# changelog

author: Caolán McNamara <caolanm@redhat.com> - 1.1.5.3-3
changelog:
  - Resolves: rhbz#240696 extend encoding patch to promote and add
    dictionary 8bit WORDCHARS to the ucs-2 word char list


author: Caolán McNamara <caolanm@redhat.com> - 1.1.5.3-5
changelog:
  - fix memory leak
    http://sourceforge.net/tracker/index.php?func=detail&aid=1745263&group_id=143754&atid=756395


author: Caolán McNamara <caolanm@redhat.com> - 1.1.6-1
changelog:
  - latest version
  - drop integrated hunspell-1.1.4-defaultdictfromlang.patch
  - drop integrated hunspell-1.1.5-badheader.patch
  - drop integrated hunspell-1.1.5.encoding.patch


author: Kristian Høgsberg <krh@redhat.com> - 1.2.4.2-2
changelog:
  - Drop ABI breaking hunspell-1.2.2-xulrunner.pita.patch and fix the
    hunspell include in xulrunner.


author: Caolán McNamara <caolanm@redhat.com> - 1.2.8-2
changelog:
  - Resolves: rhbz#471085 in ispell compatible mode (-a), ignore
    -m option which means something different to ispell


author: Caolán McNamara <caolanm@redhat.com> - 1.2.12-1
changelog:
  - latest version
  - drop integrated hunspell-1.2.11-valgrind.patch
  - drop integrated hunspell-1.2.11-koreansupport.patch


author: Caolán McNamara <caolanm@redhat.com> - 1.2.13-1
changelog:
  - latest version
  - drop integrated backport.warnings.patch
  - drop integrated backport.rhbz650503.patch


author: Caolán McNamara <caolanm@redhat.com> - 1.3.2-6
changelog:
  - Resolves: rhbz#573516 have hunspell require hunspell-en to ensure
    at least one dictionary exists


author: maciek <maciek@corsair.lan> - 1.3.3-4
changelog:
  - Resolves: rhbz#915448, UTF-8 handling patch from
    http://debbugs.gnu.org/cgi/bugreport.cgi?bug=7781#31


author: Parag Nemade <pnemade AT redhat DOT com> - 0.20080825-12
changelog:
  - Add Supplements: tag for langpacks naming guidelines
  - Clean the specfile to follow current packaging guidelines


author: Michael Stahl <mstahl@redhat.com> - 0.20151222-1
changelog:
  - upgrade to latest version
  - upstream removed "OASIS distribution license agreement 0.1", only GPLv2/v3 now
  - remove needless use of percent-defattr


author: Michael Stahl <mstahl@redhat.com> - 0.20160407-1
changelog:
  - Resolves: rhbz#1344662 upgrade to latest release
  - switch source URL to https
  - revert the GNU grep 2.23 LANG=C bug workaround
  - added explicit build dependency on perl, now required on rawhide


author: Caolán McNamara <caolanm@redhat.com> - 0.20090216-3
changelog:
  - Change two suspicious words with two initial capitals in en_GB
    from ADte TEirtza to ADTe Teirtza


author: Parag Nemade <pnemade AT redhat DOT com> - 5.1-3
changelog:
  - Resolves:rhbz#1967646 - Correct the License: tag to LGPLv3+ based on LICENSE.txt file
  - Added gating tests


author: Caolan McNamara <caolanm@redhat.com> - 2.4-0.4.20070901
changelog:
  - it_IT_README.1st says GPLv2+, but it_IT_README.txt says GPLv3+ -> 
    change license field to GPLv3+


author: Parag Nemade <pnemade AT redhat DOT com> - 1.4.0-1
changelog:
  - Update to 1.4.0 release
  - Update hunspell dictionary directory path
    https://fedoraproject.org/wiki/Changes/Hunspell_dictionary_dir_change
  - Added CI tests


author: Parag <pnemade AT redhat DOT com> - 20080425-7
changelog:
  - Resolves:rh#959987: Error message: “0 is wrong flag id” occurs when using hunspell-ne
  - Resolves:rh#967638: ne_NP.dic contains both CRLF and LF line terminators


author: Parag Nemade <pnemade AT redhat.com> - 0.2.1-2
changelog:
  - Resolves: rh#571710: Fix license tag in spec file with new upstream release
  - Removed CREDITS file as upstream provides now README and LICENSE files.


author: Parag <pnemade@redhat.com> - 0.20050929-3
changelog:
  - Use aspell source instead to pull source as BR:aspell-te
  - Resolves:rh#511262 buildrequires aspell-te


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.1-0
changelog:
  - 1.1 rel# Patch to the 1.1 fix 2967 http://www.open-mpi.org/software/hwloc/nightly/v1.1/hwloc-1.1rc6r2967.tar.bz2
  - Fix hwloc_bitmap_to_ulong right after allocating the bitmap.
  - Fix the minimum width of NUMA nodes, caches and the legend in the graphical lstopo output.
  - Cleanup error management in hwloc-gather-topology.sh.
  - Add a manpage and usage for hwloc-gather-topology.sh on Linux.
  - Rename hwloc-gather-topology.sh to hwloc-gather-topology to be consistent with the upcoming version 1.2ease


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.3-0
changelog:
  - 1.3 release
  - added dependency on libibverbs-devel pciutils-devel
  - cannot provide support for cuda (cuda_runtime_api.h).
  - Nvidia CUDA is free but not open-source therefore not in Fedora.


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.8-2
changelog:
  - Unversioned docdir change, more info on
    https://fedoraproject.org/wiki/Changes/UnversionedDocdirs


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9-1
changelog:
  - Update to 1.9
  - Split out lstopo into a -gui subpackage, so the hwloc base package
    does not pull in all of X.


author: Orion Poplwski <orion@cora.nwra.com> - 1.11.0-1
changelog:
  - Update to version 1.11.0 (fixes bug #1208279)
  - Drop arm patch applied upstream
  - Make hwloc-devel require libibverbs-devel (bug #1191770)
  - Fix man page manipulation (bug #1235954)


author: Michal Schmidt <mschmidt@redhat.com> - 1.11.8-3
changelog:
  - BuildRequire rdma-core-devel on s390(x).
  - Install the hwloc-dump-hwdata.service systemd service on x86/x86_64.


author: Michal Schmidt <mschmidt@redhat.com> - 1.11.9-1
changelog:
  - Update to 1.11.9.
  - BuildRequire gcc, gcc-c++. Drop Group tags.
  - BuildRequire numactl-devel on s390x too.


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.8-2
changelog:
  - Unversioned docdir change, more info on 
    https://fedoraproject.org/wiki/Changes/UnversionedDocdirs


author: Tomas Hozza <thozza@redhat.com> - 0-0.2.20130826git
changelog:
  - Use 'hypervkvpd' directory in libexec for KVP daemon scripts (#1010268)
  - daemons are now WantedBy multi-user.target instead of basic.target (#1010260)


author: Tomas Hozza <thozza@redhat.com> - 0-0.3.20131022git
changelog:
  - rebase to the latest git snapshot next-20130927 (obtained 2013-10-22)
    - KVP, VSS: daemon use single buffer for send/recv
    - KVP: FQDN is obtained on start and cached


author: Tomas Hozza <thozza@redhat.com> - 0-0.5.20140219git
changelog:
  - rebase to the latest git snapshot next-20140219
    - KVP, VSS: removed inclusion of linux/types.h
    - VSS: Ignore VFAT mounts during freeze operation


author: Tomas Hozza <thozza@redhat.com> - 0-0.7.20140611git
changelog:
  - Fix FTBFS (#1106781)
  - Use kernel-headers instead of kernel-devel for building
  - package new Hyper-V fcopy daemon as hypervfcopyd sub-package


author: Tomas Hozza <thozza@redhat.com> - 0-0.8.20140714git
changelog:
  - Update the File copy daemon to the latest git snapshot
  - Fix hyperfcopyd.service to check for /dev/vmbus/hv_fcopy


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.10.20150108git
changelog:
  - Rebase to 3.19-rc3 (20150108 git snapshot)
  - Drop 'nodaemon' patches, use newly introduced '-n' option


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.12.20150702git
changelog:
  - Rebase to 4.2-rc0 (20150702 git snapshot)
  - Switch to new chardev-based communication layer (#1195029)


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.15.20160728git
changelog:
  - Rebase to 4.8-rc0 (20160728 git snapshot)
  - Disable services and remove ConditionVirtualization, multi-user.target
    dependencies switching to udev-only activation (#1331577)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.36.20190303git
changelog:
  - Synchronize RHEL 8 changes [rhbz#1957651]
  - Resolves: rhbz#1957651
    ([Hyper-V][RHEL-9] Update build to rhel format and syncup RHEL 8 content for hyperv-daemons.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.38.20190303git
changelog:
  - hpvd-Enable-build-on-aarch64.patch [bz#2020148]
  - Resolves: bz#2020148
    ([Hyper-V][RHEL9.0][ARM] No hyperv-daemons package built for aarch64 platform)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.39.20190303git
changelog:
  - hpvd-hv_set_ifconfig.sh-Use-nmcli-commands.patch [bz#2026371]
  - hpvd-Use-filename-for-connection-profile.patch [bz#2026371]
  - Resolves: bz#2026371
    ([RHEL9][Hyper-V]The /usr/libexec/hypervkvpd/hv_set_ifconfig need update for RHEL9 since the ifdown/ifup was not supported on RHEL9)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.40.20190303git
changelog:
  - hpvd-hypervkvpd.service-ordering-fixes.patch [bz#2103188]
  - Resolves: bz#2103188
    ([Hyper-V][RHEL-9] hypervkvpd.service service ordering)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.41.20190303git
changelog:
  - hpvd-redhat-hv_set_if_config-Workaround-for-gateway-numbe.patch [bz#2122115]
  - hpvd-tools-hv-Remove-an-extraneous-the.patch [bz#2139457]
  - hpvd-tools-hv-kvp-remove-unnecessary-void-conversions.patch [bz#2139457]
  - Resolves: bz#2122115
    ([Hyper-V][RHEL-9] Cannot set gateway properly when set static IPADDR0,NETMASK0,GATEWAY in ifcfg-eth0)
  - Resolves: bz#2139457
    ([Hyper-V][RHEL9.2] Update Hyper-V-Daemons)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.42.20190303git
changelog:
  - hpvd-vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch [bz#2218931]
  - Resolves: bz#2218931
    ([Hyper-V] [RHEL-9] /usr/sbin/vmbus_testing python script prints: "SyntaxWarning: "is" with a literal.")


author: Caolán McNamara <caolanm@redhat.com> - 2.8.3-4
changelog:
  - Resolves: rhbz#813481 x86_64 valgrind spews, see rhbz#813780
  - Related: rhbz#813481 dump valgrind failure log


author: Caolán McNamara <caolanm@redhat.com> - 0.20140727-1
changelog:
  - rhbz#2085482 update to latest available hyphenation rules
  - rhbz#2084587 add Supplements: langpacks-pt_BR


author: Hans de Goede <j.w.r.degoede@hhs.nl> 3.0.0-3
changelog:
  - Change /dev/i2c-# creation from /lib/udev/devices to /etc/udev/makedev.d
    usage
  - Add an /etc/modprobe.d/i2c-dev file to work around bug 380971


author: Jaromir Capik <jcapik@redhat.com> - 3.1.0-5
changelog:
  - Introducing man pages for binaries in the eepromer subpackage
  - Introducing -r switch in the i2cset help


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.1.2-2
changelog:
  - Provide i2c-dev.h in /usr/include/i2c-tools/
  - Resolves: rhbz#1288823
  - Dropped Group: tags as per https://fedoraproject.org/wiki/Packaging:Guidelines#Tags_and_Sections


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.1.2-5
changelog:
  - Python 2 binary package renamed to python2-i2c-tools
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090211-1
changelog:
  - Add --xim argument in xinput-ibus
  - Add Obsoletes:  ibus-qt <= 1.1.0
  - Move libibus.so.* to ibus-libs to make ibus multilib.
  - Update to 1.1.0.20090211.


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090211-6
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree.
  - The new patch fixes ibus-x11 segfault (#485661).


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090211-10
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree.
  - Put 'Select an input method' in engine select combobox (#485861).


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090225-1
changelog:
  - Update to ibus-1.1.0.20090225.
  - Fix problems in %post and %postun scripts.
  - Hide ibus & ibus preferences menu items.


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090311-1
changelog:
  - Update to ibus-1.1.0.20090311.
  - Update setup ui follow GNOME Human Interface Guidelines 2.2 (#489497).


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090311-2
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree.
  - Fix bug 490009 - Deleting Next Engine shortcuts doesn't work
  - Fix bug 490381 - Change "Next/Previous engine" labels


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090311-3
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree
  - Fix bug 491999 - up/down arrow keys broken in xchat


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090331-1
changelog:
  - Update to ibus-1.1.0.20090331.
  - Fix bug 492956 - screws up keyboard input in firefox
  - Fix bug 490143 - ibus issue with gnome-keyring


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090407-1
changelog:
  - Update to ibus-1.1.0.20090407.
  - Fix bug 491042 - ibus default trigger hotkeys
  - Fix bug 492929 - ibus-hangul can cause gtk app to lockup
  - Fix bug 493701 -  (ibus) imsettings disconnect/reconnect kills gtk app
  - Fix bug 493687 -  ibus-hangul should default to vertical candidate selection
  - Fix bug 493449 -  ibus broke Alt-F2 command auto-completion


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090407-3
changelog:
  - Update the tarball.
  - Fix bug 494511 - ibus-gtk makes gnome-terminal abort 
    when a key is pressed


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090413-2
changelog:
  - Update ibus-HEAD.patch.
  - Change the mode of /tmp/ibus-$USER to 0700 to improve security
  - Change the mode of /tmp/ibus-$USER/socket-address to 0600 to improve security
  - Update as.po


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090413-3
changelog:
  - Update ibus-HEAD.patch.
  - Fix bug 495431 -  ibus Release modifier doesn't work with Alt
  - Fix bug 494445 -  ibus-hangul missing Hangul Han/En mode
    (and Alt_R+release hotkey)
  - Update te.po


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090417-1
changelog:
  - Update to ibus-1.1.0.20090417.
  - Fix bug 496199 -  cannot remove Ctrl+Space hotkey with ibus-setup


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090423-1
changelog:
  - Update to ibus-1.1.0.20090423.
  - Fix bug 497265 - [mai_IN] Maithili language name is not correct.
  - Fix bug 497279 - IBus does not works with evolution correctly.
  - Enhance authentication both in daemon & clients


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090423-2
changelog:
  - Fix bug 498141 - new ibus install needs gtk immodules
  - Separate ibus document from ibus-devel to ibus-devel-docs


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-1
changelog:
  - Update to 1.1.0.20090508
  - Fix bug 499533 - [Indic] ibus should allow input in KDE using all supported Indic locales
  - Fix bug 498352 - hotkey config table should list keys in same order as on main setup page
  - Fix bug 497707 - ibus French translation update


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-2
changelog:
  - Remove requires notification-daemon
  - Fix bug 500588 - Hardcoded requirement for notification-daemon


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-4
changelog:
  - Update ibus-HEAD.patch.
  - Fix bug 501211 - ibus-setup window should be raised if running or just stay on top/grab focus
  - Fix bug 501640 - ibus should adds new IMEs at end of engine list not beginning
  - Fix bug 501644 - [IBus] focus-out and disabled IME should hide language panel


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-5
changelog:
  - Update ibus-HEAD.patch.
  - Show the default input method with bold text
  - Add information text below input methods list


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090609-1
changelog:
  - Update to Update to 1.1.0.20090609
  - Fix bug 502414 - Implemented on-screen help facility
  - Fix bug 502561 - iBus should show keymap name on iBus panel
  - Fix bug 498043 - ibus Alt-grave trigger conflicts with openoffice.org
  - Implemented API for setting labels for candidates in LookupTable


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090612-1
changelog:
  - Update to 1.1.0.20090612
  - Fix bug 504942 - PageUp and PageDown do not work in candidate list
  - Fix bug 491040 - Implememnt mouse selection in candidate list


author: Peng Huang <phuang@redhat.com> - 1.2.0.20090828-1
changelog:
  - Update to 1.2.0.20090828
  - Change the icon on systray.
  - Fix segment fault in ibus_hotkey_profile_destroy
  - Fix some memory leaks.


author: Peng Huang <phuang@redhat.com> - 1.2.0.20090915-1
changelog:
  - Update to 1.2.0.20090915
  - Fix bug 521591 - check if the icon filename is a real file before trying to open it
  - Fix bug 522310 - Memory leak on show/hide
  - Fix bug 509518 - ibus-anthy should only override to jp layout for kana input


author: Peng Huang <phuang@redhat.com> - 1.2.0.20091124-1
changelog:
  - Update to 1.2.0.20091124
  - Update some translations.
  - Fix bug 538147 - [abrt] crash detected in firefox-3.5.5-1.fc12


author: Peng Huang <phuang@redhat.com> - 1.2.0.20091204-1
changelog:
  - Update to 1.2.0.20091204
  - Fix Bug 529920 - language panel pops up on the wrong monitor
  - Fix Bug 541197 - Ibus crash


author: Peng Huang <phuang@redhat.com> - 1.2.0.20091225-1
changelog:
  - Update to 1.2.0.20091225
  - Fix bug 513895 - new IME does not show up in ibus-setup
  - Fix bug 531857 - applet order should correspond with preferences order
  - Fix bug 532856 - should not list already added input-methods in Add selector


author: Peng Huang <phuang@redhat.com> - 1.3.0-3
changelog:
  - Update ibus-HEAD.patch
  - Fix bug - some time panel does not show candidates.
  - Update some po files


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.8-1
changelog:
  - Updated to 1.3.8
  - Added ibus-541492-xkb.patch
    Fixes Bug 541492 - ibus needs to support some xkb layout switching
  - Added ibus-435880-surrounding-text.patch
    Fixes Bug 435880 - ibus-gtk requires surrounding-text support
  - Added ibus-xx-workaround-gtk3.patch
    Workaround for f14 http://koji.fedoraproject.org/koji/taskinfo?taskID=2516604


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20101202-1
changelog:
  - Updated to 1.3.99.20101202
  - Added ibus-530711-preload-sys.patch
    Fixed Bug 530711 - Reload preloaded engines by login


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110117-1
changelog:
  - Updated to 1.3.99.20110117
  - Fixed Bug 666427 - ibus requires dbus-x11
  - Fixed Bug 670137 - QT_IM_MODULE=xim in ibus.conf without ibus-qt


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110228-1
changelog:
  - Updated to 1.3.99.20110228
  - Integrated the part of gjs in Bug 657165 ibus for gnome-shell.
    Added ibus-657165-panel-libs.patch
    Added gnome-shell-ibus-plugins-20110304.tar.bz2
  - Fixed Bug 675503 - a regression in sync mode
    Added ibus-675503-gnome-shell-workaround.patch until gnome-shell is updated.
  - Fixed Bug 677856 - left ibus snooper when im client is switched.
  - Fixed Bug 673047 - abrt ibus_xkb_get_current_layout for non-XKB system
    Updated ibus-541492-xkb.patch


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110408-1
changelog:
  - Updated to 1.3.99.20110408
    Fixed Bug 683484 - Timed out SetEngine when select an engine from panel.
    Fixed Bug 657165 - IBus for gnome-shell for Fedora 15.
  - Upstreamed ibus-657165-panel-libs.patch
  - Removed ibus-675503-gnome-shell-workaround.patch
  - Added ibus-xx-setup-frequent-lang.patch
  - Updated ibus-541492-xkb.patch
    Fixed Bug 696481 - no the variant maps without language codes
  - Added dependency of imsettings-gnome.
    Fixed Bug 696510 - need a dependency in ibus-gtk3 for imsettings-gnome


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110419-1
changelog:
  - Updated to 1.3.99.20110419
  - Added ibus-HEAD.patch
    Fixed Bug 697471 - ibus-gconf zombie when restart ibus from ibus panel.
  - Updated ibus-541492-xkb.patch
    Fixed Bug 701202 - us(dvorak) does not show up in list
    Updated ibus-1.0.pc for ibus-xkb
    Showed XKB variant descriptions only without layout descriptions.
  - Updated ibus-xx-setup-frequent-lang.patch
    Updated UI strings


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110817-3
changelog:
  - Fixed Bug 700472 Use a symbol icon instead of an image icon.
  - Updated ibus-HEAD.patch for upstream.
  - Removed ibus-435880-surrounding-text.patch as upstream.
  - Added ibus-711632-fedora-fallback-icon.patch
    Fixed SEGV with no icon in oxygen-gtk icon theme.
  - Added ibus-xx-bridge-hotkey.patch
    Triaged Bug 707370 SetEngine timeout
    Fixed Bug 731610 Keep IM state when text input focus changes
  - Added transitional ibus-gnome3 package.
    Fixed Bug 718110 Use a shell icon instead of pygtk2 icon.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110817-4
changelog:
  - Updated ibus-gjs 3.1.91.20110908 and 3.0.2.20110908 for gnome-shell.
    Fixed preedit active segments on gnome-shell and X11 apps.
  - Added ibus-xx-g-s-disable-preedit.patch
    Disabled preedit on gnome-shell for a workaround.
  - Updated ibus.spec
    Fixed Bug 735879 pre/postun scripts


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-2
changelog:
  - Updated to 1.4.0
  - Updated ibus-gjs 3.0.2.20110928 for f15.
  - Updated ibus-gjs 3.2.0.20110928 for f16. (#740588)
  - Updated ibus-530711-preload-sys.patch
    Fixed not to show duplicated engine names in setup treeview (#740447)
  - Updated bus-gjs-xx-gnome-shell-3.1.4-build-failure.patch for f16.
  - Updated ibus-xx-bridge-hotkey.patch
    Fixed a XKB configuration without the input focus for f16 (#739165)
    Fixed not to show null strings in case of no variants (#738130)


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-9
changelog:
  - Updated ibus-HEAD.patch
    Fixed prev/next keys without global engine.
  - Updated ibus-xx-bridge-hotkey.patch for f16
    Fixed Bug 747902 - mouse and ctrl+space not working
    Fixed Bug 749770 - IME hotkey after Control + Space
  - Updated ibus-711632-fedora-fallback-icon.patch
    Fixed Bug 717831 - use old icon for desktops other than gnome


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-10
changelog:
  - Updated ibus-xx-bridge-hotkey.patch for f16
    Fixed no XKB languages from layout only. e.g. in(eng).
  - Updated ibus-541492-xkb.patch
    Fixed not to show 'eng' on GUI for in(eng).


