
changelog:
  - Install kernelshark manpage with kernelshark subpackage, not with trace-cmd
  Resolves: rhbz#1678252


author: Kamil Dudka <kdudka@redhat.com> - 1.7.0-11
changelog:
  - do not escape UTF-8 chars in file names by default in UTF-8 locale (#1480778)
  - modernize spec file (Group, BuildRoot, autosetup, clean, defattr)


author: Jerry Snitselaar <jsnitsel@redhat.com> - 0.3.15-1
changelog:
  - Rebase to 0.3.15
  - Fix CVE-2020-24330 CVE-2020-24331 CVE-2020-24332
  resolves: rhbz#1725782 rhbz#1877517 rhbz#1882402 rhbz#1882414


author: Leah Leshchinsky <lleshchi@redhat.com> - 0.17-2
changelog:
  - Fix typo for variable parm
  - Handle get_policy_and_rtprio exceptions
  - Remove finally block in get_policy_and_rtprio
  Resolves: rhbz#2049746


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2003833
    - profiles: fix improper parsing of include directive
      resolves: rhbz#2017924
    - disk: added support for the nvme
      resolves: rhbz#1854816
    - cpu: extended cstate force_latency syntax to allow skipping zero latency
      resolves: rhbz#2002744
    - net: added support for the txqueuelen
      resolves: rhbz#2015044
    - bootloader: on s390(x) remove TuneD variables from the BLS
      resolves: rhbz#1978786
    - daemon: don't do full rollback on systemd failure
      resolves: rhbz#2011459


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#2003833
    - tuned-gui: fixed creation of new profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.19.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2057602
    - fixed parsing of inline comments
      resolves: rhbz#2060138
    - added support for quotes in isolated_cores specification
      resolves: rhbz#1891036
    - recommend: preset balanced profile for notebook, laptop or portable if
      syspurpose is not defined
      resolves: rhbz#1896717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2133814
    - systemd: relax polkit requirement
      resolves: rhbz#2065591
    - sysvinit: fixed path
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - do not exit on duplicate config lines
      resolves: rhbz#2071418
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - API: add support for moving devices between instances
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - throughput-performance: set net.core.somaxconn to at least 2048
      resolves: rhbz#1998310
    - plugin_scheduler: do not leak FDs from the perf
      resolves: rhbz#2080227
    - plugin_cpu: added support for intel_pstate scaling driver
    - added support for the API access through the Unix Domain Socket


author: zhangbinchen <zhangbinchen@openanolis.org> - 2.20.0-1.0.1
changelog:
  - cherry-pick [38e4b97]
  - Don't require syspurpose for Anolis OS
  - Turn on balance mode for Anolis OS


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Kamil Dudka <kdudka@redhat.com> - 2.17-5
changelog:
  - do not update currency.units from network during build
  - units_cur: validate rate data from server (#1598913)


author: Jakub Martisko <jamartis@redhat.com> - 6.0-38
changelog:
  - Fix CVE-2018-1000035 - heap based buffer overflow when opening
    password protected files.
    Resolves: 1537043


author: Jakub Martisko <jamartis@redhat.com> - 6.0-40
changelog:
  - fix several possibly unterminated strings
    When copying to OEM_CP and ISO_CP strings, the string could end unterminated
    (stncpy does not append '\0').
  - Related: #1602721


author: Miloslav Trmač <mitr@redhat.com> - 1.111-10
changelog:
  - Fix a FBFS with  -Werror=format-security
    Resolves #1444750
  - Fix inconsistent dates in %changelog


author: Jiri Kucera <jkucera@redhat.com> - 1.112-2
changelog:
  - Dropped need to run autotools
  - <sys/sysmacros.h> must be now included manually
    Resolves #1611752
  - Fixed bad FSF address


author: Jiri Kucera <jkucera@redhat.com> - 1.113-2
changelog:
  - Fix typo in pam-panel-icon manpage
    Do not use deprecated selinux API
    Do not use fexecve
    Resolves: #1775931


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.10.1-3
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz #1853168)
  - Added CI gating tests (bz #1682555)
  - Resolves: bz #1682555, #1853168


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.41-14
changelog:
  - Integrated the vdo to lvm conversion tool into the vdo management script
    and modified the tool itself to correctly convert the UDS index so that
    dedupe information is not lost by conversion.
  - Resolves: rhbz#1928284


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.62-14
changelog:
  - Removed extraneous fields from the super block of a converted index.
  - Resolves: rhbz#1965546
  - Added a parameter to the lvm conversion tool to specify the amount of
    space to free up.
  - Resolves: rhbz#1966827
  - Fixed calculation of the number of expiring chapters in a converted
    index.
  - Resolves: rhbz#1975546


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.74-14
changelog:
  - Renamed vdo2LVM to vdopreparelvm and moved its installation location to
    /usr/libexec so that it is not in common default paths as this utility is
    intended to be called from LVM, not directly by users.
  - Related: rhbz#1986930


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.3-14
changelog:
  - Added a check to vdopreparelvm to determine whether it has already been
    converted.
  - Resolves: rhbz#2017843


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.7-14
changelog:
  - Fixed bugs in the vdopreparelvm check to determine whether a device has
    already been converted.
  - Resolves: rhbz#2017843
  - Fixed an issue in the vdo-by-dev tool which could result in a failure to
    start vdo devices when some devices in the vdo config file do not exist.
  - Resolves: rhbz#2022154


