# changelog

author: Jay Fenlason <fenlason@redhat.com> 3.0.3-5
changelog:
  - Patch to allow password changes from machines patched with
    Microsoft hotfix MS04-011.
  - Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302
    and https://bugzilla.samba.org/show_bug.cgi?id=1309


author: Jay Fenlason <fenlason@redhat.com> 3.0.5.0pre1.0
changelog:
  - New upstream version
  - use % { SOURCE1 } instead of a hardcoded path
  - include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org)
    https://bugzilla.samba.org/show_bug.cgi?id=1315
    to make winbindd work against Windows versions that do not have
    128 bit encryption enabled.
  - Moved %{_bindir}/net to the -common package, so that folks who just
    want to use winbind, etc don't have to install -client in order to
    "net join" their domain.
  - New upstream version obsoletes the patches added in 3.0.3-5
  - Remove smbgetrc.5 man page, since we don't ship smbget.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-0.pre1.1
changelog:
  - Backport base64_decode patche to close CAN-2004-0500
  - Backport hash patch to close CAN-2004-0686
  - use_authtok patch from Nalin Dahyabhai <nalin@redhat.com>
  - smbclient-kerberos patch from Alexander Larsson <alexl@redhat.com>
  - passwd patch uses "*" instead of "x" for "hashed" passwords for
    accounts created by winbind.  "x" means "password is in /etc/shadow" to
    brain-damaged pam_unix module.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-2
changelog:
  - Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a
    security fix.
  - Include the 3.0.4-backport patch from the 3E branch.  This restores
    some of the 3.0.5pre1 and 3.0.5rc1 functionality.


author: Jason Vas Dias <jvdias@redhat.com> 3.0.5-3
changelog:
  - Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination
  - resulted in executables getting corrupt stacks, causing smbmnt to
  - get a SIGBUS in the mount() call (bug 127420).


author: Jay Fenlason <fenlason@redhat.com> 3.0.6-3
changelog:
  - New upstream version.
  - Include post 3.0.6 patch from "Gerald (Jerry) Carter" <jerry@samba.org>
    to fix a duplicate in the LDAP schema.
  - Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com)
    to allow correct timestamp handling on 64-bit platforms and fix #126109.
  - reenable the -pie patch.  Samba is too widely used, and too vulnerable
    to potential security holes to disable an important security feature
    like -pie.  The correct fix is to have the toolchain not create broken
    executables when programs compiled -pie are stripped.
  - Remove obsolete patches.
  - Modify this spec file to put libsmbclient.{a,so} in the right place on
    x86_64 machines.


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-3
changelog:
  - Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808
    This obsoletes the 3.0.6-schema patch.
  - Update BuildRequires line to include openldap-devel openssl-devel
    and cups-devel


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-4
changelog:
  - Update docs section to not carryover the docs/manpages directory
    This moved many files from /usr/share/doc/samba-3.0.7/docs/* to
    /usr/share/doc/samba-3.0.7/*
  - Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu)
    to correctly create libsmbclient.so.0 and to use %_initrddir instead
    of rolling our own.  This closes #132642
  - Add patch to default "use sendfile" to no, since sendfile appears to
    be broken
  - Add patch from Volker Lendecke <vl@samba.org> to help make
    ldapsam_compat work again.
  - Add patch from "Vince Brimhall" <vbrimhall@novell.com> for ldapsam_compat
    These two patches close bugzilla #132169


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies
    smbmnt to work with 32-bit uids.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.2
changelog:
  - Re-enable the x_fclose patch that was accidentally disabled
    in 3.0.8-0.pre1.1.  This closes #135832
  - include Nalin's -fqdn and -salt patches.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.3
changelog:
  - disable the -salt patch, because it causes undefined references in
    libsmbclient that prevent gnome-vfs from building.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-2
changelog:
  - New upstream version fixes CAN-2004-0930.  This obsoletes the
    disable-sendfile, salt, signing-shortkey and fqdn patches.
  - Add my <fenlason@redhat.com> ugly non-ascii-domain patch.
  - Updated the pie patch for 3.0.8.
  - Updated the logfiles patch for 3.0.8.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3
changelog:
  - Include the corrected docs tarball, and use it instead of the
    obsolete docs from the upstream 3.0.8 tarball.
  - Update the logfiles patch to work with the updated docs.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3.1
changelog:
  - Rescue the install.mount.smbfs patch from Juanjo Villaplana
    (villapla@si.uji.es) to prevent building the srpm from trashing your
    installed /usr/bin/smbmount


author: Than Ngo <than@redhat.com> 3.0.8-4
changelog:
  - fix unresolved symbols in libsmbclient which caused applications
    such as KDE's konqueror to fail when accessing smb:// URLs. #139894


author: Jay Fenlason <fenlason@redhat.com> 3.0.9-2
changelog:
  - New upstream release.  This obsoletes the -secret patch.
    Include my changetrustpw patch to make "net ads changetrustpw" stop
    aborting.  This closes #134694
  - Remove obsolete triggers for ancient samba versions.
  - Move /var/log/samba to the -common rpm.  This closes #76628
  - Remove the hack needed to get around the bad docs files in the
    3.0.8 tarball.
  - Change the comment in winbind.init to point at the correct pidfile.
    This closes #76641


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-2
changelog:
  - New upstream release that closes CAN-2004-1154  bz#142544
  - Include the -64bit patch from Nalin.  This closes bz#142873
  - Update the -logfiles patch to work with 3.0.10
  - Create /var/run/winbindd and make it part of the -common rpm to close
    bz#142242


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-4
changelog:
  - Update the -man patch to fix ntlm_auth.1 too.
  - Move pam_smbpass.so to the -common package, so both the 32
    and 64-bit versions will be installed on multiarch platforms.
    This closes bz#143617
  - Added new -delim patch to fix mount.cifs so it can accept
    passwords with commas in them (via environment or credentials
    file) to close bz#144198


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-3
changelog:
  - add -gcc4 patch to compile with gcc 4.
  - remove the now obsolete -smbclient-kerberos.patch
  - Include four upstream patches from
    http://samba.org/~jerry/patches/post-3.0.11/
    (Slightly modified the winbind_find_dc_v2 patch to apply easily with
    rpmbuild).


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-4
changelog:
  - Use the updated filter-requires-samba.sh file, so we don't accidentally
    pick up a dependency on perl(Crypt::SmbHash)


author: Jay Fenlason <fenlason@redhat.com> 3.0.13-2
changelog:
  - New upstream release
  - add my -quoting patch, to fix swat with strings that contain
    html meta-characters, and to use correct quote characters in
    lists, closing bz#134310
  - include the upstream winbindd_2k3sp1 patch
  - include the -smbclient patch.
  - include the -hang patch from upstream.


author: Jay Fenlason <fenlason@redhat.com> 3.0.14a-2
changelog:
  - New upstream release.
  - the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1,
    winbind_find_dc_v2 patches are now obsolete.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20-2
changelog:
  - New upstream release
    Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3,
      -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1
    This obsoletes the -pie and -delim patches
    the -warning and -gcc4 patches are obsolete too
    The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1
    Also, the -quoting patch was implemented differently upstream
    There is now a umount.cifs executable and manpage
    We run autogen.sh as part of the build phase
    The testprns command is now gone
    libsmbclient now has a man page
  - Include -bug106483 patch to close
    bz#106483 smbclient: -N negates the provided password, despite documentation
  - Added the -warnings patch to quiet some compiler warnings.
  - Removed many obsolete patches from CVS.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20b-2
changelog:
  - turn on -DLDAP_DEPRECATED to allow access to ldap functions that have
    been depricated in 2.3.11, but which don't have well-documented
    replacements (ldap_simple_bind_s(), for example).
  - Upgrade to 3.0.20b, which includes all the previous upstream patches.
  - Updated the -warnings patch for 3.0.20a.
  - Include  --with-shared-modules=idmap_ad,idmap_rid to close
    bz#156810 --with-shared-modules=idmap_ad,idmap_rid
  - Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close
    bz#170259 pam_stack is deprecated


author: Jay Fenlason <fenlason@redhat.com> 3.0.21b-2
changelog:
  - New upstream version.
  - Since the rawhide kernel has dropped support for smbfs, remove smbmount
    and smbumount.  Users should use mount.cifs instead.
  - Upgrade to 3.0.21b


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-0.RC3
changelog:
  - New upstream RC release.
  - Update the -logfiles, and -passwd patches for
    3.0.23rc3
  - Include the change to smb.init from Bastien Nocera <bnocera@redhat.com>)
    to close
    bz#182560 Wrong retval for initscript when smbd is dead
  - Update this spec file to build with 3.0.23rc3
  - Remove the -install.mount.smbfs patch, since we don't install
    mount.smbfs any more.


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-2
changelog:
  - New upstream release.
  - Use modified filter-requires-samba.sh from packaging/RHEL/setup/
    to get rid of bogus dependency on perl(Unicode::MapUTF8)
  - Update the -logfiles and -smb.conf patches to work with 3.0.23


author: Jay Fenlason <fenlason@redhat.com> 3.0.23a-3
changelog:
  - Fix the -logfiles patch to close
    bz#199607 Samba compiled with wrong log path.
    bz#199206 smb.conf has incorrect log file path


author: Simo Sorce <ssorce@redhat.com> 3.0.24-2.fc7
changelog:
  - New upstream release
  - Fix packaging issue wrt idmap modules used only by smbd
  - Addedd Vista Patchset for compatibility with Windows Vista
  - Change default of "msdfs root", it seem to cause problems with
    some applications and it has been proposed to change it for
    3.0.25 upstream


author: Simo Sorce <ssorce@redhat.com> 3.0.24-3.fc7
changelog:
  - Directories reorg, tdb files must go to /var/lib, not
    to /var/cache, add migration script in %post common
  - Split out libsmbclient, devel and doc packages
  - Remove libmsrpc.[h|so] for now as they are not really usable
  - Remove kill -HUP from rotate, samba use -HUP for other things
    noit to reopen logs


author: Simo Sorce <ssorce@redhat.com> 3.0.24-5.fc7
changelog:
  - actually use the correct samba.pamd file not the old samba.pamd.stack file
  - fix logifles and use upstream convention of log.* instead of our old *.log
    Winbindd creates its own log.* files anyway so we will be more consistent
  - install our own (enhanced) default smb.conf file
  - Fix pam_winbind acct_mgmt PAM result code (prevented local users from
    logging in). Fixed by Guenther.
  - move some files from samba to samba-common as they are used with winbindd
    as well


author: Simo Sorce <ssorce@redhat.com> 3.0.24-6.fc7
changelog:
  - do not put comments inline on smb.conf options, they may be read
    as part of the value (for example log files names)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-7.fc7
changelog:
  - make winbindd start earlier in the init process, at the same time
    ypbind is usually started as well
  - add a sepoarate init script for nmbd called nmb, we need to be able
    to restart nmbd without dropping al smbd connections unnecessarily


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - remove patch for bug 106483 as it introduces a new bug that prevents
    the use of a credentials file with the smbclient tar command
  - move the samba private dir from being the same as the config dir
    (/etc/samba) to /var/lib/samba/private


author: Simo Sorce <ssorce@redhat.com> 3.0.24-9.fc7
changelog:
  - integrate most of merge review proposed changes (bug #226387)
  - remove libsmbclient-devel-static and simply stop shipping the
    static version of smbclient as it seem this is deprecated and
    actively discouraged


author: Simo Sorce <ssorce@redhat.com> 3.0.24-10.fc7
changelog:
  - set passdb backend = tdbsam as default in smb.conf
  - remove samba-docs dependency from swat, that was a mistake
  - put back COPYING and other files in samba-common
  - put examples in samba not in samba-docs
  - leave only stuff under docs/ in samba-doc


author: Guenther Deschner <gdeschner@redhat.com> 3.0.24-11.fc7
changelog:
  - enable PAM and NSS dlopen checks during build
  - fix unresolved symbols in libnss_wins.so (bug #198230)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-12.fc7
changelog:
  - fixes in smb.conf
  - advice in smb.conf to put scripts in /var/lib/samba/scripts
  - create /var/lib/samba/scripts so that selinux can be happy
  - fix Vista problems with msdfs errors


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - fixes in the spec file
  - moved to 3.0.25rc1
  - addedd patches (merged upstream so they will be removed in 3.0.25rc2)


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - update to 3.0.25a as it contains many fixes
  - add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut.


author: Simo Sorce <ssorce@redhat.com> 3.2.0-0.pre1.fc9
changelog:
  - New major relase, minor switched from 0 to 2
  - License change, the code is now GPLv3+
  - Numerous improvements and bugfixes included
  - package libsmbsharemodes too
  - remove smbldap-tools as they are already packaged separately in Fedora
  - Fix bug 245506


author: Simo Sorce <ssorce@redhat.com> - 3.2.0-0.pre1.3
changelog:
  - Try to fix GCC 4.3 build
  - Add --with-dnsupdate flag and also make sure other flags are required just to
    be sure the features are included without relying on autodetection to be
    successful


author: Guenther Deschner <gdeschner@redhat.com> - 3.3.0-0.25
changelog:
  - Update to 3.3.0 final
  - Add upstream fix for ldap connections to AD (Bug #6073)
  - Remove bogus perl dependencies (resolves: #473051)


author: Simo Sorce <ssorce@redhat.com> - 3.3.1-0.29
changelog:
  - Make the talloc and ldb packages optionsl and disable their build within
    the samba3 package, they are now built as part of the samba4 package
    until they will both be released as independent packages.


author: Simo Sorce <ssorce@redhat.com> - 3.3.2-0.33
changelog:
  - Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the
    configuration
  - Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on
    startup, causing your own machine not to show up in the network for 5 minutes
    if it was the only client in that workgroup (fix committed upstream)


author: Guenther Deschner <gdeschner@redhat.com> - 3.4.0-0.41
changelog:
  - Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX)
  - Specify required talloc and tdb version for BuildRequires


author: Simo Sorce <ssorce@redhat.com> - 3.4.2-47
changelog:
  - Spec file cleanup
  - Fix sources upstream location
  - Remove conditionals to build talloc and tdb, now they are completely indepent
    packages in Fedora
  - Add defattr() where missing
  - Turn all tabs into 4 spaces
  - Remove unused migration script
  - Split winbind-clients out of main winbind package to avoid multilib to include
    huge packages for no good reason


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.3-60
changelog:
  - Update to 3.5.3
  - Make sure nmb and smb initscripts return LSB compliant return codes
  - Fix winbind over ipv6


author: Andreas Schneider <asn@redhat.com> - 2:3.6.5-88
changelog:
  - Move tmpfiles.d config to common package as it is needed for smbd and
    winbind.
  - Make sure tmpfiles get created after installation.


author: Ville Skyttä <ville.skytta@iki.fi> - 2:3.6.6-92
changelog:
  - Call ldconfig at libwbclient and -winbind-clients post(un)install time.
  - Fix empty localization files, use %find_lang to find and %lang-mark them.
  - Escape macros in %changelog.
  - Fix source tarball URL.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.0-154.rc3
changelog:
  - Update to 4.0.0rc3.
  - resolves: #805562 - Unable to share print queues.
  - resolves: #863388 - Unable to reload smbd configuration with systemctl.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.0-160.rc3
changelog:
  - resolves: #867893 - Move /var/log/samba to samba-common package for
                        winbind which requires it.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.2-1
changelog:
  - Update to Samba 4.0.2.
  - Fixes CVE-2013-0213.
  - Fixes CVE-2013-0214.
  - resolves: #906002
  - resolves: #905700
  - resolves: #905704
  - Fix conn->share_access which is reset between user switches.
  - resolves: #903806
  - Add missing example and make sure we don't introduce perl dependencies.
  - resolves: #639470


author: Andreas Schneider <asn@redhat.com> - 2:4.0.3-1
changelog:
  - Update to Samba 4.0.3.
  - resolves: #907544 - Add unowned directory /usr/lib64/samba.
  - resolves: #906517 - Fix pidl code generation with gcc 4.8.
  - resolves: #908353 - Fix passdb backend ldapsam as module.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.4-3
changelog:
  - resolves: #919405 - Fix and improve large_readx handling for broken clients.
  - resolves: #924525 - Don't use waf caching.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.5-1
changelog:
  - Update to Samba 4.0.5.
  - Add UPN enumeration to passdb internal API (bso #9779).
  - resolves: #928947 - samba-doc is obsolete now.
  - resolves: #948606 - LogRotate should be optional, and not a hard "Requires".


author: Andreas Schneider <asn@redhat.com> - 2:4.0.7-2
changelog:
  - resolves: #972692 - Build with PIE and full RELRO.
  - resolves: #884169 - Add explicit dependencies suggested by rpmdiff.
  - resolves: #981033 - Local user's krb5cc deleted by winbind.
  - resolves: #984331 - Fix samba-common tmpfiles configuration file in wrong
                        directory.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.2
changelog:
  - resolves: #985985 - Fix file conflict between samba and wine.
  - resolves: #985107 - Add support for new default location for Kerberos
                        credential caches.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.7
changelog:
  - related: #985609 - Update to Samba 4.1.0rc3.
  - resolves: #1005422 - Add support for KEYRING ccache type in pam_winbindd.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.8
changelog:
  - related: #985609 - Update to Samba 4.1.0rc4.
  - resolves: #1010722 - Split out a samba-winbind-modules package.


author: Andreas Schneider <asn@redhat.com> - 4.1.0-2
changelog:
  - resolves: #1018856 - Fix installation of pam_winbind after upgrade.
  - related: #1010722 - Split out a samba-winbind-modules package.
  - related: #985609


author: Andreas Schneider <asn@redhat.com> - 4.1.0-4
changelog:
  - related: #884169 - Add direct dependency to samba-libs in the
                       glusterfs package.
  - resolves: #996567 - Fix userPrincipalName composition.
  - related: #884169 - Fix memset call with zero length in in ntdb.


author: Andreas Schneider <asn@redhat.com> - 4.1.3-1
changelog:
  - Update to Samba 4.1.3.
  - resolves: #1039454 - CVE-2013-4408.
  - resolves: #1039500 - CVE-2012-6150.


author: Andreas Schneider <asn@redhat.com> - 4.2.0-0.3.rc2
changelog:
  - resolves: #1174412 - Build VFS Ceph module.
  - resolves: #1169067 - Move libsamba-cluster-support.so to samba-libs package.
  - resolves: #1016122 - Move smbpasswd to samba-common package.


author: Michael Adam <madam@redhat.com> - 4.2.0-0.2.rc3
changelog:
  - Improve dependencies of vfs-glusterfs and vfs-cephfs.
  - Remove unused python_libdir.
  - Fix malformed changelog entries.


author: Andreas Schneider <asn@redhat.com> - 4.2.0-2
changelog:
  - Fix the AD build.
  - Create samba-client-libs subpackage.
  - Fix multiarch issues by splitting the samba-common package.