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-11
changelog:
  - Updated ibus-541492-xkb.patch
    Fixed Bug 750484 - support reloading Xmodmap
  - Updated ibus-HEAD.patch
    Fixed Bug 753781 - ibus-x11 needs async for hangul ibus_commit_text.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-14
changelog:
  - Enabled dconf.
  - Updated ibus-HEAD.patch
    Fixed Bug 618229 - engine setup buton on ibus-setup.
  - Removed ibus-711632-fedora-fallback-icon.patch as upstreamed.
  - Updated ibus-xx-bridge-hotkey.patch
    Removed Enable/Disable buttons on ibus-setup


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-16
changelog:
  - Enhanced ibus-gnome3 shell lookup window.
  - Updated ibus-HEAD.patch from upstream
    Fixed Bug 769135 - ibus-x11 SEGV in _process_key_event_done.
  - Updated ibus-541492-xkb.patch
    Fixed Bug 757889 - ibus-setup SEGV without active engine.
    Fixed Bug 760213 - ibus-setup saves XKB variants correctly.
    Fixed Bug 769133 - ibus-engine-xkb returns FALSE for ASCII typings.
  - Updated ibus-xx-bridge-hotkey.patch for an enhancement.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-17
changelog:
  - Added ibus-771115-property-compatible.patch for f16
    Fixed Bug 771115 - IBusProperty back compatibility.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120203-1
changelog:
  - Updated to 1.4.99.20120203
  - Removed ibus-xx-bridge-hotkey.patch
  - Updated ibus-541492-xkb.patch to use libgnomekbd.
  - Updated ibus-xx-setup-frequent-lang.patch for 1.4.99.20120203


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120203-3
changelog:
  - Fixed ibus-setup on C locale
  - Fixed to show no registered engines from g-c-c.
  - Enabled Alt_R keybinding on ko locales for ibus gtk only.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120303-3
changelog:
  - Bumped to ibus-gjs 3.3.90.20120308 to work with gnome-shell 3.3.90
  - Fixed Bug 786906 - Added ifnarch ppc ppc64 s390 s390x
  - Updated ibus-HEAD.patch
    Fixed Bug 800897 - After doing "ctrl+space", ibus tray icon freezes


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120317-1
changelog:
  - Bumped to 1.4.99.20120317
    Fixed Bug 718668 - focus move is slow with ibus-gnome3
    Fixed Bug 749497 - Enhance IME descriptions in status icon active menu
  - Bumped to ibus-gjs 3.3.90.20120317
  - Added ibus-xx-no-use.diff
    Fixed Bug 803260 - Disable non-global input method mode
  - Updated ibus-HEAD.patch
    Fixed Bug 803250 - ibus lookup window font customization
    Fixed Bug 803177 - language id on ibus-ui-gtk3 switcher
  - Update ibus-530711-preload-sys.patch
    Fixed Bug 797023 - port preload engines


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120428-1
changelog:
  - Bumped to 1.4.99.20120428
    Fixed Bug 799571 - no IME list at the session login.
    Fixed Bug 810415 - ibus does not handle Ctrl+space with BUTTON_PRESS.
  - Bumped to ibus-gjs 3.4.1.20120428
    Fixed Bug 802052 - no modifiers trigger keys.
    Fixed Bug 803244 - IME switch Ctrl+space not working on shell text entry.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120428-2
changelog:
  - Updated ibus-HEAD.patch
  - Updated ibus-541492-xkb.patch
  - Updated ibus-xx-branding-switcher-ui.patch
    Fixed Bug 810211 - Cancel Control + space pressing Control key.
  - Updated ibus-xx-no-use.diff
    Enabled to customize trigger keys with non-modifier trigger keys.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120822-1
changelog:
  - Bumped to 1.4.99.20120822
  - Bumped to ibus-gjs 3.4.1.20120815
    Fixed Bug 845956 - ibus backward trigger key is not customized
    Fixed Bug 844580 - ibus-dconf does not load the system gvdb
  - Separated ibus-810211-no-switch-by-no-trigger.patch from ibus-HEAD.patch


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120822-2
changelog:
  - Updated ibus-530711-preload-sys.patch
  - Updated ibus-541492-xkb.patch
  - Updated ibus-xx-no-use.diff
    Fixed Bug 854161 - not able to add keymap with ibus-setup


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20121109-1
changelog:
  - Bumped to 1.4.99.20121109
  - Removed im-chooser, imsettings-gnome, gnome-icon-theme-symbolic
    dependencies in f18 because ibus gnome integration is done.
    Use ibus-keyboard instead of input-keyboard-symbolic.
  - Disabled ibus-gjs build because of ibus gnome integration.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.2-1
changelog:
  - Bumped to 1.5.2
  - Created noarch packages for python files due to .pyc and .pyo.
  - Added man pages.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.2-4
changelog:
  - Updated ibus-HEAD.patch for upstream.
  - Added ibus-xx-1.5.2.patch until 1.5.3 will be released.
  - Added ibus-xx-ctrl-space.patch for back compatible triggers.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-1
changelog:
  - Bumped to 1.5.3
  - Deleted ibus-xx-g-s-disable-preedit.patch as EOL.
  - Deleted ibus-gjs as EOL.
  - Removed imsettings-gnome, im-chooser, libgnomekbd dependencies.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.4-1
changelog:
  - Bumped to 1.5.4
  - Added ibus.conf.5
  - Added ibus-xkb-1.5.0.tar.gz for po files.
  - Added ibus-xx-f19-password.patch for back compatibility.
  - Added ibus-wayland in f20 or later.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.7-5
changelog:
  - Updated ibus-HEAD.patch from upstream.
    Added pl(qwertz).
    Fixed escape key with Ctrl-Shift-U.
    Updated pt-br compose table from the latest xorg.
    Do not sort ibus engines when they are saved by ibus-setup.
    Updated jp IBusKeymap.
    Added ibus reset-config and read-config sub-commands.
    Update ibus(1) for read-config and reset-config.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.7-6
changelog:
  - Updated ibus-HEAD.patch from upstream.
    Fixed ibus-setup SEGV when an engine is selected.
    Fixed ibus-setup deprecated warnings with the latest python3-gobject.
    Integrated the 'IBUS_SETUP_XID' environment variable for each engine setup.
    Set prgname 'ibus-setup' for ibus-setup.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.8-1
changelog:
  - Bumped to 1.5.8
  - Deleted ibus-810211-no-switch-by-no-trigger.patch
  - Deleted ibus-541492-xkb.patch
  - Deleted ibus-530711-preload-sys.patch
  - Deleted ibus-xx-setup-frequent-lang.patch
  - Deleted ibus-xx-f19-password.patch


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.9-6
changelog:
  - Updated ibus-xx-increase-timeout.patch to fix #1163722
  - Updated ibus-HEAD.patch for upstream #1747, #1748, #1753
    and gnome #703020, gnome #730628


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.10-2
changelog:
  - Updated ibus-HEAD.patch from upstream
    Added Swedish svdvorak
    I18N engine longnames and descriptions on ibus-setup
    Moved PropertyPanel at bottom right in KDE5
    Drew gray color on Handle PropertyPanel
    Enabled ibus engine full path icon in KDE5
    Updated translations


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.10-3
changelog:
  - Updated ibus-HEAD.patch from upstream
    Fixed to show shortcuts on ibus-setup.
    Bug 1214271 Fixed to enable IME with GTK3 applications in wayland.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.13-3
changelog:
  - Bug 1349732 - ibus not working at all in Gnome Wayland
  - Add ibus service file
  - Fix CSS color format and font size


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.14-3
changelog:
  - Fixed Bug 1380675 - Emoji leaves the candidates of @laugh when @laughing
  - Fixed Bug 1380690 - User is not able to select emojis from digit keys
  - Fixed Bug 1380691 - PageUp PageDown buttons on emoji lookup not working


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.14-5
changelog:
  - support scroll event in candidates panel
  - Fixed Bug 1403985 - Emoji typing is enabled during Unicode typing
  - Fixed Bug 1402494 - Font settings of ibus are ignored on non-Gnome


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-2
changelog:
  - Added ibus-HEAD.patch to get upstream patches
    Fixed ibus_emojier_run() SIGABRT with `ibus emoji`
    Enhanced theme color on emoji candidates


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-3
changelog:
  - Emoji dialog enhancements and bug fixes
    Fixed ibus_emoji_dict_load() API.
    Focus on emoji text entry by default
    Removed internal text buffer and use Gtk.Entry buffer instead.
    Implemented cursor left, right, home, end on emoji annotation preedit.
    Show localized emoji description from tts in emoji xml.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-4
changelog:
  - Implemented Ctrl-[f|b|n|p|h|e|a|u] for cursor operations on emoji dialog
  - Added XSetIOErrorHandler() for GNOME3 desktop


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-5
changelog:
  - Moved language setting on IBusEmojier to ibus-setup.
  - Enabled strcasecmp to match emoji annotations.
  - Added a build error message if emoji xml files are not found.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-6
changelog:
  - Enabled unicode_alt in EmojiOne json file
  - Enabled to type multiple code points on Emojier
  - Fixed IBusEmojiDialog_1_0_gir_LIBS for --as-needed LDFLAGS


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-8
changelog:
  - Dropped nodejs-emojione-json and import unicode-emoji instead
  - Created emoji tab in ibus-setup
  - Set default emoji font size from gsettings in ibus emoji command
  - Added an option of emoji partial match in ibus-setup
  - Hid emoji variants by default
  - Added ibus-emoji man page
  - emoji favorites category is updated by selecting emoji


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.16-2
changelog:
  - Added ctrl-c,v,x for annotations and ctrl-shift-c for emoji
  - Added Malay and Mongolian keymaps
  - Made all emoji dicts to fully qualified


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.16-9
changelog:
  - Fix scaling factor, mouse events on switcher, c-s-u on im-ibus, 
    propertypanel position and menu 
  - Add ibus-portal
  - Move ibus-emoji-dialog.vapi in the build
  - Fixed some SEGVs #1406699 #1432252


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.17-9
changelog:
  - Added panel extension for emoji keybinding not to depen on desktops
  - Showed Unicode code points on Unicode name list


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-5
changelog:
  - Disabled python2 since RHEL8
  - Run make check in %check except for GUI testings
  - Fixed Bug 1574855 - [abrt] ibus: ibus_engine_filter_key_event()


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-7
changelog:
  - Moved input focus on Emojier to engines' preedit
  - Removed ibus-xx-emoji-harfbuzz.patch not to change session emoji font


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-9
changelog:
  - Do not use combined characters on preedit for compose keys
  - Fixed an infinite loop of extension preedit with xterm


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-14
changelog:
  - Fixed Man page scan results for ibus
  - Added IBUS_DISCARD_PASSWORD env variable for password dialog in firefox
  - Added history annotation for previous emojis


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-3
changelog:
  - Fix Bug SEGV Choose an emoji by mouse from the emoji category list
  - Fix Bug 1618682 - SEGV with ASCII on emojier in Wayland
  - Support Shift-Space on emojier preedit
  - Do not move Emojier popup with the active candidate in Xorg
  - Do not clear Unicode data when emoji annotation lang is changed


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-5
changelog:
  - Resolves: #1713606 - Fix hangul preedit commit with mouse click
  - Resolves: #1682157 - Integrate ibus-desktop-testing and test cases


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-13
changelog:
  - Resolves: #1897548 - Rebuild IBus emoji with unicode-emoji-13.0-4 and cldr-emoji-annotation-39-2
  - Rebuild ibusemojigen.h and ibusunicodegen.h
  - Add ibus-1897548-emoji-unicode.patch to lookup Unicode names
  - Add U+32FF to IBusUnicodeData
  - Add ibus-po-1.5.19-20210706.tar.gz


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-3
changelog:
  - Fix Bug 1618682 - SEGV with ASCII on emojier in Wayland
  - Support Shift-Space on emojier preedit
  - Do not move Emojier popup with the active candidate in Xorg


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-10
changelog:
  - Always reset and clear preedit on mouse click
  - Show compose preedit with custom compose file
  - Clear preedit in IBusEngineSimple with focus changes
  - Obsolete ibus-xkbc since Fedora 30


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-12
changelog:
  - Use ISO 639-3 names instead of 639
  - Connect to button-press-event only with IBUS_ENGINE_PREEDIT_COMMIT


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-13
changelog:
  - Resolves: #1470673 Replace assert with warning for .XCompose
  - Update APIs for Hangul preedit in Flatpak
  - Fix Atom and Slack for Flatpak
  - Resolves: #1663528 Check if the mutex is not unlocked before the clear


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-17
changelog:
  - Delete dconf dependencies and gettext migration for gschema.xml file
  - Delete Super-space notification in initial login in non-GNOME desktops


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.20-6
changelog:
  - Update ibus-HEAD.patch from upstream
    Integrate a new compose feature
    Generate ibus-tests and ibus-desktop-testing sub packages


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.21-4
changelog:
  - Replace push with cd for Posix SH
  - Use XDG_CONFIG_HOME for Unix socket directory
  - Fix deprecated APIs
  - Fix restart crash with inotify read()
  - Fix Bug 1658187 exit `ibus emoji` with Escape key
  - Add fr(bepo_afnor) keymap
  - Add file list in registry file for Silverblue


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.21-6
changelog:
  - Fix to connect button-press-event for Hangul
  - Delete a previous workaround targeted to firefox only for Hangul


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.21-9
changelog:
  - Bug 1785276 - Fix abrt without XDG_CACHE_HOME/ibus
  - Bug 1788754 - Fix abrt with NULL output of compose keys
  - Bug 1787732 - Fix abrt in exit handlers in ibus-x11
  - Bug 1795499 - Fix abrt in bus monitor handlers when ibus-daemon restarts
  - Fix greek cases
  - Increase sleep 3 to wait for running ibus-config in CI.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.22-6
changelog:
  - Update HEAD.patch to make parallel dict build
  - Update 1385349-segv-bus-proxy.patch
  - Resolves #1767976 #1601577 #1771238 #1797120


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.22-12
changelog:
  - Generate simple.xml with denylist
  - Tell Pango about the engine language in the candidate panel
  - Add file list in registry file for Silverblue


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.22-14
changelog:
  - Update ibusunicodegen.h with latest unicode-ucd
  - Update simple.xml with latest xkeyboard-config
  - Fix gvfsd-fuse to unbind directory
  - Update translations


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.22-16
changelog:
  - Bug 1876877 - Fix to pull the correct language with no iso639 variants
  - Accept xdigits only for Unicode typing


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.23-2
changelog:
  - Bug 1898065 - Fix build failure of emoji-*.dict with CLDR 38
  - Fix build failure with Vala 0.50
  - Add IBUS_INPUT_PURPOSE_TERMINAL


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.23-3
changelog:
  - Enable IM gtk4 module
  - Fix to rename xkb:de::ger to sync xkeyboard-config
  - Enhance ibus-setup search engine


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.24-5
changelog:
  - Fix covscan reviews. Related: rhbz#1963071

  - Implement ibus_im_context_set_surrounding_with_selection()


author: Peng Huang <shawn.p.huang@gmail.com> - 1.1.0.20090330-1
changelog:
  - Update version to 1.1.0.20090330.
  - Fix bug 486056 - missing options for 2bul, 3bul and other Korean layouts
  - Fix bug 487269 - missing Hanja Conversion


author: Warren Togami <wtogami@redhat.com> - 1.1.0.20090330-2
changelog:
  - Bug 493706: ibus-hangul Hanja arrow keys are wrong
  - Bug 493509: ibus-hangul missing right Ctrl for Hanja button
    These fixes are not ideal, but they make it usable for Fedora 11.
    These must become configurable in a future version.


author: Peng Huang <shawn.p.huang@gmail.com> - 1.1.0.20091031-1
changelog:
  - Update version to 1.2.0.20091031.
  - Drop ibus-hangul-1.1.0.20090328-right-ctrl-hanja.patch and
    ibus-hangul-1.1.0.20090328-hanja-arrow-keys.patch temporarily, because
    patches conflict with 1.2.0.20091031, and the key configure will available
    in next release.


author: Daiki Ueno <dueno@redhat.com> - 1.3.1-2
changelog:
  - Apply ibus-1.4 patch conditionally for SRPM compatibility.
  - Drop buildroot, %clean and cleaning of buildroot in %install


author: Daiki Ueno <dueno@redhat.com> - 1.3.1-3
changelog:
  - Update ibus-1.4 patch.
  - Move the ibus version check into the patch from this spec.
  - Fix bug 695971 - Hangul Keybaord Layout works to only dubeolsik


author: Daiki Ueno <ueno@unixuser.org> - 1.3.1-6
changelog:
  - Fix entity reference for icon symbol.
  - Fix bug 722566 - Cannot select Hangul Input Method on Ibus Preferences


author: Daiki Ueno <dueno@redhat.com> - 1.4.0-1
changelog:
  - Update version to 1.4.0.
  - Remove ibus-hangul-ibus-1.4.patch.
  - Drop %defattr(-,root,root,-) from %files.
  - Pass -p to install to preserve file timestamps.
  - Install ibus-setup-hangul.desktop properly.


author: Daiki Ueno <dueno@redhat.com> - 1.4.0-3
changelog:
  - Add ibus-hangul-use-system-icon.patch
  - Fix bug 789230 - ibus hangul Icon missing in gnome-shell (fedora 17)


author: Daiki Ueno <dueno@redhat.com> - 1.4.0-4
changelog:
  - Package the latest git master.
  - Fix bug 799776 - [abrt] ibus-hangul-1.4.0-3.fc17
  - Remove upstreamed patches: ibus-hangul-xx-icon-symbol.patch,
    ibus-hangul-no-ibus-daemon.patch, and
    ibus-hangul-use-system-icon.patch


author: Daiki Ueno <dueno@redhat.com> - 1.4.0-5
changelog:
  - Revive <hotkey> in hangul.xml.
  - Remove unnecessary BR: ibus.
  - Port ibus-setup-hangul to use gobject-introspection.


author: Daiki Ueno <dueno@redhat.com> - 1.4.1-2
changelog:
  - Add pygobject3 to dependencies on F-16.
  - Fix bug 816890 - [abrt] ibus-hangul-1.4.0-5.fc16:
    main.py:23:<module>:ImportError: No module named gi.repository


author: Daiki Ueno <dueno@redhat.com> - 1.4.1-3
changelog:
  - Fix ibus-setup-hangul race condition
  - Fix bug 828597 - [abrt] ibus-hangul-1.4.1-2.fc16:
    main.py:184:on_value_changed:TypeError: 'NoneType' object is not
    iterable


author: Daiki Ueno <dueno@redhat.com> - 1.4.1-4
changelog:
  - Fix ibus-hangul-setup-gi.patch
  - Remove previously applied ibus-hangul-setup-race-condition.patch
  - Fix bug 828597 - [abrt] ibus-hangul-1.4.1-2.fc16:
    main.py:184:on_value_changed:TypeError: 'NoneType' object is not
    iterable


author: Daiki Ueno <dueno@redhat.com> - 1.4.1-6
changelog:
  - Add ibus-hangul-engine-name.patch
  - Update ibus-hangul-setup-gi.patch
  - Fix bug 870318 - Change of “Automatic reordering” setup option
    cannot be applied in ibus-hangul setup (thanks Mike FABIAN for the patch)


author: Daiki Ueno <dueno@redhat.com> - 1.4.1-7
changelog:
  - Re-add ibus-hangul-HEAD.patch based on recent upstream change
  - Apply ibus-hangul-add-hangul-hotkey.patch only for F-15 and F-16


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-3
changelog:
  - Remove have_bridge_hotkey and need_pygobject3 macros which does no
    longer make sense after F17
  - Add ibus-hangul-dconf-prefix.patch
  - Fix bug 909509 - Hangul Keybaord doesn't be changed in IBusHangul Setup


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-7
changelog:
  - Invoke ibus-setup-hangul with the absolute path.
  - Fix bug 1012732 - Click ibus hangul setup on gnome-shell top bar's
    ibus -> No Response


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-10
changelog:
  - Add ibus-hangul-setup-ui.patch
  - Fix bug 1115411 - [abrt] ibus-hangul: main.py:43:__init__:Error:
    gtk-builder-error-quark: Invalid property: GtkNotebook.tab_hborder
    on line 21 (11)


author: Daiki Ueno <dueno@redhat.com> - 1.5.0-5
changelog:
  - require python3-gobject instead of pygobject3, to avoid python2
    dependency.  Suggested by Miro Hrončok.


author: Daiki Ueno <dueno@redhat.com> - 1.5.18-2
changelog:
  - write ibus registry cache in %post and %postun (Closes: #1013980)
  - add patch to respect content-type of target application (Closes: #1013398)


author: Peng Wu <pwu@redhat.com> - 1.6.91-5
changelog:
  - Update ibus-libpinyin-1.7.x-head.patch
  - Support ibus input purpose feature, fixes bug 1016438.
  - Remove pyxdg depends, fixes bug 1016941.


author: Peng Huang <shawn.p.huang@gmail.com> - 1.1.0.20090211-2
changelog:
  - Add patch ibus-m17n-HEAD.patch from upstream git tree.
  - Make Control + Alt + ... available. (#482789)


author: Peng Huang <shawn.p.huang@gmail.com> - 1.3.0-1
changelog:
  - Update to 1.3.0.
  - Update iok patch.
  - Fix bug 577148 - IOK screen appears with all keyboard layouts on ibus language panel


author: Daiki Ueno <dueno@redhat.com> - 1.3.0-2
changelog:
  - Update ibus-m17n-HEAD.patch.
  - Fix bug 614867 - Invisible pre-edit buffer when using m17n Wijesekera keyboard layout
  - Update iok patch.


author: Daiki Ueno <dueno@redhat.com> - 1.3.0-3
changelog:
  - Update ibus-m17n-HEAD.patch.
  - Fix regression with the previous update.  See comment 7 of bug 614867.


author: Daiki Ueno <dueno@redhat.com> - 1.3.1-1
changelog:
  - Update to 1.3.1.
  - Fix bug 615158 - Do not change the background colour of the pre-edit buffer
  - Add gtk2-devel to BR
  - Install ibus-setup-m17n in %{_libexecdir}


author: Daiki Ueno <dueno@redhat.com> - 1.3.1-3
changelog:
  - Apply a patch to handle Shift+AltGr.
  - Update surrounding-text patch.
  - Fix bug 634829 - [abrt] ibus-m17n-1.3.1-1.fc14: shift_state: Process
    /usr/libexec/ibus-engine-m17n was killed by signal 11 (SIGSEGV).


author: Daiki Ueno <dueno@redhat.com> - 1.3.1-4
changelog:
  - Remove Shift+AltGr patch; apply a simplified AltGr patch.
  - Fix bug 639963 - SHIFT switch is not working in layouts as expected.


author: Daiki Ueno <dueno@redhat.com> - 1.3.1-5
changelog:
  - put several Fedora patches into one.
  - Fix bug 640896 - Ibus does not load all the keymaps for a language
    that is used for logging in.


author: Daiki Ueno <dueno@redhat.com> - 1.3.1-7
changelog:
  - Rename ibus-m17n-fedora.patch to ibus-m17n-HEAD.patch since the
    changes are merged into upstream.
  - Update ibus-m17n-HEAD.patch with upstream fix 08e06310
  - Fix bug 649230 - [si] last input character is committed late in
    wijesekara input method


author: Daiki Ueno <dueno@redhat.com> - 1.3.1-10
changelog:
  - Update ibus-m17n-HEAD.patch.
  - Fix bug 658336 - ibus-m17n: define the IM ranks in a config file and
    not in a compiled binary


author: Daiki Ueno <dueno@redhat.com> - 1.3.1-15
changelog:
  - Update iok patch.
  - Fix bug 669128 - [abrt] ibus-m17n-1.3.1-14.fc15:
    Process /usr/libexec/ibus-engine-m17n was killed by signal 6 (SIGABRT)


author: Daiki Ueno <dueno@redhat.com> - 1.3.2-2
changelog:
  - Bump the release to fix upgrade path.
  - Fix bug 706602 - ibus-m17n-1.3.2-2.fc14 > ibus-m17n-1.3.2-1.fc15
  - Drop preparing/cleaning buildroot.


author: Daiki Ueno <dueno@redhat.com> - 1.3.2-4
changelog:
  - Add ibus-m17n-stscap.patch.
  - Fix bug 711126 - ibus: surrounding text support fails for the first
    syllable upon activation


author: Daiki Ueno <dueno@redhat.com> - 1.3.2-5
changelog:
  - Add ibus-m17n-stsreq.patch.
  - Fix bug 711126 - ibus: surrounding text support fails for the first
    syllable upon activation


author: Daiki Ueno <dueno@redhat.com> - 1.3.2-6
changelog:
  - Add ibus-m17n-xkb-options.patch.
  - Add ibus-m17n-xx-icon-symbol.patch.
  - Drop surrounding-text patches since they are included in the HEAD patch.


author: Daiki Ueno <dueno@redhat.com> - 1.3.2-8
changelog:
  - Update ibus-m17n-xx-icon-symbol.patch.
  - Fix bug 727024 - ibus compose file needs a symbol tag for gnome-shell
  - Update ibus-m17n-xkb-options.patch.


author: Daiki Ueno <dueno@redhat.com> - 1.3.3-1
changelog:
  - New upstream release.
  - Add ibus-m17n-default-xml-override.patch.
  - Add ibus-m17n-virtkbd.patch, instead of ibus-m17n-iok.patch.


author: Daiki Ueno <dueno@redhat.com> - 1.3.3-5
changelog:
  - Add ibus-m17n-hide-title-status.patch.
  - Fix bug 741157 - ibus-m17n: m17n "title" variable appears as a
    dormant button on the language panel


author: Daiki Ueno <dueno@redhat.com> - 1.3.3-6
changelog:
  - Add ibus-m17n-blacklist-engines.patch
    https://lists.fedoraproject.org/pipermail/i18n/2011-October/001194.html


author: Daiki Ueno <dueno@redhat.com> - 1.3.3-7
changelog:
  - Add ibus-m17n-custom-setup-element.patch
  - Fix bug 760427 - engine preferences button in ibus-setup doesn't
    work for ibus-m17n


author: Daiki Ueno <dueno@redhat.com> - 1.3.3-11
changelog:
  - Revive m17n:zh:pinyin with a different label ("hanyu pinyin (m17n)")
  - Rebase ibus-m17n-virtkbd.patch


author: Daiki Ueno <dueno@redhat.com> - 1.3.3-12
changelog:
  - Check %{rhel} version in addition to %{fedora}
  - Remove unnecessary %defattr(-,root,root,-) from %files
  - Drop libxklavier-devel from BR


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-3
changelog:
  - Add ibus-m17n-fix-mtext-config.patch
  - Fix bug 836397 - [abrt] ibus-m17n-1.3.3-11.fc17: mtext_data: Process
    /usr/libexec/ibus-setup-m17n was killed by signal 11 (SIGSEGV)


