# changelog

author: Dan Walsh <dwalsh@redhat.com> 1.3.30-1
changelog:
  - Update from NSA
    * Fixed policy file leaks in semanage_load_module and
      semanage_write_module.
    * Merged further database work from Ivan Gyurdiev.
    * Fixed bug in semanage_direct_disconnect.


author: Dan Walsh <dwalsh@redhat.com> 1.3.32-1
changelog:
  - Update from NSA
    * Merged resync to sepol changes and transaction fix patches from
      Ivan Gyurdiev.
    * Merged reorganize users patch from Ivan Gyurdiev.
    * Merged remove unused relay functions patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.34-1
changelog:
  - Update from NSA
    * Merged resync to sepol changes and booleans fixes/improvements 
      patches from Ivan Gyurdiev.
    * Merged support for genhomedircon/homedir template, store selection,
      explicit policy reload, and semanage.conf relocation from Joshua
      Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.35-1
changelog:
  - Update from NSA
    * Merged sepol handle passing, seusers support, and policydb cache
      patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.38-1
changelog:
  - Upgrade to latest from NSA
    * Merged dbase policydb list and count change from Ivan Gyurdiev.
    * Merged enable dbase and set relay patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.39-1
changelog:
  - Upgrade to latest from NSA
    * Merged record interface, dbase flush, common database code,
      and record bugfix patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.41-1
changelog:
  - Upgrade to latest from NSA
    * Merged interface parse/print, context_to_string interface change,
      move assert_noeof, and order preserving patches from Ivan Gyurdiev.
          * Added src/dso.h in preparation for other changes.
    * Merged install seusers, handle/error messages, MLS parsing,
      and seusers validation patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.43-1
changelog:
  - Upgrade to latest from NSA
    * Merged seuser parser resync, dbase tracking and cleanup, strtol
      bug, copyright, and assert space patches from Ivan Gyurdiev.
    * Added src/*_internal.h in preparation for other changes.
     * Added hidden/hidden_proto/hidden_def to src/debug.[hc] and
            src/seusers.[hc].


author: Dan Walsh <dwalsh@redhat.com> 1.3.48-1
changelog:
  - Upgrade to latest from NSA
    * Disabled calls to port dbase for merge and commit and stubbed
      out calls to sepol_port interfaces since they are not exported.
    * Merged rename instead of copy patch from Joshua Brindle (Tresys).
    * Added hidden_def/hidden_proto for exported symbols used within 
      libsemanage to eliminate relocations.  Wrapped type definitions
      in exported headers as needed to avoid conflicts.  Added
      src/context_internal.h and src/iface_internal.h.
    * Added semanage_is_managed() interface to allow detection of whether
      the policy is managed via libsemanage.  This enables proper handling
      in setsebool for non-managed systems.
    * Merged semanage_set_reload_bools() interface from Ivan Gyurdiev,
      to enable runtime control over preserving active boolean values
      versus reloading their saved settings upon commit.


author: Dan Walsh <dwalsh@redhat.com> 1.3.51-1
changelog:
  - Upgrade to latest from NSA
    * Clear modules modified flag upon disconnect and commit.
          * Added tracking of module modifications and use it to
      determine whether expand-time checks should be applied
      on commit.
    * Reverted semanage_set_reload_bools() interface.


author: Dan Walsh <dwalsh@redhat.com> 1.3.52-1
changelog:
  - Upgrade to latest from NSA
    * Merged cleanup patch from Ivan Gyurdiev.
      This renames semanage_module_conn to semanage_direct_handle,
      and moves sepol handle create/destroy into semanage handle
      create/destroy to allow use even when disconnected (for the
      record interfaces).


author: Dan Walsh <dwalsh@redhat.com> 1.3.53-1
changelog:
  - Upgrade to latest from NSA
    * Merged move seuser validation patch from Ivan Gyurdiev.
    * Merged hidden declaration fixes from Ivan Gyurdiev,
      with minor corrections.


author: Dan Walsh <dwalsh@redhat.com> 1.3.56-1
changelog:
  - Upgrade to latest from NSA
    * Fixed free->key_free bug.
    * Merged clear obsolete patch from Ivan Gyurdiev.
    * Merged modified swigify patch from Dan Walsh 
      (original patch from Joshua Brindle).
    * Merged move genhomedircon call patch from Chad Sellers.


author: Dan Walsh <dwalsh@redhat.com> 1.3.59-1
changelog:
  - Add additional swig objects
    * Merged wrap char*** for user_get_roles patch from Joshua Brindle.
    * Merged remove defrole from sepol patch from Ivan Gyurdiev.
    * Merged swig wrappers for modifying users and seusers from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.61-1
changelog:
  - Upgrade to latest from NSA
    * Merged Makefile python definitions patch from Dan Walsh.
    * Removed is_selinux_mls_enabled() conditionals in seusers and users
      file parsers.


author: Dan Walsh <dwalsh@redhat.com> 1.3.63-1
changelog:
  - Upgrade to latest from NSA
    * Dropped handle from user_del_role interface.
    * Removed defrole interfaces.


author: Dan Walsh <dwalsh@redhat.com> 1.3.64-1
changelog:
  - Upgrade to latest from NSA
    * Changed semanage_handle_create() to set do_reload based on
      is_selinux_enabled().  This prevents improper attempts to
      load policy on a non-SELinux system.


author: Dan Walsh <dwalsh@redhat.com> 1.5.1-1
changelog:
  - Upgrade to latest from NSA
    * Added file-mode= setting to semanage.conf, default to 0644.
      Changed semanage_copy_file and callers to use this mode when
      installing policy files to runtime locations.


author: Dan Walsh <dwalsh@redhat.com> 1.5.1-2
changelog:
  - Upgrade to latest from NSA
    * Merged toggle modified flag in policydb_modify, fix memory leak
      in clear_obsolete, polymorphism vs headers fix, and include guards
      for internal headers patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.3-1
changelog:
  - Upgrade to latest from NSA
    * Merged further header cleanups from Ivan Gyurdiev.
    * Merged toggle modified flag in policydb_modify, fix memory leak
      in clear_obsolete, polymorphism vs headers fix, and include guards
      for internal headers patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.4-1
changelog:
  - Upgrade to latest from NSA
    * Merged patch series from Ivan Gyurdiev.
      This includes patches to:
      - separate file rw code from linked list
      - annotate objects
      - fold together internal headers
      - support ordering of records in compare function
      - add active dbase backend, active booleans
      - return commit numbers for ro database calls
      - use modified flags to skip rebuild whenever possible
      - enable port interfaces
      - update swig interfaces and typemaps
      - add an API for file_contexts.local and file_contexts
      - flip the traversal order in iterate/list
      - reorganize sandbox_expand
      - add seusers MLS validation
      - improve dbase spec/documentation
      - clone record on set/add/modify


author: Dan Walsh <dwalsh@redhat.com> 1.5.6-1
changelog:
  - Upgrade to latest from NSA
    * Clarified error messages from parse_module_headers and 
      parse_base_headers for base/module mismatches.
    * Merged string and file optimization patch from Russell Coker.
    * Merged swig header reordering patch from Ivan Gyurdiev.
    * Merged toggle modify on add patch from Ivan Gyurdiev.
    * Merged ports parser bugfix patch from Ivan Gyurdiev.
    * Merged fcontext swig patch from Ivan Gyurdiev.
    * Merged remove add/modify/delete for active booleans patch from Ivan Gyurdiev.
    * Merged man pages for dbase functions patch from Ivan Gyurdiev.
    * Merged pywrap tests patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.8-1
changelog:
  - Upgrade to latest from NSA
    * Re-applied string and file optimization patch from Russell Coker,
      with bug fix.
    * Reverted string and file optimization patch from Russell Coker.
    * Clarified error messages from parse_module_headers and 
      parse_base_headers for base/module mismatches.


author: Dan Walsh <dwalsh@redhat.com> 1.5.9-1
changelog:
  - Upgrade to latest from NSA
    * Merged const in APIs patch from Ivan Gyurdiev.
    * Merged validation of local file contexts patch from Ivan Gyurdiev.
    * Merged compare2 function patch from Ivan Gyurdiev.
    * Merged hidden def/proto update patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.14-1
changelog:
  - Upgrade to latest from NSA
    * Merged disallow port overlap patch from Ivan Gyurdiev.
    * Merged join prereq and implementation patches from Ivan Gyurdiev.
    * Merged join user extra data part 2 patch from Ivan Gyurdiev.
    * Merged bugfix patch from Ivan Gyurdiev.
    * Merged remove add_local/set_local patch from Ivan Gyurdiev.
    * Merged user extra data part 1 patch from Ivan Gyurdiev.
    * Merged size_t -> unsigned int patch from Ivan Gyurdiev.
    * Merged calloc check in semanage_store patch from Ivan Gyurdiev,
      bug noticed by Steve Grubb.
    * Merged cleanups after add/set removal patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.15-1
changelog:
  - Upgrade to latest from NSA
    * Merged pywrap Makefile diff from Dan Walsh.
    * Merged cache management patch from Ivan Gyurdiev.
    * Merged bugfix for dbase_llist_clear from Ivan Gyurdiev.
    * Merged remove apply_local function patch from Ivan Gyurdiev.
    * Merged only do read locking in direct case patch from Ivan Gyurdiev.
    * Merged cache error path memory leak fix from Ivan Gyurdiev.
    * Merged auto-generated file header patch from Ivan Gyurdiev.
    * Merged pywrap test update from Ivan Gyurdiev.
    * Merged hidden defs update from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.18-1
changelog:
  - Upgrade to latest from NSA
    * Merged seuser -> seuser_local rename patch from Ivan Gyurdiev.
    * Merged set_create_store, access_check, and is_connected interfaces
      from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.5.19-1
changelog:
  - Upgrade to latest from NSA
    * Merged fname parameter patch from Ivan Gyurdiev.
    * Merged more size_t -> unsigned int fixes from Ivan Gyurdiev.
    * Merged seusers.system patch from Ivan Gyurdiev.
    * Merged improve port/fcontext API patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.21-1
changelog:
  - Upgrade to latest from NSA
    * Merged seuser/user_extra support patch from Joshua Brindle.
    * Merged remote system dbase patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.23-1
changelog:
  - Upgrade to latest from NSA
    * Merged optionals in base patch from Joshua Brindle.
    * Merged treat seusers/users_extra as optional sections patch from
      Ivan Gyurdiev.
    * Merged parse_optional fixes from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.26-1
changelog:
  - Upgrade to latest from NSA
    * Merged paths array patch from Ivan Gyurdiev.
    * Merged bug fix patch from Ivan Gyurdiev.
    * Merged improve bindings patch from Ivan Gyurdiev.
    * Merged use PyList patch from Ivan Gyurdiev.  
    * Merged memory leak fix patch from Ivan Gyurdiev.
    * Merged nodecon support patch from Ivan Gyurdiev.
    * Merged cleanups patch from Ivan Gyurdiev.
    * Merged split swig patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.28-1
changelog:
  - Upgrade to latest from NSA
    * Merged bug fix for fcontext validate handler from Ivan Gyurdiev.
    * Merged base_merge_components changes from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.6-1
changelog:
  - Make work on RHEL4
  - Upgrade to latest from NSA
    * Merged abort early on merge errors patch from Ivan Gyurdiev.
    * Cleaned up error handling in semanage_split_fc based on a patch
      by Serge Hallyn (IBM) and suggestions by Ivan Gyurdiev.
    * Merged MLS handling fixes from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.2-1
changelog:
  - Upgrade to latest from NSA
    * Merged Makefile PYLIBVER definition patch from Dan Walsh.
    * Merged man page reorganization from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.3-1
changelog:
  - Fix to work with new version of swig
  - Upgrade to latest from NSA
    * Merged corrected fix for descriptor leak from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.6-1
changelog:
  - Upgrade to latest from NSA
    * Merged updated file context sorting patch from Christopher
      Ashworth, with bug fix for escaped character flag.
    * Merged file context sorting code from Christopher Ashworth 
      (Tresys Technology), based on fc_sort.c code in refpolicy.
    * Merged python binding t_output_helper removal patch from Dan Walsh.
    * Regenerated swig files.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.8-1
changelog:
  - Upgrade to latest from NSA
    * Updated default location for setfiles to /sbin to
      match policycoreutils.  This can also be adjusted via 
      semanage.conf using the syntax:
      [setfiles]
      path = /path/to/setfiles
      args = -q -c $@ $<
      [end]


author: Dan Walsh <dwalsh@redhat.com> - 1.6.9-1
changelog:
  - Upgrade to latest from NSA
    * Merged several fixes from Serge Hallyn:
         dbase_file_cache:  deref of uninit data on error path.
         dbase_policydb_cache:  clear fp to avoid double fclose
         semanage_fc_sort:  destroy temp on error paths


author: Dan Walsh <dwalsh@redhat.com> - 1.6.12-1
changelog:
  - Upgrade to latest from NSA
    * Merged support for read operations on read-only fs from 
      Caleb Case (Tresys Technology).


author: Dan Walsh <dwalsh@redhat.com> - 1.6.15-1
changelog:
  - Upgrade to latest from NSA
    * Merged separate local file contexts patch from Chris PeBenito.
    * Merged patch to make most copy errors non-fatal from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.16-1
changelog:
  - Upgrade to latest from NSA
    * Make most copy errors fatal, but allow exceptions for
      file_contexts.local, seusers, and netfilter_contexts if
      the source file does not exist in the store.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.17-1
changelog:
  - Upgrade to latest from NSA
    * Merged patch to skip reload if no active store exists and
      the store path doesn't match the active store path from Dan Walsh.
    * Merged patch to not destroy sepol handle on error path of
      connect from James Athey.
    * Merged patch to add genhomedircon path to semanage.conf from
      James Athey.


author: Dan Walsh <dwalsh@redhat.com> - 1.9.1-1
changelog:
  - Upgrade to latest from NSA
    * Merged patch to compile wit -fPIC instead of -fpic from
      Manoj Srivastava to prevent hitting the global offest table
      limit. Patch changed to include libselinux and libsemanage in
      addition to libsepol.


author: Dan Walsh <dwalsh@redhat.com> - 1.9.2-1
changelog:
  - Upgrade to latest from NSA
    * Merged patch to optionally reduce disk usage by removing 
      the backup module store and linked policy from Karl MacMillan
    * Merged patch to correctly propagate return values in libsemanage


author: Dan Walsh <dwalsh@redhat.com> - 1.10.1-1
changelog:
  - Upgrade to latest from NSA
    * Merged python binding fix from Dan Walsh.
    * Updated version for stable branch.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.0-1
changelog:
  - Upgrade to latest from NSA
    * Merged Makefile test target patch from Caleb Case.
    * Merged get_commit_number function rename patch from Caleb Case.
    * Merged strnlen -> strlen patch from Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.1-1
changelog:
  - Merged dbase_file_flush patch from Dan Walsh.
  - This removes any mention of specific tools (e.g. semanage)
  - from the comment header of the auto-generated files,
  - since there are multiple front-end tools.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.2-1
changelog:
  - Upgrade to latest from NSA
  - Merged optimizations from Stephen Smalley.
  -    do not set all booleans upon commit, only those whose values have changed
  -    only install the sandbox upon commit if something was rebuilt


author: Dan Walsh <dwalsh@redhat.com> - 2.0.3-1
changelog:
  - Upgrade to latest from NSA
    * Fix to libsemanage man patches so whatis will work better from Dan Walsh


author: Dan Walsh <dwalsh@redhat.com> - 2.0.4-1
changelog:
  - Upgrade to latest from NSA
    * Allow dontaudits to be turned off via semanage interface when
      updating policy


author: Dan Walsh <dwalsh@redhat.com> - 2.0.6-1
changelog:
  - Upgrade to latest from NSA
    * Change to use getpw* function calls to the _r versions from Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.9-1
changelog:
  - Upgrade to latest from NSA
    * Pass CFLAGS to CC even on link command, per Dennis Gilmore.
    * Clear errno on non-fatal errors to avoid reporting them upon a
      later error that does not set errno.
    * Improve reporting of system errors, e.g. full filesystem or read-only filesystem from Stephen Smalley.

  - Fix segfault in genhomedircon when using bad user names


author: Dan Walsh <dwalsh@redhat.com> - 2.0.10-1
changelog:
  - Upgrade to latest from NSA
    * Fix error checking on getpw*_r functions from Todd Miller.
    * Make genhomedircon skip invalid homedir contexts from Todd Miller.
    * Set default user and prefix from seusers from Dan Walsh.
    * Add swigify Makefile target from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.11-1
changelog:
  - Upgrade to latest from NSA
    * Fix ordering of file_contexts.homedirs from Todd Miller and Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.12-1
changelog:
  - Upgrade to latest from NSA
    * ustr cleanups from James Antill.
    * Ensure that /root gets labeled even if using the default context from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.14-1
changelog:
  - Upgrade to latest from NSA
    * Call rmdir() rather than remove() on directory removal so that errno isn't polluted from Stephen Smalley.
    * Allow handle_unknown in base to be overridden by semanage.conf from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.15-1
changelog:
  - Update to upstream
    * Fix genhomedircon handling of shells and missing user context template from Dan Walsh.
    * Copy the store path in semanage_select_store from Dan Walsh.
  - Add expand-check=0 to semanage.conf


author: Dan Walsh <dwalsh@redhat.com> - 2.0.16-1
changelog:
  - Update to upstream
    * Merged fix for genhomedircon handling of missing HOME_DIR or HOME_ROOT templates from Caleb Case.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.18-1
changelog:
  - Update to upstream
    * Fix spurious out of memory error reports.
    * Merged second version of fix for genhomedircon handling from Caleb Case.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.19-1
changelog:
  - Update to upstream
    * Fix genhomedircon to not override a file context with a homedir context from Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.20-1
changelog:
  - Update to upstream
    * Use sepol_set_expand_consume_base to reduce peak memory usage when
    using semodule


author: Dan Walsh <dwalsh@redhat.com> - 2.0.22-1
changelog:
  - Update to upstream
    * Free policydb before fork from Joshua Brindle.
    * Drop the base module immediately after expanding to permit memory re-use from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.23-1
changelog:
  - Update to upstream
    * Use vfork rather than fork for libsemanage helpers to reduce memory overhead as suggested by Todd Miller.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.25-1
changelog:
  - Update to upstream
    * Do not call genhomedircon if the policy was not rebuilt from Stephen Smalley.
      Fixes semanage boolean -D seg fault (bug 441379).


author: Dan Walsh <dwalsh@redhat.com> - 2.0.26-1
changelog:
  - Update to upstream
    * Fix bug in genhomedircon fcontext matches logic from Dan Walsh.
    Strip any trailing slash before appending /*$.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.27-1
changelog:
  - Update to upstream
    * Modify genhomedircon to skip groupname entries.
    Ultimately we need to expand them to the list of users to support per-role homedir labeling when using the groupname syntax.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.28-1
changelog:
  - Update to upstream
    * allow fcontext and seuser changes without rebuilding the policy from Dan Walsh


author: Dan Walsh <dwalsh@redhat.com> - 2.0.31-1
changelog:
  - Update to upstream
    * Policy module compression (bzip) support from Dan Walsh.
    * Hard link files between tmp/active/previous from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.35-1
changelog:
  - Revert hard linking of files between tmp/active/previous.
  - Enable configuration of bzip behavior from Stephen Smalley.
  -   bzip-blocksize=0 to disable compression and decompression support.
  -   bzip-blocksize=1..9 to set the blocksize for compression.
  -   bzip-small=true to reduce memory usage for decompression.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.36-1
changelog:
  - Update to upstream
    * Changed bzip-blocksize=0 handling to support existing compressed
    modules in the store.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.37-1
changelog:
  - Update to upstream
    * Fix persistent dontaudit support to rebuild policy if the 
          dontaudit state is changed from Chad Sellers.
  - Move load_policy to /sbin


author: Dan Walsh <dwalsh@redhat.com> - 2.0.38-1
changelog:
  - Update to upstream
    * Change semodule upgrade behavior to install even if the module
      is not present from Dan Walsh.
    * Make genhomedircon trim excess '/' from homedirs from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.41-1
changelog:
  - Update to upstream
    * Add pkgconfig file from Eamon Walsh.
    * Add semanage_set_check_contexts() function to disable calling
    setfiles


author: Dan Walsh <dwalsh@redhat.com> - 2.0.43-1
changelog:
  - Update to upstream
    * Move libsemanage.so to /usr/lib
    * Add NAME lines to man pages from Manoj Srivastava<srivasta@debian.org>


author: Dan Walsh <dwalsh@redhat.com> - 2.0.44-1
changelog:
  - Update to upstream
  	* Replace usage of fmemopen() with sepol_policy_file_set_mem() since
  	  glibc < 2.9 does not support binary mode ('b') for fmemopen'd
  	  streams.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.45-1
changelog:
  - Update to upstream
  	* Add enable/disable patch support from Dan Walsh.
  	* Add usepasswd flag to semanage.conf to disable genhomedircon using
  	  passwd from Dan Walsh.
  	* regenerate swig wrappers


author: David Malcolm <dmalcolm@redhat.com> - 2.0.46-2
changelog:
  - big reworking of the support-multiple-python-builds patch to deal with
  PEP 3149: the latest Python 3.2 onwards uses include paths and library names
  that don't fit prior naming patterns, and so we must query python3-config for
  this information.  To complicate things further, python 2's python-config
  doesn't understand all of the options needed ("--extension-suffix").  I've
  thus added new Makefile variables as needed, to be supplied by the specfile by
  invoking the appropriate config tool (or by hardcoding the old value for
  "--extension-suffix" i.e. ".so")
  - rework python3 manifest for PEP 3149, and rebuild for newer python3


author: Dan Walsh <dwalsh@redhat.com> - 2.0.46-5
changelog:
  - Change libsemanage mechanism for handling disabled modules. Now it will only create a flag for a module 
  indicating the module is disabled.  MODULE.pp.disabled, it will no longer rename the module.  This way we can
  ship active modules in rpm.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.2-1
changelog:
  -Update to upstream
  2.1.2 2011-08-17
  	* print error debug info for buggy fc
  	* introduce semanage_set_root and friends
  	* throw exceptions in python rather than return
  	* python3 support.
  	* patch for MCS/MLS in user files

  2.1.1 2011-08-01
  	* Remove generated files, expand .gitignore
  	* Use -Werror and change a few prototypes to support it


author: Dan Walsh <dwalsh@redhat.com> - 2.1.4-1
changelog:
  -Update to upstream
  	* Create a new preserve_tunables flag
  	* tree: default make target to all not
  	* fix semanage_store_access_check calling arguments


author: Dan Walsh <dwalsh@redhat.com> - 2.1.5-1
changelog:
  - Upgrade to upstream
  	* regenerate .pc on VERSION change
  	* maintain mode even if umask is tighter
  	* semanage.conf man page
  	* create man5dir if not exist


author: Dan Walsh <dwalsh@redhat.com> - 2.1.6-1
changelog:
  -Update to upstream
  	* add ignoredirs config for genhomedircon
  	* Fallback_user_level can be NULL if you are not using MLS


author: Dan Walsh <dwalsh@redhat.com> - 2.1.7-1
changelog:
  - Update to upstream 
  	* Alternate path for semanage.conf
  	* do not link against libpython, this is considered bad in Debian
  	* Allow to build for several ruby version
  	* fallback-user-level


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-1
changelog:
  - Update to upstream 
  	* remove build warning when build swig c files
  	* additional makefile support for rubywrap
  	* ignore 80 column limit for readability
  	* semanage_store: fix snprintf length argument by using asprintf
  	* Use default semanage.conf as a fallback
  	* use after free in python bindings


author: Dan Walsh <dwalsh@redhat.com> - 2.1.8-3
changelog:
  - Attempt to allocate memory for selinux_binary_policy_path and free memory 
  - allocated by asprintf.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.9-1
changelog:
  - Update to upstream 
  	* libsemanage: do not set soname needlessly
  	* libsemanage: remove PYTHONLIBDIR and ruby equivalent
  	* do boolean name substitution
  	* Fix segfault for building standard policies.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.9-2
changelog:
  - Fix handling of missing semanage permissive -d foo, not failing correctly
  - Previous to this fix the first module beginning with foo would get deleted.


author: Dan Walsh <dwalsh@redhat.com> 2.1.9-3
changelog:
  - Update to latest patches from eparis/Upstream
  -    libsemanage: fixes from coverity
  -    libsemange: redo genhomedircon minuid


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-1
changelog:
  - Update to upstream 
  	* Add sefcontext_compile to compile regex everytime policy is rebuilt
  	* Cleanup/fix enable/disable/remove module.
  	* redo genhomedircon minuid
  	* fixes from coverity
  	* semanage_store: do not leak memory in semanage_exec_prog
  	* genhomedircon: remove useless conditional in get_home_dirs
  	* genhomedircon: double free in get_home_dirs
  	* fcontext_record: do not leak on error in semanage_fcontext_key_create
  	* genhomedircon: do not leak on failure in write_gen_home_dir_context
  	* semanage_store: do not leak fd 
  	* genhomedircon: do not leak shells list
  	* semanage_store: do not leak on strdup failure 
  	* semanage_store: rewrite for readability


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-6
changelog:
  - Remove dependance on selinux-policy, /etc/selinux should be owned by libsemanage, and selinux-policy can require it.


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-7
changelog:
  - Move handling of role audit records into the library
  - Patch stops semanage from removing user record while in use


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-10
changelog:
  - Do not write error message to screen when looking for previous record for auditing.
  - Add mls_range from user record if the MLS range is not specified by the seuser add record.
  - Error out if seuser or mls range is not specified when adding user records


author: Dan Walsh <dwalsh@redhat.com> - 2.1.10-14
changelog:
  - Cleanup handling of missing mls_range to fix problems with useradd -Z
  - Fix auditing of login record changes, roles were not working correctly.
  Resolves: #952237


author: Dan Walsh <dwalsh@redhat.com> - 2.2-1
changelog:
  - Update to upstream 
  	* Avoid duplicate list entries from Dan Walsh.
  	* Add audit support to libsemanage from Dan Walsh.
  	* Remove policy.kern and replace with symlink from Dan Walsh.
  	* Apply a MAX_UID check for genhomedircon from Laurent Bigonville.
  	* Fix man pages from Laurent Bigonville.


author: Petr Lautrbach <plautrba@redhat.com> 2.4-2
changelog:
  - semanage_migrate_store: use /usr/bin/python3
  - move semanage_migrate_store script to libsemanage-python3


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-5
changelog:
  - Sort object files for deterministic linking order
  - Support overriding Makefile RANLIB
  - Respect CC and PKG_CONFIG environment variable


author: Petr Lautrbach <plautrba@redhat.com> 2.5-8
changelog:
  - Fixes bug preventing the installation of base modules
  - make distclean target work
  - Do not always print a module name warning
  - Use pp module name instead of filename when installing module
  - tests: Do not force using gcc
  - genhomedircon: remove hardcoded refpolicy strings
  - genhomedircon: add support for %group syntax
  - genhomedircon: generate contexts for logins mapped to the default user
  - Validate and compile file contexts before installing
  - Swap tcp and udp protocol numbers


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-1
changelog:
  - Update to upstream release 2017-08-04
  - Use 'sefcontext_compile -r' when it's run during SELinux policy build


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.7-2
changelog:
  - Python 2 binary package renamed to python2-libsemanage
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
  - Python 3 binary package renamed to python3-libsemanage


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-10
changelog:
  - properly check return value of iterate function
  - Use umask(0077) for fopen() write operations
  - Return commit number if save-previous false
  - Allow tmp files to be kept if a compile fails
  - build: follow standard semantics for DESTDIR and PREFIX
  - Improve warning for installing disabled module
  - silence clang static analyzer report
  - remove access() check to make setuid programs work


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-5
changelog:
  - cil: Create new keep field for type attribute sets
  - build: follow standard semantics for DESTDIR and PREFIX
  - cil: show an error when cil_expr_to_string() fails


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-6
changelog:
  - Prevent freeing unitialized value in ibendport handling
  - Add support for the SCTP portcon keyword
  - Export sepol_polcap_getnum/name functions


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-3
changelog:
  - cil: Fix out-of-bound read of file context pattern ending with "\"
  - cil: Destroy classperms list when resetting classpermission (#1983517)
  - cil: Destroy classperm list when resetting map perms (#1983521)
  - cil: cil_reset_classperms_set() should not reset classpermission (#1983525)
  - cil: Set class field to NULL when resetting struct cil_classperms
  - cil: More strict verification of constraint leaf expressions
  - cil: Exit with an error if declaration name is a reserved word
  - cil: Allow permission expressions when using map classes
  - cil: Reorder checks for invalid rules when building AST
  - cil: Cleanup build AST helper functions
  - cil: Create new first child helper function for building AST
  - cil: Remove unused field from struct cil_args_resolve
  - cil: Destroy disabled optional blocks after pass is complete
  - cil: Check if name is a macro parameter first
  - cil: fix NULL pointer dereference in __cil_insert_name
  - cil: Report disabling an optional block only at high verbose levels
  - cil: Use AST to track blocks and optionals when resolving
  - cil: Reorder checks for invalid rules when resolving AST
  - cil: Sync checks for invalid rules in booleanifs
  - cil: Check for statements not allowed in optional blocks (#1983530)


author: Jindrich Novy <jnovy@redhat.com> - 4.3.0-3
changelog:
  - fix static analysis issues merged upstream
    (https://gitlab.freedesktop.org/slirp/libslirp/-/merge_requests/41)
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 4.3.0-4
changelog:
  - fix "CVE-2020-10756 QEMU: slirp: networking out-of-bounds read information disclosure vulnerability"
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 4.4.0-1
changelog:
  - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
  - Related: #1934415


author: John H Terpstra <jht@samba.anu.edu.au>
changelog:
  - Many optimisations (some suggested by Manoj Kasichainula <manojk@io.com>
  - Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb
  - Compounded make line
  - Updated smb.init restart mechanism
  - Use compound mkdir -p line instead of individual calls to mkdir
  - Fixed smb.conf file path for log files
  - Fixed smb.conf file path for incoming smb print spool directory
  - Added a number of options to smb.conf file
  - Added smbadduser command (missed from all previous RPMs) - Doooh!
  - Added smbuser file and smb.conf file updates for username map


author: Erik Troan <ewt@redhat.com>
changelog:
  - made the %postun script a tad less agressive; no reason to remove
    the logs or lock file (after all, if the lock file is still there,
    samba is still running)
  - the %postun and %preun should only exectute if this is the final
    removal
  - migrated %triggerpostun from Red Hat's samba package to work around
    packaging problems in some Red Hat samba releases


author: Bill Nottingham <notting@redhat.com>
changelog:
  - add a mount.smb to make smb mounting a little easier.
  - smb filesystems apparently don't work on alpha. Oops.


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.0.5
  - fix mount.smb - smbmount options changed again.........
  - fix postun. oops.
  - update some stuff from the samba team's spec file.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - use cp rather than mv to preserve /etc/services perms (#4938 et al).
  - use mktemp to generate /etc/tmp.XXXXXX file name.
  - add prereqs on sed/mktemp/killall (need to move killall to /bin).
  - fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7")


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix yp_get_default_domain in autoconf
  - only link against readline for smbclient
  - fix log rotation (#9909)


author: Than Ngo <than@redhat.de>
changelog:
  - add initdir macro to handle the initscript directory
  - add a new macro to handle /etc/pam.d/system-auth


author: Bill Nottingham <notting@redhat.com>
changelog:
  - move initscript back
  - remove 'Using Samba' book from %doc 
  - move stuff to /etc/samba (#13708)
  - default configuration tweaks (#13704)
  - some logrotate tweaks


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix swat only_from line (#18726, others)
  - fix attempt to write outside buildroot on install (#17943)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - set a default CA certificate path in smb.conf (#19010)
  - require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file


author: Bill Nottingham <notting@redhat.com>
changelog:
  - i18n-ize initscript
  - add a sysconfig file for daemon options (#23550)
  - clarify smbpasswd man page (#23370)
  - build with LFS support (#22388)
  - avoid extraneous pam error messages (#10666)
  - add Urban Widmark's bug fixes for smbmount (#19623)
  - fix setgid directory modes (#11911)
  - split swat into subpackage (#19706)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak the PAM code some more to try to do a setcred() after initgroups()
  - pull in all of the optflags on i386 and sparc
  - don't explicitly enable Kerberos support -- it's only used for password
    checking, and if PAM is enabled it's a no-op anyway


author: Helge Deller <hdeller@redhat.de>
changelog:
  - updated to samba 2.2.0
  - moved codepages to %{_datadir}/samba/codepages
  - use all available CPUs for building rpm packages
  - use %{_xxx} defines at most places in spec-file
  - "License:" replaces "Copyright:"
  - dropped excludearch sparc
  - de-activated japanese patches 100 and 200 for now 
    (they need to be fixed and tested wth 2.2.0)
  - separated swat.desktop file from spec-file and added
    german translations
  - moved /etc/sysconfig/samba to a separate source-file
  - use htmlview instead of direct call to netscape in 
    swat.desktop-file


author: Helge Deller <hdeller@redhat.de>
changelog:
  - build as 2.2.0-1 release
  - skip the documentation-directories docbook, manpages and yodldocs
  - don't include *.sgml documentation in package
  - moved codepage-directory to /usr/share/samba/codepages
  - make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - (these changes are from the non-head version)
  - Don't include /usr/sbin/samba, it's the same as the initscript
  - unset TMPDIR, as samba can't write into a TMPDIR owned
    by root (#41193)
  - Add pidfile: lines for smbd and nmbd and a config: line
    in the initscript  (#15343)
  - don't use make -j
  - explicitly include /usr/share/samba, not just the files in it


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Use /var/cache/samba instead of /var/lock/samba 
  - Remove "domain controller" keyword from smb.conf, it's 
    deprecated (from #13704)
  - Sync some examples with smb.conf.default
  - Fix password synchronization (#16987)


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Don't include smbpasswd in samba, it's in samba-common (#51598)
  - Add a disabled "obey pam restrictions" statement - it's not
    active, as we use encrypted passwords, but if the admin turns
    encrypted passwords off the choice is available. (#31351)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-3
changelog:
  - Add "--with-utmp" to configure options (#55372)
  - Include winbind, pam_smbpass.so, rpcclient and smbcacls
  - start using /var/cache/samba, we need to keep state and there is
    more than just locks involved


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-5
changelog:
  - Teach smbadduser about "getent passwd" 
  - Fix more pid-file references
  - Add (conditional) winbindd startup to the initscript, configured in
    /etc/sysconfig/samba


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-6
changelog:
  - Move winbind files to samba-common. Add separate initscript for
    winbind 
  - Fixes for winbind - protect global variables with mutex, use
    more secure getenv


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.3a-3
changelog:
  - include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o
    (patch posted to samba-list by Ilia Chipitsine)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.5-7
changelog:
  - Enable VFS support and compile the "recycling" module (#69796)
  - more selective includes of the examples dir


author: Jay Fenlason <fenlason@redhat.com> 2.2.7a-3
changelog:
  - edited spec file to put .so files in the correct directories
    on 64-bit platforms that have 32-bit compatability issues
    (sparc64, x86_64, etc).  This fixes bugzilla #83782.
  - Added samba-2.2.7a-error.patch from twaugh.  This fixes
    bugzilla #82454.


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.7a-4
changelog:
  - relink libnss_wins.so with SHLD="%{__cc} -lnsl" to force libnss_wins.so to
    link with libnsl, avoiding unresolved symbol errors on functions in libnsl


author: Jay Fenlason <fenlason@redhat.com> 2.2.8-0
changelog:
  - Upgrade to 2.2.8
  - removed commented out patches.
  - removed old patches and .md5 files from the repository.
  - remove duplicate /sbin/chkconfig --del winbind which causes
    warnings when removing samba.
  - Fixed minor bug in smbprint that causes it to fail when called with
    more than 10 parameters: the accounting file (and spool directory
    derived from it) were being set wrong due to missing {}.  This closes
    bug #86473.
  - updated smb.conf patch, includes new defaults to close bug #84822.


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-1
changelog:
  - upgrade to 2.2.8a
  - remove old .md5 files
  - add "pid directory = /var/run" to the smb.conf file.  Fixes #88495
  - Patch from jra@dp.samba.org to fix a delete-on-close regression


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-2
changelog:
  - add libsmbclient.so for gnome-vfs-extras
  - Edit specfile to specify /var/run for pid files
  - Move /tmp/.winbindd/socket to /var/run/winbindd/socket


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-3beta3
changelog:
  - Merge from 3.0.0-2beta3.3E
  - (Correct log file names (#100981).)
  - (Fix pidfile directory in samab.log)
  - (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file)
  - (Move libsmbclient to the -common package (#99449))


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-15
changelog:
  - New 3.0.0 final release
  - merge nmbd-netbiosname and testparm patches from 3E branch
  - updated the -logfiles patch to work against 3.0.0
  - updated the pie patch
  - update the VERSION file during build
  - use make -j if avaliable
  - merge the winbindd_privileged change from 3E
  - merge the "rm /usr/lib" patch that allows Samba to build on 64-bit
    platforms despite the broken Makefile


author: Felipe Alfaro Solana <felipe_alfaro@linuxmail.org> 3.0.1-1
changelog:
  - Update to 3.0.1
  - Removed testparm patch as it's already merged
  - Removed Samba.7* man pages
  - Fixed .buildroot patch
  - Fixed .pie patch
  - Added new /usr/bin/tdbdump file


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-3rc2
changelog:
  - add %dir entries for %{_libdir}/samba and %{_libdir}/samba/charset
  - Upgrade to new upstream version
  - build mount.cifs for the new cifs filesystem in the 2.6 kernel.


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-5
changelog:
  - New upstream version: 3.0.2 final includes security fix for #114995
    (CAN-2004-0082)
  - Edit postun script for the -common package to restart winbind when
    appropriate.  Fixes bugzilla #114051.


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Change all requires lines to list an explicit epoch.  Closes #102715
  - Add an explicit Epoch so that %{epoch} is defined.


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-1.pre1
changelog:
  - New upstream version.
  - Updated -pie and -logfiles patches for 3.0.3pre1
  - add krb5-devel to buildrequires, fixes #116560
  - Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run
    "service smb status".  This fixes #116559


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-2.pre2
changelog:
  - New upstream version  
  - Updated configure line to remove --with-fhs and to explicitly set all
    the directories that --with-fhs was setting.  We were overriding most of
    them anyway.  This closes #118598


author: jay Fenlason <fenlason@redhat.com> 3.0.3-3.rc1
changelog:
  - New upstream version
  - updated spec file to make libsmbclient.so executable.  This closes
    bugzilla #121356


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-5
changelog:
  - Patch to allow password changes from machines patched with
    Microsoft hotfix MS04-011.
  - Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302
    and https://bugzilla.samba.org/show_bug.cgi?id=1309


author: Jay Fenlason <fenlason@redhat.com> 3.0.5.0pre1.0
changelog:
  - New upstream version
  - use % { SOURCE1 } instead of a hardcoded path
  - include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org)
    https://bugzilla.samba.org/show_bug.cgi?id=1315
    to make winbindd work against Windows versions that do not have
    128 bit encryption enabled.
  - Moved %{_bindir}/net to the -common package, so that folks who just
    want to use winbind, etc don't have to install -client in order to
    "net join" their domain.
  - New upstream version obsoletes the patches added in 3.0.3-5
  - Remove smbgetrc.5 man page, since we don't ship smbget.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-0.pre1.1
changelog:
  - Backport base64_decode patche to close CAN-2004-0500
  - Backport hash patch to close CAN-2004-0686
  - use_authtok patch from Nalin Dahyabhai <nalin@redhat.com>
  - smbclient-kerberos patch from Alexander Larsson <alexl@redhat.com>
  - passwd patch uses "*" instead of "x" for "hashed" passwords for
    accounts created by winbind.  "x" means "password is in /etc/shadow" to
    brain-damaged pam_unix module.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-2
changelog:
  - Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a
    security fix.
  - Include the 3.0.4-backport patch from the 3E branch.  This restores
    some of the 3.0.5pre1 and 3.0.5rc1 functionality.


author: Jason Vas Dias <jvdias@redhat.com> 3.0.5-3
changelog:
  - Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination
  - resulted in executables getting corrupt stacks, causing smbmnt to
  - get a SIGBUS in the mount() call (bug 127420).


author: Jay Fenlason <fenlason@redhat.com> 3.0.6-3
changelog:
  - New upstream version.
  - Include post 3.0.6 patch from "Gerald (Jerry) Carter" <jerry@samba.org>
    to fix a duplicate in the LDAP schema.
  - Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com)
    to allow correct timestamp handling on 64-bit platforms and fix #126109.
  - reenable the -pie patch.  Samba is too widely used, and too vulnerable
    to potential security holes to disable an important security feature
    like -pie.  The correct fix is to have the toolchain not create broken
    executables when programs compiled -pie are stripped.
  - Remove obsolete patches.
  - Modify this spec file to put libsmbclient.{a,so} in the right place on
    x86_64 machines.