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-5
changelog:
  - Require samba-common-tools in samba package
  - Require samba-common-tools in samba-client package
  - resolves: #1215631 - /usr/bin/net moved to samba-common-tools but the package is not required by samba


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-7
changelog:
  - Fix LSASD daemon
  - resolves: #1217346 - FreeIPA trusts to AD broken due to Samba 4.2 failure to run LSARPC pipe externally


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-8
changelog:
  - Fixes: #1219832: Samba 4.2 broke FreeIPA trusts to AD
  - Remove usage of deprecated API from gnutls


author: Andreas Schneider <asn@redhat.com> - 4.2.2-1
changelog:
  - resolves: #1227911 - Enable tar support for smbclient
  - resolves: #1234908 - Own the /var/lib/samba directory
  - Enable hardened build


author: Guenther Deschner <gdeschner@redhat.com> - 4.3.3-0
changelog:
  - Update to Samba 4.3.3
  - resolves: #1292069
  - CVE-2015-3223 Remote DoS in Samba (AD) LDAP server
  - CVE-2015-5252 Insufficient symlink verification in smbd
  - CVE-2015-5296 Samba client requesting encryption vulnerable to
                  downgrade attack
  - CVE-2015-5299 Missing access control check in shadow copy code
  - CVE-2015-7540 DoS to AD-DC due to insufficient checking of asn1
                  memory allocation


author: Guenther Deschner <gdeschner@redhat.com> - 4.4.0-0.7.rc4
changelog:
  - Update to Samba 4.4.0rc4
  - resolves: #1315942 - CVE-2015-7560 Incorrect ACL get/set allowed on symlink path


author: Guenther Deschner <gdeschner@redhat.com> - 4.4.2-1
changelog:
  - Update to Samba 4.4.2, fix badlock security bug
  - resolves: #1326453 - CVE-2015-5370
  - resolves: #1326453 - CVE-2016-2110
  - resolves: #1326453 - CVE-2016-2111
  - resolves: #1326453 - CVE-2016-2112
  - resolves: #1326453 - CVE-2016-2113
  - resolves: #1326453 - CVE-2016-2114
  - resolves: #1326453 - CVE-2016-2115
  - resolves: #1326453 - CVE-2016-2118


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.0-3
changelog:
  - auth/credentials: Always set the the realm if we set the principal from the ccache
  - resolves: #1430761 - credentials_crb5: use gss_acquire_cred for client-side GSSAPI use case


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.0-4
changelog:
  - Export arcfour_crypt_blob to Python as samba.crypto.arcfour_encrypt
  - Makes possible to run trust to AD in FreeIPA in FIPS mode


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-0.5.rc1
changelog:
  - Convert more rpc modules to python3
  - Explicitly specify Python artifacts in the spec to be able to catch unpackaged ones
  - Split 'make test' Python code into separate python2-samba-test/python3-samba-test sub-packages
  - Remove embedded python2-dns version, require python{2,3}-dns instead


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-0.6.rc1
changelog:
  - Use Python 2 explicitly for samba-tool and other Python-based tools
  - Install samba.service as it is required for the AD DC case


author: Guenther Deschner <gdeschner@redhat.com> - 4.7.0-12
changelog:
  - Update to Samba 4.7.0
  - resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-13
changelog:
  - Move /usr/lib{64,}/samba/libdsdb-garbage-collect-tombstones-samba4.so to samba-dc-libs
  - Rebuild in rawhide against new krb5 1.16 and docbook-xml


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-18
changelog:
  - Force samba-dc to use the same libldb version as LDB modules compiled
  - resolves: #1507420 - LDB / Samba module version mismatch


author: Guenther Deschner <gdeschner@redhat.com> - 4.8.0-7
changelog:
  - resolves: #1554754, #1554756 - Security fixes for CVE-2018-1050 CVE-2018-1057
  - resolves: #1555112 - Update to Samba 4.8.0


author: Petr Viktorin <pviktori@redhat.com> - 4.8.3-2
changelog:
  - Use %{__python2}, not "python", as the Python2 interpreter
  - Add workaround to allow building with Python 2
  - Change unversioned python macros to python2
  - Disable gluster temporarily


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc3-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc3
  - resolves: #1554753 - Fix CVE-2018-1050
  - resolves: #1617912 - Fix CVE-2018-10858
  - resolves: #1617913 - Fix CVE-2018-10918
  - resolves: #1617914 - Fix CVE-2018-10919
  - resolves: #1617915 - Fix CVE-2018-1139
  - resolves: #1612522 - Manpage fixes


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc5-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc5
  - resolves: #1610909 - Re-enable glubsterfs vfs module
  - resolves: #1624170 - Build with -fstack-protectore-strong if available
  - resolves: #1602685 - Fixed issues found by covscan


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.9.1-3
changelog:
  - Temporarily remove smbtorture from samba-test due to Python 2 linkage
  - related: #1609661 - samba-test package cannot be installed due to unresolved dependencies


author: Andreas Schneider <asn@redhat.com> - 4.9.1-5
changelog:
  - resolves: #1644327 - Segfault if wrong 'passdb backend' is configured
  - resolves: #1647959 - Segfault in the debug system with hardended build


author: Andreas Schneider <asn@redhat.com> - 4.9.1-6
changelog:
  - resolves: #1642092 - Harden [homes] share export
  - resolves: #1648846 - Fix out of bound array access in ctdb
  - resolves: #1657266 - Fix tmp directory creation in /run


author: Andreas Schneider <asn@redhat.com> - 4.9.1-7
changelog:
  - resolves: #1658690 - Add smbc_setOptionProtocols()
  - resolves: #1658678 - Fix spoolss client operations against Windows


author: Andreas Schneider <asn@redhat.com> - 4.10.4-0
changelog:
  - related: #1638001 - Rebase to Samba version 4.10.4
  - resolves: #1597298 - Build Samba with python3
  - resolves: #1658558 - Add 'net ads leave --keep-account' option
  - resolves: #1669004 - Fix systemd status notifications
  - resolves: #1672167 - Fix printing cache timeout in debug output
  - resolves: #1696525 - Fix CVE-2019-3880


author: Andreas Schneider <asn@redhat.com> - 4.10.4-1
changelog:
  - resolves: #1712378 - Fix smbspool CUPS backend
  - resolves: #1696612 - Fix 'net ads join -U admin@parentdomain'


author: Andreas Schneider <asn@redhat.com> - 4.10.4-100
changelog:
  - resolves: #1754575 - Avoid overlinking with librt and libpthread
  - resolves: #1755440 - Fix forest trusts enumeration
  - resolves: #1755445 - Fix CUPS username/password authentication with smbspool


author: Andreas Schneider <asn@redhat.com> - 4.11.2-1
changelog:
  - resolves: #1754409 - Rebase to Samba version 4.11.2
  - resolves: #1776312 - Winbind is not restarted on upgrade
  - resolves: #1764469 - Fix CVE-2019-10218
  - resolves: #1746241 - Fix CVE-2019-10197
  - resolves: #1710980 - Add support for KCM ccache in pam_winbind


author: Andreas Schneider <asn@redhat.com> - 4.11.2-4
changelog:
  - related: #1754409 - Add patch to avoid overlinking with libnsl and libsocket
  - related: #1754409 - Fix permissions for pidl
  - related: #1754409 - Fix logrotate script
  - related: #1754409 - Add missing README files


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.11.2-10
changelog:
  - resolves: #1790353 - Fix access check in DsRGetForestTrustInformation
  - resolves: #1791209 - Fix CVE-2019-14907


author: Andreas Schneider <asn@redhat.com> - 4.11.2-12
changelog:
  - related: #1781232 - Improve debug output of smbclient
  - resolves: #1794461 - Do not return bogus inode numbers in
                         cli_qpathinfo2()/cli_qpathinfo3() for SMB1
  - resolves: #1794442 - Fix segfault in smbd_do_qfilepathinfo()


author: Andreas Schneider <asn@redhat.com> - 4.12.3-0
changelog:
  - resolves: #1817557 - Rebase to version 4.12.3
  - resolves: #1813833 - Fix 'net ads join createupn='


author: Andreas Schneider <asn@redhat.com> - 4.12.3-1
changelog:
  - resolves: #1666737 - Add a new smbc_readdirplus2() function to libsmbclient
  - resolves: #1842844 - Fix GnuTLS priority list for TLS connections


author: Isaac Boukris <iboukris@redhat.com> - 4.12.3-4
changelog:
  - resolves: #1850980 - Add "additional dns hostname" to keytab
  - resolves: #1850981 - Add net-ads-join dnshostname=fqdn option


author: Andreas Schneider <asn@redhat.com> - 4.12.3-5
changelog:
  - resolves: #1823612 - Fix segfault in 'net ads dns gethostbyname'
  - resolves: #1792553 - Fix 'net ads join createcomputer=OU'


author: Andreas Schneider <asn@redhat.com> - 4.12.3-7
changelog:
  - resolves: #1855711 - Fix 'require_membership_of' documentation in
                         pam_winbind manpage


author: Andreas Schneider <asn@redhat.com> - 4.12.3-9
changelog:
  - related: #1817557 - Move DECRPC mdssvc data files to correct package
  - resolves: #1856676 - Fix lookuprids in winbind


author: Andreas Schneider <asn@redhat.com> - 4.13.2-1
changelog:
  - resolves: #1878109 - Rebase Samba to version 4.13.2
  - resolves: #1872833 - Add samba-winexe subpackage
  - resolves: #1891688 - Fix CVE-2020-14323
  - resolves: #1892633 - Fix CVE-2020-14318
  - resolves: #1892639 - Fix CVE-2020-14383
  - resolves: #1879835 - Fix CVE-2020-1472
  - resolves: #1888990 - Update smb.conf manpages to describe how to apply
                         config changes.
  - resolves: #1869702 - Fix %U substitution for 'valid users' option
  - resolves: #1818038 - Improve FIPS compliance


author: Andreas Schneider <asn@redhat.com> - 4.13.2-2
changelog:
  - related: #1869702 - Fix spoolss crash
  - resolves: #1896736 - Fix name lookups of FreeIPA users
  - resolves: #1899113 - Fix DFS links


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.14.4-2
changelog:
  - resolves: rhbz#1944657 - Update to version 4.14.4
  - resolves: rhbz#1949445 - Fix CVE-2021-20254
  - resolves: rhbz#1947945 - Fix libsmbldap.so.2 not being a symbolic link
  - resolves: rhbz#1908506 - Fix creating the gencache user directory
  - resolves: rhbz#1901029 - Build the vfs_io_uring module


author: Andreas Schneider <asn@redhat.com> - 4.14.4-0
changelog:
  - related: rhbz#1944657 - Update to version 4.14.5
  - resolves: rhbz#1969787 - Fix memory leak in RPC server
  - resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
  - resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
  - resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
  - resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags


author: Andreas Schneider <asn@redhat.com> - 4.14.4-1
changelog:
  - resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
  - resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message


author: Andreas Schneider <asn@redhat.com> - 4.14.4-3
changelog:
  - resolves: rhbz#2019662 - Fix CVE-2016-2124
  - resolves: rhbz#2019668 - Fix CVE-2021-23192
  - resolves: rbhz#2019674 - Fix CVE-2020-25717


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.2-1
changelog:
  - resolves: rhbz#2013596 - Rebase to version 4.15.2
  - resolves: rhbz#1999294 - Remove noisy error message in winbindd
  - resolves: rhbz#1958881 - Don't require winbind being online for krb5 auth
                             with one-way trusts
  - resolves: rhbz#2019461 - Fix deleting directories with dangling symlinks


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.3-1
changelog:
  - related: rhbz#2013596 - Rebase to version 4.15.3
  - resolves: rhbz#2028029 - Fix possible null pointer dereference in winbind
  - resolves: rhbz#1912549 - Winexe: Kerberos Auth is respected via --use-kerberos=desired


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.4-0
changelog:
  - Update to Samba 4.15.4
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2039153 - Fix CVE-2021-20316
  - resolves: rhbz#1912549 - Winexe: Kerberos flag not invoking Kerberos Auth
  - resolves: rhbz#2039157 - Fix CVE-2021-43566
  - resolves: rhbz#2038148 - Failed to authenticate users after upgrade samba package to release samba-4.14.5-7
  - resolves: rhbz#2035528 - [smb] Segmentation fault when joining the domain
  - resolves: rhbz#2038796 - filename_convert_internal: open_pathref_fsp [xxx] failed: NT_STATUS_ACCESS_DENIED


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-0
changelog:
  - Update to Samba 4.15.5
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2046127 - Fix CVE-2021-44141
  - resolves: rhbz#2046153 - Fix CVE-2021-44142
  - resolves: rhbz#2044404 - Printing no longer works on Windows 7
  - resolves: rhbz#2043154 - Fix systemd notifications
  - resolves: rhbz#2049602 - Disable NTLMSSP for ldap client connections (e.g. libads)


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-1
changelog:
  - resolves: #1995849 - [RFE] Change change password change prompt phrasing
  - resolves: #2029417 - virusfilter_vfs_openat: Not scanned: Directory or special file


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-6
changelog:
  - resolves: rhbz#2059151 - Fix username map for unix groups
  - resolves: rhbz#2065212 - Fix 'create krb5 conf = yes` when a KDC has a single IP address.


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.3-0
changelog:
  - related: rhbz#2077468 - Rebase Samba to 4.16.3
  - resolves: rhbz#2106672 - The pcap background queue process should not be stopped
  - resolves: rhbz#2106263 - Fix crash in rpcd_classic
  - resolves: rhbz#2100093 - Fix net ads info returns LDAP server and LDAP server name


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.4-1
changelog:
  - resolves: rhbz#2221594 - Fix broken symlink for libwbclient
  - resolves: rhbz#2221600 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
  - resolves: rhbz#2175385 - Fix access of Samba share with veto files = /.*/
  - resolves: rhbz#2218237 - Fix Python tarfile extraction to avoid a warning


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-0
changelog:
  - resolves: rhbz#2222894 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-1
changelog:
  - related: rhbz#2190417 - Update to version 4.18.6
  - resolves: rhbz#2232564 - Fix the rpc dsgetinfo command


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.3-1
changelog:
  - resolves: RHEL-16483 - Update to version 4.19.3
  - resolves: RHEL-11361
              - Fix CVE-2023-3961 CVE-2023-4091 CVE-2023-42669
  - resolves: RHEL-2228  - Logging Format Enhancement
  - resolves: RHEL-1965  - Fix smbget issues with DFS shares
  - resolves: RHEL-2108  - Fix force user/group issues with 'allow trusted domains = yes'
  - resolves: RHEL-17122 - Fix memory corruption in libnss_winbind


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-2
changelog:
  - Fix error in PREIN scriptlet in rpm package samba-common
  - related: RHEL-16483 - Update to version 4.19.4


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-10
changelog:
  - resolves: RHEL-101902 - Fix DC discovery after Windows netlogon hardening - follow-up
  - resolves: RHEL-111318 - Fix winbind fork bomb in 'IPA with AD trust' environment


author: Matej Habrnal <mhabrnal@redhat.com> 0.21-1
changelog:
  - New upstream version
    - Introduce 'serial' field in uReport
    - normalization: actualize list of functions


author: Jakub Filak <jakub@thefilaks.net> 0.22-1
changelog:
  - New upstream version
    - Added support fof JavaScript (V8) stack traces
    - Most parts of the in-hook core unwinder callable under unprivileged user
    - GDB core unwinder limits number of unwound frames
    - Fixed a pair of compile warnings - Chris Redmon <credmonster@gmail.com>


author: Matej Habrnal <mhabrnal@redhat.com> 0.23-1
changelog:
  - New upstream version
    - Allow rpm to be optional at build time
    - Do not use deprecated fedorahosted.org


author: Julius Milan <jmilan@redhat.com> 0.24-1
changelog:
  - New upstream version
    - Allow to report unpackaged problems
    - apidoc: generate html docs using doxygen
    - Fix parsing of subset of arm kernel oopses


author: Martin Kutlak <mkutlak@redhat.com> 0.25-1
changelog:
  - New upstream version
   - Normalization: actualize list of functions
   - Fix some compilation warnings
   - Allow to build python3 for rhel8
   - Makefile: add make release-* subcommands
   - Elfutils: Add missing stubs from earlier commit


author: Matej Habrnal <mhabrnal@redhat.com> 0.26-1
changelog:
  - spec: fix Allow python2 to be optional at build time
  - Allow python2 to be optional at build time
  - normalization: actualize list of functions
  - Append Python interpreter as related package
  - makefile: create .tar.xz with make release


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.2-1
changelog:
  - rebase to upstream v1.4.2
  - make sbd default to do pacemakerd-api handshake
  - conflict with pacemaker-libs < 2.0.5-4 to assure pacemaker
    is defaulting to pacemakerd-api handshake

    Resolves: rhbz#1903730
    Resolves: rhbz#1873135


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.2-3
changelog:
  - change the default for SBD_WATCHDOG_TIMEOUT to 10s
    s390(x) stays at 15s as before

    Resolves: rhbz#1922143


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.0-2
changelog:
  - reverted watchdog_timeout_default to 5s
    (slipped in via an unreleased change on 8.4.0 branch)

    Resolves: rhbz#1980797


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-1
changelog:
  - rebase to upstream v1.5.2
  - convert license naming to SPDX
  - make static analysis happy with a few checks & rearanges with
    dynamic-memory-management

    Resolves: rhbz#2168567


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-2
changelog:
  - add required tests subdirectory in addition to gating.yaml
    that had already been brought over before

    Related: rhbz#2168567


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-10
changelog:
  - Fix docdir patch (patch Makefile.am, not Makefile.in)
  - Use correct short name for Eclipse Public License 1.0
  - Use %license
  - Add explicit dependencies for libraries in Makefile.am (fixes FTBFS)
    Resolves: #1606302


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-14
changelog:
  - Fix getting of InstallDate property, improve it to work on non en_US locales
    and update support for recent Fedora distributions
    Resolves: #1776670


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.9-24
changelog:
  - Fix important coverity issues
    Resolves: #1989603
  - Fix incorrect use of temporary paths
    Resolves: #1989605


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.5.0-1
changelog:
  - Update to latest upstream version
  - Change license to Eclipse Public License 1.0
  - Use %license
  - Fix URL


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-10
changelog:
  - Fix null pointer (DoS) vulnerability via POST request to /cimom (CVE-2018-6644)
    (patch by Adam Majer)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-16
changelog:
  - Use %license for file which contains the text of the license
  - Change versioned docdir to unversioned and rename the docdir to match
    the package name
  - Remove %defattr
    Resolves: #1638007


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-9
changelog:
  - Use %license for file which contains the text of the license
  - Change versioned docdir to unversioned and rename the docdir to match
    the package name
  - Fix license tag
    Resolves: #1638015


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.24-2
changelog:
  - Optimize get_rpm_nvr_by_type by adding a cache (#1794807)
  - Stop building seappletlegacy (#1878792)
  - Update translations


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-1
changelog:
  - Revert "Replace pydbus with dasbus"
  - Fix typos in --help, man pages and developer's guide (#2028226)
  - Do not use Python slip package
  - Stop SetroubleshootFixit after 10 seconds of inactivity
  - Fix plugin exception reporting
  - export alert dbus signal
  - Make sure local_policy_package is not None
  - sealert: add "Last Seen" column to alert list


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-4
changelog:
  - Decrease setroubleshootd priority and limit RAM utilization to 1GB (#2064727)
  - doc: Document performance related changes


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-6
changelog:
  - Fix shebang of SetroubleshootPrivileged.py (#2231023)
  - Check that SELinux is enabled before running (#2178950)


author: Petr Pisar <ppisar@redhat.com> - 4.15.2-10
changelog:
  - License corrected to "GPLv3+ and (GPLv3+ and BSD) and (LGPLv3+ or BSD) and
    LGPLv2+ and Public Domain and GFDL"


author: Lokesh Mandvekar <lsm5@redhat.com> - 1:0.1.31-7.git0144aa8
changelog:
  - build with %gobuild
  - use scl-ized go-toolset as dep
  - disable i686 builds temporarily because of go-toolset issues


author: Eduardo Santiago <santiago@redhat.com> - 1:0.1.41-3
changelog:
  - patch broken gating tests: improper 'jq' usage, and use 'registry:2.6'
    (instead of :2) to work around broken image pushed by docker


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-9
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/a05ddb8)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-10
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/6c0e35a)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-11
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/b4210c0)
  - Resolves: #1914884


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-12
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/3abb778)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/e72dd9c)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-10
changelog:
  - update shortnames from Pyxis
  - sync with the vendored versions in 3.0-8.5.0
  - bump release to assure upgrade path from 3.0-8.4.0
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.4-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/9921983)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.4-2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/7300333)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/540efb3)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/4336972)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-3
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/4414e52)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-4
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/f952195)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-5
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/c20c32d)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-7
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/2b16a1c)
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-8
changelog:
  - rebuild for following CVEs:
  CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
  - Resolves: #2179946
  - Resolves: #2187316
  - Resolves: #2187362
  - Resolves: #2203679
  - Resolves: #2207508


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.6-2
changelog:
  - CVE 2021-3480:  idm:DL1/slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1944713


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.6-3
changelog:
  - Resolves: rhbz#1958909 - fix regression for scoped searches in compat tree
  - Resolves: rhbz#1978189 - better handle error response from libsss_nss_idmap


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Resolves: rhbz#1984010
    Fix ID views integration
  - Fix base scope lookups
  - Resolves: rhbz#1784172
    Bump NIS max dgram size to 8KB by default instead of 1KB
  - Resolves: rhbz#2070575
    Allow to rebuild the compat tree


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-4
changelog:
  - Ignore updates from non-tracked subtrees during modify/modrdn/update
    to avoid deadlocks with retro changelog
  - Resolves: RHEL-11984


author: Jindrich Novy <jnovy@redhat.com> - 0.4.0-1
changelog:
  - update to v.0.4.0
  - sync with fedora spec
  - drop applied CVE-2019-14378 patch
  - Resolves: #1766774


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.2
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.3
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.4-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.4
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.6-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.6
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.7-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.7
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.8-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.8
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.2.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.1
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 1.2.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.2
  - Related: Jira:RHEL-2110


author: Jindrich Novy <jnovy@redhat.com> - 1.2.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3
  - Related: Jira:RHEL-2110


author: Paul Wouters <pwouters@redhat.com> - 1.7.4.1-1
changelog:
  - Resolves: rhbz#1805132 socat does not recognize IP addresses of the SAN extensions in ssl mode
  - Resolves: rhbz#1870279 Transfer via socat fails with openssl enabled
  - Resolves: rhbz#1914989 Socat udp4-recvfrom cause endless loop error when target is not vaild


author: Paul Wouters <paul@xelerance.com> 1.5.0.0-4
changelog:
  - Some filesystem defines moved from their specific (ext2)
    filesystem defines into the generic <linux/fs.h>.


author: Caolán McNamara <caolanm@redhat.com> - 1.7.1.1-5
changelog:
  - recreate autoconf to get correct includes when determining type
    sizes in order to build correctly


author: Paul Wouters <paul@xelerance.com> - 1.7.1.2-1
changelog:
  - Upgraded to 1.7.1.2
  - Link against compat-readline5 for GPLv2 license (Miroslav Lichvar)
    (bz #511310)


author: Paul Wouters <paul@xelerance.com> - 1.7.1.3-1
changelog:
  - Upgrade to 1.7.1.3
  - Includes fix for CVE-2010-2799 Stack overflow by lexical scanning of nested
    character patterns
  - Resolves https://bugzilla.redhat.com/show_bug.cgi?id=620430


author: Paul Wouters <paul@nohats.ca> - 1.7.2.0-1
changelog:
  - Upgraded to 1.7.2.0 which allows tun/tap interfaces without IP address
    and introduces options openssl-compress and max-children.


author: Paul Wouters <pwouters@redhat.com> - 1.7.2.1-1
changelog:
  - Updated to 1.7.2.1 for CVE-2012-0219, rhbz#821553, rhbz#821688
  - Remove patch merged upstream
  - Remove --disable-fips from configure


author: Paul Wouters <pwouters@redhat.com> - 1.7.2.2-2
changelog:
  - Added two patches that fixes some -Wformat warnings. these fix 2 of 3
    failing test cases from test.sh
  - Enabled hardening with full relro/pie
  - Switch from readline5 to readline(6)


author: Paul Wouters <pwouters@redhat.com> - 1.7.2.4-1
changelog:
  - Updated to 1.7.2.4 which contains many bugfixes
  - Run tests in make check
  - Add build dependancies for make test


author: Paul Wouters <pwouters@redhat.com> - 1.7.3.2-1
changelog:
  - Resolves rhbz#1404290 socat build failure on rawhide
  - Resolves rhbz#1416597 socat-1.7.3.2 is available
  - Resolves rhbz#1417483 Failed DNS resolution causes SIGSEGV and endless loop
  - Removed obsoleted patch


author: Andreas Schneider <asn@redhat.com> - 1.1.8-1
changelog:
  - Update to version 1.1.8
    * Added support for openat()
    * Added support for open64() and fopen64()
    * Always enabled logging support
    * Increased maximum for wrapped interfaces to 64
    * Improved fd duplication code
    * Fixed strict-aliasing issues
    * Fixed some use after free issues
    * Fixed issues on ppc64le


author: Andreas Schneider <asn@redhat.com> - 1.2.0-1
changelog:
  - Update to vesrion 1.2.0
    * Added threading support
    * Moved to modern cmake
    * Several smaller bugfixes