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-4
changelog:
  - Add ibus-m17n-translit-layout.patch
  - Fix bug 847495 - For non-US keyboard layout Ibus-m17n adds English
    (US) to the list of input methods and other input methods use US
    layout
  - Require eekboard-service instead of eekboard
  - Fix bug 847500 - Don't install Eekboard by default in the desktop spin


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-6
changelog:
  - Add ibus-m17n-desktop-file.patch
    Fix bug 860955 - ibus-m17n setup is not enabled in
    gnome-control-center region, .desktop file is missing


author: Daiki Ueno <deno@redhat.com> - 1.3.4-8
changelog:
  - Update ibus-m17n-HEAD.patch to the latest upstream master
  - Remove unnecessary and not upstreamable patches
  - Use gtk3 always
  - Fix bug 912592 - ibus-m17n should use default keyboard in most cases


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-9
changelog:
  - Update ibus-m17n-xkb-options.patch to set XKB option for Inscript2
  - Fix bug 957993 - ibus-m17n doesn't automatically map Alt_R to AltGr
    when Inscript2 maps are used


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-10
changelog:
  - Add ibus-m17n-fix-data-location.patch
  - Fix bug 962144 [abrt] ibus-m17n-1.3.4-9.fc19:
    setup_dialog_load_config: Process /usr/libexec/ibus-setup-m17n was
    killed by signal 11 (SIGSEGV)


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-12
changelog:
  - Add ibus-m17n-fix-preedit-color.patch
  - Fix bug 995842 - Preedit background colour in ibus-m17n is always
    black and preedit underlining is always off


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-16
changelog:
  - Add ibus-m17n-fix-preferences-ui.patch
  - Fix bug 1117720 - ibus-m17n input method's setup option does not work


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-17
changelog:
  - Add ibus-m17n-content-type.patch
  - Fix bug 1024071 - ibus-m17n is enabled in the password entry field
    of the lock screen


author: Caius Chance <cchance@redhat.com> - 0.1.1.20081014-4
changelog:
  - Resolves: rhbz#466430 rhbz#466844
  - Added wildcard features.
  - Added preedit clearance on refocus.


author: Caius Chance <cchance@redhat.com> - 1.1.0.20090220-1.fc11
changelog:
  - Resolves: rhbz#484650
  - Updated to latest upstream release.
  - Splitted chinese input methods into modules.


author: Jens Petersen <petersen@redhat.com> - 1.1.0.20090220-5
changelog:
  - make pkgconfig noarch with ibus-table-pkgconfig-noarch.patch
  - fix license field: actually LGPL
  - drop gettext-devel BR
  - require ibus > 1.1.0


author: Caius Chance <cchance@redhat.com> - 1.1.0.20090316-1.fc11
changelog:
  - Resolves: rhbz#490396
  - Updated source tarball.
  - Disabled speedmeter until config option is implemented.


author: Caius 'kaio' Chance <k at kaio.me> - 1.2.0.20100111-1.fc13
changelog:
  - Updated source from upstream.
  - Migreate tables from ibus-table-additional to ibus-table-latin and ibus-table-code.


author: Caius 'kaio' Chance <k at kaio.me> - 1.2.0.20100111-2.fc13
changelog:
  - Temporary keep files of additional available in ibus-table until 
    ibus-table-{code,latin} packages are ready in repository.


author: Mike FABIAN <mfabian@redhat.com> - 1.3.9.20110827-4
changelog:
  - Resolves: #845798
  - add ibus-table-1.3.9.20110827-add-some-keys-for-translit.patch (from Yuwei YU, upstream)
  - add ibus-table-1.3.9.20110827-enable-non-ascii.patch  (from Yuwei YU, upstream)
  - add ibus-table-1.3.9.20110827-uppercase-umlauts.patch to allow uppercase as well in translit


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20120907-1
changelog:
  - Relates: #855250
  - see comment#1 in #855250
  - update to latest upstream 1.4.99.20120907 from Caius 'kaio' Chance's repository
  - remove ibus-table-1.3.9.20110827-add-some-keys-for-translit.patch (included upstream)
  - remove ibus-table-1.3.9.20110827-enable-non-ascii.patch (included upstream)


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20120907-2
changelog:
  - Resolves: #856320
  - Improve check whether a phrase is simplified or traditional Chinese
    The improvement is to ignore all non-Han characters when
    doing the check.
    This is to avoid classifying a simplified Chinese string as
    traditional just because it happens to include some non-Chinese
    characters, for example box drawing characters, which cannot be
    converted to gb2312 but happen to be convertible to big5hkscs.
    This fixes the problem in the emoji-table input method that most
    phrases cannot be input at all.


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20120907-3
changelog:
  - Resolves: #856903
  - Fix ipa-x-sampa table and phrases containing spaces in emoji-table
    Currently there is a regular expression which filters out several
    lines defining valid phrases. The emoji-table for example has phrases
    containing spaces which are currently filtered out and the ipa-x-sampa
    table has trailing comments which are filtered out as well.


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20121113-1
changelog:
  - update to latest upstream 1.4.99.20121113 from Caius ‘kaio’ Chance’s repository, using rel20121101 git tag
  - remove ibus-table-1.4.99.20120907-improve-chinese-category-check.patch (included upstream)
  - remove fix-ipa-x-sampa-table-and-phrases-containing-spaces.patch (included upstream)
  - Fix marking of translatable strings for gettext
  - update zh_??.po files
  - Add German translation
  - Do not fail if the ~/.ibus/byo-tables/ directory does not exist


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20130108-1
changelog:
  - update to latest upstream 1.4.99.20130108 from Caius ‘kaio’ Chance’s repository, 1.5.0 branch
  - includes port to GObjectIntrospection now


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20130110-1
changelog:
  - Resolves: #513901 ibus-table setup does not store config settings
  - update to latest upstream 1.4.99.20130110 from Caius ‘kaio’ Chance’s repository, 1.5.0 branch
  - When detecting the Chinese mode from the environment, also check LC_ALL
  - Fix typo in self._chinese_mode variable (The typo broke the SC/TC property)
  - Make cursor in lookup table always visible (became invisible after the port to GObjectIntrospection)
  - apply changes in values of dconf keys immediately


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0-1
changelog:
  - update to latest upstream 1.5.0  from Caius ‘kaio’ Chance’s repository
  - add patches for better simplified/traditional Chinese detection
  - Resolves: #857967 - simplified/traditional Chinese detection in ibus-table does not work well


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0-2
changelog:
  - Resolves: #911487 - Non-Chinese tables from the ibus-table-other package do not work
  - Add auto_select functionality to select the first phrase when typing.
    Useful for Cyrillic transliteration
  - Update cmode property in chinese mode only
  - Fall back to auto_select = False if neither dconf nor the table
    have a value for auto_select
  - Preedit needs to be updated on page-up and page-down


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20130419-1
changelog:
  - update to latest upstream
  - remove patches which are included upstream
  - Resolves: #948454 - Man page scan results for ibus-table


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20130419-3
changelog:
  - Resolves: rhbz#1051365 - suggestion: move ibus-table-createdb to a subpackage
  - When tabcreatedb.py is called without any options, print a usage message. Do not just show a cryptic backtrace.


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20140218-1
changelog:
  - update to latest upstream
  - Resolves: rhbz#1061345 - ibus-table shows entered text in password fields
  - remove patches which are included upstream
  - remove old, unused patches


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20140306-1
changelog:
  - update to latest upstream
  - Resolves: rhbz#1072940 - Left Shift stopped work for ibus-table-1.5.0.20140218-1.fc20.noarch
  - port from Python2 to Python3, require Python3 in this rpm now
  - fix directory for setup tool, setup tool should work now
  - add profiling support


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20140311-1
changelog:
  - update to latest upstream
  - fix a regression introduced by the Python3 port
  - add a .desktop file and make the setup tool work with Gnome
  - make it possible to interrupt the setup tool with Control-C from the command line


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20140312-1
changelog:
  - update to latest upstream
  - fix another regression introduced by the Python3 port (a spelling mistake in a variable name)
  - Resolves: rhbz#1072940


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20140312-2
changelog:
  - fix yet another regression introduced by the Python3 port (problem occured when filtering Chinese characters, see rhbz#1072940 comment#18)
  - Resolves: rhbz#1072940


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20140402-1
changelog:
  - Fix a regression caused by the Python3 port in tabcreatedb.py (This fixes the build of ibus-table-chinese)


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20140409-1
changelog:
  - Make toggling pinyin mode with the right shift key work
  - Don’t try to colour system phrases and user phrases differently in pinyin mode
  - Resolves: rhbz#1084684
  - Don’t switch off pinyin mode in clear()
  - Make usage of engine name and dconf key consistent


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20140416-1
changelog:
  - Do not fail when the environment variable HOME is not set
  - Resolves: rhbz#1088138
  - some code cleanup


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20140527-1
changelog:
  - update to 1.5.0.20140527
  - Put exact matches always at the top of the candidate list
  - Fix typo in the filtering for Chinese mode 3 (All characters with traditional Chinese first)
  - Support prompt characters (e.g. for cangjie and stroke5)


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0.20140528-1
changelog:
  - update to 1.5.0.20140528
  - Use Unicode code point as a last ditch sort key for the candidates
  - Fix bug in Unihan_Variants.txt, 同 is both simplified *and* traditional Chinese
  - Update Unihan_Variants.txt from “2011-08-08 Unicode 6.1.0” to “2013-02-25 Unicode 6.3.0” and regenerate engine/chinese_variants.py


author: Mike FABIAN <mfabian@redhat.com> - 1.8.1-1
changelog:
  - update to 1.8.1
  - Added support for wildcards (both in table and in pinyin mode)
  - Don’t show the prompt characters defined in the table in
    pinyin mode in the auxiliary text


author: Mike FABIAN <mfabian@redhat.com> - 1.8.2-1
changelog:
  - update to 1.8.2
  - Better sorting of the lookup table in the mixed Chinese modes
  - Do not create useless indexes
  - Resolves: rhbz#1105465


author: Mike FABIAN <mfabian@redhat.com> - 1.8.3-1
changelog:
  - update to 1.8.3
  - Insert a special candidate for the wildcard character itself
    if only a wildcard character has been typed
  - Make wildchard characters configurable
  - Resolves: rhbz#1110325 - Unable to input question marks in Wubi-jidian


author: Mike FABIAN <mfabian@redhat.com> - 1.8.4-1
changelog:
  - update to 1.8.4
  - Tweak defaults for Chinese mode taken from the locale
  - Fix prompts for array30 table and don’t use prompts in pinyin mode
  - Make it possible to use select keys like F1, F2, F3 ...
  - For cangjie* and quick* tables: Use big5 order if the
    freq from the table is the same


author: Mike FABIAN <mfabian@redhat.com> - 1.8.5-1
changelog:
  - update to 1.8.5
  - Always write xml output in UTF-8 encoding, not in the encoding
    of the current locale
  - Resolves: rhbz#1120919


author: Mike FABIAN <mfabian@redhat.com> - 1.8.7-1
changelog:
  - update to 1.8.7
  - Use the “notify::text” signal instead of “activate” on GtkEntry widget.
    This is to make changes in the text entry widgets in the setup tool apply
    immediately.
  - Move the “Restore all defaults” button into the GtkButtonBox at the bottom
  - Update Unihan_Variants.txt from “2013-02-25 Unicode 6.3.0” to “2014-05-09 Unicode 7.0.0”


author: Mike FABIAN <mfabian@redhat.com> - 1.8.8-1
changelog:
  - update to 1.8.8
  - Show keyboard shortcuts also in the property menu entries
  - Remove “Hide Candidates/Display Candidates” from the properties menu
  - If the database is not CJK, set sensitivity to comboboxes
    useful only for CJK to OFF
  - Disable properties related to fullwidth/halfwidth for non-CJK tables
  - Resolves: rhbz#1128912 - With the new "rusle" table in
    ibus-table-cyrillic, typing space works strangely


author: Mike FABIAN <mfabian@redhat.com> - 1.8.9-1
changelog:
  - update to 1.8.9
  - Move some options into a new tab “Details”
  - Ignore Shift+Space hotkey to switch fullwidth/halfwidth if the database is not for CJK
  - Resolves: rhbz#1133422
  - Pass IBus.KEY_KP_Enter to the application if the preedit is empty
  - Resolves: rhbz#1133424


author: Mike FABIAN <mfabian@redhat.com> - 1.8.10-1
changelog:
  - update to 1.8.10
  - Disable auto_commit option for tables which do not have RULES
  - Resolves: rhbz#1135759
  - Disable hotkey to switch Chinese mode if database is not Chinese
  - Disable “onechar” (Phrase mode/Single char mode) option for non-CJK databases


author: Mike FABIAN <mfabian@redhat.com> - 1.8.11-1
changelog:
  - update to 1.8.11
  - fixes a Python backtrace when the dconf key
    /desktop/ibus/engine/table/wubi-jidian86/onechar was not set


author: Mike FABIAN <mfabian@redhat.com> - 1.9.1-1
changelog:
  - update to 1.9.1
  - Use proper fallback when reading the localized table name
  - Show pinyin mode as well in the input mode indicator


author: Mike FABIAN <mfabian@redhat.com> - 1.9.2-1
changelog:
  - update to 1.9.2
  - Use directories according to theXDG Base Directory Specification
  - Resolves: rhbz#1172524
  - When a leading invalid character is passed through, it needs
    to be remembered in self._prev_char
  - Change class “KeyEvent” to store the keycode as well


author: Mike FABIAN <mfabian@redhat.com> - 1.9.3-1
changelog:
  - update to 1.9.3
  - Try to get the English name of the table if run in locale C/POSIX
  - Resolves: rhbz#1197001


author: Mike FABIAN <mfabian@redhat.com> - 1.9.4-1
changelog:
  - update to 1.9.4
  - Check existence of old log files before trying to delete them
  - Resolves: rhbz#1199673


author: Mike FABIAN <mfabian@redhat.com> - 1.9.5-1
changelog:
  - update to 1.9.5
  - Don’t strip space when parsing phrases from a source table
  - Resolves: rhbz#1211208


author: Mike FABIAN <mfabian@redhat.com> - 1.9.6-1
changelog:
  - update to 1.9.6
  - Use os.path.expanduser('~') instead of os.getenv('HOME')
  - Resolves: rhbz#1218023


author: Mike FABIAN <mfabian@redhat.com> - 1.9.7-1
changelog:
  - update to 1.9.7
  - When matching hotkeys, ignore all modifiers not requested in the match
  - Fix U+8986 in Unihan_variants.txt, it is both simplified *and* traditional Chinese
  - Resolves: rhbz#1271036
  - Update Unihan_Variants.txt from "2014-05-09 Unicode 7.0.0" to "2015-04-30 Unicode 8.0.0"


author: Mike FABIAN <mfabian@redhat.com> - 1.9.8-1
changelog:
  - update to 1.9.8
  - Get option 'lookuptableorientation' default value from database (Thanks to Heiher <r@hev.cc>).


author: Mike FABIAN <mfabian@redhat.com> - 1.9.10-2
changelog:
  - update to 1.9.10
  - Fix bug in Unihan_Variants.txt, U+8868 and U+6770 are both simplified *and* traditional Chinese
  - Resolves: rhbz#1284749


author: Mike FABIAN <mfabian@redhat.com> - 1.9.11-1
changelog:
  - update to 1.9.11
  - Fix bug in Unihan_Variants.txt, U+9762 and U+7CFB are both simplified *and* traditional Chinese
  - Resolves: rhbz#1285379
  - Add a few more IBus.Text.new_from_string() conversions to make it work on older systems


author: Mike FABIAN <mfabian@redhat.com> - 1.9.12-1
changelog:
  - update to 1.9.12
  - Show the table code in the candidate list when pinyin mode is used
  - Resolves: rhbz#1318109


author: Mike FABIAN <mfabian@redhat.com> - 1.9.13-1
changelog:
  - update to 1.9.13
  - When ignoring key release events, “False” should be returned, not “True”
  - Resolves: Resolves: rhbz#1369514
  - add ibus-table.appdata.xml and make it translatable
  - pull some new translations and updates from Zanata
    (ca, fr, pt_BR, and uk are new, ja, zh_CN, and
    zh_TW have updates).


author: Mike FABIAN <mfabian@redhat.com> - 1.9.14-1
changelog:
  - update to 1.9.14
  - Fix bug in Unihan_Variants.txt, 乾 U+4E7E is both simplified
    and traditional Chinese (thanks to Heiher <r@hev.cc>)


author: Mike FABIAN <mfabian@redhat.com> - 1.9.15-1
changelog:
  - update to 1.9.15
  - Update translations from zanata (ca, de, fr, uk updated)
  - Point to new home-page in the “About” tab.
  - Improve README


author: Mike FABIAN <mfabian@redhat.com> - 1.9.16-1
changelog:
  - update to 1.9.16
  - Avoid running initialization code of ibus_table_location.py
    when using ibus-table-createdb.
  - Make it work on Python 3.6 (Unbreak sqlite on Python 3.6)
    (Resolves: rhbz#1413580).


author: Mike FABIAN <mfabian@redhat.com> - 1.9.17-1
changelog:
  - update to 1.9.17
  - Load .desktop file for ibus-setup-table correctly under Gnome Wayland
  - Set WM_CLASS of ibus-setup-table correctly


author: Mike FABIAN <mfabian@redhat.com> - 1.9.18-1
changelog:
  - update to 1.9.18
  - validate ibus-table.appdata.xml in %check
  - Update translations from zanata (pt_BR updated, es new)
  - Don't query user database if user define phrase and
    dynamic adjust are disabled (thanks to heiher)
  - Enable hash map based cache for user database enabled
    (thanks to heiher)
  - Import hash map based cache for table database (thanks to
    heiher)
  - Install appstream metadata to /usr/share/metainfo/ (thanks
    to jbicha)
  - Fix some appdata validation issues (thanks to jbicha)
  - Fix bug in Unihan_Variants.txt, 著 U+8457 is both
    simplified *and* traditional Chinese (thanks to heiher)


author: Caius 'kaio' Chance <k at kaio.me> - 1.3.0.20100527-3
changelog:
  - Added Quick 3, 5, Classic tables and icons.
  - Added Easy (big) table and icon.
  - Updated AUTHORS, COPYING, license and its declarations.


author: Ding-Yi Chen <dchen@redhat.com> - 1.3.0.20101206-1
changelog:
  - New tables which was not include in original:
    + array30, array30-big, wubi-haifeng
  - Table removed from original version because of license issues:
    + zhengma, ziranma
  - Add package review ID
  - Add build tag for el6


author: Ding-Yi Chen <dchen@redhat.com> - 1.3.0.20110114-1
changelog:
  - Fix Bug 667877: ibus-table-yinma and ibus-table-xingma have been obsoleted.
  - Now depends on cmake-fedora


author: Ding-Yi Chen <dchen@redhat.com> - 1.3.4-1
changelog:
  - Fixed Bug 715707 - FTBFS ibus-table-chinese-1.3.0.20110114-2.fc15
  - Fixed Bug 629212 - bad candidate orders in ibus-table-quick
  - Merged patch from sagara @ github, which address IBus issue 787
  - Make it compatible with cmake-fedora-0.7.994
  - Move the cmake policies to the front
  - Suppress the misleading warning from rpm -V


author: Ding-Yi Chen <dchen@redhat.com> - 1.4.0-1
changelog:
  - Table build scripts has been refactored.
  - cmake-fedora is added as submodule.
  - Fixed Bug 855250 - Change the default filtering for Quick and Cangjie by
    merging maxiaojun's repository
  - Fixed Google Issue 1405: failed to build ibus-table-chinese due to missing db files


author: Ding-Yi Chen <dchen@redhat.com> - 1.4.5-1
changelog:
  - Table build scripts has been refactored.
  - cmake-fedora is added as submodule.
  - Fixed Bug 855250 - Change the default filtering for Quick and Cangjie by
    merging maxiaojun's repository
  - Fixed Google Issue 1405: failed to build ibus-table-chinese due to missing db files
  - Fixed Google issue 1507: Add CJKV Extension C/D support for Array30
  - Merge GitHub Pull request 3: Added the inter punct
  - Merge GitHub Pull request 4: Give Cangjie and Quick users 9 candidates per page


author: Ding-Yi Chen <dchen@redhat.com> - 1.4.6-1
changelog:
  - Fixed IBus Google issue 1126: An error in ChineseTableLicenseAuditing
  - Complete LICENSE tag for all of the tables.


author: Ding-Yi Chen <dchen@redhat.com> - 1.8.0-1
changelog:
  - Update for ibus-table-1.8.0
  - Fixed Bug 1099380 - The stroke5 table should not use 
    "AUTO_SELECT = TRUE" but "AUTO_SELECT = FALSE"


author: Deepak Bhole <dbhole@redhat.com> 1.0.2-2
changelog:
  - Fixed incorrect macro value for min_openjdk_version
  - Use posttrans instead of post, so that upgrade from old plugin works


author: Deepak Bhole <dbhole@redhat.com> 1.0.4-1
changelog:
  - Bump to 1.0.4
  - Fixed rhbz#718164: Home directory path disclosure to untrusted applications
  - Fixed rhbz#718170: Java Web Start security warning dialog manipulation


author: Ville Skyttä <ville.skytta@iki.fi> - 1.3.1-5
changelog:
  - Resolves: rhbz#875496
  - Build with $RPM_LD_FLAGS and %{_smp_mflags}.
  - Run unit tests during build.


author: Jiri Vanek <jvanek@redhat.com> 1.3.2-0
changelog:
  - Updated to latest ustream release of 1.3 branch - 1.3.2
   - Security Updates
    - CVE-2013-1927, RH884705: fixed gifar vulnerability
    - CVE-2013-1926, RH916774: Class-loader incorrectly shared for applets with same relative-path.
   - Common
    - Added new option in itw-settings which allows users to set JVM arguments when plugin is initialized.
   - NetX
    - PR580: http://www.horaoficial.cl/ loads improperly
   - Plugin
     PR1260: IcedTea-Web should not rely on GTK
     PR1157: Applets can hang browser after fatal exception
  - Removed upstreamed patch to remove GTK dependency
    - icedtea-web-pr1260-remove-gtk-dep.patch


author: Jiri Vanek <jvanek@redhat.com> 1.4-1
changelog:
  - Adapted to latest openjdk changes
  - added build requires for autoconf and automake
  - minor clean up
  - Updated to 1.4
  - See announcement for detail
   - http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-May/023195.html
  - commented out check - some junit4  incompatibility


author: Jiri Vanek <jvanek@redhat.com> 1.4.1-0
changelog:
  - updated to 1.4.1
  - add icedtea-web man page
  - removed upstreamed  patch1 b25-appContextFix.patch
  - removed upstreamed  patch2 rhino-pac-permissions.patch
  - make check enabled again
  - should be build for non-standart archs !-)
  - removed unused multilib arches (yupii!)


author: Jiri Vanek <jvanek@redhat.com> 1.4.1-1
changelog:
  - added and applied patch0, christmasSplash3.diff. Will be upstreamed
  - Christmas release for Fedora !-)


author: Jiri Vanek <jvanek@redhat.com> 1.4.2-0
changelog:
  - updated to 1.4.2
  - removed upstreamed patches
  - added std=c++11 flag to CXXFLAGS (thanx omajid!)
  - removed autoreconf


author: Jiri Vanek <jvanek@redhat.com> 1.5-0.1.pre01
changelog:
  - updated to  bleeding edge as tracker before 1.5 actual release
  - named by https://fedoraproject.org/wiki/Packaging:NamingGuidelines#Pre-Release_packages
   - see commented original source0 line and setup line reusing versions
  - the source tarball is based on revision 892


author: Jiri Vanek <jvanek@redhat.com> 1.5-0.1.pre02
changelog:
  - updated to  bleeding edge as tracker before 1.5 actual release
   - based on revision 899
  - added policyeditor.desktop
  - removed -std=c++11  flag


author: Jiri Vanek <jvanek@redhat.com> 1.5-2
changelog:
  - add not yet upstreamed DE localisation of 1.5
   - patch0 DElocalizationforIcedTea-Web1.5-0001.patch
  - autoreconf gog  -vfi, see RH1077898
  - ./configure changed to %configure,see RH1077287


author: Richard Hughes <richard@hughsie.com> - 1.5-4
changelog:
  - Add MetaInfo file to show an addon in GNOME Software.
  - See http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1907 for upstream.