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-3
changelog:
  - Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808
    This obsoletes the 3.0.6-schema patch.
  - Update BuildRequires line to include openldap-devel openssl-devel
    and cups-devel


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-4
changelog:
  - Update docs section to not carryover the docs/manpages directory
    This moved many files from /usr/share/doc/samba-3.0.7/docs/* to
    /usr/share/doc/samba-3.0.7/*
  - Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu)
    to correctly create libsmbclient.so.0 and to use %_initrddir instead
    of rolling our own.  This closes #132642
  - Add patch to default "use sendfile" to no, since sendfile appears to
    be broken
  - Add patch from Volker Lendecke <vl@samba.org> to help make
    ldapsam_compat work again.
  - Add patch from "Vince Brimhall" <vbrimhall@novell.com> for ldapsam_compat
    These two patches close bugzilla #132169


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies
    smbmnt to work with 32-bit uids.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.2
changelog:
  - Re-enable the x_fclose patch that was accidentally disabled
    in 3.0.8-0.pre1.1.  This closes #135832
  - include Nalin's -fqdn and -salt patches.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.3
changelog:
  - disable the -salt patch, because it causes undefined references in
    libsmbclient that prevent gnome-vfs from building.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-2
changelog:
  - New upstream version fixes CAN-2004-0930.  This obsoletes the
    disable-sendfile, salt, signing-shortkey and fqdn patches.
  - Add my <fenlason@redhat.com> ugly non-ascii-domain patch.
  - Updated the pie patch for 3.0.8.
  - Updated the logfiles patch for 3.0.8.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3
changelog:
  - Include the corrected docs tarball, and use it instead of the
    obsolete docs from the upstream 3.0.8 tarball.
  - Update the logfiles patch to work with the updated docs.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3.1
changelog:
  - Rescue the install.mount.smbfs patch from Juanjo Villaplana
    (villapla@si.uji.es) to prevent building the srpm from trashing your
    installed /usr/bin/smbmount


author: Than Ngo <than@redhat.com> 3.0.8-4
changelog:
  - fix unresolved symbols in libsmbclient which caused applications
    such as KDE's konqueror to fail when accessing smb:// URLs. #139894


author: Jay Fenlason <fenlason@redhat.com> 3.0.9-2
changelog:
  - New upstream release.  This obsoletes the -secret patch.
    Include my changetrustpw patch to make "net ads changetrustpw" stop
    aborting.  This closes #134694
  - Remove obsolete triggers for ancient samba versions.
  - Move /var/log/samba to the -common rpm.  This closes #76628
  - Remove the hack needed to get around the bad docs files in the
    3.0.8 tarball.
  - Change the comment in winbind.init to point at the correct pidfile.
    This closes #76641


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-2
changelog:
  - New upstream release that closes CAN-2004-1154  bz#142544
  - Include the -64bit patch from Nalin.  This closes bz#142873
  - Update the -logfiles patch to work with 3.0.10
  - Create /var/run/winbindd and make it part of the -common rpm to close
    bz#142242


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-4
changelog:
  - Update the -man patch to fix ntlm_auth.1 too.
  - Move pam_smbpass.so to the -common package, so both the 32
    and 64-bit versions will be installed on multiarch platforms.
    This closes bz#143617
  - Added new -delim patch to fix mount.cifs so it can accept
    passwords with commas in them (via environment or credentials
    file) to close bz#144198


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-3
changelog:
  - add -gcc4 patch to compile with gcc 4.
  - remove the now obsolete -smbclient-kerberos.patch
  - Include four upstream patches from
    http://samba.org/~jerry/patches/post-3.0.11/
    (Slightly modified the winbind_find_dc_v2 patch to apply easily with
    rpmbuild).


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-4
changelog:
  - Use the updated filter-requires-samba.sh file, so we don't accidentally
    pick up a dependency on perl(Crypt::SmbHash)


author: Jay Fenlason <fenlason@redhat.com> 3.0.13-2
changelog:
  - New upstream release
  - add my -quoting patch, to fix swat with strings that contain
    html meta-characters, and to use correct quote characters in
    lists, closing bz#134310
  - include the upstream winbindd_2k3sp1 patch
  - include the -smbclient patch.
  - include the -hang patch from upstream.


author: Jay Fenlason <fenlason@redhat.com> 3.0.14a-2
changelog:
  - New upstream release.
  - the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1,
    winbind_find_dc_v2 patches are now obsolete.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20-2
changelog:
  - New upstream release
    Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3,
      -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1
    This obsoletes the -pie and -delim patches
    the -warning and -gcc4 patches are obsolete too
    The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1
    Also, the -quoting patch was implemented differently upstream
    There is now a umount.cifs executable and manpage
    We run autogen.sh as part of the build phase
    The testprns command is now gone
    libsmbclient now has a man page
  - Include -bug106483 patch to close
    bz#106483 smbclient: -N negates the provided password, despite documentation
  - Added the -warnings patch to quiet some compiler warnings.
  - Removed many obsolete patches from CVS.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20b-2
changelog:
  - turn on -DLDAP_DEPRECATED to allow access to ldap functions that have
    been depricated in 2.3.11, but which don't have well-documented
    replacements (ldap_simple_bind_s(), for example).
  - Upgrade to 3.0.20b, which includes all the previous upstream patches.
  - Updated the -warnings patch for 3.0.20a.
  - Include  --with-shared-modules=idmap_ad,idmap_rid to close
    bz#156810 --with-shared-modules=idmap_ad,idmap_rid
  - Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close
    bz#170259 pam_stack is deprecated


author: Jay Fenlason <fenlason@redhat.com> 3.0.21b-2
changelog:
  - New upstream version.
  - Since the rawhide kernel has dropped support for smbfs, remove smbmount
    and smbumount.  Users should use mount.cifs instead.
  - Upgrade to 3.0.21b


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-0.RC3
changelog:
  - New upstream RC release.
  - Update the -logfiles, and -passwd patches for
    3.0.23rc3
  - Include the change to smb.init from Bastien Nocera <bnocera@redhat.com>)
    to close
    bz#182560 Wrong retval for initscript when smbd is dead
  - Update this spec file to build with 3.0.23rc3
  - Remove the -install.mount.smbfs patch, since we don't install
    mount.smbfs any more.


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-2
changelog:
  - New upstream release.
  - Use modified filter-requires-samba.sh from packaging/RHEL/setup/
    to get rid of bogus dependency on perl(Unicode::MapUTF8)
  - Update the -logfiles and -smb.conf patches to work with 3.0.23


author: Jay Fenlason <fenlason@redhat.com> 3.0.23a-3
changelog:
  - Fix the -logfiles patch to close
    bz#199607 Samba compiled with wrong log path.
    bz#199206 smb.conf has incorrect log file path


author: Simo Sorce <ssorce@redhat.com> 3.0.24-2.fc7
changelog:
  - New upstream release
  - Fix packaging issue wrt idmap modules used only by smbd
  - Addedd Vista Patchset for compatibility with Windows Vista
  - Change default of "msdfs root", it seem to cause problems with
    some applications and it has been proposed to change it for
    3.0.25 upstream


author: Simo Sorce <ssorce@redhat.com> 3.0.24-3.fc7
changelog:
  - Directories reorg, tdb files must go to /var/lib, not
    to /var/cache, add migration script in %post common
  - Split out libsmbclient, devel and doc packages
  - Remove libmsrpc.[h|so] for now as they are not really usable
  - Remove kill -HUP from rotate, samba use -HUP for other things
    noit to reopen logs


author: Simo Sorce <ssorce@redhat.com> 3.0.24-5.fc7
changelog:
  - actually use the correct samba.pamd file not the old samba.pamd.stack file
  - fix logifles and use upstream convention of log.* instead of our old *.log
    Winbindd creates its own log.* files anyway so we will be more consistent
  - install our own (enhanced) default smb.conf file
  - Fix pam_winbind acct_mgmt PAM result code (prevented local users from
    logging in). Fixed by Guenther.
  - move some files from samba to samba-common as they are used with winbindd
    as well


author: Simo Sorce <ssorce@redhat.com> 3.0.24-6.fc7
changelog:
  - do not put comments inline on smb.conf options, they may be read
    as part of the value (for example log files names)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-7.fc7
changelog:
  - make winbindd start earlier in the init process, at the same time
    ypbind is usually started as well
  - add a sepoarate init script for nmbd called nmb, we need to be able
    to restart nmbd without dropping al smbd connections unnecessarily


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - remove patch for bug 106483 as it introduces a new bug that prevents
    the use of a credentials file with the smbclient tar command
  - move the samba private dir from being the same as the config dir
    (/etc/samba) to /var/lib/samba/private


author: Simo Sorce <ssorce@redhat.com> 3.0.24-9.fc7
changelog:
  - integrate most of merge review proposed changes (bug #226387)
  - remove libsmbclient-devel-static and simply stop shipping the
    static version of smbclient as it seem this is deprecated and
    actively discouraged


author: Simo Sorce <ssorce@redhat.com> 3.0.24-10.fc7
changelog:
  - set passdb backend = tdbsam as default in smb.conf
  - remove samba-docs dependency from swat, that was a mistake
  - put back COPYING and other files in samba-common
  - put examples in samba not in samba-docs
  - leave only stuff under docs/ in samba-doc


author: Guenther Deschner <gdeschner@redhat.com> 3.0.24-11.fc7
changelog:
  - enable PAM and NSS dlopen checks during build
  - fix unresolved symbols in libnss_wins.so (bug #198230)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-12.fc7
changelog:
  - fixes in smb.conf
  - advice in smb.conf to put scripts in /var/lib/samba/scripts
  - create /var/lib/samba/scripts so that selinux can be happy
  - fix Vista problems with msdfs errors


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - fixes in the spec file
  - moved to 3.0.25rc1
  - addedd patches (merged upstream so they will be removed in 3.0.25rc2)


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - update to 3.0.25a as it contains many fixes
  - add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut.


author: Simo Sorce <ssorce@redhat.com> 3.2.0-0.pre1.fc9
changelog:
  - New major relase, minor switched from 0 to 2
  - License change, the code is now GPLv3+
  - Numerous improvements and bugfixes included
  - package libsmbsharemodes too
  - remove smbldap-tools as they are already packaged separately in Fedora
  - Fix bug 245506


author: Simo Sorce <ssorce@redhat.com> - 3.2.0-0.pre1.3
changelog:
  - Try to fix GCC 4.3 build
  - Add --with-dnsupdate flag and also make sure other flags are required just to
    be sure the features are included without relying on autodetection to be
    successful


author: Guenther Deschner <gdeschner@redhat.com> - 3.3.0-0.25
changelog:
  - Update to 3.3.0 final
  - Add upstream fix for ldap connections to AD (Bug #6073)
  - Remove bogus perl dependencies (resolves: #473051)


author: Simo Sorce <ssorce@redhat.com> - 3.3.1-0.29
changelog:
  - Make the talloc and ldb packages optionsl and disable their build within
    the samba3 package, they are now built as part of the samba4 package
    until they will both be released as independent packages.


author: Simo Sorce <ssorce@redhat.com> - 3.3.2-0.33
changelog:
  - Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the
    configuration
  - Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on
    startup, causing your own machine not to show up in the network for 5 minutes
    if it was the only client in that workgroup (fix committed upstream)


author: Guenther Deschner <gdeschner@redhat.com> - 3.4.0-0.41
changelog:
  - Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX)
  - Specify required talloc and tdb version for BuildRequires


author: Simo Sorce <ssorce@redhat.com> - 3.4.2-47
changelog:
  - Spec file cleanup
  - Fix sources upstream location
  - Remove conditionals to build talloc and tdb, now they are completely indepent
    packages in Fedora
  - Add defattr() where missing
  - Turn all tabs into 4 spaces
  - Remove unused migration script
  - Split winbind-clients out of main winbind package to avoid multilib to include
    huge packages for no good reason


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.3-60
changelog:
  - Update to 3.5.3
  - Make sure nmb and smb initscripts return LSB compliant return codes
  - Fix winbind over ipv6


author: Andreas Schneider <asn@redhat.com> - 2:3.6.5-88
changelog:
  - Move tmpfiles.d config to common package as it is needed for smbd and
    winbind.
  - Make sure tmpfiles get created after installation.


author: Ville Skyttä <ville.skytta@iki.fi> - 2:3.6.6-92
changelog:
  - Call ldconfig at libwbclient and -winbind-clients post(un)install time.
  - Fix empty localization files, use %find_lang to find and %lang-mark them.
  - Escape macros in %changelog.
  - Fix source tarball URL.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.0-154.rc3
changelog:
  - Update to 4.0.0rc3.
  - resolves: #805562 - Unable to share print queues.
  - resolves: #863388 - Unable to reload smbd configuration with systemctl.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.0-160.rc3
changelog:
  - resolves: #867893 - Move /var/log/samba to samba-common package for
                        winbind which requires it.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.2-1
changelog:
  - Update to Samba 4.0.2.
  - Fixes CVE-2013-0213.
  - Fixes CVE-2013-0214.
  - resolves: #906002
  - resolves: #905700
  - resolves: #905704
  - Fix conn->share_access which is reset between user switches.
  - resolves: #903806
  - Add missing example and make sure we don't introduce perl dependencies.
  - resolves: #639470


author: Andreas Schneider <asn@redhat.com> - 2:4.0.3-1
changelog:
  - Update to Samba 4.0.3.
  - resolves: #907544 - Add unowned directory /usr/lib64/samba.
  - resolves: #906517 - Fix pidl code generation with gcc 4.8.
  - resolves: #908353 - Fix passdb backend ldapsam as module.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.4-3
changelog:
  - resolves: #919405 - Fix and improve large_readx handling for broken clients.
  - resolves: #924525 - Don't use waf caching.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.5-1
changelog:
  - Update to Samba 4.0.5.
  - Add UPN enumeration to passdb internal API (bso #9779).
  - resolves: #928947 - samba-doc is obsolete now.
  - resolves: #948606 - LogRotate should be optional, and not a hard "Requires".


author: Andreas Schneider <asn@redhat.com> - 2:4.0.7-2
changelog:
  - resolves: #972692 - Build with PIE and full RELRO.
  - resolves: #884169 - Add explicit dependencies suggested by rpmdiff.
  - resolves: #981033 - Local user's krb5cc deleted by winbind.
  - resolves: #984331 - Fix samba-common tmpfiles configuration file in wrong
                        directory.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.2
changelog:
  - resolves: #985985 - Fix file conflict between samba and wine.
  - resolves: #985107 - Add support for new default location for Kerberos
                        credential caches.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.7
changelog:
  - related: #985609 - Update to Samba 4.1.0rc3.
  - resolves: #1005422 - Add support for KEYRING ccache type in pam_winbindd.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.8
changelog:
  - related: #985609 - Update to Samba 4.1.0rc4.
  - resolves: #1010722 - Split out a samba-winbind-modules package.


author: Andreas Schneider <asn@redhat.com> - 4.1.0-2
changelog:
  - resolves: #1018856 - Fix installation of pam_winbind after upgrade.
  - related: #1010722 - Split out a samba-winbind-modules package.
  - related: #985609


author: Andreas Schneider <asn@redhat.com> - 4.1.0-4
changelog:
  - related: #884169 - Add direct dependency to samba-libs in the
                       glusterfs package.
  - resolves: #996567 - Fix userPrincipalName composition.
  - related: #884169 - Fix memset call with zero length in in ntdb.


author: Andreas Schneider <asn@redhat.com> - 4.1.3-1
changelog:
  - Update to Samba 4.1.3.
  - resolves: #1039454 - CVE-2013-4408.
  - resolves: #1039500 - CVE-2012-6150.


author: Andreas Schneider <asn@redhat.com> - 4.2.0-0.3.rc2
changelog:
  - resolves: #1174412 - Build VFS Ceph module.
  - resolves: #1169067 - Move libsamba-cluster-support.so to samba-libs package.
  - resolves: #1016122 - Move smbpasswd to samba-common package.


author: Michael Adam <madam@redhat.com> - 4.2.0-0.2.rc3
changelog:
  - Improve dependencies of vfs-glusterfs and vfs-cephfs.
  - Remove unused python_libdir.
  - Fix malformed changelog entries.


author: Andreas Schneider <asn@redhat.com> - 4.2.0-2
changelog:
  - Fix the AD build.
  - Create samba-client-libs subpackage.
  - Fix multiarch issues by splitting the samba-common package.


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-5
changelog:
  - Require samba-common-tools in samba package
  - Require samba-common-tools in samba-client package
  - resolves: #1215631 - /usr/bin/net moved to samba-common-tools but the package is not required by samba


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-7
changelog:
  - Fix LSASD daemon
  - resolves: #1217346 - FreeIPA trusts to AD broken due to Samba 4.2 failure to run LSARPC pipe externally


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-8
changelog:
  - Fixes: #1219832: Samba 4.2 broke FreeIPA trusts to AD
  - Remove usage of deprecated API from gnutls


author: Andreas Schneider <asn@redhat.com> - 4.2.2-1
changelog:
  - resolves: #1227911 - Enable tar support for smbclient
  - resolves: #1234908 - Own the /var/lib/samba directory
  - Enable hardened build


author: Guenther Deschner <gdeschner@redhat.com> - 4.3.3-0
changelog:
  - Update to Samba 4.3.3
  - resolves: #1292069
  - CVE-2015-3223 Remote DoS in Samba (AD) LDAP server
  - CVE-2015-5252 Insufficient symlink verification in smbd
  - CVE-2015-5296 Samba client requesting encryption vulnerable to
                  downgrade attack
  - CVE-2015-5299 Missing access control check in shadow copy code
  - CVE-2015-7540 DoS to AD-DC due to insufficient checking of asn1
                  memory allocation


author: Guenther Deschner <gdeschner@redhat.com> - 4.4.0-0.7.rc4
changelog:
  - Update to Samba 4.4.0rc4
  - resolves: #1315942 - CVE-2015-7560 Incorrect ACL get/set allowed on symlink path


author: Guenther Deschner <gdeschner@redhat.com> - 4.4.2-1
changelog:
  - Update to Samba 4.4.2, fix badlock security bug
  - resolves: #1326453 - CVE-2015-5370
  - resolves: #1326453 - CVE-2016-2110
  - resolves: #1326453 - CVE-2016-2111
  - resolves: #1326453 - CVE-2016-2112
  - resolves: #1326453 - CVE-2016-2113
  - resolves: #1326453 - CVE-2016-2114
  - resolves: #1326453 - CVE-2016-2115
  - resolves: #1326453 - CVE-2016-2118


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.0-3
changelog:
  - auth/credentials: Always set the the realm if we set the principal from the ccache
  - resolves: #1430761 - credentials_crb5: use gss_acquire_cred for client-side GSSAPI use case


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.0-4
changelog:
  - Export arcfour_crypt_blob to Python as samba.crypto.arcfour_encrypt
  - Makes possible to run trust to AD in FreeIPA in FIPS mode


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-0.5.rc1
changelog:
  - Convert more rpc modules to python3
  - Explicitly specify Python artifacts in the spec to be able to catch unpackaged ones
  - Split 'make test' Python code into separate python2-samba-test/python3-samba-test sub-packages
  - Remove embedded python2-dns version, require python{2,3}-dns instead


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-0.6.rc1
changelog:
  - Use Python 2 explicitly for samba-tool and other Python-based tools
  - Install samba.service as it is required for the AD DC case


author: Guenther Deschner <gdeschner@redhat.com> - 4.7.0-12
changelog:
  - Update to Samba 4.7.0
  - resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-13
changelog:
  - Move /usr/lib{64,}/samba/libdsdb-garbage-collect-tombstones-samba4.so to samba-dc-libs
  - Rebuild in rawhide against new krb5 1.16 and docbook-xml


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-18
changelog:
  - Force samba-dc to use the same libldb version as LDB modules compiled
  - resolves: #1507420 - LDB / Samba module version mismatch


author: Guenther Deschner <gdeschner@redhat.com> - 4.8.0-7
changelog:
  - resolves: #1554754, #1554756 - Security fixes for CVE-2018-1050 CVE-2018-1057
  - resolves: #1555112 - Update to Samba 4.8.0


author: Petr Viktorin <pviktori@redhat.com> - 4.8.3-2
changelog:
  - Use %{__python2}, not "python", as the Python2 interpreter
  - Add workaround to allow building with Python 2
  - Change unversioned python macros to python2
  - Disable gluster temporarily


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc3-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc3
  - resolves: #1554753 - Fix CVE-2018-1050
  - resolves: #1617912 - Fix CVE-2018-10858
  - resolves: #1617913 - Fix CVE-2018-10918
  - resolves: #1617914 - Fix CVE-2018-10919
  - resolves: #1617915 - Fix CVE-2018-1139
  - resolves: #1612522 - Manpage fixes


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc5-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc5
  - resolves: #1610909 - Re-enable glubsterfs vfs module
  - resolves: #1624170 - Build with -fstack-protectore-strong if available
  - resolves: #1602685 - Fixed issues found by covscan


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.9.1-3
changelog:
  - Temporarily remove smbtorture from samba-test due to Python 2 linkage
  - related: #1609661 - samba-test package cannot be installed due to unresolved dependencies


author: Andreas Schneider <asn@redhat.com> - 4.9.1-5
changelog:
  - resolves: #1644327 - Segfault if wrong 'passdb backend' is configured
  - resolves: #1647959 - Segfault in the debug system with hardended build


author: Andreas Schneider <asn@redhat.com> - 4.9.1-6
changelog:
  - resolves: #1642092 - Harden [homes] share export
  - resolves: #1648846 - Fix out of bound array access in ctdb
  - resolves: #1657266 - Fix tmp directory creation in /run


author: Andreas Schneider <asn@redhat.com> - 4.9.1-7
changelog:
  - resolves: #1658690 - Add smbc_setOptionProtocols()
  - resolves: #1658678 - Fix spoolss client operations against Windows


author: Andreas Schneider <asn@redhat.com> - 4.10.4-0
changelog:
  - related: #1638001 - Rebase to Samba version 4.10.4
  - resolves: #1597298 - Build Samba with python3
  - resolves: #1658558 - Add 'net ads leave --keep-account' option
  - resolves: #1669004 - Fix systemd status notifications
  - resolves: #1672167 - Fix printing cache timeout in debug output
  - resolves: #1696525 - Fix CVE-2019-3880


author: Andreas Schneider <asn@redhat.com> - 4.10.4-1
changelog:
  - resolves: #1712378 - Fix smbspool CUPS backend
  - resolves: #1696612 - Fix 'net ads join -U admin@parentdomain'


author: Andreas Schneider <asn@redhat.com> - 4.10.4-100
changelog:
  - resolves: #1754575 - Avoid overlinking with librt and libpthread
  - resolves: #1755440 - Fix forest trusts enumeration
  - resolves: #1755445 - Fix CUPS username/password authentication with smbspool


author: Andreas Schneider <asn@redhat.com> - 4.11.2-1
changelog:
  - resolves: #1754409 - Rebase to Samba version 4.11.2
  - resolves: #1776312 - Winbind is not restarted on upgrade
  - resolves: #1764469 - Fix CVE-2019-10218
  - resolves: #1746241 - Fix CVE-2019-10197
  - resolves: #1710980 - Add support for KCM ccache in pam_winbind


author: Andreas Schneider <asn@redhat.com> - 4.11.2-4
changelog:
  - related: #1754409 - Add patch to avoid overlinking with libnsl and libsocket
  - related: #1754409 - Fix permissions for pidl
  - related: #1754409 - Fix logrotate script
  - related: #1754409 - Add missing README files


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.11.2-10
changelog:
  - resolves: #1790353 - Fix access check in DsRGetForestTrustInformation
  - resolves: #1791209 - Fix CVE-2019-14907


author: Andreas Schneider <asn@redhat.com> - 4.11.2-12
changelog:
  - related: #1781232 - Improve debug output of smbclient
  - resolves: #1794461 - Do not return bogus inode numbers in
                         cli_qpathinfo2()/cli_qpathinfo3() for SMB1
  - resolves: #1794442 - Fix segfault in smbd_do_qfilepathinfo()


author: Andreas Schneider <asn@redhat.com> - 4.12.3-0
changelog:
  - resolves: #1817557 - Rebase to version 4.12.3
  - resolves: #1813833 - Fix 'net ads join createupn='


author: Andreas Schneider <asn@redhat.com> - 4.12.3-1
changelog:
  - resolves: #1666737 - Add a new smbc_readdirplus2() function to libsmbclient
  - resolves: #1842844 - Fix GnuTLS priority list for TLS connections


author: Isaac Boukris <iboukris@redhat.com> - 4.12.3-4
changelog:
  - resolves: #1850980 - Add "additional dns hostname" to keytab
  - resolves: #1850981 - Add net-ads-join dnshostname=fqdn option


author: Andreas Schneider <asn@redhat.com> - 4.12.3-5
changelog:
  - resolves: #1823612 - Fix segfault in 'net ads dns gethostbyname'
  - resolves: #1792553 - Fix 'net ads join createcomputer=OU'


author: Andreas Schneider <asn@redhat.com> - 4.12.3-7
changelog:
  - resolves: #1855711 - Fix 'require_membership_of' documentation in
                         pam_winbind manpage


author: Andreas Schneider <asn@redhat.com> - 4.12.3-9
changelog:
  - related: #1817557 - Move DECRPC mdssvc data files to correct package
  - resolves: #1856676 - Fix lookuprids in winbind


author: Andreas Schneider <asn@redhat.com> - 4.13.2-1
changelog:
  - resolves: #1878109 - Rebase Samba to version 4.13.2
  - resolves: #1872833 - Add samba-winexe subpackage
  - resolves: #1891688 - Fix CVE-2020-14323
  - resolves: #1892633 - Fix CVE-2020-14318
  - resolves: #1892639 - Fix CVE-2020-14383
  - resolves: #1879835 - Fix CVE-2020-1472
  - resolves: #1888990 - Update smb.conf manpages to describe how to apply
                         config changes.
  - resolves: #1869702 - Fix %U substitution for 'valid users' option
  - resolves: #1818038 - Improve FIPS compliance


author: Andreas Schneider <asn@redhat.com> - 4.13.2-2
changelog:
  - related: #1869702 - Fix spoolss crash
  - resolves: #1896736 - Fix name lookups of FreeIPA users
  - resolves: #1899113 - Fix DFS links


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.14.4-2
changelog:
  - resolves: rhbz#1944657 - Update to version 4.14.4
  - resolves: rhbz#1949445 - Fix CVE-2021-20254
  - resolves: rhbz#1947945 - Fix libsmbldap.so.2 not being a symbolic link
  - resolves: rhbz#1908506 - Fix creating the gencache user directory
  - resolves: rhbz#1901029 - Build the vfs_io_uring module


author: Andreas Schneider <asn@redhat.com> - 4.14.4-0
changelog:
  - related: rhbz#1944657 - Update to version 4.14.5
  - resolves: rhbz#1969787 - Fix memory leak in RPC server
  - resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
  - resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
  - resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
  - resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags


author: Andreas Schneider <asn@redhat.com> - 4.14.4-1
changelog:
  - resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
  - resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message


author: Andreas Schneider <asn@redhat.com> - 4.14.4-3
changelog:
  - resolves: rhbz#2019662 - Fix CVE-2016-2124
  - resolves: rhbz#2019668 - Fix CVE-2021-23192
  - resolves: rbhz#2019674 - Fix CVE-2020-25717


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.2-1
changelog:
  - resolves: rhbz#2013596 - Rebase to version 4.15.2
  - resolves: rhbz#1999294 - Remove noisy error message in winbindd
  - resolves: rhbz#1958881 - Don't require winbind being online for krb5 auth
                             with one-way trusts
  - resolves: rhbz#2019461 - Fix deleting directories with dangling symlinks


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.3-1
changelog:
  - related: rhbz#2013596 - Rebase to version 4.15.3
  - resolves: rhbz#2028029 - Fix possible null pointer dereference in winbind
  - resolves: rhbz#1912549 - Winexe: Kerberos Auth is respected via --use-kerberos=desired


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.4-0
changelog:
  - Update to Samba 4.15.4
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2039153 - Fix CVE-2021-20316
  - resolves: rhbz#1912549 - Winexe: Kerberos flag not invoking Kerberos Auth
  - resolves: rhbz#2039157 - Fix CVE-2021-43566
  - resolves: rhbz#2038148 - Failed to authenticate users after upgrade samba package to release samba-4.14.5-7
  - resolves: rhbz#2035528 - [smb] Segmentation fault when joining the domain
  - resolves: rhbz#2038796 - filename_convert_internal: open_pathref_fsp [xxx] failed: NT_STATUS_ACCESS_DENIED


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-0
changelog:
  - Update to Samba 4.15.5
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2046127 - Fix CVE-2021-44141
  - resolves: rhbz#2046153 - Fix CVE-2021-44142
  - resolves: rhbz#2044404 - Printing no longer works on Windows 7
  - resolves: rhbz#2043154 - Fix systemd notifications
  - resolves: rhbz#2049602 - Disable NTLMSSP for ldap client connections (e.g. libads)


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-1
changelog:
  - resolves: #1995849 - [RFE] Change change password change prompt phrasing
  - resolves: #2029417 - virusfilter_vfs_openat: Not scanned: Directory or special file


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-6
changelog:
  - resolves: rhbz#2059151 - Fix username map for unix groups
  - resolves: rhbz#2065212 - Fix 'create krb5 conf = yes` when a KDC has a single IP address.


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.3-0
changelog:
  - related: rhbz#2077468 - Rebase Samba to 4.16.3
  - resolves: rhbz#2106672 - The pcap background queue process should not be stopped
  - resolves: rhbz#2106263 - Fix crash in rpcd_classic
  - resolves: rhbz#2100093 - Fix net ads info returns LDAP server and LDAP server name


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.4-1
changelog:
  - resolves: rhbz#2221594 - Fix broken symlink for libwbclient
  - resolves: rhbz#2221600 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
  - resolves: rhbz#2175385 - Fix access of Samba share with veto files = /.*/
  - resolves: rhbz#2218237 - Fix Python tarfile extraction to avoid a warning


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-0
changelog:
  - resolves: rhbz#2222894 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-1
changelog:
  - related: rhbz#2190417 - Update to version 4.18.6
  - resolves: rhbz#2232564 - Fix the rpc dsgetinfo command


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.3-1
changelog:
  - resolves: RHEL-16483 - Update to version 4.19.3
  - resolves: RHEL-11361
              - Fix CVE-2023-3961 CVE-2023-4091 CVE-2023-42669
  - resolves: RHEL-2228  - Logging Format Enhancement
  - resolves: RHEL-1965  - Fix smbget issues with DFS shares
  - resolves: RHEL-2108  - Fix force user/group issues with 'allow trusted domains = yes'
  - resolves: RHEL-17122 - Fix memory corruption in libnss_winbind


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-2
changelog:
  - Fix error in PREIN scriptlet in rpm package samba-common
  - related: RHEL-16483 - Update to version 4.19.4


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-10
changelog:
  - resolves: RHEL-101902 - Fix DC discovery after Windows netlogon hardening - follow-up
  - resolves: RHEL-111318 - Fix winbind fork bomb in 'IPA with AD trust' environment


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10
changelog:
  - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function
    i2alaw_array in alaw (#1673085)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-11
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985028)


author: Jeremy Katz <katzj@redhat.com> 0.7.4-3
changelog:
  - fix to not try to include non-existent doc files and remove all 
    unwanted files from the build
  - include api docs 
  - don't build the apache module


author: Jeremy Katz <katzj@redhat.com> 0.7.9-3
changelog:
  - better lib64 patch
  - fix building of libwsdl-build to use libtool so that it gets built 
    with -fPIC as needed


author: Jeremy Katz <katzj@redhat.com> 1.99.17-1
changelog:
  - rename package to libsoup
  - update to 1.99.17
  - don't obsolete soup for now, it's parallel installable


author: David Malcolm <dmalcolm@redhat.com> - 2.2.2-1
changelog:
  - update from 2.2.1 to 2.2.2
  - add explicit devel requirements on glib2-devel, pkgconfig, gtk-doc, gnutls-devel and libxml2-devel


author: David Malcolm <dmalcolm@redhat.com> - 2.2.5-1
changelog:
  - 2.2.5
  - Removed gnome-bug-306877-soup-connection-ntlm.c.patch (#160071) as this is 
    now in upstream tarball


author: Matthew Barnes <mbarnes@redhat.com> - 2.3.0-1
changelog:
  - Update to 2.3.0
  - Bump glib2 requirement to >= 2.15.3.
  - Clean up some redundant dependencies.
  - Remove patch for RH bug #327871 (fixed in glibc).


author: David King <amigadave@amigadave.com> - 2.51.3-1
changelog:
  - Update to 2.51.3
  - Update URL
  - Use pkgconfig for BuildRequires
  - Preserve timestamps during install


author: Milan Crha <mcrha@redhat.com> - 2.62.2-1
changelog:
  - Update to 2.62.2
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c:get_cookies() on empty hostnames


author: Tomas Popela <tpopela@redhat.com> - 2.62.3-6
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Backport upstream patch for CVE-2024-52532 - infinite loop while reading websocket data
  - Resolves: RHEL-67076
  - Resolves: RHEL-67067


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-7
changelog:
  - Backport upstream patch for CVE-2024-52531 - buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict
    Resolves: RHEL-76376


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-8
changelog:
  - Backport patches for various CVEs, plus test improvements
    Resolves: RHEL-85887
    Resolves: RHEL-85900
    Resolves: RHEL-85901
    Resolves: RHEL-87039
    Resolves: RHEL-87094
    Resolves: RHEL-87114
    Resolves: RHEL-88348
    Resolves: RHEL-88351


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-9
changelog:
  - Add patches to improve test reliability
  - Backport patches for various CVEs
    Resolves: RHEL-85879
    Resolves: RHEL-92280
    Resolves: RHEL-93031
    Resolves: RHEL-93032


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-6
changelog:
  - Enable client and server testing build time
  - Fix failing rekey test on arch s390x
  - Resolves: rhbz#2126342


author: Liwei Ge <liwei.glw@alibaba-inc.com> - 0.9.6-7
changelog:
  - NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)
  - authorization bypass in pki_verify_data_signature (CVE-2023-2283)


author: - Andreas Schneider <asn@redhat.com> - 0.6.1-1
changelog:
  - Update to version 0.6.1.
  - resolves: #1056757 - Fix scp mode.
  - resolves: #1053305 - Fix known_hosts heuristic.


author: Andreas Schneider <asn@redhat.com> - 0.6.5-1
changelog:
  - resolves: #1213775 - Security fix for CVE-2015-3146
  - resolves: #1218076 - Security fix for CVE-2015-3146


author: Andreas Schneider <asn@redhat.com> - 0.7.0-1
changelog:
  - Update to version 0.7.0
    * Added support for ed25519 keys
    * Added SHA2 algorithms for HMAC
    * Added improved and more secure buffer handling code
    * Added callback for auth_none_function
    * Added support for ECDSA private key signing
    * Added more tests
    * Fixed a lot of bugs
    * Improved API documentation


author: Andreas Schneider <asn@redhat.com> - 0.7.1-1
changelog:
  - Update to version 0.7.1
    * Fixed SSH_AUTH_PARTIAL auth with auto public key
    * Fixed memory leak in session options
    * Fixed allocation of ed25519 public keys
    * Fixed channel exit-status and exit-signal
    * Reintroduce ssh_forward_listen()


author: Andreas Schneider <asn@redhat.com> - 0.7.2-1
changelog:
  - Update to version 0.7.2
    * Fixed OpenSSL detection on Windows
    * Fixed return status for ssh_userauth_agent()
    * Fixed KEX to prefer hmac-sha2-256
    * Fixed sftp packet handling
    * Fixed return values of ssh_key_is_(public|private)
    * Fixed bug in global success reply
  - resolves: #1267346


author: Andreas Schneider <asn@redhat.com> - 0.7.3-1
changelog:
  - resolves: #1311259 - Fix CVE-2016-0739
  - resolves: #1311332 - Update to version 0.7.3
    * Fixed CVE-2016-0739
    * Fixed ssh-agent on big endian
    * Fixed some documentation issues
  - Enabled GSSAPI support


author: Andreas Schneider <asn@redhat.com> - 0.7.4-1
changelog:
  - Update to version 0.7.4
    * Added id_ed25519 to the default identity list
    * Fixed sftp EOF packet handling
    * Fixed ssh_send_banner() to confirm with RFC 4253
    * Fixed some memory leaks
  - resolves: #1419007


author: Rex Dieter <rdieter@fedoraproject.org> - 0.7.4-2
changelog:
  - BR: compat-openssl10-devel (f26+, #1423088)
  - use %license
  - -devel: drop hardcoded pkgconfig dep (let autodeps handle it)
  - %files: track library sonames, simplify -devel
  - %install: use 'install/fast' target
  - .spec cosmetics, drop deprecated %clean section


author: Anderson Sasaki <ansasaki@redhat.com> - 0.8.1-2
changelog:
  - Add Provides for libssh_threads.so to unbreak applications
  - Fix ABIMap detection to not depend on python to build


author: Anderson Sasaki <ansasaki@redhat.com> - 0.8.3-1
changelog:
  - Update to version 0.8.3
    * Added support for rsa-sha2 (#1610882)
    * Added support to parse private keys in openssh container format (other than
      ed25519) (#1622983)
    * Added support for diffie-hellman-group18-sha512 and
      diffie-hellman-group16-sha512 (#1610885)
    * Added ssh_get_fingerprint_hash()
    * Added ssh_pki_export_privkey_base64()
    * Added support for Match keyword in config file
    * Improved performance and reduced memory footprint for sftp
    * Fixed ecdsa publickey auth
    * Fixed reading a closed channel
    * Added support to announce posix-rename@openssh.com and hardlink@openssh.com
      in the sftp server
    * Use -fstack-protector-strong if possible (#1624135)


author: Anderson Sasaki <ansasaki@redhat.com> - 0.8.5-1
changelog:
  - Update to version 0.8.5
    * Fixed an issue where global known_hosts file was ignored (#1649321)
    * Fixed ssh_get_fd() to return writable file descriptor (#1649319)
    * Fixed regression introduced in known_hosts parsing (#1649315)
    * Fixed a regression which caused only the first algorithm in known_hosts to
      be considered (#1638790)


author: Anderson Sasaki <ansasaki@redhat.com> - 0.8.91-0.1
changelog:
  - Update to 0.9.0 pre release version (0.8.91)
  - Added default configuration files for client and server
  - Removed unused patch files left behind
  - Fixed issues found to run upstream test suite with SELinux


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.0-1
changelog:
  - Update to version 0.9.0
    https://www.libssh.org/2019/06/28/libssh-0-9-0/
  - Added explicit Requires for crypto-policies
  - Do not ignore known_hosts keys when SSH_OPTIONS_HOSTKEYS is set
  - Provide the configuration files in a separate libssh-config subpackage


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.0-3
changelog:
  - Add Obsoletes in libssh-config to avoid conflict with old libssh which
    installed the configuration files.