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.6.0-1
changelog:
  - Fixes: rhbz#1818877 - rebase to softhsm 2.6.0+
  - Fixes: rhbz#1701233 - support setting supported signature methods on the token


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.6.0-3
changelog:
  - Fixes: rhbz#1834909 - softhsm use-after-free on process exit
  - Synchronize the final fix with Fedora


author: Hans de Goede <hdegoede@redhat.com> - 2.0.0-6
changelog:
  - The last round of security fixes also fixes CVE-2018-14044, CVE-2018-14045
    (rhbz#1601618, rhbz#1601620, rhbz#1601624, rhbz#1601625)


author: Sérgio Basto <sergio@serjux.com> - 2.1.1-1
changelog:
  - Update to 2.1.1
    Bugfixes: Fixed potential buffer overwrite bugs in WavFile routines. Replaced asserts with runtime exceptions.
    Android: Migrated the SoundTouch Android example to new Android Studio
    Automake: unset ACLOCAL in bootstrap script to avoid error in case earlier build script has set it


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.2-10
changelog:
  - Fixed CVE-2018-11805
  - Resolves: rhbz#1787514
  - Fixed CVE-2020-1930
  - Resolves: rhbz#1820649
  - Fixed CVE-2020-1931
  - Resolves: rhbz#1820650


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.2.0-1
changelog:
  - update to 1.2.0
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - include soname in file list
  - use license macro


author: Uri Lublin <uril@redhat.com> - 0.21.0-2
changelog:
  - Build without pciaccess
    Resolves: rhbz#1964922
  - Fix g_memdup deprecation warning with glib >= 2.68


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - first build against glibc
  - patched out the use of setresuid(), which is available only on kernels
    2.1.44 and later


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated the init script to use reconfigure option to restart squid instead
    of shutdown/restart (both safer and quicker)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - cache & log dirs shouldn't be world readable
  - remove preun script (leave logs & cache @ uninstall)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - switch to using group squid
  - turn off icmp (insecure)
  - update to 2.2.DEVEL3
  - build FAQ docs from source


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Fix compliance with ftp RFCs
    (http://www.wu-ftpd.org/broken-clients.html)
  - Work around a bug in some versions of autoconf
  - BuildPrereq sgml-tools - we're using sgml2html


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix init script again (#11699)
  - add --enable-delay-pools (#11695)
  - update to STABLE3
  - update FAQ


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix path references in QUICKSTART (#15114)
  - fix initscript translations (#24086)
  - fix shutdown logic (#24234), patch from <jos@xos.nl>
  - add /etc/sysconfig/squid for daemon options & shutdown timeouts
  - three more bugfixes from the Squid people
  - update FAQ.sgml
  - build and ship auth modules (#23611)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.4.STABLE1 + patches
  - enable some more configure options (#24981)
  - oops, ship /etc/sysconfig/squid


author: Bill Nottingham <notting@redhat.com>
changelog:
  - 2.4.STABLE3 + patches
  - turn off HTCP at request of maintainers
  - leave SNMP enabled in the build, but disabled in the default config


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE3-0
changelog:
  - Spec file change to enable the nul storage module. bugzilla #74654
  - Upgrade to 2.5STABLE3 with current official patches.
  - Added --enable-auth="basic,ntlm": closes bugzilla #90145
  - Added --with-winbind-auth-challenge: closes bugzilla #78691
  - Added --enable-useragent-log and --enable-referer-log, closes
  - bugzilla #91884


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE4-1
changelog:
  - New upstream version.
  - Fix the Source: line in this spec file to point to the correct URL.
  - redo the -location patch to work with the new upstream version.


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Incorporate many upstream patches
  - Include many spec file changes from D.Johnson <dj@www.uk.linux.org>


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE4-3
changelog:
  - Clean up the spec file to work on 64-bit platforms (use %{_libdir}
    instead of /usr/lib, etc)
  - Make the release number in the changelog section agree with reality.
  - use -fPIE rather than -fpie.  s390 fails with just -fpie


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE5-1
changelog:
  - New upstream version, obsoletes many patches.
  - Fix --datadir passed to configure.  Configure automatically adds /squid
    so we shouldn't.
  - Remove the problematic triggerpostun trigger, since is's broken, and FC2
    never shipped with that old version.
  - add %{?_smp_mflags} to make line.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE5-2
changelog:
  - Include the first 10 upstream patches
  - Add a patch for the correct location of the winbindd pipe.  This closes
    bugzilla #107561
  - Remove the change to ssl_support.c from squid-2.5.STABLE3-build patch
    This closes #117851
  - Include /etc/pam.d/squid .  This closes #113404
  - Include a patch to close #111254 (assignment in assert)
  - Change squid.init to put output messages in /var/log/squid/squid.out
    This closes #104697
  - Only useradd the squid user if it doesn't already exist, and error out
    if the useradd fails.  This closes #118718.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5STABLE5-5
changelog:
  - Merge current upstream patches.
  - Fix the -pipe patch to have the correct name of the winbind pipe.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE6-1
changelog:
  - New upstream version, with 32 upstream patches.
    This closes #133970, #133931, #131728, #128143, #126726

  - Change the permissions on /etc/squid/squid.conf to 640.  This closes
    bugzilla #125007


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE6-3
changelog:
  - include patch from Ulrich Drepper <drepper@redhat.com> to stop
    problems with O_NONBLOCK.  This closes #136049


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-1
changelog:
  - new upstream version, with 3 upstream patches.
    Updated the -build and -config patches
  - Include patch from Ulrich Drepper <frepper@redhat.com> to more
    intelligently close all file descriptors.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-2
changelog:
  - Add a triggerin on samba-common to make /var/cache/samba/winbindd_privileged
    accessable so that ntlm_auth will work.  It needs to be in this rpm,
    because the Samba RPM can't assume the squid user exists.
    Note that this will only work if the Samba RPM is recent enough to create
    that directory at install time instead of at winbindd startup time.
    That should be samba-common-3.0.0-15 or later.
    This fixes bugzilla #103726
  - Clean up extra whitespace in this spec file.
  - Add additional upstream patches. (Now 18 upstream patches).
  - patch #112 closes CAN-2005-0096 and CAN-2005-0097, remote DOS security holes.
  - patch #113 closes CAN-2005-0094, a remote buffer-overflow DOS security hole.
  - patch #114 closes CAN-2005-0095, a remote DOS security hole.
  - Remove the -nonbl (replaced by #104) and -close (replaced by #111) patches, since
    they're now fixed by upstream patches.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-4
changelog:
  - Include two more upstream patches for security vulns:
    bz#146783 Correct handling of oversized reply headers
    bz#146778 CAN-2005-0211 Buffer overflow in WCCP recvfrom() call


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE8-2
changelog:
  - new upstream version with 4 upstream patches.
  - Reorganize spec file to apply upstream patches first


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE9-4
changelog:
  - More upstream patches, including the fixed 2GB patch.
  - include the -libbind patch, which prevents squid from using the optional
    -lbind library, even if it's installed.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE9-6
changelog:
  - More upstream patches, including a fix for
    bz#157456 CAN-2005-1519 DNS lookups unreliable on untrusted networks


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE10-1
changelog:
  - new upstream version
  - enabled fakeauth utility (#154020)
  - enabled digest authentication scheme (#155882)
  - all error pages marked as config (#127836)
  - patch for 64bit statvfs interface (#153274)
  - added httpd config file for cachemgr.cgi (#112725)


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE10-3
changelog:
  - removed "--enable-truncate" option (#165948)
  - added "--enable-cache-digests" option (#102134)
  - added "--enable-ident-lookups" option (#161640)
  - some clean up (#165949)


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE11-5
changelog:
  - fix for #171213 - CVE-2005-3258 Squid crash due to malformed FTP response
  - more fixes from upstream


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE12-2
changelog:
  - rewriten patch squid-2.5.STABLE10-64bit.patch, it works with
    "--with-large-files" option now
  - fix for #72896 - squid does not support > 1024 file descriptors,
    new "--enable-fd-config" option for it.


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE1-1
changelog:
  - new upstream + the latest CVS snapshot from 2006/07/18
  - updated fd config patch
  - enabled epoll
  - fixed release format (#197405)
  - enabled WCCPv2 support (#198642)


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE4-2
changelog:
  - upstream fixes:
    * Accept 00:00-24:00 as a valid time specification (upstream BZ #1794)
    * aioDone() could be called twice
    * Squid reconfiguration (upstream BZ #1800)


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE4-3
changelog:
  - added fix for #183869 - squid can abort when getting status
  - added upstream fixes:
      * Bug #1796: Assertion error HttpHeader.c:914: "str"
      * Bug #1779: Delay pools fairness, correction to first patch
      * Bug #1802: Crash on exit in certain conditions where cache.log is not writeable
      * Bug #1779: Delay pools fairness when multiple connections compete for bandwidth
      * Clarify the select/poll/kqueue/epoll configure --enable/disable options
  - reworked fd patch for STABLE4


author: Martin Bacovsky <mbacovsk@redhat.com> - 7:2.6.STABLE16-2
changelog:
  - our fd_config patch was replaced by upstream's version 
  - Source1 (FAQ.sgml) points to local source (upstream's moved to wiki)


author: Martin Nagy <mnagy@redhat.com> - 7:3.0.STABLE2-1
changelog:
  - upgrade to latest upstream 3.0.STABLE2
  - check config file before starting (#428998)
  - whitespace unification of init script
  - some minor path changes in the QUICKSTART file
  - configure with the --with-filedescriptors=16384 option


author: Martin Nagy <mnagy@redhat.com> - 7:3.0.STABLE5-2
changelog:
  - fix configure detection of netfilter kernel headers (#435499),
    patch by aoliva@redhat.com
  - add support for negotiate authentication (#445337)


author: Jiri Skala <jskala@redhat.com> - 7:3.0.STABLE7-2
changelog:
  - used ncsa_auth.8 from man-pages. there will be this file removed due to conflict
  - fix #458593 noisy initscript
  - fix #463129 init script tests wrong conf file
  - fix #450352 - build.patch patches only generated files


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.0.STABLE13-2
changelog:
  - backported logfile.cc syslog parameters patch from 3.1 (b9443.patch)
  - GCC-4.4 workaround in src/wccp2.cc


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.0.STABLE17-2
changelog:
  - Bug #514014, update to 3.0.STABLE17 fixing the denial of service issues
    mentioned in Squid security advisory SQUID-2009_2.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.13-1
changelog:
  - Upgrade to next upstream release 3.1.0.13 with many new features
    * IPv6 support
    * NTLM-passthru
    * Kerberos/Negotiate authentication scheme support
    * Localized error pages based on browser language preferences
    * Follow X-Forwarded-For capability
    * and more..


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.13-7
changelog:
  - Include upstream patches fixing important operational issues
  - Enable ESI support now that it does not conflict with normal operation


author: Jiri Skala <jskala@redhat.com> 7:3.1.0.14-2
changelog:
  - fixed #532930 Syntactic error in /etc/init.d/squid
  - fixed #528453 cannot initialize cache_dir with user specified config file


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.15-3
changelog:
  - fixed #551302 PROXY needs libcap. Also increases security a little.
  - merged relevant upstream bugfixes waiting for next 3.1 release


author: Jiri Skala <jskala@redhat.com> - 7:3.1.0.16-4
changelog:
  - spec file modified to be fedora packaging guidline compliant
  - little shifting lines in init script header due to rpmlint complaint
  - fixes assertion during start up


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.16-6
changelog:
  - Patch for Squid security advisory SQUID-2010:2, denial of service
    issue in HTCP processing (CVE-2010-0639)


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.1-2
changelog:
  - Update to 3.1.1 Squid bug #2827 crash with assertion failed:
    FilledChecklist.cc:90: "conn() != NULL" under high load.


author: Jiri Skala <jskala@redhat.com>
changelog:
  - fixes #548903 - "comm_open: socket failure: (97) Address family not supported by protocol" if IPv6 disabled


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.3-2
changelog:
  - Fully fix #548903 - "comm_open: socket failure: (97) Address family not supported by protocol" if IPv6 disabled
  - Various IPv6 related issues fixed, making tcp_outgoing_address behave
    as expected and no commResetFD warnings when using tproxy setups.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.4-1
changelog:
  - Upstream 3.1.4 bugfix release, issues relating to IPv6, TPROXY, Memory
    management, follow_x_forwarded_for, and stability fixes


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.5-2
changelog:
  - Upstream 3.1.5 bugfix release
  - Upstream patch for Bug #614665: Squid crashes with  ident auth
  - Upstream patches for various memory leaks


author: Jiri Skala <jskala@redhat.com> - 7:3.2.0.9-1
changelog:
  - upgrade to squid-3.2
  - fixes #720445 - Provide native systemd unit file
  - SysV initscript moved to subpackage
  - temproary disabled eCap


author: Jiri Skala <jskala@redhat.com> - 7:3.2.0.13-2
changelog:
  - fixes #747103 - squid does not start if /var/spool/squid is empty
  - fixes #747110 - squid does not start adding "memory_pools off"


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.2.0.14-6
changelog:
  - upstream gcc-4.7 patch
  - fix for bug #772483 running out of memory, mem_node growing out of bounds


author: Michal Luscon <mluscon@redhat.com> - 7:3.2.3-2
changelog:
  - Resolved: #854356 - squid.service use PIDFile
  - Resolved: #859393 - Improve cache_swap script
  - Resolved: #791129 - disk space warning
  - Resolved: #862252 - reload on VPN or network up/down
  - Resolved: #867531 - run test suite during build
  - Resolved: #832684 - missing after dependency nss-lookup.target
  - Removed obsolete configure options


author: Michal Luscon <mluscon@redhat.com> - 7:3.2.9-1
changelog:
  - Update to latest upstream version 3.2.9
  - Fixed: CVE-2013-1839
  - Removed: makefile-patch (+make check)


author: Ville Skyttä <ville.skytta@iki.fi> - 7:3.3.4-2
changelog:
  - Fix basic auth and log daemon DB helper builds.
  - Use xz compressed tarball, fix source URLs.
  - Fix bogus dates in %changelog.


author: Michal Luscon <mluscon@redhat.com> - 7:3.3.9-1
changelog:
  - Update to latest upstream version 3.3.9
  - Fixed #976815: file descriptors are hard coded to 16384
  - Fixed: active ftp crashing
  - Fixed: offset of patches


author: Michal Luscon <mluscon@redhat.com> - 7:3.4.1-1
changelog:
  - Rebase to latest stable upstream release 3.4.1
  - Fixed #1034306: fails to build for AArch64
  - Fixed: active ftp


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.4.12-1
changelog:
  - Update to latest upstream version 3.4.12
  - bug #1173946: Disable -march=native compile time optimization, use Fedora defaults.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.5.2-2
changelog:
  - Update to latest upstream version 3.5.2
  - Remove deprecated (and renamed) squid_msnt_auth basic auth helper. Only
    performs LM authentication and not considered useful in todays networks.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.13-3
changelog:
  - Resolves: #1308866 - CVE-2016-2390 squid: incorrect server error 
    handling resulting in denial of service


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.15-1
changelog:
  - new version 3.5.15
  - Resolves: #1311585 - squid: Multiple Denial of Service issues in
    HTTP Response processing
  - Resolves: #1312267 - squid: SQUID-2016_2 advisory, multiple DoS issues


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.0.23-5
changelog:
  - Resolves: #1585617 - Build against libdb only instead of libdb4
  - disabled strict checking for now (squid can not be built with GCC8)


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-1
changelog:
  - Resolves: #1656871 - squid rebase to 4.4
  - Resolves: #1645148 - CVE-2018-19131 squid: Cross-Site Scripting when
    generating HTTPS response messages about TLS errors
  - Resolves: #1645156 - CVE-2018-19132 squid: Memory leak in SNMP query
    rejection code


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-6
changelog:
  - Resolves: #1679526 - Missing detailed configuration file
  - Resolves: #1703117 - RHEL 7 to 8 fails with squid installed because dirs
    changed to symlinks
  - Resolves: #1691741 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1683527 - "Reloading" message on a fresh reboot after enabling
    squid


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-8
changelog:
  - Resolves: # 1738485 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow
    in HttpHeader::getAuth


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-9
changelog:
  - Resolves: #1738583 - CVE-2019-12525 squid:4/squid: parsing of header
    Proxy-Authentication leads to memory corruption
  - Resolves: #1828369 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828370 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-1
changelog:
  - new version 4.11
  - libsystemd integration
  - Resolves: #1829467 - squid:4 rebase
  - Resolves: #1828378 - CVE-2019-12521 squid:4/squid: off-by-one error in
    addStackElement allows for a heap buffer overflow and a crash
  - Resolves: #1828377 - CVE-2019-12520 squid:4/squid: improper input validation
    in request allows for proxy manipulation
  - Resolves: #1828375 - CVE-2019-12524 squid:4/squid: improper access restriction
    in url_regex may lead to security bypass
  - Resolves: #1820664 - CVE-2019-18860 squid: mishandles HTML in the host
    parameter to cachemgr.cgi which could result in squid behaving in unsecure way
  - Resolves: #1802514 - CVE-2020-8449 squid:4/squid: Improper input validation
    issues in HTTP Request processing
  - Resolves: #1802513 - CVE-2020-8450 squid:4/squid: Buffer overflow in a Squid
    acting as reverse-proxy
  - Resolves: #1802512 - CVE-2019-12528 squid:4/squid: Information Disclosure
    issue in FTP Gateway
  - Resolves: #1771288 - CVE-2019-18678 squid:4/squid: HTTP Request Splitting
    issue in HTTP message processing
  - Resolves: #1771283 - CVE-2019-18679 squid:4/squid: Information Disclosure
    issue in HTTP Digest Authentication
  - Resolves: #1771280 - CVE-2019-18677 squid:4/squid: Cross-Site Request Forgery
    issue in HTTP Request processing
  - Resolves: #1771275 - CVE-2019-12523 squid:4/squid: Improper input validation
    in URI processor
  - Resolves: #1771272 - CVE-2019-18676 squid:4/squid: Buffer overflow in URI
    processor
  - Resolves: #1771264 - CVE-2019-12526 squid:4/squid: Heap overflow issue in URN
    processing
  - Resolves: #1738581 - CVE-2019-12529 squid: OOB read in Proxy-Authorization
    header causes DoS


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-2
changelog:
  - Resolves: #1853130 - CVE-2020-15049 squid:4/squid: request smuggling and
    poisoning attack against the HTTP cache
  - Resolves: #1853136 - CVE-2020-14058 squid:4/squid: DoS in TLS handshake


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-3
changelog:
  - Resolves: #1871705 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1871702 - CVE-2020-15811 squid: HTTP Request Splitting could result
    in cache poisoning
  - Resolves: #1871700 - CVE-2020-15810 squid: HTTP Request Smuggling could result
    in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-5
changelog:
  - Resolves: #1944261 - CVE-2020-25097 squid:4/squid: improper input validation
    may allow a trusted client to perform HTTP Request Smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-2
changelog:
  - Resolves: #2006121 - SQUID shortens FTP Link wrong that contains a semi-colon
    and as a result is not able to download zip file.CODE 404 TO CLIENT)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-3
changelog:
  - Resolves: #1941506 - CVE-2021-28116 squid:4/squid: out-of-bounds read in WCCP
    protocol data may lead to information disclosure


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-5
changelog:
  - Resolves: #2130260 - CVE-2022-41318 squid:4/squid: buffer-over-read in SSPI and SMB
    authentication


author: Tomas Korbar <tkorbar@redhat.com> - 4.15-6
changelog:
  - Resolves: #2072988 - [RFE] Add the "IP_BIND_ADDRESS_NO_PORT"
    flag to sockets created for outgoing connections in the squid source code.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-8
changelog:
  - Resolves: RHEL-18351 - squid:4/squid: Buffer over-read in the HTTP Message
    processing feature (CVE-2023-49285)
  - Resolves: RHEL-18342 - squid:4/squid: Incorrect Check of Function Return
    Value In Helper Process management (CVE-2023-49286)
  - Resolves: RHEL-18230 - squid:4/squid: Denial of Service in SSL Certificate
    validation (CVE-2023-46724)
  - Resolves: RHEL-15911 - squid:4/squid: NULL pointer dereference in the gopher
    protocol code (CVE-2023-46728)
  - Resolves: RHEL-18251 - squid crashes in assertion when a parent peer exists
  - Resolves: RHEL-14794 - squid: squid multiple issues in HTTP response caching
    (CVE-2023-5824)
  - Resolves: RHEL-14803 - squid: squid: Denial of Service in HTTP Digest
    Authentication (CVE-2023-46847)
  - Resolves: RHEL-14777 - squid: squid: Request/Response smuggling in HTTP/1.1
    and ICAP (CVE-2023-46846)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-9
changelog:
  - Resolves: RHEL-19552 - squid:4/squid: denial of service in HTTP request 
    parsing (CVE-2023-50269)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10
changelog:
  - Resolves: RHEL-28529 - squid:4/squid: Denial of Service in HTTP Chunked
    Decoding (CVE-2024-25111)
  - Resolves: RHEL-26088 - squid:4/squid: denial of service in HTTP header
    parser (CVE-2024-25617)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.1
changelog:
  - Resolves: RHEL-56024 - (Regression) Transfer-encoding:chunked data is not sent
    to the client in its complementary


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.2
changelog:
  - Disable ESI support
  - Resolves: RHEL-65075 - CVE-2024-45802 squid:4/squid: Denial of Service
    processing ESI response content


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.3
changelog:
  - Resolves: RHEL-22593 - CVE-2024-23638 squid:4/squid: vulnerable to
    a Denial of Service attack against Cache Manager error responses


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New stable upstream version 1.2.1
  - Resolves: rhbz#595529 - spec file should eschew %define in favor of
  -                         %global
  - Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart.
  - Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
  -                         keyring
  - Resolves: rhbz#599724 - sssd is broken on Rawhide