author: Jiri Vanek <jvanek@redhat.com> 1.6-0.1.pre01
changelog:
  - update future 1.6 alpha pre01
  - added localised man pages
  - removed link to icedtea-web man page (now provided by upstream)


author: Jiri Vanek <jvanek@redhat.com> 1.6-0.1.pre02
changelog:
  - updated to pre02
  - upstreamed patch1, quoteDocsPaths.patch
  - temprarily disabled unittests
  - fixed nlp apps shortcut


author: Jiri Vanek <jvanek@redhat.com> 1.6-0.1.pre05
changelog:
  - updated to pre06
  - handled "Add Tab Completion for icedtea-web" change
  - this release contains numers, not yet upstreamed, but going to release features:
  - summary: Fixed resource test to pass for CZ localization
  - summary: Added Czech translation for 1.6.
  - summary: Messages from TextsProvider moved to properties
  - summary: various improvements to default set of properties
  - summary: Added MultipleDeploymentPropertiesModifier improvement to testsuite


author: Omair Majid <omajid@redhat.com> - 1.6-5
changelog:
  - Comply with newer java packaging guidelines
  - Require javapackages-tools in main package
  - Don't require jpackage-utils in -javadoc subpackage, since subpackage
    requires the main package


author: Jiri Vanek <jvanek@redhat.com> 1.6.1-3
changelog:
  - added and applied three patches scheduled for 1.6.2
  - patch2 fileLogInitializationError-1.6.patch to prevent consequences 1268909
  - patch1 donLogToFileBeforeFileLogsInitiate.patch
  - patch0 javadocFixes.patch


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-2
changelog:
  - added --family to make it part of javas alternatives alignment
  - java-javaver-openjdk collected into preffered_java


author: Jiri Vanek <jvanek@redhat.com> 1.7-4
changelog:
  - removed natie plugin, no longer can build (removed xullruner and gecko devel packages)
  - added forgotten slaves of itweb-settings policyeditor
  - Own %{_datadir}/%{name} dir
  - Mark non-English man pages with %lang
  - Install COPYING as %license
  - last three by Ville Skytta <ville.skytta@iki.fi> via 1481270
  - added BuildRequires:  javapackages-local to introduce deprecated add_maven_depmap macro


author: - Jiri Vanek <jvanek@redhat.com> -1.7.1-3
changelog:
  - added buildrequires on gcc/gcc-c++
  - to follow new packaging guidelines which no longer automatically pulls gcc/c++ to build root


author: - Jiri Vanek <jvanek@redhat.com> -1.7.1-5
changelog:
  - added 1473-1480.patch
  - added support for javafx-desc and so allwong run of pure-javafx only applications
  - --nosecurity enhanced for possibility to skip invalid signatures
  - enhanced to allow resources to be read also from j2se/java element (OmegaT)


author: Jiri Vanek <jvanek@redhat.com> 1.7.1-16
changelog:
  - added patch1, patch4 and patch11 to fix CVE-2019-10182
  - added patch2 to fix CVE-2019-10181
  - added patch3 and patch33 to fix CVE-2019-10185
  - Resolves: rhbz#1724958 
  - Resolves: rhbz#1725928 
  - Resolves: rhbz#1724989


author: - Jiri Vanek <jvanek@redhat.com> -1.8.4-2
changelog:
  - added native launchers, via separate subpackage, but efectively changed main package to arched one
  - removed policyeditor man page, it was link to itself
  - Resolves: rhbz#1900043


author: - Jiri Vanek <jvanek@redhat.com> -1.8.4-4
changelog:
  - added patch2, fed2f5b-22402bb.patch containing important fixes from future 1.8.5
  - Resolves: rhbz#1900043


author: - Martin Gieseking <martin.gieseking@uos.de> - 0.27.0-1
changelog:
  - updated to latest upstream release
  - added missing BuildRequires
  - patched wrestool/Makefile.am to fix ppc build failures


author: Martin Gieseking <martin.gieseking@uos.de> 0.30.0-1
changelog:
  - updated to release 0.30.0
  - dropped patch as it has been applied upstream
  - removed old buildroot stuff


author: Richard W.M. Jones <rjones@redhat.com> - 0.31.2-3
changelog:
  - Add a series of upstream patches to enable compiler warnings and
    fix multiple issues.
  - Revert one of the checks which breaks processing of PE binaries.
  - Removed the 'Group' line, not needed with modern Fedora/RPM.


author: Richard W.M. Jones <rjones@redhat.com> - 0.31.3-1
changelog:
  - New upstream version 0.31.3.
  - This includes all the previous upstream patches, and reverts the
    check which broke processing of PE binaries.


author: Martin Gieseking <martin.gieseking@uos.de> - 0.32.3-1
changelog:
  - Updated to version 0.32.3.
  - Dropped patch to fix https://savannah.nongnu.org/bugs/?52319 (applied upstream)


author: Fernando Nasser <fnasser@redhat.com> - 0:3.4.5-2jpp
changelog:
  - Add optional eclipse subpackage, created by
    Jeff Johnston  <jjohnstn@rdhat.com> :
  - Add eclipse sub-package to create plugins.


author: Matt Wringe <mwringe@redhat.com> - 0:3.4.5-2jpp.1
changelog:
  - Fix some rpmlint issues
  - Make use of buildroot more consistent
  - Remove javadoc post and postun sections as per new jpp standard
  - Change license section to 'MIT style' license from 'MIT' license.
    This was done since the source package calls the license the 
    "X license" (see readme.html in src jar).
  - Install eclipse plugin into /usr/share/eclipse


author: Jeff Johnston <jjohnstn@redhat.com> - 0:3.4.5-2jpp.2
changelog:
  - Disable eclipse plugin support temporarily until build problems
    can be worked out.  Plugin is still being built as part of
    eclipse platform.
  - BuildRequire sinjdoc.


author: Andrew Overholt <overholt@redhat.com> 0:3.8.1-2
changelog:
  - Remove GCJ support due to
    com.sun.tools.doclets.internal.toolkit.taglets.* import (not in gjdoc)


author: Andrew Overholt <overholt@redhat.com> 3.8.1-3
changelog:
  - Get rid of eclipse_name macro
  - Rebuild with Eclipse 3.4 and put into Eclipse stuff into
    %{_libdir}/eclipse
  - Remove now-unnecessary OSGi configuration dir patch
  - Add patch to point to PDE Build location


author: Ville Skyttä <ville.skytta at iki.fi> - 0:3.8.1-4
changelog:
  - Disable debuginfo package when built with Eclipse support, change to
    noarch when built without it (#464017).


author: Mat Booth <mat.booth@redhat.com> - 1:54.1.1-1
changelog:
  - Update to latest upstream release
  - Add patch for building against java 8 taglet API
    - Fixes: rhbz#1087450, rhbz#1106794
  - Add patch for generating better OSGi metadata in core lib
  - Install core lib with mvn_install
  - Package localespi lib
  - Run test suite


author: Red Hat PKI Team <rhcs-maint@redhat.com> 4.6.0-5
changelog:
  - Red Hat Bugzilla #1747987 - CVE 2019-14823 jss: OCSP policy "Leaf and Chain" implicitly trusts the root certificate


author: Red Hat PKI Team <rhcs-maint@redhat.com> 4.7.2-1
changelog:
  - Rebase to upstream stable release JSS v4.7.2
  - Red Hat Bugzilla #1822246 - Fix SSLSocket NULL pointer deference after close


author: Red Hat PKI Team <rhcs-maint@redhat.com> 4.7.3-1
changelog:
  - Rebase to upstream stable release JSS v4.7.3
  - Red Hat Bugzilla #1873235 - Fix SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT in pki ca-user-cert-add


author: Red Hat PKI Team <rhcs-maint@redhat.com> 4.8.1-1
changelog:
  - Rebase to upstream JSS v4.8.1
  - Red Hat Bugilla #1908541 - jss broke SCEP - missing PasswordChallenge class
  - Red Hat Bugilla #1489256 - [RFE] jss should support RSA with OAEP padding


author: Red Hat PKI Team <rhcs-maint@redhat.com> 4.9.3-1
changelog:
  - Rebase to JSS 4.9.3
  - Bug 2046022 - CVE-2021-4213 pki-core:10.6/jss: memory leak in TLS connection leads to OOM [rhel-8]


author: Red Hat PKI Team <rhcs-maint@redhat.com> 4.9.4-1
changelog:
  - Rebase to JSS 4.9.4
  - Bug 2013674 - JSS cannot be properly initialized after using another NSS-backed security provider


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.0-0.3
changelog:
  - Iryna Shcherbina <ishcherb@redhat.com>: Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
  - Rebase to PKI 10.6.0 beta2


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.1-1
changelog:
  - Rebase to PKI 10.6.1
  - Bug 1559047 - pki-core misses a dependency to pki-symkey
  - Bug 1573094 - FreeIPA external CA installation fails


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.2-3
changelog:
  - Fix macro expressions
  - Bug 1566606 - pki-core: Switch to Python 3
  - Bug 1590467 - pki-core: Drop pylint dependency from RHEL 8


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.4-3
changelog:
  - Patch PKI to use Jackson 2 and avoid Jackson 1 dependency.
    Add direct dependency on slf4j-jdk14.


author: Alexander Bokovoy <abokovoy@redhat.com> 10.6.6-2
changelog:
  - Use platform-python interpreter
  - Bug 1620066 - pkispawn crashes as /usr/bin/python3 does not exist


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.8-1
changelog:
  - Rebase to PKI 10.6.8
  - Bug 1602659 - Fix issues found by covscan
  - Bug 1566360 - Fix missing serial number from pki-server subsystem-cert-find


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.9-1
changelog:
  - Rebase to PKI 10.6.9
  - Bug 1629048 - X500Name.directoryStringEncodingOrder overridden by CSR encoding
  - Bug 1652269 - Replace Nuxwdog
  - Bug 1656856 - Need Method to Include SKI in CA Signing Certificate Request


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.7.2-1
changelog:
  - Rebase to PKI 10.7.2
  - Bug 1721340 - TPS installation failure
  - Bug 1248216 - Incorrect pkidaemon status
  - Bug 1729215 - cert-fix: detect and prevent pkidbuser being used as --agent-uid
  - Bug 1698059 - pki-core implements crypto


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.7.3-1
changelog:
  - Rebase to PKI 10.7.3
  - Bug 1698084 - pkidestroy not working as expected
  - Bug 1468050 and Bug #1448235 - Support AES for LWCA key replication


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.3-1
changelog:
  - Rebase to PKI 10.8.3
  - Bug 1809210 - TPS installation failure on HSM machine
  - Bug 1807421 - Subordinate CA installation failed
  - Bug 1806840 - KRA cloning with HSM failed


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.1-2
changelog:
  - Bug 1857933 - CA Installation is failing with ncipher v12.30 HSM
  - Bug 1868233 - Disabling AIA and cert policy extensions in ACME examples


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.3-1
changelog:
  - Rebase to PKI 10.9.3
  - Bug 1869893 - Common certificates are missing in CS.cfg on shared PKI instance


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.4-1
changelog:
  - Rebase to PKI 10.9.4
  - Bug 1873235 - Fix SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT in pki ca-user-cert-add


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.0-0.2.beta1
changelog:
  - Rebase to PKI 10.10.0-beta1
  - Bug 1868233 - Disabling AIA and cert policy extensions in ACME examples


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.0-1
changelog:
  - Rebase to PKI 10.10.0
  - Add workaround for missing capture_output in Python 3.6
  - Fix JSS initialization in pki-server <subsystem>-user-cert-add
  - Fix NPE in UGSubsystem.findUsersByKeyword()
  - Bug 1787115 - Need Method to copy SKI from CSR to Certificate signed
  - Bug 1875563 - Add KRA Transport and Storage Certificates profiles, audit for IPA
  - Bug 1883996 - Inconsistent folders in pki-tools


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.1-1
changelog:
  - Rebase to PKI 10.10.1
  - Bug 1843416 - kra-audit-mod fail with Invalid event configuration
  - Bug 1889691 - ACME failed when run with more than 1 thread/connection
  - Bug 1891577 - Sub-ordinate installation is failing with NullPointerException


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.2-1
changelog:
  - Rebase to PKI 10.10.2
  - Bug 1392616 - KRA key recovery cli kra-key-retrieve generates an invalid p12 file
  - Bug 1897120 - pki-server cert-fix command failing
  - Bug 1694664 - ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (503)


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.3-1
changelog:
  - Rebase to PKI 10.10.3
  - Bug 1584550 - CRMFPopClient: unexpected behavior with -y option when values are specified
  - Bug 1590942 - CMCResponse treats -d as optional
  - Bug 1890639 - Two-step installation with external certificates fails on HSM configured system
  - Bug 1912493 - pkispawn reports incorrect FIPS mode


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.4-1
changelog:
  - Rebase to PKI 10.10.4
  - Bug 1664435 - Error instantiating class for challenge_password with SCEP request
  - Bug 1912418 - OCSP and TKS cloning failed due to duplicate replica ID
  - Bug 1916686 - Memory leak during ACME performance test
  - Bug 1919282 - ACME cert enrollment failed with HTTP 500


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.12.0-0.1
changelog:
  - Rebase to PKI 10.12.0
  - Bug 1904112 - pki fails to start if empty dir /var/lib/pki/pki-tomcat/kra exists
  - Bug 1984455 - [RFE] Date Format on the TPS Agent Page
  - Bug 1980378 - 'keyctl_search: Required key not available' message when running 'ipa-healthcheck'
  - Bug 2004084 - Reinstall of the same ipa-replica fails with 'RuntimeError: CA configuration failed.'
  - Bug 2006070 - Upgrades incorrectly add secret attribute to connectors


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.12.0-4
changelog:
  - Bug 2107334 - CVE-2022-2414 access to external entities when parsing XML can lead to XXE
  - Rename packages to idm-pki


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.14.3-1
changelog:
  - Rebase to PKI 10.14.3
  - Bug 1959057 - An error has ocorred (IPA Error 4301:CertificateOperationError)
  - Bug 2016164 - IdM Install fails on RHEL 8.5 Beta when DISA STIG is applied
  - Bug 2022561 - ipa-healthcheck CADogtagCertsConfigCheck fail to process the scenario of renewed IPA CA certificates ( ipa get_cert_from_db() )


author: Rex Dieter <rdieter[AT]fedoraproject.org> 1.0.0-2
changelog:
  - update %summary
  - -devel: +Requires: libGL-devel libGLU-devel
  - make install ... INSTALL="install -p" to preserve timestamps


author: Rex Dieter <rdieter@fedoraproject.org> - 1.0.2-2
changelog:
  - libIlmThread missing -pthread linkage (#661115)
  - %install: INSTALL="install -p"
  - -devel: tighten dep using %?_isa


author: Rex Dieter <rdieter@fedoraproject.org> - 1.0.3-3
changelog:
  - IlmBase.pc: +Requires.private: gl glu
  - -devel: drop hard-coded libGL/pkgconfig deps, let rpm autodetect now


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.0-1
changelog:
  - New upstream release
  - Add OpenSSL 1.0 compatibility package, due to issues with OpenSSL 1.1
  - Remove libtool files
  - Run ldconfig after un/installation to update *.so files
  - Add -devel subpackage to handle include files and examples


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.0-2
changelog:
  - Adjusted docbook xsl path to match the correct stylesheet
  - Remove only *.la files, considering there aren't any *.a files


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.0-3
changelog:
  - Add OpenSSL 1.1 API support for the package, avoiding the need of
    compat-openssl10-devel package


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.1-1
changelog:
  - New upstream release
  - Support for OpenSSL 1.1 was added directly to the source code in upstream,
    thus removing specific patch for it
  - Docbook xsl stylesheet updated to a local path


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.1-2
changelog:
  - Remove libtool files
  - Run ldconfig scriptlets after un/installing
  - Add -devel subpackage to handle include files and examples
  - Disable any static file in the package


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 1.1-3
changelog:
  - Solve memory leaks pointed by covscan tool
  - Add optimization flag O2 during compilation to satisfy annocheck tool


author: Martin Sivak <msivak@euryale.brq.redhat.com> - 0.3-1
changelog:
  - Use updated Anaconda API
  - Fix systemd units
  - Add localization spokes to TUI
  - Write changes to disk
  - Conflict with old firstboot


author: Martin Sivak <msivak@euryale.brq.redhat.com> - 0.3.1-1
changelog:
  - Use updated Anaconda API
  - Request firstboot environment spokes
  - Initialize anaconda threading properly


author: Martin Sivak <msivak@euryale.brq.redhat.com> - 0.3.2-1
changelog:
  - Modify the ROOT_PATH properly
  - Do not execute old ksdata (from anaconda's ks file)
  - Save the resulting configuration to /root/initial-setup-ks.cfg


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.5-1
changelog:
  - Reference the new repository in the .spec file (vpodzime)
  - Prevent systemd services from running on live images (#962196) (awilliam)
  - Don't traceback if the expected kickstart file doesn't exist (#950796) (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.6-1
changelog:
  - Make serial-getty wait for us as well (#970719) (vpodzime)
  - Disable the service only on successful exit (#967617) (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.7-1
changelog:
  - Prevent getty on various services killing us (#979174) (vpodzime)
  - Initialize network logging for the network spoke (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.8-1
changelog:
  - Read /etc/os-release to get product title (#1000426) (vpodzime)
  - Don't let product_title() return None (vpodzime)
  - Apply the timezone and NTP configuration (#985566) (hdegoede)
  - Make handling translations easier (vpodzime)
  - Make translations work (vpodzime)
  - Sync changelog with downstream (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.9-1
changelog:
  - Yet another serial console in ARMs (#1007163) (vpodzime)
  - Fix the base mask of initial_setup gui submodules (vpodzime)
  - Specify and use environment of the main hub (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.10-1
changelog:
  - Do not try to kill unexisting process (vpodzime)
  - Add some logging to our shell scripts (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.11-1
changelog:
  - Fix how spokes are collected for the I-S main hub (vpodzime)
  - Override distribution text in spokes (#1028370) (vpodzime)
  - Get rid of the useless modules directory (vpodzime)
  - Split GUI code into a separate package (#999464) (vpodzime)
  - Fallback to text UI if GUI is not available (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.12-1
changelog:
  - Adapt to changes in anaconda tui spoke categories (#1035462) (vpodzime)
  - Ignore the SIGINT (#1035590) (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.14-1
changelog:
  - Try to quit plymouth before running our X server instance (#1058329)
  - Get rid of the empty debuginfo package (#1062738)


author: Martin Kolman <mkolman@redhat.com> - 0.3.18-1
changelog:
  - Remove debugging code that was left in the tarball by mistake (#1091470) (mkolman)
  - Translation update


author: Martin Kolman <mkolman@redhat.com> - 0.3.19-1
changelog:
  - Bump required Anaconda version due to TUI category handling change (mkolman)
  - Override Hub collect methods also in TUI hub (mkolman)
  - Translation update


author: Martin Kolman <mkolman@redhat.com> - 0.3.24-1
changelog:
  - Fix Initial Setup to correctly support the Anaconda built-in Help (#1072033) (mkolman)
  - Populate README (#1110178) (master-log) (mkolman)
  - Remove the --disable-overwrite parameter for the Transifex client (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.27-1
changelog:
  - Remove unneeded dependencies (mkolman)
  - Add the rst suffix to the README file (mkolman)
  - Update the link to the upstream source code repository (mkolman)
  - Add AnacondaKSHandler no-member error to pylint-false-positives. (mulhern)
  - Mark strings for translation when module is loaded. (mulhern)
  - Fix easy pylint errors. (mulhern)
  - Add pylint testing infrastructure. (mulhern)


author: Martin Kolman <mkolman@redhat.com> - 0.3.32-1
changelog:
  - Point out the err in case that ks parsing failed (#1145130) (fabiand)
  - Switch to Zanata for translations (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.33-1
changelog:
  - Improve the Makefile (mkolman)
  - Remove old GUI testing code from the Makefile (mkolman)
  - Update upstream URL (#1213101) (mkolman)
  - Update upstream Git repository URL (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.36-1
changelog:
  - Setup the locale before starting the UI (dshea)
  - Run the TUI service before hvc0.service (#1209731) (mkolman)
  - Don't create /etc/sysconfig/initial-setup on s390 (#1181209) (mkolman)
  - Use systemd service status for run detection on S390 console (#1181209) (mkolman)
  - Read the kickstart from previous IS run, if available (#1110439) (mkolman)
  - Add support for externally triggered reconfig mode (#1110439) (mkolman)
  - Log the reason if GUI import fails (#1229747) (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.37-1
changelog:
  - Stop any Initial Setup services before upgrading package (#1244394) (mkolman)
  - Replace systemd_postun_with_restart with systemd_postun (#1244394) (mkolman)
  - Fix 'bumpver' make target (vtrefny)
  - Add archive target to Makefile (vtrefny)


author: Martin Kolman <mkolman@redhat.com> - 0.3.38-1
changelog:
  - Make Initial Setup startup more robust (mkolman)
  - Move the s390 profile scripts to a subfolder (mkolman)
  - Improve log messages for kickstart parsing error (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.40-1
changelog:
  - Use blank title for the Initial Setup window (mkolman)
  - Start the window manager correctly (#1160891) (mkolman)
  - Fix some rpmlint warnings (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.41-1
changelog:
  - Fix reconfiguration service name (mkolman)
  - Fix installation path for the reconfiguration-mode-enabled script (mkolman)
  - Use the environs flag when setting the environment (mkolman)
  - Some typo fixes and logging improvements (mkolman)
  - Add a systemd service that enables Initial Setup if /.unconfigured exists (#1257624) (mkolman)
  - Adapt to addon execute() signature change (mkolman)
  - Replace hardcoded python3 call by a variable (mkolman)
  - Nicer systemctl calls (mkolman)
  - Use systemd-cat also for the run-initial-setup script (mkolman)
  - Remove a redundant Requires: line (mkolman)
  - Fix a typo (mkolman)
  - Run correct systemd scriptlets (mkolman)
  - Use systemd-cat for logging to the journal (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.43-1
changelog:
  - Initialize SAM on startup (#1375721) (mkolman)
  - Log unhandled exceptions to Journal (mkolman)
  - Suppress logging to stdout when TUI is started by s390 startup scripts (mkolman)
  - Fix path to TUI executable in the s390 startup scripts (#1366776) (mkolman)
  - Canonicalize symlinks returned by readlink (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.49-1
changelog:
  - Use new Simpleline package (jkonecny)
  - Remove unused import (jkonecny)
  - add yet another ARM serial console (sjenning)


author: Martin Kolman <mkolman@redhat.com> - 0.3.50-1
changelog:
  - Use constant+offset when turning systemd console logging on/off (mkolman)
  - Add some more serial console options (pbrobinson)


author: Martin Kolman <mkolman@redhat.com> - 0.3.51-1
changelog:
  - Don't print directory changes when outputting the changelog (mkolman)
  - Automate release creation (mkolman)
  - Don't include merges in the spec file changelog (mkolman)
  - Update initial-setup-reconfiguration.service too, add another (mvebu) serial console (pbrobinson)
  - Add some more serial console options for ARM (pbrobinson)


author: Martin Kolman <mkolman@redhat.com> - 0.3.53-1
changelog:
  - Fix imports after Anaconda refactoring (jkonecny)
  - Return correct code at startup script success/failure (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.54-1
changelog:
  - Start and stop Boss (mkolman)
  - New version 0.3.53 (mkolman)
  - Add common function for finding bugreport URL (riehecky)


author: Martin Kolman <mkolman@redhat.com> - 0.3.55-1
changelog:
  - Handle kickstart commands provided by DBUS modules (mkolman)
  - Adapt to changes in starting Boss (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.60-1
changelog:
  - Fix name of the Zanata Python client package (mkolman)
  - Use the Anaconda default for DBUS module timeout (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.62-1
changelog:
  - Make EULA spoke name compatible with three column hub (mkolman)
  - Blacklist the ptmx console from multi-tty use (mkolman)
  - Add support for showing an EULA spoke (mkolman)
  - Add explicit dependency on X server for the GUI sub-package (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.63-1
changelog:
  - Disable modules in the configuration file (vponcova)
  - Let the DBus launcher to set up the modules (vponcova)
  - README.rst: update link to anaconda addon dev guide (kenyon)


author: Martin Kolman <mkolman@redhat.com> - 0.3.68-1
changelog:
  - Remove obsolete Group definition from the spec file (mkolman)
  - Initialize network module (device configurations) (#1685992) (rvykydal)
  - Specify the type of the installation system (#1685992) (vponcova)


author: Martin Kolman <mkolman@redhat.com> - 0.3.72-1
changelog:
  - Set physical and system roots in the configuration file (vponcova)
  - Write Anaconda logs to journal (vponcova)
  - Read configuration files from /etc/initial-setup/conf.d (#1713506) (vponcova)


author: Martin Kolman <mkolman@redhat.com> - 0.3.73-1
changelog:
  - Remove system root from DBus calls (vponcova)
  - Correct the name for libreport Python3 require (mkutlak)


author: Martin Kolman <mkolman@redhat.com> - 0.3.77-1
changelog:
  - Run the installation tasks of the Localization module (vponcova)
  - Use new DBus support for reading a kickstart file (vponcova)
  - Use autosetup instead of setup (mkolman)
  - Bump Anaconda version due to networking changes (mkolman)


author: Martin Kolman <martin.kolman@gmail.com> - 0.3.78-1
changelog:
  - Revert "Fix import of the DBus launcher" (martin.kolman)
  - Run the installation tasks of the DBus addons (vponcova)
  - Run the installation tasks of the Timezone module (vponcova)
  - Fix import of the DBus launcher (vponcova)


author: Martin Kolman <mkolman@redhat.com> - 0.3.80-1
changelog:
  - Do not call a task which has been moved into install keyboard task (rvykydal)
  - Adapt to changes in localization module (rvykydal)
  - Fix Zanata client detection in Makefile (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.81-1
changelog:
  - Use macro for Python 3 requirement in spec file (mkolman)
  - Remove outdated dependency on python3-libreport (vslavik)
  - Fix a typo in Zanata CLI invocation (mkolman)


author: Martin Kolman <mkolman@redhat.com> - 0.3.81.5-1
changelog:
  - Disable multi TTY handler when running in SSH session (mkolman)
  - Add CLI option to disable multi TTY handler (mkolman)
  - Add PEP8 Speaks configuration (mkolman)
  - Add missing branch config to manifest file (jkonecny)
  - Add translation badge to the README file (jkonecny)
  - Remove unused PREFIX variable from Makefile (jkonecny)
  - Use new po-push instead of Zanata (jkonecny)
  - Add po-push using localization repository (jkonecny)
  - Use translation repository to pull the translations (jkonecny)


changelog: - new release
author:
  Aaron Hetherington <aaron.hetherington@intel.com>, Michal Aleksinski <michalx.aleksinski@intel.com> 1.0.0-1


author: Adam Jackson <ajax@redhat.com> 2.19.0-4.20120529
changelog:
  - Today's git snapshot
  - Enable SNA (default is still UXA, use Option "AccelMethod" to switch)
  - build-fix.patch: Fix build with Fedora's default cflags


author: Adam Jackson <ajax@redhat.com> 2.20.4-2
changelog:
  - Backport some patches to avoid binding to non-i915.ko-driven Intel GPUs,
    like Cedarview and friends (#849475)


author: Adam Jackson <ajax@redhat.com> 2.20.6-2
changelog:
  - Only bother to build UMS (read: i810) support on 32-bit.  If you've
    managed to build a machine with an i810 GPU but a 64-bit CPU, please
    don't have done that.