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.4-1
changelog:
  - Update to version 0.9.4
    https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
  - Fixed CVE-2019-14889 (#1781782)
  - Fixed CVE-2020-1730 (#1802422)
  - Create missing directories in the path provided for known_hosts files (#1733914)
  - Removed inclusion of OpenSSH server configuration file from
    libssh_server.config (#1821339)


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.4-2
changelog:
  - Do not return error when server properly closed the channel (#1849071)
  - Add a test for CVE-2019-14889
  - Do not parse configuration file in torture_knownhosts test


author: Sahana Prasad <sahana@redhat.com> - 0.9.4-3
changelog:
  - Fix CVE-2020-16135 NULL pointer dereference in sftpserver.c if
    ssh_buffer_new returns NULL (#1862646)


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-2021-3634: Fix possible heap-buffer overflow when
    rekeying with different key exchange mechanism (#1978810)


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-2021-3634: Fix possible heap-buffer overflow when
    rekeying with different key exchange mechanism
  - Rebase to version 0.9.6
  - Rename SSHD_EXECUTABLE to SSH_EXECUTABLE in tests/torture.c
  - Resolves: rhbz#1896651, rhbz#1994600


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-7
changelog:
  - Fix NULL dereference during rekeying with algorithm guessing
    GHSL-2023-032 / CVE-2023-1667
  - Fix possible authentication bypass
    GHSL 2023-085 / CVE-2023-2283
  - Resolves: rhbz#2182251, rhbz#2189742


author: Sahana Prasad <sahana@redhat.com> - 0.9.6-14
changelog:
  - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol (BPP)
  - Fix CVE-2023-6918 Missing checks for return values for digests
  - Fix CVE-2023-6004 ProxyCommand/ProxyJump features allow injection
    of malicious code through hostname
  - Note: version is bumped from 12 to 14 directly, as the z-stream
    version in 8.9 also has 13. So bumping it to 14, will prevent
    upgrade conflicts.
  - Resolves:RHEL-19690, RHEL-17244, RHEL-19312


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
  - Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
  - Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
  - Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
  - Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
  - Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
  - Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
  - Resolves: RHEL-10721 - very bad performance when requesting service tickets
  - Resolves: RHEL-19011 - Invalid handling groups from child domain
  - Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
  - Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
  - Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.1
changelog:
  - Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
  - Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
  - Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
  - Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
  - Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
  - Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New stable upstream version 1.2.1
  - Resolves: rhbz#595529 - spec file should eschew %define in favor of
  -                         %global
  - Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart.
  - Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
  -                         keyring
  - Resolves: rhbz#599724 - sssd is broken on Rawhide


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.91-20
changelog:
  - New upstream version 1.2.91 (1.3.0rc1)
  - Improved LDAP failover
  - Synchronous sysdb API (provides performance enhancements)
  - Better online reconnection detection


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-30
changelog:
  - Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
  -                           against LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-32
changelog:
  - Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
  -                         doesn't require it


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-1
changelog:
  - New upstream release 1.4.0
  - Added support for netgroups to the LDAP provider
  - Performance improvements made to group processing of RFC2307 LDAP servers
  - Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
  - Build-system improvements to support Gentoo
  - Split out several libraries into the ding-libs tarball
  - Manpage reviewed and updated


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-1
changelog:
  - New upstream release 1.4.1
  - Add support for netgroups to the proxy provider
  - Fixes a minor bug with UIDs/GIDs >= 2^31
  - Fixes a segfault in the kerberos provider
  - Fixes a segfault in the NSS responder if a data provider crashes
  - Correctly use sdap_netgroup_search_base


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-3
changelog:
  - Solve a shutdown race-condition that sometimes left processes running
  - Resolves: rhbz#606887 - SSSD stops on upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  -Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Fix nested group member filter sanitization for RFC2307bis
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#677768 - name service caches names, so id command shows
  -                         recently deleted users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.2-1
changelog:
  - New upstream release 1.5.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
  - Fixes for support of FreeIPA v2
  - Fixes for failover if DNS entries change
  - Improved sss_obfuscate tool with better interactive mode
  - Fix several crash bugs
  - Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
  - Delete users from the local cache if initgroups calls return 'no such user'
  - (previously only worked for getpwnam/getpwuid)
  - Use new Transifex.net translations
  - Better support for automatic TGT renewal (now survives restart)
  - Netgroup fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.4-1
changelog:
  - New upstream release 1.5.4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
  - Fixes for Active Directory when not all users and groups have POSIX attributes
  - Fixes for handling users and groups that have name aliases (aliases are ignored)
  - Fix group memberships after initgroups in the IPA provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-1
changelog:
  - New upstream release 1.5.5
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
  - Fixes for several crash bugs
  - LDAP group lookups will no longer abort if there is a zero-length member
  - attribute
  - Add automatic fallback to 'cn' if the 'gecos' attribute does not exist


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-3
changelog:
  - Fix systemd conversion. Upgrades from SysV to systemd weren't properly
  - enabling the systemd service.
  - Fix a serious memory leak in the memberOf plugin
  - Fix an issue where the user's full name would sometimes be removed
  - from the cache


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
changelog:
  - Resolves: rhbz#697057 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server
  - Upgrades from SysV should now maintain enabled/disabled status


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.6-1
changelog:
  - New upstream release 1.5.6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
  - Fixed a serious memory leak in the memberOf plugin
  - Fixed a regression with the negative cache that caused it to be essentially
  - nonfunctional
  - Fixed an issue where the user's full name would sometimes be removed from
  - the cache
  - Fixed an issue with password changes in the kerberos provider not working
  - with kpasswd


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-1
changelog:
  - Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
  -                         cached password with predicatable filename


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-3
changelog:
  - Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
  - Make sure to properly convert to systemd if upgrading from newer
  - updates for Fedora 14


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.8-1
changelog:
  - New upstream release 1.5.8
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
  - Support for the LDAP paging control
  - Support for multiple DNS servers for name resolution
  - Fixes for several group membership bugs
  - Fixes for rare crash bugs


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.9-1
changelog:
  - New upstream release 1.5.9
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
  - Support for overriding home directory, shell and primary GID locally
  - Properly honor TTL values from SRV record lookups
  - Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
  - servers)
  - Properly escape IPv6 addresses in the failover code
  - Do not crash if inotify fails (e.g. resource exhaustion)
  - Don't add multiple TGT renewal callbacks (too many log messages)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.10-1
changelog:
  - New upstream release 1.5.10
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
  - Fixed a regression introduced in 1.5.9 that could result in blocking calls
  - to LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.11-2
changelog:
  - New upstream release 1.5.11
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
  - Fix a serious regression that prevented SSSD from working with ldaps:// URIs
  - IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
  - address being saved to the AAAA record


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
changelog:
  - New upstream release 1.6.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
  - Add host access control support for LDAP (similar to pam_host_attr)
  - Finer-grained control on principals used with Kerberos (such as for FAST or
  - validation)
  - Added a new tool sss_cache to allow selective expiring of cached entries
  - Added support for LDAP DEREF and ASQ controls
  - Added access control features for Novell Directory Server
  - FreeIPA dynamic DNS update now checks first to see if an update is needed
  - Complete rewrite of the HBAC library
  - New libraries: libipa_hbac and libipa_hbac-python


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.1-1
changelog:
  - New upstream release 1.6.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
  - Fixes a serious issue with LDAP connections when the communication is
    dropped (e.g. VPN disconnection, waking from sleep)
  - SSSD is now less strict when dealing with users/groups with multiple names
    when a definitive primary name cannot be determined
  - The LDAP provider will no longer attempt to canonicalize by default when
    using SASL. An option to re-enable this has been provided.
  - Fixes for non-standard LDAP attribute names (e.g. those used by Active
    Directory)
  - Three HBAC regressions have been fixed.
  - Fix for an infinite loop in the deref code


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-1
changelog:
  - Improved handling of users and groups with multi-valued name attributes
    (aliases)
  - Performance enhancements
      Initgroups on RFC2307bis/FreeIPA
      HBAC rule processing
  - Improved process-hang detection and restarting
  - Enabled the midpoint cache refresh by default (fewer cache misses on
    commonly-used entries)
  - Cleaned up the example configuration
  - New tool to change debug level on the fly


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-4
changelog:
  - Change selinux policy requirement to Conflicts: with the old version,
    rather than Requires: the supported version.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release 1.6.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
  - Fixes a major cache performance issue introduced in 1.6.2
  - Fixes a potential infinite-loop with certain LDAP layouts


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-4
changelog:
  - Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758425 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.4-1
changelog:
  - New upstream release 1.6.4
  - Rolls up previous patches applied to the 1.6.3 tarball
  - Fixes a rare issue causing crashes in the failover logic
  - Fixes an issue where SSSD would return the wrong PAM error code for users
    that it does not recognize.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-1
changelog:
  - New upstream release 1.7.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
  - Support for case-insensitive domains
  - Support for multiple search bases in the LDAP provider
  - Support for the native FreeIPA netgroup implementation
  - Reliability improvements to the process monitor
  - New DEBUG facility with more consistent log levels
  - New tool to change debug log levels without restarting SSSD
  - SSSD will now disconnect from LDAP server when idle
  - FreeIPA HBAC rules can choose to ignore srchost options for significant
    performance gains
  - Assorted performance improvements in the LDAP provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-3
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-5
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features - fix netgroups and sudo as well


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta1
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta2
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
  - Fix two minor manpage bugs
  - Include the IPA AutoFS provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - New upstream release 1.8.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed several memory-corruption bugs
  - Finalized the ABI for the autofs support
  - Fixed a regression in the proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - New upstream release 1.8.0
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)
  - Include the IPA AutoFS provider
  - Fixed several memory-corruption bugs
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed a regression in the proxy provider
  - Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
  - Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
                            logged at each login
  - Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-7
changelog:
  - New upstream release 1.8.1
  - Resolve issue where we could enter an infinite loop trying to connect to an
    auth server
  - Fix serious issue with complex (3+ levels) nested groups
  - Fix netgroup support for case-insensitivity and aliases
  - Fix serious issue with lookup bundling resulting in requests never
    completing
  - IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
    in addition to pam_authenticate
  - Fix several regressions in the proxy provider
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-8
changelog:
  - Fix uninitialized value bug causing crashes throughout the code
  - Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-9
changelog:
  - Don't duplicate libsss_autofs.so in two packages
  - Set explicit package contents instead of globbing


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.2-10
changelog:
  - New upstream release 1.8.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
  - Several fixes to case-insensitive domain functions
  - Fix for GSSAPI binds when the keytab contains unrelated principals
  - Fixed several segfaults
  - Workarounds added for LDAP servers with unreadable RootDSE
  - SSH knownhostproxy will no longer enter an infinite loop preventing login
  - The provided SYSV init script now starts SSSD earlier at startup and stops
    it later during shutdown
  - Assorted minor fixes for issues discovered by static analysis tools


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.3-11
changelog:
  - New upstream release 1.8.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
  - Numerous manpage and translation updates
  - LDAP: Handle situations where the RootDSE isn't available anonymously
  - LDAP: Fix regression for users using non-standard LDAP attributes for user
    information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-1.beta1
changelog:
  - New upstream release 1.9.0 beta 1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
  - Add native support for autofs to the IPA provider
  - Support for ID-mapping when connecting to Active Directory
  - Support for handling very large (> 1500 users) groups in Active Directory
  - Support for sub-domains (will be used for dealing with trust relationships)
  - Add a new fast in-memory cache to speed up lookups of cached data on
    repeated requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-2.beta1
changelog:
  - Fix several regressions since 1.5.x
  - Ensure that the RPM creates the /var/lib/sss/mc directory
  - Add support for Netscape password warning expiration control
  - Rebuild against libldb 1.1.6


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-5.beta2
changelog:
  - New upstream release 1.9.0 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
  - Add support for the Kerberos DIR cache for storing multiple TGTs
    automatically
  - Major performance enhancement when storing large groups in the cache
  - Major performance enhancement when performing initgroups() against Active
    Directory
  - SSSDConfig data file default locations can now be set during configure for
    easier packaging


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-7.beta2
changelog:
  - Switch unicode library from libunistring to Glib
  - Drop unnecessary explicit Requires on keyutils
  - Guarantee that versioned Requires include the correct architecture


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-8.beta3
changelog:
  - New upstream release 1.9.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
  - Add a new PAC responder for dealing with cross-realm Kerberos trusts
  - Terminate idle connections to the NSS and PAM responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-9.beta4
changelog:
  - New upstream release 1.9.0 beta 4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
  - Add a new AD provider to improve integration with Active Directory 2008 R2
    or later servers
  - SUDO integration was completely rewritten. The new implementation works
    with multiple domains and uses an improved refresh mechanism to download
    only the necessary rules
  - The IPA authentication provider now supports subdomains
  - Fixed regression for setups that were setting default_tkt_enctypes
    manually by reverting a previous workaround.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-12.beta5
changelog:
  - New upstream release 1.9.0 beta 5
  - Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
  - Many fixes for the support for setting default SELinux user context from
    FreeIPA, most notably fixed the specificity evaluation
  - Fixed an incorrect default in the krb5_canonicalize option of the AD
    provider which was preventing password change operation
  - The shadowLastChange attribute value is now correctly updated with the
    number of days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-13.beta6
changelog:
  - New upstream release 1.9.0 beta 6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
  - A new option, override_shell was added. If this option is set, all users
    managed by SSSD will have their shell set to its value.
  - Fixes for the support for setting default SELinux user context from FreeIPA.
  - Fixed a regression introduced in beta 5 that broke LDAP SASL binds
  - The SSSD supports the concept of a Primary Server and a Back Up Server in
    failover
  - A new command-line tool sss_seed is available to help prime the cache with
    a user record when deploying a new machine
  - SSSD is now able to discover and save the domain-realm mappings
    between an IPA server and a trusted Active Directory server.
  - Packaging changes to fix ldconfig usage in subpackages (#843995)
  - Rebuild against libldb 1.1.9


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-14.beta6
changelog:
  - Don't discard HBAC rule processing result if SELinux is on
    Resolves: rhbz#846792 (CVE-2012-3462)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-18.beta6
changelog:
  - Change the default ccache location to DIR:/run/user/${UID}/krb5cc
    and patch man page accordingly
  - Resolves: rhbz#851304


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.4-3
changelog:
  - Recreate Kerberos ccache directory if it's missing
  - Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
                            directory /run/user/UID/ccdir does not exist


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-4.beta1
changelog:
  - Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
    in ding-libs
  - Fix SSH integration with fully-qualified domains
  - Add the ability to dynamically discover the NetBIOS name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-6.beta1
changelog:
  - Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
                            realm join
  - Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
                            default for AD Provider
  - Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
                            parent directory when logging in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-7.beta1
changelog:
  - Apply a couple of patches from upstream git that resolve crashes when
    ID mapping object was not initialized properly but needed later


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-8.beta2
changelog:
  - New upstream release 1.10 beta2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
  - BuildRequire libcmocka-devel in order to run all upstream tests during build
  - BuildRequire libnl3 instead of libnl1
  - No longer BuildRequire initscripts, we no longer use /sbin/service
  - Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
    older krb5-libs version


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-9.beta2
changelog:
  - Fix typo in Requires that prevented an upgrade (#973916)
  - Use a hardcoded version in Conflicts, not less-than-current


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-11.beta2
changelog:
  - Apply a number of patches from upstream to fix issues found post-beta,
    in particular:
    -- segfault with a high DEBUG level
    -- Fix IPA password migration (upstream #1873)
    -- Fix fail over when retrying SRV resolution (upstream #1886)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-14
changelog:
  - Fix Obsoletes: to account for dist tag
  - Convert post and pre scripts to run on the sssd-common subpackage
  - Remove old conversion from SYSV


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-16
changelog:
  - Move sssd_pac to the sssd-ipa and sssd-ad subpackages
  - Trim out RHEL5-specific macros since we don't build on RHEL 5
  - Trim out macros for Fedora older than F18
  - Update libldb requirement to 1.1.16
  - Trim RPM changelog down to the last year


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0.2beta2
changelog:
  - Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
                        pam libraries


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-0.4.beta2
changelog:
  - Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
                        Process /usr/libexec/sssd/sssd_nss was killed by
                        signal 11 (SIGSEGV)
  - Resolves: #996214 - sssd proxy_child segfault


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-2
changelog:
  - Backport simplification of ccache management from 1.11.1
  - Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-3
changelog:
  - Fix multicast checks in the SSSD
  - Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
                             code getting the host info


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-1
changelog:
  - New upstream release 1.11.2
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.3-1
changelog:
  - New upstream release 1.11.3
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.4-1
changelog:
  - New upstream release 1.11.4
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.5-1
changelog:
  - New upstream release 1.11.5
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.1-2
changelog:
  - Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
                             private group from server


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.2-6
changelog:
  - Fix regressions and bugs in sssd upstream 1.12.2
  - https://fedorahosted.org/sssd/ticket/{id}
  - Regressions: #2471, #2475, #2483, #2487, #2529, #2535
  - Bugs: #2287, #2445


author: Sumit Bose <sbose@redhat.com> - 1.12.2-7
changelog:
  - Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
                             crash in wbinfo
                             - in addition to the patch libwbclient.so is
                               filtered out of the Provides list of the package


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-1
changelog:
  - New upstream release 1.12.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
  - Fix spelling errors in description (fedpkg lint)


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-2
changelog:
  - Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
  - Resolves: rhbz#1179379 - gzip: stdin: file size changed while
                             zipping when rotating logfile


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-3
changelog:
  - Apply a number of patches from upstream to fix issues found 1.12.3
  - Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
                             interfaces, or isn't documented to be able to
  - Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
                            not running
  - Resolves: upstream #2557  authentication failure with user from AD


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-4
changelog:
  - Decrease priority of sssd-libwbclient 20 -> 5
  - It should be lower than priority of samba veriosn of libwbclient.
  - https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-6
changelog:
  - Fix double free in monitor
  - Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
                          sssd killed by SIGABRT


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-2
changelog:
  - Add support for python3 bindings
  - Add requirement to python3 or python3 bindings
  - Resolves: rhbz#1014594 - sssd: Support Python 3


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-5
changelog:
  - Fix regressions with ipa and SELinux
  - Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
                               context on client is staff_u


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-6
changelog:
  - Fix slow login with ipa and SELinux
  - Resolves: upstream #2624 - Only set the selinux context if the context
                               differs from the local one


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-8
changelog:
  - Backport important patches from upstream 1.13 prerelease
  - Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
                             attribute for group name
  - Resolves: upstream #2335 - Investigate using the krb5 responder
                               for driving the PAM conversation with OTPs
  - Enable cmocka tests for secondary architectures


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-4
changelog:
  - Fix ipa-migration bug
  - Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
                               migration mode


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-6
changelog:
  - Fix OTP bug
  - Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
                               entered separately


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-2
changelog:
  - Fix few segfaults
  - Resolves: upstream #2811 - PAM responder crashed if user was not set
  - Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-3
changelog:
  - python-sssdconfig: Fix parssing sssd.conf without config_file_version
  - Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-5
changelog:
  - Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
                             groups during getgrnam and getgrgid
  - Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
                             in call to 'print'


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-6
changelog:
  - Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
                             prompts (e.g. Password + Token)
  - Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
                             by remote host" if locale not available


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.4-3
changelog:
  - Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
                             sssd_ifp killed by SIGSEGV


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-2
changelog:
  - Backport important patches from upstream 1.14.2 prerelease
  - Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
                               boot
  - Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-3
changelog:
  - Fix regression with krb5_map_user
  - Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
  - Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
                             default if nonexistent domain is mentioned


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.2-2
changelog:
  - Resolves: rhbz#1369130 - nss_sss should not link against libpthread
  - Resolves: rhbz#1392916 - sssd failes to start after update
  - Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
                             on the directory /etc/sssd


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.0-4
changelog:
  - Cherry-pick patches from upstream that enable the files provider
  - Enable the files domain
  - Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
    which is superseded by the files domain autoconfiguration
  - Related: rhbz#1357418 - SSSD fast cache for local users


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.2
changelog:
  - Fix issue with IPA + SELinux in containers
  - Resolves: upstream https://fedorahosted.org/sssd/ticket/3297


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.3
changelog:
  - Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
  - Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
                             file from package sssd-common-1.15.1-1.fc25.x86_64
  - Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-4
changelog:
  - Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
                             access on the sock_file system_bus_socket
  - Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
                             fails to download desktop profile data
  - Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
  - Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
                              after applying ID Views for them in IPA server
  - Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
                              mapping is applied


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-5
changelog:
  - Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database access on
                             the sock_file system_bus_socket


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.16.0-5
changelog:
  - Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
                              setnetgrent_result_timeout
  - Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
                              or machine swaps
  - Resolves: failure in glibc tests
              https://sourceware.org/bugzilla/show_bug.cgi?id=22530
  - Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
                              auth_provider ldap, login fails if the LDAP server
                              is not allowing anonymous binds
  - Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
                              corrected with AD
  - Resolves: upstream#3586 - Give a more detailed debug and system-log message
                              if krb5_init_context() failed
  - Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
                             in /etc/systemd/system
  - Backport few upstream features from 1.16.1


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.0-12
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Resolves: upstream#3621 - FleetCommander integration must not require
                              capability DAC_OVERRIDE


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-2
changelog:
  - Resolves: upstream#3573 - sssd won't show netgroups with blank domain
  - Resolves: upstream#3660 - confdb_expand_app_domains() always fails
  - Resolves: upstream#3658 - Application domain is not interpreted correctly
  - Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
                              json_loads()
  - Resolves: upstream#3386 - KCM: Payload buffer is too small
  - Resolves: upstream#3666 - Fix usage of str.decode() in our tests
  - A few KCM misc fixes


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-3
changelog:
  - Resolves: upstream#3684 - A group is not updated if its member is removed
                              with the cleanup task, but the group does not
                              change
  - Resolves: upstream#3558 - sudo: report error when two rules share cn
  - Tone down shutdown messages for socket activated responders
  - IPA: Qualify the externalUser sudo attribute
  - Resolves: upstream#3550 - refresh_expired_interval does not work with
                              netgrous in 1.15
  - Resolves: upstream#3402 - Support alternative sources for the files provider
  - Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
  - Resolves: upstream#3679 - Make nss netgroup requests more robust
  - Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
                              configured
  - Resolves: upstream#3469 - extend sss-certmap man page regarding priority
                              processing
  - Improve docs/debug message about GC detection
  - Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
                              list out of bound?
  - Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
                              set.
  - Document which principal does the AD provider use
  - Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
                              defined, but contains no SIDs
  - Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
  - Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
                             Provider returned an error
                             [org.freedesktop.sssd.Error.DataProvider.Fatal]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-1
changelog:
  - Update to 1.16.2 release
  - Cleanup unused global definitions
  - Remove python2 references from the spec file
  - Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-2
changelog:
  - Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
                             fails with the KCM ccache


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-4
changelog:
  - Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                             users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-7
changelog:
  - Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
                             differs from the default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-8
changelog:
  - Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
                              /usr/libexec/sssd/sssd_be killed by 11 crash
                              func _dbus_list_unlink


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-9
changelog:
  - Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
                             commands in man pages since local provider
                             is deprecated


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-10
changelog:
  - Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
                             started due to a misconfiguration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-11
changelog:
  - Resolves: rhbz#1628122 - Printing incorrect information about domain
                             with sssctl utility


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-16
changelog:
  - Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
                            PKCS#11 URI


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-17
changelog:
  - Related: rhbz#1637131 - pam_unix unable to match fully qualified username
                            provided by sssd during smartcard auth using gdm


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-18
changelog:
  - Related: rhbz#1638006 - Files: The files provider always enumerates
                            which causes duplicate when running getent passwd


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-19
changelog:
  - Add OSCP checks for p11_child
  - Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                            users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-21
changelog:
  - Related: rhbz#1638150 - session not recording for local user when groups defined
  - Also add silence a Coverity warning, which is related to rhbz#1637131


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-23
changelog:
  - Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
                             with smart card


author: Michal Židek <mzidek@redhat.com> - 2.0.0-24
changelog:
  - Resolves: rhbz#1646168 - sssctl access-report always prints an error message
  - Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
                             configuration without having to restart the whole
                             sssd
  - Resolves: rhbz#1640576 - sssctl reports incorrect information about local
                             user's cache entry expiration time
  - Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
  - Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys


author: Michal Židek <mzidek@redhat.com> - 2.0.0-25
changelog:
  - Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
                             for D-bus, resulting in a crash


author: Michal Židek <mzidek@redhat.com> - 2.0.0-27
changelog:
  - Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
                             if ID provider is authenticated with GSSAPI


author: Michal Židek <mzidek@redhat.com> - 2.0.0-29
changelog:
  - Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
                             /usr/libexec/sssd/proxy_child killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.0.0-30
changelog:
  - Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
                        retrieve AD users through IPA Trust


author: Michal Židek <mzidek@redhat.com> - 2.0.0-32
changelog:
  - Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
              and libtevent to avoid an issue in GPO processing


author: Michal Židek <mzidek@redhat.com> - 2.0.0-33
changelog:
  - Resolves: rhbz#1646113 - Missing concise documentation about valid options
                             for sssd-files-provider


author: Michal Židek <mzidek@redhat.com> - 2.0.0-34
changelog:
  - Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
                             kdestroy caused by KCM returning a wrong error
                             code during the delete operation


author: Michal Židek <mzidek@redhat.com> - 2.0.0-36
changelog:
  - Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
                             suggests using * for backend sss


author: Michal Židek <mzidek@redhat.com> - 2.0.0-38
changelog:
  - Resolves: rhbz#1578014 - sssd does not work under non-root user
  - Note: Actually the patches were in the 2.0.0-37, this one just adds this
          changelog because it was missing.


author: Michal Židek <mzidek@redhat.com> - 2.0.0-39
changelog:
  - Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
                             1.x, this can result in time outs


author: Michal Židek <mzidek@redhat.com> - 2.0.0-40
changelog:
  -Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
                            UnknownProperty: Unknown property


author: Michal Židek <mzidek@redhat.com> - 2.0.0-41
changelog:
  -Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
                            subdomain service name being used


author: Michal Židek <mzidek@redhat.com> - 2.0.0-42
changelog:
  - Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
                             of gen_new to avoid a subsequent switch call
                             failure


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-43
changelog:
  - Resolves: rhbz#1672780 - gdm login not prompting for username when smart
                             card maps to multiple users


author: Michal Židek <mzidek@redhat.com> - 2.0.0-45
changelog:
  - Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
    done here in order to unblock gating changes before rebase.
  - Related: rhbz#1682305


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-2
changelog:
  - Resolves: rhbz#1673443 - sssd man pages: The default value of
                             "ldap_user_home_directory" is not mentioned
                             with AD server configuration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-3
changelog:
  - Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
                             no members


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-4
changelog:
  - Resolves: rhbz#1283798 - sssd failover does not work on connecting to
                             non-responsive ldaps:// server


author: Michal Židek <mzidek@redhat.com> - 2.2.0-6
changelog:
  - Resolves: rhbz#1726945 - negative cache does not use values from
                             'filter_users' config option for known domains


author: Michal Židek <mzidek@redhat.com> - 2.2.0-7
changelog:
  - Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
                             not FIPS140 compliant


author: Michal Židek <mzidek@redhat.com> - 2.2.0-8
changelog:
  - Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
                             repository
                           - This just required a raise in release number
                             and changelog for the record.


author: Michal Židek <mzidek@redhat.com> - 2.2.0-10
changelog:
  - Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
                             the trailing colon


author: Michal Židek <mzidek@redhat.com> - 2.2.0-11
changelog:
  - Resolves: rhbz#1733372 - permission denied on logs when running sssd as
                             non-root user


author: Michal Židek <mzidek@redhat.com> - 2.2.0-13
changelog:
  - Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
              systemd-user service in the account phase in RHEL-8


author: Michal Židek <mzidek@redhat.com> - 2.2.0-14
changelog:
  - Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
                             should not cause files domain entries to be
                             qualified, this can break sudo access


author: Michal Židek <mzidek@redhat.com> - 2.2.0-15
changelog:
  - Resolves: rhbz#1736265 - Smart Card auth of local user: endless
                             loop if wrong PIN was provided


author: Michal Židek <mzidek@redhat.com> - 2.2.0-16
changelog:
  - Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
                             the IP address of the machine updated in IPA upon
                             sssd.service startup


author: Michal Židek <mzidek@redhat.com> - 2.2.0-17
changelog:
  - Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
                             keyring
  - Also apply a patch to fix gating tests issue


author: Michal Židek <mzidek@redhat.com> - 2.2.0-18
changelog:
  - Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
  - Also sync. kcm multihost tests with master


author: Michal Židek <mzidek@redhat.com> - 2.2.0-19
changelog:
  - Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
                             new ones (kcm)


author: Michal Židek <mzidek@redhat.com> - 2.2.3-2
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              PART2: Fix gating issue.


author: Michal Židek <mzidek@redhat.com> - 2.2.3-3
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              Increasing version number to pick latest libldb


author: Michal Židek <mzidek@redhat.com> - 2.2.3-4
changelog:
  * Resolves: rhbz#1781728 - sssctl config-check command does not give proper
                             error messages with line numbers


author: Michal Židek <mzidek@redhat.com> - 2.2.3-5
changelog:
  * Resolves: rhbz#1744500 - [Doc]Provide explanation on escape character
                             for match rules sss-certmap


author: Michal Židek <mzidek@redhat.com> - 2.2.3-9
changelog:
  * Resolves: rhbz#1783190 - [abrt] [faf] sssd:
                             raise(): /usr/libexec/sssd/sssd_autofs killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.2.3-10
changelog:
  * Resolves: rhbz#1583592 - [RFE] Add configurable randomness to SSSD ldap
                             connection timeout


author: Michal Židek <mzidek@redhat.com> - 2.2.3-14
changelog:
  - Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
                             specified up to the seconds


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-16
changelog:
  - Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
                             omitted and auth_provider is krb5


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-17
changelog:
  - Resolves: rhbz#1718193 - p11_child should have an option to skip
                             C_WaitForSlotEvent if the PKCS#11 module
                             does not implement it properly


author: Michal Židek <mzidek@redhat.com> - 2.2.3-18
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
                             information


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate
                             (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
  - Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
  - Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
  - Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
  - Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
  - Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
  - Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
  - Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
  - Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
  - Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
  - Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.2
changelog:
  - Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
  - Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
  - Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]


author: Alejandro López <allopez@redhat.com> - 2.9.4-5.3
changelog:
  - Resolves: RHEL-112455 - p11_child currently has an infinite timeout [rhel-8.10.z]
  - Resolves: RHEL-120292 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-8.10.z]


author: Tony Asleson <tasleson@redhat.com> - 1.9.1-7
changelog:
  - Remove valgrind dependency as not being used and causing
    build to fail as it pulls in python3.11


author: Kamil Dudka <kdudka@redhat.com> - 1.2.20-16
changelog:
  - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646)
  - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> 0:0.2.5-0.fdr.1
changelog:
  - updated to 0.2.5
  - changed license to LGPL
  - rearranged %check to reflect execution order
  - minor cosmetical changes


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.3-1
changelog:
  - updated to 1.3 (#426488, #431334)
  - use wrapper around libtasn1-config which should make it multilib
    safe (#342411); this implies an untagged 'Requires: pkgconfig' for
    -devel now
  - conditionalized BR of valgrind (#401041)


author: Tomas Mraz <tmraz@redhat.com> - 2.2-1
changelog:
  - updated to new upstream version
  - SMP build should work now
  - drop fix for spurious rpath - no longer necessary


author: Peter Robinson <pbrobinson@fedoraproject.org> 4.9-2
changelog:
  - Move development related docs to devel sub package
  - Cleanup spec and macros
  - Update valgrind ExclusiveArch


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-6
changelog:
  - Fix CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570 CVE-2022-3598
    CVE-2022-3627
  - Resolves: CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570
    CVE-2022-3598 CVE-2022-3627


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-8
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
    CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799
    CVE-2022-48281
  - Resolves: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803
    CVE-2023-0804 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798
    CVE-2023-0799 CVE-2022-48281


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-10
changelog:
  - Fix CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576
  - Resolves: CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-11
changelog:
  - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175
  - Resolves: RHEL-5458 RHEL-5455 RHEL-5405 RHEL-5450


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - enable zip and jpeg codecs
  - change defattr in normal package to 0755
  - add defattr to -devel package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move man pages from devel package to the regular one
  - integrate Frank Warmerdam's fixed .fax handling code (keep until next release
    of libtiff)
  - fix fax2ps breakage (bug #8345)


author: Phil Knirsch <phil@redhat.de>
changelog:
  - Fixed ia64 problem with tiffinfo. Was general 64 bit arch problem where s390x
    and ia64 were missing (#52129).


author: Matthias Clasen <mclasen@redhat.com> - 3.7.1-3
changelog:
  - Drop the largefile patch again
  - Fix a problem with the handling of alpha channels
  - Fix an integer overflow in tiffdump (#143576)


author: Matthias Saou <http://freshrpms.net/> 3.7.4-2
changelog:
  - Remove useless explicit dependencies.
  - Minor spec file cleanups.
  - Move make check to %check.
  - Add _smp_mflags.


author: Matthias Clasen <mclasen@redhat.com>
changelog:
  - Fix several vulnerabilities (CVE-2006-3460 CVE-2006-3461
    CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465)


author: Jindrich Novy <jnovy@redhat.com> - 3.8.2-6
changelog:
  - fix CVE-2006-2193, tiff2pdf buffer overflow (#194362)
  - fix typo in man page for tiffset (#186297)
  - use %{?dist}


author: Tom Lane <tgl@redhat.com> 3.8.2-8
changelog:
  - Restore static library to distribution, in a separate -static subpackage
  Resolves: #219905
  - Don't apply multilib header hack to unrecognized architectures
  Resolves: #233091
  - Remove documentation for programs we don't ship
  Resolves: #205079
  Related: #185145


author: Tom Lane <tgl@redhat.com> 3.8.2-11
changelog:
  - Fix LZW decoding vulnerabilities (CVE-2008-2327)
  Related: #458674
  - Use -fno-strict-aliasing per rpmdiff recommendation


author: Tom Lane <tgl@redhat.com> 3.9.2-1
changelog:
  - Update to libtiff 3.9.2; stop carrying a lot of old patches
  Resolves: #520734
  - Split command-line tools into libtiff-tools subpackage
  Resolves: #515170
  - Use build system's libtool instead of what package contains;
    among other cleanup this gets rid of unwanted rpath specs in executables
  Related: #226049


author: Tom Lane <tgl@redhat.com> 3.9.2-3
changelog:
  - Apply Adam Goode's fix for Warmerdam's fix
  Resolves: #552360
  Resolves: #533353
  - Add some defenses to prevent tiffcmp from crashing on downsampled JPEG
    images; this isn't enough to make it really work correctly though
  Related: #460322


author: Tom Lane <tgl@redhat.com> 3.9.4-1
changelog:
  - Update to libtiff 3.9.4, for numerous bug fixes including fixes for
    CVE-2010-1411, CVE-2010-2065, CVE-2010-2067
  Resolves: #554371
  Related: #460653, #588784, #601274, #599576, #592361, #603024
  - Add fixes for multiple SIGSEGV problems
  Resolves: #583081
  Related: #603081, #603699, #603703


author: Tom Lane <tgl@redhat.com> 3.9.4-3
changelog:
  - Add patch for CVE-2011-0192
  Resolves: #681672
  - Fix non-security-critical potential SIGSEGV in gif2tiff
  Related: #648820


author: Tom Lane <tgl@redhat.com> 3.9.4-4
changelog:
  - Fix incorrect fix for CVE-2011-0192
  Resolves: #684007
  Related: #688825
  - Add fix for CVE-2011-1167
  Resolves: #689574


author: Tom Lane <tgl@redhat.com> 3.9.5-1
changelog:
  - Update to libtiff 3.9.5, incorporating all our previous patches plus other
    fixes, notably the fix for CVE-2009-5022
  Related: #695885


author: Tom Lane <tgl@redhat.com> 4.0.1-1
changelog:
  - Update to libtiff 4.0.1, adds BigTIFF support and other features;
    library soname is bumped from libtiff.so.3 to libtiff.so.5
  Resolves: #782383
  - Temporarily package 3.9.5 shared library (only) in libtiff-compat subpackage
    so that dependent packages won't be broken while rebuilding proceeds


author: Tom Lane <tgl@redhat.com> 4.0.2-1
changelog:
  - Update to libtiff 4.0.2, includes fix for CVE-2012-2113
    (note that CVE-2012-2088 does not apply to 4.0.x)
  - Update libtiff-compat to 3.9.6 and add patches to it for
    CVE-2012-2088, CVE-2012-2113
  Resolves: #832866


author: Tom Lane <tgl@redhat.com> 4.0.2-5
changelog:
  - Add accessor functions for opaque type TIFFField (backport of not-yet-released
    upstream feature addition; needed to fix freeimage)


author: Tom Lane <tgl@redhat.com> 4.0.2-6
changelog:
  - Remove compat subpackage; no longer needed
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: Tom Lane <tgl@redhat.com> 4.0.3-2
changelog:
  - Add upstream patches for CVE-2012-4447, CVE-2012-4564
    (note: CVE-2012-5581 is already fixed in 4.0.3)
  Resolves: #880907


author: Nikola Forró <nforro@redhat.com> - 4.0.9-9
changelog:
  - Fix CVE-2017-9935, CVE-2017-18013 (#1530441),
    CVE-2018-8905 (#1559705) and CVE-2018-10963 (#1579061)


author: Matej Mužila <mmuzila@redhat.com> 4.4.0-2
changelog:
  - Update to version 4.4.0
  - Resolves: CVE-2022-0561 CVE-2022-0562 CVE-2022-22844 CVE-2022-0865
    CVE-2022-0891 CVE-2022-0924 CVE-2022-0909 CVE-2022-0908 CVE-2022-1354
    CVE-2022-1355


author: RHEL Packaging Agent <jotnar@redhat.com> - 4.4.0-13.2
changelog:
  - fix CVE-2025-8176 off-by-one error skipping first line in tiffdither
    and tiffmedian
  - Resolves: RHEL-120243


author: Michal Hlavinka <mhlavink@redhat.com> - 4.4.0-14
changelog:
  - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-17337)


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.6-23
changelog:
  - bake in versioned requirement on automake (rhbz#1193591)
  - fix testsuite FTBFS against automake 1.16.1
  - bypass -specs=* to gcc (rhbz#985592)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.3-1.20200818git1d392d466a
changelog:
  - Update to v0.7.3 stable, fixes rhbz#1868447
  - (includes "tpm2: fix PCRBelongsTCBGroup for PCClient")


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-5.20201106git2452a24dab
changelog:
  - Fix CVE-2021-3623: out-of-bounds access when trying to resume the state of the vTPM
    Fixes: rhbz#1976816


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-6.20201106git2452a24dab
changelog:
  - Fix CVE-2021-3746 libtpms: out-of-bounds access via specially crafted TPM 2 command packets
    Resolves: rhbz#1999307


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.1-2.20211126git1ff6fe1f43
changelog:
  - Backport "tpm2: Check size of buffer before accessing it" (CVE-2023-1017 & CVE-2023-1018)
    Resolves: rhbz#2173964
    Resolves: rhbz#2173970


author: Stefan Berger
changelog:
  - Created initial version of rpm spec files
  - Version of library is now 0.5.0
  - Debuginfo rpm is built but empty -- seems to be a known problem
    Check https://bugzilla.redhat.com/show_bug.cgi?id=209316


author: Stefan Berger - 0.5.1-2
changelog:
  - make rpmlint happy by replacing tabs with spaces
  - providing a valid URL for the tgz file
  - release is now 2 -> 0.5.1-2


author: Stefan Berger - 0.5.1-3
changelog:
  - removing release from tar ball name
  - Use {?_smp_mflags} for make rather than hardcoding it
  - Fixing post and postun scripts; removing the scripts for devel package
  - Fixing usage of defattr
  - Adding version information into the changelog headers and spaces between the changelog entries
  - Adding LICENSE, README and CHANGELOG file into tar ball and main rpm
  - Removing clean section
  - removed command to clean the build root
  - adding library version to the libries required for building and during
    runtime
  - Extended Requires in devel package with {?_isa}


author: Stefan Berger - 0.5.1-5
changelog:
  - adding BuildRequires for nss-softokn-freebl-static
  - several libtpms-internal changes around state serialization and 
    deserialization
  - fixes to libtpms makefile (makefile-libtpms)
  - adding build_type to generate a debug or production build
  - need nss-devel to have nss-config


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.2-1.20200527git7325acb477
changelog:
  - Update to v0.7.2 stable snapshot, fixes rhbz#1809676
  - exclude i686 build
  - Following stable-0.7.0 branch for TPM 2 related fixes: RSA decryption,
    PSS salt length, symmetric decryption (padding)
  - Under certain circumstances an RSA decryption could cause a buffer overflow causing
    termination of the program (swtpm)
  - Following stable-0.7.0 branch for TPM 2 related fixes; v0.7.1 + gcc related patch
  - elliptic curve fixes
  - MANUFACTURER changed from "IBM " to "IBM"
  - gcc 10 related fix
  - Following stable-0.7.0 branch for TPM 1.2 related bugfix


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.0-14
changelog:
  - iscsi: CHAP auth algorithm selection fixes (#2188991)
  - tests: Use stronger passphrases for LUKS tests
  - lvm2: Improve uevent processing (#2039772)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.0-16
changelog:
  - iscsi: Fix login on firmware-discovered nodes (#2213193)
  - tests: Extend iscsi method call timeouts (#2213715)


author: Peter Hatina <phatina@redhat.com> - 2.1.0-3
changelog:
  - Changes for EPEL-7
    - Lower systemd required version to 208
    - Rewrite BuildRequires for systemd-devel


author: Tomas Bzatek <tbzatek@redhat.com> - 2.8.3-1
changelog:
  - Rebased to upstream 2.8.3 release (#1685210)
  - Fix leaking filedescriptors (#1614774)
  - Fix udisksctl pager scrolling (#1662336)
  - Fix LVM2 plugin CreateSnapshot() error (#1668291)
  - Add ISCSI plugin GetInitiatorNameRaw() method (#1710257)


author: Liwei Ge <liwei.glw@alibaba-inc.com> - 2.9.0-16.0.4.1
changelog:
  - return a nicer UTF-8 string
  - Add UTF-8 check for udisksclient
  - Add doc sub package
  - Fix CVE-2025-6019


author: Robert Scheck <robert@fedoraproject.org> 0.9.12-15
changelog:
  - Added patch to avoid a /usr/@DATADIRNAME@/locale/ directory
  - Use %{_udevrulesdir} macro rather /etc/udev/rules.d/ (#1226681)


author: Jeff Moyer <jmoyer@redhat.com> - 1.0.7-2.el8
changelog:
  - Fix versioning.  The installed library is 1.0.7, make the rpm match.
  - bump release number for build, which includes -fPIC fix
  - Related: rhbz#1862551


author: Ziyang Zhang <ZiyangZhang@linux.alibaba.com> - 1.0.7-3.0.2
changelog:
  - revert io_uring ioctl support
  - update uapi for IORING_ENTER_SQ_SUBMIT_ON_IDLE
  - add a test for sqpoll sq_thread_idle_us mode


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-17
changelog:
  - Resolves: rhbz#1558151 - libuser needs audit events around the account
                             lifecycle


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-19
changelog:
  - Resolves: rhbz#1602600 -  Please review important issues found by covscan
                              in "libuser-0.62-14.el8+7" package


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-20
changelog:
  - Resolves: rhbz#1637398 - libuser-python3 should be renamed to comply
                             with Packaging Guidelines


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-23
changelog:
  - Actually apply the patch from the previous build
  - Resolves: rhbz#1670997 - Amend the user lifecycle auditing


author: Michal Hlavinka <mhlavink@redhat.com> - 0.62-26
changelog:
  - fix findings from static application security testing (#RHEL-35578)
  - translation update (#RHEL-12111)


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.1.6-14
changelog:
  - build with hardening LDFLAGS (#1548717)
  - remove obsolete macro and comments
  - add gcc to build requirements


author: Adam Williamson <awilliam@redhat.com> - 0.31.1-1.sds4
changelog:
  - initial package (based on package from elsewhere by myself and Nic
    Chauvet with i965 driver removed)


author: Adam Williamson <awilliam@redhat.com> - 1.0.6-1
changelog:
  - switch to upstream from sds branch (sds now isn't carrying any very
    interesting changes according to gwenole)
  - pull in the dont-install-test-programs patch from sds
  - split out libva-utils again for multilib purposes
  - drop -devel package obsolete/provides itself too


author: Adam Williamson <awilliam@redhat.com> - 1.0.8-1
changelog:
  - bump to new version
  - fix modded tarball to actually not have i965 dir
  - merge with the other spec I seem to have lying around somewhere


author: Nicolas Chauvet <kwizart@gmail.com> - 1.1.0-3
changelog:
  - Update to official 1.1.0 release
  - Enable Wayland support on f18 - add subpackage
  - Clean spec file


author: Nicolas Chauvet <kwizart@gmail.com> - 1.1.0-5
changelog:
  - Drop wayland support - Lead to suspicious crash
    to reintroduce later using alternates build for vainfo and libs.


author: Nicolas Chauvet <kwizart@gmail.com> - 1.8.0-1
changelog:
  - Update to 1.8.0
  - Switch upstream URL to 01.org and github
  - Split libva-utils into it's own package
  - Clean-up groups


author: Harald Hoyer <harald@redhat.com> - 16-1
changelog:
  - libvarlink 16
  - fixed coverity issues
  - Resolves: #1638294 - Interface name validation rule update


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-19
changelog:
  - qemu: domain: Fix logic when tainting domain (rhbz#2174447)
  - qemu: agent: Make fetching of 'can-offline' member from 'guest-query-vcpus' optional (rhbz#2174447)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-20
changelog:
  - qemu: monitor: Drop old monitor fields from 'struct _qemuMonitorMessage' (rhbz#2170472)
  - qemu: Make 'struct _qemuMonitorMessage' private (rhbz#2170472)
  - qemu: monitor: Move declaration of struct _qemuMonitor to qemu_monitor_priv.h (rhbz#2170472)
  - qemu: qemuBlockGetNamedNodeData: Remove pointless error path (rhbz#2170472)
  - qemu: monitor: Store whether 'query-named-block-nodes' supports 'flat' parameter (rhbz#2170472)
  - qemuMonitorJSONBlockStatsUpdateCapacityBlockdev: Use 'flat' mode of query-named-block-nodes (rhbz#2170472)
  - qemu: relax shared memory check for vhostuser daemons (rhbz#2177701)
  - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700)
  - node_device_conf: Avoid memleak in virNodeDeviceGetPCIVPDDynamicCap() (CVE-2023-2700)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-23.2.el8
changelog:
  - util: Fix error return for virProcessKillPainfullyDelay() (RHEL-36064)
  - rpc: ensure temporary GSource is removed from client event loop (CVE-2024-4418)


author: zhaotianrui <zhaotianrui@loongson.cn> - 8.0.0-23.3.0.1
changelog:
  - Add loongarch support
  - Fix loongarch xml validate
  - Synchronize upstream patches "Use correct tpm device for all non-x86" (lixianglai@loongson.cn)
  - Synchronize upstream patches "validate: Drop tpm-tis arch validation" (lixianglai@loongson.cn)
  - Add new Dharma CPU model (zhouyanjing@hygon.cn)
  - Add Phytium S5000C CPU model (shuaijiakun1288@phytium.com.cn)
  - Add sw64arch support (lufeifei@wxiat.com)


author: hanliyang <hanliyang@hygon.cn> - 8.0.0-23.3.0.2
changelog:
  - conf: qemu: add libvirt support reuse id for hygon CSV
  - conf: qemu: support provide inject secret for Hygon CSV


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-2
changelog:
  - qemu: Add capability for the HTM pSeries feature
  - conf: Parse and format the HTM pSeries feature
  - qemu: Format the HTM pSeries feature
  - qemu: hotplug: Don't access srcPriv when it's not allocated
  - qemuDomainNestedJobAllowed: Allow QEMU_JOB_NONE
  - src: Mention DEVICE_REMOVAL_FAILED event in virDomainDetachDeviceAlias docs
  - virsh.pod: Drop --persistent for detach-device-alias
  - qemu: don't use chardev FD passing with standalone args
  - qemu: remove chardevStdioLogd param from vhostuser code path
  - qemu: consolidate parameters of qemuBuildChrChardevStr into flags
  - qemu: don't use chardev FD passing for vhostuser backend
  - qemu: fix UNIX socket chardevs operating in client mode
  - qemuDomainDeviceDefValidateNetwork: Check for range only if IP prefix set
  - spec: Temporarily drop gluster support