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.91-20
changelog:
  - New upstream version 1.2.91 (1.3.0rc1)
  - Improved LDAP failover
  - Synchronous sysdb API (provides performance enhancements)
  - Better online reconnection detection


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-30
changelog:
  - Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
  -                           against LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-32
changelog:
  - Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
  -                         doesn't require it


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-1
changelog:
  - New upstream release 1.4.0
  - Added support for netgroups to the LDAP provider
  - Performance improvements made to group processing of RFC2307 LDAP servers
  - Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
  - Build-system improvements to support Gentoo
  - Split out several libraries into the ding-libs tarball
  - Manpage reviewed and updated


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-1
changelog:
  - New upstream release 1.4.1
  - Add support for netgroups to the proxy provider
  - Fixes a minor bug with UIDs/GIDs >= 2^31
  - Fixes a segfault in the kerberos provider
  - Fixes a segfault in the NSS responder if a data provider crashes
  - Correctly use sdap_netgroup_search_base


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-3
changelog:
  - Solve a shutdown race-condition that sometimes left processes running
  - Resolves: rhbz#606887 - SSSD stops on upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  -Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Fix nested group member filter sanitization for RFC2307bis
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#677768 - name service caches names, so id command shows
  -                         recently deleted users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.2-1
changelog:
  - New upstream release 1.5.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
  - Fixes for support of FreeIPA v2
  - Fixes for failover if DNS entries change
  - Improved sss_obfuscate tool with better interactive mode
  - Fix several crash bugs
  - Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
  - Delete users from the local cache if initgroups calls return 'no such user'
  - (previously only worked for getpwnam/getpwuid)
  - Use new Transifex.net translations
  - Better support for automatic TGT renewal (now survives restart)
  - Netgroup fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.4-1
changelog:
  - New upstream release 1.5.4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
  - Fixes for Active Directory when not all users and groups have POSIX attributes
  - Fixes for handling users and groups that have name aliases (aliases are ignored)
  - Fix group memberships after initgroups in the IPA provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-1
changelog:
  - New upstream release 1.5.5
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
  - Fixes for several crash bugs
  - LDAP group lookups will no longer abort if there is a zero-length member
  - attribute
  - Add automatic fallback to 'cn' if the 'gecos' attribute does not exist


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-3
changelog:
  - Fix systemd conversion. Upgrades from SysV to systemd weren't properly
  - enabling the systemd service.
  - Fix a serious memory leak in the memberOf plugin
  - Fix an issue where the user's full name would sometimes be removed
  - from the cache


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
changelog:
  - Resolves: rhbz#697057 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server
  - Upgrades from SysV should now maintain enabled/disabled status


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.6-1
changelog:
  - New upstream release 1.5.6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
  - Fixed a serious memory leak in the memberOf plugin
  - Fixed a regression with the negative cache that caused it to be essentially
  - nonfunctional
  - Fixed an issue where the user's full name would sometimes be removed from
  - the cache
  - Fixed an issue with password changes in the kerberos provider not working
  - with kpasswd


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-1
changelog:
  - Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
  -                         cached password with predicatable filename


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-3
changelog:
  - Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
  - Make sure to properly convert to systemd if upgrading from newer
  - updates for Fedora 14


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.8-1
changelog:
  - New upstream release 1.5.8
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
  - Support for the LDAP paging control
  - Support for multiple DNS servers for name resolution
  - Fixes for several group membership bugs
  - Fixes for rare crash bugs


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.9-1
changelog:
  - New upstream release 1.5.9
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
  - Support for overriding home directory, shell and primary GID locally
  - Properly honor TTL values from SRV record lookups
  - Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
  - servers)
  - Properly escape IPv6 addresses in the failover code
  - Do not crash if inotify fails (e.g. resource exhaustion)
  - Don't add multiple TGT renewal callbacks (too many log messages)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.10-1
changelog:
  - New upstream release 1.5.10
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
  - Fixed a regression introduced in 1.5.9 that could result in blocking calls
  - to LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.11-2
changelog:
  - New upstream release 1.5.11
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
  - Fix a serious regression that prevented SSSD from working with ldaps:// URIs
  - IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
  - address being saved to the AAAA record


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
changelog:
  - New upstream release 1.6.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
  - Add host access control support for LDAP (similar to pam_host_attr)
  - Finer-grained control on principals used with Kerberos (such as for FAST or
  - validation)
  - Added a new tool sss_cache to allow selective expiring of cached entries
  - Added support for LDAP DEREF and ASQ controls
  - Added access control features for Novell Directory Server
  - FreeIPA dynamic DNS update now checks first to see if an update is needed
  - Complete rewrite of the HBAC library
  - New libraries: libipa_hbac and libipa_hbac-python


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.1-1
changelog:
  - New upstream release 1.6.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
  - Fixes a serious issue with LDAP connections when the communication is
    dropped (e.g. VPN disconnection, waking from sleep)
  - SSSD is now less strict when dealing with users/groups with multiple names
    when a definitive primary name cannot be determined
  - The LDAP provider will no longer attempt to canonicalize by default when
    using SASL. An option to re-enable this has been provided.
  - Fixes for non-standard LDAP attribute names (e.g. those used by Active
    Directory)
  - Three HBAC regressions have been fixed.
  - Fix for an infinite loop in the deref code


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-1
changelog:
  - Improved handling of users and groups with multi-valued name attributes
    (aliases)
  - Performance enhancements
      Initgroups on RFC2307bis/FreeIPA
      HBAC rule processing
  - Improved process-hang detection and restarting
  - Enabled the midpoint cache refresh by default (fewer cache misses on
    commonly-used entries)
  - Cleaned up the example configuration
  - New tool to change debug level on the fly


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-4
changelog:
  - Change selinux policy requirement to Conflicts: with the old version,
    rather than Requires: the supported version.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release 1.6.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
  - Fixes a major cache performance issue introduced in 1.6.2
  - Fixes a potential infinite-loop with certain LDAP layouts


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-4
changelog:
  - Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758425 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.4-1
changelog:
  - New upstream release 1.6.4
  - Rolls up previous patches applied to the 1.6.3 tarball
  - Fixes a rare issue causing crashes in the failover logic
  - Fixes an issue where SSSD would return the wrong PAM error code for users
    that it does not recognize.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-1
changelog:
  - New upstream release 1.7.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
  - Support for case-insensitive domains
  - Support for multiple search bases in the LDAP provider
  - Support for the native FreeIPA netgroup implementation
  - Reliability improvements to the process monitor
  - New DEBUG facility with more consistent log levels
  - New tool to change debug log levels without restarting SSSD
  - SSSD will now disconnect from LDAP server when idle
  - FreeIPA HBAC rules can choose to ignore srchost options for significant
    performance gains
  - Assorted performance improvements in the LDAP provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-3
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-5
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features - fix netgroups and sudo as well


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta1
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta2
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
  - Fix two minor manpage bugs
  - Include the IPA AutoFS provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - New upstream release 1.8.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed several memory-corruption bugs
  - Finalized the ABI for the autofs support
  - Fixed a regression in the proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - New upstream release 1.8.0
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)
  - Include the IPA AutoFS provider
  - Fixed several memory-corruption bugs
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed a regression in the proxy provider
  - Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
  - Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
                            logged at each login
  - Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-7
changelog:
  - New upstream release 1.8.1
  - Resolve issue where we could enter an infinite loop trying to connect to an
    auth server
  - Fix serious issue with complex (3+ levels) nested groups
  - Fix netgroup support for case-insensitivity and aliases
  - Fix serious issue with lookup bundling resulting in requests never
    completing
  - IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
    in addition to pam_authenticate
  - Fix several regressions in the proxy provider
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-8
changelog:
  - Fix uninitialized value bug causing crashes throughout the code
  - Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-9
changelog:
  - Don't duplicate libsss_autofs.so in two packages
  - Set explicit package contents instead of globbing


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.2-10
changelog:
  - New upstream release 1.8.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
  - Several fixes to case-insensitive domain functions
  - Fix for GSSAPI binds when the keytab contains unrelated principals
  - Fixed several segfaults
  - Workarounds added for LDAP servers with unreadable RootDSE
  - SSH knownhostproxy will no longer enter an infinite loop preventing login
  - The provided SYSV init script now starts SSSD earlier at startup and stops
    it later during shutdown
  - Assorted minor fixes for issues discovered by static analysis tools


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.3-11
changelog:
  - New upstream release 1.8.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
  - Numerous manpage and translation updates
  - LDAP: Handle situations where the RootDSE isn't available anonymously
  - LDAP: Fix regression for users using non-standard LDAP attributes for user
    information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-1.beta1
changelog:
  - New upstream release 1.9.0 beta 1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
  - Add native support for autofs to the IPA provider
  - Support for ID-mapping when connecting to Active Directory
  - Support for handling very large (> 1500 users) groups in Active Directory
  - Support for sub-domains (will be used for dealing with trust relationships)
  - Add a new fast in-memory cache to speed up lookups of cached data on
    repeated requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-2.beta1
changelog:
  - Fix several regressions since 1.5.x
  - Ensure that the RPM creates the /var/lib/sss/mc directory
  - Add support for Netscape password warning expiration control
  - Rebuild against libldb 1.1.6


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-5.beta2
changelog:
  - New upstream release 1.9.0 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
  - Add support for the Kerberos DIR cache for storing multiple TGTs
    automatically
  - Major performance enhancement when storing large groups in the cache
  - Major performance enhancement when performing initgroups() against Active
    Directory
  - SSSDConfig data file default locations can now be set during configure for
    easier packaging


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-7.beta2
changelog:
  - Switch unicode library from libunistring to Glib
  - Drop unnecessary explicit Requires on keyutils
  - Guarantee that versioned Requires include the correct architecture


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-8.beta3
changelog:
  - New upstream release 1.9.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
  - Add a new PAC responder for dealing with cross-realm Kerberos trusts
  - Terminate idle connections to the NSS and PAM responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-9.beta4
changelog:
  - New upstream release 1.9.0 beta 4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
  - Add a new AD provider to improve integration with Active Directory 2008 R2
    or later servers
  - SUDO integration was completely rewritten. The new implementation works
    with multiple domains and uses an improved refresh mechanism to download
    only the necessary rules
  - The IPA authentication provider now supports subdomains
  - Fixed regression for setups that were setting default_tkt_enctypes
    manually by reverting a previous workaround.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-12.beta5
changelog:
  - New upstream release 1.9.0 beta 5
  - Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
  - Many fixes for the support for setting default SELinux user context from
    FreeIPA, most notably fixed the specificity evaluation
  - Fixed an incorrect default in the krb5_canonicalize option of the AD
    provider which was preventing password change operation
  - The shadowLastChange attribute value is now correctly updated with the
    number of days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-13.beta6
changelog:
  - New upstream release 1.9.0 beta 6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
  - A new option, override_shell was added. If this option is set, all users
    managed by SSSD will have their shell set to its value.
  - Fixes for the support for setting default SELinux user context from FreeIPA.
  - Fixed a regression introduced in beta 5 that broke LDAP SASL binds
  - The SSSD supports the concept of a Primary Server and a Back Up Server in
    failover
  - A new command-line tool sss_seed is available to help prime the cache with
    a user record when deploying a new machine
  - SSSD is now able to discover and save the domain-realm mappings
    between an IPA server and a trusted Active Directory server.
  - Packaging changes to fix ldconfig usage in subpackages (#843995)
  - Rebuild against libldb 1.1.9


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-14.beta6
changelog:
  - Don't discard HBAC rule processing result if SELinux is on
    Resolves: rhbz#846792 (CVE-2012-3462)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-18.beta6
changelog:
  - Change the default ccache location to DIR:/run/user/${UID}/krb5cc
    and patch man page accordingly
  - Resolves: rhbz#851304


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.4-3
changelog:
  - Recreate Kerberos ccache directory if it's missing
  - Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
                            directory /run/user/UID/ccdir does not exist


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-4.beta1
changelog:
  - Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
    in ding-libs
  - Fix SSH integration with fully-qualified domains
  - Add the ability to dynamically discover the NetBIOS name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-6.beta1
changelog:
  - Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
                            realm join
  - Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
                            default for AD Provider
  - Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
                            parent directory when logging in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-7.beta1
changelog:
  - Apply a couple of patches from upstream git that resolve crashes when
    ID mapping object was not initialized properly but needed later


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-8.beta2
changelog:
  - New upstream release 1.10 beta2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
  - BuildRequire libcmocka-devel in order to run all upstream tests during build
  - BuildRequire libnl3 instead of libnl1
  - No longer BuildRequire initscripts, we no longer use /sbin/service
  - Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
    older krb5-libs version


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-9.beta2
changelog:
  - Fix typo in Requires that prevented an upgrade (#973916)
  - Use a hardcoded version in Conflicts, not less-than-current


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-11.beta2
changelog:
  - Apply a number of patches from upstream to fix issues found post-beta,
    in particular:
    -- segfault with a high DEBUG level
    -- Fix IPA password migration (upstream #1873)
    -- Fix fail over when retrying SRV resolution (upstream #1886)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-14
changelog:
  - Fix Obsoletes: to account for dist tag
  - Convert post and pre scripts to run on the sssd-common subpackage
  - Remove old conversion from SYSV


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-16
changelog:
  - Move sssd_pac to the sssd-ipa and sssd-ad subpackages
  - Trim out RHEL5-specific macros since we don't build on RHEL 5
  - Trim out macros for Fedora older than F18
  - Update libldb requirement to 1.1.16
  - Trim RPM changelog down to the last year


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0.2beta2
changelog:
  - Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
                        pam libraries


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-0.4.beta2
changelog:
  - Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
                        Process /usr/libexec/sssd/sssd_nss was killed by
                        signal 11 (SIGSEGV)
  - Resolves: #996214 - sssd proxy_child segfault


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-2
changelog:
  - Backport simplification of ccache management from 1.11.1
  - Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-3
changelog:
  - Fix multicast checks in the SSSD
  - Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
                             code getting the host info


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-1
changelog:
  - New upstream release 1.11.2
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.3-1
changelog:
  - New upstream release 1.11.3
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.4-1
changelog:
  - New upstream release 1.11.4
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.5-1
changelog:
  - New upstream release 1.11.5
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.1-2
changelog:
  - Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
                             private group from server


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.2-6
changelog:
  - Fix regressions and bugs in sssd upstream 1.12.2
  - https://fedorahosted.org/sssd/ticket/{id}
  - Regressions: #2471, #2475, #2483, #2487, #2529, #2535
  - Bugs: #2287, #2445


author: Sumit Bose <sbose@redhat.com> - 1.12.2-7
changelog:
  - Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
                             crash in wbinfo
                             - in addition to the patch libwbclient.so is
                               filtered out of the Provides list of the package


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-1
changelog:
  - New upstream release 1.12.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
  - Fix spelling errors in description (fedpkg lint)


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-2
changelog:
  - Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
  - Resolves: rhbz#1179379 - gzip: stdin: file size changed while
                             zipping when rotating logfile


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-3
changelog:
  - Apply a number of patches from upstream to fix issues found 1.12.3
  - Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
                             interfaces, or isn't documented to be able to
  - Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
                            not running
  - Resolves: upstream #2557  authentication failure with user from AD


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-4
changelog:
  - Decrease priority of sssd-libwbclient 20 -> 5
  - It should be lower than priority of samba veriosn of libwbclient.
  - https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-6
changelog:
  - Fix double free in monitor
  - Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
                          sssd killed by SIGABRT


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-2
changelog:
  - Add support for python3 bindings
  - Add requirement to python3 or python3 bindings
  - Resolves: rhbz#1014594 - sssd: Support Python 3


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-5
changelog:
  - Fix regressions with ipa and SELinux
  - Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
                               context on client is staff_u


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-6
changelog:
  - Fix slow login with ipa and SELinux
  - Resolves: upstream #2624 - Only set the selinux context if the context
                               differs from the local one


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-8
changelog:
  - Backport important patches from upstream 1.13 prerelease
  - Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
                             attribute for group name
  - Resolves: upstream #2335 - Investigate using the krb5 responder
                               for driving the PAM conversation with OTPs
  - Enable cmocka tests for secondary architectures


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-4
changelog:
  - Fix ipa-migration bug
  - Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
                               migration mode


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-6
changelog:
  - Fix OTP bug
  - Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
                               entered separately


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-2
changelog:
  - Fix few segfaults
  - Resolves: upstream #2811 - PAM responder crashed if user was not set
  - Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-3
changelog:
  - python-sssdconfig: Fix parssing sssd.conf without config_file_version
  - Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-5
changelog:
  - Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
                             groups during getgrnam and getgrgid
  - Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
                             in call to 'print'


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-6
changelog:
  - Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
                             prompts (e.g. Password + Token)
  - Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
                             by remote host" if locale not available


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.4-3
changelog:
  - Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
                             sssd_ifp killed by SIGSEGV


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-2
changelog:
  - Backport important patches from upstream 1.14.2 prerelease
  - Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
                               boot
  - Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-3
changelog:
  - Fix regression with krb5_map_user
  - Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
  - Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
                             default if nonexistent domain is mentioned


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.2-2
changelog:
  - Resolves: rhbz#1369130 - nss_sss should not link against libpthread
  - Resolves: rhbz#1392916 - sssd failes to start after update
  - Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
                             on the directory /etc/sssd


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.0-4
changelog:
  - Cherry-pick patches from upstream that enable the files provider
  - Enable the files domain
  - Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
    which is superseded by the files domain autoconfiguration
  - Related: rhbz#1357418 - SSSD fast cache for local users


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.2
changelog:
  - Fix issue with IPA + SELinux in containers
  - Resolves: upstream https://fedorahosted.org/sssd/ticket/3297


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.3
changelog:
  - Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
  - Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
                             file from package sssd-common-1.15.1-1.fc25.x86_64
  - Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-4
changelog:
  - Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
                             access on the sock_file system_bus_socket
  - Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
                             fails to download desktop profile data
  - Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
  - Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
                              after applying ID Views for them in IPA server
  - Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
                              mapping is applied


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-5
changelog:
  - Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database access on
                             the sock_file system_bus_socket


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.16.0-5
changelog:
  - Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
                              setnetgrent_result_timeout
  - Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
                              or machine swaps
  - Resolves: failure in glibc tests
              https://sourceware.org/bugzilla/show_bug.cgi?id=22530
  - Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
                              auth_provider ldap, login fails if the LDAP server
                              is not allowing anonymous binds
  - Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
                              corrected with AD
  - Resolves: upstream#3586 - Give a more detailed debug and system-log message
                              if krb5_init_context() failed
  - Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
                             in /etc/systemd/system
  - Backport few upstream features from 1.16.1


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.0-12
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Resolves: upstream#3621 - FleetCommander integration must not require
                              capability DAC_OVERRIDE


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-2
changelog:
  - Resolves: upstream#3573 - sssd won't show netgroups with blank domain
  - Resolves: upstream#3660 - confdb_expand_app_domains() always fails
  - Resolves: upstream#3658 - Application domain is not interpreted correctly
  - Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
                              json_loads()
  - Resolves: upstream#3386 - KCM: Payload buffer is too small
  - Resolves: upstream#3666 - Fix usage of str.decode() in our tests
  - A few KCM misc fixes


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-3
changelog:
  - Resolves: upstream#3684 - A group is not updated if its member is removed
                              with the cleanup task, but the group does not
                              change
  - Resolves: upstream#3558 - sudo: report error when two rules share cn
  - Tone down shutdown messages for socket activated responders
  - IPA: Qualify the externalUser sudo attribute
  - Resolves: upstream#3550 - refresh_expired_interval does not work with
                              netgrous in 1.15
  - Resolves: upstream#3402 - Support alternative sources for the files provider
  - Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
  - Resolves: upstream#3679 - Make nss netgroup requests more robust
  - Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
                              configured
  - Resolves: upstream#3469 - extend sss-certmap man page regarding priority
                              processing
  - Improve docs/debug message about GC detection
  - Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
                              list out of bound?
  - Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
                              set.
  - Document which principal does the AD provider use
  - Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
                              defined, but contains no SIDs
  - Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
  - Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
                             Provider returned an error
                             [org.freedesktop.sssd.Error.DataProvider.Fatal]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-1
changelog:
  - Update to 1.16.2 release
  - Cleanup unused global definitions
  - Remove python2 references from the spec file
  - Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-2
changelog:
  - Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
                             fails with the KCM ccache


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-4
changelog:
  - Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                             users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-7
changelog:
  - Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
                             differs from the default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-8
changelog:
  - Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
                              /usr/libexec/sssd/sssd_be killed by 11 crash
                              func _dbus_list_unlink


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-9
changelog:
  - Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
                             commands in man pages since local provider
                             is deprecated


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-10
changelog:
  - Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
                             started due to a misconfiguration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-11
changelog:
  - Resolves: rhbz#1628122 - Printing incorrect information about domain
                             with sssctl utility


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-16
changelog:
  - Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
                            PKCS#11 URI


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-17
changelog:
  - Related: rhbz#1637131 - pam_unix unable to match fully qualified username
                            provided by sssd during smartcard auth using gdm


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-18
changelog:
  - Related: rhbz#1638006 - Files: The files provider always enumerates
                            which causes duplicate when running getent passwd


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-19
changelog:
  - Add OSCP checks for p11_child
  - Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                            users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-21
changelog:
  - Related: rhbz#1638150 - session not recording for local user when groups defined
  - Also add silence a Coverity warning, which is related to rhbz#1637131