author: Adam Jackson <ajax@redhat.com> 2.20.10-2
changelog:
  - Today's i-g-t
  - Don't bother building the nouveau bits of i-g-t on OSes without an X
    server with prime support.


author: Adam Jackson <ajax@redhat.com> 2.21.9-1
changelog:
  - intel 2.21.9
  - New i-g-t snapshot
  - Drop useless symlinks from -devel
  - Repurpose -devel for intel-gen4{,dis}asm
  - Default to SNA in F20+


author: Hans de Goede <hdegoede@redhat.com> - 2.99.911-2
changelog:
  - xserver 1.15.99-20140428 git snapshot ABI rebuild
  - Add 2 patches from upstream to not close server-fds of udl devices


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-3
changelog:
  - Git snapshot of the day to bring in various DPMS and other fixes
  - Update gpu-tools to 1.9
  - Xserver 1.17 ABI rebuild


author: Adam Jackson <ajax@redhat.com> 2.99.917-9
changelog:
  - Today's git snap
  - Don't force the default to DRI3, use upstream's preference
  - Fix build failure due to GCC PR65873


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-22.20160119
changelog:
  - xorg-x11-drv-intel hardly has any accel on skylake and newer, so make
    Xorg fallback to modesetting + glamor by returning FALSE from probe
  - Using glamor also gives us proper Xvideo support on skylake (rhbz#1305369)


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-23.20160512
changelog:
  - Update to 20160512 snapshot
  - This fixes laptops with switchable graphics hanging after a dpms off of
    the lcd screen (rhbz#1334581)
  - Fix fd-leak when falling back to mode-setting on skylake, this fixes
    Xorg exiting with a "drmSetMaster failed" error when not using server
    managed fds (e.g. using a different login manager then gdm)
  - Fix duplicate binaries in -devel / intel-gpu-tools subpackages (rhbz#1323641)


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-24.20160712
changelog:
  - Git snapshot du jour, bringing in a bunch of bugfixes
  - Fix dpi issues on Surface 3 (also needs some kernel fixes)
  - Hopefully fix rhbz#1354124


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-27
changelog:
  - Drop the patch to fail probe on skylake and newer, the xserver now
    defaults to the modesetting driver for all recent GPUs


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 2.99.917-39.20200205.0.1
changelog:
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Add libXv-devel build requirement


author: Tim Powers <timp@redhat.com>
changelog:
  - cleaned up files list so that there aren't non-standard dirs and so
    that it owns the xml-i18n-tools dir


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - s/Copyright/License/
  - Shorter summary
  - Remove empty post/postun scripts
  - Don't define name and ver on the top and use this in the headers later


author: Owen Taylor <otaylor@redhat.com>
changelog:
  - Version 0.14
  - Try again on DBM fix
  - Patch to use AnyDBM_File rather than NDBM_File for caching
  - Version 0.14


author: Matthias Clasen <mclasen@redhat.com> - 0.36.0-1
changelog:
  - Update to 0.36.0
  - Update license field
  - Drop patch rejected, obsolete and upstreamed patches
  - Some spec file cleanups
  - Require automake


author: Alon Levy <alevy@redhat.com>
changelog:
  - Update to 0.50.0
  - Drop patch carried for bz#568845 (schemas-merge) per last comment
    in that bug.


author: Jon Ciesla <limburgher@gmail.com> - 0.50.2-1
changelog:
  - Latest stable release.
  - Merge review BZ 225902 fixes:
  - Removed Obsoletes/Provides for xml-i18n-tools.
  - Swapped gettext/gettext-devel Requires, BuildRequires.
  - Added %check section.


author: David King <amigadave@amigadave.com> - 0.51.0-1
changelog:
  - Update to 0.51.0
  - Use license macro for COPYING
  - Preserve timestamps during install
  - Use parallel make flags
  - Update man page glob in files section


author: Colin Walters <walters@redhat.com> - 0.51.0-4
changelog:
  - Add patch to hopefully close race condition in systemd builds
  - Related to https://bugzilla.redhat.com/show_bug.cgi?id=1249051
  - And the test suite is failing but the logs are hidden under
    test-suite.log, so copy some code I had in dbus.spec to cat them.


author: Eric Sandeen <sandeen@redhat.com> - 1.0.1-2
changelog:
  - Upstream respun the release tarball to re-include top-level dir
  - drop exclude of bno_plot.py[co], not getting built now?


author: Rob Crittenden <rcritten@redhat.com> - 0.1.0-2
changelog:
  - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
  - Remove references to admin server in ipa-server-setupssl
  - Generate a client certificate for the XML-RPC server to connect to LDAP with
  - Create a keytab for Apache
  - Create an ldif with a test user
  - Provide a certmap.conf for doing SSL client authentication


author: Karl MacMillan <kmacmill@redhat.com> - 0.4.0-2
changelog:
  * Fri Sep 7 2007 Karl MacMillan <kmacmill@redhat.com> - 0.3.0-1
  - Added support for libipa-dna-plugin


author: Rob Crittenden <rcritten@redhat.com> - 0.4.1-2
changelog:
  - Broke invididual Requires and BuildRequires onto separate lines and
    reordered them
  - Added python-tgexpandingformwidget as a dependency
  - Require at least fedora-ds-base 1.1


author: Rob Crittenden <rcritten@redhat.com> 0.99-3
changelog:
  - Included LICENSE and README in all packages for documentation
  - Move user-modifiable content to /etc/ipa and linked back to
    /usr/share/ipa/html
  - Changed some references to /usr to the {_usr} macro and /etc
    to {_sysconfdir}
  - Added popt-devel to BuildRequires for Fedora 8 and higher and
    popt for Fedora 7
  - Package the egg-info for Fedora 9 and higher for ipa-python


author: Rob Crittenden <rcritten@redhat.com> 0.99-7
changelog:
  - Ensure that /etc/ipa exists before moving user-modifiable html files there
  - Put html files into /etc/ipa/html instead of /etc/ipa


author: Rob Crittenden <rcritten@redhat.com> 0.99-9
changelog:
  - Pull upstream changelog 641
  - Require minimum version of krb5-server on F-7 and F-8
  - Package some new files


author: Rob Crittenden <rcritten@redhat.com> 0.99-10
changelog:
  - Pull upstream changelog 678
  - Add new subpackage, ipa-server-selinux
  - Add Requires: authconfig to ipa-python (bz #433747)
  - Package i18n files


author: Rob Crittenden <rcritten@redhat.com> 0.99-11
changelog:
  - Pull upstream changelog 698
  - Fix ownership of /var/log/ipa_error.log during install (435119)
  - Add pwpolicy command and man page


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-2
changelog:
  - Fix Requires for krb5-server that was missing for Fedora versions > 9
  - Remove quotes around test for fedora version to package egg-info


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-4
changelog:
  - Add missing entry for /var/cache/ipa/kpasswd (444624)
  - Added patch to fix permissions problems with the Apache NSS database.
  - Added patch to fix problem with DNS querying where the query could be
    returned as the answer.
  - Fix spec error where patch1 was in the wrong section


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-5
changelog:
  - Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
    version to 1.0.7-4 so we pick up the NSS fixes.
  - Add selinux-policy-base(post) to Requires (446496)


author: Rob Crittenden <rcritten@redhat.com> - 1.1.0-1
changelog:
  - Update to upstream version 1.1.0
  - Patch for indexing memberof attribute
  - Patch for indexing uidnumber and gidnumber
  - Patch to change DNA default values for replicas
  - Patch to fix uninitialized variable in ipa-getkeytab


author: Simo Sorce <ssorce@redhat.com> - 1.1.0-3
changelog:
  - Fix for CVE-2008-3274
  - Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
  - Add fix for bug #453185
  - Rebuild against openldap libraries, mozldap ones do not work properly
  - TurboGears is currently broken in rawhide. Added patch to not build
    the UI locales and removed them from the ipa-server files section.


author: Rob Crittenden <rcritten@redhat.com> - 1.2.0-1
changelog:
  - Update to upstream version 1.2.0
  - Set fedora-ds-base minimum version to 1.1.3 for winsync header
  - Set the minimum version for SELinux policy
  - Remove references to Fedora 7


author: Simo Sorce <ssorce@redhat.com> - 1.2.0-3
changelog:
  - Respin after the tarball has been re-released upstream
    New hash is 506c9c92dcaf9f227cba5030e999f177


author: Jason Gerard DeRose <jderose@redhat.com> - 1.99-8
changelog:
  - Removed python-cherrypy from BuildRequires and Requires
  - Added Requires python-assets, python-wehjit


author: Rob Crittenden <rcritten@redhat.com> - 1.99-23
changelog:
  - Change Requires from fedora-ds-base to 389-ds-base
  - Set minimum level of 389-ds-base to 1.2.6 for the replication
    version plugin.


author: Rob Crittenden <rcritten@redhat.com> - 1.99-27
changelog:
  - Set minimum version of certmonger to 0.26 (to pck up #621670)
  - Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
  - Set minimum version of pki-ca to 1.3.6
  - Set minimum version of sssd to 1.2.1


author: Rob Crittenden <rcritten@redhat.com> - 1.99-28
changelog:
  - Drop conflicts on mod_nss
  - Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
  - Drop a slew of conditionals on older Fedora releases (< 12)
  - Add a few conditionals against RHEL 6
  - Add Requires of nss-tools on ipa-client


author: Rob Crittenden <rcritten@redhat.com> - 1.99-29
changelog:
  - Drop requires on python-configobj (not used any more)
  - Drop ipa-ldap-updater message, upgrades are done differently now


author: Simo Sorce <ssorce@redhat.com> - 1.99-39
changelog:
  - Remove dependency on nss_ldap/nss-pam-ldapd
  - The official client is sssd and that's what we use by default.


author: Rob Crittenden <rcritten@redhat.com> - 1.99-41
changelog:
  - Re-arrange doc and defattr to clean up rpmlint warnings
  - Remove conditionals on older releases
  - Move some man pages into admintools subpackage
  - Remove some explicit Requires in client that aren't needed
  - Consistent use of buildroot vs RPM_BUILD_ROOT


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.2.beta.git80e87e7
changelog:
  - Remove unnecessary moving of v1 CA serial number file in post script
  - Add Obsoletes for server-selinxu subpackage
  - Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.beta2
changelog:
  - Set min version of 389-ds-base to 1.2.8
  - Set min version of mod_nss 1.0.8-10
  - Set min version of selinux-policy to 3.9.7-27
  - Add dogtag themes to Requires
  - Update to upstream freeipa-2.0.0.pre2


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.rc1
changelog:
  - Set minimum version of sssd to 1.5.1
  - Update to upstream freeipa-2.0.0.rc1
  - Move server-only binaries from admintools subpackage to server


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.4.rc2
changelog:
  - Update to upstream freeipa-2.0.0.rc2
  - Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
  - Set minimum version of sssd to 1.5.1
  - Patch to include SuiteSpotGroup when setting up 389-ds instances
  - Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled


author: Rob Crittenden <rcritten@redhat.com> - 2.0.1-1
changelog:
  - Update minimum selinux-policy to 3.9.16-18
  - Update minimum pki-ca and pki-selinux to 9.0.7
  - Update minimum 389-ds-base to 1.2.8.0-1
  - Update to upstream 2.0.1


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-6
changelog:
  - Introduce upgrade script to recover existing configuration after systemd migration
    as user has no means to recover FreeIPA from systemd migration
  - Upgrade script:
    - recovers symlinks in Dogtag instance install
    - recovers systemd configuration for FreeIPA's directory server instances
    - recovers freeipa.service
    - migrates directory server and KDC configs to use proper keytabs for systemd services


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-2
changelog:
  - Allow longer dirsrv startup with systemd:
    - IPAdmin class will wait until dirsrv instance is available up to 10 seconds
    - Helps with restarts during upgrade for ipa-ldap-updater
  - Fix pylint warnings from F16 and Rawhide


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-3
changelog:
  - Allow Web-based migration to work with tightened SE Linux policy (#769440)
  - Rebuild slapi plugins against re-enterant version of libldap


author: Martin Kosek <mkosek@redhat.com> - 2.1.4-4
changelog:
  - Fix ipa-replica-install crashes
  - Fix ipa-server-install and ipa-dns-install logging
  - Set minimum version of pki-ca to 9.0.17 to fix sslget problem
    caused by FEDORA-2011-17400 update (#771357)


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-5
changelog:
  - Force to use 389-ds 1.2.10-0.8.a7 or above
  - Improve upgrade script to handle systemd 389-ds change
  - Fix freeipa to work with python-ldap 2.4.6


author: Rob Crittenden <rcritten@redhat.com> - 2.1.90-0.2
changelog:
  - Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
  - Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
  - Add Conflicts on mod_ssl
  - Update minimum n-v-r of 389-ds-base to 1.2.10.4
  - Update minimum n-v-r of sssd to 1.8.0
  - Update minimum n-v-r of slapi-nis to 0.38
  - Update minimum n-v-r of pki-* to 9.0.18
  - Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
  - Update conflicts on bind to < 9.9.0-1
  - Drop requires on krb5-server-ldap
  - Add patch to remove escaping arguments to pkisilent


author: Rob Crittenden <rcritten@redhat.com> - 2.2.0-1
changelog:
  - Updated to upstream 2.2.0 GA
  - Update minimum n-v-r of certmonger to 0.53
  - Update minimum n-v-r of slapi-nis to 0.40
  - Add Requires in client to oddjob-mkhomedir and python-krbV
  - Update minimum selinux-policy to 3.10.0-110


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.8
changelog:
  - Updated to upstream 3.0.0 rc 1
  - Update BR for 389-ds-base to 1.2.11.14
  - Update BR for krb5 to 1.10
  - Update BR for samba4-devel to 4.0.0-139 (rc1)
  - Add BR for python-polib
  - Update BR and Requires on sssd to 1.9.0
  - Update Requires on policycoreutils to 2.1.12-5
  - Update Requires on 389-ds-base to 1.2.11.14
  - Update Requires on selinux-policy to 3.11.1-21
  - Update Requires on dogtag to 10.0.0-0.33.a1
  - Update Requires on certmonger to 0.60
  - Update Requires on tomcat to 7.0.29
  - Update minimum version of bind to 9.9.1-10.P3
  - Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
  - Remove Requires on authconfig from python sub-package


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.10
changelog:
  - Updated to upstream 3.0.0 rc 2
  - Include new FF configuration extension
  - Set minimum Requires of selinux-policy to 3.11.1-33
  - Set minimum Requires dogtag to 10.0.0-0.43.b1
  - Add new optional strict sub-package to allow users to limit other
    package upgrades.


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-1
changelog:
  - Updated to upstream 3.0.0 GA
  - Set minimum for samba to 4.0.0-153.
  - Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
    plugin to /dev/null since they cannot be used when trusts are configured
  - Restrict krb5-server to 1.10.
  - Update BR for 389-ds-base to 1.3.0
  - Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
  - Add Requires on zip for generating FF browser extension


author: Rob Crittenden <rcritten@redhat.com> - 3.1.0-1
changelog:
  - Updated to upstream 3.1.0 GA
  - Set minimum for sssd to 1.9.2
  - Set minimum for pki-ca to 10.0.0-1
  - Set minimum for 389-ds-base to 1.3.0
  - Set minimum for selinux-policy to 3.11.1-60
  - Remove unneeded dogtag package requires


author: Martin Kosek <mkosek@redhat.com> - 3.1.0-2
changelog:
  - Remove redundat Requires versions that are already in Fedora 17
  - Replace python-crypto Requires with m2crypto
  - Add missing Requires(post) for client and server-trust-ad subpackages
  - Restart httpd service when server-trust-ad subpackage is installed
  - Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes


author: Rob Crittenden <rcritten@redhat.com> - 3.1.2-1
changelog:
  - Update to upstream 3.1.2
  - CVE-2012-4546: Incorrect CRLs publishing
  - CVE-2012-5484: MITM Attack during Join process
  - CVE-2013-0199: Cross-Realm Trust key leak
  - Updated strict dependencies to 389-ds-base = 1.3.0.2 and
    pki-ca = 10.0.1


author: Martin Kosek <mkosek@redhat.com> - 3.2.0-0.1.pre1
changelog:
  - Update to upstream 3.2.0 Prerelease 1
  - Use upstream reference spec file as a base for Fedora spec file


author: Rob Crittenden <rcritten@redhat.com> - 3.2.0-0.3.beta1
changelog:
  - Add a Requires for java-atk-wrapper until we can determine which package
    should be pulling it in, dogtag or tomcat.


author: Rob Crittenden <rcritten@redhat.com> - 3.2.0-1
changelog:
  - Update to upstream 3.2.0 GA
  - ipa-client-install fails if /etc/ipa does not exist (#961483)
  - Certificate status is not visible in Service and Host page (#956718)
  - ipa-client-install removes needed options from ldap.conf (#953991)
  - Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
  - Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
  - Require nss 3.14.3-12.0 to address certutil certificate import
    errors (#953485)
  - Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
    environments. (#953464)
  - ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
  - ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
  - Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
    socket based connections (#960222)
  - Require libsss_nss_idmap-python
  - Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
    member is now done automatically and having it in the config file raises
    an error.
  - Add backup and restore tools, directory.
  - require at least systemd 38 which provides the journal (we no longer
    need to require syslog.target)
  - Update Requires on policycoreutils to 2.1.14-37
  - Update Requires on selinux-policy to 3.12.1-42
  - Update Requires on 389-ds-base to 1.3.1.0
  - Remove a Requires for java-atk-wrapper


author: Martin Kosek <mkosek@redhat.com> - 3.2.2-1
changelog:
  - Update to upstream 3.2.2
  - Drop ipa-server-selinux subpackage
  - Drop redundant directory /var/cache/ipa/sessions
  - Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
  - Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
    issues when there are still old parts of software (like entitlements plugin)


author: Martin Kosek <mkosek@redhat.com> - 3.3.0-2
changelog:
  - Remove ipa-server-selinux obsoletes as upgrades from version prior to
    3.3.0 are not allowed
  - Wrap server-trust-ad subpackage description better
  - Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
  - Change permissions on default_encoding_utf8.so to fix ipa-python Provides


author: Martin Kosek <mkosek@redhat.com> - 3.3.0-4
changelog:
  - ipa-server-install fails if --subject parameter is other than default
    realm (#983075)
  - do not allow configuring bind-dyndb-ldap without persistent search (#967876)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-2
changelog:
  - Unable to remove replica by ipa-replica-manage (#1001662)
  - Before uninstalling a server, warn about active replicas (#998069)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-3
changelog:
  - Replica installation fails for RHEL 6.4 master (#1004680)
  - Server uninstallation crashes if DS is not available (#998069)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-5
changelog:
  - Remove dependency on python-paramiko (#1002884)
  - Broken redirection when deleting last entry of DNS resource
    record (#1006360)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-1
changelog:
  - Update to upstream 3.3.2 (#991064)
  - Add delegation info to MS-PAC (#915799)
  - Warn about incompatibility with AD when IPA realm and domain
    differs (#1009044)
  - Allow PKCS#12 files with empty password in install tools (#1002639)
  - Privilege "SELinux User Map Administrators" did not list
    permissions (#997085)
  - SSH key upload broken when client joins an older server (#1009024)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-2
changelog:
  - Deprecate --serial-autoincrement option (#1016645)
  - CA installation always failed on replica (#1005446)
  - Re-initializing a winsync connection exited with error (#994980)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-4
changelog:
  - Server install failure during client enrollment shouldn't
    roll back (#1023086)
  - nsds5ReplicaStripAttrs are not set on agreements (#1023085)
  - ipa-server conflicts with mod_ssl (#1018172)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-5
changelog:
  - Temporarily move ipa-backup and ipa-restore functionality
    back to make them available in public Beta (#1003933)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-3
changelog:
  - Installer did not detect different server and IPA domain (#1026845)
  - Allow kernel keyring CCACHE when supported (#1026861)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-5
changelog:
  - Trust add tries to add same value of --base-id for sub domain,
    causing an error (#1033068)
  - Improved error reporting for adding trust case (#1029856)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-6
changelog:
  - Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
  - Re-adding existing trust fails (#1033216)
  - IPA uninstall exits with a samba error (#1033075)
  - Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
  - Fixed ownership of /usr/share/ipa/ui/js (#1026260)
  - ipa-tests: support external names for hosts (#1032668)
  - ipa-client-install fail due fail to obtain host TGT (#1029354)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-8
changelog:
  - Fix status trust-add command status message (#910453)
  - NetBIOS was not trimmed at 15 characters (#1030517)
  - Harden CA subsystem certificate renewal on CA clones (#1040018)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-12
changelog:
  - Missing objectclasses when empty password passed to host-add (#1052979)
  - sudoOrder missing in sudoers (#1052983)
  - Missing examples in sudorule help (#1049464)
  - Client automount does not uninstall when fstore is empty (#910899)
  - Error not clear for invalid realm given to trust-fetch-domains (#1052981)
  - trust-fetch-domains does not add idrange for subdomains found (#1049926)
  - Add option to show if an AD subdomain is enabled/disabled (#1052973)
  - ipa-adtrust-install still failed with long NetBIOS names (#1030517)
  - Error not clear for invalid relam given to trustdomain-find (#1049455)
  - renewed client cert not recognized during IPA CA renewal (#1033273)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-13
changelog:
  - Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
  - Increase default timeout for IPA services (#1033273)
  - Error while running trustdomain-find (#1054376)
  - group-show lists SID instead of name for external groups (#1054391)
  - Fix IPA server NetBIOS name in samba configuration (#1030517)
  - dnsrecord-mod produces missing API version warning (#1054869)
  - Hide trust-resolve command as internal (#1052860)
  - Add Trust domain Web UI (#1054870)
  - ipasam cannot delete multiple child trusted domains (#1056120)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-16
changelog:
  - Fallback to global policy in ipa lockout plugin (#912725)
  - Migration does not add users to default group (#903232)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-18
changelog:
  - Display server name in ipa command's verbose mode (#1061703)
  - Remove sourcehostcategory from default HBAC rule (#1061187)
  - dnszone-add cannot add classless PTR zones (#1058688)
  - Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-20
changelog:
  - trustdomain-find with pkey-only fails (#1068611)
  - Invalid credential cache in trust-add (#1069182)
  - ipa-replica-install prints unexpected error (#1069722)
  - Too big font in input fields in details facet in Firefox (#1069720)
  - trust-add for POSIX AD does not fetch trustdomains (#1070925)
  - Misleading trust-add error message in some cases (#1070926)
  - Access is not rejected for disabled domain (#1070924)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-22
changelog:
  - ipa-replica-install never checks for 7389 port (#1075165)
  - Non-terminated string may be passed to LDAP search (#1075091)
  - ipa-sam may fail to translate group SID into GID (#1073829)
  - Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-26
changelog:
  - When IdM server trusts multiple AD forests, IPA client returns invalid group
    membership info (#1079498)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-28
changelog:
  - ipa-client-automount fails with incompatibility error when installed against
    older IPA server (#1083108)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-29
changelog:
  - Server installation fails using external signed certificates with
    "IndexError: list index out of range" (#1111320)
  - Add rhino to BuildRequires to fix Web UI build error