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-3
changelog:
  - qemu: hotplug: Do not try to add secret object for TLS if it does not exist
  - qemu: monitor: Make qemuMonitorAddObject more robust against programming errors
  - spec: Explicitly require matching libvirt-libs
  - virDomainConfNWFilterInstantiate: initialize @xml to avoid random crash
  - qemuProcessStartPRDaemonHook: Try to set NS iff domain was started with one
  - qemuDomainValidateStorageSource: Relax PR validation
  - virStoragePRDefFormat: Suppress path formatting for migratable XML
  - qemu: Wire up PR_MANAGER_STATUS_CHANGED event
  - qemu_monitor: Introduce qemuMonitorJSONGetPRManagerInfo
  - qemu: Fetch pr-helper process info on reconnect
  - qemu: Fix ATTRIBUTE_NONNULL for qemuMonitorAddObject
  - virsh.pod: Fix a command name typo in nwfilter-binding-undefine
  - docs: schema: Add missing <alias> to vsock device
  - virnetdevtap: Don't crash on !ifname in virNetDevTapInterfaceStats
  - tests: fix TLS handshake failure with TLS 1.3


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-4
changelog:
  - qemu: hotplug: don't overwrite error message in qemuDomainAttachNetDevice
  - qemu: hotplug: report error when changing rom enabled attr for net iface
  - qemu: Fix setting global_period cputune element
  - tests: qemucaps: Add test data for upcoming qemu 3.0.0
  - qemu: capabilities: Add capability for werror/rerror for 'usb-device' frontend
  - qemu: command: Move graphics iteration to its own function
  - qemu: address: Handle all the video devices within a single loop
  - conf: Introduce virDomainVideoDefClear helper
  - conf: Introduce virDomainDefPostParseVideo helper
  - qemu: validate: Enforce compile time switch type checking for videos
  - tests: Add capabilities data for QEMU 2.11 x86_64
  - tests: Update capabilities data for QEMU 3.0.0 x86_64
  - qemu: qemuBuildHostdevCommandLine: Use a helper variable mdevsrc
  - qemu: caps: Introduce a capability for egl-headless
  - qemu: Introduce a new graphics display type 'headless'
  - qemu: caps: Add vfio-pci.display capability
  - conf: Introduce virDomainGraphicsDefHasOpenGL helper
  - conf: Replace 'error' with 'cleanup' in virDomainHostdevDefParseXMLSubsys
  - conf: Introduce new <hostdev> attribute 'display'
  - qemu: command: Enable formatting vfio-pci.display option onto cmdline
  - docs: Rephrase the mediated devices hostdev section a bit
  - conf: Introduce new video type 'none'
  - virt-xml-validate: Add schema for nwfilterbinding
  - tools: Fix typo generating adapter_wwpn field
  - src: Fix memory leak in virNWFilterBindingDispose


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-5
changelog:
  - esx storage: Fix typo lsilogic -> lsiLogic
  - networkGetDHCPLeases: Don't always report error if unable to read leases file
  - nwfilter: Resolve SEGV for NWFilter Snoop processing
  - qemu: Remove unused bypassSecurityDriver from qemuOpenFileAs
  - qemuDomainSaveMemory: Don't enforce dynamicOwnership
  - domain_nwfilter: Return early if net has no name in virDomainConfNWFilterTeardownImpl
  - examples: Add clean-traffic-gateway into nwfilters


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-6
changelog:
  - qemu: Exempt video model 'none' from getting a PCI address on Q35
  - conf: Fix a error msg typo in virDomainVideoDefValidate


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-8
changelog:
  - tests: Add missing thread_siblings_list files (rhbz#1608479)
  - util: Rewrite virHostCPUCountThreadSiblings() (rhbz#1608479)
  - utils: Remove arbitrary limit on socket_id/core_id (rhbz#1608479)
  - tests: Add linux-high-ids test (rhbz#1608479)
  - qemu: hotplug: Fix asynchronous unplug of 'shmem' (rhbz#1618680)
  - tests: rename hugepages to hugepages-default (rhbz#1615461)
  - tests: extract hugepages-numa-default-dimm out of hugepages-numa (rhbz#1615461)
  - tests: rename hugepages-numa into hugepages-numa-default (rhbz#1615461)
  - tests: remove unnecessary XML elements from hugepages-numa-default (rhbz#1615461)
  - tests: extract pages-discard out of hugepages-pages (rhbz#1615461)
  - tests: rename hugepages-pages into hugepages-numa-nodeset (rhbz#1615461)
  - tests: rename hugepages-pages2 into hugepages-numa-default-2M (rhbz#1615461)
  - tests: extract pages-discard-hugepages out of hugepages-pages3 (rhbz#1615461)
  - tests: rename hugepages-pages3 into hugepages-numa-nodeset-part (rhbz#1615461)
  - tests: rename hugepages-pages4 into hugepages-numa-nodeset-nonexist (rhbz#1615461)
  - tests: rename hugepages-pages5 into hugepages-default-2M (rhbz#1615461)
  - tests: rename hugepages-pages6 into hugepages-default-system-size (rhbz#1615461)
  - tests: rename hugepages-pages7 into pages-dimm-discard (rhbz#1615461)
  - tests: rename hugepages-pages8 into hugepages-nodeset-nonexist (rhbz#1615461)
  - tests: introduce hugepages-default-1G-nodeset-2M (rhbz#1615461)
  - tests: introduce hugepages-nodeset (rhbz#1615461)
  - conf: Move hugepage XML validation check out of qemu_command (rhbz#1615461)
  - conf: Move hugepages validation out of XML parser (rhbz#1615461)
  - conf: Introduce virDomainDefPostParseMemtune (rhbz#1615461)
  - tests: sev: Test launch-security with specific QEMU version (rhbz#1619150)
  - qemu: Fix probing of AMD SEV support (rhbz#1619150)
  - qemu: caps: Format SEV platform data into qemuCaps cache (rhbz#1619150)
  - conf: Parse guestfwd channel device info again (rhbz#1610072)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-9
changelog:
  - RHEL: Fix virConnectGetMaxVcpus output (rhbz#1582222)
  - storage: Add --shrink to qemu-img command when shrinking vol (rhbz#1622534)
  - access: Fix nwfilter-binding ACL access API name generation (rhbz#1622540)
  - conf: Add validation of input devices (rhbz#1591240)
  - tests: qemu: Remove disk from graphics-vnc-tls (rhbz#1598167)
  - tests: qemu: test more versions for graphics-vnc-tls (rhbz#1598167)
  - qemu: vnc: switch to tls-creds-x509 (rhbz#1598167)
  - qemu: mdev: Use vfio-pci 'display' property only with vfio-pci mdevs (rhbz#1624740)
  - virDomainDefCompatibleDevice: Relax alias change check (rhbz#1603133)
  - virDomainDetachDeviceFlags: Clarify update semantics (rhbz#1603133)
  - virDomainNetDefCheckABIStability: Check for MTU change too (rhbz#1623158)
  - RHEL: spec: Require python3-devel on RHEL-8 (rhbz#1518446)
  - qemu: monitor: Remove qemuMonitorJSONExtractCPUArchInfo wrapper (rhbz#1598829)
  - qemu: monitor: Use 'target' instead of 'arch' in reply of 'query-cpus-fast' (rhbz#1598829)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10
changelog:
  - conf: Fix check for chardev source path (rhbz#1609723)
  - tests: Reuse qemucapabilities data for qemucaps2xml (rhbz#1629862)
  - tests: Add more tests to qemucaps2xml (rhbz#1629862)
  - qemu: Drop QEMU_CAPS_ENABLE_KVM (rhbz#1629862)
  - qemu: Avoid probing non-native binaries all the time (rhbz#1629862)
  - qemu: Clarify QEMU_CAPS_KVM (rhbz#1629862)
  - qemu: Don't check for /dev/kvm presence (rhbz#1629862)
  - tests: Follow up on qemucaps2xmldata rename (rhbz#1629862)
  - security: dac: also label listen UNIX sockets (rhbz#1634775)
  - spec: Set correct TLS priority (rhbz#1632269)
  - spec: Build ceph and gluster support everywhere (rhbz#1599546)
  - virsh: Require explicit --domain for domxml-to-native (rhbz#1634769)
  - virFileIsSharedFSType: Check for fuse.glusterfs too (rhbz#1634782)
  - qemu: fix up permissions for pre-created UNIX sockets (rhbz#1634775)
  - cpu_map: Add features for Icelake CPUs (rhbz#1527657, rhbz#1526625)
  - cpu_map: Add Icelake CPU models (rhbz#1526625)
  - qemu: Properly report VIR_DOMAIN_EVENT_RESUMED_FROM_SNAPSHOT (rhbz#1634758)
  - qemu: Report more appropriate running reasons (rhbz#1634758)
  - qemu: Pass running reason to RESUME event handler (rhbz#1634758)
  - qemu: Map running reason to resume event detail (rhbz#1634758)
  - qemu: Avoid duplicate resume events and state changes (rhbz#1634758)
  - conf: qemu: add support for Hyper-V frequency MSRs (rhbz#1589702)
  - conf: qemu: add support for Hyper-V reenlightenment notifications (rhbz#1589702)
  - conf: qemu: add support for Hyper-V PV TLB flush (rhbz#1589702)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-11
changelog:
  - virfile: fix cast-align error (rhbz#1634782)
  - virfiletest: Fix test name prefix for virFileInData test (rhbz#1634782)
  - virfiletst: Test virFileIsSharedFS (rhbz#1634782)
  - virFileIsSharedFSType: Detect direct mount points (rhbz#1634782)
  - virfile: Rework virFileIsSharedFixFUSE (rhbz#1634782)
  - RHEL: network: regain guest network connectivity after firewalld switch to nftables (rhbz#1638864)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-14
changelog:
  - storage: Remove secretPath from _virStorageBackendQemuImgInfo (rhbz#1645459)
  - storage: Allow for inputvol to have any format for encryption (rhbz#1645459)
  - storage: Allow inputvol to be encrypted (rhbz#1645459)
  - access: Modify the VIR_ERR_ACCESS_DENIED to include driverName (rhbz#1631608)
  - docs: Enhance polkit documentation to describe secondary connection (rhbz#1631608)
  - qemu: Don't ignore resume events (rhbz#1634758, rhbz#1643338)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-15
changelog:
  - virfile: Take symlink into account in virFileIsSharedFixFUSE (rhbz#1634782)
  - qemu: Ignore nwfilter binding instantiation issues during reconnect (rhbz#1648544)
  - qemu: Set identity for the reconnect all thread (rhbz#1648546)
  - Revert "access: Modify the VIR_ERR_ACCESS_DENIED to include driverName" (rhbz#1631608)
  - access: Modify the VIR_ERR_ACCESS_DENIED to include driverName (rhbz#1631608)
  - qemu: add vfio-ap capability (rhbz#1508146)
  - qemu: vfio-ap device support (rhbz#1508146)
  - qemu: Extract MDEV VFIO PCI validation code into a separate helper (rhbz#1508146)
  - conf: Move VFIO AP validation from post parse to QEMU validation code (rhbz#1508146)
  - qemu: Fix post-copy migration on the source (rhbz#1649169)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-16
changelog:
  - util: Don't overflow in virRandomBits (rhbz#1655586)
  - virrandom: Avoid undefined behaviour in virRandomBits (rhbz#1655586)
  - spec: remove libcgroup and cgconfig (rhbz#1602407)
  - qemu: Drop duplicated code from qemuDomainDefValidateFeatures() (rhbz#1647822)
  - tests: Add capabilities data for QEMU 3.1.0 on ppc64 (rhbz#1647822)
  - qemu: Introduce QEMU_CAPS_MACHINE_PSERIES_CAP_NESTED_HV (rhbz#1647822)
  - conf: Parse and format nested-hv feature (rhbz#1647822)
  - qemu: Format nested-hv feature on the command line (rhbz#1647822)
  - qemu: Add check for whether KVM nesting is enabled (rhbz#1645139)
  - secret: Add check/validation for correct usage when LookupByUUID (rhbz#1656255)
  - cpu: Add support for "stibp" x86_64 feature (rhbz#1655032)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-17
changelog:
  - virsh: Strip XML declaration when extracting CPU XMLs (rhbz#1659048)
  - RHEL: qemu: Add ability to set sgio values for hostdev (rhbz#1582424)
  - RHEL: qemu: Add check for unpriv sgio for SCSI generic host device (rhbz#1582424)
  - qemu: Alter @val usage in qemuSetUnprivSGIO (rhbz#1656362)
  - qemu: Alter qemuSetUnprivSGIO hostdev shareable logic (rhbz#1656362)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-18
changelog:
  - conf: correct false boot order error during domain parse (rhbz#1630393)
  - qemu: Remove duplicated qemuAgentCheckError (rhbz#1665000)
  - qemu: require reply from guest agent in qemuAgentGetInterfaces (rhbz#1665000)
  - qemu: Filter non SCSI hostdevs in qemuHostdevPrepareSCSIDevices (rhbz#1665244)
  - util: remove const specifier from nlmsghdr arg to virNetlinkDumpCallback() (rhbz#1583131)
  - util: add a function to insert new interfaces to IPv6CheckForwarding list (rhbz#1583131)
  - util: use nlmsg_find_attr() instead of an open-coded loop (rhbz#1583131)
  - util: check accept_ra for all nexthop interfaces of multipath routes (rhbz#1583131)
  - util: make forgotten changes suggested during review of commit d40b820c (rhbz#1583131)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-19
changelog:
  - qemu: Fix logic error in qemuSetUnprivSGIO (rhbz#1666605)
  - tests: qemuxml2argv: Add test case for empty CDROM with cache mode (rhbz#1553255)
  - qemu: command: Don't format image properties for empty -drive (rhbz#1553255)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-21
changelog:
  - docs: Drop /dev/net/tun from the list of shared devices (rhbz#1665400)
  - qemu: conf: Remove /dev/sev from the default cgroup device acl list (rhbz#1665400)
  - qemu: cgroup: Expose /dev/sev/ only to domains that require SEV (rhbz#1665400)
  - qemu: domain: Add /dev/sev into the domain mount namespace selectively (rhbz#1665400)
  - security: dac: Relabel /dev/sev in the namespace (rhbz#1665400)
  - qemu: caps: Use CAP_DAC_OVERRIDE for probing to avoid permission issues (rhbz#1665400)
  - qemu: caps: Don't try to ask for CAP_DAC_OVERRIDE if non-root (rhbz#1665400)
  - Revert "RHEL: Require firewalld-filesystem for firewalld rpm macros" (rhbz#1650320)
  - Revert "RHEL: network: regain guest network connectivity after firewalld switch to nftables" (rhbz#1650320)
  - configure: change HAVE_FIREWALLD to WITH_FIREWALLD (rhbz#1650320)
  - util: move all firewalld-specific stuff into its own files (rhbz#1650320)
  - util: new virFirewallD APIs + docs (rhbz#1650320)
  - configure: selectively install a firewalld 'libvirt' zone (rhbz#1650320)
  - network: set firewalld zone of bridges to "libvirt" zone when appropriate (rhbz#1650320)
  - network: allow configuring firewalld zone for virtual network bridge device (rhbz#1650320)
  - util: remove test code accidentally committed to virFirewallDZoneExists (rhbz#1650320)
  - qemu: command: Don't skip 'readonly' and throttling info for empty drive (rhbz#1670337)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-24
changelog:
  - tests: qemuxml2argv: add CAPS_ARCH_LATEST macro (rhbz#1698855)
  - qemu: Add ccw support for vhost-vsock (rhbz#1698855)
  - qemu: Allow creating ppc64 guests with graphics and no USB mouse (rhbz#1683681)
  - conf: Expose virDomainSCSIDriveAddressIsUsed (rhbz#1692354)
  - qemuhotplugtest: Don't plug a SCSI disk at unit 7 (rhbz#1692354)
  - qemu_hotplug: Check for duplicate drive addresses (rhbz#1692354)
  - cpu_map: Add support for cldemote CPU feature (rhbz#1537731)
  - util: alloc: add macros for implementing automatic cleanup functionality (rhbz#1505998)
  - qemu: domain: Simplify non-VFIO memLockLimit calculation for PPC64 (rhbz#1505998)
  - qemu_domain: add a PPC64 memLockLimit helper (rhbz#1505998)
  - qemu_domain: NVLink2 bridge detection function for PPC64 (rhbz#1505998)
  - PPC64 support for NVIDIA V100 GPU with NVLink2 passthrough (rhbz#1505998)
  - cpu_x86: Do not cache microcode version (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)
  - qemu: Don't cache microcode version (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)
  - cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)
  - cpu_map: Define md-clear CPUID bit (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-25
changelog:
  - admin: reject clients unless their UID matches the current UID (CVE-2019-10132)
  - locking: restrict sockets to mode 0600 (CVE-2019-10132)
  - logging: restrict sockets to mode 0600 (CVE-2019-10132)
  - util: skip RDMA detection for non-PCI network devices (rhbz#1693299)
  - virfile: Detect ceph as shared FS (rhbz#1698133)
  - virfile: added GPFS as shared fs (rhbz#1698133)
  - util: bitmap: define cleanup function using VIR_DEFINE_AUTOPTR_FUNC (rhbz#1716943)
  - qemu: Rework setting process affinity (rhbz#1716943)
  - qemu: Set up EMULATOR thread and cpuset.mems before exec()-ing qemu (rhbz#1716943)
  - conf: Add definitions for 'uid' and 'fid' PCI address attributes (rhbz#1508149)
  - qemu: Introduce zPCI capability (rhbz#1508149)
  - qemu: Enable PCI multi bus for S390 guests (rhbz#1508149)
  - conf: Introduce extension flag and zPCI member for PCI address (rhbz#1508149)
  - conf: Introduce address caching for PCI extensions (rhbz#1508149)
  - qemu: Auto add pci-root for s390/s390x guests (rhbz#1508149)
  - conf: use virXMLFormatElement() in virDomainDeviceInfoFormat() (rhbz#1508149)
  - conf: Introduce parser, formatter for uid and fid (rhbz#1508149)
  - qemu: Add zPCI address definition check (rhbz#1508149)
  - conf: Allocate/release 'uid' and 'fid' in PCI address (rhbz#1508149)
  - qemu: Generate and use zPCI device in QEMU command line (rhbz#1508149)
  - qemu: Add hotpluging support for PCI devices on S390 guests (rhbz#1508149)
  - qemuDomainRemoveRNGDevice: Remove associated chardev too (rhbz#1508149)
  - qemu_hotplug: remove erroneous call to qemuDomainDetachExtensionDevice() (rhbz#1508149)
  - qemu_hotplug: remove another erroneous qemuDomainDetachExtensionDevice() call (rhbz#1508149)
  - util: Propagate numad failures correctly (rhbz#1716907)
  - util: Introduce virBitmapUnion() (rhbz#1716908)
  - util: Introduce virNumaNodesetToCPUset() (rhbz#1716908)
  - qemu: Fix qemuProcessInitCpuAffinity() (rhbz#1716908)
  - qemu: Fix leak in qemuProcessInitCpuAffinity() (rhbz#1716908)
  - qemu: Drop cleanup label from qemuProcessInitCpuAffinity() (rhbz#1716908)
  - qemu: Fix NULL pointer access in qemuProcessInitCpuAffinity() (rhbz#1716908)
  - qemuBuildMemoryBackendProps: Pass @priv instead of its individual members (rhbz#1624223)
  - qemu: Don't use -mem-prealloc among with .prealloc=yes (rhbz#1624223)
  - nwfilter: fix adding std MAC and IP values to filter binding (rhbz#1691356)
  - qemuProcessBuildDestroyMemoryPathsImpl: Don't overwrite error (rhbz#1658112)
  - qemu_security: Fully implement qemuSecurityDomainSetPathLabel (rhbz#1658112)
  - qemu: process: SEV: Assume libDir to be the directory to create files in (rhbz#1658112)
  - qemu: process: SEV: Relabel guest owner's SEV files created before start (rhbz#1658112)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-26
changelog:
  - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (CVE-2019-10161)
  - api: disallow virDomainManagedSaveDefineXML on read-only connections (CVE-2019-10166)
  - api: disallow virConnectGetDomainCapabilities on read-only connections (CVE-2019-10167)
  - api: disallow virConnect*HypervisorCPU on read-only connections (CVE-2019-10168)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-27
changelog:
  - RHEL: spec: Disable gluster on i686 (rhbz#1722668)
  - rpc: virnetlibsshsession: update deprecated functions (rhbz#1722735)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-29
changelog:
  - cpu: allow include files for CPU definition (rhbz#1686895)
  - cpu: fix cleanup when signature parsing fails (rhbz#1686895)
  - cpu: push more parsing logic into common code (rhbz#1686895)
  - cpu: simplify failure cleanup paths (rhbz#1686895)
  - cpu_map: Add support for arch-capabilities feature (rhbz#1693433)
  - cputest: Add data for Intel(R) Xeon(R) CPU E5-2630 v4 (rhbz#1686895)
  - cputest: Add data for Intel(R) Core(TM) i7-7600U (rhbz#1686895)
  - cputest: Add data for Intel(R) Xeon(R) CPU E7540 (rhbz#1686895)
  - cputest: Add data for Intel(R) Xeon(R) CPU E5-2650 (rhbz#1686895)
  - cputest: Add data for Intel(R) Core(TM) i7-8700 (rhbz#1686895)
  - cpu_x86: Separate ancestor model parsing from x86ModelParse (rhbz#1686895)
  - cpu_x86: Separate signature parsing from x86ModelParse (rhbz#1686895)
  - cpu_x86: Separate vendor parsing from x86ModelParse (rhbz#1686895)
  - cpu_x86: Separate feature list parsing from x86ModelParse (rhbz#1686895)
  - cpu_x86: Make sure CPU model names are unique in cpu_map (rhbz#1686895)
  - cpu_x86: Add x86ModelCopySignatures helper (rhbz#1686895)
  - cpu_x86: Store CPU signature in an array (rhbz#1686895)
  - cpu_x86: Allow multiple signatures for a CPU model (rhbz#1686895)
  - cpu_x86: Log decoded CPU model and signatures (rhbz#1686895)
  - qemu_capabilities: Inroduce virQEMUCapsGetCPUModelX86Data (rhbz#1686895)
  - qemu_capabilities: Introduce virQEMUCapsGetCPUModelInfo (rhbz#1686895)
  - qemu_capabilities: Use virQEMUCapsGetCPUModelInfo (rhbz#1686895)
  - cpu_x86: Add virCPUx86DataGetSignature for tests (rhbz#1686895)
  - cpu_map: Add hex representation of signatures (rhbz#1686895)
  - cputest: Test CPU signatures (rhbz#1686895)
  - cpu_map: Add more signatures for Conroe CPU model (rhbz#1686895)
  - cpu_map: Add more signatures for Penryn CPU model (rhbz#1686895)
  - cpu_map: Add more signatures for Nehalem CPU models (rhbz#1686895)
  - cpu_map: Add more signatures for Westmere CPU model (rhbz#1686895)
  - cpu_map: Add more signatures for SandyBridge CPU models (rhbz#1686895)
  - cpu_map: Add more signatures for IvyBridge CPU models (rhbz#1686895)
  - cpu_map: Add more signatures for Haswell CPU models (rhbz#1686895)
  - cpu_map: Add more signatures for Broadwell CPU models (rhbz#1686895)
  - cpu_map: Add more signatures for Skylake-Client CPU models (rhbz#1686895)
  - cpu: Don't access invalid memory in virCPUx86Translate (rhbz#1686895)
  - cpu_x86: Require <cpuid> within <feature> in CPU map (rhbz#1697627)
  - cputest: Add data for Intel(R) Xeon(R) Platinum 8268 CPU (rhbz#1693433)
  - cpu_map: Add Cascadelake-Server CPU model (rhbz#1693433)
  - cpu_x86: Introduce virCPUx86DataItem container struct (rhbz#1697627)
  - cpu_x86: Rename virCPUx86Vendor.cpuid (rhbz#1697627)
  - cpu_x86: Rename virCPUx86DataItem variables (rhbz#1697627)
  - cpu_x86: Rename x86DataCpuidNext function (rhbz#1697627)
  - cpu_x86: Rename x86DataCpuid (rhbz#1697627)
  - cpu_x86: Rename virCPUx86CPUIDSorter (rhbz#1697627)
  - cpu_x86: Rename virCPUx86DataAddCPUIDInt (rhbz#1697627)
  - cpu_x86: Rename virCPUx86DataAddCPUID (rhbz#1697627)
  - cpu_x86: Rename virCPUx86VendorToCPUID (rhbz#1697627)
  - cpu_x86: Simplify x86DataAdd (rhbz#1697627)
  - cpu_x86: Introduce virCPUx86DataCmp (rhbz#1697627)
  - cpu_x86: Make x86cpuidSetBits more general (rhbz#1697627)
  - cpu_x86: Make x86cpuidClearBits more general (rhbz#1697627)
  - cpu_x86: Make x86cpuidAndBits more general (rhbz#1697627)
  - cpu_x86: Make x86cpuidMatchMasked more general (rhbz#1697627)
  - cpu_x86: Make x86cpuidMatch more general (rhbz#1697627)
  - cpu_x86: Store virCPUx86DataItem content in union (rhbz#1697627)
  - cpu_x86: Add support for storing MSR features in CPU map (rhbz#1697627)
  - cpu_x86: Move *CheckFeature functions (rhbz#1697627)
  - cputest: Add support for MSR features to cpu-parse.sh (rhbz#1697627)
  - util: file: introduce VIR_AUTOCLOSE macro to close fd of the file automatically (rhbz#1697627)
  - vircpuhost: Add support for reading MSRs (rhbz#1697627)
  - virhostcpu: Make virHostCPUGetMSR() work only on x86 (rhbz#1697627)
  - cpu_x86: Fix placement of *CheckFeature functions (rhbz#1697627)
  - cpu_conf: Introduce virCPUDefFilterFeatures (rhbz#1697627)
  - qemu_command: Use consistent syntax for CPU features (rhbz#1697627)
  - tests: Add QEMU caps data for future 4.1.0 (rhbz#1697627)
  - tests: Add domain capabilities case for QEMU 4.1.0 (rhbz#1697627)
  - qemuxml2argvtest: Add test for CPU features translation (rhbz#1697627)
  - qemu: Add APIs for translating CPU features (rhbz#1697627)
  - qemu: Probe for max-x86_64-cpu type (rhbz#1697627)
  - qemu: Probe for "unavailable-features" CPU property (rhbz#1697627)
  - qemu: Probe host CPU after capabilities (rhbz#1697627)
  - qemu_command: Use canonical names of CPU features (rhbz#1697627)
  - qemu: Translate feature names from query-cpu-model-expansion (rhbz#1697627)
  - qemu: Don't use full CPU model expansion (rhbz#1697627)
  - qemu: Make qemuMonitorGetGuestCPU usable on x86 only (rhbz#1697627)
  - cpu: Introduce virCPUDataAddFeature (rhbz#1697627)
  - qemu: Add type filter to qemuMonitorJSONParsePropsList (rhbz#1697627)
  - util: string: Introduce macro for automatic string lists (rhbz#1697627)
  - util: json: define cleanup function using VIR_DEFINE_AUTOPTR_FUNC (rhbz#1697627)
  - qemu: Introduce generic qemuMonitorGetGuestCPU (rhbz#1697627)
  - qemu_process: Prefer generic qemuMonitorGetGuestCPU (rhbz#1697627)
  - util: Rework virStringListAdd (rhbz#1697627)
  - conf: Introduce virCPUDefCheckFeatures (rhbz#1697627)
  - cpu_x86: Turn virCPUx86DataIteratorInit into a function (rhbz#1697627)
  - cpu_x86: Introduce virCPUx86FeatureFilter*MSR (rhbz#1697627)
  - cpu_x86: Read CPU features from IA32_ARCH_CAPABILITIES MSR (rhbz#1697627)
  - cpu_map: Introduce IA32_ARCH_CAPABILITIES MSR features (rhbz#1697627)
  - qemu: Forbid MSR features with old QEMU (rhbz#1697627)
  - qemu: Drop MSR features from host-model with old QEMU (rhbz#1697627)
  - cpu_x86: Fix memory leak - virCPUx86GetHost (rhbz#1697627)
  - qemu: Use @tmpChr in qemuDomainDetachChrDevice to build device string (rhbz#1624204)
  - qemu: Drop "user-" prefix for guestfwd netdev (rhbz#1624204)
  - qemu_hotplug: Attach guestfwd using netdev_add (rhbz#1624204)
  - qemu_hotplug: Detach guestfwd using netdev_del (rhbz#1624204)
  - qemuhotplugtest: Test guestfwd attach and detach (rhbz#1624204)
  - daemon: Register secret driver before storage driver (rhbz#1685151)
  - bhyve: Move autostarting of domains into bhyveStateInitialize (rhbz#1685151)
  - Revert "virStateDriver - Separate AutoStart from Initialize" (rhbz#1685151)
  - Revert "Separate out StateAutoStart from StateInitialize" (rhbz#1685151)
  - util: moving 'type' argument to avoid issues with mount() syscall. (rhbz#1689297)
  - util: cgroup: use VIR_AUTOFREE instead of VIR_FREE for scalar types (rhbz#1689297)
  - vircgroup: Rename structs to start with underscore (rhbz#1689297)
  - vircgroup: Introduce standard set of typedefs and use them (rhbz#1689297)
  - vircgroup: Extract file link resolving into separate function (rhbz#1689297)
  - vircgroup: Remove unused function virCgroupKill() (rhbz#1689297)
  - vircgroup: Unexport unused function virCgroupAddTaskController() (rhbz#1689297)
  - vircgroup: Unexport unused function virCgroupRemoveRecursively (rhbz#1689297)
  - vircgroup: Move function used in tests into vircgrouppriv.h (rhbz#1689297)
  - vircgroup: Remove pointless bool parameter (rhbz#1689297)
  - vircgroup: Extract mount options matching into function (rhbz#1689297)
  - vircgroup: Use virCgroupMountOptsMatchController in virCgroupDetectPlacement (rhbz#1689297)
  - vircgroup: Introduce virCgroupEnableMissingControllers (rhbz#1689297)
  - vircgroup: machinename will never be NULL (rhbz#1689297)
  - vircgroup: Remove virCgroupAddTaskController (rhbz#1689297)
  - vircgroup: Introduce virCgroupGetMemoryStat (rhbz#1689297)
  - lxc: Use virCgroupGetMemoryStat (rhbz#1689297)
  - vircgroup: fix MinGW build (rhbz#1689297)
  - vircgroup: Duplicate string before modifying (rhbz#1689297)
  - vircgroup: Extract controller detection into function (rhbz#1689297)
  - vircgroup: Extract placement validation into function (rhbz#1689297)
  - vircgroup: Split virCgroupPathOfController into two functions (rhbz#1689297)
  - vircgroup: Call virCgroupRemove inside virCgroupMakeGroup (rhbz#1689297)
  - vircgroup: Simplify if conditions in virCgroupMakeGroup (rhbz#1689297)
  - vircgroup: Remove obsolete sa_assert (rhbz#1689297)
  - tests: Resolve possible overrun (rhbz#1689297)
  - vircgroup: cleanup controllers not managed by systemd on error (rhbz#1689297)
  - vircgroup: fix bug in virCgroupEnableMissingControllers (rhbz#1689297)
  - vircgroup: rename virCgroupAdd.*Task to virCgroupAdd.*Process (rhbz#1689297)
  - vircgroup: introduce virCgroupTaskFlags (rhbz#1689297)
  - vircgroup: introduce virCgroupAddThread (rhbz#1689297)
  - vircgroupmock: cleanup unused cgroup files (rhbz#1689297)
  - vircgroupmock: rewrite cgroup fopen mocking (rhbz#1689297)
  - vircgrouptest: call virCgroupDetectMounts directly (rhbz#1689297)
  - vircgrouptest: call virCgroupNewSelf instead virCgroupDetectMounts (rhbz#1689297)
  - util: introduce vircgroupbackend files (rhbz#1689297)
  - vircgroup: introduce cgroup v1 backend files (rhbz#1689297)
  - vircgroup: extract virCgroupV1Available (rhbz#1689297)
  - vircgroup: detect available backend for cgroup (rhbz#1689297)
  - vircgroup: extract virCgroupV1ValidateMachineGroup (rhbz#1689297)
  - vircgroup: extract virCgroupV1CopyMounts (rhbz#1689297)
  - vircgroup: extract v1 detect functions (rhbz#1689297)
  - vircgroup: extract virCgroupV1CopyPlacement (rhbz#1689297)
  - vircgroup: extract virCgroupV1ValidatePlacement (rhbz#1689297)
  - vircgroup: extract virCgroupV1StealPlacement (rhbz#1689297)
  - vircgroup: extract virCgroupV1DetectControllers (rhbz#1689297)
  - vircgroup: extract virCgroupV1HasController (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetAnyController (rhbz#1689297)
  - vircgroup: extract virCgroupV1PathOfController (rhbz#1689297)
  - vircgroup: extract virCgroupV1MakeGroup (rhbz#1689297)
  - vircgroup: extract virCgroupV1Remove (rhbz#1689297)
  - vircgroup: extract virCgroupV1AddTask (rhbz#1689297)
  - vircgroup: extract virCgroupV1HasEmptyTasks (rhbz#1689297)
  - vircgroup: extract virCgroupV1BindMount (rhbz#1689297)
  - vircgroup: extract virCgroupV1SetOwner (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioWeight (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetBlkioIoServiced (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetBlkioIoDeviceServiced (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioDeviceWeight (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioDeviceReadIops (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioDeviceWriteIops (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioDeviceReadBps (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioDeviceWriteBps (rhbz#1689297)
  - vircgroup: extract virCgroupV1SetMemory (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetMemoryStat (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetMemoryUsage (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)Memory*Limit (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetMemSwapUsage (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Allow|Deny)Device (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Allow|Deny)AllDevices (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpuShares (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpuCfsPeriod (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpuCfsQuota (rhbz#1689297)
  - vircgroup: extract virCgroupV1SupportsCpuBW (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetCpuacct*Usage (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetCpuacctStat (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)FreezerState (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpusetMems (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpusetMemoryMigrate (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpusetCpus (rhbz#1689297)
  - vircgroup: rename virCgroupController into virCgroupV1Controller (rhbz#1689297)
  - vircgroup: rename controllers to legacy (rhbz#1689297)
  - vircgroup: remove VIR_CGROUP_SUPPORTED (rhbz#1689297)
  - vircgroup: include system headers only on linux (rhbz#1689297)
  - vircgroupv1: fix build on non-linux OSes (rhbz#1689297)
  - Revert "vircgroup: cleanup controllers not managed by systemd on error" (rhbz#1689297)
  - util: introduce cgroup v2 files (rhbz#1689297)
  - vircgroup: introduce virCgroupV2Available (rhbz#1689297)
  - vircgroup: introduce virCgroupV2ValidateMachineGroup (rhbz#1689297)
  - vircgroup: introduce virCgroupV2CopyMounts (rhbz#1689297)
  - vircgroup: introduce virCgroupV2CopyPlacement (rhbz#1689297)
  - vircgroup: introduce virCgroupV2DetectMounts (rhbz#1689297)
  - vircgroup: introduce virCgroupV2DetectPlacement (rhbz#1689297)
  - vircgroup: introduce virCgroupV2ValidatePlacement (rhbz#1689297)
  - vircgroup: introduce virCgroupV2StealPlacement (rhbz#1689297)
  - vircgroup: introduce virCgroupV2DetectControllers (rhbz#1689297)
  - vircgroup: introduce virCgroupV2HasController (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetAnyController (rhbz#1689297)
  - vircgroup: introduce virCgroupV2PathOfController (rhbz#1689297)
  - vircgroup: introduce virCgroupV2MakeGroup (rhbz#1689297)
  - vircgroup: introduce virCgroupV2Remove (rhbz#1689297)
  - vircgroup: introduce virCgroupV2AddTask (rhbz#1689297)
  - vircgroup: introduce virCgroupV2HasEmptyTasks (rhbz#1689297)
  - vircgroup: introduce virCgroupV2BindMount (rhbz#1689297)
  - vircgroup: introduce virCgroupV2SetOwner (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioWeight (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetBlkioIoServiced (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetBlkioIoDeviceServiced (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceWeight (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceReadIops (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceWriteIops (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceReadBps (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceWriteBps (rhbz#1689297)
  - vircgroup: introduce virCgroupV2SetMemory (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetMemoryStat (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetMemoryUsage (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)MemoryHardLimit (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)MemorySoftLimit (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)MemSwapHardLimit (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetMemSwapUsage (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)CpuShares (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)CpuCfsPeriod (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)CpuCfsQuota (rhbz#1689297)
  - vircgroup: introduce virCgroupV2SupportsCpuBW (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetCpuacctUsage (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetCpuacctStat (rhbz#1689297)
  - vircgroup: register cgroup v2 backend (rhbz#1689297)
  - vircgroup: add support for hybrid configuration (rhbz#1689297)
  - vircgroupmock: change cgroup prefix (rhbz#1689297)
  - vircgroupmock: add support to test cgroup v2 (rhbz#1689297)
  - vircgrouptest: introduce initFakeFS and cleanupFakeFS helpers (rhbz#1689297)
  - vircgrouptest: prepare testCgroupDetectMounts for cgroup v2 (rhbz#1689297)
  - vircgrouptest: add detect mounts test for cgroup v2 (rhbz#1689297)
  - vircgrouptest: add detect mounts test for hybrid cgroups (rhbz#1689297)
  - vircgrouptest: prepare validateCgroup for cgroupv2 (rhbz#1689297)
  - vircgrouptest: add cgroup v2 tests (rhbz#1689297)
  - vircgrouptest: add hybrid tests (rhbz#1689297)
  - virt-host-validate: rewrite cgroup detection to use util/vircgroup (rhbz#1689297)
  - virt-host-validate: require freezer for LXC (rhbz#1689297)
  - virt-host-validate: Fix build on non-Linux (rhbz#1689297)
  - tests: Use correct function name in error path (rhbz#1689297)
  - util: Fix virCgroupGetMemoryStat (rhbz#1689297)
  - tests: Augment vcgrouptest to add virCgroupGetMemoryStat (rhbz#1689297)
  - vircgroup: introduce virCgroupKillRecursiveCB (rhbz#1689297)
  - vircgroupv2: fix virCgroupV2ValidateMachineGroup (rhbz#1689297)
  - util: implement virCgroupV2(Set|Get)CpusetMems (rhbz#1689297)
  - util: implement virCgroupV2(Set|Get)CpusetMemoryMigrate (rhbz#1689297)
  - util: implement virCgroupV2(Set|Get)CpusetCpus (rhbz#1689297)
  - util: enable cgroups v2 cpuset controller for threads (rhbz#1689297)
  - util: vircgroup: pass parent cgroup into virCgroupDetectControllersCB (rhbz#1689297)
  - internal: introduce a family of NULLSTR macros (rhbz#1689297)
  - util: vircgroup: improve controller detection (rhbz#1689297)
  - util: vircgroupv2: use any controller to create thread directory (rhbz#1689297)
  - util: vircgroupv2: enable CPU controller only if it's available (rhbz#1689297)
  - util: vircgroupv2: separate return values of virCgroupV2EnableController (rhbz#1689297)
  - util: vircgroupv2: don't error out if enabling controller fails (rhbz#1689297)
  - util: vircgroupv2: mark only requested controllers as available (rhbz#1689297)
  - Revert "util: vircgroup: pass parent cgroup into virCgroupDetectControllersCB" (rhbz#1689297)
  - util: vircgroupv2: stop enabling missing controllers with systemd (rhbz#1689297)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-30
changelog:
  - virWaitForDevices: Drop confusing part of comment (rhbz#1710575)
  - lib: Drop UDEVSETTLE (rhbz#1710575)
  - m4: Provide default value fore UDEVADM (rhbz#1710575)
  - m4: Drop needless string checks (rhbz#1710575)
  - util: vircgroup: introduce virCgroup(Get|Set)ValueRaw (rhbz#1658890)
  - util: vircgroup: move virCgroupGetValueStr out of virCgroupGetValueForBlkDev (rhbz#1658890)
  - util: vircgroupv1: add support for BFQ blkio files (rhbz#1658890)
  - util: vircgroupv2: add support for BFQ files (rhbz#1658890)
  - Handle copying bitmaps to larger data buffers (rhbz#1703160)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-31
changelog:
  - virDomainObjListAddLocked: fix double free (rhbz#1728530)
  - docs: schemas: Decouple the virtio options from each other (rhbz#1729675)
  - util: command: use VIR_AUTOFREE instead of VIR_FREE for scalar types (rhbz#1721434)
  - util: command: define cleanup function using VIR_DEFINE_AUTOPTR_FUNC (rhbz#1721434)
  - util: netdevopenvswitch: use VIR_AUTOFREE instead of VIR_FREE for scalar types (rhbz#1721434)
  - util: virnetdevopenvswitch: Drop an unused variable @ovs_timeout (rhbz#1721434)
  - util: netdevopenvswitch: use VIR_AUTOPTR for aggregate types (rhbz#1721434)
  - util: suppress unimportant ovs-vsctl errors when getting interface stats (rhbz#1721434)
  - virNetDevOpenvswitchInterfaceStats: Optimize for speed (rhbz#1721434)
  - test: Introduce virnetdevopenvswitchtest (rhbz#1721434)
  - vircommand: Separate mass FD closing into a function (rhbz#1721434)
  - virCommand: use procfs to learn opened FDs (rhbz#1721434)
  - util: command: Ignore bitmap errors when enumerating file descriptors to close (rhbz#1721434)
  - util: Avoid possible error in virCommandMassClose (rhbz#1721434)
  - vircgroup: fix cgroups v2 controllers detection (rhbz#1689297)
  - vircgroupv2: store enabled controllers (rhbz#1689297)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-32
changelog:
  - virDomainObjListAddLocked: Produce better error message than 'Duplicate key' (rhbz#1737790)
  - virdbus: Grab a ref as long as the while loop is executed (rhbz#1741900)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-33
changelog:
  - vircgroupv2: fix parsing multiple values in single file (rhbz#1741825)
  - vircgroupv2: fix virCgroupV2GetCpuCfsQuota for "max" value (rhbz#1741837)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36
changelog:
  - cpu_conf: Pass policy to CPU feature filtering callbacks (rhbz#1749672, rhbz#1756156, rhbz#1721608)
  - qemuxml2*test: Add tests for Icelake-Server, -pconfig (rhbz#1749672, rhbz#1756156, rhbz#1721608)
  - qemu: Drop disabled CPU features unknown to QEMU (rhbz#1749672, rhbz#1756156, rhbz#1721608)
  - cputest: Add data for Ice Lake Server CPU (rhbz#1749672, rhbz#1756156, rhbz#1721608)
  - cpu_map: Drop pconfig from Icelake-Server CPU model (rhbz#1749672, rhbz#1756156, rhbz#1721608)
  - qemu: Fix NULL ptr dereference caused by qemuDomainDefFormatBufInternal (rhbz#1749672, rhbz#1756156, rhbz#1721608)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-37
changelog:
  - cpu_map: Add TAA_NO bit for IA32_ARCH_CAPABILITIES MSR (CVE-2019-11135)
  - cpu_map: Add TSX_CTRL bit for IA32_ARCH_CAPABILITIES MSR (CVE-2019-11135)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-39
changelog:
  - selinux: Do not report an error when not returning -1 (rhbz#1788096)
  - qemu: Fix hyperv features with QEMU 4.1 (rhbz#1794868)
  - qemu: Prefer dashes for hyperv features (rhbz#1794868)
  - cpu: Drop KVM_ from hyperv feature macros (rhbz#1794868)
  - cpu: Drop unused KVM features (rhbz#1794868)
  - qemu: Fix KVM features with QEMU 4.1 (rhbz#1794868)
  - cpu: Drop CPUID definition for hv-spinlocks (rhbz#1794868)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-40
changelog:
  - process: wait longer on kill per assigned Hostdev (rhbz#1785338)
  - process: wait longer 5->30s on hard shutdown (rhbz#1785338)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-42
changelog:
  - RHEL: virscsi: Check device type before getting it's /dev node name (rhbz#1808388)
  - RHEL: virscsi: Support TAPEs in virSCSIDeviceGetDevName() (rhbz#1808388)
  - RHEL: virscsi: Introduce and use virSCSIDeviceGetUnprivSGIOSysfsPath() (rhbz#1808388)
  - RHEL: virutil: Accept non-block devices in virGetDeviceID() (rhbz#1808388)
  - RHEL: qemuSetUnprivSGIO: Actually use calculated @sysfs_path to set unpriv_sgio (rhbz#1808388)
  - RHEL: qemuCheckUnprivSGIO: use @sysfs_path to get unpriv_sgio (rhbz#1808399)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-25
changelog:
  - Upgrade components in virt:rhel module:stream for RHEL-8.3 release (rhbz#1828317)
  - conf: Don't format http cookies unless VIR_DOMAIN_DEF_FORMAT_SECURE is used (CVE-2020-14301)
  - util: Introduce a parser for kernel cmdline arguments (rhbz#1848997)
  - qemu: Check if s390 secure guest support is enabled (rhbz#1848997)
  - qemu: Check if AMD secure guest support is enabled (rhbz#1848997)
  - tools: Secure guest check on s390 in virt-host-validate (rhbz#1848997)
  - tools: Secure guest check for AMD in virt-host-validate (rhbz#1848997)
  - docs: Update AMD launch secure description (rhbz#1848997)
  - docs: Describe protected virtualization guest setup (rhbz#1848997)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-26
changelog:
  - qemu: blockjob: Don't base bitmap handling of active-layer block commit on QEMU_CAPS_BLOCKDEV_REOPEN (rhbz#1857779)
  - qemu: blockjob: Actually delete temporary bitmap on failed active commit (rhbz#1857779)
  - qemu: block: Remove 'active-write' bitmap even if there are no bitmaps to merge (rhbz#1857779)
  - qemuDomainBlockPivot: Rename 'actions' to 'bitmapactions' (rhbz#1857779)
  - qemuDomainBlockPivot: Ignore failures of creating active layer bitmap (rhbz#1857779)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-27
changelog:
  - src: assume sys/sysmacros.h always exists on Linux (rhbz#1860421)
  - virdevmapper.c: Join two WITH_DEVMAPPER sections together (rhbz#1860421)
  - virDevMapperGetTargetsImpl: Use VIR_AUTOSTRINGLIST (rhbz#1860421)
  - virdevmapper: Don't use libdevmapper to obtain dependencies (CVE-2020-14339, rhbz#1860421)
  - virDevMapperGetTargets: Don't ignore EBADF (rhbz#1860421)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-28
changelog:
  - virdevmapper: Don't cache device-mapper major (rhbz#1860421)
  - virdevmapper: Handle kernel without device-mapper support (rhbz#1860421)
  - virdevmapper: Ignore all errors when opening /dev/mapper/control (rhbz#1860421)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-29
changelog:
  - qemu: substitute missing model name for host-passthrough (rhbz#1850680)
  - rpc: gendispatch: handle empty flags (CVE-2020-25637)
  - rpc: add support for filtering @acls by uint params (CVE-2020-25637)
  - rpc: require write acl for guest agent in virDomainInterfaceAddresses (CVE-2020-25637)
  - qemu: agent: set ifname to NULL after freeing (CVE-2020-25637)
  - qemu: Fix domfsinfo for non-PCI device information from guest agent (rhbz#1858771)
  - virDomainNetFindIdx: add support for CCW addresses (rhbz#1837495)
  - check for NULL before calling g_regex_unref (rhbz#1861176)
  - virhostcpu.c: fix 'die_id' parsing for Power hosts (rhbz#1876742)
  - qemuFirmwareFillDomain: Fill NVRAM template on migration too (rhbz#1880418)
  - node_device: refactor udevProcessCCW (rhbz#1853289, rhbz#1865932)
  - node_device: detect CSS devices (rhbz#1853289, rhbz#1865932)
  - virsh: nodedev: ability to filter CSS capabilities (rhbz#1853289, rhbz#1865932)
  - node_device: detect DASD devices (rhbz#1853289, rhbz#1865932)
  - udevProcessCSS: Check if def->driver is non-NULL (rhbz#1853289, rhbz#1865932)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-30
changelog:
  - cpu_map: Add missing x86 features in 0x7 CPUID leaf (rhbz#1861506)
  - cpu_map: Add missing x86 features in 0x80000008 CPUID leaf (rhbz#1861506)
  - cpu_map: Add missing AMD SVM features (rhbz#1861506)
  - Add testdata for AMD EPYC 7502 (rhbz#1861506)
  - cpu_map: Defined and enable EPYC-Rome model (rhbz#1861506)
  - cpu_map: Remove monitor feature from EPYC-Rome (rhbz#1861506)
  - tests: qemuxml2argv: Use existing machine type for 'numatune-distances' case (rhbz#1749518)
  - qemuxml2xmltest: Add "numatune-distance" test case (rhbz#1749518)
  - conf: Move and rename virDomainParseScaledValue() (rhbz#1749518)
  - numa_conf: Drop CPU from name of two functions (rhbz#1749518)
  - qemu_command: Rename qemuBuildNumaArgStr() (rhbz#1749518)
  - qemuBuildMachineCommandLine: Drop needless check (rhbz#1749518)
  - numa_conf: Make virDomainNumaSetNodeCpumask() return void (rhbz#1749518)
  - Allow NUMA nodes without vCPUs (rhbz#1749518)
  - conf: Parse and format HMAT (rhbz#1749518)
  - conf: Validate NUMA HMAT configuration (rhbz#1749518)
  - numa: expose HMAT APIs (rhbz#1749518)
  - qemu: Introduce QEMU_CAPS_NUMA_HMAT capability (rhbz#1749518)
  - qemu: Build HMAT command line (rhbz#1749518)
  - qemuBuildNumaCommandLine: Fix @masterInitiator check (rhbz#1749518)
  - numa_conf: Properly check for caches in virDomainNumaDefValidate() (rhbz#1749518)
  - RNG: Allow interleaving of /domain/cpu/numa/cell children (rhbz#1749518)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-31
changelog:
  - conf: properly clear out autogenerated macvtap names when formatting/parsing (rhbz#1872610)
  - qemu: format 'ramfb' attribute for mediated devices (rhbz#1876297)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-32
changelog:
  - util: replace macvtap name reservation bitmap with a simple counter (rhbz#1874304)
  - util: assign tap device names using a monotonically increasing integer (rhbz#1874304)
  - util: virNetDevTapCreate: initialize fd to -1 (rhbz#1874304)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-33
changelog:
  - cpu_map: Fix Icelake Server model number (rhbz#1537734)
  - cputestdata: Add test data for Snowridge (rhbz#1537734)
  - cpu_map: Add support for fsrm CPU feature (rhbz#1537734)
  - cpu_map: Add support for core-capability CPU feature (rhbz#1537734)
  - cpu_map: Add support for split-lock-detect CPU feature (rhbz#1537734)
  - cpu_map: Define and enable Snowridge model (rhbz#1537734)
  - util: fix typo in VIR_MOCK_WRAP_RET_ARGS() (rhbz#1607929)
  - util/tests: enable locking on iptables/ebtables commandlines in unit tests (rhbz#1607929)
  - util/tests: enable locking on iptables/ebtables commandlines by default (rhbz#1607929)
  - tests: fix iptables test case commandline options in virfirewalltest.c (rhbz#1607929)
  - network: be more verbose about the reason for a firewall reload (rhbz#1607929)
  - util: always check for ebtables/iptables binaries, even when using firewalld (rhbz#1607929)
  - util: synchronize with firewalld before we start calling iptables directly (rhbz#1607929)
  - util: call iptables directly rather than via firewalld (rhbz#1607929)
  - util: virhostcpu: Fail when fetching CPU Stats for invalid cpu (rhbz#1915183)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-34
changelog:
  - qemu: move cgroup cpu period and quota defines to vircgroup.h (rhbz#1915733)
  - vircgroupv1: use defines for cpu period and quota limits (rhbz#1915733)
  - vircgroupv2: use defines for cpu period and quota limits (rhbz#1915733)
  - vircgroup: fix cpu quota maximum limit (rhbz#1915733)
  - util: add virNetDevGetPhysPortName (rhbz#1918708)
  - util: avoid manual VIR_FREE of a g_autofree pointer in virPCIGetName() (rhbz#1918708)
  - util: Add phys_port_name support on virPCIGetNetName (rhbz#1918708)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-35
changelog:
  - vircgroupv2: properly detect placement of running VM (rhbz#1798463)
  - virsystemd: export virSystemdHasMachined (rhbz#1798463)
  - virsystemd: introduce virSystemdGetMachineByPID (rhbz#1798463)
  - virsystemd: introduce virSystemdGetMachineUnitByPID (rhbz#1798463)
  - vircgroup: use DBus call to systemd for some APIs (rhbz#1798463)
  - vircgroupv1: refactor virCgroupV1DetectPlacement (rhbz#1798463)
  - vircgroupv2: move task into cgroup before enabling controllers (rhbz#1798463)
  - vircgroup: introduce virCgroupV1Exists and virCgroupV2Exists (rhbz#1798463)
  - vircgroup: introduce nested cgroup to properly work with systemd (rhbz#1798463)
  - tests: add cgroup nested tests (rhbz#1798463)
  - vircgroup: correctly free nested virCgroupPtr (rhbz#1798463)
  - qemu: Add virtio related options to vsock (rhbz#1931548)
  - domain_validate: use defines for cpu period and quota limits (rhbz#1798463)
  - docs: use proper cpu quota value in our documentation (rhbz#1798463)
  - vircgroup: enforce range limit for cpu.shares (rhbz#1798463)
  - cgroup: use virCgroupSetCpuShares instead of virCgroupSetupCpuShares (rhbz#1798463)
  - cpumap: Add support for ibrs CPU feature (rhbz#1926864)
  - cpumap: Add support for svme-addr-check CPU feature (rhbz#1926864)
  - cpu_map: Add EPYC-Milan x86 CPU model (rhbz#1926864)
  - cpu_map: Install x86_EPYC-Milan.xml (rhbz#1926864)
  - cpu_map: Fix spelling of svme-addr-chk feature (rhbz#1926864)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-36
changelog:
  - network: make it safe to call networkSetupPrivateChains() multiple times (rhbz#1942805)
  - network: force re-creation of iptables private chains on firewalld restart (rhbz#1942805)
  - hostdev: Update mdev pointer reference after checking device type (rhbz#1940449)
  - hostdev: mdev: Lookup mdevs by sysfs path rather than mdev struct (rhbz#1940449)
  - qemu_firmware: don't error out for unknown firmware features (rhbz#1961562)
  - docs: improve description of secure attribute for loader element (rhbz#1929357)
  - conf: introduce virDomainDefParseBootInitOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootKernelOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootFirmwareOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootLoaderOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootAcpiOptions (rhbz#1929357)
  - conf: use switch in virDomainDefParseBootOptions (rhbz#1929357)
  - conf: introduce support for firmware auto-selection feature filtering (rhbz#1929357)
  - qemu: implement support for firmware auto-selection feature filtering (rhbz#1929357)
  - domain_conf: Don't leak def->os.firmwareFeatures (rhbz#1929357)
  - conf: remove duplicated firmware type attribute (rhbz#1929357)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-37
changelog:
  - security: fix SELinux label generation logic (CVE-2021-3631)
  - storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath (CVE-2021-3667)