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-23
changelog:
  - Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
                             with smart card


author: Michal Židek <mzidek@redhat.com> - 2.0.0-24
changelog:
  - Resolves: rhbz#1646168 - sssctl access-report always prints an error message
  - Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
                             configuration without having to restart the whole
                             sssd
  - Resolves: rhbz#1640576 - sssctl reports incorrect information about local
                             user's cache entry expiration time
  - Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
  - Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys


author: Michal Židek <mzidek@redhat.com> - 2.0.0-25
changelog:
  - Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
                             for D-bus, resulting in a crash


author: Michal Židek <mzidek@redhat.com> - 2.0.0-27
changelog:
  - Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
                             if ID provider is authenticated with GSSAPI


author: Michal Židek <mzidek@redhat.com> - 2.0.0-29
changelog:
  - Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
                             /usr/libexec/sssd/proxy_child killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.0.0-30
changelog:
  - Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
                        retrieve AD users through IPA Trust


author: Michal Židek <mzidek@redhat.com> - 2.0.0-32
changelog:
  - Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
              and libtevent to avoid an issue in GPO processing


author: Michal Židek <mzidek@redhat.com> - 2.0.0-33
changelog:
  - Resolves: rhbz#1646113 - Missing concise documentation about valid options
                             for sssd-files-provider


author: Michal Židek <mzidek@redhat.com> - 2.0.0-34
changelog:
  - Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
                             kdestroy caused by KCM returning a wrong error
                             code during the delete operation


author: Michal Židek <mzidek@redhat.com> - 2.0.0-36
changelog:
  - Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
                             suggests using * for backend sss


author: Michal Židek <mzidek@redhat.com> - 2.0.0-38
changelog:
  - Resolves: rhbz#1578014 - sssd does not work under non-root user
  - Note: Actually the patches were in the 2.0.0-37, this one just adds this
          changelog because it was missing.


author: Michal Židek <mzidek@redhat.com> - 2.0.0-39
changelog:
  - Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
                             1.x, this can result in time outs


author: Michal Židek <mzidek@redhat.com> - 2.0.0-40
changelog:
  -Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
                            UnknownProperty: Unknown property


author: Michal Židek <mzidek@redhat.com> - 2.0.0-41
changelog:
  -Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
                            subdomain service name being used


author: Michal Židek <mzidek@redhat.com> - 2.0.0-42
changelog:
  - Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
                             of gen_new to avoid a subsequent switch call
                             failure


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-43
changelog:
  - Resolves: rhbz#1672780 - gdm login not prompting for username when smart
                             card maps to multiple users


author: Michal Židek <mzidek@redhat.com> - 2.0.0-45
changelog:
  - Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
    done here in order to unblock gating changes before rebase.
  - Related: rhbz#1682305


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-2
changelog:
  - Resolves: rhbz#1673443 - sssd man pages: The default value of
                             "ldap_user_home_directory" is not mentioned
                             with AD server configuration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-3
changelog:
  - Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
                             no members


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-4
changelog:
  - Resolves: rhbz#1283798 - sssd failover does not work on connecting to
                             non-responsive ldaps:// server


author: Michal Židek <mzidek@redhat.com> - 2.2.0-6
changelog:
  - Resolves: rhbz#1726945 - negative cache does not use values from
                             'filter_users' config option for known domains


author: Michal Židek <mzidek@redhat.com> - 2.2.0-7
changelog:
  - Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
                             not FIPS140 compliant


author: Michal Židek <mzidek@redhat.com> - 2.2.0-8
changelog:
  - Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
                             repository
                           - This just required a raise in release number
                             and changelog for the record.


author: Michal Židek <mzidek@redhat.com> - 2.2.0-10
changelog:
  - Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
                             the trailing colon


author: Michal Židek <mzidek@redhat.com> - 2.2.0-11
changelog:
  - Resolves: rhbz#1733372 - permission denied on logs when running sssd as
                             non-root user


author: Michal Židek <mzidek@redhat.com> - 2.2.0-13
changelog:
  - Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
              systemd-user service in the account phase in RHEL-8


author: Michal Židek <mzidek@redhat.com> - 2.2.0-14
changelog:
  - Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
                             should not cause files domain entries to be
                             qualified, this can break sudo access


author: Michal Židek <mzidek@redhat.com> - 2.2.0-15
changelog:
  - Resolves: rhbz#1736265 - Smart Card auth of local user: endless
                             loop if wrong PIN was provided


author: Michal Židek <mzidek@redhat.com> - 2.2.0-16
changelog:
  - Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
                             the IP address of the machine updated in IPA upon
                             sssd.service startup


author: Michal Židek <mzidek@redhat.com> - 2.2.0-17
changelog:
  - Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
                             keyring
  - Also apply a patch to fix gating tests issue


author: Michal Židek <mzidek@redhat.com> - 2.2.0-18
changelog:
  - Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
  - Also sync. kcm multihost tests with master


author: Michal Židek <mzidek@redhat.com> - 2.2.0-19
changelog:
  - Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
                             new ones (kcm)


author: Michal Židek <mzidek@redhat.com> - 2.2.3-2
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              PART2: Fix gating issue.


author: Michal Židek <mzidek@redhat.com> - 2.2.3-3
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              Increasing version number to pick latest libldb


author: Michal Židek <mzidek@redhat.com> - 2.2.3-4
changelog:
  * Resolves: rhbz#1781728 - sssctl config-check command does not give proper
                             error messages with line numbers


author: Michal Židek <mzidek@redhat.com> - 2.2.3-5
changelog:
  * Resolves: rhbz#1744500 - [Doc]Provide explanation on escape character
                             for match rules sss-certmap


author: Michal Židek <mzidek@redhat.com> - 2.2.3-9
changelog:
  * Resolves: rhbz#1783190 - [abrt] [faf] sssd:
                             raise(): /usr/libexec/sssd/sssd_autofs killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.2.3-10
changelog:
  * Resolves: rhbz#1583592 - [RFE] Add configurable randomness to SSSD ldap
                             connection timeout


author: Michal Židek <mzidek@redhat.com> - 2.2.3-14
changelog:
  - Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
                             specified up to the seconds


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-16
changelog:
  - Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
                             omitted and auth_provider is krb5


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-17
changelog:
  - Resolves: rhbz#1718193 - p11_child should have an option to skip
                             C_WaitForSlotEvent if the PKCS#11 module
                             does not implement it properly


author: Michal Židek <mzidek@redhat.com> - 2.2.3-18
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
                             information


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate
                             (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
  - Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
  - Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
  - Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
  - Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
  - Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
  - Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
  - Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
  - Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
  - Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
  - Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
  - Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
  - Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
  - Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
  - Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
  - Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
  - Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
  - Resolves: RHEL-10721 - very bad performance when requesting service tickets
  - Resolves: RHEL-19011 - Invalid handling groups from child domain
  - Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
  - Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
  - Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.1
changelog:
  - Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
  - Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
  - Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
  - Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
  - Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
  - Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.2
changelog:
  - Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
  - Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
  - Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]


author: Alejandro López <allopez@redhat.com> - 2.9.4-5.3
changelog:
  - Resolves: RHEL-112455 - p11_child currently has an infinite timeout [rhel-8.10.z]
  - Resolves: RHEL-120292 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-8.10.z]


author: Fernando Pacheco <fpacheco@redhat.com> - 1.16-1
changelog:
  - stald/utils: Space, lines and voids clenaups
  - stalld: Add an option to easily set stalld as SCHED_DEADLINE
  - stalld: Comments cleanup
  - src/utils: Comments cleanup
  - src/throttling: Comments cleanup
  - src/stalld.h Comments cleanup
    Resolves: rhbz#2068549


author: Leah Leshchinsky <lleshchi@redhat.com> - 1.17.1-1
changelog:
  - stalld: Fix memory leak in print_boosted_info()
  - utils: Check if the system is in lockdown mode
  - stalld: print process comm and cpu when boosting
  Resolves: rhbz#2120800


author: Dennis Keefe <dkeefe@redhat.com> - 2.0.0-4
changelog:
  - Update to 2.0.0
  - Resolves: rhbz#1760906
  - Fix a bug where last update time for variable length metadata was not set
    properly on startup:
  - Resolves: rhbz#1720399
  - Specify path of PID file as "/run/stratisd.pid" instead of 
    "/var/run/stratisd.pid".
  - Resolves: rhbz#1754649
  - For a particular log entry, reduce log level from INFO to DEBUG and make the
    log message more detailed:
  - Resolves: rhbz#1680052


author: Dennis Keefe <dkeefe@redhat.com> - 2.1.0-1
changelog:
  - Update to 2.1.0
  - Resolves: rhbz#1791473
  - Update Stratis RPM Spec File
  - Resolves: rhbz#1828487
  - Support per-pool encryption of the devices that form a pool's data tier
  - Resolves: rhbz#1768580
  - Improve systemd unit file description
  - Resolves: rhbz#1756525


author: Dennis Keefe <dkeefe@redhat.com> - 2.3.0-2
changelog:
  - Update to 2.3.0
  - Resolves: rhbz#1885328
  - Stratis devices inhabit an existing root directory path
  - Resolves: rhbz#1798244
  - Add Clevis Support
  - Resolves: rhbz#1868100
  - Improve stratisd log levels
  - Resolves: rhbz#1757976


author: Bryan Gurney <bgurney@redhat.com> - 2.4.0-3
changelog:
  - Update to 2.4.0
  - Resolves: rhbz#1931671
  - Improve stratis by adding Multi-threading
  - Resolves: rhbz#1927485
  - Dump stratis configuration on demand or in debug
  - Resolves: rhbz#1735475
  - Add noalign option to XFS creation on MDV
  - Resolves: rhbz#1908318
  - Cap thinpool metadata device size at devicemapper-set limit
  - Resolves: rhbz#1707461


author: Bryan Gurney <bgurney@redhat.com> - 2.4.2-1
changelog:
  - Update to 2.4.2
  - Resolves: rhbz#1931671
  - Ensure that binaries are installed with proper features enabled
  - Split dracut modules out to subpackage
  - Add additional dependencies in dracut module


author: John Kacur <jkacur@redhat.com> - 0.15.00-1
changelog:
  - Rebase to upstream V0.15.00
  - Add the following upstream patches
  - stress-shm: move /dev/shm check to earlier in the setup phase
  - stress-shm: skip stressor if /dev/shm is not mounted with tmpfs on linux
  - stress-sysfs: check for zero sysfs entries after pruning the directory
  Resolves: rhbz#2144070


author: John Kacur <jkacur@redhat.com> - 0.17.08-1
changelog:
  - Rebase to upstream V0.17.08
  - ARM: Don't declare inlined yield helper if yield is not available
  Resolves: RHEL-33304


author: John Kacur <jkacur@redhat.com> - 0.18.06-1
changelog:
  - Update the stress-ng-0.18.06 upstream
  - Include some upstream patches after 0.18.06
  Resolves: RHEL-65474


author: Michael Catanzaro <mcatanzaro@redhat.com> - 3.28.3-3
changelog:
  - Use autosetup so WebKitGTK patch actually gets applied, and rewrite the patch to work
    Resolves: RHEL-26699


author: Tom Stellard <tstellar@redhat.com> - 4.0.2-2
changelog:
  - Use make macros
    https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Disable Go tests


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.0-2.20200828git0c238a2
changelog:
  - Backport fixes from 0.4.0 stable branch. Resolves: rhbz#1868375
    (fixes usage of swtpm-localca with passwords when signing keys)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.2-1.20201201git2df14e3
changelog:
  - Update to 0.4.2, to address potential symlink vulnerabilities (CVE-2020-28407).
    Resolves: rhbz#1906043


author: <msekleta@redhat.com> - 11.7.3-7
changelog:
  - Don't trigger autofs mounts when running sadc (#2000910)
  - sar: Add missing %gnice CPU value for tickless CPU (#2000916)
  - sadf: Fix seg fault on empty data files (#1910841)
  - sar: Fix typo in manual page (#1877836)


author: Pavel Šimovec <psimovec@redhat.com> - 11.7.3-11
changelog:
  - fix the arithmetic overflow in allocate_structures() that is still possible on some 32 bit systems (CVE-2023-33204)


author: Lukáš Zaoral <lzaoral@redhat.com> - 11.7.3-13
changelog:
  - fix memory allocation errors with malformed sa files (RHEL-35511)
  - reorder patches to prevent errors during their application


author: Stan Cox <scox@redhat.com> - 4.7-1
changelog:
  - Upstream release, see wiki page below for detailed notes.
    https://sourceware.org/systemtap/wiki/SystemTapReleases


author: Frank Ch. Eigler <fche@redhat.com> - 4.8-2
changelog:
  - rhbz2156092 = rhbz1997192
  - rhbz2145241 = rhbz2145242
  - rhbz2156093 = rhbz2149223
  - rhbz2156095 = rhbz2149666
  - rhbz2156094 = rhbz2154430


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Removing build-time dependency on sharutils(rhbz#1587877)
  - Changing git dependency to smaller git-core


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-6
changelog:
  - Resolves: #1715423 - tcpdump pre creates user and groups unconditionally
  - Resolves: #1655622 - CVE-2018-19519 Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-2
changelog:
  - Resolves: #1860216 - tcpdump can not parse mptcp options
  - Resolves: #1901635 - ppp decapsulator can be convinced to allocate a large amount of memory
  - Adding tedude test to gating


author: Hangbo Fan <fanhangbo.fhb@alibaba-inc.com> - 14:4.9.3-5.0.1
changelog:
  - Add doc sub package
  - cherry-pick `add sw patch #199f8102fc30b385b28c16494d2a683ecd265166`.(nijie@wuxiat.com)


author: Jan Macku <jamacku@redhat.com> - 6.22.03-1
changelog:
  - Update to tcsh-6.22.03
  - Drop tcsh-6.22.02-avoid-gcc-to-fail.patch                              - applied by upstream
  - Drop tcsh-6.22.02-call-seterror-consistently-and-abort-quickly.patch   - applied by upstream
  - Drop tcsh-6.22.02-avoid-crashing-when-loading-corrupted-history.patch  - applied by upstream


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-69
changelog:
  - Resolves: #1445259 - telnet won't build with latest gcc
  - added note about address resolution in manpage


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-73
changelog:
  - Resolves: #1602711 - Please review important issues found by covscan
  - Resolves: #1637085 - Option -i is missing in telnet in el8 but is available in el7


author: Than Ngo <than@redhat.com> - 9:20200327-19
changelog:
  - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 9:20200406-26.0.1
changelog:
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - anolis texlive add loongarch64(Yaxuan Liu)


author: Lukáš Zaoral <lzaoral@redhat.com> - 5.2-25
changelog:
  - Fix inconsistent --map-file option spelling in manual (rhbz#2066853)
  - Fix memory corruption in tftpd when filename remapping with macro \x
    is used (rhbz#2066862)


author: Weitao Zhou <zhouwt@linux.alibaba.com> 5.2-27.0.1
changelog:
  - Make configure an order-only prerequisite of aconfig.h.in
  - remove autoreconf in %build to fix parallel build error
  - use extern in header files when declaring global variables for compatible gcc10 build
  - Add doc sub package


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: Tomas Popela <tpopela@redhat.com> - 78.12.0-3
changelog:
  - Add script to process the official tarball to comply with PELC review
  - Fix the build with newer glibc


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-7
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20388
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20382
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20530
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21214


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-9
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-30755
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30767
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-10
changelog:
  - Drop patches that are already part of xorg-x11-server
    Resolves: RHEL-30755
    Resolves: RHEL-30767
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-14
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-61999


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-15
changelog:
  - Fix CVE-2025-26594 xorg-x11-server Use-after-free of the root cursor
    Resolves: RHEL-79397
  - Fix CVE-2025-26595 xorg-x11-server Buffer overflow in XkbVModMaskText()
    Resolves: RHEL-79401
  - Fix CVE-2025-26596 xorg-x11-server Heap overflow in XkbWriteKeySyms()
    Resolves: RHEL-79386
  - Fix CVE-2025-26597 xorg-x11-server Buffer overflow in XkbChangeTypesOfKey()
    Resolves: RHEL-79380
  - Fix CVE-2025-26598 xorg-x11-server Out-of-bounds write in CreatePointerBarrierClient()
    Resolves: RHEL-79369
  - Fix CVE-2025-26599 xorg-x11-server Use of uninitialized pointer in compRedirectWindow()
    Resolves: RHEL-79364
  - Fix CVE-2025-26600 xorg-x11-server Use-after-free in PlayReleasedEvents()
    Resolves: RHEL-79360
  - Fix CVE-2025-26601 xorg-x11-server Use-after-free in SyncInitTrigger()
    Resolves: RHEL-79348


author: Adam Tkac <atkac redhat com> 0.0.90-0.4.20090403svn3751
changelog:
  - update to r3751
  - patches merged
    - tigervnc-xclients.patch
    - tigervnc-clipboard.patch
    - tigervnc-rh212985.patch
  - basic RandR support in Xvnc (resize of the desktop)
  - use built-in libjpeg (SSE2/MMX accelerated encoding on x86 platform)
  - use Tight encoding by default
  - use TigerVNC icons


author: Adam Tkac <atkac redhat com> 0.0.90-0.6.20090427svn3789
changelog:
  - update to r3789
    - tigervnc-rh494801.patch merged
  - tigervnc-newfbsize.patch is no longer needed
  - fix problems when vncviewer and Xvnc run on different endianess (#496653)
  - UltraVNC and TightVNC clients work fine again (#496786)


author: Adam Tkac <atkac redhat com> 0.0.90-0.10
changelog:
  - rebuild against 1.6.1.901 X server (#497835)
  - disable i18n, vncviewer is not UTF-8 compatible (#501832)


author: Adam Tkac <atkac redhat com> 0.0.91-0.11
changelog:
  - update to 0.0.91 (1.0.0 RC1)
  - patches merged
    - tigervnc10-rh499401.patch
    - tigervnc10-rh497592.patch
    - tigervnc10-rh501832.patch
  - after discusion in upstream drop tigervnc-bounds.patch
  - configure flags cleanup


author: Adam Tkac <atkac redhat com> 0.0.91-0.13
changelog:
  - temporary use F11 Xserver base to make Xvnc compilable
  - BuildRequires: libXi-devel
  - don't ship tigervnc-server-module on s390/s390x


author: Adam Tkac <atkac redhat com> 1.0.0-2
changelog:
  - update underlying X source to 1.6.4-0.3.fc11
  - remove bogus '-nohttpd' parameter from /etc/sysconfig/vncservers (#525629)
  - initscript LSB compliance fixes (#523974)
  - improve -LowColorSwitch documentation and handling (#510185)
  - honor dotWhenNoCursor option (and it's changes) every time (#524340)


author: Adam Tkac <atkac redhat com> 1.0.90-0.1.20091221svn3929
changelog:
  - update to 1.0.90 snapshot
  - patches merged
    - tigervnc10-compat.patch
    - tigervnc10-rh510185.patch
    - tigervnc10-rh524340.patch
    - tigervnc10-rh516274.patch


author: Adam Tkac <atkac redhat com> 1.0.90-0.2.20091221svn3929
changelog:
  - add patch for upstream X.Org issue #25909
  - add libXdmcp-devel to build requires to build Xvnc with XDMCP support (#552322)


author: Adam Tkac <atkac redhat com> 1.0.90-0.4.20091221svn3929
changelog:
  - mark stack as non-executable in jpeg ASM code
  - add xorg-x11-xauth to Requires
  - add support for X.Org 1.8
  - drop shave sources, they are no longer needed


author: Adam Tkac <atkac redhat com> 1.0.90-0.6.20100219svn3993
changelog:
  - add mesa-dri-drivers and xkeyboard-config to -server Requires
  - update to r3993 1.0.90 snapshot
    - tigervnc11-noexecstack.patch merged
    - tigervnc11-xorg18.patch merged
    - xserver18.patch is no longer needed


author: Adam Tkac <atkac redhat com> 1.0.90-0.9.20100219svn3993
changelog:
  - add server-applet subpackage which contains Java vncviewer applet
  - fix Java applet; it didn't work when run from web browser
  - add xorg-x11-xkb-utils to server Requires


author: Adam Tkac <atkac redhat com> 1.0.90-0.10.20100420svn4030
changelog:
  - update to r4030 snapshot
  - patches merged to upstream
    - tigervnc11-rh522369.patch
    - tigervnc11-rh551262.patch
    - tigervnc11-r4002.patch
    - tigervnc11-r4014.patch


author: Adam Tkac <atkac redhat com> 1.0.90-0.11.20100420svn4030
changelog:
  - link libvnc.so "now" to catch "undefined symbol" errors during Xorg startup
  - use always XkbConvertCase instead of XConvertCase (#580159, #586406)
  - don't link libvnc.so against libXi.la, libdix.la and libxkb.la; use symbols
    from Xorg instead


author: Adam Tkac <atkac redhat com> 1.0.90-0.14.20100420svn4030
changelog:
  - fix memory leak in Xvnc input code (#597172)
  - don't crash when receive negative encoding (#600070)
  - explicitly disable udev configuration support
  - add gettext-autopoint to BR


author: Adam Tkac <atkac redhat com> 1.0.90-0.17.20100721svn4113
changelog:
  - update to r4113
  - patches merged
    - tigervnc11-rh586406.patch
    - tigervnc11-libvnc.patch
    - tigervnc11-rh597172.patch
    - tigervnc11-rh600070.patch
    - tigervnc11-options.patch
  - don't own %{_datadir}/icons directory (#614301)
  - minor improvements in the .desktop file (#616340)
  - bundled libjpeg configure requires nasm; is executed even if system-wide
    libjpeg is used


author: Adam Tkac <atkac redhat com> 1.0.90-0.19.20100813svn4123
changelog:
  - separate Xvnc, vncpasswd and vncconfig to -server-minimal subpkg (#626946)
  - move license to separate subpkg and Requires it from main subpkgs
  - Xvnc: handle situations when no modifiers exist well (#611677)


author: Adam Tkac <atkac redhat com> 1.0.90-0.20.20100813svn4123
changelog:
  - press fake modifiers correctly (#633931)
  - supress unneeded debug information emitted from initscript (#633645)


author: Adam Tkac <atkac redhat com> 1.0.90-0.24.20100813svn4123
changelog:
  - rebuild against xserver 1.10.X
  - 0001-Return-Success-from-generate_modkeymap-when-max_keys.patch merged


author: Adam Tkac <atkac redhat com> 1.0.90-0.25.20101208svn4225
changelog:
  - update to r4225
  - patches merged
    - tigervnc11-rh611677.patch
    - tigervnc11-rh633931.patch
    - tigervnc11-xorg1.10.patch
  - enable VeNCrypt and PAM support


author: Adam Tkac <atkac redhat com> - 1.0.90-3
changelog:
  - fix wrong usage of memcpy which caused screen artifacts (#652590)
  - don't point to inaccessible link in sysconfig/vncservers (#644975)


author: Adam Tkac <atkac redhat com> - 1.1.0-1
changelog:
  - update to 1.1.0
  - update the xorg11 patch
  - patches merged
    - tigervnc11-glx.patch
    - tigervnc11-CVE-2011-1775.patch
    - 0001-Use-memmove-instead-of-memcpy-in-fbblt.c-when-memory.patch


author: Adam Tkac <atkac redhat com> - 1.1.0-3
changelog:
  - don't build X.Org devel docs (#755782)
  - applet: BR generic java-devel instead of java-gcj-devel (#755783)
  - use runuser to start Xvnc in systemd service file (#754259)
  - don't attepmt to restart Xvnc session during update/erase (#753216)


author: Adam Tkac <atkac redhat com> - 1.1.0-5
changelog:
  - clean Xvnc's /tmp environment in service file before startup
  - fix building against the latest JAVA 7 and X.Org 1.12


author: Adam Tkac <atkac redhat com> 1.2.80-0.1.20120905svn4996
changelog:
  - update to 1.2.80
  - remove deprecated patches
    - tigervnc-102434.patch
    - tigervnc-viewer-reparent.patch
    - tigervnc11-java7.patch
  - patches merged
    - tigervnc11-xorg111.patch
    - tigervnc11-xorg112.patch


author: Adam Tkac <atkac redhat com> - 1.2.80-0.12.20130314svn5065
changelog:
  - include /etc/X11/xorg.conf.d/10-libvnc.conf sample configuration (#712482)
  - vncserver now honors specified -geometry parameter (#755947)


author: Tim Waugh <twaugh@redhat.com> 1.2.80-0.14.20130314svn5065
changelog:
  - Use systemd rpm macros (bug #850340).  Moved systemd requirements
    from main package to server sub-package.
  - Applied Debian patch to fix busy loop when run from inetd in nowait
    mode (bug #920373).
  - Added dependency on xorg-x11-xinit to server sub-package so that
    default window manager can be found (bug #896284, bug #923655).
  - Fixed bogus changelog date.