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-4
changelog:
  - Update Requires on pki-ca to 10.1.2-4 (#1129558)
  - build: increase java stack size for all arches
  - Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
  - Fix dns zonemgr validation regression (#1056202)
  - Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
  - Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
    (#886645)
  - Add bind-dyndb-ldap working dir to IPA specfile
  - Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
    (#886645)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - Deadlock in schema compat plugin (#1161131)
  - ipactl stop should stop dirsrv last (#1161129)
  - Upgrade 3.3.5 to 4.1 failed (#1161128)
  - CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-5
changelog:
  - Update slapi-nis dependency to pull 0.54-2 (#891984)
  - ipa-restore: Don't crash if AD trust is not installed (#951581)
  - Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
  - Trust setting not restored for CA cert with ipa-restore command (#1159011)
  - ipa-server-install fails when restarting named (#1162340)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-6
changelog:
  - Fix: DNS installer adds invalid zonemgr email (#1056202)
  - ipaplatform: Use the dirsrv service, not target (#951581)
  - Fix: DNS policy upgrade raises asertion error (#1161128)
  - Fix upgrade referint plugin (#1161128)
  - Upgrade: fix trusts objectclass violationi (#1161128)
  - group-add doesn't accept gid parameter (#1149124)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-7
changelog:
  - ipa-csreplica-manage connect fails (#1157735)
  - error message which is not understandable when IDNA2003 characters are
    present in --zonemgr (#1163849)
  - Fix warning message should not contain CLI commands (#1114013)
  - Renewing the CA signing certificate does not extend its validity period end
    (#1163498)
  - RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
    httpd (#1159330)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-8
changelog:
  - Improve otptoken help messages (#919228)
  - Ensure users exist when assigning tokens to them (#919228)
  - Enable QR code display by default in otptoken-add (#919228)
  - Show warning instead of error if CA did not start (#1158410)
  - CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
  - Traceback when adding zone with long name (#1164859)
  - Backup & Restore mechanism (#951581)
  - ignoring user attributes in migrate-ds does not work if uppercase characters
    are returned by ldap (#1159816)
  - Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
  - Failure when installing on dual stacked system with external ca (#1128380)
  - ipa-server should keep backup of CS.cfg (#1059135)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - webui: use domain name instead of domain SID in idrange adder dialog
    (#891984)
  - webui: normalize idview tab labels (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-9
changelog:
  - schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
    build fails (#1167196)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - "ipa trust-add ... " cmd says : (Trust status: Established and verified)
    while in the logs we see "WERR_ACCESS_DENIED" during verification step.
    (#1144121)
  - POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
    (#1156466)
  - Add support/hooks for a one-time password system like SecureID in IPA
    (#919228)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - ID Views: Support migration from the sync solution to the trust solution
    (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-11
changelog:
  - Throw zonemgr error message before installation proceeds (#1163849)
  - Winsync: Setup is broken due to incorrect import of certificate (#1169867)
  - Enable last token deletion when password auth type is configured (#919228)
  - ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
  - add --hosts and --hostgroup options to allow/retrieve keytab methods
    (#1007367)
  - Extend host-show to add the view attribute in set of default attributes
    (#1168916)
  - Prefer TCP connections to UDP in krb5 clients (#919228)
  - [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
  - webui: increase notification duration (#1171089)
  - RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
  - RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
    (#1170003)
  - Improve validation of --instance and --backend options in ipa-restore
    (#951581)
  - RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
  - Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-12
changelog:
  - RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
    (#1169591)
  - CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
    (#1172578)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-13
changelog:
  - Expand the token auth/sync windows (#919228)
  - Access is not rejected for disabled domain (#1172598)
  - krb5kdc crash in ldap_pvt_search (#1170695)
  - RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-14
changelog:
  - IPA Replicate creation fails with error "Update failed! Status: [10 Total
    update abortedLDAP error: Referral]" (#1166265)
  - running ipa-server-install --setup-dns results in a crash (#1072502)
  - DNS zones are not migrated into forward zones if 4.0+ replica is added
    (#1175384)
  - gid is overridden by uid in default trust view (#1168904)
  - When migrating warn user if compat is enabled (#1177133)
  - Clean up debug log for trust-add (#1168376)
  - No error message thrown on restore(full kind) on replica from full backup
    taken on master (#1175287)
  - ipa-restore proceed even IPA not configured (#1175326)
  - Data replication not working as expected after data restore from full backup
    (#1175277)
  - IPA externally signed CA cert expiration warning missing from log (#1178128)
  - ipa-upgradeconfig fails in CA-less installs (#1181767)
  - IPA certs fail to autorenew simultaneouly (#1173207)
  - More validation required on ipa-restore's options (#1176034)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-16
changelog:
  - PassSync does not sync passwords due to missing ACIs (#1181093)
  - ipa-replica-manage list does not list synced domain (#1181010)
  - Do not assume certmonger is running in httpinstance (#1181767)
  - ipa-replica-manage disconnect fails without password (#1183279)
  - Put LDIF files to their original location in ipa-restore (#1175277)
  - DUA profile not available anonymously (#1184149)
  - IPA replica missing data after master upgraded (#1176995)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-17
changelog:
  - Wrong directories created on full restore (#1186398)
  - ipa-restore crashes if replica is unreachable (#1186396)
  - idoverrideuser-add option --sshpubkey does not work (#1185410)


author: Martin Kosek <mkosek@redhat.com> - 4.1.0-18
changelog:
  - Fix ipa-pwd-extop global configuration caching (#1187342)
  - group-detach does not add correct objectclasses (#1187540)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-18.1
changelog:
  - "an internal error has occurred" during ipa host-del --updatedns (#1198431)
  - Renamed patch 1013 to 0114, as it was merged upstream
  - Fax number not displayed for user-show when kinit'ed as normal user.
    (#1198430)
  - Replication agreement with replica not disabled when ipa-restore done without
    IPA installed (#1199060)
  - Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.1.0-18.2
changelog:
  - IPA extdom plugin fails when encountering large groups (#1193759)
  - CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
    (#1202998)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-18.3
changelog:
  - [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
    (SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-0.1.alpha1
changelog:
  - Resolves: #805188  [RFE] "ipa migrate-ds" ldapsearches with scope=1
  - Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
    throws Internal server error
  - Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
  - Resolves: #1045153 ipa-managed-entries --list -p <badpassword> still requires
    DM password
  - Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
    from ldap_port_t
  - Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
  - Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
    matching uidgid
  - Resolves: #1176036 IDM client registration failure in a high load environment
  - Resolves: #1183116 Remove Requires: subscription-manager
  - Resolves: #1186054 permission-add does not prompt to enter --right option in
    interactive mode
  - Resolves: #1187524 Replication agreement with replica not disabled when
    ipa-restore done without IPA installed
  - Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
    normal user.
  - Resolves: #1189034 "an internal error has occurred" during ipa host-del
    --updatedns
  - Resolves: #1193554 ipa-client-automount: failing with error LDAP server
    returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
  - Resolves: #1193759 IPA extdom plugin fails when encountering large groups
  - Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
    certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
  - Resolves: #1194633 Default trust view can be deleted in lower case
  - Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
    server instance - confusing CA staus message on TLS error
  - Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
  - Resolves: #1199527 [RFE] Use datepicker component for datetime fields
  - Resolves: #1200867 [RFE] Make OTP validation window configurable
  - Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
  - Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
    get_user_grouplist() [rhel-7.2]
  - Resolves: #1204637 slow group operations
  - Resolves: #1204642 migrate-ds: slow add o users to default group
  - Resolves: #1208461 IPA CA master server update stuck on checking getStatus
    via https
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1211708 ipa-client-install gets stuck during NTP sync
  - Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
    sync
  - Resolves: #1215200 ipa-client-install configures IPA server as NTP source
    even if IPA server has not ntpd configured
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
  - Related:  #1204809 Rebase ipa to 4.2
    - Update to upstream 4.2.0.alpha1


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-0.2.alpha1
changelog:
  - Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
  - Related:  #1204809 Rebase ipa to 4.2
    - Fix minimum version of slapi-nis
    - Require python-sss and python-sss-murmur (provided by sssd-1.13.0)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-1
changelog:
  - Resolves: #846033  [RFE] Documentation for JSONRPC IPA API
  - Resolves: #989091  Ability to manage IdM/IPA directly from a standard LDAP
    client
  - Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
    users in IdM
  - Resolves: #1115294 [RFE] Add support for DNSSEC
  - Resolves: #1145748 [RFE] IPA running with One Way Trust
  - Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
  - Resolves: #1200728 [RFE] Replicate PKI Profile information
  - Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
  - Resolves: #1204054 SSSD database is not cleared between installs and
    uninstalls of ipa
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
  - Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
  - Resolves: #1204504 [RFE] Add access control so hosts can create their own
    services
  - Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
  - Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
  - Resolves: #1209476 package ipa-client does not require package dbus-python
  - Resolves: #1211589 [RFE] Add option to skip the verify_client_version
  - Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
  - Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
  - Resolves: #1217010 OTP Manager field is not exposed in the UI
  - Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
    00007fffd68b2340 error 6 in libc-2.17.so
  - Related:  #1204809 Rebase ipa to 4.2
    - Update to upstream 4.2.0
    - Move /etc/ipa/kdcproxy to the server subpackage


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-2
changelog:
  - Resolves: #1131907 [ipa-client-install] cannot write certificate file
    '/etc/ipa/ca.crt.new': must be string or buffer, not None
  - Resolves: #1195775 unsaved changes dialog internally inconsistent
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - Stageusedr-activate: show username instead of DN
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - Prevent to rename certprofile profile id
  - Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
  - Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
    - copy-schema-to-ca: allow to overwrite schema files
  - Resolves: #1241941 kdc component installation of IPA failed
    - spec file: Update minimum required version of krb5
  - Resolves: #1242036 Replica install fails to update DNS records
    - Fix DNS records installation for replicas
  - Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
    - Start dirsrv for kdcproxy upgrade


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-3
changelog:
  - Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
    that conflicts with AD DC
    - trusts: Check for AD root domain among our trusted domains
  - Resolves: #1195339 ipa-client-install changes the label on various files
    which causes SELinux denials
    - sysrestore: copy files instead of moving them to avoind SELinux issues
  - Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
    commands / ntpd -qgc $tmpfile hangs
    - enable debugging of ntpd during client installation
  - Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
    - migration: Use api.env variables.
  - Resolves: #1212719 abort-clean-ruv subcommand should allow
    replica-certifyall: no
    - Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
  - Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
    occurred
    - dcerpc: Expand explanation for WERR_ACCESS_DENIED
    - dcerpc: Fix UnboundLocalError for ccache_name
  - Resolves: #1222778 idoverride group-del can delete user and user-del can
    delete group
    - dcerpc: Add get_trusted_domain_object_type method
    - idviews: Restrict anchor to name and name to anchor conversions
    - idviews: Enforce objectclass check in idoverride*-del
  - Resolves: #1234919 Be able to request certificates without certmonger service
    running
    - cermonger: Use private unix socket when DBus SystemBus is not available.
    - ipa-client-install: Do not (re)start certmonger and DBus daemons.
  - Resolves: #1240939 Please add dependency on bind-pkcs11
    - Create server-dns sub-package.
    - ipaplatform: Add constants submodule
    - DNS: check if DNS package is installed
  - Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
    calling out oddjobd-activated services
    - selinux: enable httpd_run_ipa to allow communicating with oddjobd services
  - Resolves: #1243261 non-admin users cannot search hbac rules
    - fix hbac rule search for non-admin users
    - fix selinuxusermap search for non-admin users
  - Resolves: #1243652 Client has missing dependency on memcache
    - do not import memcache on client
  - Resolves: #1243835 [webui] user change password dialog does not work
    - webui: fix user reset password dialog
  - Resolves: #1244802 spec: selinux denial during kdcproxy user creation
    - Fix selinux denial during kdcproxy user creation
  - Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
    - oddjob: avoid chown keytab to sssd if sssd user does not exist
  - Resolves: #1246136 Adding a privilege to a permission avoids validation
    - Validate adding privilege to a permission
  - Resolves: #1246141 DNS Administrators cannot search in zones
    - DNS: Consolidate DNS RR types in API and schema
  - Resolves: #1246143 User plugin - user-find doesn't work properly with manager
    option
    - fix broken search for users by their manager


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-4
changelog:
  - Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
    users in IdM
    - store certificates issued for user entries as
    - user-show: add --out option to save certificates to file
  - Resolves: #1145748 [RFE] IPA running with One Way Trust
    - Fix upgrade of sidgen and extdom plugins
  - Resolves: #1195339 ipa-client-install changes the label on various files
    which causes SELinux denials
    - Use 'mv -Z' in specfile to restore SELinux context
  - Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
    for combinations of "User authentication types"
    - webui: add LDAP vs Kerberos behavior description to user auth
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - ULC: Fix stageused-add --from-delete command
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - certprofile-import: do not require profileId in profile data
    - Give more info on virtual command access denial
    - Allow SAN extension for cert-request self-service
    - Add profile for DNP3 / IEC 62351-8 certificates
    - Work around python-nss bug on unrecognised OIDs
  - Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
    - Validate vault's file parameters
    - Fixed missing KRA agent cert on replica.
  - Resolves: #1225866 display browser config options that apply to the browser.
    - webui: add Kerberos configuration instructions for Chrome
    - Remove ico files from Makefile
  - Resolves: #1246342 Unapply idview raises internal error
    - idviews: Check for the Default Trust View only if applying the view
  - Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
    - webui: fix regressions failed auth messages
  - Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
    - dcerpc: Fix UnboundLocalError for ccache_name
  - Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
    allow access to \\pipe\lsarpc
    - Fix selector of protocol for LSA RPC binding string
    - dcerpc: Simplify generation of LSA-RPC binding strings
  - Resolves: #1250192 Error in ipa trust-fecth-domains
    - Fix incorrect type comparison in trust-fetch-domains
  - Resolves: #1251553 Winsync setup fails with unexpected error
    - replication: Fix incorrect exception invocation
  - Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
    - ACI plugin: correctly parse bind rules enclosed in
  - Resolves: #1252414 Trust agent install does not detect available replicas to
    add to master
    - adtrust-install: Correctly determine 4.2 FreeIPA servers


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-5
changelog:
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - user-undel: Fix error messages.
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - Prohibit deletion of predefined profiles
  - Resolves: #1232819 testing ipa-restore on fresh system install fails
    - Backup/resore authentication control configuration
  - Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
    server
    - Require Dogtag PKI >= 10.2.6
  - Resolves: #1245225 Asymmetric vault drops traceback when the key is not
    proper
    - Asymmetric vault: validate public key in client
  - Resolves: #1248399 Missing DNSSEC related files in backup
    - fix typo in BasePathNamespace member pointing to ods exporter config
    - ipa-backup: archive DNSSEC zone file and kasp.db
  - Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
    finished
    - winsync-migrate: Add warning about passsync
    - winsync-migrate: Expand the man page
  - Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
    - adjust search so that it works for non-admin users
  - Resolves: #1250093 ipa certprofile-import accepts invalid config
    - Require Dogtag PKI >= 10.2.6
  - Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
    agents
    - trusts: Detect missing Samba instance
  - Resolves: #1250111 User lifecycle - preserved users can be assigned
    membership
    - ULC: Prevent preserved users from being assigned membership
  - Resolves: #1250145 Add permission for user to bypass caacl enforcement
    - Add permission for bypassing CA ACL enforcement
  - Resolves: #1250190 idrange is not added for sub domain
    - idranges: raise an error when local IPA ID range is being modified
    - trusts: harden trust-fetch-domains oddjobd-based script
  - Resolves: #1250928 Man page for ipa-server-install is out of sync
    - install: Fix server and replica install options
  - Resolves: #1251225 IPA default CAACL does not allow cert-request for services
    after upgrade
    - Fix default CA ACL added during upgrade
  - Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
    - validate mutually exclusive options in vault-add
  - Resolves: #1251579 ipa vault-add --user should set container owner equal to
    user on first run
    - Fixed vault container ownership.
  - Resolves: #1252517 cert-request rejects request with correct
    krb5PrincipalName SAN
    - Fix KRB5PrincipalName / UPN SAN comparison
  - Resolves: #1252555 ipa vault-find doesn't work for services
    - vault: Add container information to vault command results
    - Add flag to list all service and user vaults
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - Added CLI param and ACL for vault service operations.
  - Resolves: #1252557 certprofile: improve profile format documentation
    - certprofile-import: improve profile format documentation
    - certprofile: add profile format explanation
  - Resolves: #1253443 ipa vault-add creates vault with invalid type
    - vault: validate vault type
  - Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
    owner
    - baseldap: Allow overriding member param label in LDAPModMember
    - vault: Fix param labels in output of vault owner commands
  - Resolves: #1253511 ipa vault-find does not use criteria
    - vault: Fix vault-find with criteria
  - Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
    - install: Fix replica install with custom certificates
  - Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
    - improve the handling of krb5-related errors in dnssec daemons
  - Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
    starting CA and named-pkcs11.service
    - Server Upgrade: Start DS before CA is started.
  - Resolves: #1254637 Add ACI and permission for managing user userCertificate
    attribute
    - add permission: System: Manage User Certificates
  - Resolves: #1254641 Remove CSR allowed-extensions restriction
    - cert-request: remove allowed extensions check
  - Resolves: #1254693 vault --service does not normalize service principal
    - vault: normalize service principal in service vault operations
  - Resolves: #1254785 ipa-client-install does not properly handle dual stacked
    hosts
    - client: Add support for multiple IP addresses during installation.
    - Add dependency to SSSD 1.13.1
    - client: Add description of --ip-address and --all-ip-addresses to man page


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-6
changelog:
  - Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
    - DNSSEC: fix forward zone forwarders checks
  - Resolves: #1250190 idrange is not added for sub domain
    - trusts: format Kerberos principal properly when fetching trust topology
  - Resolves: #1252334 User life cycle: missing ability to provision a stage user
    from a preserved user
    - Add user-stage command
  - Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
    start.
    - spec file: Add Requires(post) on selinux-policy
  - Resolves: #1254304 Changing vault encryption attributes
    - Change internal rsa_(public|private)_key variable names
    - Added support for changing vault encryption.
  - Resolves: #1256715 Executing user-del --preserve twice removes the user
    pernamently
    - improve the usability of `ipa user-del --preserve` command


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-7
changelog:
  - Resolves: #1256840 [webui] majority of required fields is no longer marked as
    required
    - fix missing information in object metadata
  - Resolves: #1256842 [webui] no option to choose trust type when creating a
    trust
    - webui: add option to establish bidirectional trust
  - Resolves: #1256853 Clear text passwords in KRA install log
    - Removed clear text passwords from KRA install log.
  - Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
    discouraged
    - vault: change default vault type to symmetric
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: prevent rename (modrdn)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-8
changelog:
  - Resolves: #1254689 Storing big file as a secret in vault raises traceback
    - vault: Limit size of data stored in vault
  - Resolves: #1255880 ipactl status should distinguish between different
    pki-tomcat services
    - ipactl: Do not start/stop/restart single service multiple times


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-9
changelog:
  - Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
    tracked
    - cert renewal: Include KRA users in Dogtag LDAP update
    - cert renewal: Automatically update KRA agent PEM file
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: remove 'rename' option
  - Resolves: #1257968 kinit stop working after ipa-restore
    - Backup: back up the hosts file
  - Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
    - DNSSEC: remove "DNSSEC is experimental" warnings
  - Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
    - Installer: do not modify /etc/hosts before user agreement
  - Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
    zone
    - DNSSEC: backup and restore opendnssec zone list file
    - DNSSEC: remove ccache and keytab of ipa-ods-exporter
    - DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
    - DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
    - DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
      key master
    - DNSSEC: Fix key metadata export
    - DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
  - Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
    - Using LDAPI to setup CA and KRA agents.
  - Resolves: #1259848 server closes connection and refuses commands after
    deleting user that is still logged in
    - ldap: Make ldap2 connection management thread-safe again
  - Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
    'ra_certprofile' while ipa-ca-install
    - load RA backend plugins during standalone CA install on CA-less IPA master


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-10
changelog:
  - Resolves: #1260663 crash of ipa-dnskeysync-replica component during
    ipa-restore
    - IPA Restore: allows to specify files that should be removed
  - Resolves: #1261806 Installing ipa-server package breaks httpd
    - Handle timeout error in ipa-httpd-kdcproxy
  - Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
    - Server Upgrade: backup CS.cfg when dogtag is turned off


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-11
changelog:
  - Resolves: #1258965 ipa vault: set owner of vault container
    - baseldap: make subtree deletion optional in LDAPDelete
    - vault: add vault container commands
    - vault: set owner to current user on container creation
    - vault: update access control
    - vault: add permissions and administrator privilege
    - install: support KRA update
  - Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
    - config: allow user/host attributes with tagging options
  - Resolves: #1262315 Unable to establish winsync replication
    - winsync: Add inetUser objectclass to the passsync sysaccount


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-12
changelog:
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
    - winsync-migrate: Convert entity names to posix friendly strings
    - winsync-migrate: Properly handle collisions in the names of external groups
  - Resolves: #1261074 Adjust Firefox configuration to new extension signing
    policy
    - webui: use manual Firefox configuration for Firefox >= 40
  - Resolves: #1263337 IPA Restore failed with installed KRA
    - ipa-backup: Add mechanism to store empty directory structure
  - Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
    and private key in world readable file [rhel-7.2]
    - install: fix KRA agent PEM file permissions
  - Resolves: #1265086 Mark IdM API Browser as experimental
    - WebUI: add API browser is experimental warning
  - Resolves: #1265277 Fix kdcproxy user creation
    - install: create kdcproxy user during server install
    - platform: add option to create home directory when adding user
    - install: fix kdcproxy user home directory
  - Resolves: #1265559 GSS failure after ipa-restore
    - destroy httpd ccache after stopping the service


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-13
changelog:
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
    - Fix an integer underflow bug in libotp
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - install: always export KRA agent PEM file
    - vault: select a server with KRA for vault operations
  - Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
    - do not overwrite files with local users/groups when restoring authconfig
  - Renamed patch 1011 to 0138, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-14
changelog:
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - upgrade: make sure ldap2 is connected in export_kra_agent_pem
  - Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
    external CA
    - schema: do not derive ipaVaultPublicKey from ipaPublicKey


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15
changelog:
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - vault: fix private service vault creation