author: Jiri Denemark <jdenemar@redhat.com> - 7.8.0-1
changelog:
  - Rebased to libvirt-7.8.0 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#1839070, rhbz#1942275, rhbz#1995865, rhbz#1806857, rhbz#1924616
      rhbz#1978574, rhbz#1989457, rhbz#1965589, rhbz#1677608, rhbz#1926508
      rhbz#1810863, rhbz#1845468, rhbz#1738392, rhbz#1965140


author: Jiri Denemark <jdenemar@redhat.com> - 7.9.0-1
changelog:
  - Rebased to libvirt-7.9.0 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#2011731, rhbz#2012385, rhbz#2013539


author: Jiri Denemark <jdenemar@redhat.com> - 7.10.0-1
changelog:
  - Rebased to libvirt-7.10.0 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#1845468, rhbz#2017928, rhbz#2024419, rhbz#1953389, rhbz#1510237


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-0rc1.1
changelog:
  - Rebased to libvirt-8.0.0-rc1 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#1689202, rhbz#2014369, rhbz#2030119, rhbz#2029380, rhbz#2035237
      rhbz#2035714, rhbz#2034180


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-2
changelog:
  - Revert "report error when virProcessGetStatInfo() is unable to parse data" (rhbz#2041610)
  - qemu: fix inactive snapshot revert (rhbz#2043584)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-3
changelog:
  - qemuDomainSetupDisk: Initialize 'targetPaths' (rhbz#2046172)
  - RHEL: Remove <glib-2.64.0 workaround for GSource race (rhbz#2045879)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-4
changelog:
  - qemu_command: Generate memory only after controllers (rhbz#2050697)
  - qemu: Validate domain definition even on migration (rhbz#2050702)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-5
changelog:
  - node_device: Rework udevKludgeStorageType() (rhbz#2056673)
  - node_device: Treat NVMe disks as regular disks (rhbz#2056673)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-6
changelog:
  - conf: Introduce memory allocation threads (rhbz#2067126)
  - qemu_capabilities: Detect memory-backend-*.prealloc-threads property (rhbz#2067126)
  - qemu_validate: Validate prealloc threads against qemuCpas (rhbz#2067126)
  - qemu_command: Generate prealloc-threads property (rhbz#2067126)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-7
changelog:
  - cpu_map: Disable cpu64-rhel* for host-model and baseline (rhbz#1851227)
  - cputest: Drop some old artificial baseline tests (rhbz#1851227)
  - cputest: Give better names to baseline tests (rhbz#1851227)
  - cputest: Add some real world baseline tests (rhbz#1851227)
  - cpu_x86: Consolidate signature match in x86DecodeUseCandidate (rhbz#1851227)
  - cpu_x86: Refactor feature list comparison in x86DecodeUseCandidate (rhbz#1851227)
  - cpu_x86: Penalize disabled features when computing CPU model (rhbz#1851227)
  - cpu_x86: Ignore enabled features for input models in x86DecodeUseCandidate (rhbz#1851227)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-8
changelog:
  - nwfilter: fix crash when counting number of network filters (CVE-2022-0897, rhbz#2063902)
  - virDomainDiskDefValidate: Improve error messages for 'startupPolicy' checks (rhbz#2095758)
  - domain_validate: Split out validation of disk startup policy (rhbz#2095758)
  - virDomainDiskDefValidateStartupPolicy: Validate disk type better (rhbz#2095758)
  - virDomainDiskTranslateSourcePool: Fix check of 'startupPolicy' definition (rhbz#2095758)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-9
changelog:
  - conf: virtiofs: add thread_pool element (rhbz#2079582)
  - qemu: virtiofs: format --thread-pool-size (rhbz#2079582)
  - conf: Move virDomainObj::originalMemlock into qemuDomainObjPrivate (rhbz#2089433)
  - qemu_domain: Format qemuDomainObjPrivate::originalMemlock (rhbz#2089433)
  - qemu: Add qemuDomainSetMaxMemLock helper (rhbz#2089433)
  - qemu_migration: Use qemuDomainSetMaxMemLock (rhbz#2089433)
  - qemu_migration: Restore original memory locking limit (rhbz#2089433)
  - Add VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)
  - virsh: Add support for VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)
  - qemu_migration: Implement VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-10
changelog:
  - security_selinux.c: Relabel existing mode="bind" UNIX sockets (rhbz#2101575)
  - RHEL: qemu_migration: Fix restoring memlock limit on destination (rhbz#2107954)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-11
changelog:
  - qemu_process: Don't require a hugetlbfs mount for memfd (rhbz#2123196)
  - qemu_namespace: Tolerate missing ACLs when creating a path in namespace (rhbz#2123196)
  - qemu_namespace: Fix a corner case in qemuDomainGetPreservedMounts() (rhbz#2123196)
  - qemu_namespace: Introduce qemuDomainNamespaceSetupPath() (rhbz#2123196)
  - qemu_process.c: Propagate hugetlbfs mounts on reconnect (rhbz#2123196)
  - qemuProcessReconnect: Don't build memory paths (rhbz#2123196)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-12
changelog:
  - util: json: Split out array->strinlist conversion from virJSONValueObjectGetStringArray (rhbz#2149752)
  - qemuAgentGetDisks: Don't use virJSONValueObjectGetStringArray for optional data (rhbz#2149752)
  - virpidfile: Add virPidFileReadPathIfLocked func (rhbz#2152188)
  - qemu: tpm: Get swtpm pid without binary validation (rhbz#2152188)
  - qemu_tpm: Do async IO when starting swtpm emulator (rhbz#2152188)
  - qemu: gpu: Get pid without binary validation (rhbz#2152188)
  - spec: libvirt-daemon: Add optional dependency on *-client (rhbz#2136591)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-13
changelog:
  - build: Only install libvirt-guests when building libvirtd (rhbz#2153688)
  - tools: Fix install_mode for some scripts (rhbz#2153688)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-15
changelog:
  - nodedev: fix reported error msg in css cap XML parsing (rhbz#2165011)
  - util: refactor virDomainDeviceCCWAddress into virccw.h (rhbz#2165011)
  - util: refactor virDomainCCWAddressAsString into virccw (rhbz#2165011)
  - util: make reuse of ccw device address format constant (rhbz#2165011)
  - util: refactor ccw address constants into virccw (rhbz#2165011)
  - util: refactor virDomainCCWAddressIncrement into virccw (rhbz#2165011)
  - util: refactor virDomainDeviceCCWAddressIsValid into virccw (rhbz#2165011)
  - util: refactor virDomainDeviceCCWAddressEqual into virccw (rhbz#2165011)
  - conf: adjust method name virDomainDeviceCCWAddressParseXML (rhbz#2165011)
  - util: add ccw device address parsing into virccw (rhbz#2165011)
  - util: add virCCWDeviceAddressFromString to virccw (rhbz#2165011)
  - nodedev: refactor css format from ccw format method (rhbz#2165011)
  - nodedev: refactor ccw device address parsing from XML (rhbz#2165011)
  - nodedev: refactor css XML parsing from ccw XML parsing (rhbz#2165011)
  - schemas: refactor out nodedev ccw address schema (rhbz#2165011)
  - nodedev: add optional device address of channel device to css device (rhbz#2165011)
  - nodedev: add tests for optional device address to css device (rhbz#2165011)
  - nodedev: prevent internal error on dev_busid parse (rhbz#2165011)
  - rpc: Fix memory leak of fds (rhbz#2165428)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-23.4.el8
changelog:
  - util: xml: Introduce virXMLNodeGetSubelementList (RHEL-88716)
  - util: xml: Return GPtrArray from virXMLNodeGetSubelement [partial] (RHEL-88716)
  - qemuMonitorJSONGetCPUModelExpansion: refactor parsing functions (RHEL-88716)
  - qemu: parse deprecated-props from query-cpu-model-expansion response (RHEL-88716)
  - qemu_capabilities: query deprecated features for host-model (RHEL-88716)
  - libvirt-domain: introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES (RHEL-88716)
  - qemu_capabilities: filter deprecated features if requested (RHEL-88716)
  - virsh: add --disable-deprecated-features flag to domcapabilities (RHEL-88716)
  - conf: add deprecated_features attribute (RHEL-88716)


author: zhaotianrui <zhaotianrui@loongson.cn> - 8.0.0-23.4.0.1
changelog:
  - Add loongarch support
  - Fix loongarch xml validate
  - Synchronize upstream patches "Use correct tpm device for all non-x86" (lixianglai@loongson.cn)
  - Synchronize upstream patches "validate: Drop tpm-tis arch validation" (lixianglai@loongson.cn)
  - Add new Dharma CPU model (zhouyanjing@hygon.cn)
  - Add Phytium S5000C CPU model (shuaijiakun1288@phytium.com.cn)
  - Add sw64arch support (lufeifei@wxiat.com)
  - conf: qemu: add libvirt support reuse id for hygon CSV
  - conf: qemu: support provide inject secret for Hygon CSV


author: Petr Pisar <ppisar@redhat.com> - 0.9.11-9
changelog:
  - Fix CVE-2018-15127 (Heap out-of-bounds write in
    rfbserver.c:rfbProcessFileTransferReadBuffer()) (bug #1662997)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 0.9.11-16
changelog:
  - Fix CVE-2019-20839
    Resolves: #1851032
  - Fix CVE-2018-21247
    Resolves: #1852516
  - Fix CVE-2020-14405
    Resolves: #1860527
  - Fix CVE-2020-14397
    Resolves: #1861152


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.8-6
changelog:
  - Python 2 binary package renamed to python2-libvoikko
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Mike FABIAN <mfabian@redhat.com> - 4.1.1-1
changelog:
  - Rebase to 4.1.1 from Fedora 29 (provides only python3-libvoikko,
    removes python2-libvoikko)
  - Resolves: rhbz#1636062


author: Mike FABIAN <mfabian@redhat.com> - 4.1.1-2
changelog:
  - Fix man file names for Flatpak builds, exclude __pycache__ files from Flatpak builds
  - Resolves: rhbz#1896322


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
changelog:
  - Fix for CVE-2019-9232, CVE-2019-9433, CVE-2019-9371, CVE-2019-2126
  - Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
  - Remove php-cli BR


author: Tom "spot" Callaway <tcallawa@redhat.com> 0.9.0-2
changelog:
  - fix permissions on binaries
  - rename generic binaries to v8_*
  - link shared library to -lm, -lpthread to resolve missing weak symbols


author: Tom "spot" Callaway <tcallawa@redhat.com> 0.9.0-7
changelog:
  - update to git revision 8389f1967c5f8b3819cca80705b1b4ba04132b93
  - upstream fix for bz 599147
  - proper shared library support


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-11
changelog:
  - Add patch to fix integer overflows.
  - Fix compilation by including limits.h
  - Resolves: RHEL-40650


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-2
changelog:
  - Drop libwacom-show-stylus, it's a debugging tool that requires extra
    dependencies that we shouldn't pull in everywhere (#2044710)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.3-4
changelog:
  - libwacom-0.3-add-list-devices.patch: add API to list devices
  - libwacom-0.3-add-udev-generator.patch: add a udev rules generater tool
  - libwacom-0.3-add-bamboo-one.patch: add Bamboo One definition


author: Olivier Fourdan <ofourdan@redhat.com> 0.3-5
changelog:
  - Mark data subpackage as noarch and make it a requirement for libwacom
  - Use generated udev rule file to list only known devices from libwacom
    database


author: Peter Hutterer <peter.hutterer@redhat.com> 0.5-2
changelog:
  - Fix gnome-control-center crash for Bamboo Pen & Touch
  - Generic styli needs to have erasers, default to two tools.


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-4
changelog:
  - Add support for the Cintiq Pro 27 (RHEL-101886)
  - Add support for the Intuos Pro 3rd Gen series (RHEL-101881)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-5
changelog:
  - Rearrange the OSD buttons for the Intuos Pro 3rd Gen (RHEL-101881)
  - Use separate Ring/Ring2 assignments


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-6
changelog:
  - Add stylus definitions for the propen group (RHEL-122207)
  - Add tablet definitions for the latest Cintiqs (RHEL-122206)
  - Fix the overlap for button assignments in the SVG (RHEL-126355)


author: Kalev Lember <klember@redhat.com> - 1.14.91-1
changelog:
  - Update to 1.14.91
  - Add new libwayland-egl subpackage and obsolete mesa-libwayland-egl
  - Remove ldconfig scriptlets


author: Tomas Popela <tpopela@redhat.com> - 1.2.0-6
changelog:
  - Add fix for mzbz#1819244
  - Fix tools subpackage dependency
  - Bump the release to "6" to accommodate the 9.1.0.z release bumps


author: Tomas Popela <tpopela@redhat.com> - 1.2.0-7
changelog:
  - Bump the release to "7" to accommodate the 9.1.0.z release bumps as
    libwebp-1.2.0-6.el9 < libwebp-1.2.0-6.el9_1


author: Weitao Zhou <yunqi.zwt@alibaba-inc.com> - 1.2.0-8.0.1
changelog:
  - Obsoletes libwebp7 from remi repo for better compatibility
  - Fix CVE-2023-4863 (#2238431)(cheng.shengyu1@zte.com.cn)


author: Caolán McNamara <caolanm@redhat.com> - 0.2.12-6
changelog:
  - document that libwmf bundles a modified old copy of gd 2.0.1
    https://fedoraproject.org/wiki/Bundled_Libraries#Requirement_if_you_bundle


author: Wolfgang Ulbrich <fedora@raveit.de> - 40.0-2
changelog:
  - revert https://gitlab.gnome.org/GNOME/libwnck/-/commit/3456b74
  - fixes rhbz #1971048
  - and https://github.com/mate-desktop/mate-panel/issues/1230


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.5-1
changelog:
  - Update to openwsman-2.6.5
  - Simplify python binding build and drop python2 subpackage
  - Fix malformed HTTP 200 status line


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.5-3
changelog:
  - Fix wrong SSL_CTX_set_cipher_list() retval check
  - Explicitly disable build of java bindings (build fails if java-devel is installed)


author: Daniel Veillard <veillard@redhat.com> 2.6.27-1
changelog:
  - upstream release 2.6.27 see http://xmlsoft.org/news.html
  - very large amount of bug fixes reported upstream


author: Daniel Veillard <veillard@redhat.com> 2.7.0-1.fc10
changelog:
  - upstream release of 2.7.0
  - switch to XML 1.0 5th edition
  - switch to RFC 3986 for URI parsing
  - better entity handling
  - option to remove hardcoded limitations in the parser
  - more testing
  - a new API to allocate entity nodes
  - and lot of fixes and clanups


author: Daniel Veillard <veillard@redhat.com> 2.7.2-1.fc10
changelog:
  - new release 2.7.2
  - Fixes the known problems in 2.7.1
  - increase the set of options when saving documents


author: Daniel Veillard <veillard@redhat.com> - 2.7.3-1
changelog:
  - new release 2.7.3
  - limit default max size of text nodes
  - special parser mode for PHP
  - bug fixes and more compiler checks


author: Daniel Veillard <veillard@redhat.com> - 2.7.4-1
changelog:
  - upstream release 2.7.4
  - symbol versioning of libxml2 shared libs
  - very large number of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.7-1
changelog:
  - Upstream release of 2.7.7
  - fix serious trouble with zlib >= 1.2.4
  - xmllint new option --xpath
  - various HTML parser improvements
  - includes a number of nug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.8-1
changelog:
  - Upstream release of 2.7.8
  - various bug fixes, including potential crashes
  - new non-destructive formatting option
  - date parsing updated to RFC 5646


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-0rc1
changelog:
  - upstream release candidate 1 of 2.9.0
  - introduce a small API change, but ABI compatible, see
    https://mail.gnome.org/archives/xml/2012-August/msg00005.html
    patches for php, gcc/libjava and evolution-data-connector are upstream
    Grab me in cases of problems veillard@redhat.com
  - many bug fixes including security aspects and small improvements


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-1
changelog:
  - upstream release of 2.9.0
  - A few new API entry points
  - More resilient push parser mode
  - A lot of portability improvement
  - Faster XPath evaluation
  - a lot of bug fixes and smaller improvement


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-2
changelog:
  - remaining cleanups from merge bug rhbz#226079
  - do not put the docs in the main package, only in -devel rhbz#864731


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-1
changelog:
  - upstream release of 2.9.1
  - a couple more API entry point
  - compatibility with python3
  - a lot of bug fixes


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.9.2-8
changelog:
  - Remove executable permissions from documentation.  Complies with packaging
    guidelines and solves issue of libxml2-python3 package depending on python2


author: Daniel Veillard <veillard@redhat.com> - 2.9.2-1
changelog:
  - upstream release of 2.9.3
  - Fixes for CVE-2015-8035, CVE-2015-7942, CVE-2015-7941, CVE-2015-1819
    CVE-2015-7497, CVE-2015-7498, CVE-2015-5312, CVE-2015-7499, CVE-2015-7500
    and CVE-2015-8242
  - many other bug fixes


author: Kevin Fenzi <kevin@scrye.com> - 2.9.4-1
changelog:
  - Update to 2.9.4.
  - Apply very hacky patch that removes the no longer in python-3.6 PyVerify_fd symbol.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.9.4-5
changelog:
  - Python 2 binary package renamed to python2-libxml2
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: David King <dking@redhat.com> - 2.9.7-10
changelog:
  - Fix CVE-2021-3516 (#1956976)
  - Fix CVE-2021-3517 (#1957001)
  - Fix CVE-2021-3518 (#1957028)
  - Fix CVE-2021-3537 (#1957284)


author: David King <dking@redhat.com> - 2.9.7-21.1
changelog:
  - Fix CVE-2025-6021 (RHEL-96498)
  - Fix CVE-2025-49794 (RHEL-96398)
  - Fix CVE-2025-49796 (RHEL-96424)


author: Daniel Veillard <veillard@redhat.com> 1.1.24-1.fc10
changelog:
  - release of 1.1.24
  - fixes a few bugs including the key initialization problem
  - tentative fix for multiarch devel problems


author: Daniel Veillard <veillard@redhat.com> 1.1.25-1
changelog:
  - release of 1.1.25
  - Add API versioning  for libxslt shared library
  - xsl:sort lang support using the locale
  - many bug fixes


author: Matthias Clasen <mclasen@redhat.com> - 1.1.28-3
changelog:
  - Don't ship api docs twice (they were included in both
    the main and the devel package, by accident (need to save
    space on the f19 live images)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.1.29-5
changelog:
  - Python 2 binary package renamed to python2-libxslt
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tomas Korbar <tkorbar@redhat.com> - 0.16.105-1
changelog:
  - Change specfile accordingly to mosvald's review
  - Remove obsolete ldconfig scriptlets
  - libyang-devel-doc changed to noarch package
  - Add python_provide macro to python3-libyang subpackage
  - Remove obsolete Requires from libyang-cpp-devel
  - Start using cmake with smp_mflags macro


author: Michal Ruprich <mruprich@redhat.com> - 0.16.105-4
changelog:
  - Resolves: #1780311 - CVE-2019-19333 libyang: stack-based buffer overflow in make_canonical when bits leaf type is used
  - Resolves: #1780313 - CVE-2019-19334 libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used


author: Remi Collet <remi@remirepo.net> - 1.3.2-1
changelog:
  - update to 1.3.2
  - drop multilib header hack
  - change URL to https://libzip.org/
  - test suite now ok on all arch


author: Remi Collet <remi@remirepo.net> - 1.5.1-1
changelog:
  - update to 1.5.1
  - drop dependency on zlib-devel and bzip2-devel no more
    referenced in libzip.pc
  - drop rpath patch merged upstream


author: Remi Collet <rcollet@redhat.com> - 1.5.2-1
changelog:
  - update to 1.5.2
  - add all explicit cmake options to ensure openssl is used
    even in local build with other lilbraries available


author: Miroslav Lichvar <mlichvar@redhat.com> 2.0-5
changelog:
  - fix sample timestamps when synchronizing PHC to system clock (#1787376)
  - fix handling of zero-length messages (#1827275)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.1.1-1
changelog:
  - update to 3.1.1 (#1895005 CVE-2021-3571)
  - add read-only UDS port (#1929797)
  - add option to set clockClass threshold (#1980386)
  - don't repeat some log messages in multi-port configuration (#1980377)
  - increase default TX timestamp timeout to 10 ms (#1977136)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2-1
changelog:
  - update to 4.2 (RHEL-21326 RHEL-21328 RHEL-21329)
  - fix ts2phc to handle large NMEA delay (RHEL-23278)
  - fix loading and reloading of leapfile


author: Tom Stellard <tstellar@redhat.com> - 5.0.1-11
changelog:
  - Remove conditionals to enable building only the llvm-libs package, we don't
    needs these for module builds.


author: Artem Egorenkov <aegorenk@redhat.com> - 3.6.0-7
changelog:
  - New flag for no sensors added. This flag is used in VM environment
    to make sensors binaries not fail if no sensors was detected.


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.0.4-0.27.20111007git
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
  - Explicitly include <sys/sysmacros.h> due to glibc-headers changes.
  Definition of major and minor macros is no longer transitively included
  through <sys/types.h>, hence make it explicit.
  Ref:
  https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=NEWS;hb=HEAD


author: Pravin Satpute <psatpute@redhat.com> - 2.91.5-1
changelog:
  - Upstream new release 2.91.5
  - Update metainfo file with latest specifications
  - Changed location of metainfo to /usr/share/metainfo


author: Pravin Satpute <psatpute@redhat.com> - 2.91.1-1
changelog:
  - Upstream new release with critical bugfixes.
  - Resolves #1170135 Conjuncts rendering issue for some glyphs


author: Pravin Satpute <psatpute@redhat.com> - 2.91.4-1
changelog:
  - Added  BuildRequires: python3-devel.
  - Resolves: #1423901 - FTBFS in rawhide.
  - Migrated upstream from fedorahosted to pagure.


author: Vishal Vijayraghavan <vvijayra AT redhat DOT com> - 2.95.4-8
changelog:
  - Resolves: #1646688 bad hinting instructions from bug in ttfautohint
  - Build against latest ttfautohint 1.8.2-1.fc29


author: Vishal Vijayraghavan <vishalvvr AT fedoraproject DOT org> - 2.95.5-1
changelog:
  - Resolves: #1958634 Typographic error in configuration file of lohit-devanagari
  - Release v2.95.5
  - Update source url


author: Pravin Satpute <psatpute@redhat.com> - 2.92.3-1
changelog:
  - Added  BuildRequires: python2-devel.
  - Resolves: #1423903 - FTBFS in rawhide
  - Migrated from Fedorahosted.org to pagure.io


author: Pravin Satpute <psatpute@redhat.com> - 2.91.1-1
changelog:
  - Added  BuildRequires: python3-devel.
  - Resolves: #1423904 - FTBFS in rawhide.
  - Migrated from fedorahosted.org to pagure.io.


author: Pravin Satpute <psatpute@redhat.com> - 2.91.2-1
changelog:
  - Upstream new release 2.91.2
  - Update metainfo file with latest specifications
  - Changed location of metainfo to /usr/share/metainfo


author: Pravin Satpute <psatpute@redhat.com> - 2.5.4-1
changelog:
  - Upstream new release 2.5.4
  - Update metainfo file with latest specifications
  - Changed location of metainfo to /usr/share/metainfo
  - Removed patch already included in upstream


author: Pravin Satpute <psatpute@redhat.com> - 2.92.1-1
changelog:
  - Added  BuildRequires: python3-devel.
  - Resolves: #1423905 - FTBFS in rawhide
  - Migrated from fedorahosted.org to pagure.io


author: Pravin Satpute <psatpute@redhat.com> - 2.92.2-1
changelog:
  - Upstream new release 2.92.2
  - Update metainfo file with latest specifications
  - Changed location of metainfo to /usr/share/metainfo


author: Parag Nemade <pnemade AT redhat DOT com> - 2.94.0-7
changelog:
  - Fix the apply_featurefile.py to use fontforge python3 module
  - use %license
  - Drop obsolete Group tag


author: Pravin Satpute <psatpute@redhat.com> - 2.94.1-1
changelog:
  - Upstream new release 2.94.1 with python3 support.
  - Resolves: #1423906 - FTBFS in rawhide
  - Migrated from fedorahosted.org to pagure.io.


author: Pravin Satpute <psatpute@redhat.com> - 2.94.2-1
changelog:
  - Upstream new release 2.94.2
  - Update metainfo file with latest specifications
  - Changed location of metainfo to /usr/share/metainfo


author: Pravin Satpute <psatpute@redhat.com> - 2.94.1-1
changelog:
  - Added  BuildRequires: python3-devel.
  - Resolves: #1423907 - FTBFS in rawhide.
  - Upstream new release, migrated from fedorahosted.org to pagure.io.


author: Pravin Satpute <psatpute@redhat.com> - 2.91.0-1
changelog:
  - Updated with upstream release 2.91.0
  - First release of Lohit Odia after re-writing GSUB rules.
  - Open type rules are available in .fea file for easy reusability.
  - Feature file compiled with AFDKO.
  - Supports orya and ory2 both.
  - Developer friendly glyphs names with AGL syntax format.
  - Corrected glyph class for all glyphs. 
  - Improved shape of ka-viramasignodia-taodia.
  - Added Glyph positioning rules for below based matra.
  - Test file available with release tarball.
  - Auto testing support with harfbuzz hb-shape.
  - Tested with Harfbuzz and Uniscribe (W8 and XP)
  - Corrected feature rules for conjucts ଖ୍ର ଗ୍ର କ୍ଷ୍ଯ


author: Pravin Satpute <psatpute@redhat.com> - 2.91.1-1
changelog:
  - Added  BuildRequires: python3-devel.
  - Resolves: #1423908 - FTBFS in rawhide.
  - Upstream new release, migrated from fedorahosted.org to pagure.io.


author: Pravin Satpute <psatpute@redhat.com> - 2.91.2-1
changelog:
  - Added  BuildRequires: python3-devel.
  - Resolves: #1423909 - FTBFS in rawhide
  - Upstream new release, migrated from fedorahosted.org to pagure.io.


author: Pravin Satpute <psatpute@redhat.com> - 2.91.3-1
changelog:
  - Upstream new release 2.91.3
  - Update metainfo file with latest specifications
  - Changed location of metainfo to /usr/share/metainfo


author: Pravin Satpute <psatpute@redhat.com> - 2.5.4-1
changelog:
  - Upstream release 2.5.4
  - Added support for Unicode 8.0 characters U0C00, U0C34 and U0C5A
  - Added support for Latin characters
  - Using TTFAUTOHINT now while building ttf file.
  - Resolves #985343, #1229213 and #1258123.


author: Pravin Satpute <psatpute@redhat.com> - 2.5.5-1
changelog:
  - Upstream new release 2.5.5
  - Update metainfo file with latest specifications
  - Changed location of metainfo to /usr/share/metainfo


author: Wenlong Zhang <zhangwenlong@loongson.cn> - 8.3-4.17
changelog:
  - Add args -full-iso9660-filenames for loongarch64
  - delete 0001-add-ls2k500sfb.ko-for-loongarch64.patch


author: Lianbo Jiang <lijiang@redhat.com> - B.02.18-22
changelog:
  - Display proper logical name of network device
  - Resolves: rhbz#1724087
  - Add DIMM running speed and Print dimm rank information
  - Resolves: rhbz#1725199


author: Terje Rosten <terjeros@phys.ntnu.no> - 2.10-2
changelog:
  - minor fixes
  - add patch to avoid stripping
  - add desktop file
  - strip changelog
  - move from sbin to bin
  - new url


author: Adam Jackson <ajax@redhat.com> - B.02.14-2
changelog:
  - Requires: hwdata
  - Drop redundant copies of pci.ids and friends, since we'll pick up the
    copies in hwdata at runtime


author: Lianbo Jiang <lijiang@redhat.com> - B.02.18-18
changelog:
  - Fix:59a8e99ab22d ("Porting the code from /CoreOS/lshw/sanity/check-output for the CI gating")
  - Resolves: rhbz#1680623


author: DJ Delorie <dj@redhat.com> - 0.7.91-27
changelog:
  - Fix aarch64 long parameters (via $r8) support.
  - Make system_call_params test compare more exactly.


author: Omair Majid <omajid@redhat.com> - 2.8.1-9
changelog:
  - Build with standard distro-wide optimization flags even on s390 and s390x
  - Resolves: rhbz#1630591