author: Tim Waugh <twaugh@redhat.com> 1.3.0-3
changelog:
  - Avoid PIDFile problems in systemd unit file (bug #983232).
  - libvnc.so: don't use unexported key_is_down function.
  - Don't use shebang in vncserver script.


author: Tim Waugh <twaugh@redhat.com> 1.3.0-15
changelog:
  - Disable dri3 to enable building (bug #1063392).
  - Fixed heap-based buffer overflow (CVE-2014-0011, bug #1050928).


author: Tim Waugh <twaugh@redhat.com> - 1.3.1-8
changelog:
  - Input reset fixes from upstream (bug #1116956).
  - No longer need ppc64le patch as it's now in xorg-x11-server.
  - Rebased xserver114.patch again.


author: Tim Waugh <twaugh@redhat.com> - 1.4.2-1
changelog:
  - Rebased xserver116.patch against xorg-x11-server-1.17.1.
  - Allow build against xorg-x11-server-1.17.
  - 1.4.2.


author: Jan Grulich <jgrulich@redhat.com> - 1.6.0-4
changelog:
  - Utilize system-wide crypto policies
    Resolves: bz#1179345
  - Try to disable patch4 as it was previously written to support an
    older version of a different client and breaks some other usage
    Resolves: bz#1280440


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-3
changelog:
  - Bug 1438704 - CVE-2017-7392 CVE-2017-7393 CVE-2017-7394
                  CVE-2017-7395 CVE-2017-7396 tigervnc: various flaws
    + other upstream related fixes


author: Jan Grulich <jgrulich@redhat.com> - 1.9.0-7
changelog:
  - Improve coverity scan fixes
    Resolves: bz#1602714

    Inform whether view-only password is used or not
    Resolves: bz#1639169

    Backport fixes from RHEL 7
    Resolves: bz#1651254


author: Jan Grulich <jgrulich@redhat.com> - 1.10.1-5
changelog:
  - Install the HOWTO file to correct location
  - Add /usr/bin/vncserver file informing users to read the HOWTO.md file
    Resolves: bz#1790443


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-1
changelog:
  - Update to 1.11.0
    Resolves: bz#1880985
  - Backport fix to allow Tigervnc use boolean values in config files
    Resolves: bz#1883415


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-2
changelog:
  - Revert removal of vncserver
    Resolves: bz#1897504
  - Correctly start vncsession as a daemon
    Resolves: bz#1897498


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-4
changelog:
  - Added vncsession-restore script for SELinux policy migration
    Fix SELinux context for root user
    Resolves: bz#2021892


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-1
changelog:
  - 1.13.1
    Resolves: bz#2175748
  - Restore "--fallbacktofreeport" option in the vncserver script
    Resolves: bz#2174398


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege
    Escalation Vulnerability
    Resolves: bz#2180306


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-4
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
    Resolves: RHEL-15236

  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15230


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-5
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18410
  - Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18422


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-4
changelog:
  - Add option "ApproveLoggedUserOnly" allowing to connect only the user
    owning the running session
    Resolves: RHEL-91104


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-6
changelog:
  - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors
    Resolves: RHEL-97268
  - Fix CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97294
  - Fix CVE-2025-49178: xorg-x11-server: Unprocessed Client Request Due to Bytes to Ignore
    Resolves: RHEL-97364
  - Fix CVE-2025-49179: xorg-x11-server: Integer overflow in X Record extension
    Resolves: RHEL-97397
  - Fix CVE-2025-49180: xorg-x11-server: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension
    Resolves: RHEL-97232


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-7
changelog:
  - Additional fix to CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97294


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-8
changelog:
  - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation
    Resolves: RHEL-119979

  - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal
    Resolves: RHEL-120001

  - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb extension XkbSetCompatMap()
    Resolves: RHEL-120762


author: Justin Stephenson <jstephen@redhat.com> - 8-1
changelog:
  - Release v8
  - Spec file fixes for EL6
  - Spec file improvements for Debian/Ubuntu pkg-config
  - Tlog-play improve authentication options
  - Handle piped in I/O from stdin and improve the main recording transfer exit
    condition.
  - Use empty string on hostname resolution failure


author: Justin Stephenson <jstephen@redhat.com> - 9-1
changelog:
  - Release v9
  - Add libutempter support
  - Require journal match filter
  - Add file reader match functionality
  - Restore cursor visibility and color attributes on tlog-play exit
  - Add "time" real clock timestamp message field
  - Various upstream CI improvements


author: Justin Stephenson <jstephen@redhat.com> - 11-1
changelog:
  - Fire SIGCHLD after utempter_add_record since it probably eats it.
  - Correct suse rpmbuild
  - Update debbuild for travis CI


author: Justin Stephenson <jstephen@redhat.com> - 12-1
changelog:
  - Release v12
  - Prevent infinite transfer loop on GDM login.
  - tlog-play: add journal namespace support.
  - tlitest: extend delay for limit-action delay test.


author: Justin Stephenson <jstephen@redhat.com> - 12.1
changelog:
  - Exit transfer loop when output fd is closed
  - Revert "Prevent infinite transfer loop on GDM login"


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-3
changelog:
  - Rebuild for CVE-2022-41723, CVE-2023-24534, CVE-2023-24536 and
    CVE-2023-24538
  Resolves: #2187343, #2187363, #2203694


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-3
changelog:
  - Rebuild for CVE-2022-41723, CVE-2023-24534, CVE-2023-24536 and
    CVE-2023-24538
  Resolves: #2187345, #2187368, #2203690


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-7
changelog:
  - Rebuild for CVE-2023-29406, CVE-2023-39318 and CVE-2023-39319
  Resolves: RHEL-4231, RHEL-4475, RHEL-4502


author: Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-1
changelog:
  - Update to 0.0.99.2
  - Make 'toolbox' create or fall back to a container if possible
  Resolves: #1914687
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-2
changelog:
  - Actually apply the patch to make 'toolbox' create or fall back to a
    container if possible
  - Support logging into a registry if necessary
  - Related: #1934415


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-2
changelog:
  - Update to 0.0.99.3
  - BuildRequire only systemd-rpm-macros as recommended by the Fedora packaging
    guidelines
  - Update the Summary to match upstream
  - Update the URL to point to the website
  Resolves: #2047290


author: Honggang Li <honli@redhat.com> - 4.2.10-25
changelog:
  - Rebase to latest Fedora release
  - Fix file conflicts in torque-devel multilib packages
  - Resolve: bz1853167


author: Kalev Lember <klember@redhat.com> - 3.38.2-2
changelog:
  - Use conflicts for totem-video-thumbnailer split instead of self-obsoletes
  - Resolves: rhbz#1949422


author: Miloslav Trmac <mitr@redhat.com> - 1:3.2.4-8
changelog:
  - Fix at least a few obvious instances of C abuse (partly #74594 with patch by
    Sysoltsev Slawa)
  - Drop -Dcfree=free fix, not needed with current version


author: Than Ngo <than@redhat.com> 3.2.4-14
changelog:
  - fix #191825, buildrequire on imake
  - fix #173748, fig2dev still refers to /usr/X11R6/lib/X11/rgb.txt


author: Ville Skyttä <ville.skytta at iki.fi> - 1:3.2.5-7
changelog:
  - Get rid of csh dependency, add missing one on bc (#435993).
  - Build with $RPM_OPT_FLAGS (#329831).
  - Convert specfile to UTF-8.
  - Add URL, fix source URL.
  - Escape macros in changelog.
  - Improve summary.


author: Kamil Dudka <kdudka@redhat.com> - 1:3.2.5c-1
changelog:
  - new upstream release
  - patch to generate comments compliant with DSC 3.0, thanks to Ian Dall
    (#558380)


author: Kamil Dudka <kdudka@redhat.com> - 1:3.2.5d-11
changelog:
  - install man pages using the correct file name suffix
  - provide the fig2ps2tex.sh man page as a symlink


author: Wim Taymans <wtaymans@redhat.com> - 0.3.13-12
changelog:
  - Add explicit Requires for the -libs package.
  - Do NVR bump to move twolame-devel from buildroot to CRB
  - Resolves: rhbz#1843275


author: Nils Philippsen <nils@redhat.com> - 1.2.1-3
changelog:
  - drop requirements on cmake, pkgconfig and rather own the directories for the
    files augmenting these packages


author: Andreas Schneider <asn@redhat.com> - 1.2.2-1
changelog:
  - Update to version 1.2.2:
    * Added support for fork'ed and then exec'ed processes
    * Added support for Alpha


author: Andreas Schneider <asn@redhat.com> - 1.2.4-1
changelog:
  - Update to version 1.2.4
    * Added deadlock workaround for glibc < 2.24
    * Fixed a possible deadlock bug if uid_wrapper is turned off
    * Logging is always turned on now
    * Fixed a memory leak
    * Limited number of groups during fork+exec


author: Murray Todd Williams <murray@codingapes.com>
changelog:
  - added a unixODBC-devel RPM to the group, added KDE links and icons to system
  - all of which came from recommendations from Fredrick Meunier
  - <Fredrick.Meunier@computershare.com.au>


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - enable GUI now that we have KDE compiled with the standard
    compiler
  - move the applnk entries to the KDE package


author: Fernando Nasser <fnasser@redhat.com> 2.2.5-1
changelog:
  - Moved odbctest to the kde package to remove require on Qt stuff
    from the main package.
  - Removed stray "\" from doc/Makefile.am
  - Applied libtool fix (provided by Alex Oliva) so that it build
   with cross-compilers (which are used by 64 bit systems)
  - Updated sources to the 2.2.5 community release
  - Changed the included libtool to the 1.5-3 one so that
    it properly link the libraries with the newly generated ones
    and not with the ones installed on the build system (or give
    an error if an old version is not installed (# 91110)
  - Added new files for executable DataManagerII and icons LinuxODBC.xpm
    and odbc.xpm


author: Fernando Nasser <fnasser@redhat.com> 2.2.5-3
changelog:
  - Moved all the shared library symlinks to the main package.
    They were deliberatedly being added to the devel package for
    unknown reasons but this was forcing users to install the
    devel package always.
  - No need to special-case libodbc.so anymore


author: Fernando Nasser <fnasser@redhat.com> 2.2.5-4
changelog:
  - Revert previous change and special case libodbcpsql.so and
    libodbcpsqlS.so instead.  Here is the explanation (from Elliot
    Lee):
    ".so files are only used at link time for normal dynamic libraries.
     The libraries referred to here are being used as dynamically loaded
     modules, so I guess moving those particular .so files back to the
     main package would make sense, but the other .so files should stay
     in the devel subpackage."


author: Fernando Nasser <fnasser@redhat.com> 2.2.5-9
changelog:
  - Add comments to the /etc/odbcinst.ini file regarding the proper
    setup for MySQL and the origin of each library needed.


author: Fernando Nasser <fnasser@redhat.com> 2.2.5-9
changelog:
  - Add XFree86-devel to the list of BuildPrereq.  Did not bump
    release as there is no need to rebuild.


author: Tom Lane <tgl@redhat.com> 2.2.8-4
changelog:
  - Add dependency to ensure kde subpackage stays in sync with main
    (needed because we moved odbctest from one pkg to the other,
    cf bug #122478)
  - rebuilt


author: Tom Lane <tgl@redhat.com> 2.2.11-2
changelog:
  - Remove Makefiles accidentally included in docs installation (bz #168819)
  - Updates to keep newer libtool code from installing itself as part of package


author: Tom Lane <tgl@redhat.com> 2.2.11-3
changelog:
  - Force update of yac.h because the copy in the distributed tarball does not
    match bison 2.0's numbering of symbols (bz #162676)
  - Include documentation of text-file driver
  - Use private libltdl so we can omit RTLD_GLOBAL from dlopen flags (bz #161399)


author: Tom Lane <tgl@redhat.com> 2.2.11-6
changelog:
  - Patch NO-vs-no discrepancy between aclocal/acinclude and recent autoconf
    versions (not sure if this has been broken for a long time, or was just
    exposed by modular X changeover).
  - Apparently need to require libXt-devel too for modular X.


author: Tom Lane <tgl@redhat.com> 2.2.12-6
changelog:
  - Move libodbcinst.so symlink into main package, since it's often dlopen'd
  Related: #204882
  - Clean up specfile's ugly coding for making base-vs-devel decisions


author: Tom Lane <tgl@redhat.com> 2.2.12-8
changelog:
  - Install icons in /usr/share/pixmaps, not /usr/share/icons as this package
    has historically done; the former is considered correct.


author: Tom Lane <tgl@redhat.com> 2.2.14-1
changelog:
  - Update to unixODBC 2.2.14.  Note this involves an ABI break and a consequent
    soname version bump, because upstream fixed some mistakes in the widths of
    some API datatypes for 64-bit platforms.  Also, the formerly embedded
    mysql, postgresql, and text drivers have been removed.  (For mysql and
    postgresql, use the separate mysql-connector-odbc and postgresql-odbc
    packages, which are far more up to date.  The text driver is not currently
    shipped by upstream at all, but might get revived as a separate SRPM later.)
  - Stop shipping .a library files, per distro policy.
  - Fixes for libtool 2.2.


author: Peter Lemenkov <lemenkov@gmail.com> - 2.2.14-4
changelog:
  - Properly install *.desktop files
  - No need to ship INSTALL in docs
  - Use macros instead of hardcoded /usr/share and /usr/include
  - fixed permissions on some doc- and src-files
  - Almost all rpmlint messages are gone now


author: Tom Lane <tgl@redhat.com> 2.2.14-6
changelog:
  - Switch to building against qt4, not qt3.  This means the DataManager,
    DataManagerII, and odbctest applications are gone.
  Resolves: #514064
  - Use Driver64/Setup64 to eliminate need for hand-adjustment of odbcinst.ini
  Resolves: #514688
  - Fix misdeclaration of SQLBIGINT and SQLUBIGINT in generated header files
  Resolves: #518623


author: Tom Lane <tgl@redhat.com> 2.2.14-7
changelog:
  - Clean up bogosity in multilib stub header support: ia64 should not be
    listed (it's not multilib), sparcv9 isn't a possible uname -i output


author: Tom Lane <tgl@redhat.com> 2.3.1-1
changelog:
  - Update to version 2.3.1.  The main externally-visible change is that the
    GUI programs are not part of the unixODBC tarball anymore, so they are no
    longer in this package, and the unixODBC-kde sub-RPM has disappeared.
    There is a separate package unixODBC-gui-qt that now provides those programs.


author: Jan Stanek <jstanek@redhat.com> - 2.3.3-1
changelog:
  - Update to version 2.3.3
  - Removed patches and sources included upstream
  - Recreated so-version-bump.patch


author: Attila Lakatos <alakatos@redhat.com> - 0.7.8-4
changelog:
  - RHEL 8.3.0 ERRATUM
  - Spec file clean up
  - Rebase to 0.7.8
  Resolves: rhbz#1738590
  - Added selinux subpackage
  Resolves: rhbz#1683567
  - Added notifier subpackage
  - Installing /etc/usbguard/rules.d/
  Resolves: rhbz#1667395
  - Fixed sigwaitinfo handling
  Resolves: rhbz#1835210


author: Radovan Sroka <rsroka@redhat.com> - 0.7.8-5
changelog:
  - RHEL 8.3.0 ERRATUM
  - Use old-fasioned forking style in unit file
  Resolves: rhbz#1846885
  - Allow usbguard to read /proc/cpuinfo
  Resolves: rhbz#1847870
  - Removed notifier's Requires for usbguard-devel
  Resolves: rhbz#1667395
  - Allow usbguard to read /dev/urandom
  Resolves: rhbz#1848618


author: Radovan Sroka <rsroka@redhat.com> - 0.7.8-6
changelog:
  - RHEL 8.3.0 ERRATUM
  - Removed execstack from .spec
  - Removed AuthorizedDefault=wired from the usbguard
  Resolves: rhbz#1852539
  - Missing error message on bad configuration
  Resolves: rhbz#1857299
  - /etc/usbguard/usbguard-daemon.conf file does not contain all default options
  Resolves: rhbz#1862907


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-1
changelog:
  - Rebase to 1.0.0
  Resolves: rhbz#1887448
  - Filtering rules by attribute
  Resolves: rhbz#1873953
  - Change device policy of multiple devices using rule instead of ID
  Resolves: rhbz#1852568


author: Zoltan Fridrich <zfridric@redhat.com> - 1.0.0-8
changelog:
  - change usbguard icon injection
  - fix DSP module definition in spec file
  Resolves: rhbz#2014441
  - add execstack to spec
  - remove IPAddressDeny from usbguard service
  Resolves: rhbz#1929364
  - fix file conflict when installing usbguard on rhel
  Resolves: rhbz#1963271
  - fix IPC access control files override
  Resolves: rhbz#2004511
  - validate ACL permission existence
  Resolves: rhbz#2005020
  - decrease usbguard-notifier spam when denied connection
  Resolves: rhbz#2000000


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-8.2
changelog:
  - Fix unauthorized access via D-bus
  - Fix memory leak on D-bus connection failure
  Resolves: rhbz#2127848


author: Victor Toso <victortoso@redhat.com> - 0.13.0-1
changelog:
  - Rebase to latest upstream: 0.13.0
  - Keeps usbredirserver binary (removed upstream)
    Related: rhbz#2135760


author: Victor Toso <victortoso@redhat.com> - 0.13.0-2
changelog:
  - Fixes 100% CPU usage when usbredirect used as TCP server
    Related: rhbz#2157520
  - Fixes USB redirection of identical devices
    Resolves: rhbz#2157520


author: James Antill <james@fedoraproject.org> - 1.0.4-20
changelog:
  - Move doc/ustr-devel-<version> to doc/ustr-devel. BZ 993940.
  - Use -fgnu89-inline workaround for gcc5.


author: Mark Wielaard <mjw@redhat.com> - 3.21.0-2
changelog:
  - Upgrade to upstream 3.21.0
  - Remove upstreamed patches
  - Add valgrind-3.21.0-no-memcpy-replace-check.patch


author: Mark Wielaard <mjw@redhat.com> - 3.21.0-7
changelog:
  - Add valgrind-3.21.0-callgrind_control-no-strict.patch
  - Add valgrind-3.21.0-realloc-again.patch
  - Update valgrind-3.21.0-no-memcpy-replace-check.patch (memcpy_chk)
  - Add valgrind-3.21.0-vgm.patch and valgrind-3.21.0-vgm-tests.patch
  - Add valgrind-3.21.0-pgste.patch


author: Mark Wielaard <mjw@redhat.com> - 3.22.0-1
changelog:
  - Upstream 3.22.0 final
  - BuildRequires elfutils-debuginfod for testing
  - Remove all upstreamed patches
  - Adjust valgrind-3.16.0-some-stack-protector.patch
  - Adjust valgrind-3.16.0-some-Wl-z-now.patch
  - Add cachegrind.h to valgrind-devel package
  - Use %patch -Pn instead of deprecated %patchn


author: Binbin Zhou <zhoubinbin@loongson.cn> - 3.22.0-3
changelog:
  - Add valgrind-3.22.0-Add-LoongArch64-Linux-support.patch
  - Add valgrind-3.22.0-LoongArch64-Sync-kernel-4.19.patch


author: Lubos Uhliarik <luhliari@redhat.com> - 0.15.0-1
changelog:
  - updated to newer version (0.15.0)
  - Drop EPEL and older Fedora releases support
  - Drop broken manual ABI dependency to Varnish
  - Drop commented out references to past patches
  - Verbose test suite
  - Simplified configure step
  - Dependencies cleanup


author: Karsten Hopp <karsten@redhat.com> 7.3.638-2
changelog:
  - fix some man page typos (#668894, #675480)
  - own usr/share/vim/vimfiles/doc/tags (#845564)
  - add path to csope database (#844843)


author: Karsten Hopp <karsten@redhat.com> 7.4.5-1
changelog:
  - patchlevel 5
  - when closing a window fails ":bwipe" may hang
  - "vaB" while 'virtualedit' is set selects the wrong area


author: Karsten Hopp <karsten@redhat.com> 7.4.009-1
changelog:
  - patchlevel 009
    mkdir("foo/bar/", "p") gives an error message
    creating a preview window on startup messes up the screen
    new regexp engine can't be interrupted
    too easy to write a file was not decrypted (yet)


author: Karsten Hopp <karsten@redhat.com> 7.4.909-1
changelog:
  - patchlevel 909
  - Fedora vim now uses tarballs created from upstream git instead
    of just upstream patches. Now runtime files will have fixes, too.