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-16
changelog:
  - Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
    Credential"
    - cert renewal: make renewal of ipaCert atomic
  - Resolves: #1278330 installer options are not validated at the beginning of
    installation
    - install: fix command line option validation
  - Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
    from starting up
    - client install: do not corrupt OpenSSH config with Match sections
  - Resolves: #1282935 ipa upgrade causes vault internal error
    - install: export KRA agent PEM file in ipa-kra-install
  - Resolves: #1283429 Default CA ACL rule is not created during
    ipa-replica-install
    - TLS and Dogtag HTTPS request logging improvements
    - Avoid race condition caused by profile delete and recreate
    - Do not erroneously reinit NSS in Dogtag interface
    - Add profiles and default CA ACL on migration
    - disconnect ldap2 backend after adding default CA ACL profiles
    - do not disconnect when using existing connection to check default CA ACLs
  - Resolves: #1283430 ipa-kra-install: fails to apply updates
    - suppress errors arising from adding existing LDAP entries during KRA
      install
  - Resolves: #1283748 Caching of ipaconfig does not work in framework
    - fix caching in get_ipa_config
  - Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
    upgrade from RHEL 7.0 to RHEL 7.2
    - upgrade: fix migration of old dns forward zones
    - Fix upgrade of forwardzones when zone is in realmdomains
  - Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
    connection
    - ipa-cacert-renew: Fix connection to ldap.
  - Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
    - ipa-otptoken-import: Fix connection to ldap.
  - Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
    "yum update ipa* sssd"
    - Set minimal required version for openssl
  - Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
    - Upgrade: Fix upgrade of NIS Server configuration
  - Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
    permissions on /var/lib/ipa/dnssec
    - DNS: fix file permissions
    - Explicitly call chmod on newly created directories
    - Fix: replace mkdir with chmod
  - Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
    - Fix version comparison
    - use FFI call to rpmvercmp function for version comparison
  - Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
    groups are missing
    - ipa-kdb: map_groups() consider all results
  - Resolves: #1293870 User should be notified for wrong password in password
    reset page
    - Fixed login error message box in LoginScreen page
  - Resolves: #1296196 Sysrestore did not restore state if a key is specified in
    mixed case
    - Allow to used mixed case for sysrestore
  - Resolves: #1296214 DNSSEC key purging is not handled properly
    - DNSSEC: Improve error reporting from ipa-ods-exporter
    - DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
      LDAP
    - DNSSEC: Make sure that current key state in LDAP matches key state in BIND
    - DNSSEC: remove obsolete TODO note
    - DNSSEC: add debug mode to ldapkeydb.py
    - DNSSEC: logging improvements in ipa-ods-exporter
    - DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
    - DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
    - DNSSEC: ipa-ods-exporter: add ldap-cleanup command
    - DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
    - DNSSEC: Log debug messages at log level DEBUG
  - Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
    - prevent crash of CA-less server upgrade due to absent certmonger
    - always start certmonger during IPA server configuration upgrade
  - Resolves: #1297811 The ipa -e skip_version_check=1 still issues
    incompatibility error when called against RHEL 6 server
    - ipalib: assume version 2.0 when skip_version_check is enabled
  - Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
    - Do not decode HTTP reason phrase from Dogtag
  - Resolves: #1300252 shared certificateProfiles container is missing on a
    freshly installed RHEL7.2 system
    - upgrade: unconditional import of certificate profiles into LDAP
  - Resolves: #1301674 --setup-dns and other options is forgotten for using an
    external PKI
    - installer: Propagate option values from components instead of copying them.
    - installer: Fix logic of reading option values from cache.
  - Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
    IPA setup
    - ipa-ca-install: print more specific errors when CA is already installed
    - cert renewal: import all external CA certs on IPA CA cert renewal
    - CA install: explicitly set dogtag_version to 10
    - fix standalone installation of externally signed CA on IPA master
    - replica install: validate DS and HTTP server certificates
    - replica install: improvements in the handling of CA-related IPA config
      entries
  - Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
    - slapi-nis: update configuration to allow external members of IPA groups
  - Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - upgrade: fix config of sidgen and extdom plugins
    - trusts: use ipaNTTrustPartner attribute to detect trust entries
    - Warn user if trust is broken
    - fix upgrade: wait for proper DS socket after DS restart
    - Insure the admin_conn is disconnected on stop
    - Fix connections to DS during installation
    - Fix broken trust warnings
  - Resolves: #1321092 Installers fail when there are multiple versions of the
    same certificate
    - certdb: never use the -r option of certutil
  - Related: #1317381 Crash during IPA upgrade due to slapd
    - spec file: update minimum required version of slapi-nis
  - Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
    CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
    [rhel-7.3]
    - Rebuild against newer Samba version


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37
changelog:
  - Resolves: #837369 [RFE] Switch to client promotion to replica model
  - Resolves: #1199516 [RFE] Move replication topology to the shared tree
  - Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
    list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
  - Resolves: #1267206 ipa-server-install uninstall should warn if no
    installation found
  - Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
    ipa-client-automount is executed.
  - Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
    displayed when certificate generated using IPA on RHEL 7.2up2.
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605191449GITf8edf37


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37.1
changelog:
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
    - Rebuild with krb5-1.14.1


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3
changelog:
  - Resolves: #1339233 CA installed on replica is always marked as renewal master
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605241723GIT1b427d3


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3.1
changelog:
  - Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
    - Fix incorrect rebase of patch 1001


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.1.alpha1
changelog:
  - Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
    setting password for default sudo binddn.
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
  - Resolves: #825391 [RFE] Replica installation should provide a means for
    inheriting nssldap security access settings
  - Resolves: #921497 Incorrect *.py[co] files placement
  - Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
  - Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
  - Resolves: #1196958 IPA replica installation failing with high number of users
    (160000).
  - Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
    uninstall a replica
  - Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
    Authentication Indicator
  - Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
    principal expiration"
  - Resolves: #1234223 [WebUI] General invalid password error message appearing
    for "Locked user"
  - Resolves: #1254267 ipa-server-install failure applying ldap updates with
    limits exceeded
  - Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
    doamin already is in forwardzone.
  - Resolves: #1259020 ipa-server-adtrust-install doesn't allow
    NetBIOS-name=EXAMPLE-TEST.COM (dash character)
  - Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
    message when DNSSEC master not installed
  - Resolves: #1262747 dnssec options missing in ipa-dns-install man page
  - Resolves: #1265900 Fail installation immediately after dirsrv fails to
    install using ipa-server-install
  - Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
    resolvable anymore
  - Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
    LimitsExceeded: limits exceeded for this query
  - Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
  - Resolves: #1269200 ipa-server crashing while trying to preserve admin user
  - Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
  - Resolves: #1271579 Automember rule expressions disappear from tables on
    single expression delete
  - Resolves: #1275816 Incomplete ports for IPA ad-trust
  - Resolves: #1276351 [RFE] Remove
    /usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
  - Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
    the IPA UI
  - Resolves: #1278426 Better error message needed for invalid ca-signing-algo
    option
  - Resolves: #1279932 ipa-client-install --request-cert needs workaround in
    anaconda chroot
  - Resolves: #1282521 Creating a user w/o private group fails when doing so in
    WebUI
  - Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
    by "IPA is not configured on this system"
  - Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
    file
  - Resolves: #1287194 [RFE] Support of UPN for trusted domains
  - Resolves: #1288967 Normalize Manager entry in ipa user-add
  - Resolves: #1289487 Priority field missing in Password Policy detail tab
  - Resolves: #1291140 ipa client should configure kpasswd_server directive in
    krb5.conf
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0.alpha1
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1300576 Browser setup page includes instructions for Internet
    Explorer
  - Resolves: #1301586 ipa host-del --updatedns should remove related dns
    entries.
  - Resolves: #1304618 Residual Files After IPA Server Uninstall
  - Resolves: #1305144 ipa-python does not require its dependencies
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
  - Resolves: #1313798 Console output post ipa-winsync-migrate command should be
    corrected.
  - Resolves: #1314786 [RFE] External Trust with Active Directory domain
  - Resolves: #1319023 Include description for 'status' option in man page for
    ipactl command.
  - Resolves: #1319912 ipa-server-install does not completely change hostname and
    named-pkcs11 fails
  - Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
    Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
    it is executed on server already installed with KRA.
  - Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
    to 'rpcbind'
  - Resolves: #1329275 ipa-nis-manage command should include status option
  - Resolves: #1330843 'man ipa' should be updated with latest commands
  - Resolves: #1333755 ipa cert-request causes internal server error while
    requesting certificate
  - Resolves: #1337484 EOF is not handled for ipa-client-install command
  - Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
    members of the role which has "User Administrators" privilege.
  - Resolves: #1343142 IPA DNS should do better verification of DNS zones
  - Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
    browser


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.2.alpha1
changelog:
  - Resolves: #1348948 IPA server install fails with build
    ipa-server-4.4.0-0.el7.1.alpha1
    - Revert "Increased mod_wsgi socket-timeout"


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-1
changelog:
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
    in the default global_policy in IPA sets user's password expiration
    (krbPasswordExpiration) to be 90 days
  - Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
  - Resolves: #1084018 [RFE] Add IdM user password change support for legacy
    client compat tree
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - Fix incorrect check for principal type when evaluating CA ACLs
  - Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
  - Resolves: #1238190 ipasam unable to lookup group in directory yet manual
    search works
  - Resolves: #1250110 search by users which don't have read rights for all attrs
    in search_attributes fails
  - Resolves: #1263764 Show Certificate displays in useless format
  - Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
    the options after adding new certificate
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0
  - Resolves: #1294503 IPA fails to issue 3rd party certs
  - Resolves: #1298242 [RFE] API compatibility - compatibility of clients
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1298966 [RFE] Extend Smart Card support
  - Resolves: #1315146 Multiple clients cannot join domain simultaneously:
    /var/run/httpd/ipa/clientcaches race condition?
  - Resolves: #1318903 ipa server install failing when SUBCA signs the cert
  - Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
    console output
  - Resolves: #1324055 IPA always qualify requests for admin
  - Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
  - Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
    hold
  - Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
  - Resolves: #1349281 Fix `Conflicts` with ipa-python
  - Resolves: #1350695 execution of copy-schema script fails
  - Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
  - Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
    execution to 7.3
  - Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
    create ipa-ca entry
  - Related: #1343422 [RFE] Add GssapiImpersonate option


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2
changelog:
  - Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
    with certmonger
    - uninstall: untrack lightweight CA certs
  - Resolves: #1351807 ipa-nis-manage config.get_dn missing
    - ipa-nis-manage: Use server API to retrieve plugin status
  - Resolves: #1353452 ipa-compat-manage command failed,
    exception: NotImplementedError: config.get_dn()
    - ipa-compat-manage: use server API to retrieve plugin status
  - Resolves: #1353899 ipa-advise: object of type 'type' has no len()
    - ipa-advise: correct handling of plugin namespace iteration
  - Resolves: #1356134 'kinit -E' does not work for IPA user
    - kdb: check for local realm in enterprise principals
  - Resolves: #1353072 ipa unknown command vault-add
    - Enable vault-* commands on client
    - vault-add: set the default vault type on the client side if none was given
  - Resolves: #1353995 Default CA can be used without a CA ACL
    - caacl: expand plugin documentation
  - Resolves: #1356144 host-find should not print SSH keys by default, only
    SSH fingerprints
    - host-find: do not show SSH key by default
  - Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
    - Removed unused method parameter from migrate-ds


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2.1
changelog:
  - Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
  - Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
  - Related: #1356134 'kinit -E' does not work for IPA user


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-3
changelog:
  - Resolves: #1296140 Remove redhat-access-plugin-ipa support
    - Obsolete and conflict redhat-access-plugin-ipa
  - Resolves: #1351119 Multiple issues while uninstalling ipa-server
    - server uninstall fails to remove krb principals
  - Resolves: #1351758 ipa commands not showing expected error messages
    - frontend: copy command arguments to output params on client
    - Show full error message for selinuxusermap-add-hostgroup
  - Resolves: #1352883 Traceback on adding default automember group and hostgroup
    set
    - allow 'value' output param in commands without primary key
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - schema: Fix subtopic -> topic mapping
  - Resolves: #1354348 ipa trustconfig-show throws internal error.
    - allow 'value' output param in commands without primary key
  - Resolves: #1354381 ipa trust-add with raw option gives internal error.
    - trust-add: handle `--all/--raw` options properly
  - Resolves: #1354493 Replica install fails with old IPA master
    - DNS install: Ensure that DNS servers container exists
  - Resolves: #1354628 ipa hostgroup-add-member does not return error message
    when adding itself as member
    - frontend: copy command arguments to output params on client
  - Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
    - messages: specify message type for ResultFormattingError
  - Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
    secret key
    - expose `--secret` option in radiusproxy-* commands
    - prevent search for RADIUS proxy servers by secret
  - Resolves: #1356099 Bug in the ipapwd plugin
    - Heap corruption in ipapwd plugin
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
  - Resolves: #1356964 Renaming a user removes all of his principal aliases
    - Preserve user principal aliases during rename operation


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-4
changelog:
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - harden the check for trust namespace overlap in new principals
  - Resolves: #1351142 CLI is not using session cookies for communication with
    IPA API
    - Fix session cookies
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - help: Add dnsserver commands to help topic 'dns'
  - Resolves: #1354406 host-del updatedns options complains about missing ptr
    record for host
    - Host-del: fix behavior of --updatedns and PTR records
  - Resolves: #1355718 ipa-replica-manage man page example output differs actual
    command output
    - Minor fix in ipa-replica-manage MAN page
  - Resolves: #1358229 Traceback message should be fixed, seen while editing
    winsync migrated user information in Default trust view.
    - baseldap: Fix MidairCollision instantiation during entry modification
  - Resolves: #1358849 CA replica install logs to wrong log file
    - unite log file name of ipa-ca-install
  - Resolves: #1359130 ipa-server-install command fails to install IPA server.
    - DNS Locations: fix update-system-records unpacking error
  - Resolves: #1359237 AVC on dirsrv config caused by IPA installer
    - Use copy when replacing files to keep SELinux context
  - Resolves: #1359692 ipa-client-install join fail with traceback against
    RHEL-6.8 ipa-server
    - compat: fix ping call
  - Resolves: #1359738 ipa-replica-install --domain=<IPA primary domain> option
    does not work
    - replica-install: Fix --domain
  - Resolves: #1360778 Vault commands are available in CLI even when the server
    does not support them
    - Revert "Enable vault-* commands on client"
    - client: fix hiding of commands which lack server support
  - Related: #1281704 Rebase to softhsm 2.1.0
    - Remove the workaround for softhsm bug #1293340
  - Related: #1298288 [RFE] Improve performance in large environments.
    - Create indexes for krbCanonicalName attribute


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-5
changelog:
  - Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
    - Do not initialize API in ipa-client-automount uninstall
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - idrange: fix unassigned global variable
  - Resolves: #1360792 Migrating users doesn't update krbCanonicalName
    - re-set canonical principal name on migrated users
  - Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
    and 'bool' objects
    - Fix ipa hbactest output
  - Resolves: #1362260 ipa vault-mod no longer allows defining salt
    - vault: add missing salt option to vault_mod
  - Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
    public key
    - vault: Catch correct exception in decrypt
  - Resolves: #1362537 ipa-server-install fails to create symlink from
    /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
    - Correct path to HTTPD's systemd service directory
  - Resolves: #1363756 Increase length of passwords generated by installer
    - Increase default length of auto generated passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-6
changelog:
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
    - Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
  - Resolves: #1341249 Subsequent external CA installation fails
    - install: fix external CA cert validation
  - Resolves: #1353831 ipa-server-install fails in container because of
    hostnamectl set-hostname
    - server-install: Fix --hostname option to always override api.env values
    - install: Call hostnamectl set-hostname only if --hostname option is used
  - Resolves: #1356091 ipa-cacert-manage --help and man differ
    - Improvements for the ipa-cacert-manage man and help
  - Resolves: #1360631 ipa-backup is not keeping the
    /etc/tmpfiles.d/dirsrv-<instance>.conf
    - ipa-backup: backup /etc/tmpfiles.d/dirsrv-<instance>.conf
  - Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
    file is needed
    - Update ipa-replica-install documentation
  - Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
    not rpm-require it
    - client: RPM require initscripts to get *-domainname.service
  - Resolves: #1364197 caacl: error when instantiating rules with service
    principals
    - caacl: fix regression in rule instantiation
  - Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
    - parameters: move the `confirm` kwarg to Param
  - Resolves: #1364464 Topology graph: ca and domain adders shows question marks
    instead of plus icon
    - Fix unicode characters in ca and domain adders
  - Resolves: #1365083 Incomplete output returned for command ipa vault-add
    - client: add missing output params to client-side commands
  - Resolves: #1365526 build fails during "make check"
    - ipa-kdb: Fix unit test after packaging changes in krb5


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-7
changelog:
  - Resolves: #1361119 UPN-based search for AD users does not match an entry in
    slapi-nis map cache
    - support multiple uid values in schema compatibility tree


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-8
changelog:
  - Resolves: #1298288 [RFE] Improve performance in large environments.
    - cert: speed up cert-find
  - Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
    authentication
    - service: add flag to allow S4U2Self
    - Add 'trusted to auth as user' checkbox
    - Added new authentication method
  - Resolves: #1353881 ipa-replica-install suggests about
    non-existent --force-ntpd option
    - Don't show --force-ntpd option in replica install
  - Resolves: #1354441 DNS forwarder check is too strict: unable to add
    sub-domain to already-broken domain
    - DNS: allow to add forward zone to already broken sub-domain
  - Resolves: #1356146 performance regression in CLI help
    - schema: Speed up schema cache
    - frontend: Change doc, summary, topic and NO_CLI to class properties
    - schema: Introduce schema cache format
    - schema: Generate bits for help load them on request
    - help: Do not create instances to get information about commands and topics
    - schema cache: Do not reset ServerInfo dirty flag
    - schema cache: Do not read fingerprint and format from cache
    - Access data for help separately
    - frontent: Add summary class property to CommandOverride
    - schema cache: Read server info only once
    - schema cache: Store API schema cache in memory
    - client: Do not create instance just to check isinstance
    - schema cache: Read schema instead of rewriting it when SchemaUpToDate
  - Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
    - server install: do not prompt for cert file PIN repeatedly
  - Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
    cache directory: [Errno 13] Permission denied: '/home/test_user'
    - schema: Speed up schema cache
  - Resolves: #1366604 `cert-find` crashes on invalid certificate data
    - cert: do not crash on invalid data in cert-find
  - Resolves: #1366612 Middle replica uninstallation in line topology works
    without '--ignore-topology-disconnect'
    - Fail on topology disconnect/last role removal
  - Resolves: #1366626 caacl-add-service: incorrect error message when service
    does not exists
    - Fix ipa-caalc-add-service error message
  - Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
    does not happen to run during dnf upgrade
    - DNS server upgrade: do not fail when DNS server did not respond
  - Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
    with CA
    - Add warning about only one existing CA server
    - Set servers list as default facet in topology facet group
  - Resolves: #1367773 thin client ignores locale change
    - schema check: Check current client language against cached one


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-9
changelog:
  - Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
    - Fix ipa-server-install in pure IPv6 environment
  - Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
    reachable via the forest root
    - trust: make sure ID range is created for the child domain even if it exists
    - ipa-kdb: simplify trusted domain parent search
  - Resolves: #1335567 Update Warning in IdM Web UI API browser
    - WebUI: add API browser is tech preview warning
  - Resolves: #1348560 Mulitple domain Active Directory Trust conflict
    - ipaserver/dcerpc: reformat to make the code closer to pep8
    - trust: automatically resolve DNS trust conflicts for triangle trusts
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)
  - Resolves: #1353936 custodia.conf and server.keys file is world-readable.
    - Remove Custodia server keys from LDAP
    - Secure permissions of Custodia server.keys
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
    - custodia: include known CA certs in the PKCS#12 file for Dogtag
    - custodia: force reconnect before retrieving CA certs from LDAP
  - Resolves: #1362333 ipa vault container owner cannot add vault
    - Fix: container owner should be able to add vault
  - Resolves: #1365546 External trust with root domain is transitive
    - trust: make sure external trust topology is correctly rendered
  - Resolves: #1365572 IPA server broken after upgrade
    - Require pki-core-10.3.3-7
  - Resolves: #1367864 Server assumes latest version of command instead of
    version 1 for old / 3rd party clients
    - rpcserver: assume version 1 for unversioned command calls
    - rpcserver: fix crash in XML-RPC system commands
  - Resolves: #1367773 thin client ignores locale change
    - schema cache: Fallback to 'en_us' when locale is not available
  - Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
    - Fail on topology disconnect/last role removal
  - Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
    - otptoken, permission: Convert custom type parameters on server
  - Resolves: #1369414 ipa server-del fails with Python stack trace
    - Handled empty hostname in server-del command
  - Resolves: #1369761 ipa-server must depend on a version of httpd that support
    mod_proxy with UDS
    - Require httpd 2.4.6-31 with mod_proxy Unix socket support
  - Resolves: #1370512 Received ACIError instead of DuplicatedError in
    stageuser_tests
    - Raise DuplicatedEnrty error when user exists in delete_container
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add missing param values to cert-find output
  - Renamed patch 1011 to 0100, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-10
changelog:
  - Resolves: #1355753 adding two way non transitive(external) trust displays
    internal error on the console
    - Always fetch forest info from root DCs when establishing two-way trust
    - factor out `populate_remote_domain` method into module-level function
    - Always fetch forest info from root DCs when establishing one-way trust
  - Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
    after `ipa-replica-install`
    - Track lightweight CAs on replica installation
  - Resolves: #1357488 ipa command stuck forever on higher versioned client with
    lower versioned server
    - compat: Save server's API version in for pre-schema servers
    - compat: Fix ping command call
    - schema cache: Store and check info for pre-schema servers
  - Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
    - Fix man page ipa-replica-manage: remove duplicate -c option
      from --no-lookup
  - Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
    when revoking certificate
    - cert: include CA name in cert command output
    - WebUI add support for sub-CAs while revoking certificates
  - Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
    - Add support for additional options taken from table facet
    - WebUI: Fix showing certificates issued by sub-CA
  - Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
    internactively
    - dns: normalize record type read interactively in dnsrecord_add
    - dns: prompt for missing record parts in CLI
    - dns: fix crash in interactive mode against old servers
  - Resolves: #1370519 Certificate revocation in service-del and host-del isn't
    aware of Sub CAs
    - cert: fix cert-find --certificate when the cert is not in LDAP
    - Make host/service cert revocation aware of lightweight CAs
  - Resolves: #1371901 Use OAEP padding with custodia
    - Use RSA-OAEP instead of RSA PKCS#1 v1.5
  - Resolves: #1371915 When establishing external two-way trust, forest root
    Administrator account is used to fetch domain info
    - do not use trusted forest name to construct domain admin principal
  - Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
    certificate request
    - Fix CA ACL Check on SubjectAltNames
  - Resolves: #1373272 CLI always sends default command version
    - cli: use full name when executing a command
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix ipa-certupdate for CA-less installation
  - Resolves: #1373540 client-install with IPv6 address fails on link-local
    address (always)
    - Fix parse errors with link-local addresses


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-11
changelog:
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix regression introduced in ipa-certupdate


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-12
changelog:
  - Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
  - Resolves: #1375269 ipa trust-fetch-domains throws internal error


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-13
changelog:
  - Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
    - Keep NSS trust flags of existing certificates
  - Resolves: #1360813 ipa-server-certinstall does not update all certificate
    stores and doesn't set proper trust permissions
    - Add cert checks in ipa-server-certinstall
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add revocation reason back to cert-find output
  - Resolves: #1375133 WinSync users who have First.Last casing creates users who
    can have their password set
    - ipa passwd: use correct normalizer for user principals
  - Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
    - Properly handle LDAP socket closures in ipa-otpd
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Make httpd publish its CA certificate on DL1


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14
changelog:
  - Resolves: #1378353 Replica install fails with old IPA master sometimes during
    replication process
    - spec file: bump minimal required version of 389-ds-base
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Fix missing file that fails DL1 replica installation
  - Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
    - WebUI: services without canonical name are shown correctly
  - Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
    - trustdomain-del: fix the way how subdomain is searched


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - password policy: Add explicit default password policy for hosts and
      services
  - Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
    certprofile-mod
    - certprofile-mod: correctly authorise config update


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.2
changelog:
  - Resolves: #1382812 Creation of replica for disconnected environment is
    failing with CA issuance errors; Need good steps.
    - gracefully handle setting replica bind dn group on old masters
  - Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
    temporary CA admin
    - replication: ensure bind DN group check interval is set on replica config
    - add missing attribute to ipaca replica during CA topology update
  - Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
    named-pkcs11
    - bindinstance: use data in named.conf to determine configuration status


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.3
changelog:
  - Resolves: #1398670 Check IdM Topology for broken record caused by replication
    conflict before upgrading it
    - Check for conflict entries before raising domain level


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.4
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - ipa-kdb: search for password policies globally
  - Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.5
changelog:
  - Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
    installed without CA
    - Set up DS TLS on replica in CA-less topology
  - Resolves: #1398600 IPA replica install fails with dirsrv errors.
    - Do not configure PKI ajp redirection to use "::1"
  - Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
    ca-del, ca-disable and ca-enable commands
    - ca: correctly authorise ca-del, ca-enable and ca-disable


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.6
changelog:
  - Resolves: #1416454 replication race condition prevents IPA to install
    - wait_for_entry: use only DN as parameter
    - Wait until HTTPS principal entry is replicated to replica
    - Use proper logging for error messages