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.14-14
changelog:
  - Added a tool to make LVMVDO pools read/write so that support and
    debugging tools may access them.
  - Resolves: rhbz#1999640


author: - Andy Walsh <awalsh@redhat.com> - 6.2.7.17-14
changelog:
  - Fixed excessive vdo2lvm "Retrying" messages.
  - Resolves: rhbz#1986595
  - Fixed a pylint 2+ complaint in the vdo scripts.
  - Resolves: rhbz#2072131
  - Updated vdo script documentation and help text for the uuid option.
  - Resolves: rhbz#2089957


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read
  - CVE-2021-4192 vim: vulnerable to Use After Free


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0261 vim: Heap-based Buffer Overflow in block_insert() in src/ops.c
  - CVE-2022-0318 vim: heap-based buffer overflow in utf_head_off() in mbyte.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - fix test suite after fix for CVE-2022-0318
  - CVE-2022-0359 vim: heap-based buffer overflow in init_ccline() in ex_getln.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-19.3
changelog:
  - CVE-2022-1785 vim: Out-of-bounds Write
  - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
  - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-8
changelog:
  - Add support for Nutanix AHV
    resolves: rhbz#1756381
  - Add all patches since 1.18 was released, up to 1.20 and beyond.


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-17
changelog:
  - Remove ldconfig
    https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/SU3LJVDZ7LUSJGZR5MS72BMRAFP3PQQL/


author: Than Ngo <than@redhat.com> - 2.21-17
changelog:
  - Resolves: #2025709, check shell correctly 
  - Resolves: #2009547, which treats function contents as aliases when parsing ksh


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-2
changelog:
  - Fix AP mode PMF disconnection protection bypass (CVE-2019-16275)
  - Fix NULL dereference in d-bus handler when P2P control interface is removed (rh #1752780)
  - enable WIFI_DISPLAY (rh #1755941)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-3
changelog:
  - fix p2p_listen unexpectedly stopped after 5 seconds (rh #1693684)
  - allow changing 'bridge' via D-Bus (rh #1888050)
  - expose OWE configurability via D-Bus (rh #1888718)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-5
changelog:
  - P2P: Fix a corner case in peer addition based on PD Request (CVE-2021-27803)
  - Fix buffer overflow when processing P2P group information (CVE-2021-0326)


author: Pavel Reichl <preichl@redhat.com> - 3.1.8-5
changelog:
  - Batch fixing several issues
  - xfsdump: restoring inventory prevents non-directory files being restored
  -      from tape, Related: rhbz#2245677
  - xfsrestore: Files from the backup go to orphanage dir because of xfsdump
  -      issue, Related: rhbz#2245344
  - xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x,
  -      Related: RHEL-14493


author: Bill O'Donnell <billodo@redhat.com> 5.0.0-6
changelog:
  - xfs_repair: improve AG btree ptr validation (libxfs_verify_agbno) (#1887288)
  - mkfs.xfs: fix ASSERT on too-small device with stripe geometry (#1887401)
  - xfs_repair: fix rebuilding btree block less than minrecs (#1759452)


author: Bill O'Donnell <billodo@redhat.com> 5.0.0-7
changelog:
  - xfs_quota: document how the default quota is stored (#1850188)
  - xfs_db: skip type change if type_f unchanged (#1867474)


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 5.0.0-11.0.1
changelog:
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Add atomic write support (joseph.qi@linux.aliabba.com)
  - mkfs: don't trample the gid set in the protofile (hongnan.li@linux.alibaba.com)
  - Add doc sub package (fanhangbo.fhb@alibaba-inc.com)
  - Add fsck log replay support (joseph.qi@linux.aliabba.com)
  - mkfs.xfs: terminate getsubopt arrays properly (mengferry@linux.alibaba.com)
  - mkfs.xfs: fix internal logs' size (mengferry@linux.alibaba.com)
  - xfs_repair: ignore empty xattr leaf blocks (mengferry@linux.alibaba.com)


author: Rob Crittenden <rcritten@redhat.com> - 1.51.0-7
changelog:
  - lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
    (#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
  - Prevent integer overflow on m_groupSize in doProlog
    (CVE-2021-46143) (#2058560)


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.4-1
changelog:
  - rebase to 5.2.4 (rhbz#1574039), per release notes:
    https://www.mail-archive.com/xz-devel@tukaani.org/msg00295.html


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.4-2
changelog:
  - drop ppc64p7 hack, per fedora devel list discussion:
    https://lists.fedoraproject.org/archives/list/
    devel@lists.fedoraproject.org/thread/2OWD2QRDFBEC6HTPVQ7FMJENH32BWT54/
  - don't explicitly set _FILE_OFFSET_BITS, package uses AC_SYS_LARGEFILE


author: Jakub Martisko <jamartis@redhat.com> - 3.0-22
changelog:
  - Add missing linker flags
  - Port the configure patch from unzip that allows linker flags configuration
    from the spec file
  - Related: #1624188


author: Jakub Martisko <jamartis@redhat.com> - 3.0-23
changelog:
  - Set the ziperr function as noreturn
  - Fix email in the previous chnagelog entry
  - Related: #1602741


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-11
changelog:
  - IBM Z hardware-accelerated deflate for s390x architectures
  - IBM CRC32 optimalization for POWER 8+ architectures
  - fixed firefox crash due to zlib (#1741266)
  - added test for crc32


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11.19
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