author: Karsten Hopp <karsten@redhat.com> - 7.4.1718-2
changelog:
  - add vimfiles_root macro (rhbz#844975)
  - add %_libdir/vim  directory for plugins (rhbz#1193230)
  - vi, rvi, rview, ex, view don't read vimrc anymore. They use virc instead
    (rhbz#1045815)
  - fix dates in changelogs when spec.vim is used and locale != 'C'


author: Karsten Hopp <karsten@redhat.com> - 7.4.1797-3
changelog:
  - use uncompressed help files. vimtutor and vi will access those when
    vim-common is installed.  (rhbz#1262182)
    No hard requirement vim-minimal -> vim-common added, to allow minimal
    installations


author: Karsten Hopp <karsten@redhat.com> - 7.4.1830-3
changelog:
  - mv vim.sh and vim.csh to source files
  - sh profile.d improvements: don't leak $ID, don't fail on nounset
    (rhbz#1339106 Ville Skyttä)


author: Karsten Hopp <karsten@redhat.com> 8.0.134-1
changelog:
  - patchlevel 134
  - f24->f25 vim: copy paste no longer works (bug #1401410) - revert previous changes, set mouse=v in defaults.vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.134-2
changelog:
  - f24->f25 vim: copy paste no longer works (bug #1401410) - deleting mouse setting block from defaults.vim


author: Karsten Hopp <karsten@redhat.com> 8.0.347-1
changelog:
  - patchlevel 347
  - 1405234 - Gvim fails to properly render after Openbox desktop switch
  - 1426296 - vim: FTBFS with python3-3.6.0-18.fc26


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.685-3
changelog:
  - update python dependencies accordingly Fedora Guidelines for Python (python-devel -> python2-devel)


author: Karsten Hopp <karsten@redhat.com> 8.0.1092-1
changelog:
  - editing vim-update.sh for building package
  - patchlevel 1092
  - 1487175 - VIm conflicts in man pages


author: Karsten Hopp <karsten@redhat.com> 8.0.1102-1
changelog:
  - vim-update.sh - add test for succesful build and fixing grepping of update's list
  - patchlevel 1102


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1428-4
changelog:
  - throw vim.1.gz out from vim-minimal and other manpages from vim-common
  - appdata should be in metainfo folder now


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1523-2
changelog:
  - gcc is no longer in buildroot by default
  - 1546116 - make vim-filesystem noarch package
  - remove %{_libdir}/vim, because it is unused


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1666-2
changelog:
  - suggests ruby-libs, python2-libs, python3-libs, perl-libs and lua-libs for vim and gvim(bug #1562057)


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1763-2
changelog:
  - 1576470 - Suggest correct packages to get embedded interpreters working
  - add libappstream-glib for appstream-util
  - 1576483 - Vim needs Python2 to build


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-8
changelog:
  - 1640919 - augroup fedora, test case failure: /CoreOS/vim/Regression/bz241308-use-augroup-for-rh-autocmds


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16
changelog:
  - 2004975 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-8.6.0]
  - 2004892 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-17
changelog:
  - 2016201 - CVE-2021-3872 vim: heap-based buffer overflow in win_redr_status() drawscreen.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - 2028341 - CVE-2021-3984 vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow [rhel-8.6.0]
  - 2028430 - CVE-2021-4019 vim: heap-based buffer overflow in find_help_tags() in src/help.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read
  - CVE-2021-4192 vim: vulnerable to Use After Free


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0261 vim: Heap-based Buffer Overflow in block_insert() in src/ops.c
  - CVE-2022-0318 vim: heap-based buffer overflow in utf_head_off() in mbyte.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - fix test suite after fix for CVE-2022-0318
  - CVE-2022-0359 vim: heap-based buffer overflow in init_ccline() in ex_getln.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-20
changelog:
  - CVE-2022-1785 vim: Out-of-bounds Write
  - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
  - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-21
changelog:
  - RHEL-112003 CVE-2025-53905 vim: Vim path traversial
  - RHEL-112007 CVE-2025-53906 vim: Vim path traversal


author: Mahailiang <mahailiang@openanolis.org> - 2:8.0.1763-21.0.1
changelog:
  - Rebrand to Anolis(Xiaoxuan Yang)
  - Fix build issue with ruby(Liwei Ge)
  - add sw patch
  - add support for gcc having version beyond 10.0.


author: Marek Kasik <mkasik@redhat.com> - 3.22.0-22
changelog:
  - Rebuild due to new version of FreeRDP
  - Fix an issue when RDP connection shows just black screen
  - Resolves: #1839744


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-11
changelog:
  - v2v: windows: Allow qxldod.inf as synonym for qxl.inf
    resolves: rhbz#1926102
  - v2v: Increase required free space in Windows to 100 MB
    resolves: rhbz#1949147
  - docs: Document how to remove "Out of HTTP sessions" limit
  - v2v: Disable readahead for VMware curl sources too
    resolves: rhbz#1848862
  - v2v: Allow output to block devices
    resolves: rhbz#1868690
  - docs: -o openstack: Clarify name of file containing OpenStack auth
    resolves: rhbz#1871754
  - docs: UEFI guest conversion to -o openstack is supported
    resolves: rhbz#1872100
  - v2v: Turn pnp_wait.exe warning into a debug message
    resolves: rhbz#1903960
  - v2v: windows: Fix schtasks /SD parameter
    resolves: rhbz#1895323


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-13
changelog:
  - docs: Fix version of virt-v2v which added UEFI for OpenStack
    related: rhbz#1872100
  - v2v: Increase Linux minimum root filesystem to 100 MB
    resolves: rhbz#1764569


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-17
changelog:
  - Correct regexps used to fix schtasks command
  - Fix backing file specified without backing format
    resolves: rhbz#2023279, rhbz#2025769


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-21
changelog:
  - Fix assertion failure when parsing OVA dir with trailing slash
    resolves: rhbz#2028823
  - For -o rhv-upload wait for VM creation task
    resolves: rhbz#1985827
  - If listing RPM applications fails, rebuild DB and retry (2089623)
  - Fix CVE-2022-2211 Denial of Service in --key parameter
    resolves: rhbz#2102720


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-22
changelog:
  - RHEL 8: If setfiles fails fall back to autorelabel
    resolves: rhbz#XXX
  - Reapply patches since we are using git format-patch --submodule=diff


author: Uri Lublin <uril@redhat.com> - 10.0-3
changelog:
  - Show OS-ID when running 'remote-viewer -V'
    Resolves: rhbz#1953282
  - Clear auth entry fields
    Resolves: rhbz#1953933


author: Daniel P. Berrangé <berrange@redhat.com> - 11.0-1
changelog:
  - Rebase to 11.0 release
  - Add missing dep on libvirt-client for bash completion
  - Resolves: rhbz#2028604, rhbz#2000528


author: Jiri Kucera <jkucera@redhat.com> - 0.3.11-4
changelog:
  - fixed License
  - Requires: /usr/bin/gpg2 in libs subpackage
  - Added support for opening all types of LUKS devices
    Resolves: #1626974


author: Seth Vidal <skvidal@phy.duke.edu>
changelog:
  - First RPM packaging
  - Stolen items from wu-ftpd's pam setup
  - Separated rh 7 and rh 6.X's packages
  - Built for Rh6


author: Seth Vidal <skvidal@phy.duke.edu>
changelog:
  - updated to 0.0.15
  - added entry for vsftpd.8 man page
  - added entry for vsftpd.log logrotate file
  - added TUNING file to docs list


author: Trond Eivind Glomsrød <teg@redhat.com> 1.0.1-4
changelog:
  - s/Copyright/License/
  - add "missingok" to the logrotate script, so we don't get errors
    when nothing has happened


author: Bill Nottingham <notting@redhat.com> 1.0.1-5
changelog:
  - don't spit out ugly errors if anonftp isn't installed (#62987)
  - fix horribly broken userlist setup (#62321)


author: Elliot Lee <sopwith@redhat.com> 1.0.1-8
changelog:
  - -D_FILE_OFFSET_BITS=64
  - smp make
  - remove forced optflags=-g for lack of supporting documentation


author: Nalin Dahyabhai <nalin@redhat.com> 1.0.1-9
changelog:
  - remove absolute paths from PAM configuration so that the right modules get
    used for whichever arch we're built for on multilib systems


author: Bill Nottingham <notting@redhat.com> 1.2.0-3
changelog:
  - tweak man page (#84584, #72798)
  - buildprereqs for pie (#99336)
  - free ride through the build system to fix (#101582)


author: Karsten Hopp <karsten@redhat.de> 1.2.1-1
changelog:
  - update to 1.2.1, which fixes #89765 and lot of other issues
  - remove manpage patch, it isn't required anymore
  - clean up init script
  - don't use script to find libs to link with (lib64 issues)


author: Bill Nottingham <notting@redhat.com> 1.2.1-5
changelog:
  - fix all references to vsftpd.conf to be /etc/vsftpd/vsftpd.conf,
    including in the binary (#121199, #104075)


author: Radek Vokal <rvokal@redhat.com> 2.0.1-1
changelog:
  - tcp_wrapper patch updated, signal patch updated
  - upgrade to 2.0.1, fixes several bugs, RHEL and FC builds


author: Radek Vokal <rvokal@redhat.com> 2.0.3-10
changelog:
  - vsfptd.log as a default log file has to be rotated (#167359)
  - vsftpd does dns reverse before passing hosts to pam_access.so (#159745)


author: Maros Barabas <mbarabas@redhat.com> - 2.0.5-14
changelog:
  - remove file upload permission problem 
  - change name of patch vsfptd-2.0.3-user_config
  - Resolves #190193


author: Maros Barabas <mbarabas@redhat.com> - 2.0.5-16
changelog:
  - Merge review: - fix using %{_var}, %{_sbindir} and 
                    %{_sysconfigdir} macros for files and install
                  - fix BuildRoot
                  - dropped usermod, openssl & pam requirement


author: Martin Nagy <mnagy@redhat.com> - 2.0.5-21
changelog:
  - Remove uniq_rename patch.
  - Correct create/lock race condition, original patch by <mpoole@redhat.com>
    (#240550).
  - Fix bad handling of unique files (#392231).
  - Added userlist_log option.
  - Allow usernames to begin with underscore or dot (#339911).
  - Removed user_config patch.
  - Fix nonrootconf patch (#400921).
  - Increase maximum length of allowed username (#236326).
  - Fix file listing issue with wildcard (#392181).
  - Removed use_localtime patch (#243087).


author: Martin Nagy <mnagy@redhat.com> - 2.0.6-1
changelog:
  - rebase for new upstream version
  - remove patches that were fixed in upstream: kickline, confspell, anon_umask


author: Martin Nagy <mnagy@redhat.com> - 2.1.0-0.1.pre3
changelog:
  - update to latest upstream release
  - cleanup the spec file
  - drop patches fixed upstream:
      vsftpd-1.0.1-missingok.patch
      vsftpd-1.2.1-nonrootconf.patch
      vsftpd-2.0.1-tcp_wrappers.patch
      vsftpd-2.0.2-signal.patch
      vsftpd-2.0.3-daemonize_fds.patch
      vsftpd-2.0.5-correct_comments.patch
      vsftpd-2.0.5-pasv_dot.patch
      vsftpd-2.0.5-write_race.patch
      vsftpd-2.0.5-fix_unique.patch
      vsftpd-2.0.5-uname_size.patch
      vsftpd-2.0.5-bind_denied.patch
      vsftpd-2.0.5-pam_end.patch
      vsftpd-2.0.5-underscore_uname.patch
      vsftpd-2.0.6-listen.patch
  - join all configuration patches into one:
      vsftpd-1.1.3-rh.patch
      vsftpd-1.2.1-conffile.patch
      vsftpd-2.0.1-dir.patch
      vsftpd-2.0.1-server_args.patch
      vsftpd-2.0.3-background.patch
      vsftpd-2.0.5-default_ipv6.patch
      vsftpd-2.0.5-add_ipv6_option.patch
      vsftpd-2.0.5-man.patch


author: Martin Nagy <mnagy@redhat.com> - 2.1.0-0.3.pre4
changelog:
  - update to latest upstream release
  - enable ptrace sandbox again
  - don't mark vsftpd_conf_migrate.sh as a config file


author: Jiri Skala <jskala@redhat.com> - 2.1.0-3
changelog:
  - updated to latest upstream version
  - improved daemonizing - init script gets correct return code if binding fails
  - trim white spaces from option values
  - fixed #483604 - vsftpd not honouring delay_failed_login when userlist active


author: Jiri Skala <jskala@redhat.com> - 2.3.4-6
changelog:
  - fixes #753365 - multiple issues with vsftpd's systemd unit
  - removes exclusivity between listen and listen_ipv6 BZ#450853
  - ls wildchars supports square brackets


author: Jiri Skala <jskala@redhat.com> - 3.0.1-1
changelog:
  - update to latest upstream 3.0.1
  - fixes #851441 - Introduce new systemd-rpm macros in vsftpd spec file
  - fixes #845980 - vsftpd seccomp filter is too strict


author: Jiri Skala <jskala@redhat.com> - 3.0.2-6
changelog:
  - fixes usage pasv_address option in combination with external IP
  - updated man pages - multile instances using vsftpd.target


author: Jiri Skala <jskala@redhat.com> - 3.0.2-8
changelog:
  - adds reverse lookup option to vsftpd.conf
  - changes types of uid and gid to uint
  - removes spare patch pasv-addr
  - implements DH cipher
  - gets rid init scirpt subpackage


author: Jiri Skala <jskala@redhat.com> - 3.0.2-10
changelog:
  - improves DH cipher
  - implements ECDH cipher
  - adds isolate* options to man vsftpd.conf
  - corrects max_clients, max_per_ip default values in man vsftd.conf
  - adds return code 450 when a file is temporarily unavailable


author: Martin Sehnoutka <msehnout@redhat.com> - 3.0.3-2
changelog:
  - Applied patches:
  - Readd seccomp disabled by default
  - vsftpd local_max_rate option doesn't work as expected
  - The vsftpd hangs in a SIGCHLD handler when the pam_exec.so is used in pam.d 
  - configuration
  - The vsftpd doesn't remove failed upload when the delete_failed_uploads is 
  - enabled and the network cable is unplagged
  - man pages bug
  - vsftpd segfaults in vsf_sysutil_strndup
  - Fix logging when syslog is used


author: Martin Sehnoutka <msehnout@redhat.com> - 3.0.3-3
changelog:
  - Review patches
  - Add TLSv1.{1,2} options
  - Fix question mark wildcard within a file name
  - Seccomp patch removed


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.3-8
changelog:
  - Build against OpenSSL 1.1
  - Redefine VSFTP_COMMAND_FD to 1 to get errors generated during
  - startup picked up by systemd
  - Resolves: rhbz#1443055


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.3-13
changelog:
  - Document the new default for ssl_ciphers in the man page
  - Related: rhbz#1483970
  - When handling FEAT command, check ssl_tlsv1_1 and ssl_tlsv1_2
  - Patch was written by Martin Sehnoutka
  - Resolves: rhbz#1432054
  - Disable TLSv1 and TLSv1.1 - enable only TLSv1.2 by default


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.3-16
changelog:
  - Disable tcp_wrappers support
  - Resolves: rhbz#1518796
  - Fix default value of strict_ssl_read_eof in man page


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.3-18
changelog:
  - Add a new config option 'better_stou', which can be used to enable
    a better algorithm for generating unique filenames for the STOU command.
  - Resolves: rhbz#1479237


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.3-25
changelog:
  - Add config option log_die allowing to pass error messages to syslog
  - Add config option bind_retries allowing to change the max number
  - of attempts to find a listening port for the PASV/EPSV command
  - Resolves: rhbz#1318198


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.3-32
changelog:
  - Removed a hint about the ftp_home_dir SELinux boolean from the config file
  - Resolves: rhbz#1623424


author: Artem Egorenkov <aegorenk@redhat.com> - 3.0.3-34
changelog:
  - Enable support for wide-character strings in logs
  - Replace unprintables with HEX code, not question marks
  - Resolves: rhbz#1947900


author: José Expósito <jexposit@redhat.com> - 1.3.283.0-3
changelog:
  - Provides/Obsoletes vulkan-validation-layers-devel
    Resolves: https://issues.redhat.com/browse/RHEL-54290


author: Bo Ren <rb01097748@alibaba-inc.com> 2.46.6-2.0.1
changelog:
  - Exclude loongarch64
  - cherry-pick `add sw arch #ef8be098b07c4d8a9f809d32a607700f4a420676`. (nijie@wxiat.com)
  - Remove patches for cmake and gstreamer (wb-zh951434@alibaba-inc.com)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.30.2-2
changelog:
  - Try to fix coverity build by disabling docs (thanks to Kamil Dudka <kdudka@redhat.com>!)
  - Related: #1883304


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.1-1
changelog:
  - Update to 2.36.1
    Related: #2061994
  - Resolves: #2075492
  - Resolves: #2075494
  - Resolves: #2075496


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1.4
changelog:
  - Add patch for CVE-2023-28204
    Resolves: #2209744
  - Add patch for CVE-2023-32373
    Resolves: #2209727


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.5-1
changelog:
  - Upgrade to 2.40.5. Also, disable JIT
    Resolves: #2176269
    Resolves: #2185742
    Resolves: #2209728
    Resolves: #2209745
    Resolves: #2218649
    Resolves: #2218651
    Resolves: #2224611


author: Bo Ren <rb01097748@alibaba-inc.com> 2.48.1-1.0.1
changelog:
  - Exclude loongarch64
  - cherry-pick `add sw arch #ef8be098b07c4d8a9f809d32a607700f4a420676`. (nijie@wxiat.com)
  - Remove patches for gstreamer (wb-zh951434@alibaba-inc.com)


author: Bo Ren <rb01097748@alibaba-inc.com> 2.48.2-1.0.1
changelog:
  - Exclude loongarch64
  - cherry-pick `add sw arch #ef8be098b07c4d8a9f809d32a607700f4a420676`. (nijie@wxiat.com)


author: Brian C. Lane <bcl@redhat.com> - 35.5-1
changelog:
  - New release: 35.5 (bcl)
    Resolves: rhbz#2052604
  - docs: Explain how to undo blueprints delete (bcl)
  - test: server status no longer returns devel (bcl)
  - Use GetFrozenBlueprintsTOML for blueprints freeze save (bcl)
  - Add a test for float uid/gid in frozen blueprint (bcl)
  - Use GetBlueprintsTOML for blueprints save (bcl)
  - test: Add a test for float uid/gid in saved blueprint (bcl)
  - build(deps): bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0 (49699333+dependabot[bot])
  - tests: trigger on push to main (jrusz)
  - build(deps): bump github.com/spf13/cobra from 1.2.1 to 1.3.0 (49699333+dependabot[bot])
  - ci: add keystore for sonarqube (jrusz)
  - spec: Switch to using %gobuild macro on Fedora (bcl)
  - ci: change workflow name (jrusz)
  - ci: add gitlab-ci and sonarqube (jrusz)
  - doc: fix example links from the README (tdecacqu)
  - build(deps): bump actions/checkout from 2.3.4 to 2.4.0 (49699333+dependabot[bot])
  - ci: Enable Coverity Scan tool (atodorov)


author: Brian C. Lane <bcl@redhat.com> - 35.9-1
changelog:
  - Copy rhel-88.json test repository from osbuild-composer
  - Update osbuild-composer test repositories from osbuild-composer
  - New release: 35.9 (bcl)
    Resolves: rhbz#2168666
  - tests: Replace os.MkdirTemp with t.TempDir (bcl)
  - blueprint save: Allow overriding bad blueprint names (bcl)
  - tests: Clean up checking err in tests (bcl)
  - composer-cli: Implement blueprints diff (bcl)
  - saveBlueprint: Return the filename to the caller (bcl)
  - composer-cli: Add tests for using --commit with old servers (bcl)
  - weldr: Return error about the blueprints change route (bcl)
  - weldr: Save the http status code as part of APIResponse (bcl)
  - Add --commit support to blueprints save (bcl)
  - Add --commit to blueprints show (bcl)
  - gitleaks: Exclude the test password used in tests (bcl)
  - ci: add tags to AWS instances (tlavocat)
  - Update github.com/BurntSushi/toml to 1.2.1
  - Update github.com/stretchr/testify to 1.8.1
  - Update bump github.com/spf13/cobra to 1.6.1
  - New release: 35.8 (bcl)
  - completion: Remove providers from bash completion script (bcl)
  - completion: Filter out new headers from compose list (bcl)
  - docs: Remove unneeded Long descriptions (bcl)
  - docs: Use a custom help template (bcl)
  - docs: Add more command documentation (bcl)
  - cmdline: Add package glob support to modules list command (bcl)
  - workflow: Add govulncheck on go v1.18 (bcl)
  - tests: Update to use golangci-lint 1.49.0 (bcl)
  - New release: 35.7 (bcl)
  - spec: Move %gometa macro above %gourl (bcl)
  - weldr: When starting a compose pass size as bytes, not MiB (bcl)
  - tests: Use correct size value in bytes for test (bcl)
  - workflow: Add Go 1.18 to text matrix (bcl)
  - Replace deprecated ioutil functions (bcl)
  - New release: 35.6 (bcl)
  - tests: Update tests for osbuild-composer changes (bcl)
  - CMD: Compose status format (eloy.coto)
  - CMD: Compose list format (eloy.coto)
  - tests: Update tests to check for JSON list output (bcl)
  - composer-cli: Change JSON output to be a list of objects (bcl)
  - weldr: Simplify the old ComposeLog, etc. functions (bcl)
  - composer-cli: Add --filename to blueprints freeze save command (bcl)
  - composer-cli: Add --filename to blueprints save command (bcl)
  - composer-cli: Add --filename to compose logs command (bcl)
  - composer-cli: Add --filename to compose image command (bcl)
  - composer-cli: Add --filename to compose metadata command (bcl)
  - composer-cli: Add --filename to compose results command (bcl)
  - weldr: Add saving to a new filename to GetFilePath function (bcl)
  - github: Fix issue with codecov and forced pushes in PRs (bcl)
  - Use golangci-lint 1.45.2 in workflow (bcl)
  - Run workflow tests for go 1.16.x and 1.17.x (bcl)
  - Move go.mod to go 1.16 (bcl)
  - workflows/trigger-gitlab: run Gitlab CI in new image-builder project (jrusz)
  - Update GitHub actions/setup-go to 3
  - Update GitHub actions/checkout to 3


author: Brian C. Lane <bcl@redhat.com> - 35.12-1
changelog:
  - Copy rhel-8.10.json test repository from osbuild-composer
  - New release: 35.12 (bcl)
    Resolves: RHEL-1770
  - Add support for compose start warning messages (bcl)
  - Update documentation urls for new locations (bcl)
  - weldr: go fmt changes to a couple comments (bcl)
  - weldr: Update ostree test for parentid with no url (bcl)
  - Makefile: Turn off seccomp for build-in-podman (bcl)
  - composer-cli: Update doc links (simon.steinbeiss)
  - docs: fix typo/formatting in HACKING.md (idiez)
  - Add release creation documentation (bcl)
  - spec: Require createrepo_c for weldr-client-tests package (bcl)
  - spec: migrate the license field to SPDX (ondrej)
  - Go: Switch to go 1.19 (bcl)
  - CI: Update terraform hash (bcl)
  - Actions: add workflow for marking and closing stale issues and PRs (thozza)
  - workflows: Stop using golint (bcl)
  - workflows: Add Go 1.21 and 1.22 to test matrix (bcl)
  - workflows: Update to golangci-lint 1.56.2 (bcl)
  - workflow: Ignore govulncheck failures (bcl)
  - workflow: Switch to testing on go 1.18, 1.19, 1.20 (bcl)
  - build(deps): bump actions/setup-go from 3 to 5 (49699333+dependabot[bot])
  - build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.8.0 (49699333+dependabot[bot])
  - build(deps): bump actions/checkout from 3 to 4 (49699333+dependabot[bot])
  - build(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 (49699333+dependabot[bot])
  - build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.4 (49699333+dependabot[bot])


author: Brian C. Lane <bcl@redhat.com> - 35.12-3
changelog:
  - Update test repository snapshot urls rhel 8.10 and remove cs8 repos
    The snapshots for cs8 have been removed from the service
  - Rebuild for CVE-2025-22871
    Resolves: RHEL-89289