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 2.8.1-11.0.1
changelog:
  - fix build failed for better compatibility for glibc2.30 and glibc2.28
  - Fix gcc10 -fno-common compile issue for compatible with gcc10&gcc8 build


author: Andrew Hughes <gnu.andrew@redhat.com> - 35.0-6
changelog:
  - Pass LDFLAGS to the build so RPM linker flags are used and annocheck passes.
  - Add patch from upstream to fix propagation of LDFLAGS into build system.
  - Resolves: rhbz#2044879


author: Kamil Dudka <kdudka@redhat.com> - 2.8.9-0.23.dev19
changelog:
  - do not require 'rsh' installed at build time (#1581747)
  - update to the latest upstream pre-release


author: Parag Nemade <pnemade AT redhat DOT com> - 1.7.0-7
changelog:
  - Add missing BuildRequires: glibc-locale-source
  - Resolves:rh#996429 - Mapping of ਠ is improper as per standard
  - Resolves:rh#903272 - [gu_IN] use Devanagari U0965 instead of U0AE5 in inscript2 map


author: Parag Nemade <pnemade AT redhat DOT com> - 1.8.0-0.1.RC1
changelog:
  - Update to 1.8.0 (#1523967)
  - Resolves:rh#1487512 - Can't enter words beginning "ld" with Tibetan-ewts keyboard


author: Nikola Forró <nforro@redhat.com> - 8.3.0.0-1
changelog:
  - Upload new tarball
  - Use unversioned docdir
    resolves: #1824824
  - xattr.7: add attr(1) as a relevant page to SEE ALSO
    resolves: #1828296
  - execve.2: clarify signal sent to the process on late failure
    resolves: #1829031


author: Nikola Forró <nforro@redhat.com> - 8.5.0.0-1
changelog:
  - Upload new tarball
  - statx.2: add STATX_ATTR_DAX
    resolves: #1899552
  - resolv.conf.5: update information about search list and
    attempt to clarify domain/search interaction
    resolves: #1928160


author: Honza Horak <hhorak@redhat.com> 5.5.28a-5
changelog:
  - Added licenses LGPLv2 and BSD
  - Removed wrong usage of %{epoch}
  - Test-suite is run in %check
  - Removed perl dependency checking adjustment, rpm seems to be smart enough
  - Other minor spec file fixes


author: Honza Horak <hhorak@redhat.com> 5.5.28a-6
changelog:
  - Removed %{_isa} from provides/obsoletes, which doesn't allow
    proper obsoleting
  - Do not obsolete mysql at the time of testing


author: Honza Horak <hhorak@redhat.com> 5.5.28a-7
changelog:
  - Adding necessary hacks for perl dependency checking, rpm is still
    not wise enough
  - Namespace sanity re-added for symbol default_charset_info


author: Honza Horak <hhorak@redhat.com> 5.5.29-1
changelog:
  - Rebase to 5.5.29
    https://kb.askmonty.org/en/mariadb-5529-changelog/
  - Fix inaccurate default for socket location in mysqld-wait-ready
  - Resolves: #890535


author: Honza Horak <hhorak@redhat.com> 5.5.29-3
changelog:
  - Packages need to provide also %_isa version of mysql package
  - Provide own symbols with real- prefix to distinguish from mysql
    unambiguously
  - Fix format for buffer size in error messages (MDEV-4156)
  - Disable some tests that fail on ppc and s390
  - Conflict only with real-mysql, otherwise mariadb conflicts with ourself


author: Honza Horak <hhorak@redhat.com> 5.5.29-7
changelog:
  - Use configured prefix value instead of guessing basedir
    in mysql_config
  - Resolves: #916189
  - Export dynamic columns and non-blocking API functions documented
    by upstream


author: Honza Horak <hhorak@redhat.com> 5.5.29-9
changelog:
  - Let mariadb-embedded-devel conflict with MySQL-embedded-devel
  - Adjust mariadb-sortbuffer.patch to correspond with upstream patch


author: Honza Horak <hhorak@redhat.com> 1:5.5.29-10
changelog:
  - Adding epoch to have higher priority than other mysql implementations
    when comes to provider comparison


author: Honza Horak <hhorak@redhat.com> 1:5.5.30-2
changelog:
  - Remove mytop utility, which is packaged separately
  - Resolve multilib conflicts in mysql/private/config.h


author: Honza Horak <hhorak@redhat.com> 1:5.5.31-1
changelog:
  - Rebase to 5.5.31
    https://kb.askmonty.org/en/mariadb-5531-changelog/
  - Preserve time-stamps in case of installed files
  - Use /var/tmp instead of /tmp, since the later is using tmpfs,
    which can cause problems
  - Resolves: #962087
  - Fix test suite requirements


author: Honza Horak <hhorak@redhat.com> 1:5.5.31-6
changelog:
  - Test suite params enhanced to decrease server condition influence
  - Fix misleading error message when uninstalling built-in plugins
  - Related: #966873


author: Honza Horak <hhorak@redhat.com> 1:5.5.32-1
changelog:
  - Rebase to 5.5.32
    https://kb.askmonty.org/en/mariadb-5532-changelog/
  - Clean-up un-necessary systemd snippets


author: Dennis Gilmore <dennis@ausil.us> - 1:5.5.32-5
changelog:
  - remove "Requires(pretrans): systemd" since its not possible
  - when installing mariadb and systemd at the same time. as in a new install


author: Honza Horak <hhorak@redhat.com> - 1:5.5.32-6
changelog:
  - Remove unneeded systemd-sysv requires
  - Provide mysql-compat-server symbol
  - Create mariadb.service symlink
  - Fix multilib header location for arm
  - Enhance documentation in the unit file
  - Use scriptstub instead of links to avoid multilib conflicts
  - Add condition for doc placement in F20+


author: Honza Horak <hhorak@redhat.com> - 1:5.5.32-11
changelog:
  - Move log file into /var/log/mariadb/mariadb.log
  - Rename logrotate script to mariadb
  - Resolves: #999589


author: Honza Horak <hhorak@redhat.com> - 1:5.5.32-12
changelog:
  - Re-organize my.cnf to include only generic settings
  - Resolves: #1003115
  - Move pid file location to /var/run/mariadb
  - Make mysqld a symlink to mariadb unit file rather than the opposite way
  - Related: #999589


author: Honza Horak <hhorak@redhat.com> 1:5.5.33a-1
changelog:
  - Rebase to 5.5.33a
    https://kb.askmonty.org/en/mariadb-5533-changelog/
    https://kb.askmonty.org/en/mariadb-5533a-changelog/
  - Enable outfile_loaddata test
  - Disable tokudb_innodb_xa_crash test


author: Honza Horak <hhorak@redhat.com> 1:5.5.33a-3
changelog:
  - Add pam-devel to build-requires in order to build
  - Related: #1019945
  - Check if correct process is running in mysql-wait-ready script
  - Related: #1026313


author: Honza Horak <hhorak@redhat.com> 1:5.5.34-3
changelog:
  - Don't test EDH-RSA-DES-CBC-SHA cipher, it seems to be removed from openssl
    which now makes mariadb/mysql FTBFS because openssl_1 test fails
  - Related: #1044565
  - Use upstream's layout for symbols version in client library
  - Related: #1045013
  - Check if socket file is not being used by another process at a time
    of starting the service
  - Related: #1045435
  - Use %ghost directive for the log file
  - Related: 1043501


author: Marcin Juszkiewicz <mjuszkiewicz@redhat.com> 1:5.5.34-6
changelog:
  - Disable main.gis-precise test also for AArch64
  - Disable perfschema.func_file_io and perfschema.func_mutex for AArch64
    (like it is done for 32-bit ARM)


author: Honza Horak <hhorak@redhat.com> 1:5.5.34-7
changelog:
  - Build with -O3 on ppc64
  - Related: #1051069
  - Move mysql_config to -devel sub-package and remove Require: mariadb
  - Related: #1050920


author: Honza Horak <hhorak@redhat.com> - 1:5.5.34-9
changelog:
  - Adopt compatible system versioning
  - Related: #1045013
  - Use compatibility mysqld.service instead of link
  - Related: #1014311


author: Honza Horak <hhorak@redhat.com> 1:5.5.35-1
changelog:
  - Rebase to 5.5.35
    https://kb.askmonty.org/en/mariadb-5535-changelog/
    Also fixes: CVE-2014-0001, CVE-2014-0412, CVE-2014-0437, CVE-2013-5908,
    CVE-2014-0420, CVE-2014-0393, CVE-2013-5891, CVE-2014-0386, CVE-2014-0401,
    CVE-2014-0402
  - Resolves: #1054043
  - Resolves: #1059546


author: Honza Horak <hhorak@redhat.com> - 1:5.5.36-2
changelog:
  - Server crashes on SQL select containing more group by and left join statements using innodb tables
  - Resolves: #1065676
  - Fix paths in helper scripts
  - Move language files into mariadb directory


author: Honza Horak <hhorak@redhat.com> - 1:10.0.12-3
changelog:
  - Enable OQGRAPH engine and package it as a sub-package
  - Add support for TokuDB engine for x86_64 (currently still disabled)
  - Re-enable tokudb_innodb_xa_crash again, seems to be fixed now
  - Drop superfluous -libs and -embedded ldconfig deps (thanks Ville Skyttä)
  - Separate -lib and -common sub-packages
  - Require /etc/my.cnf instead of shipping it
  - Include README.mysql-cnf
  - Multilib support re-worked
  - Introduce new option with_mysqld_unit
  - Removed obsolete mysql-cluster, the package should already be removed
  - Improve error message when log file is not writable
  - Compile all binaries with full RELRO (RHBZ#1092548)
  - Use modern symbol filtering with compatible backup
  - Add more groupnames for server's my.cnf
  - Error messages now provided by a separate package (thanks Alexander Barkov)
  - Expand paths in helper scripts using cmake


author: Honza Horak <hhorak@redhat.com> - 1:10.0.12-5
changelog:
  - Hardcoded paths removed to work fine in chroot
  - Spec rewrite to be more similar to oterh MySQL implementations
  - Use variable for daemon unit name
  - Include SysV init script if built on older system
  - Add possibility to not ship some sub-packages


author: Honza Horak <hhorak@redhat.com> - 1:10.0.13-4
changelog:
  - Build config subpackage everytime
  - Disable failing tests: innodb_simulate_comp_failures_small, key_cache
    rhbz#1096787


author: Honza Horak <hhorak@redhat.com> - 1:10.0.13-6
changelog:
  - Disable vcol_supported_sql_funcs_myisam test on all arches
  - Related: #1096787
  - Install systemd service file on RHEL-7+
    Server requires any mysql package, so it should be fine with older client


author: Honza Horak <hhorak@redhat.com> - 1:10.0.13-8
changelog:
  - Move connect engine to a separate package
    Rename oqgraph engine to align with upstream packages
  - Move some files to correspond with MariaDB upstream packages
    client.cnf into -libs, mysql_plugin and msql2mysql into base,
    tokuftdump and aria_* into -server, errmsg-utf8.txt into -errmsg
  - Remove duplicate cnf files packaged using %doc
  - Check upgrade script added to warn about need for mysql_upgrade


author: Honza Horak <hhorak@redhat.com> - 1:10.0.14-6
changelog:
  - Remove bundled cmd-line-utils
  - Related: #1079637
  - Move mysqlimport man page to proper package
  - Disable main.key_cache test on s390
    Releated: #1149647


author: Honza Horak <hhorak@redhat.com> - 1:10.0.16-6
changelog:
  - Check permissions when starting service on RHEL-6
  - Resolves: #1194699
  - Do not create test database by default
  - Related: #1194611


author: Honza Horak <hhorak@redhat.com> - 1:10.0.17-2
changelog:
  - Wait for daemon ends
  - Resolves: #1072958
  - Do not include symlink to libmysqlclient if not shipping the library
  - Do not use scl prefix more than once in paths
    Based on https://www.redhat.com/archives/sclorg/2015-February/msg00038.html


author: Honza Horak <hhorak@redhat.com> - 1:10.0.17-4
changelog:
  - Include client plugins into -common package since they are used by both -libs
    and base packages.
  - Do not use libedit
  - Related: #1201988
  - Let plugin dir to be owned by -common
  - Use correct comment in the init script
  - Related: #1184604
  - Add openssl as BuildRequires to run some openssl tests during build
  - Related: #1189180
  - Fail in case any command in check fails
  - Related: #1124791
  - Fix mysqladmin crash if run with -u root -p
  - Resolves: #1207170


author: Honza Horak <hhorak@redhat.com> - 1:10.1.11-5
changelog:
  - Add missing requirements for proper wsrep functionality
  - Obsolate mariadb-galera & mariadb-galera-server (thanks Tomas Repik)
  - Resolves: #1279753
  - Re-enable using libedit, which should be now fixed
  - Related: #1201988
  - Remove mariadb-wait-ready call from systemd unit, we have now systemd notify support
  - Make mariadb@.service similar to mariadb.service


author: Honza Horak <hhorak@redhat.com> - 1:10.1.11-7
changelog:
  - Add Provides: bundled(pcre) in case we build with bundled pcre
  - Related: #1302296
  - embedded-devel should require libaio-devel
  - Resolves: #1290517


author: Jakub Dorňák <jdornak@redhat.com> - 1:10.1.13-2
changelog:
  - Moved /etc/sysconfig/clustercheck
    and /usr/share/mariadb/systemd/use_galera_new_cluster.conf
    to mariadb-server-galera


author: Jakub Dorňák <jdornak@redhat.com> - 1:10.1.14-1
changelog:
  - Add selinux policy
  - Update to 10.1.14 (includes various bug fixes)
  - Add -h and --help options to galera_new_cluster


author: Pavel Raiskup <praiskup@redhat.com> - 1:10.1.14-3
changelog:
  - BR multilib-rpm-config and use it for multilib workarounds
  - install architecture dependant pc file to arch-dependant location


author: Honza Horak <hhorak@redhat.com> - 3:10.1.14-4
changelog:
  - Revert Update to 10.1.15, this release is broken
    https://lists.launchpad.net/maria-discuss/msg03691.html


author: Michal Schorm <mschorm@redhat.com> - 3:10.1.19-1
changelog:
  - Update to 10.1.19
  - added temporary support to build with OpenSSL 1.0 on Fedora >= 26
  - added krb5-devel pkg as Buldrquires to prevent gssapi failure


author: Michal Schorm <mschorm@redhat.com> - 3:10.1.19-2
changelog:
  - fixed bug 1382988
  - added comment to the test suite
  - test suite DISABLED for most builds in Koji, see comments


author: Michal Schorm <mschorm@redhat.com> - 3:10.1.19-5
changelog:
  - Testsuite blacklists heavily updated. Current tracker: #1399847
  - Log-error option added to all config files examples
  - Resolves: #1382988


author: Michal Schorm <mschorm@redhat.com> - 3:10.1.21-1
changelog:
  - Rebase to version 10.1.21
  - Most of the non-essential utilites has been moved to the new sub-package mariadb-server-utils
  - Patches "admincrash" and "errno" removed, they are no longer relevant
    "mysql-embedded-check.c" removed, no longer relevant
  - Buildrequires krb5-devel duplicity removed
  - Manpage for mysql_secure_installation extended
  - Preparation for the CrackLib plugin to be added (waiting for correct SELinux rules to be relased)
  - Related: #1260821, #1205082, #1414387


author: Michal Schorm <mschorm@redhat.com> - 3:10.1.21-3
changelog:
  - Fix for some RPMLint issues
  - Fix: Only server utilities can be move to server-utils subpackage. The rest (from client)
    were moved back to where they came from (client - the main subpackage)
  - Added correct "Obsoletes" for the server-utils subpackage
  - Fixed FTBFS in F26 on x86_64, because of -Werror option
  - Related: #1421092, #1395127


author: Michal Schorm <mschorm@redhat.com> - 3:10.1.21-4
changelog:
  - Cracklib plugin enabled
  - Removed strmov patch, it is no longer needed. The issue was fixed long ago in both MariaDB and MySQL


author: Michal Schorm <mschorm@redhat.com> - 3:10.1.21-6
changelog:
  - Plugin oqgraph enabled
  - Plugin jemalloc enabled
  - 'force' option for 'rm' removed
  - Enabled '--big-test' option for the testsuite
  - Disabled '--skip-rpl' option for the testsuite = replication tests enabled
  - Multilib manpage added


author: Michal Schorm <mschorm@redhat.com> - 3:10.1.24-1
changelog:
  - Rebase to 10.1.24
  - Build dependecies Bison and Libarchive added, others corrected
  - Disabling Mroonga engine for i686 architecture, as it is not supported by MariaDB
  - Removed patches: (fixed by upstream)
      Patch5:  mariadb-file-contents.patch
      Patch14: mariadb-example-config-files.patch
      Patch31: mariadb-string-overflow.patch
      Patch32: mariadb-basedir.patch
      Patch41: mariadb-galera-new-cluster-help.patch
  - Resolves: rhbz#1414387
      CVE-2017-3313
  - Resolves partly: rhbz#1443408
      CVE-2017-3308 CVE-2017-3309 CVE-2017-3453 CVE-2017-3456 CVE-2017-3464


author: Honza Horak <hhorak@redhat.com> - 3:10.1.24-3
changelog:
  - Downstream script mariadb-prepare-db-dir fixed for CVE-2017-3265
  - Resolves: #1458940
  - Check properly that datadir includes only expected files
  - Related: #1356897


author: Michal Schorm <mschorm@redhat.com> - 3:10.1.25-1
changelog:
  - Rebase to 10.1.25
  - Disable plugins 'cracklib' and 'gssapi' by default
  - Related: #1468028, #1464070
  - Looks like the testsuite removes its 'var' content correctly,
    no need to do that explicitly.


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.6-1
changelog:
  - Rebase to 10.2.6
  - SSL patch removed
  - 'libmariadb.so.3' replaced 'limysqlclient.so.18.0.0', symlinks provided
  - "make test" removed, it needs running server and same test are included in the testsuite


author: Honza Horak <hhorak@redhat.com> - 3:10.2.8-2
changelog:
  - Fix paths in galera_recovery and galera_new_cluster
    Resolves: #1403416
  - Support --defaults-group-suffix properly in systemd unit file
    Resolves: #1485777
  - Allow 4567 port for tcp as well
  - Install mysql-wait-ready on RHEL-6 for the SysV init
  - Run mysql-prepare-db-dir as non-root
  - Sync mysql.init with community-mysql


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.8-5
changelog:
  - Fix building without client library part
  - Start building mariadb without client library part,
    use mariadb-connector-c package >= 3.0 instead
  - Use obosletes of "-libs" in "-common", if built without client library part


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.9-1
changelog:
  - Rebase to 10.2.9
  - Testsuite temorarly disabled in order to fast deploy critical fix
    Related: #1497234


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.9-2
changelog:
  - Fix of "with" and "without" macros, so they works
  - Use 'iproute' dependency instead of 'net-tools'
    Related: #1496131
  - Set server package to own /usr/lib64/mysql directory
  - Use correct obsolete, so upgrade from maridb 10.1 to 10.2 is possible
    with dnf "--allowerasing" option
    Related: #1497234
  - Fix building with client library


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.9-3
changelog:
  - Fix client library obsolete
    Related: #1498956
  - Enable testsuite again
  - RPMLint error fix:
    Remove unused python scripts which remained from TokuDB upstream
  - RPMLint error fix: description line too long


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.10-1
changelog:
  - Rebase to 10.2.10 version
  - Patch 2: mariadb-install-test.patch has been incorporated by upstream
  - Patch 8: mariadb-install-db-sharedir.patch; upstream started to use macros
  - Update PCRE check
  - Start using location libdir/mariadb for plugins
  - Move libraries to libdir
  - Divided to more sub-packages to match upstream's RPM list
    Resolves: #1490401; #1400463
  - Update of Cmake arguments to supported format
    Related: https://lists.launchpad.net/maria-discuss/msg04852.html
  - Remove false Provides


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.10-2
changelog:
  - Fix PID file location
    Related: #1483331, #1515779
  - Remove 'Group' tags as they should not be used any more
    Related: https://fedoraproject.org/wiki/RPMGroups


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.11-1
changelog:
  - Rebase to 10.2.11
  - Temporary fix for https://jira.mariadb.org/browse/MDEV-14537 introduced
  - Temporary fix for #1523875 intoruced
    Related: #1523875


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.12-1
changelog:
  - Rebase to 10.2.12
  - Temporary fix for https://jira.mariadb.org/browse/MDEV-14537 removed
  - TokuDB disabled


author: Honza Horak <hhorak@redhat.com> - 3:10.2.12-1
changelog:
  - Do not build connect plugin with mongo and jdbc connectors
  - Support MYSQLD_OPTS and _WSREP_NEW_CLUSTER env vars in init script,
    same as it is done in case of systemd unit file
    Related: #1455850
  - Print the same messages as before when starting the service in SysV init,
    to not scare users
    Related: #1463411


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.12-4
changelog:
  - Fix the upgrade path. Build TokuDB subpackage again, but build a unsupported
    configuration by upstream (without Jemalloc).
    Jemmalloc has been updated to version 5, which isn't backwards compatible.
  - Use downstream tmpfiles instead of the upstream one
    Related: #1538066


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.13-2
changelog:
  - Further fix of ldconfig scriptlets for F27
  - Fix hardcoded paths, move unversioned libraries and symlinks to the devel subpackage


author: Michal Schorm <mschorm@redhat.com> - 3:10.2.15-1
changelog:
  - Rebase to 10.2.15
  - CVEs fixed: #1568962
    CVE-2018-2755 CVE-2018-2761 CVE-2018-2766 CVE-2018-2771 CVE-2018-2781
    CVE-2018-2782 CVE-2018-2784 CVE-2018-2787 CVE-2018-2813 CVE-2018-2817
    CVE-2018-2819 CVE-2018-2786 CVE-2018-2759 CVE-2018-2777 CVE-2018-2810


author: Honza Horak <hhorak@redhat.com> - 3:10.2.15-2
changelog:
  - Use mysqladmin for checking the socket
  - Jemalloc dependency moved to the TokuDB subpackage.
    CMake jemalloc option removed, not used anymore.
    The server doesn't need jemalloc since 10.2: https://jira.mariadb.org/browse/MDEV-11059
  - Build MariaDB with TokuDB without Jemalloc.


author: Honza Horak <hhorak@redhat.com> - 3:10.3.8-3
changelog:
  - Move config files mysql-clients.cnf and enable_encryption.preset to correct
    sub-packages, similar to what upstream does


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.8-6
changelog:
  - Use openssl-devel instead of pkgconfig(openssl)
  - Enable conflicts against mysql (instead of community-mysql)
    Related: #1581034


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.9-1
changelog:
  - Rebase to 10.3.9
  - Add workaround for short SSL certificates
  - Fix parallel installability for x86_64 and i686 devel packages
  - CVEs fixed: #1603531
    CVE-2018-3058 CVE-2018-3063 CVE-2018-3064 CVE-2018-3066


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.10-3
changelog:
  - Fix "-fstack-protector-strong" static analysis errors
    Resolves: #1624139
  - Add wsrep_sst_rsync_tunnel script, add README
    Resolves: #1650463
  - Fix few covscan issues
    Resolves: #1649707
  - Fix galera_new_cluster script
    Resolves: #1641663


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.11-1
changelog:
  - Rebase to 10.3.11
  - Remove README.mysql-cnf as we don't ship example configuration files anymore
    Resolves: #1653318
  - CVEs fixed:
    CVE-2018-3282, CVE-2016-9843, CVE-2018-3174, CVE-2018-3143, CVE-2018-3156
    CVE-2018-3251, CVE-2018-3185, CVE-2018-3277, CVE-2018-3162, CVE-2018-3173
    CVE-2018-3200, CVE-2018-3284


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.17-1
changelog:
  - Rebase to 10.3.17
    Resolves: #1711265
    Resolves: #1701687
  - Add patch for server pkgconfig file location
  - Use logrotatedir macro on one more spot
  - Fix building of TokuDB with Jemalloc 5
  - Fix building with / without lz4
  - Fix "ggsapi" -> "gssapi" typo but keep the broken behaviour
  - Control building of the CACHING_SHA2_PASSWORD plugin
  - Fix the license tag
    Resolves: #1702707


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.23-1
changelog:
  - Rebase to 10.3.23
  - Make conflicts between corresponding mariadb and mysql packages explicit
  - Get rid of the Conflicts macro, it was intended to mark conflicts with
    *upstream* packages
    Resolves: #1853159


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-1
changelog:
  - Rebase to 10.3.27
  - mariadb-debug_build.patch is no more needed, upstream did the changes:
    https://github.com/MariaDB/server/commit/31eaa2029f3c2a4f8e5609ce8b87682286238d9a#diff-32766783af7cac683980224d63c59929
    https://github.com/MariaDB/server/commit/23c6fb3e6231b8939331e2d9f157092f24ed8f4f#diff-78f3162f137407db5240950beb2bcd7c


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-2
changelog:
  - Disable building of the ed25519 client plugin.
    From now on it will be shipped by 'mariadb-connector-c' package


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-3
changelog:
  - Remove mariadb_rpl.h from includedir
    This file is shipped in mariadb-connector-c package
  - Require matching version of mariadb-connector-c package


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.11-1
changelog:
  - Rebase to 10.3.11
  - CVEs fixed:
    CVE-2018-3282, CVE-2016-9843, CVE-2018-3174, CVE-2018-3143, CVE-2018-3156
    CVE-2018-3251, CVE-2018-3185, CVE-2018-3277, CVE-2018-3162, CVE-2018-3173
    CVE-2018-3200, CVE-2018-3284


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.12-1
changelog:
  - Rebase to 10.3.12
  - Disable building of the caching_sha2_password plugin, it is shipped
    by 'mariadb-connector-c'
  - Remove libmariadb.pc, is it shipped by 'mariadb-connector-c'


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.12-6
changelog:
  - Enable mysql-selinux requirement
  - Tweak the testsuite execution, speed up the testsuite on rebuilds
  - Change weak dependency of RocksDB and TokuDB storage engines
    from Recommends to Suggests
  - Add "Suggests" weak dependencies to more storage engines


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.15-1
changelog:
  - Rebase to 10.3.15
  - CVEs fixed:
    CVE-2019-2510 CVE-2019-2537
  - CVEs fixed:
    CVE-2019-2614 CVE-2019-2627 CVE-2019-2628


author: Michal Schorm <mschorm@redhat.com> - 3:10.4.11-1
changelog:
  - Rebase to 10.4.11
    Related: #1756468
  - Remove 'bench' subpackage. Upstream no longer maintains it.
  - Use Valgrind for debug builds
  - Remove ancient obsoletions
  - Tweak build flags
  - Add patch for auth_pam_tool directory


author: Michal Schorm <mschorm@redhat.com> - 3:10.4.12-3
changelog:
  - Rebase mariadb-connector-c git submodule to commit fbf1db6
    For fix: https://jira.mariadb.org/browse/CONC-441


author: Michal Schorm <mschorm@redhat.com> - 3:10.4.13-3
changelog:
  - Make conflicts between corresponding mariadb and mysql packages explicit
  - Get rid of the Conflicts macro, it was intended to mark conflicts with
    *upstream* packages


author: Michal Schorm <mschorm@redhat.com> - 3:10.4.13-7
changelog:
  - Do CMake out-of-source builds
  - Force the CMake change regarding the in-source builds also to F31 and F32
  - Use CMake macros instead of cmake & make direct commands
  - %cmake macro covers the %{set_build_flags}, so they are not needed
    Other changes to compile flags must be specified *after* the %cmake macro


author: Michal Schorm <mschorm@redhat.com> - 3.1.9-4
changelog:
  - Force the CMake change regarding the in-source builds also to F31 and F32
  - %cmake macro covers the %{set_build_flags}, so they are not needed
    That also means, the debug build changes to the build flags must be done AFTER the
    %cmake macro was used.
  - %cmake macro also covers several other options which redudndant specification I removed in this commit
  - Default to %cmake commands instead of %make commands


author: Zuzana Miklankova <zmiklank@redhat.com> - 2.7.1-1
changelog:
  - Update to 2.7.1
  - Retain compatibility with jna4
  - Adjust pom.xml, so that the rpm Requires jna and jna-platform
    Resolves: #2043212


author: Zuzana Miklankova <zmiklank@redhat.com> - 2.7.1-2
changelog:
  - autogenerate the Requires only for jna, not jna-platform
  - change required version of jna-platform to 'any' in pom.xml
    Resolves: #2089627


author: Parag Nemade <pnemade AT redhat DOT com> - 0.2.4-38
changelog:
  - Resolves:rh#2180735 - move marisa-devel in rhel8 CRB repository
    also fix missing gating test execution


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1:3.6.2-9
changelog:
  - Turn hard dependency on java-devel into a weak dependencny
  - Add missing Requires on which
  - Resolves: rhbz#2129825, rhbz#2008121


author: Alex Williamson <alex.williamson@redhat.com> - 0.61-1
changelog:
  - d7dfac5f5bfb ("Merge pull request #15 from cohuck/attr_sanity")
  - 28a9fa17b51e ("validate attribute names")


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 1.1.0-2
changelog:
  - Create additonal directories required by installation.
  - Fix sporadic callout test failures
    Related: rhbz#1999687


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 0:1.5.22-2.0.1
changelog:
  - Fix glibc2.32 build issue for better compatible with both glibc2.28 and glibc2.32
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 and gcc8 build


author: Sebastian Kisela <skisela@redhat.com> - 4.6.2-1
changelog:
  - New release 4.6.2.
  - Convert deprecated specfile python macros to use python2 macros.
  - Explicitly depend on gcc, as it was removed from buildroot default packages.


author: José Expósito <jexposit@redhat.com> - 23.1.4-3
changelog:
  - Fix off-by-one error for newblock allocation in dlist_alloc
    Resolves: https://issues.redhat.com/browse/RHEL-40566


author: Erik van Pienbroek <epienbro@fedoraproject.org> - 101-1
changelog:
  - Update config.{guess,sub} in %mingw_configure (#1288256)
  - Regenerated list of default win32 DLL's


author: Erik van Pienbroek <epienbro@fedoraproject.org> - 5.0-0.2.rc2.v5.x.git65a0c3.20160723
changelog:
  - Update to 20160204 snapshot of the v5.x branch (git rev 65a0c3)
  - Backported patch to build failure of latest wine-gecko


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-5
changelog:
  - Resolves: rhbz#1692457 - CVE-2019-3878 mod_auth_mellon: authentication
                             bypass in ECP flow [rhel-8.1.0]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-6
changelog:
  - Resolves: rhbz#1692471 - CVE-2019-3877 appstream/mod_auth_mellon: open
                             redirect in logout url when using URLs with
                             backslashes [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-7
changelog:
  - Apply the patch from the previous commit
  - Resolves: rhbz#1692471 - CVE-2019-3877 appstream/mod_auth_mellon: open
                             redirect in logout url when using URLs with
                             backslashes [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-9
changelog:
  - Just bump the release number
  - Related: rhbz#1718238 - mod_auth_mellon-diagnostics RPM not in product
                            listings


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-10
changelog:
  - Resolves: rhbz#1761774 - mod_auth_mellon fix for AJAX header name
                             X-Requested-With


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-11
changelog:
  - Resolves: rhbz#1731053 - CVE-2019-13038 mod_auth_mellon: an Open Redirect
                             via the login?ReturnTo= substring which could
                             facilitate information theft [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-12
changelog:
  - Resolves: rhbz#1791262 - Backport SameSite=None cookie from upstream to
                             support latest browsers


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-12.1
changelog:
  - Resolves: rhbz#1986805 - CVE-2021-3639 mod_auth_mellon: Open Redirect
                             vulnerability in logout URLs [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-8
changelog:
  - Resolves: rhbz#1823756 - Backport SameSite=None cookie from
                             mod_auth_openidc upstream to support latest browsers


author: Tomas Halman <thalman@redhat.com> - 2.3.7-9
changelog:
  - Resolves: rhbz#2001853 - CVE-2021-39191 open redirect by supplying a crafted URL
                             in the target_link_uri parameter


author: Tomas Halman <thalman@redhat.com> - 2.3.7-10
changelog:
  - Resolves: rhbz#1987216 - CVE-2021-32791 hardcoded static IV and AAD with a
                             reused key in AES GCM encryption [rhel-8] (edit)


author: Tomas Halman <thalman@redhat.com> - 2.4.9.4-2
changelog:
  - Resolves: rhbz#2153659 - CVE-2022-23527 - Open Redirect in
        oidc_validate_redirect_url() using tab character


author: Tomas Halman <thalman@redhat.com> - 2.4.9.4-3
changelog:
  - Resolves: rhbz#2184144 - CVE-2023-28625 NULL pointer dereference
        when OIDCStripCookies is set and a crafted Cookie header is supplied


author: Tomas Halman <thalman@redhat.com> - 2.4.9.4-6
changelog:
  - Resolves: RHEL-36492 Race condition in mod_auth_openidc filecache
  - Resolves: RHEL-25421 mod_auth_openidc: DoS when using
      `OIDCSessionType client-cookie` and manipulating cookies
      (CVE-2024-24814)


author: John Dennis <jdennis@redhat.com> - 1.8.8-2
changelog:
  - Add missing unpackaged files/directories

    Add to doc: README.md, DISCLAIMER, AUTHORS
    Add to httpd/conf.d: auth_openidc.conf
    Add to /var/cache: /var/cache/httpd/mod_auth_openidc/cache
                       /var/cache/httpd/mod_auth_openidc/metadata


author: John Dennis <jdennis@redhat.com> - 1.8.10.1-3
changelog:
  - Resolves: #1423956 fails to build with openssl 1.1.x
    Also rolls up all fixes to jose library before the change over to cjose


author: <jdennis@redhat.com> - 2.3.7-3
changelog:
  - Resolves: rhbz# 1614977 - fix unit test segfault,
    the problem was not limited exclusively to s390x, but s390x provoked it.


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-5
changelog:
  - Resolves: rhbz#1805749 - CVE-2019-14857 mod_auth_openidc:2.3/mod_auth_openidc:
                             Open redirect in logout url when using URLs with
                             leading slashes
  - Resolves: rhbz#1805068 - CVE-2019-20479 mod_auth_openidc:2.3/mod_auth_openidc:
                             open redirect issue exists in URLs with slash and
                             backslash


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-6
changelog:
  - Fix the previous backport
  - Related: rhbz#1805749 - CVE-2019-14857 mod_auth_openidc:2.3/mod_auth_openidc:
                            Open redirect in logout url when using URLs with
                            leading slashes
  - Related: rhbz#1805068 - CVE-2019-20479 mod_auth_openidc:2.3/mod_auth_openidc:
                            open redirect issue exists in URLs with slash and
                            backslash


author: Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-7
changelog:
  - Resolves: rhbz#1897992 - OIDCStateInputHeaders &
                             OIDCStateMaxNumberOfCookies in existing
                             mod_auth_openidc version
  - Backport the OIDCStateMaxNumberOfCookies option
  - Configure which header value is used to calculate the fingerprint of
    the auth state


author: Tomas Halman <thalman@redhat.com> - 2.4.9.4-7
changelog:
  - Resolves: RHEL-86218 - mod_auth_openidc allows OIDCProviderAuthRequestMethod
              POSTs to leak protected data (CVE-2025-31492)


author: Joe Orton <jorton@redhat.com> - 1.10.0-6
changelog:
  - really disable Berkeley DB support if required by bcond
  - add build conditional to disable swig binding subpackages


author: Lubos Uhliarik <luhliari@redhat.com> - 1.10.2-2
changelog:
  - Resolves: #1733443 - CVE-2019-0203 subversion:1.10/subversion: remote
    unauthenticated denial-of-service in subversion svnserve


author: Lubos Uhliarik <luhliari@redhat.com> - 2.3.9-17
changelog:
  - Resolves: #1876525 - mod_fcgid does not pass more than 64 variables to an FCGI
    server process environment


author: Lubos Uhliarik <luhliari@redhat.com> - 1.11.3-1
changelog:
  - new version 1.11.3
  - Resolves: #1633401 - CVE-2018-11763 mod_http2: httpd:  DoS for HTTP/2
    connections by continuous SETTINGS


author: Lubos Uhliarik <luhliari@redhat.com> - 1.15.7-1
changelog:
  - new version 1.15.7
  - Resolves: #1814236 - RFE: mod_http2 rebase 
  - Resolves: #1747289 - CVE-2019-10082 httpd:2.4/mod_http2: httpd: 
    read-after-free in h2 connection shutdown
  - Resolves: #1696099 - CVE-2019-0197 httpd:2.4/mod_http2: httpd: 
    mod_http2: possible crash on late upgrade
  - Resolves: #1696094 - CVE-2019-0196 httpd:2.4/mod_http2: httpd:
    mod_http2: read-after-free on a string compare
  - Resolves: #1677591 - CVE-2018-17189 httpd:2.4/mod_http2: httpd: 
    mod_http2: DoS via slow, unneeded request bodies


author: Lubos Uhliarik <luhliari@redhat.com> - 1.15.7-2
changelog:
  - Resolves: #1869073 - CVE-2020-9490 httpd:2.4/mod_http2: httpd: 
    Push diary crash on specifically crafted HTTP/2 header


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-4
changelog:
  - Resolves: #1966728 - CVE-2021-33193 httpd:2.4/mod_http2: httpd:
    Request splitting via HTTP/2 method injection and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-9.3
changelog:
  - Resolves: RHEL-13367 - httpd:2.4/mod_http2: reset requests exhaust memory
    (incomplete fix of CVE-2023-44487)(CVE-2023-45802)


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-10.1
changelog:
  - Resolves: RHEL-46214 - Access logs and ErrorDocument don't work when HTTP431
    occurs using http/2 on RHEL8


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-10.3
changelog:
  - Resolves: RHEL-58454 - mod_proxy_http2 failures after CVE-2024-38477 fix
  - Resolves: RHEL-59017 - random failures in other requests on http/2 stream
    when client resets one request


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-10.4
changelog:
  - Resolves: RHEL-105186 - httpd:2.4/httpd: untrusted input from a client causes
    an assertion to fail in the Apache mod_proxy_http2 module (CVE-2025-49630)


author: Jan Pazdziora <jpazdziora@redhat.com> - 0.9.7-1
changelog:
  - 1347490 - Rebase to upstream version 0.9.7.
  - Ensure lookup_user_by_certificate runs after mod_nss as well.


author: Jan Pazdziora <jpazdziora@redhat.com> - 0.9.9-1
changelog:
  - 1434814 - Rebase to upstream version 0.9.9.
  - Add support for multiple users mapped to single certificate.


author: Jan Pazdziora <jpazdziora@redhat.com> - 1.0.0-1
changelog:
  - 1439711 - Rebase to upstream version 1.0.0.
  - Make LookupUserGECOS optional (no default) to support non-POSIX
    user identities.


author: Lubos Uhliarik <luhliari@redhat.com> - 1:2.0.8-8
changelog:
  - Resolves: #1832844 - mod_md does not work with ACME server that does not
    provide keyChange or revokeCert resources


author: Lubos Uhliarik <luhliari@redhat.com> - 2.9.2-9
changelog:
  - Resolves: #1824859 - RFE: Add a feature that can set a mod_security/libcurl
    timeout for retrieving the rules


author: Michael Fleming <mfleming+rpm@enlartenment.com> 1.8.7-4
changelog:
  - Add Requires: httpd-mmn to get the appropriate "module magic" version
    (thanks Ville Skytta)
  - Disabled an overly-agressive rule or two..


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.1.0-1
changelog:
  - New major release - 2.1.0
  - Fix CVE-2007-1359 with a local rule courtesy of Ivan Ristic
  - Addition of core ruleset
  - (Build)Requires libxml2 and pcre added.


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.1.0-3
changelog:
  - Automagically configure correct library path for libxml2 library.
  - Add LoadModule for mod_unique_id as the logging wants this at runtime


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.1.1-1
changelog:
  - New upstream release
  - Drop ASCIIZ rule (fixed upstream)
  - Re-enable protocol violation/anomalies rules now that REQUEST_FILENAME
    is fixed upstream.


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.5.6-1
changelog:
  - Update to upstream 2.5.6
  - Remove references to mlogc, it no longer ships in the main tarball.
  - Link correctly vs. libxml2 and lua (bz# 445839)
  - Remove bogus LoadFile directives as they're no longer needed.


author: Michael Fleming <mfleming+rpm@thatfleminggent.com> - 2.5.12-1
changelog:
  - Update to latest upstream release
  - SECURITY: Fix potential rules bypass and denial of service (bz#563576)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-1
changelog:
  - Update to 2.7.1
  - Remove libxml2 build patch (upstreamed)
  - Update spec since upstream moved to github


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-3
changelog:
  - Add some missing directives RHBZ #569360
  - Fix multipart/invalid part ruleset bypass issue (CVE-2012-4528)
    (RHBZ #867424, #867773, #867774)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-5
changelog:
  - Use conditional for loading mod_unique_id (rhbz #879264)
  - Fix syntax errors on httpd 2.4.x by using IncludeOptional (rhbz #879264, comment #2)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.3-2
changelog:
  - Fix NULL pointer dereference (DoS, crash) (CVE-2013-2765) (RHBZ #967615)
  - Fix a possible memory leak.


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.2.8-1
changelog:
  - Update to 2.2.8
  - Adapt the spec file to new github tarball schema.
  - Correct bugus date in the spec file.


author: Athmane Madjoudj <athmane@fedoraproject.org> - 3.0.0-2
changelog:
  - Fix the install part since extra and experimental rules are not longer included in 3.x
  - Remove EL5 bits since EL5/EPEL5 are OEL-ed
  - Bump reqs


author: Luboš Uhliarik <luhliari@redhat.com> - 3.3.4-3.2
changelog:
  - Resolves: RHEL-78711 - A form data, "鹿沼市御成橋"(a name of street/city
    in Japanese) is forbade by mod_security_crs-3.3.4-3.el8.noarch


author: Jakub Kadlcik <frostyx@email.cz> 0.8-1
changelog:
  - modulemd_tools: drop python3-parameterized dependency (frostyx@email.cz)
  - Package modulemd_tools helper lib (fvalder@redhat.com)
  - Add modulemd-merge tests (fvalder@redhat.com)
  - Add createrepo_mod tests (fvalder@redhat.com)
  - Replace master in fedora releaser to rawhide (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz> 0.11-1
changelog:
  - modulemd_tools: compatibility for upgrade_ext on EPEL8 (frostyx@email.cz)
  - modulemd_tools: compatibility for read_packager_string on EPEL8
    (frostyx@email.cz)
  - dir2module: generate also profiles and modulemd-defaults file
    (frostyx@email.cz)
  - modulemd_tools: use upgrade_ext instead of upgrade (frostyx@email.cz)
  - modulemd_tools: use read_packager_string instead of read_string
    (frostyx@email.cz)
  - Add installation instructions (frostyx@email.cz)
  - bld2repo: do not create empty repos when --result-dir is used
    (kdudka@redhat.com)
  - bld2repo: print status in a more intuitive format (kdudka@redhat.com)
  - tito: stop releasing for Fedora 32 (frostyx@email.cz)


author: Jakub Kadlcik <jkadlcik@redhat.com> 0.7-6
changelog:
  - Do not install bld2repo as RHEL8 doesn't have python3-koji
    (jkadlcik@redhat.com)
  - Drop the Patch1 and make the change directly in this repository
    (jkadlcik@redhat.com)
  - Use UpstreamBuilder instead of DistributionBuilder (jkadlcik@redhat.com)
  - Skip some tests because they require binary files (jkadlcik@redhat.com)


author: Jakub Kadlcik <jkadlcik@redhat.com> 0.7-8
changelog:
  - modulemd_tools: fix tests for new libmodulemd version 2.15.0
    (frostyx@email.cz)
  - createrepo: replace deprecated LooseVersion (mkulik@redhat.com)


author: José Expósito <jexposit@redhat.com> - 2.3.4-20
changelog:
  - Fix CVE-2023-43788: out of bounds read in XpmCreateXpmImageFromBuffer()
  - Fix CVE-2023-43789: out of bounds read on XPM with corrupted colormap


author: Than Ngo <than@redhat.de>
changelog:
  - fix imake to built with gcc-2.96 (thanks Jakup)
  - put bitmaps in /usr/X11R6/include/X11/bitmaps
  - put bindings in /usr/X11R6/lib/Xm/bindings
  - add define -D_GNU_SOURCE to build Motif
  - gzip man pages
  - cleanup specfile


author: Than Ngo <than@redhat.com>
changelog:
  - add 3 official motif patches 
  - add rm -rf $RPM_BUILD_ROOT in install section
  - remove some old patches which are now in official patches


author: Thomas Woerner <twoerner@redhat.com> 2.2.2-13
changelog:
  - fix for Xmu/EditRes conflict (bug #80777)
  - fix for wml and utf-8 (bug #80271)
  - fix for Ext18List (bug #74502)


author: Thomas Woerner <twoerner@redhat.com> 2.2.3-3
changelog:
  - fixed popup menus fail on Tarantella/VNC (#123027)
  - fixed character not supported problem (#124960)
  - fixed data out of bounds bug (#124961)


author: Thomas Woerner <twoerner@redhat.com> 2.2.3-5
changelog:
  - libXp now moved to xorg-x11-deprecated-libs, therefore no compatibility 
    with XFree86 packages anymore.


author: Thomas Woerner <twoerner@redhat.com> 2.2.3-6
changelog:
  - fixed CAN-2004-0687 (integer overflows) and CAN-2004-0688 (stack overflows)
    in embedded Xpm library


author: Thomas Woerner <twoerner@redhat.com> 2.2.3-9
changelog:
  - Upstream Fix: Multiscreen mode
  - Upstream Fix: Crash when restarting by a session manager (motifzone#1193)
  - Upstream Fix: Crash when duplicating a window menu containing f.circle_up
    (motifzone#1202)
  - fixed divide by zero error in ComputeVizCount() (#144420)
  - Xpmcreate: define LONG64 on 64 bit architectures (#143689)


author: Thomas Woerner <twoerner@redhat.com> 2.2.3-11
changelog:
  - fixed mrm initialization error in MrmOpenHierarchyPerDisplay (#167094)
    Thanks to Arjan van de Ven for the patch.


author: Thomas Woerner <twoerner@redhat.com> 2.3.0-0.1
changelog:
  - new 2.3.0 (beta1)
  - patch for new rgb.txt location (#174210)
    Thanks to Ville Skyttä for the patch


author: Thomas Woerner <twoerner@redhat.com> 2.3.0-0.1.1
changelog:
  - enabled Xft, jpeg and png support
  - patch for missing xft-config
  - dropped duplicate include path in devel package


author: Thomas Woerner <twoerner@redhat.com> 2.3.0-0.1.1
changelog:
  - moved mwmrc to /etc/X11/mwm
  - moved bindings to /usr/share/X11
  - fixed paths in man pages containing /usr/X11R6


author: Thomas Woerner <twoerner@redhat.com> 2.3.0-0.1.9
changelog:
  - new CVS version 2006-02-02
  - fixed CVE-2005-3964: libUil buffer overflows (#174814)
  - fixed XmList out of bound accesses (#167701)
  - fixed pasting into TextField (#179549)


author: Thomas Woerner <twoerner@redhat.com> 2.3.0-0.5
changelog:
  - fixed SEGV error moving mouse over window related to XmToolTipGetLabel
    (MotifZone bug fix #1388)
    Resolves: rhbz#277381


author: Thomas Woerner <twoerner@redhat.com> 2.3.1-0
changelog:
  - rebase to 2.3.1 (CVS dist release)
    Resolves: rhbz#455736
  - fixes OpenMotif XmList problem
    Resolves: rhbz#405801
  - fixes List.c/ReplaceItem() segfaults when item selected
    Resolves: rhbz#431460
  - fixes [motifzone 1400 ] openmotif/ BadFont on multiple display application
    Resolves: rhbz#438910
  - fixes applications dump core in non-UTF8 environment
    Resolves: rhbz#453722
  - fixes lots of additional bugs: see release notes


author: Thomas Woerner <twoerner@redhat.com> 2.3.1-2
changelog:
  - more fixes for unreliable pasting into XmTextField (MotifZone bug #1321)
    Resolves: rhbz#405941
  - the fix for MotifZone bug #1400 is not working for remote displays


author: Thomas Woerner <twoerner@redhat.com> 2.3.2-1
changelog:
  - new version 2.3.2 with upstream bug fixes: #1212, #1277, #1473, #1476
  - spec file cleanup
  - make build work with libtool
  - all man pages are utf-8, no need to convert them anymore
  - enabled EditRes support with upstream fix
  - fixed parallel build
  - fixed patches for fuzz 0
    Related: rhbz#543948


author: Thomas Woerner <twoerner@redhat.com> 2.3.2-1.1
changelog:
  - fixes according to review:
  - fixed buildroot
  - removed dot from summary
  - removed dist tag from changelog
  - added source download link


author: Thomas Woerner <twoerner@redhat.com> 2.3.3-2
changelog:
  - fixed LabelGadget draws background over border of its parent (rhbz#584300)
    (MotifZone bug #1517)
  - fixed LabelGadget draws Xft text over border of its parent (rhbz#584300#c3)
    (MotifZone bug #1521)


author: Thomas Woerner <twoerner@redhat.com> 2.3.3-4
changelog:
  - fixed Label draws Xft text over border of its parent (rhbz#584300#c3)
    (MotifZone bug #1521 refixed)


author: Thomas Woerner <twoerner@redhat.com> 2.3.3-5
changelog:
  - dropped file requires for /usr/share/X11/XKeysymDB, not needed and not 
    available anymore
  - added flex-static build requirement, because of flex package split


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-1
changelog:
  - new version 2.3.4 with LGPL license
  - fixed some rpmlint warnings
  - new sub package for static libraries
  - added /etc/X11/mwm directory
  - removed defattrs


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-2
changelog:
  - fixed requirements according to review (RHBZ#870049)
  - flex-static has been renamed to flex-devel with Fedora-18 and RHEL-7


author: Olivier Fourdan <ofourdan@redhat.com> - 2.3.4-22
changelog:
  - Keep drop-down menus on the same monitor as the pull-down button with
    Xinerama
    Resolves: RHEL-91951


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-1
changelog:
  - Import into RHEL
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jan Vcelak <jvcelak@fedoraproject.org>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jeff Law <law@redhat.com>
        Lukas Zachar <lzachar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Tom Stellard <tstellar@redhat.com>


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-3
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: James Paul Turner <jamesturner246@fedoraproject.org> - 3.1.6-1
changelog:
  - Update to MPFR version 3.1.6
  - Use autosetup specfile macro for applying patches (patches 1 and 2 applied)
  - Removed iconv calls, as they were breaking .info files, which are now unicode
    resolves #1299649
  - Other minor cleanups
  - BuildRequire gcc per https://fedoraproject.org/wiki/Packaging:C_and_C%2B%2B#BuildRequires_and_Requires


author: Jarod Wilson <jarod@redhat.com> - 3.2.1-8
changelog:
  - Remove python2 bits entirely, fix mpi lib dependencies
  - Remove obsolete Provides/Obsoletes for mpich2
  - Resolves: rhbz#1628628


author: Honggang Li <honli@redhat.com> - 3.3.2-8
changelog:
  - Sync with Fedora build
  - Update to latest upstream release 3.3.2
  - Resolves: rhbz#1657316, rhbz#1732982, rhbz#1850080


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 4.1.1-1.0.1
changelog:
  - Add -fallow-argument-mismatch for compatible with gcc10 build
  - Do not require valgrind for loongarch64 (geliwei@openanolis.org)


author: Honggang Li <honli@redhat.com> - 5.6.2-1
changelog:
  - Update OSU benchmarks to upstream release 5.6.2
  - Update IMB benchmarks to upstream release v2019.6
  - Resolves: rhbz#1817837


author: Honggang Li <honli@redhat.com> - 5.7-2
changelog:
  - Update OSU benchmarks to upstream release 5.7.1
  - Update Intel MPI Benchmarks 2021.2
  - Resolves: rhbz#1960078


author: Honggang Li <honli@redhat.com> - 5.8-1
changelog:
  - Update OSU benchmarks to upstream release 5.8
  - Update Intel MPI Benchmarks 2021.3
  - Resolves: rhbz#2008517


author: Steve Traylen <steve.traylen@cern.ch> - 0.5.8-2
changelog:
  - Correct License to GPLv2+
  - Move man3 pages to the devel package.
  - Remove +x bit from create-munge-key source.
  - Preserve timestamps when installing files.
  - ldconfig not needed on -devel package.
  - Do a condrestart when upgrading.
  - Remove redundant files from docs.
  - chmod /var/lib/munge /var/log/munge and /etc/munge to 700.
  - Apply patch to not error when GPL_LICENSED is not set.
  - Patch service script to print error on if munge.key not present
    on start only and with a better error. 
  - Remove dont-exit-form-lib.patch. munge is expecting munge to
    do this.
  - Remove libgcrypt-devel from BuildRequires, uses openssl by
    default anyway.
  - Mark the munge.key as a ghost file.


author: Steve Traylen <steve.traylen@cern.ch> - 0.5.8-4
changelog:
  - Expand defattr with 4th argument for default directory perms.
  - Explict attr for non 0644 files and 0755 directories.


author: Steve Traylen <steve.traylen@cern.ch> - 0.5.8-6
changelog:
  - Patch for rhbz #525732 - Loads /etc/sysconfig/munge 
    correctly.
  - Mark pid file as ghost file on oses that support that.
  - Permisions on pid directory to 755


author: Steve Traylen <steve.traylen@cern.ch> - 0.5.8-7
changelog:
  - rhbz#530128 Move runtime libs to a new -libs package.
    ldconfig moved to new -libs package as a result.


author: Steve Traylen <steve.traylen@cern.ch> - 0.5.8-8
changelog:
  - Requirment on munge removed from munge-libs.
  - Explicit exact requirment on munge-libs for munge and munge-devel
    added.


author: Steve Traylen <steve.traylen@cern.ch> - 0.5.9-2
changelog:
  - Remove initd-pass-rpmlint.patch, has been applied upstream.
  - Remove remove-GPL_LICENSED-cpp.patch, has been applied upstream.


author: Steve Traylen <steve.traylen@cern.ch> - 0.5.10-1
changelog:
  - Upstream to 0.5.10
  - Add _isa tags to all build requires.
  - Remove unused patch munge-correct-service-name.patch, upstream fixed.
  - Update and add check-key-exists.patch back.
  - Revert back to default CFLAGS. _GNU_SOURCE not needed any more.


author: Steve Traylen <steve.traylen@cern.ch> - 0.5.11-1
changelog:
  - Upstream 0.5.11
  - Use upstream's systemd files.
  - Fix incorrect dates in changelogs.
  - Fix systemd scriptlets #850219
  - Use buildroot macro everywhere.


author: Ray Strode <rstrode@redhat.com> - 40.9-18
changelog:
  - Don't allow applications on other workspaces to steal
    focus, unless their timestamps are pristine
    Resolves: RHEL-29537


author: Jonas Ådahl <jadahl@redhat.com> - 40.9-20
changelog:
  - Fix positioning when using always-on-top windows
    Resolves: RHEL-45998
  - Improve handling of always-on-visible-workspace windows
    Resolves: RHEL-45366


author: Jonas Ådahl <jadahl@redhat.com> - 40.9-22
changelog:
  - Fix crash when moving window while switching workspace
    Resolves: RHEL-62997
  - Improve app discovery for workspace logic
    Resolves: RHEL-63000


author: Adam Jackson <ajax@redhat.com> 3.4.1-3
changelog:
  - mutter-never-slice-shape-mask.patch, mutter-use-cogl-texrect-api.patch:
    Fix window texturing on hardware without ARB_texture_non_power_of_two
    (#813648)


author: Kalev Lember <kalevlember@gmail.com> - 3.9.92-2
changelog:
  - Update the description and URL
  - Tighten -devel subpackage deps with _isa
  - Use the make_install macro


author: Hans de Goede <hdegoede@redhat.com> - 3.13.90-3
changelog:
  - Add a patch from upstream fixing gnome-shell crashing non stop on
    multi monitor setups (rhbz#1103221)


author: Ray Strode <rstrode@redhat.com> 3.15.3-2
changelog:
  - Add specific BuildRequires for wayland bits, so we don't
    get wayland support by happenstance.
  - Add BuildRequires for autogoo since ./autogen.sh is run as part of
    the build process


author: Ray Strode <rstrode@redhat.com> 3.18.1-4
changelog:
  - Force the cursor visible on vt switches after setting
    the crtc to workaround that qxl bug from before in a
    different situation
    Related: #1273247


author: David Herrmann <dh.herrmann@gmail.com> - 3.30.1-2
changelog:
  - Reduce 'dbus-x11' dependency to 'dbus'. The xinit script are no longer the
    canonical way to start dbus, but the 'dbus' package is nowadays required to
    provide a user and system bus to its dependents.


author: Kenneth Topp <toppk@bllue.org> - 3.34.0-4
changelog:
  - Backport a patch to prevent crash during animations
  - See upstream issue https://gitlab.gnome.org/GNOME/mutter/issues/815


author: Kenneth Topp <toppk@bllue.org> - 3.34.0-5
changelog:
  - Backport fix for dual special modifier keys bug (#1754867)
  - Backport fix that enables core dumps (#1748145)


author: Adam Williamson <awilliam@redhat.com> - 3.34.1-2
changelog:
  - Backport multiple fixes for F31 FE/blocker bugs:
    MR #832 for #1749433 (also needs change in gnome-shell)
    MR #840 for #1760254
    MR #848 for #1751646 and #1759644
    MR #842 for #1758873


author: Florian Müllner <fmuellner@redhat.com> - 3.35.1-3
changelog:
  - Enable sysprof support
    The required dependency was missing from rawhide when the feature
    landed, but there's no reason for keeping it disabled nowadays


author: Bastien Nocera <bnocera@redhat.com> - 3.35.92-2
changelog:
  + mutter-3.35.92-2
  - Fix wayland session not starting up, see https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1103


author: Olivier Fourdan <ofourdan@redhat.com> - 40.0~alpha.1.1-3
changelog:
  - Add build dependency on Xwayland-devel package (from Xwayland standalone)
  - Do not explicitly disable initfd support.


author: Kalev Lember <klember@redhat.com> - 40.0-4
changelog:
  - Fix enter, space, backspace keys not working with input methods (#1942294)
  - Drop old obsoletes and conflicts


author: Jarod Wilson <jarod@redhat.com> 2.3-4
changelog:
  - Clean up build/linker commands to better propagate distro-wide flags
  - Explicitly disable ftb, blcr and fuse to prevent rpath flag creep
  - Related: rhbz#1624147


author: Jarod Wilson <jarod@redhat.com> 2.3-5
changelog:
  - Add missing Provides: mpi and Requires: environment-modules to base mvapich2 package
  - Resolves: rhbz#1647177


author: Honggang Li <honli@redhat.com> - 2.3.3-1
changelog:
  - Update to upstream stable point release v2.3.3
  - Fix floating point exception for non-NUMA machine
  - Resolves: rhbz#1815962, rhbz#1814296


author: Honggang Li <honli@redhat.com> - 2.3.4-1
changelog:
  - Update to upstream stable point release v2.3.4
  - Build against hwloc-2.2.0
  - Resolves: rhbz#1850084


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 2.3.7.1-1.0.1
changelog:
  - Fix compile issue for better compatibility for both gcc-8 & gcc-10
  - 1000-mvapich2-anolis-add-typedef-cycles_t.patch (liusn@superred.com.cn)


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.30-1
changelog:
  - Update to MySQL 8.0.30
  - Remove patches now upstream:
    chain certs, s390 and robin hood
  - Add a new plugin 'conflicting_variables.so'


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.34-1
changelog:
  - Update to MySQL 8.0.34
  - Add patch from upstream bug#110569
  - Add patch to fix binlog format issue
  - Use --skip-combinations over --binlog-format=mixed
  - Add alignment patch upstream bug#110752


author: zhangbinchen <zhangbinchen@openanolis.org> - 8.0.41-1.0.1
changelog:
  - remove check_testsuite
  - redefine ignore_testsuite_result
  - Support loongarch64 platform (liwei.glw@openanolis.org)
  - skip have_32bits_time test on loongarch64 (liwei.glw@openanolis.org)
  - fix main.derived_condition_pushdown test (rb01097748@alibaba-inc.com)
  - fix loaddata_special test for loongarch64 (rb01097748@alibaba-inc.com)


author: Jos Vos <jos@xos.nl>
changelog:
  - Version 3.22.27 release XOS.1 for LinuX/OS 1.7.0
  - Initial version.
  - Some ideas borrowed from Red Hat Powertools 6.1, although this spec
    file is a full rewrite from scratch.


author: Jos Vos <jos@xos.nl>
changelog:
  - Version 3.22.27 release XOS.2 for LinuX/OS 1.7.1
  - Add post(un)install scripts for updating ld.so.conf (client subpackage).


author: Jos Vos <jos@xos.nl>
changelog:
  - Version 3.22.32 release XOS.1 for LinuX/OS 1.8.0
  - Upgrade from version 3.22.27 to 3.22.32.
  - Do "make install" instead of "make install-strip", because "install -s"
    now appears to fail on various scripts.  Afterwards, strip manually.
  - Reorganize subpackages, according to common Red Hat packages: the client
    program and shared library become the base package and the server and
    some accompanying files are now in a separate server package.  The
    server package implicitly requires the base package (shared library),
    but we have added a manual require tag anyway (because of the shared
    config file, and more).
  - Rename the mysql-benchmark subpackage to mysql-bench.


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - update to 3.23.20
  - use %configure, %makeinstall, %{_tmppath}, %{_mandir},
    %{_infodir}, /etc/init.d
  - remove the bench package
  - change some of the descriptions a little bit
  - fix the init script
  - some compile fixes
  - specify mysql user
  - use mysql uid 27 (postgresql is 26)
  - don't build on ia64


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - 3.23.21
  - remove file from /etc/sysconfig
  - Fix initscript a bit - initialization of databases doesn't
    work yet
  - specify the correct licenses
  - include a /etc/my.conf (empty, FTTB)
  - add conditional restart to spec file


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - try the new compiler again
  - build the SQL daemon statically
  - add compile time support for complex charsets
  - enable assembler
  - more cleanups in initscript


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - don't build the SQL daemon statically (glibc problems)
  - fix the logrotate script - only flush log if mysql
    is running
  - change the reloading procedure 
  - remove icon - glint is obsolete a long time ago


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - don't run ldconfig -n, it doesn't update ld.so.cache
    (#16034)
  - include some missing binaries
  - use safe_mysqld to start the server (request from
    mysql developers)


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - rename config file to /etc/my.cnf, which is what
    mysqld wants... doh. (#17432)
  - include a changed safe_mysqld, so the pid file option
    works.
  - make mysql dir world readable to they can access the
    mysql socket. (#17432)
  - 3.23.24


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - 3.23.26, which among other fixes now uses mkstemp()
    instead of tempnam().
  - revert changes made yesterday, the problem is now
    isolated


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - check for negative niceness values, and negate it
    if present (#17899)
  - redefine optflags on IA32 FTTB


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - bzipped source
  - changed from 85 to 78 in startup, so it starts before
    apache (which can use modules requiring mysql)


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - 3.23.30
  - do an explicit chmod on /var/lib/mysql in post, to avoid
    any problems with broken permissons. There is a report
    of rm not changing this on its own (#22989)


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - add the log file to the rpm database, and make it 0640
    (#24116)
  - as above in logrotate script
  - changes to the init sequence - put most of the data
    in /etc/my.cnf instead of hardcoding in the init script
  - use /var/run/mysqld/mysqld.pid instead of
    /var/run/mysqld/pid
  - use standard safe_mysqld
  - shut down cleaner


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - gettextize
  - move the items in Requires(post): to Requires: in preparation
    for an errata for 7.0 when 3.23.31 is released
  - 3.23.31


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - Make it obsolete our 6.2 PowerTools packages
  - 3.23.36 bugfix release - fixes some security issues
    which didn't apply to our standard configuration
  - Make "make test" part of the build process, except on IA64
    (it fails there)


author: Trond Eivind Glomsrd <teg@redhat.com>
changelog:
  - Reenable test, but don't run them for s390, s390x or ia64
  - Make /etc/my.cnf config(noplace). Same for /etc/logrotate.d/mysqld


author: Trond Eivind Glomsrd <teg@redhat.com> 3.23.41-1
changelog:
  - 3.23.41 bugfix release
  - disable innodb, to avoid the broken updates
  - Use "mysqladmin flush_logs" instead of kill -HUP in logrotate
    script (#51711)


author: Trond Eivind Glomsrd <teg@redhat.com> 3.23.46-1
changelog:
  - 3.23.46
  - use -fno-rtti and -fno-exceptions, and set CXX to increase stability.
    Recommended by mysql developers.


author: Trond Eivind Glomsrd <teg@redhat.com> 3.23.47-4
changelog:
  - Use kill, not mysqladmin, to flush logs and shut down. Thus,
    an admin password can be set with no problems.
  - Remove reload from init script


author: Trond Eivind Glomsrd <teg@redhat.com> 3.23.49-3
changelog:
  - Add the various .cnf examples as doc files to mysql-server (#60349)
  - Don't include manual.ps, it's just 200 bytes with a URL inside (#60349)
  - Don't include random files in /usr/share/mysql (#60349)
  - langify (#60349)


author: Trond Eivind Glomsrd <teg@redhat.com> 3.23.52-2
changelog:
  - Add --enable-local-infile to configure - a new option
    which doesn't default to the old behaviour (#72885)


author: Patrick Macdonald <patrickm@redhat.com> 3.23.57-1
changelog:
  - revert to prior version of MySQL due to license incompatibilities
    with packages that link against the client.  The MySQL folks are
    looking into the issue.


author: Tom Lane <tgl@redhat.com> 3.23.58-8
changelog:
  - repair logfile attributes in %files, per bug #102190
  - repair quoting problem in mysqlhotcopy, per bug #112693
  - repair missing flush in mysql_setpermission, per bug #113960
  - repair broken error message printf, per bug #115165
  - delete mysql user during uninstall, per bug #117017
  - rebuilt


author: Tom Lane <tgl@redhat.com> 3.23.58-11
changelog:
  - fix low-priority security issues CAN-2004-0388, CAN-2004-0381, CAN-2004-0457
    (bugs #119442, 125991, 130347, 130348)
  - fix bug with dropping databases under recent kernels (bug #124352)


author: Tom Lane <tgl@redhat.com> 3.23.58-12
changelog:
  - fix multilib problem with mysqlbug and mysql_config
  - adjust chkconfig priority per bug #128852
  - remove bogus quoting per bug #129409 (MySQL 4.0 has done likewise)
  - add sleep to mysql.init restart(); may or may not fix bug #133993


author: Tom Lane <tgl@redhat.com> 3.23.58-13
changelog:
  - fix security issues CAN-2004-0835, CAN-2004-0836, CAN-2004-0837
    (bugs #135372, 135375, 135387)
  - fix privilege escalation on GRANT ALL ON `Foo\_Bar` (CAN-2004-0957)


author: Tom Lane <tgl@redhat.com> 4.1.7-4
changelog:
  - Turn off old_passwords in default /etc/my.cnf file, for better compatibility
    with mysql 3.x clients (per suggestion from Joe Orton).


author: Tom Lane <tgl@redhat.com> 4.1.7-6
changelog:
  - Fix init script to not need a valid username for startup check (bz#142328)
  - Fix init script to honor settings appearing in /etc/my.cnf (bz#76051)
  - Enable SSL (bz#142032)


author: Tom Lane <tgl@redhat.com> 4.1.10-2
changelog:
  - Need -fno-strict-aliasing in at least one place, probably more.
  - Work around some C spec violations in mysql.


author: Tom Lane <tgl@redhat.com> 4.1.10a-1
changelog:
  - Update to MySQL 4.1.10a to fix security vulnerabilities (bz#150868,
    for CAN-2005-0711, and bz#150871 for CAN-2005-0709, CAN-2005-0710).


author: Tom Lane <tgl@redhat.com> 4.1.11-1
changelog:
  - Update to MySQL 4.1.11 to fix bz#152911 as well as other issues
  - Move perl-DBI, perl-DBD-MySQL dependencies to server package (bz#154123)
  - Override configure thread library test to suppress HAVE_LINUXTHREADS check
  - Fix BDB failure on s390x (bz#143537)
  - At last we can enable "make test" on all arches


author: Tom Lane <tgl@redhat.com> 4.1.11-2
changelog:
  - Avoid dependency on <asm/atomic.h>, cause it won't build anymore on ia64.
    This is probably a cleaner solution for bz#143537, too.


author: Tom Lane <tgl@redhat.com> 4.1.11-3
changelog:
  - Enable openssl tests during build, per bz#155850
  - Might as well turn on --disable-dependency-tracking


author: Tom Lane <tgl@redhat.com> 4.1.12-1
changelog:
  - Update to MySQL 4.1.12 (includes a fix for bz#158688, bz#158689)
  - Extend mysql-test-ssl.patch to solve rpl_openssl test failure (bz#155850)
  - Update mysql-lock-ssl.patch to match the upstream committed version
  - Add --with-isam to re-enable the old ISAM table type, per bz#159262
  - Add dependency on openssl-devel per bz#159569
  - Remove manual.txt, as upstream decided not to ship it anymore;
    it was redundant with the mysql.info file anyway.


author: Tom Lane <tgl@redhat.com> 4.1.12-2
changelog:
  - Fix buffer overflow newly exposed in isam code; it's the same issue
    previously found in myisam, and not very exciting, but I'm tired of
    seeing build warnings.


author: Tom Lane <tgl@redhat.com> 5.0.16-1
changelog:
  - Update to MySQL 5.0.16
  - Add EXCEPTIONS-CLIENT license info to the shipped documentation
  - Make my_config.h architecture-independent for multilib installs;
    put the original my_config.h into my_config_$ARCH.h
  - Add -fwrapv to CFLAGS so that gcc 4.1 doesn't break it


author: Tom Lane <tgl@redhat.com> 5.0.18-4
changelog:
  - Modify multilib header hack to not break non-RH arches, per bug #181335
  - Remove logrotate script, per bug #180639.
  - Add a new mysql-test RPM to carry the regression test files;
    hack up test scripts as needed to make them run in /usr/share/mysql-test.


author: Tom Lane <tgl@redhat.com> 5.0.22-1
changelog:
  - Update to MySQL 5.0.22 (fixes CVE-2006-2753)
  - Install temporary workaround for gcc bug on s390x (bz #193912)


author: Tom Lane <tgl@redhat.com> 5.0.22-2
changelog:
  - Work around brew's tendency not to clean up failed builds completely,
    by adding code in mysql-testing.patch to kill leftover mysql daemons.


author: Tom Lane <tgl@redhat.com> 5.0.27-1
changelog:
  - Update to MySQL 5.0.27 (see CVE-2006-4031, CVE-2006-4226, CVE-2006-4227)
  Resolves: #202247, #202675, #203427, #203428, #203432, #203434, #208641
  - Fix init script to return status 1 on server start timeout
  Resolves: #203910
  - Move mysqldumpslow from base package to mysql-server
  Resolves: #193559
  - Adjust link options for BDB module
  Resolves: #199368


author: Tom Lane <tgl@redhat.com> 5.0.33-1
changelog:
  - Update to MySQL 5.0.33
  - Install band-aid fix for "view" regression test designed to fail after 2006
  - Don't chmod -R the entire database directory tree on every startup
  Related: #221085
  - Fix unsafe use of install-info
  Resolves: #223713
  - Cope with new automake in F7
  Resolves: #224171


author: Tom Lane <tgl@redhat.com> 5.0.37-1
changelog:
  - Update to MySQL 5.0.37
  Resolves: #231838
  - Put client library into a separate mysql-libs RPM to reduce dependencies
  Resolves: #205630


author: Tom Lane <tgl@redhat.com> 5.0.37-2
changelog:
  - Use a less hacky method of getting default values in initscript
  Related: #233771, #194596
  - Improve packaging of mysql-libs per suggestions from Remi Collet
  Resolves: #233731
  - Update default /etc/my.cnf ([mysql.server] has been bogus for a long time)


author: Tom Lane <tgl@redhat.com> 5.0.45-1
changelog:
  - Update to MySQL 5.0.45
  Resolves: #246535
  - Move mysql_config's man page to base package
  Resolves: #245770
  - move my_print_defaults to base RPM, for consistency with Stacks packaging
  - mysql user is no longer deleted at RPM uninstall
  Resolves: #241912


author: Tom Lane <tgl@redhat.com> 5.0.45-2
changelog:
  - Update License tag to match code.
  - Work around recent Fedora change that makes "open" a macro name.


author: Tom Lane <tgl@redhat.com> 5.0.45-4
changelog:
  - Seems we need explicit BuildRequires on gawk and procps now
  - Rebuild to fix Fedora toolchain issues


author: Tom Lane <tgl@redhat.com> 5.0.45-7
changelog:
  - Unbelievable ... upstream still thinks that it's a good idea to have a
    regression test that is guaranteed to begin failing come January 1.
  - ... and it seems we need to raise STACK_MIN_SIZE again too.


author: Tom Lane <tgl@redhat.com> 5.0.45-9
changelog:
  - Fix the stack overflow problem encountered in January.  It seems the real
  issue is that the buildfarm machines were moved to RHEL5, which uses 64K not
  4K pages on PPC, and because RHEL5 takes the guard area out of the requested
  thread stack size we no longer had enough headroom.
  Related: #435337


author: Dennis Gilmore <dennis@ausil.us> 5.0.45-10
changelog:
  - add sparc64 to 64 bit arches for test suite checking
  - add sparc, sparcv9 and sparc64 to multilib handling


author: Tom Lane <tgl@redhat.com> 5.0.45-11
changelog:
  - Fix mysql-stack-guard patch to work correctly on IA64
  - Fix mysql.init to wait correctly when socket is not in default place
  Related: #435494


author: Tom Lane <tgl@redhat.com> 5.0.51a-2
changelog:
  - Enable ndbcluster support
  Resolves: #163758
  - Suppress odd crash messages during package build, caused by trying to
    build dbug manual (which we don't install anyway) with dbug disabled
  Resolves: #437053
  - Improve mysql.init to pass configured datadir to mysql_install_db,
    and to force user=mysql for both mysql_install_db and mysqld_safe.
  Related: #450178


author: Tom Lane <tgl@redhat.com> 5.0.67-1
changelog:
  - Update to mysql version 5.0.67
  - Move mysql_config's man page to base package, again (apparently I synced
    that change the wrong way while importing specfile changes for ndbcluster)


author: Tom Lane <tgl@redhat.com> 5.0.67-2
changelog:
  - Build the "embedded server" library, and package it in a new sub-RPM
    mysql-embedded, along with mysql-embedded-devel for devel support files.
  Resolves: #149829


author: Tom Lane <tgl@redhat.com> 5.1.30-1
changelog:
  - Update to MySQL 5.1.30.  Note that this includes an ABI break for
    libmysqlclient (it's now got .so major version 16).
  - This also updates mysql for new openssl build


author: Tom Lane <tgl@redhat.com> 5.1.30-2
changelog:
  - hm, apparently --with-innodb and --with-ndbcluster are still needed
    even though no longer documented ...


author: Tom Lane <tgl@redhat.com> 5.1.33-1
changelog:
  - Update to MySQL 5.1.33.
  - Disable use of pthread_setschedparam; doesn't work the way code expects.
  Related: #477624


author: Tom Lane <tgl@redhat.com> 5.1.34-1
changelog:
  - Update to MySQL 5.1.34, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-34.html
  - Increase startup timeout per bug #472222


author: Tom Lane <tgl@redhat.com> 5.1.35-1
changelog:
  - Update to MySQL 5.1.35, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-35.html
  - Ensure that /var/lib/mysql is created with the right SELinux context
  Resolves: #502966


author: Tom Lane <tgl@redhat.com> 5.1.36-1
changelog:
  - Update to MySQL 5.1.36, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-36.html


author: Tom Lane <tgl@redhat.com> 5.1.37-1
changelog:
  - Update to MySQL 5.1.37, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-37.html


author: Tom Lane <tgl@redhat.com> 5.1.37-2
changelog:
  - Add a couple of patches to improve the probability of the regression tests
    completing in koji builds


author: Tom Lane <tgl@redhat.com> 5.1.37-4
changelog:
  - Remove one misguided patch; turns out I was chasing a glibc bug
  - Temporarily disable "main.mysql" test; there's something broken there too,
    but we need to get mysql built in rawhide for dependency reasons


author: Tom Lane <tgl@redhat.com> 5.1.37-5
changelog:
  - Work around unportable assumptions about stpcpy(); re-enable main.mysql test
  - Clean up some obsolete parameters to the configure script


author: Tom Lane <tgl@redhat.com> 5.1.39-1
changelog:
  - Update to MySQL 5.1.39, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-39.html


author: Tom Lane <tgl@redhat.com> 5.1.39-3
changelog:
  - Work around two different compiler bugs on sparc, one by backing off
    optimization from -O2 to -O1, and the other with a klugy patch
  Related: #529298, #529299
  - Clean up bogosity in multilib stub header support: ia64 should not be
    listed (it's not multilib), sparc and sparc64 should be


author: Tom Lane <tgl@redhat.com> 5.1.40-1
changelog:
  - Update to MySQL 5.1.40, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-40.html
  - Do not force the --log-error setting in mysqld init script
  Resolves: #533736


author: Tom Lane <tgl@redhat.com> 5.1.41-1
changelog:
  - Update to MySQL 5.1.41, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html
    including fixes for CVE-2009-4019
  Related: #540906
  - Don't set old_passwords=1; we aren't being bug-compatible with 3.23 anymore
  Resolves: #540735


author: Tom Lane <tgl@redhat.com> 5.1.42-1
changelog:
  - Update to MySQL 5.1.42, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-42.html
  - Start mysqld_safe with --basedir=/usr, to avoid unwanted SELinux messages
  Resolves: #547485


author: Tom Lane <tgl@redhat.com> 5.1.42-2
changelog:
  - Disable building the innodb plugin; it tickles assorted gcc bugs and
    doesn't seem entirely ready for prime time anyway.


author: Tom Lane <tgl@redhat.com> 5.1.42-3
changelog:
  - Remove static libraries (.a files) from package, per packaging guidelines
  - Change %define to %global, per packaging guidelines


author: Tom Lane <tgl@redhat.com> 5.1.42-7
changelog:
  - Add backported patch for CVE-2008-7247 (upstream bug 39277)
  Related: #543619
  - Use non-expired certificates for SSL testing (upstream bug 50702)


author: Tom Lane <tgl@redhat.com> 5.1.43-1
changelog:
  - Update to MySQL 5.1.43, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-43.html


author: Tom Lane <tgl@redhat.com> 5.1.43-2
changelog:
  - Remove mysql-cluster, which is no longer supported by upstream in this
    source distribution.  If we want it we'll need a separate SRPM for it.


author: Tom Lane <tgl@redhat.com> 5.1.44-1
changelog:
  - Update to MySQL 5.1.44, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-44.html
  - Remove mysql.info, which is not freely redistributable
  Resolves: #560181
  - Revert broken upstream fix for their bug 45058
  Resolves: #566547


author: Tom Lane <tgl@redhat.com> 5.1.44-2
changelog:
  - Add "Obsoletes: mysql-cluster" to fix upgrade-in-place from F-12
  - Bring init script into some modicum of compliance with Fedora/LSB standards
  Related: #557711
  Related: #562749


author: Tom Lane <tgl@redhat.com> 5.1.45-1
changelog:
  - Update to MySQL 5.1.45, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-45.html


author: Tom Lane <tgl@redhat.com> 5.1.45-2
changelog:
  - Fix multiple problems described in upstream bug 52019, because regression
    tests fail on PPC if we don't.


author: Tom Lane <tgl@redhat.com> 5.1.46-1
changelog:
  - Update to MySQL 5.1.46, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-46.html


author: Tom Lane <tgl@redhat.com> 5.1.47-1
changelog:
  - Update to MySQL 5.1.47, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-47.html
    including fixes for CVE-2010-1848, CVE-2010-1849, CVE-2010-1850
  Resolves: #592862
  Resolves: #583717
  - Create mysql group explicitly in pre-server script, to ensure correct GID
  Related: #594155


author: Tom Lane <tgl@redhat.com> 5.1.47-2
changelog:
  - Add back "partition" storage engine
  Resolves: #597390
  - Fix broken "federated" storage engine plugin
  Related: #587170
  - Read all certificates in SSL certificate files, to support chained certs
  Related: #598656


author: Tom Lane <tgl@redhat.com> 5.1.48-1
changelog:
  - Update to MySQL 5.1.48, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-48.html
    including a fix for CVE-2010-2008
  Related: #614214


author: Tom Lane <tgl@redhat.com> 5.1.48-2
changelog:
  - Duplicate COPYING and EXCEPTIONS-CLIENT in -libs and -embedded subpackages,
    to ensure they are available when any subset of mysql RPMs are installed,
    per revised packaging guidelines
  - Allow init script's STARTTIMEOUT/STOPTIMEOUT to be overridden from sysconfig
  Related: #609734


author: Tom Lane <tgl@redhat.com> 5.1.50-1
changelog:
  - Update to MySQL 5.1.50, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-50.html
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html


author: Tom Lane <tgl@redhat.com> 5.1.50-2
changelog:
  - Include my_compiler.h in distribution, per upstream bug #55846.
    Otherwise PHP, for example, won't build.


author: Tom Lane <tgl@redhat.com> 5.1.51-1
changelog:
  - Update to MySQL 5.1.51, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html


author: Tom Lane <tgl@redhat.com> 5.1.52-1
changelog:
  - Update to MySQL 5.1.52, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html
  Resolves: #646569


author: Tom Lane <tgl@redhat.com> 5.5.8-1
changelog:
  - Update to MySQL 5.5.8 (major version bump).  Note this includes removal
    of libmysqlclient_r.so.
  - Add a linker version script to hide libmysqlclient functions that aren't
    part of the documented API.


author: Tom Lane <tgl@redhat.com> 5.5.8-3
changelog:
  - my_print_help, load_defaults, free_defaults, and handle_options all turn
    out to be documented/recommended in Paul DuBois' MySQL book, so we'd better
    consider them part of the de-facto API.
  Resolves: #666728


author: Tom Lane <tgl@redhat.com> 5.5.8-6
changelog:
  - Remove no-longer-needed special switches in CXXFLAGS, per yesterday's
    discussion in fedora-devel about -fexceptions.
  - Rebuild needed anyway to check compatibility with latest systemtap.


author: Tom Lane <tgl@redhat.com> 5.5.8-8
changelog:
  - PPC64 floating-point differences are not masked by -ffloat-store after all,
    so let's just disable gis regression test till upstream makes it less picky
  Resolves: #674253
  - Add __perllib_requires setting to make rpm 4.9 do what we need


author: Tom Lane <tgl@redhat.com> 5.5.8-9
changelog:
  - Support s390/s390x in performance schema's cycle-counting functions
    (needed to make regression tests pass on these platforms)


author: Tom Lane <tgl@redhat.com> 5.5.9-1
changelog:
  - Update to MySQL 5.5.9, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-9.html
  - Add %{?_isa} to cross-subpackage Requires, per latest packaging guidelines


author: Tom Lane <tgl@redhat.com> 5.5.10-1
changelog:
  - Update to MySQL 5.5.10, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-10.html
    Note that this includes a rather belated soname version bump for
    libmysqlclient.so, from .16 to .18
  - Add tmpfiles.d config file so that /var/run/mysqld is recreated at boot
    (only needed in Fedora 15 and later)
  Resolves: #658938


author: Tom Lane <tgl@redhat.com> 5.5.10-2
changelog:
  - Add my_make_scrambled_password to the list of symbols exported by
    libmysqlclient.so.  Needed at least by pure-ftpd.


author: Tom Lane <tgl@redhat.com> 5.5.10-3
changelog:
  - Add LSB init block to initscript, to ensure sane ordering at system boot
  Resolves: #703214
  - Improve initscript start action to notice when mysqladmin is failing
    because of configuration problems
  Related: #703476
  - Remove exclusion of "gis" regression test, since upstream bug 59908
    is fixed (for some value of "fixed") as of 5.5.10.