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 1.19.5-12.0.1
changelog:
  - use extern in header files when declaring global variables for compatible gcc10 build
  - Add doc sub package(taifu.gc@alibaba-inc.com)


author: Petr Menšík <pemensik@redhat.com> - 5.5.9-4
changelog:
  - Enable mkpasswd building (#2054043)
  - Remove changelog from mkpasswd, it has double size of actual tool


author: Michal Ruprich <mruprich@redhat.com> - 1:2.6.2-15
changelog:
  - Resolves: #2119126 - Wireshark source rpm fails to build due to looking for incorrect libssh header files


author: Tomas Popela <tpopela@redhat.com> - 1.6.0-5
changelog:
  - Drop PipeWire 0.2 requirement as Chrom[e|ium] 90 now depends on PipeWire 0.3
  - Resolves: rhbz#1949809


author: Debarshi Ray <rishi@fedoraproject.org> - 41.1-2
changelog:
  - Make the Supplements specific to Fedora to retain consistency with
    xdg-desktop-portal-gtk
  Resolves: #2051473


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.04-0.1
changelog:
  - disabled w3c-libwww because it does not exist anymore in FC5 and
    seems to be unmaintained upstream
  - added missing libxml2-devel
  - cleaned up list of %doc files
  - fixed gcc4.1 build issues
  - removed static libraries when there exists a corresponding dynamic one


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.04-1
changelog:
  - added libxml2-devel and openssl-devel Requires: for the -devel
    subpackage
  - ship doc/* instead of doc
  - initial Fedora Extras package (review 175840)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.06.11-2
changelog:
  - rediffed cmake patch against current version
  - made the xmlrpc-c-config compatible to the upstream version
  - added compatibility symlinks for some header files (thx to Robert de
    Vries for reporting these two issues)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.06.23-1
changelog:
  - use correct pkg-config script for 'xmlrpc-config abyss-server'
    output (#355411)
  - updated to 1.06.23 (#355411)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.13.07-2
changelog:
  - moved to advanced branched; rediffed/updated existing cmake patch
    and fixed other compilation issues (#369841)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.13.8-2
changelog:
  - fixed cmake quoting so that pkgconfig files get correct version number
  - fixed handling of 'server-util' and '--cflags' within xmlrpc-c-config


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.16.4.1567-2
changelog:
  - updated to 1.16.4
  - rediffed/updated patches
  - splitted some subpackages (c++, client) out of main package as they
    introduce additional dependencies (c++, curl)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.20.3-1.1841
changelog:
  - updated to rev1841
  - rediffed patches
  - added patch to fix handling of wrong certificates (Nikola Pajkovsky)
  - added support for $XMLRPC_TRACE_CURL env (John Dennis)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.21.00-1301.1851
changelog:
  - replaced .so symlinks by linker scripts which add all implicit
    dependencies in AS_NEEDED() commands (#564607, #565577)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.21.00-1401.1851
changelog:
  - require the various subpackages explicitly for -devel; the ld linker
    scripts broke rpm's autodetection (#567400)
  - removed -devel Requires: which are covered by pkgconfig autodeps
  - added %{?_isa} annotations


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.24.1-1500.svn1987
changelog:
  - updated to 1.24.1
  - set -Wno-uninitialized CFLAGS; code contains lot of constructs
    triggering this warning and the 'int a=a' defeaters have been
    removed in this version


author: Rob Crittenden <rcritten@redhat.com> - 1.51.0-7
changelog:
  - lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
    (#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
  - Prevent integer overflow on m_groupSize in doProlog
    (CVE-2021-46143) (#2058560)


author: Ondrej Vasik <ovasik@redhat.com> 0.0.27-1
changelog:
  - New version 0.0.27
  - remove several bashisms in scripts
  - add new option --profile for preprocessing documents
    with profiling stylesheet
  - fix several potential crashes in xmlif (found by static analysis)


author: Adam Jackson <ajax@redhat.com> - 7.7-21
changelog:
  - oclock 1.0.4
  - xeyes 1.1.2
  - xfontsel 1.0.6
  - xload 1.1.3
  - xmessage 1.0.5
  - xpr 1.0.5
  - xwd 1.0.7
  - xwud 1.0.5


author: Michel Dänzer <mdaenzer@redhat.com> - 19.1.0-1
changelog:
  - ati 19.1.0 (#1728818)
  - Drop patch 0001-Don-t-set-up-black-scanout-buffer-if-LeaveVT-is-call.patch,
    merged upstream
  - Add patches 0001-Handle-NULL-fb_ptr-in-pixmap_get_fb.patch &
    0002-Don-t-crash-X-server-if-GPU-acceleration-is-not-avai.patch from
    upstream Git master, fixing crashes with ShadowFB


author: Peter Hutterer <peter.hutterer@redhat.com> 1.0.1-2
changelog:
  - xf86-input-libinput 1.0.1 (#1951879)
  - Fix the upstream source URL
  - Use autosetup instead of manual patch handling


author: Peter Hutterer <peter.hutterer@redhat.com> 0.2.0-1
changelog:
  - Only match on specific device types, don't match on joysticks or tablets
  - libinput 0.2.0
  - switch to new fdo host


author: Peter Hutterer <peter.hutterer@redhat.com> 0.22.0-3
changelog:
  - Provide xorg-x11-drv-synaptics. The actual content is now provided by
    xorg-x11-drv-synaptics-legacy (#1394836). For details, see
    https://fedoraproject.org/wiki/Changes/RetireSynapticsDriver


author: Peter Hutterer <peter.hutterer@redhat.com> 0.23.0-2
changelog:
  - Ignore LED updates for disabled devices, avoids a null-pointer dereference
    when an AccessX timeout is set


author: Peter Hutterer <peter.hutterer@redhat.com> 0.25.1-2
changelog:
  - Add a new option to provide a workaround for the slow pointer movement on
    hidpi displays (#1413306) .
    That's a fedora-only patch for now, no idea what the permanent upstream
    solution will be here.


author: Hans de Goede <hdegoede@redhat.com> - 1.0.12-4
changelog:
  - Fix the crtc not being turned off, causing the dgpu to not suspend,
    after using a dgpu attached output


author: Christophe Fergeau <cfergeau@redhat.com> - 0.1.5-7
changelog:
  - Add upstream patches for Python 3 support
  - Validate RANDR output property atoms
  - Add patch fixing crash with multiple QXL devices
  - This syncs the RHEL branch with both current rawhide and RHEL 7.6


author: Adam Jackson <ajax@redhat.com> - 2.4.0-3
changelog:
  - Restore no-virt-shadowfb patch
  - Refuse to run if there's a UEFI framebuffer; use fbdev or a native driver


author: José Expósito <jexposit@redhat.com> - 1.20.11-20
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18321
    Resolves: https://issues.redhat.com/browse/RHEL-18327


author: José Expósito <jexposit@redhat.com> - 1.20.11-21
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21207
    Resolves: https://issues.redhat.com/browse/RHEL-20528
    Resolves: https://issues.redhat.com/browse/RHEL-20378
    Resolves: https://issues.redhat.com/browse/RHEL-20384
    Resolves: https://issues.redhat.com/browse/RHEL-21191
    Resolves: https://issues.redhat.com/browse/RHEL-21198


author: José Expósito <jexposit@redhat.com> - 1.20.11-23
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: Hangbo Fan <fanhangbo.fhb@alibaba-inc.com> - 1.20.11-25.0.1
changelog:
  - Add doc sub package
  - Fix doc package installation (wangkaiyuan@inspur.com)
  - cherry-pick `add sw arch #1ba6a0036d929c82c5516a18350d5c27cc28e210`. (nijie@wxiat.com)
  - cherry-pick: `add sw arch #3b1aa1ee2c00aeebe71a618589826c2d1cab136e`. (Weisson@linux.alibaba.com)
  - Fix the splash screen issue in the phytium S5000C (yuanxia2073@phytium.com.cn)


author: Hans de Goede <hdegoede@redhat.com> - 1.19.0-0.3.20161026
changelog:
  - Sync with upstream git, bringing in a bunch if bug-fixes
  - Add some extra fixes which are pending upstream
  - This also adds PointerWarping emulation to Xwayland, which should improve
    compatiblity with many games


author: Ben Crocker <bcrocker@redhat.com> - 1.19.0-0.6.20161028
changelog:
  - Fix Config record allocation during startup: if xorg.conf.d directory
  - was absent, a segfault resulted.


author: Hans de Goede <hdegoede@redhat.com> - 1.19.0-0.7.rc2
changelog:
  - Update to 1.19.0-rc2
  - Fix (hopefully) various crashes in FlushAllOutput() (rhbz#1382444)
  - Fix Xwayland crashing in glamor on non glamor capable hw (rhbz#1390018)


author: Olivier Fourdan <ofourdan@redhat.com> 1.19.0-1
changelog:
  - xserver 1.19.0
  - Fix use after free of cursors in Xwayland (rhbz#1385258)
  - Fix an issue where some monitors would show only black, or
    partially black when secondary GPU outputs are used


author: Hans de Goede <hdegoede@redhat.com> - 1.19.0-2
changelog:
  - Add some patches for better integration with the nvidia binary driver
  - Add a patch from upstream fixing a crash (rhbz#1389886)


author: Olivier Fourdan <ofourdan@redhat.com> 1.19.6-5
changelog:
  - xwayland: avoid race condition on new keymap
  - xwayland: Keep separate variables for pointer and tablet foci (rhbz#1519961)
  - xvfb-run now support command line option “--auto-display”


author: Olivier Fourdan <ofourdan@redhat.com> - 1.19.99.904-2
changelog:
  - Re-fix "use type instead of which in xvfb-run (rhbz#1443357)" which
    was overridden inadvertently


author: Adam Jackson <ajax@redhat.com> - 1.20.1-3
changelog:
  - Assorted RHEL mustard:
    - Don't probe for drivers we're not shipping
    - Enable PAM
    - Link Xorg with -z now
    - Nerf modesetting's atomic ioctl support
    - Don't autoconfigure vesa or fbdev from X -configure
    - Call LeaveVT on RANDR's CloseScreen path so we drop drm master
    - Try harder to get initial spanning desktop if the output's
      preferred mode was filtered away
  - Sync va_gl/vdpau patch from F29


author: Ben Crocker <bcrocker@redhat.com> - 1.20.3-5
changelog:
  - Add Eric Anholt's patch e50c85f4ebf559 from upstream:
  - Fix segfault on probing a non-PCI platform device on a system with PCI
  - NOTE: also pertains on a system with no PCI, e.g. s390x.
    Resolves: #1652013


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-3
changelog:
  - Downgrade modesetting "glamor initialization failed" X_ERROR → X_INFO
    Resolves: #1724573
  - Xwayland / Present leak fixes for #1728684


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-5
changelog:
  - xwayland: Hold a pixmap reference in struct xwl_present_event
    Related: #1728684
  - glamor: Fix glamor_poly_fill_rect_gl xRectangle::width/height handling
    Resolves: #1740250


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-8
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872391), CVE-2020-14346 (#1872395),
    CVE-2020-14361 (#1872402), CVE-2020-14362 (#1872409)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-4
changelog:
  - CVE fix for: CVE-2021-4008 (#2030162), CVE-2021-4009 (#2030172),
    CVE-2021-4010 (#2030175), CVE-2021-4011 (#2030181)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-9
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2108156, rhbz#2108161


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-11
changelog:
  - CVE fix for: CVE-2022-4283 (#2151799), CVE-2022-46340 (#2151774),
    CVE-2022-46341 (#2151779), CVE-2022-46342 (#2151784),
    CVE-2022-46343 (#2151789), CVE-2022-46344 (#2151794)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-26
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97273), CVE-2025-49176 (RHEL-97329),
                 CVE-2025-49178 (RHEL-97369), CVE-2025-49179 (RHEL-97422),
                 CVE-2025-49180 (RHEL-97235)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-27
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119953), CVE-2025-62230 (RHEL-120027),
                 CVE-2025-62231 (RHEL-124993)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.9-5
changelog:
  Fix for CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408, CVE-2024-0409


author: Olivier Fourdan <ofourdan@redhat.com> - 21.0.99.902-1
changelog:
  - xwayland 21.0.99.902
  - Remove xdmcp, udev, udev_kms build options
  - Stop overriding the vendor name, same as xorg-x11-server


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-2
changelog:
  - CVE fix for: CVE-2021-4008 (#2038067), CVE-2021-4009 (#2038070),
    CVE-2021-4010 (#2038072), CVE-2021-4011 (#2038074)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-3
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2110440, rhbz#2110433


author: Peter Hutterer <peter.hutterer@redhat.com> - 21.1.3-5
changelog:
  - CVE fix for: CVE-2022-4283 (#2151803), CVE-2022-46340 (#2151778),
    CVE-2022-46341 (#2151783), CVE-2022-46342 (#2151786),
    CVE-2022-46343 (#2151793), CVE-2022-46344 (#2151796)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-3
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-80204), CVE-2025-26595 (RHEL-80187),
                 CVE-2025-26596 (RHEL-80190), CVE-2025-26597 (RHEL-80193),
                 CVE-2025-26598 (RHEL-80195), CVE-2025-26599 (RHEL-80202),
                 CVE-2025-26600 (RHEL-80203), CVE-2025-26601 (RHEL-80207)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-3
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-79126), CVE-2025-26595 (RHEL-79130),
                 CVE-2025-26596 (RHEL-79134), CVE-2025-26597 (RHEL-79140),
                 CVE-2025-26598 (RHEL-79141), CVE-2025-26599 (RHEL-79146),
                 CVE-2025-26600 (RHEL-79154), CVE-2025-26601 (RHEL-79150)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97341), CVE-2025-49176 (RHEL-97335),
                 CVE-2025-49177 (RHEL-97358), CVE-2025-49178 (RHEL-97395),
                 CVE-2025-49179 (RHEL-97405), CVE-2025-49180 (RHEL-97245)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119975), CVE-2025-62230 (RHEL-120020),
                 CVE-2025-62231 (RHEL-125016)


author: Adam Jackson <ajax@redhat.com> - 7.7-25
changelog:
  - iceauth 1.0.8
  - xkill 1.0.5
  - xrdb 1.1.1
  - xrefresh 1.0.6
  - xset 1.2.4
  - xsetroot 1.1.2
  - HTTPS URLs


author: Adam Jackson <ajax@redhat.com> - 7.7-24
changelog:
  - Make -devel Require the base package, so the pc file will point to an
    xkbcomp that actually exists.


author: Zdenek Dohnal <zdohnal@redhat.com> - 0.999-28
changelog:
  - remove dependency on ImageMagick and netpbm-progs, because they were needed for
    tests during %build phase, which were removed in commit SHA 0595c15da29


author: Ray Strode <rstrode@redhat.com> 2.9.3-6
changelog:
  - Disable man support
  - Disable info support
  - Don't try to install schemas during install (bug 154035)


author: David Malcolm <dmalcolm@redhat.com> - 2.13.2-2
changelog:
  - Patched to include DocBook mimetype in desktop file, and added preun and post
    hooks to update-desktop-database (#175880)
  - Patched to ensure that Yelp recognizes that it can handle the mimetype of the
    documentation as reported by gnomevfs (also #175880)


author: Matthew Barnes <mbarnes@redhat.com> - 2.15.1-2
changelog:
  - Add build requirements: startup-notification-devel
                            libgnomeprintui22-devel
                            libXt-devel


author: Matthew Barnes <mbarnes@redhat.com> - 2.19.1-1
changelog:
  - Update to 2.19.1
  - Adapt the "apropos" patch for 2.19.1.
  - The "posix-man" patch appears to no longer apply.
  - Update dependencies based on configure.ac.


author: Matthew Barnes <mbarnes@redhat.com> - 2.19.90-1
changelog:
  - Update to 2.19.90
  - Remove "info-gnutls" patch (fixed upstream).
  - Remove patch for GNOME bug #370167 (fixed upstream).
  - Remove patch for GNOME bug #430365 (fixed upstream).
  - Remove patch for GNOME bug #431078 (fixed upstream).


author: Kalev Lember <kalevlember@gmail.com> - 1:3.8.1-3
changelog:
  - Make yelp-libs dep arch-specific, thanks to Michael Schwendt (#967180)
  - Don't create empty /usr/share/gnome/help directory: this should be owned by
    individual packages that install files in there (#964421)
  - Use configure --disable-static instead of removing the static .a afterwards


author: Kalev Lember <klember@redhat.com> - 2:40~beta-2
changelog:
  - Drop libtool as-needed hack as as-needed is in default LDFLAGS now
  - Remove unneeded ldconfig_scriptlets macro call
  - Tighten soname globs


author: Matej Mužila <mmuzila@redhat.com> - 3:2.4-5
changelog:
  - Add "Wants" dependency on network-online.target
  - Remove "After" dependency on NetworkManager-wait-online.service


author: Michel Alexandre Salim <salimma@centosproject.org> - 1.5.1-1
changelog:
  - Rebase to the latest upstream version
  - Enable optional gz, xz/lzma, and lz4 support in the zstd tool
  - Disable amd64 assembly on non-x86_64 architectures (rhbz#2035802)
    this should avoid the issue where an executable stack is created
  - Re-enable CET protections (rhbz#2039353)
    Resolves: rhbz#2039488


author: Jakub Martisko <jamartis@redhat.com> - 0.13.71-7
changelog:
  - Remove the doc/zzipdoc/{options,match}.py scritps from the original tar
  - Replace them with a current github version
  - The original version of the files contains autogenerated header with incompatible license
  - This build thus uses modified tar archive
  Resolves: rhbz#1982241


author: Matthias Saou <http://freshrpms.net/> 0.13.45-3
changelog:
  - Split off -utils sub-package (#199467). Could have been plain "zzip"?
  - Have sub-packages require exact release too.
  - Build require automake to make the aclocal-1.9 check happy.
  - Use --enable-frame-pointer otherwise -g gets removed from the CFLAGS.


author: Matthias Saou <http://freshrpms.net/> 0.13.49-1
changelog:
  - Update to 0.13.49 to fix CVE-2007-1614 (rhbz #233700).
  - Include new man3 pages to the devel sub-package.


author: Matthias Saou <http://freshrpms.net/> 0.13.49-2
changelog:
  - Disable static lib build instead of excluding it later.
  - Remove rpath on 64bit archs.
  - Switch to using DESTDIR install method.


author: Matthias Saou <http://freshrpms.net/> 0.13.49-4
changelog:
  - Include patch to fix fd.open calls with recent glibc.
  - Disable _smp_mflags since the docs fail to build.


author: Matthias Saou <http://freshrpms.net/> 0.13.59-1
changelog:
  - Update to 0.13.59.
  - Remove no longer needed 'open' patch.
  - Rebase the multilib patch, still required.
  - Re-enable _smp_mflags, build works again with it apparently.


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.13.69-1
changelog:
  - Update to 0.13.69 release
  - Fixes: #1598246 (CVE-2018-6541)
  - Fixes: #1554673 (CVE-2018-7727)
  - Use versioned python executables everywhere


author: Jakub Martisko <jamartis@redhat.com> - 0.13.69-4
changelog:
  - Add the missing CVE-2018-17828.part2.patch file
  - Fix Formating of the previous 2 changelog entries


author: Jakub Martisko <jamartis@redhat.com> - 0.13.71-1
changelog:
  - Rebase to 0.13.71
  - Drop the CVE patches, they are now part of the upstream package
  - Build no longer requires python2
  - Resolves: 1807565