author: Tom Lane <tgl@redhat.com> 5.5.12-1
changelog:
  - Update to MySQL 5.5.12, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-12.html


author: Tom Lane <tgl@redhat.com> 5.5.13-1
changelog:
  - Update to MySQL 5.5.13, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-13.html


author: Tom Lane <tgl@redhat.com> 5.5.14-1
changelog:
  - Update to MySQL 5.5.14, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-14.html


author: Tom Lane <tgl@redhat.com> 5.5.14-2
changelog:
  - Remove make_scrambled_password and make_scrambled_password_323 from mysql.h,
    since we're not allowing clients to call those functions anyway
  Related: #690346


author: Tom Lane <tgl@redhat.com> 5.5.15-2
changelog:
  - Update to MySQL 5.5.15, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-15.html


author: Tom Lane <tgl@redhat.com> 5.5.16-2
changelog:
  - Update to MySQL 5.5.16, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-16.html


author: Honza Horak <hhorak@redhat.com> 5.5.16-4
changelog:
  - Don't assume all ethernet devices are named ethX
  Resolves: #682365
  - Exclude user definition from my.cnf, user is defined in mysqld.service now
  Resolves: #661265


author: Tom Lane <tgl@redhat.com> 5.5.17-1
changelog:
  - Update to MySQL 5.5.17, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-17.html
  - Get rid of version-number assumption in sysv-to-systemd conversion trigger


author: Tom Lane <tgl@redhat.com> 5.5.18-1
changelog:
  - Update to MySQL 5.5.18, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-18.html


author: Tom Lane <tgl@redhat.com> 5.5.19-1
changelog:
  - Update to MySQL 5.5.19, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-19.html


author: Tom Lane <tgl@redhat.com> 5.5.20-1
changelog:
  - Update to MySQL 5.5.20, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-20.html
    as well as security fixes described at
    http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
  Resolves: #783828
  - Re-include the mysqld logrotate script, now that it's not so bogus
  Resolves: #547007


author: Tom Lane <tgl@redhat.com> 5.5.20-2
changelog:
  - Revise our test-disabling method to make it possible to disable tests on a
    platform-specific basis, and also to get rid of mysql-disable-test.patch,
    which broke in just about every upstream update (Honza Horak)
  - Disable cycle-counter-dependent regression tests on ARM, since there is
    not currently any support for that in Fedora ARM kernels
  Resolves: #773116
  - Add some comments to mysqld.service documenting how to customize it
  Resolves: #785243


author: Tom Lane <tgl@redhat.com> 5.5.21-1
changelog:
  - Update to MySQL 5.5.21, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-21.html
  - Hack openssl regression test to still work with rawhide's openssl
  - Fix assorted failures in post-install regression tests (mysql-test RPM)
  Resolves: #789530


author: Honza Horak <hhorak@redhat.com> 5.5.21-2
changelog:
  - Fix ssl-related tests to specify expected cipher explicitly
  Related: #789600
  - Fix several strcpy calls to check destination size


author: Honza Horak <hhorak@redhat.com> 5.5.21-3
changelog:
  - Revise mysql_plugin test patch so it moves plugin files to
    a temporary directory (better solution to #789530)


author: Tom Lane <tgl@redhat.com> 5.5.22-1
changelog:
  - Update to MySQL 5.5.22, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-22.html
  - Turn on PrivateTmp in service file
  Resolves: #782513
  - Comment out the contents of /etc/logrotate.d/mysqld, so that manual
    action is needed to enable log rotation.  Given the multiple ways in
    which the rotation script can fail, it seems imprudent to try to make
    it run by default.
  Resolves: #799735


author: Tom Lane <tgl@redhat.com> 5.5.23-1
changelog:
  - Update to MySQL 5.5.23, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-23.html


author: Tom Lane <tgl@redhat.com> 5.5.24-1
changelog:
  - Update to MySQL 5.5.24, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-24.html
    including the fix for CVE-2012-2122
  Resolves: #830680
  - Tweak logrotate script to put the right permissions on mysqld.log
  - Minor specfile fixes for recent packaging guidelines changes


author: Tom Lane <tgl@redhat.com> 5.5.25a-1
changelog:
  - Update to MySQL 5.5.25a, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-25a.html
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-25.html
  - Don't use systemd's Restart feature; rely on mysqld_safe instead
  Resolves: #832029


author: Tom Lane <tgl@redhat.com> 5.5.27-1
changelog:
  - Update to MySQL 5.5.27, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-27.html


author: Tom Lane <tgl@redhat.com> 5.5.28-1
changelog:
  - Update to MySQL 5.5.28, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-28.html
  - Clean up partially-created database files when mysql_install_db fails
  Related: #835131
  - Honor user and group settings from service file in mysqld-prepare-db-dir
  Resolves: #840431
  - Export THR_KEY_mysys as a workaround for inadequate threading support
  Resolves: #846602
  - Adopt new systemd macros for server package install/uninstall triggers
  Resolves: #850222
  - Use --no-defaults when invoking mysqladmin to wait for the server to start
  Related: #855704


author: Tom Lane <tgl@redhat.com> 5.5.28-2
changelog:
  - Add patch for CVE-2012-5611
  Resolves: #883642
  - Widen DH key length from 512 to 1024 bits to meet minimum requirements
    of FIPS 140-2
  Related: #877124


author: Honza Horak <hhorak@redhat.com> 5.5.28-3
changelog:
  - Rebase patches to not leave backup files when not applied smoothly
  - Use --no-backup-if-mismatch to prevent including backup files


author: Tom Lane <tgl@redhat.com> 5.5.29-1
changelog:
  - Update to MySQL 5.5.29, for various fixes described at
    http://dev.mysql.com/doc/refman/5.5/en/news-5-5-29.html
  - Fix inaccurate default for socket location in mysqld-wait-ready
  Resolves: #890535


author: Honza Horak <hhorak@redhat.com> 5.5.29-2
changelog:
  - Provide own symbols with real- prefix to distinguish packages from other
    MySQL implementations unambiguously


author: Honza Horak <hhorak@redhat.com> 5.5.30-1
changelog:
  - Update to MySQL 5.5.30, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-30.html


author: Honza Horak <hhorak@redhat.com> 5.5.30-4
changelog:
  - Allow server to be installed without client side
  - Separate -lib and -common sub-packages
  - Fix some path issues in tests


author: Honza Horak <hhorak@redhat.com> 5.5.30-5
changelog:
  - Renaming package MySQL to community-mysql to handle issues
    introduced by case-insensitive operations of yum and for proper
    prioritizing mariadb over community-mysql


author: Honza Horak <hhorak@redhat.com> 5.5.31-1
changelog:
  - Update to MySQL 5.5.31, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-31.html


author: Honza Horak <hhorak@redhat.com> 5.5.31-5
changelog:
  - Remove mysql provides from devel sub-packages to not build against
    community-mysql if mysql-devel is specified


author: Honza Horak <hhorak@redhat.com> 5.5.31-7
changelog:
  - Use /var/tmp as default tmpdir to prevent potential issues
    Resolves: #905635
  - Fix test suite requirements
  - Fix for CVE-2013-1861 backported from MariaDB
    Resolves: #921836


author: Honza Horak <hhorak@redhat.com> 5.5.32-1
changelog:
  - Update to MySQL 5.5.32, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html


author: Honza Horak <hhorak@redhat.com> 5.5.32-4
changelog:
  - Remove external man pages, upstream fixed man pages license
  - Apply fixes found by Coverity static analysis tool


author: Honza Horak <hhorak@redhat.com> 5.5.32-10
changelog:
  - Copy some generated files in order find-debuginfo.sh finds them
    Related: #729040
  - Fix systemd and perl requirements


author: Honza Horak <hhorak@redhat.com> 5.5.33-1
changelog:
  - Update to MySQL 5.5.33, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-33.html


author: Honza Horak <hhorak@redhat.com> 5.6.14-1
changelog:
  - Update to MySQL 5.6.14, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-14.html
  - Incorporate changes done by Bjorn Munch <bjorn.munch@oracle.com>


author: Honza Horak <hhorak@redhat.com> 5.6.15-1
changelog:
  - Update to MySQL 5.6.15, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-15.html


author: Honza Horak <hhorak@redhat.com> 5.6.15-3
changelog:
  - Disable tests for ppc(64) and s390(x):
    innodb.innodb_ctype_ldml main.ctype_ldml main.ps_ddl main.ps_ddl1
    Related: #1056972


author: Honza Horak <hhorak@redhat.com> 5.6.15-4
changelog:
  Fix for CVE-2014-0001
    Resolves: #1059545
  - Don't test EDH-RSA-DES-CBC-SHA cipher, it seems to be removed from openssl
    which now makes mariadb/mysql FTBFS because openssl_1 test fails
    Related: #1044565


author: Bjorn Munch <bjorn.munch@oracle.com> 5.6.16-1
changelog:
  - Update to MySQL 5.6.16, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-16.html
  - Patches now upstream: tmpdir, cve-2013-1861, covscan-signexpr,
    covscan-stroverflow
  - Fixed upstream: innodbwarn
  - ldconfig needed in embedded subpackage
  - Remove unused generate-tarball.sh from tree
  - Rediff mysql-install patch
  - Make symvers 18 default, provide symvers 16 for backward compat
    (bz #1045013)
  - Man page patch disabled due too many conflicts
  - Memcached build patched to not remove -Werror=<something> in CFLAGS


author: Bjorn Munch <bjorn.munch@oracle.com> 5.6.17-1
changelog:
  - Update to MySQL 5.6.17, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-17.html
  - libmysqld built as shared lib now supported upstream
  - Remove patches now upstream: truncate-file, rhbz1059545, ssltest
    and regex-werror
  - Use more standard (and tested) build flags, while still respect
    optflags and hardened_build
  - libmysqlclient_r* symlinks are fixed upstream
  - Remove sysv to systemd logic
  - Rework skipping of arch specific tests
  - Multiple mtr sessions are supported by default


author: Bjorn Munch <bjorn.munch@oracle.com> - 5.6.19-1
changelog:
  - Update to MySQL 5.6.19, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-19.html
  - outfile_loaddata resolved on all archs
  - Solaris files not installed, no need to remove
  - Simplify multilib install
  - Use install's -D option some places
  - Add explicit conflict with mariadb-galera-server


author: Honza Horak <hhorak@redhat.com> - 5.6.19-3
changelog:
  - Add mysql-compat-server symbol, common symbol for arbitrary MySQL
    implementation
  - Require /etc/my.cnf instead of shipping it
  - Server requires any compatible mysql-compat-client package


author: Honza Horak <hhorak@redhat.com> - 5.6.19-4
changelog:
  - Port some latest changes from MariaDB package to sync those packages
  - Error messages now provided by a separate package (thanks Alexander Barkov)


author: Honza Horak <hhorak@redhat.com> - 5.6.19-5
changelog:
  - Hardcoded paths removed to work fine in chroot
  - Spec rewrite to be more similar to oterh MySQL implementations
  - Include SysV init script if built on older system
  - Add possibility to not ship some sub-packages
  - Port scripts for systemd unit from MariaDB


author: Bjorn Munch <bjorn.munch@oracle.com> - 5.6.20-1
changelog:
  - Update to MySQL 5.6.20, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-20.html
  - Rebase install and pluginerrmsg patch
  - Drop dos2unix from buildreq, files fixed upstream
  - No need to add -O3, it's default
  - LDFLAGS is passed by cmake option, not from environment
  - Using __requires_exclude in conditional don't seems to work, swap
    to dist macros
  - Avoid unwanted dtrace dep
  - Fix mysql.init and mysql-prepare-db-dir
  - Logfile name must match value from /etc/my.cnf (and be known
    by SELinux policy)


author: Honza Horak <hhorak@redhat.com> - 5.6.20-5
changelog:
  - Fix paths in mysql_install_db script
    Related: #1134328
  - Use %cmake macro
  - Install systemd service file on RHEL-7+
    Server requires any mysql package, so it should be fine with older client


author: Honza Horak <hhorak@redhat.com> - 5.6.20-1
changelog:
  - Update to MySQL 5.6.21, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-21.html


author: Honza Horak <hhorak@redhat.com> - 5.6.21-3
changelog:
  - Check upgrade script added to warn about need for mysql_upgrade
  - Move mysql_plugin into base and errmsg-utf8.txt into -errmsg to correspond
    with MariaDB upstream packages
  - Add with_debug option


author: Bjorn Munch <bjorn.munch@oracle.com> - 5.6.23-1
changelog:
  - Update to MySQL 5.6.23, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-23.html
  - Expired certs patch now obsolete
  - Fixed changelog
  - Refreshed file contents patch
  - Man pages fixed upstream
  - Fix typo in server.cnf.in


author: Honza Horak <hhorak@redhat.com> - 5.6.23-3
changelog:
  - Expand paths in perl scripts in mysql-test
  - Use correct path in install_db script warning
  - Use --no-defaults when checking server status before starting


author: Honza Horak <hhorak@redhat.com> - 5.6.23-4
changelog:
  - Do not use scl prefix more than once in paths
    Based on https://www.redhat.com/archives/sclorg/2015-February/msg00038.html
  - Check permissions when starting service on RHEL-6
    Resolves: #1194699
  - Wait for daemon ends
    Related: #1072958


author: Honza Horak <hhorak@redhat.com> - 5.7.10-2
changelog:
  - Use mysqld instead of mysqld_safe (mysqld_safe not necessary for 5.7)
    Use mysqld --initialize-insecure instead of mysql_install_db
    Create /var/lib/mysql-files (used by secure-file-priv)
      http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_secure_file_priv
    Remove unnecessary Perl dependencies (mysqlhotcopy was removed in 5.7)
    Thanks Norvald H. Ryeng


author: Honza Horak <hhorak@redhat.com> - 5.7.11-1
changelog:
  - Update to 5.7.11
    Thanks to Norvald H. Ryeng
    Removing tar ball with boost and using mysql tar ball with boost bundled


author: Norvald H. Ryeng <norvald.ryeng@oracle.com> - 5.7.13-1
changelog:
  - Update to MySQL 5.7.13, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-13.html


author: Norvald H. Ryeng <norvald.ryeng@oracle.com> - 5.7.14-1
changelog:
  - Update to MySQL 5.7.14, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-14.html
  - Remove patches for bugs fixed upstream
  - Fix for bug #79378 (buf_block_align)
  - Fix for bug #82426 (build failure with system liblz4)
  - Further reduce list of tests known to fail on certain platforms
  - Set check_testsuite to 0 to make sure the build fails if any tests fail


author: Norvald H. Ryeng <norvald.ryeng@oracle.com> - 5.7.15-1
changelog:
  - Update to MySQL 5.7.15, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html
  - Remove patches now upstream (buf_block_align,  lz4)
  - perl(JSON) needed for tests
  - Adjust list of problematic tests


author: Norvald H. Ryeng <norvald.ryeng@oracle.com> - 5.7.16-1
changelog:
  - Update to MySQL 5.7.16, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-16.html


author: Norvald H. Ryeng <norvald.ryeng@oracle.com> - 5.7.17-1
changelog:
  - Update to MySQL 5.7.17, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-17.html
  - Add new plugin: connnection_control.so
  - Add MySQL Group Replication: group_replication.so
  - Add numactl-devel to buildreq and enable NUMA support (if available)
  - Simplify boost path
  - Build compat-openssl10 in rawhide for now
  - Reqs. in -devel packages was incomplete


author: Michal Schorm <mschorm@redhat.com> - 5.7.17-4
changelog:
  - Fix of broken cross mysql-mariadb dependecies
  - Fix of community-mysql server-client dependecy
  - Testsuite retry count lifted to 3 tries


author: Norvald H. Ryeng <norvald.ryeng@oracle.com> - 5.7.18-1
changelog:
  - Update to MySQL 5.7.18, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-18.html
  - Remove patch for test fix now upstream
  - Sample my-*.cnf is gone


author: Michal Schorm <mschorm@redhat.com> - 5.7.18-2
changelog:
  - 'force' option for 'rm' removed in specfile
  - CVEs fixed by previous commit, #1443407:
    CVE-2017-3308 CVE-2017-3309 CVE-2017-3329 CVE-2017-3450
    CVE-2017-3453 CVE-2017-3456 CVE-2017-3461 CVE-2017-3462
    CVE-2017-3463 CVE-2017-3464 CVE-2017-3599 CVE-2017-3600


author: Norvald H. Ryeng <norvald.ryeng@oracle.com> - 5.7.19-1
changelog:
  - Update to MySQL 5.7.19, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-19.html
  - Use new --report-unstable-tests to handle unstable tests
  - Prefer /run over /var/run (#1462688)
  - Resolves: #1462688; /run
                                      - CVE fixes: #1472716
              CVE-2017-3633, CVE-2017-3634, CVE-2017-3635, CVE-2017-3641, CVE-2017-3647
              CVE-2017-3648, CVE-2017-3649, CVE-2017-3651, CVE-2017-3652, CVE-2017-3653


author: Michal Schorm <mschorm@redhat.com> - 5.7.19-2
changelog:
  - Replication tests in the testsuite enabled, they don't fail anymore
  - Retry count in the testsuite dropped to 0


author: Honza Horak <hhorak@redhat.com> - 5.7.19-5
changelog:
  - Allow to use MD5 in FIPS mode
    Related: #1449689
  - Remove snippets from mysql-preparep-db-dir.sh that could have security impact
    Do not run parts of SysV init script as root if possible
    Related: CVE-2017-3312
  - Include mysqld@.service file and do not run start scripts in the unit file as root


author: Honza Horak <hhorak@redhat.com> - 5.7.19-6
changelog:
  - Add bundled(boost) virtual provide
  - Support --defaults-group-suffix option in systemd unit file
    Related: #1400702


author: Norvald H. Ryeng <norvald.ryeng@oracle.com> - 5.7.20-1
changelog:
  - Update to MySQL 5.7.20, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-20.html
  - Move all test binaries to -test package
  - Dont ship unneeded man pages on systemd platforms
  - Remove mysql_config_editor from -devel package, shipped in client
  - CVE fixes: #1503701
              CVE-2017-10155 CVE-2017-10227 CVE-2017-10268 CVE-2017-10276 CVE-2017-10279
              CVE-2017-10283 CVE-2017-10286 CVE-2017-10294 CVE-2017-10314 CVE-2017-10378
              CVE-2017-10379 CVE-2017-10384


author: Michal Schorm <mschorm@redhat.com> - 5.7.20-4
changelog:
  - Provide subackage with a client static library
    Needed by mysql-connector-odbc package
  - Remove Group tag as it shouldn't be used anymore


author: Norvald H. Ryeng <norvald.ryeng@oracle.com> - 5.7.21-1
changelog:
  - Update to MySQL 5.7.21, for various fixes described at
    https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-21.html
  - Add rpcgen to buildrep
  - Add support for libtirpc
  - Fix for various CVEs listed on
    http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
  - Add fix for libxcrypt - do not assume "crypt()" function is provided by glibc
    Resolves: #1536881
  - Fix obsoletes using isa macro, remove the line entirely
    Resolves: #1537210


author: Fedora Release Engineering <releng@fedoraproject.org> - 5.7.21-2
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
  - Removed 'static' library subpackage


author: Michal Schorm <mschorm@redhat.com> - 5.7.22-1
changelog:
  - Rebase to 5.7.22 version
  - CVE fixes: #1568963
              CVE-2018-2755 CVE-2018-2758 CVE-2018-2759 CVE-2018-2761 CVE-2018-2762
              CVE-2018-2766 CVE-2018-2769 CVE-2018-2771 CVE-2018-2773 CVE-2018-2775
              CVE-2018-2776 CVE-2018-2777 CVE-2018-2778 CVE-2018-2779 CVE-2018-2780
              CVE-2018-2781 CVE-2018-2782 CVE-2018-2784 CVE-2018-2786 CVE-2018-2787
              CVE-2018-2810 CVE-2018-2812 CVE-2018-2813 CVE-2018-2816 CVE-2018-2817
              CVE-2018-2818 CVE-2018-2819 CVE-2018-2839 CVE-2018-2846


author: Norvald H. Ryeng <norvald.ryeng@oracle.com> - 8.0.11-2
changelog:
  - MySQL 8.0 has notify support
  - SQL restart command needs MYSQLD_PARENT_PID=1
  - Increase LimitNOFILE
  - Disable symbolic links is default (and option deprecated)
  - Move mysqld to /usr/bin, with mysqld_safe gone there no reason
    to have mysqld in libexec
  - FIPS mode is now supported:
     https://dev.mysql.com/doc/refman/8.0/en/fips-mode.html
  - Remove legacy embedded refs from cnf files
  - Clean up patches: re-numbering and removing
  - Recommend to use systemctl edit to modify service files


author: Honza Horak <hhorak@redhat.com> - 8.0.11-5
changelog:
  - Move log file to a directory owned by mysql user
    Resolves: #1590369
  - Use explicitly openssl-devel as dependency for -devel sub-package


author: Michal Schorm <mschorm@redhat.com> - 8.0.12-1
changelog:
  - Rebase to MySQL 8.0.12
  - Fix the SYS_NICE capabilities
  - Add requires for the semanage binary
  - CVEs fixed: CVE-2018-3054 CVE-2018-3056 CVE-2018-3060 CVE-2018-3062
    CVE-2018-3064 CVE-2018-3065 CVE-2018-3077 CVE-2018-3081 CVE-2018-3067
    CVE-2018-3073 CVE-2018-3074 CVE-2018-3075 CVE-2018-3078 CVE-2018-3079
    CVE-2018-3080 CVE-2018-3082 CVE-2018-3084


author: Michal Schorm <mschorm@redhat.com> - 8.0.12-3
changelog:
  - Add bundled ICU version
  - Add a patch for the 'mysql_com.h' header file
  - Use system mecab tool
  - Use RPATH for mysqld, so we can later set capabilities


author: Michal Schorm <mschorm@redhat.com> - 8.0.12-6
changelog:
  - Fix the default configuration of the server, so it uses same authentication
    method as MySQL 5.7
    Resolves: #1631400


author: Michal Schorm <mschorm@redhat.com> - 8.0.13-1
changelog:
  - Rebase to 8.0.13
  - ICU patch removed; upstreamed
  - Patch for MySQL Router introduced. Do not build it.
  - Fixes for annocheck hardening
    Resolves: #1624148
  - CVEs fixed:
    CVE-2018-3276 CVE-2018-3200 CVE-2018-3137 CVE-2018-3284 CVE-2018-3195
    CVE-2018-3173 CVE-2018-3212 CVE-2018-3279 CVE-2018-3162 CVE-2018-3247
    CVE-2018-3156 CVE-2018-3161 CVE-2018-3278 CVE-2018-3174 CVE-2018-3282
    CVE-2018-3285 CVE-2018-3187 CVE-2018-3277 CVE-2018-3144 CVE-2018-3145
    CVE-2018-3170 CVE-2018-3186 CVE-2018-3182 CVE-2018-3133 CVE-2018-3143
    CVE-2018-3283 CVE-2018-3171 CVE-2018-3251 CVE-2018-3286 CVE-2018-3185
    CVE-2018-3280 CVE-2018-3203 CVE-2018-3155


author: Matej Mužila <mmuzila@redhat.com> - 8.0.17-1
changelog:
  - Rebase to 8.0.17
  - Resolves: #1732043
  - CVEs fixed:
    CVE-2019-2737 CVE-2019-2738 CVE-2019-2739 CVE-2019-2740 CVE-2019-2741
    CVE-2019-2743 CVE-2019-2746 CVE-2019-2747 CVE-2019-2752 CVE-2019-2755
    CVE-2019-2757 CVE-2019-2758 CVE-2019-2774 CVE-2019-2778 CVE-2019-2780
    CVE-2019-2784 CVE-2019-2785 CVE-2019-2789 CVE-2019-2791 CVE-2019-2795
    CVE-2019-2796 CVE-2019-2797 CVE-2019-2798 CVE-2019-2800 CVE-2019-2801
    CVE-2019-2802 CVE-2019-2803 CVE-2019-2805 CVE-2019-2808 CVE-2019-2810
    CVE-2019-2811 CVE-2019-2812 CVE-2019-2814 CVE-2019-2815 CVE-2019-2819
    CVE-2019-2822 CVE-2019-2826 CVE-2019-2830 CVE-2019-2834 CVE-2019-2879


author: Lukas Javorsky <ljavorsk@redhat.com> - 8.0.21-1
changelog:
  - Rebase to 8.0.21
  - Use bundled libzstd and libevent for RHSCL and RHEL-8.0.0
  - Check that we have correct versions in bundled(*) Provides
  - Remove re2 bundled dependency


author: Lukas Javorsky <ljavorsk@redhat.com> - 8.0.22-1
changelog:
  - Update to MySQL 8.0.22
  - mysql-certs-expired.patch patched by upstream
  - New zlib_decompress binary file in test package


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.23-1
changelog:
  - Update to MySQL 8.0.23
  - Created mysql-fix-includes-robin-hood.patch
  - Created mysql-main-cast.patch


author: Packit <hello@packit.dev> - 1.0.9-1
changelog:
  - Revert "Attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705" This reverts commit de84778e555b891fd9ea5f3111c87a4990650d6c. (Michal Schorm)
  - Resolves rhbz#2250360


author: Michal Schorm <mschorm@redhat.com> - 1.0.1-1
changelog:
  - Rebase to 1.0.1 release
    This release is just a sync-up with upstream selinux-policy
  - URL changed to a new upstream repository


author: Caolán McNamara <caolanm@redhat.com> - 3.0-22
changelog:
  - Related: rhbz#1604911 convert python2 to python3, verified
    that output th_en_US_v2.dat and th_en_US_v2.idx are identical
    before and after


author: Caolán McNamara <caolanm@redhat.com> - 0.20150304-1
changelog:
  - Resolves: rhbz#1197184 berlios has disappeared, but rla-es seems
    active, and using e.g. "a priori" as an example LibreOffice suggests
    a non-corrupted set of suggestions


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 2.13.01-3
changelog:
  - Fix use-after-free and heap buffer overflow vulnerabilities
  - Resolves: CVE-2017-10686, CVE-2017-11111


author: Michael Simacek <msimacek@redhat.com> - 2.13.02-1
changelog:
  - Update to upstream version 2.13.02
  - Resolves: CVE-2017-17810, CVE-2017-17811, CVE-2017-17812, CVE-2017-17813,
    CVE-2017-17814, CVE-2017-17815, CVE-2017-17816, CVE-2017-17817,
    CVE-2017-17818, CVE-2017-17819, CVE-2017-17820


author: Richard W.M. Jones <rjones@redhat.com> - 1.4.2-4
changelog:
  - Remove misguided LDFLAGS hack which removed server hardening.
    https://bugzilla.redhat.com/show_bug.cgi?id=1624149#c6
    resolves: rhbz#1624149


author: Josef Ridky <jridky@redhat.com> - 1:5.8-27
changelog:
  - fix memory leak due of proc file creating (#2105957)
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
  - fix memory leak when ipv6 disable set to 1 (#2151537)
  - fix proxy timeout issue (#2160723)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-30
changelog:
  - fix crash when configured as proxy - issue 82 (RHEL-14454)
  - log once truncating issue (RHEL-13597)
  - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808,
    CVE-2022-24809 and CVE-2022-24810 (RHEL-26650)


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - tkmib doco had #!/usr/bin/perl55
  - include snmpcheck and tkmib again (still needs some CPAN module, however).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - don't depend on /etc/init.d so that package will work with 6.2.
  - perl path fiddles no longer needed.
  - rely on brp-compress frpm rpm to compress man pages.
  - patch from ucd-snmp CVS (Wes Hardaker).
  - configure.in needs to check for rpm libraries correctly (#23033).
  - add simple logrotate script (#21399).
  - add options to create pidfile and log with syslog with addresses (#23476).


author: Matt Wilson <msw@redhat.com>
changelog:
  - configure with --enable-reentrant and added "smux" and "agentx" to
    --with-mib-modules= argument (#29626)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Updated to 4.2.1. Removed 2 obsolete patches (fromcvs and #18153)
  - Include /usr/share/snmp/snmpconf in %files


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Enabled IPv6 support (RFE #47764)
  - Hopefully final fix of snmpwalk problem (#42153). Thanks to Douglas Warzecha
    for the patch and Matt Domsch for reporting the problem.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Removed tkmib from the package once again as we don't ship the Tk.pm CPAN
    perl module required to run it (#49363)
  - Added missing Provides for the .so.0 libraries as rpm doesn't seem to find
    those during the build anymore (it used to) (#46388)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a couple of security issues:
    o /tmp race and setgroups() privilege problem
    o Various buffer overflow and format string issues.
    o One signedness problem in ASN handling.
  - Fixed an important RFE to support bcm5820 cards. (#51125)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Final bcm5820 fix. Last one was broken.
  - Fixed bugzilla bug (#51960) where the binaries contained rpath references.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a server segfault for snmpset operation (#53640). Thanks to Josh Giles
    and Wes Hardaker for the patch.


author: Phil Knirsch <phil@redhat.de> 4.2.3-1
changelog:
  - Update to 4.2.3 final.
  - Fixed libtool/rpath buildroot pollution problem.
  - Fixed library naming problem.


author: Phil Knirsch <pknirsch@redhat.com> 4.2.3-4
changelog:
  - Added the snmptrapd init script as per request (#49205)
  - Fixed the again broken rpm query stuff (#57444)
  - Removed all old and none-used db related stuff (libs and header checks/files)


author: Phil Knirsch <pknirsch@redhat.com> 5.0.1-5
changelog:
  - Added --enable-ucd-snmp-compatibility for compatibility with older version
    and fixed installation thereof.
  - Got rid of the perl(Tk) dependancy by removing snmpcheck.
  - Include /usr/include/ucd-snmp in the filelist.
  - Fixed a problem with the ucd-snmp/version.h file.


author: Phil Knirsch <pknirsch@redhat.com> 5.0.8-2
changelog:
  - Hack to make it build on 64bit platforms with /usr/lib64 correctly.
  - Fixed bug #85071 (leak of open descriptors for ipv6).


author: Phil Knirsch <pknirsch@redhat.com> 5.0.9-1
changelog:
  - Updated to latest upstream version net-snmp-5.0.9
  - Added patch to fix net-snmp-perl problems (#105842).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-1
changelog:
  - Updated to latest net-snmp-5.1 upstream version.
  - Tons of specfile and patch cleanup.
  - Cleaned up perl stuff (mib2c etc, see #107707).
  - Added lm_sensors support patch for x86 archs from Kaj J. Niemi (#107618).
  - Added support for custom mib paths and mibs to snmptrapd initscript (#102762)


author: Phil Knirsch <pknirsch@redhat.com> 5.1-2
changelog:
  - Included BuildPrereq on lm_sensors-devel on x86 archs (#110616).
  - Fixed deprecated initscript options (#110618).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-3
changelog:
  - Removed snmpcheck again, needs perl(Tk) which we don't ship (#111194).
  - Fixed getopt definition in include file (#111209).
  - Included Kaj J. Niemi's patch for broken perl module (#111319).
  - Included Kaj J. Niemi's patch for broken async getnext perl call (#111479).
  - Included Kaj J. Niemi's patch for broken hr_storage (#111502).


author: Phil Knirsch <pknirsch@redhat.com> 5.1-9
changelog:
  - Reverted removal of _includir redefiniton due to php-snmp dependancy.
  - Remove SO_BSDCOMPAT setsockopt() call, deprecated.


author: Phil Knirsch <pknirsch@redhat.com> 5.1-12
changelog:
  - Hacked an ugly perl hack to get rid of perl RPATH problems.
  - Fixed 64bit patch and applied it. ;-)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.1-2
changelog:
  - Added Kaj J. Niemi that fixes ipAdEntIfIndex problem (#119106)
  - Added Kaj J. Niemi to shut up memshared message for 2.6 kernel (#119203)


author: Radek Vokal <rvokal@redhat.com> 5.1.2-4
changelog:
  - New prereq for net-snmp-devel
  - lelf check removed from configure.in (#128748)
  - fixed snmpd coredump when sent SIGHUP (#127314)


author: Phil Knirsch <pknirsch@redhat.com> 5.1.2-9
changelog:
  - Droped obsolete lm-sensors patch and enabled lmSensors module
  - Marked several patches to be removed for 5.1.3


author: Radek Vokal <rvokal@redhat.com> 5.1.2-12
changelog:
  - snmpd crash with 'interfaces' directives in snmpd.conf fixed #139010
  - rather dirty patch fixing conf directory for net-snmp-config


author: Radek Vokal <rvokal@redhat.com> - 5.1.2-3
changelog:
  - patch from CVS - kill extra carriage return (#144917)
  - removed patch for interface indexing - doesn't show virtual interfaces


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-5
changelog:
  - 64bit needed some changes, was causing timeouts on 64bit archs!? 
  - affects bugs #125432 and #132058


author: Radek Vokal <rvokal@redhat.com> - 5.2.1-12
changelog:
  - session free fixed, agentx modules build fine (#157851)
  - fixed dependency for net-snmp libs (#156932)


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-0.rc6.1
changelog:
  - update to rc6, snmpnetstat changes due to license problems
  - persistent files in directory defined by snmp.conf persistentDir are 
    loaded at startup


author: Radek Vokal <rvokal@redhat.com> - 5.2.2-4
changelog:
  - check for header files in configure
  - patch for SNMPv3 traps / session user creation (net-snmp bz#1374087)


author: Radek Vokal <rvokal@redhat.com> 5.3-2
changelog:
  -  Security fix. Bug granting write access to read-only users 
     or communities which were configured  using the "rocommunity" 
     or "rouser" snmpd.conf tokens fixed


author: Radek Vokál <rvokal@redhat.com> 5.3-7
changelog:
  - fix parsing of /proc/diskstats
  - fix disman monitor crash
  - fix perl vendor name
  - fix OID lookup fail


author: Radek Vokal <rvokal@redhat.com> 5.3.1.pre2-1
changelog:
  - update to 5.3.1.pre2
  - fix multilib issues (#192736)
    On system with /usr/lib64 use net-snmp-config64 and net-snmp-config64.h


author: Radek Vokal <rvokal@redhat.com> 5.3.1.0-5
changelog:
  - SMUX support is still needed .. will disappear later!
  - static libs should be in devel not libs (#203571)
  - fix lm_sensors issues


author: Radek Vokál <rvokal@redhat.com> - 1:5.4-13
changelog:
  - fix overly verbose log message (#221911)
  - few minor tweaks for review - still not perfect
  - fix linking with lcrypto (#231805)


author: Jan Safranek <jsafranek@redhat.com> 5.4-14
changelog:
  - fix snmptrapd hostname logging (#238587)
  - fix udpEndpointProcess remote IP address (#236551)
  - fix -M option of net-snmp-utils (#244784)
  - default snmptrapd.conf added (#243536)
  - fix crash when multiple exec statements have the same name
    (#243536)
  - fix ugly error message when more interfaces share
    one IP address (#209861)


author: Jan Safranek <jsafranek@redhat.com> 5.4-16
changelog:
  - supported lm_sensors on ppc64 (#249255)
  - snmpconf generates config files with proper selinux context
    (#247462)
  - fix leak  in udp transport (#247771)
  - add alpha to supported archs in net-snmp-config (#246825)
  - fix hrSWInst (#250237)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-3
changelog:
  - include these tables: ip-mib/ipv4InterfaceTable
    ip-mib/ipv6InterfaceTable, ip-mib/ipAddressPrefixTable
  - fix Requires of net-snmp-devel to include lmsensors-devel on supported
    architectures


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-5
changelog:
  - move mib2c-update from net-snmp-utils to net-snmp-perl, where
    mib2c is located
  - add tkmib to net-snmp-gui package (#167933)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-6
changelog:
  - add support of lm_sensors v3
  - added procps to build dependencies (#380321)
  - removed beecrypt from dependencies
  - fixed crash on reading xen interfaces (#386611)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-9
changelog:
  - introduce /etc/sysconfig/snmpd. Use it to specify snmpd command line options.
    /etc/snmp/snmpd.options is not used anymore (#431391)


author: Jan Safranek <jsafranek@redhat.com> 5.4.1-15
changelog:
  - explicitly require lm_sensor > 3 for build (#442718)
  - create multilib net-snmp-config on multilib architectures only


author: Jan Safranek <jsafranek@redhat.com> 5.4.2-2
changelog:
  - redistribute the perl scripts to the net-snmp package,
    net-snmp-utils doesn't depend on perl now (#462484)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-1
changelog:
  - explicitly require the right version and release of net-snmp and
    net-snmp-libs
  - update to net-snmp-5.4.2.1 to fix CVE-2008-4309


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-12
changelog:
  - make the default configuration less noisy, i.e. do not print "Connection from
    UDP:" and "Received SNMP packet(s) from UDP:" messages on each connection.
    (#509055)


author: Jan Safranek <jsafranek@redhat.com> 5.4.2.1-13
changelog:
  - package cleanup, remove unnecessary patches
  - move local state file from /var/net-snmp/ to /var/lib/net-snmp


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-2
changelog:
  - introduce /etc/sysconfig/snmptrapd. Use it to specify snmptrapd command
    line options.  /etc/snmp/snmptrapd.options is not used anymore (#540799)
  - build-in ipAddressPrefixTable, ipDefaultRouterTable, ipv6ScopeZoneIndexTable,
    ipIfStatsTable, SCTP-MIB, RMON-MIB and Etherlike-MIBs
  - remove ucd5820stat helper script, it depends on get5820stats, which is not
    available in Fedora
  - move sample services ipf-mod.pl to documentation
  - remove logrotate config, snmpd logs into syslog


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-3
changelog:
  - prepare the .spec file for review
  - run automatic regression suite after the compilation of the package
    to check for obvious regressions
  - remove unnecessary package dependencies


author: Jan Safranek <jsafrane@redhat.com> 1:5.5-4
changelog:
  - fix udpTable indexes on big-endian systems (#543352)
  - fix snmptrapd init script to survive with empty /etc/sysconfig/snmptrapd
  - lower the default log level of snmpd to get rid of the debug messages


author: Jan Safranek <jsafrane@redhat.com> - 1:5.6-5
changelog:
  - re-create /var/run/net-snmp on boot using tmpfiles.d (#656637)
  - move snmp-bridge-mib and net-snmp-cert utilities to net-snmp-perl
    subpackage, net-snmp-utils subpackage does not depend on Perl now


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7-2
changelog:
  - restored rpath in net-snmp-config output - SNMP subagent won't link
    with libsnmpagent.so without it, linker needs to know location
    of libperl.so
  - fixed check section to make tests pass on machine without DNS


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7-6
changelog:
  - added new net-snmp-agent-libs subpackage with agent libraries
    -> net-snmp-libs do not need perl and lm_sensors libs
  - removed libsnmp.so, it's not used in Fedora (#729811)
  - added README.systemd
  - added new net-snmp-sysvinit subpackage with legacy init scripts
    (#718183)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.1-1
changelog:
  - updated to 5.7.1:
    - Fixed the mib-parsing-bug introduced shortly before 5.7
    - fixed rounding errors for disk percentage calculations
    - Many other miscellaneous minor bug fixes


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.1-10
changelog:
  - Updated RPM scriplets with latest systemd-rpm macros (#850403).
  - Fixed fedora-review tool complaints.


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-3
changelog:
  - Added direct dependency on perl-devel with architectute in
    net-snmp-devel package to pull proper dependencies.


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-6
changelog:
  - fixed net-snmp-create-v3-user to have the same content on all architectures
  - /var/lib/net-snmp/mib_indexes and cert_indexes added to net-snmp-libs
    (#906761)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-10
changelog:
  - moved agentxtrap utility to net-snmp subpackage,
    it needs libraries provided by net-snmp-agent-libs.


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-13
changelog:
  - set permissions of snmpd.conf and snmptrapd conf to 0600 to prevent
    users from reading passwords and community strings.


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-16
changelog:
  - Fixed snmpd crashing when AgentX subagent disconnects in the middle of
    request processing (#1038011)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-23
changelog:
  - Fixed CVE-2014-3565
  - Fixed net-snmp-cert tool, now it does not depend on net-snmp-devel (#1134475)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.3-13
changelog:
  - net-snmp.redhat.conf: update default configuration to conform to the best practices (#1359123)
  - nmp_transport.c: use strtok_r for strtok to avoid a race condition (#1366282)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.3-15
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
  - Add support for new version of OpenSSL library (#1423984)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.3-19
changelog:
  - Fix issue with undefined symbol my_progname when try to load NetSNMP::TrapReceiver in perl script. (#1470004)


author: Adam Williamson <awilliam@redhat.com> -1:5.7.3-20
changelog:
  - Edit fix of issue with undefined symbol my_progname when try to load
    NetSNMP::TrapReceiver in perl script (#1470004)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:5.7.3-26
changelog:
  - Python 2 binary package renamed to python2-net-snmp
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Josef Ridky <jridky@redhat.com> - 1:5.7.3-30
changelog:
  - remove Group tag
  - remove sysvinit package and init files (no longer needed)
  - fix python2 references and dependencies in spec file


author: Josef Ridky <jridky@redhat.com> - 1:5.7.3-33
changelog:
  - Fix strstr() crash when looking for RPM Group tag
  - Fix wrong usage of structure iterator
  - Fix issue with statistics from autofs


author: Josef Ridky <jridky@redhat.com> - 1:5.8-2
changelog:
  - fix default configuration file (#1589480 and #1594147)
  - modify permissions for config files (#1601060)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-14
changelog:
  - fix double free or corruption error when freeing security context (#1809077)
  - remove deprecated CFLAG


author: Josef Ridky <jridky@redhat.com> - 1:5.8-15
changelog:
  - proxied OIDs unspecified in proxy statement in snmpd.conf (#1658134)
  - UCD-SNMP-MIB::dskTable doesn't update dynamically (#1658185)
  - expand SNMPCONFPATH variable (#1660146)
  - remove file with Apple license (#1690936)
  - log meningful message on duplicate IP address (#1692286)
  - memory reporting adjustment (#1695497 and #1766521)
  - fix typos in man page (#1700262)
  - speedup ipAddressTable loading(#1700391)
  - fix memory leak when shut down librpm (#1763008)
  - services starts after network-online.target (#1775304)
  - add missing part of memory leak patch (#1829860)
  - add support for AES192 and AES256 (#1846252)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-19
changelog:
  - revert permission of config files to 600 (#1601060)
  - fix error message when the address specified by clientaddr option
    is wrong or cannot be bound (#1877375)
  - log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
  - fix issue with quoting empty passphrase (#1817225)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-21
changelog:
  - prevent parsing IP address twice (#1768908)
  - add support for digests detected from ECC certs (#1919714)
  - fix broken ErrorMsg at ucd-snmp (#1933150)
  - add support for intermediate certs (#1914656)
  - fix crash of certs with longer extension (#1908718)


author: Tomáš Mráz <tmraz@redhat.com> - 3.4-4
changelog:
  - Cover the gaps in annotation coverage for assembler sources
  - Add .hmac checksums for FIPS mode integrity checking


author: Daiki Ueno <dueno@redhat.com> - 3.4.1-5
changelog:
  - Backport powerpc64 optimization patches from upstream (#1855228)
    Patch from Christopher M. Riedl.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.52.20-4
changelog:
  - Python 2 binary package renamed to python2-newt
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-8
changelog:
  - rename newt-python3 subpackage to python3-newt
  - build python3 subpackage unconditionally
  - don't use unversioned python_sitearch macro
  - drop static subpackage
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - fix description of python2-newt


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-10
changelog:
  - move snack provides to python3-newt subpackage (#1640153)
  - fix radio button selection check in snack (#1714517)


author: Phil Sutter <psutter@redhat.com> [0.9.3-21.el8]
changelog:
  - tests: shell: Fix bogus testsuite failure with 100Hz (Phil Sutter) [1919203]
  - doc: nft.8: Extend monitor description by trace (Phil Sutter) [1820365]
  - include: missing sctp_chunk.h in Makefile.am (Phil Sutter) [1979334]
  - exthdr: Implement SCTP Chunk matching (Phil Sutter) [1979334]
  - scanner: sctp: Move to own scope (Phil Sutter) [1979334]
  - scanner: introduce start condition stack (Phil Sutter) [1979334]
  - json: Simplify non-tcpopt exthdr printing a bit (Phil Sutter) [1979334]
  - json: tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcpopt: allow to check for presence of any tcp option (Phil Sutter) [1979334]
  - tcpopt: split tcpopt_hdr_fields into per-option enum (Phil Sutter) [1979334]
  - tcpopt: rename noop to nop (Phil Sutter) [1979334]
  - tcpopts: clean up parser -> tcpopt.c plumbing (Phil Sutter) [1979334]
  - parser: merge sack-perm/sack-permitted and maxseg/mss (Phil Sutter) [1979334]
  - tests/py: Move tcpopt.t to any/ directory (Phil Sutter) [1979334]


author: Phil Sutter <psutter@redhat.com> [0.9.3-22.el8]
changelog:
  - json: Drop pointless assignment in exthdr_expr_json() (Phil Sutter) [1999059]
  - parser_json: Fix for memleak in tcp option error path (Phil Sutter) [1999059]
  - parser_bison: Fix for implicit declaration of isalnum (Phil Sutter) [1999059]
  - parser_json: Fix error reporting for invalid syntax (Phil Sutter) [1994141]