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.7
changelog:
  - Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
    with cert errors (untrusted)
    - added ssl verification using IPA trust anchor
  - Resolves: #1428472 batch param compatibility is incorrect
    - compat: fix `Any` params in `batch` and `dnsrecord`
  - Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-1.el7
changelog:
  - Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
  - Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
    hostname
  - Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
    attribute
  - Resolves: #1321652 ipa-server-install fails when using external certificates
    that encapsulate RDN components in double quotes
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1340880 ipa-server-install: improve prompt on interactive
    installation
  - Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
    incomplete entries
  - Resolves: #1356104 cert-show command does not display Subject Alternative
    Names
  - Resolves: #1357511 Traceback message seen when ipa is provided with invalid
    configuration file name
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
  - Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
    config-mod --enable-migration=TRUE
  - Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
  - Resolves: #1371927 Implement ca-enable/disable commands.
  - Resolves: #1372202 Add Users into User Group editors fails to show Full names
  - Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
    check box in the UI
  - Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
    message
  - Resolves: #1375905 "Normal" group type in the UI is confusing
  - Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
  - Resolves: #1376630 IDM admin password gets written to
    /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
  - Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
    match other options
  - Resolves: #1378461 IPA Allows Password Reuse with History value defined when
    admin resets the password.
  - Resolves: #1379029 conncheck failing intermittently during single step
    replica installs
  - Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
  - Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
  - Resolves: #1392778 Update man page for ipa-adtrust-install by
    removing --no-msdcs option
  - Resolves: #1392858 Rebase to FreeIPA 4.5+
    - Rebase to 4.5.0
  - Resolves: #1399133 Delete option shouldn't be available for hosts applied to
    view.
  - Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
    should contain full trust chain
  - Resolves: #1400416 RFE: Provide option to take backup of IPA server before
    uninstalling IPA server
  - Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
  - Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
    not on details page
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
  - Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
    non-FQDN name of IPA server is first in /etc/hosts
  - Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
    nsupdate
  - Resolves: #1413742 Backport request for bug/issue Change IP address
    validation errors to warnings
  - Resolves: #1415652 IPA replica install log shows password in plain text
  - Resolves: #1427897 different behavior regarding system wide certs in master
    and replica.
  - Resolves: #1430314 The ipa-managed-entries command failed, exception:
    AttributeError: ldap2


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-2.el7
changelog:
  - Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
    - Remove csrgen
  - Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
    - Add options to allow ticket caching


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-3.el7
changelog:
  - Resolves: #800545 [RFE] Support SUDO command rename
    - Reworked the renaming mechanism
    - Allow renaming of the sudorule objects
  - Resolves: #872671 IPA WebUI login for AD Trusted User fails
    - WebUI: check principals in lowercase
    - WebUI: add method for disabling item in user dropdown menu
    - WebUI: Add support for login for AD users
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
    - IPA certauth plugin
    - ipa-kdb: do not depend on certauth_plugin.h
    - spec file: bump krb5-devel BuildRequires for certauth
  - Resolves: #1264370 RFE: disable last successful authentication by default in
    ipa.
    - Set "KDC:Disable Last Success" by default
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
    - configure: fix --disable-server with certauth plugin
    - rpcserver.login_x509: Actually return reply from __call__ method
    - spec file: Bump requires to make Certificate Login in WebUI work
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - extdom: do reverse search for domain separator
    - extdom: improve cert request
  - Resolves: #1430363 [RFE] HBAC rule names command rename
    - Reworked the renaming mechanism
    - Allow renaming of the HBAC rule objects
  - Resolves: #1433082 systemctl daemon-reload needs to be called after
    httpd.service.d/ipa.conf is manipulated
    - tasks: run `systemctl daemon-reload` after httpd.service.d updates
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Use Custodia 0.3.1 features
  - Resolves: #1434384 RPC client should use HTTP persistent connection
    - Use connection keep-alive
    - Add debug logging for keep-alive
    - Increase Apache HTTPD's default keep alive timeout
  - Resolves: #1434729 man ipa-cacert-manage install needs clarification
    - man ipa-cacert-manage install needs clarification
  - Resolves: #1434910 replica install against IPA v3 master fails with ACIError
    - Fixing replica install: fix ldap connection in domlvl 0
  - Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
    used during typing Directory Manager password
    - ipapython.ipautil.nolog_replace: Do not replace empty value
  - Resolves: #1435397 ipa-replica-install can't install replica file produced by
    ipa-replica-prepare on 4.5
    - replica prepare: fix wrong IPA CA nickname in replica file
  - Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
    KRA is not installed
    - WebUI: Fix showing vault in selfservice view
  - Resolves: #1435718 As a ID user I cannot call a command with --rights option
    - ldap2: use LDAP whoami operation to retrieve bind DN for current connection
  - Resolves: #1436319 "Truncated search results" pop-up appears in user details
    in WebUI
    - WebUI: Add support for suppressing warnings
    - WebUI: suppress truncation warning in select widget
  - Resolves: #1436333 Uninstall fails with No such file or directory:
    '/var/run/ipa/services.list'
    - Create temporaty directories at the begining of uninstall
  - Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
    fails
    - WebUI: Allow to add certs to certmapping with CERT LINES around
  - Resolves: #1436338 CLI doesn't work after ipa-restore
    - Backup ipa-specific httpd unit-file
    - Backup CA cert from kerberos folder
  - Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
    separation
    - Bump samba version for FIPS and priv. separation
  - Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
    ipa vault commands
    - Avoid growing FILE ccaches unnecessarily
    - Handle failed authentication via cookie
    - Work around issues fetching session data
    - Prevent churn on ccaches
  - Resolves: #1436657 Add workaround for pki_pin for FIPS
    - Generate PIN for PKI to help Dogtag in FIPS
  - Resolves: #1436714 [vault] cache KRA transport cert
    - Simplify KRA transport cert cache
  - Resolves: #1436723 cert-find does not find all certificates without
    sizelimit=0
    - cert: do not limit internal searches in cert-find
  - Resolves: #1436724 Renewal of IPA RA fails on replica
    - dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
  - Resolves: #1436753 Master tree fails to install
    - httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
      available


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-4.el7
changelog:
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Require correct custodia version


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-5.el7
changelog:
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1393726 Enumerate all available request type options in ipa
    cert-request help
    - Hide request_type doc string in cert-request help
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - spec file: bump libsss_nss_idmap-devel BuildRequires
    - server: make sure we test for sss_nss_getlistbycert
  - Resolves: #1437378 ipa-adtrust-install produced an error and failed on
    starting smb when hostname is not FQDN
    - adtrust: make sure that runtime hostname result is consistent with the
      configuration
  - Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
    keytab
    - Always check and create anonymous principal during KDC install
    - Remove duplicate functionality in upgrade
  - Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
    principal for PKINIT
    - Upgrade: configure PKINIT after adding anonymous principal
    - Remove unused variable from failed anonymous PKINIT handling
    - Split out anonymous PKINIT test to a separate method
    - Ensure KDC is propery configured after upgrade
  - Resolves: #1437951 Remove pkinit-related options from server/replica-install
    on DL0
    - Fix the order of cert-files check
    - Don't allow setting pkinit-related options on DL0
    - replica-prepare man: remove pkinit option refs
    - Remove redundant option check for cert files
  - Resolves: #1438490 CA-less installation fails on publishing CA certificate
    - Get correct CA cert nickname in CA-less
    - Remove publish_ca_cert() method from NSSDatabase
  - Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
    - IPA-KDB: use relative path in ipa-certmap config snippet
  - Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
    - Allow erasing ipaDomainResolutionOrder attribute


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-6.el7
changelog:
  - Resolves: #1382053 Need to have validation for idrange names
    - idrange-add: properly handle empty --dom-name option
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - dsinstance: reconnect ldap2 after DS is restarted by certmonger
    - httpinstance: avoid httpd restart during certificate request
    - dsinstance, httpinstance: consolidate certificate request code
    - install: request service certs after host keytab is set up
    - renew agent: revert to host keytab authentication
    - renew agent, restart scripts: connect to LDAP after kinit
  - Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
    domain entry
    - ipa-sam: create the gidNumber attribute in the trusted domain entry
    - Upgrade: add gidnumber to trusted domain entry
  - Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
    Incorrect client security database password
    - Add pki_pin only when needed
  - Resolves: #1438348 Console output message while adding trust should be
    mapped with texts changed in Samba.
    - ipaserver/dcerpc: unify error processing
  - Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
    'Credentials': Missing credentials for cross-forest communication
    - trust: always use oddjobd helper for fetching trust information
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - WebUI: cert login: Configure name of parameter used to pass username
  - Resolves: #1437879 [copr] Replica install failing
    - Create system users for FreeIPA services during package installation
  - Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
    - Fix s4u2self with adtrust


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-7.el7
changelog:
  - Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
    WebUI is slow to display user details page
    - cert: defer cert-find result post-processing
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - server-install: No double Kerberos install
  - Resolves: #1437502 ipa-replica-install fails with requirement to
    use --force-join that is a client install option.
    - Add the force-join option to replica install
    - replicainstall: better client install exception handling
  - Resolves: #1437953 Server CA-less impossible option check
    - server-install: remove broken no-pkinit check
  - Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
    - Add debug log in case cookie retrieval went wrong
  - Resolves: #1441548 ipa server install fails with --external-ca option
    - ext. CA: correctly write the cert chain
  - Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
    spawn
    - Fix CA-less to CA-full upgrade
  - Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
    libsss_nss_idmap to every binary in IPA
    - configure: fix AC_CHECK_LIB usage
  - Resolves: #1442815 Replica install fails during migration from older IPA
    master
    - Fix RA cert import during DL0 replication
  - Related: #1442004 Building IdM/FreeIPA internally on all architectures -
    filtering unsupported packages
    - Build all subpackages on all architectures


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-8.el7
changelog:
  - Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
    - Fix CAInstance.import_ra_cert for empty passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-9.el7
changelog:
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - spec file: bump krb5 Requires for certauth fixes
  - Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
    is used
    - separate function to set ipaConfigString values on service entry
    - Allow for configuration of all three PKINIT variants when deploying KDC
    - API for retrieval of master's PKINIT status and publishing it in LDAP
    - Use only anonymous PKINIT to fetch armor ccache
    - Stop requesting anonymous keytab and purge all references of it
    - Use local anchor when armoring password requests
    - Upgrade: configure local/full PKINIT depending on the master status
    - Do not test anonymous PKINIT after install/upgrade
  - Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
    update_tdo_gidnumber: ERROR Default SMB Group not found
    - upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
      installed
  - Resolves: #1442932 ipa restore fails to restore IPA user
    - restore: restart/reload gssproxy after restore
  - Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
    - Fix CA/server cert validation in FIPS
  - Resolves: #1444947 Deadlock between topology and schema-compat plugins
    - compat-manage: behave the same for all users
    - Move the compat plugin setup at the end of install
    - compat: ignore cn=topology,cn=ipa,cn=etc subtree
  - Resolves: #1445358 ipa vault-add raises TypeError
    - vault: piped input for ipa vault-add fails
  - Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
    - Vault: Explicitly default to 3DES CBC
  - Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
    - automount install: fix checking of SSSD functionality on uninstall
  - Resolves: #1446137 pki_client_database_password is shown in
    ipaserver-install.log
    - Hide PKI Client database password in log file


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-10.el7
changelog:
  - Resolves: #1438833 [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic key for
    host
    - Make sure remote hosts have our keys
  - Resolves: #1442815 Replica install fails during migration from older IPA
    master
    - Refresh Dogtag RestClient.ca_host property
    - Remove the cachedproperty class
  - Resolves: #1444787 Update warning message when KRA installation fails
    - kra install: update installation failure message
  - Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
    - ipa-server-install with external CA: fix pkinit cert issuance
  - Resolves: #1445397 GET in KerberosSession.finalize_kerberos_acquisition()
    must use FreeIPA CA
    - kerberos session: use CA cert with full cert chain for obtaining cookie
  - Resolves: #1447375 ipa-client-install: extra space in pkinit_anchors
    definition
    - ipa-client-install: remove extra space in pkinit_anchors definition
  - Resolves: #1447703 Fix SELinux contex of http.keytab during upgrade
    - Use proper SELinux context with http.keytab


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-12.el7
changelog:
  - Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
    - python2-ipalib: add missing python dependency
    - installer service: fix typo in service entry
    - upgrade: add missing suffix to http instance
  - Resolves: #1444791 Update man page of ipa-kra-install
    - ipa-kra-install manpage: document domain-level 1
  - Resolves: #1441493 ipa cert-show raises stack traces when
    --certificate-out=/tmp
    - cert-show: writable files does not mean dirs
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - Bump version of ipa.conf file
  - Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
    - Turn on NSSOCSP check in mod_nss conf
  - Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
    template on
    - renew agent: respect CA renewal master setting
    - server upgrade: always fix certmonger tracking request
    - cainstance: use correct profile for lightweight CA certificates
    - renew agent: allow reusing existing certs
    - renew agent: always export CSR on IPA CA certificate renewal
    - renew agent: get rid of virtual profiles
    - ipa-cacert-manage: add --external-ca-type
  - Resolves: #1441593 error adding authenticator indicators to host
    - Fixing adding authenticator indicators to host
  - Resolves: #1449525 Set directory ownership in spec file
    - Added plugins directory to ipaclient subpackages
    - ipaclient: fix missing RPM ownership
  - Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
    - otptoken-add-yubikey: When --digits not provided use default value


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-13.el7
changelog:
  - Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
    error observed during ipa upgrade with latest package.
    - ipa-server-install: fix uninstall
  - Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
    replica
    - ca install: merge duplicated code for DM password
    - installutils: add DM password validator
    - ca, kra install: validate DM password


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-14.el7
changelog:
  - Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to
    handle PKINIT certificates/anchors
    - certdb: add named trust flag constants
    - certdb, certs: make trust flags argument mandatory
    - certdb: use custom object for trust flags
    - install: trust IPA CA for PKINIT
    - client install: fix client PKINIT configuration
    - install: introduce generic Kerberos Augeas lens
    - server install: fix KDC PKINIT configuration
    - ipapython.ipautil.run: Add option to set umask before executing command
    - certs: do not export keys world-readable in install_key_from_p12
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
    - replica install: respect --pkinit-cert-file
    - cacert manage: support PKINIT
    - server certinstall: support PKINIT
  - Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
    option
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
  - Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
    decommissioned
    - ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname
  - Resolves: #1451712 KRA installation fails on server that was originally
    installed as CA-less
    - ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
  - Resolves: #1441499 ipa cert-show does not raise error if no file name
    specified
    - ca/cert-show: check certificate_out in options
  - Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
    - Remove pkinit-anonymous command
  - Resolves: #1449523 Provide an API command to retrieve PKINIT status
    in the FreeIPA topology
    - Allow for multivalued server attributes
    - Refactor the role/attribute member reporting code
    - Add an attribute reporting client PKINIT-capable servers
    - Add the list of PKINIT servers as a virtual attribute to global config
    - Add `pkinit-status` command
    - test_serverroles: Get rid of MockLDAP and use ldap2 instead
  - Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
    - Fix rare race condition with missing ccache file
  - Resolves: #1455045 Simple service uninstallers must be able to handle
    missing service files gracefully
    - only stop/disable simple service if it is installed
  - Resolves: #1455541 after upgrade login from web ui breaks
    - krb5: make sure KDC certificate is readable
  - Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
    command "ipa cert-request --add" after upgrade
    - Change python-cryptography to python2-cryptography


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-15.el7
changelog:
  - Resolves: #1442233 IPA client commands fail when pointing to replica
    - httpinstance: wait until the service entry is replicated
  - Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
    not indexed
    - Fix index definition for ipaAnchorUUID
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Avoid possible endless recursion in RPC call
    - rpc: preparations for recursion fix
    - rpc: avoid possible recursion in create_connection
  - Resolves: #1446087 services entries missing krbCanonicalName attribute.
    - Changing cert-find to do not use only primary key to search in LDAP.
  - Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
    - ipa-kdb: reload certificate mapping rules periodically
  - Resolves: #1455541 after upgrade login from web ui breaks
    - kdc.key should not be visible to all
  - Resolves: #1435606 Add pkinit_indicator option to KDC configuration
    - ipa-kdb: add pkinit authentication indicator in case of a successful
      certauth
  - Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
    issuance when ipa-ca records are not resolvable
    - Turn off OCSP check
  - Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
    server_del - TypeError: 'NoneType' object is not iterable
    - fix incorrect suffix handling in topology checks


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-16.el7
changelog:
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Only warn when specified server IP addresses don't match intf
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Bump version of python-gssapi
  - Resolves: #1457942 certauth: use canonical principal for lookups
    - ipa-kdb: use canonical principal in certauth plugin
  - Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
    breaking older clients
    - Add code to be able to set default kinit lifetime
    - Revert setting sessionMaxAge for old clients


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-17.el7
changelog:
  - Resolve: #1455946 Provide a tooling automating the configuration
    of Smart Card authentication on a FreeIPA master
    - server certinstall: update KDC master entry
    - pkinit manage: introduce ipa-pkinit-manage
    - server upgrade: do not enable PKINIT by default
    - Extend the advice printing code by some useful abstractions
    - Prepare advise plugin for smart card auth configuration
  - Resolve: #1461053 allow to modify list of UPNs of a trusted forest
    - trust-mod: allow modifying list of UPNs of a trusted forest
    - WebUI: add support for changing trust UPN suffixes


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-18.el7
changelog:
  - Resolves: #1449189 ipa-kra-install timeouts on replica
    - kra: promote: Get ticket before calling custodia


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash()
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Fix local IP address validation
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1469246 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469480 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1
changelog:
  - Resolves: #1455946 Provide a tooling automating the configuration
    of Smart Card authentication on a FreeIPA master
    - smart-card advises: configure systemwide NSS DB also on master
    - smart-card advises: add steps to store smart card signing CA cert
    - Allow to pass in multiple CA cert paths to the smart card advises
    - add a class that tracks the indentation in the generated advises
    - delegate the indentation handling in advises to dedicated class
    - advise: add an infrastructure for formatting Bash compound statements
    - delegate formatting of compound Bash statements to dedicated classes
    - Fix indentation of statements in Smart card advises
    - Use the compound statement formatting API for configuring PKINIT
    - smart card advises: use a wrapper around Bash `for` loops
    - smart card advise: use password when changing trust flags on HTTP cert
    - smart-card-advises: ensure that krb5-pkinit is installed on client
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Add CommonNameToSANDefault to default cert profile
  - Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s
    during search in cn=ad,cn=trusts,dc=example,dc=com
    - NULL LDAP context in call to ldap_search_ext_s during search


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.1
changelog:
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Restore old version of caIPAserviceCert for upgrade only


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.2
changelog:
  - Resolves: #1477703 IPA upgrade fails for latest ipa package
      - Restore old version of caIPAserviceCert for upgrade only


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2
changelog:
  - Resolves: #1477178 - [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic
    key for host
      - Always check peer has keys before connecting
  - Resolves: #1482802 - Unable to set ca renewal master on replica
      - Fix ipa config-mod --ca-renewal-master
  - Resolves: #1486283 - TypeError in renew_ca_cert prevents from swiching
    back to self-signed CA
      - Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
  - Resolves: #1480102 - ipa-server-upgrade failes with "This entry already exists"
      - Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
  - Resolves: #1484826 - FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
      - Adds whoami DS plugin in case that plugin is missing
  - Resolves: #1478251 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
      - Fixing how sssd.conf is updated when promoting a client to replica
  - Resolves: #1461177 - ipa-otptoken-import - XML file is missing PBKDF2
    parameters!
      - ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
  - Resolves: #1484428 - Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
      - Backport 4-5: Fix ipa-server-upgrade with server cert tracking


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2.2
changelog:
  - Resolves: #1477367 ipa-server-upgrade timeouts on wait_for_open ports
    expecting IPA services listening on IPv6 ports
      - Make sure upgrade also checks for IPv6 stack
      - control logging of host_port_open from caller
      - log progress of wait_for_open_ports
  - Resolves: #1477243 ipa help command returns traceback when no cache
    is present
      - Store help in Schema before writing to disk
      - Disable pylint in get_help function because of type confusion.


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-1.el7
changelog:
  - Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
    buildroot
  - Resolves: #1470177 - Rebase IPA to latest 4.5.x version
  - Resolves: #1398594 ipa topologysuffix-verify should only warn about
    maximum number of replication agreements.
  - Resolves: #1404236 Web UI: Change "Host Based" and "Role Based"
    to "Host-Based" and "Role-Based"
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install
    setup fails when dirsrv is not running
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI
    accepts negative values
  - Resolves: #1458169 --force-join option is not mentioned in
    ipa-replica-install man page
  - Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case
  - Resolves: #1478322 user-show command fails when sizelimit is configured
    to number <= number of entity which is user member of
  - Resolves: #1496775 Enterprise principals should be able to trigger
    a refresh of the trusted domain data in the KDC
  - Resolves: #1502533 Changing cert-find to go through the proxy
    instead of using the port 8080
  - Resolves: #1502663 pkinit-status command fails after an upgrade from
    a pre-4.5 IPA
  - Resolves: #1498168 Error when trying to modify a PTR record
  - Resolves: #1457876 ipa-backup fails silently
  - Resolves: #1493531 In case full PKINIT configuration is failing during
    server/replica install the error message should be more meaningful.
  - Resolves: #1449985 Suggest CA installation command in KRA installation
    warning


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.4-2.el7
changelog:
  - Resolves: #1461177 ipa-otptoken-import  - XML file is missing PBKDF2
    parameters!
  - Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
    search in cn=ad, cn=trusts,dc=example,dc=com
  - Resolves: #1467887 iommu platform support for ipxe
  - Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic key for
    host
  - Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
    4.5
  - Resolves: #1480102 ipa-server-upgrade failes with "This entry already
    exists"
  - Resolves: #1482802 Unable to set ca renewal master on replica
  - Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
  - Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
  - Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
    to self-signed CA
  - Resolves: #1469246 Replica install fails to configure IPA-specific
    temporary files/directories
  - Resolves: #1469480 bind package is not automatically updated during
    ipa-server upgrade process
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
    installs only)
  - Resolves: #1477703 IPA upgrade fails for latest ipa package


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-3.el7
changelog:
  - Drop workaround for building on AArch64 (#1482244)
  - Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-4.el7
changelog:
  - Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
    - ldap: limit the retro changelog to dns subtree
  - Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
    of "CA:FALSE" IPA CA CSR
    - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1493145 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
    - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
    - ds: ignore time skew during initial replication step
    - ipa-replica-manage: implicitly ignore initial time skew in force-sync
  - Resolves: #1500218 Replica installation at domain-level 0 fails against
    upgraded ipa-server
    - Fix ipa-replica-conncheck when called with --principal
  - Resolves: #1506188 server-del doesn't remove dns-server configuration
    from ldap


author: Thomas Woerner <twoerner@redhat.com> - 4.7.0-3.el8
changelog:
  - Resolves: #1614301 Remove --no-sssd and --noac options
  - Resolves: #1613879 Disable Domain Level 0
    - New patch sets to disable domain level 0
    - New adapted patch to disable DL0 specific tests (pytest_ipa vs.
      pytest_plugins)
    - Adapted branding patch in ipa-replica-install.1 due to DL0 removal


author: Thomas Woerner <twoerner@redhat.com> - 4.7.0-3.1.el8
changelog:
  - Resolves: #1609883 ipaserver/plugins/cert.py: Add reason to raise of
    errors.NotFound
  - Resolves: #1615765 do-not-use-RC4-in-FIPS-mode
    - Move fips_enabled to a common library to share across different plugins
    - ipasam: do not use RC4 in FIPS mode


author: Thomas Woerner <twoerner@redhat.com> - 4.7.1-3.el8
changelog:
  - New command automember-find-orphans to find and remove orphan automemeber
    rules has been added
    Resolves: RHBZ#1638373
  - Moved ipa/idm logos and background to redhat-logos-ipa-80.4:
    header-logo.png, login-screen-background.jpg, login-screen-logo.png,
    product-name.png
    New requirement to redhat-logos-ipa >= 80.4 in ipa-server-common
    Resolves: RHBZ#1626507


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.1-4.el8
changelog:
  - Fix mapping of BUILTIN\Guests to 'nobody' group during upgrade
    to not use generated Samba config at this point
  - Related: rhbz#1623895


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.1-5.el8
changelog:
  - Fixed: rhbz#1643445 - External CA step 2 fails with pki_client_database_dir is missing
  - Fixed: rhbz#1642834 - Smart card advise script uses hard-coded Python interpreter


author: Thomas Woerner <twoerner@redhat.com> - 4.7.1-7.el8
changelog:
  - Fix misleading errors during client install rollback
    Resolves: RHBZ#1658283
  - ipa-advise: update url of cacerdir_rehash tool
    Resolves: RHBZ#1658287
  - Handle NTP configuration in a replica server installation
    Resolves: RHBZ#1651679
  - Fix defects found by static analysis
    Resolves: RHBZ#1658182
  - ipa-replica-install --setup-adtrust: check for package ipa-server-trust-ad
    Resolves: RHBZ#1658294
  - ipaldap: invalid modlist when attribute encoding can vary
    Resolves: RHBZ#1658302
  - Allow ipaapi and Apache user to access SSSD IFP
    Resolves: RHBZ#1639910
  - Add sysadm_r to default SELinux user map order
    Resolves: RHBZ#1658303
  - certdb: ensure non-empty Subject Key Identifier and validate server cert sig
    Resolves: RHBZ#1641988
  - ipa-replica-install: password and admin-password options mutually exclusive
    Resolves: RHBZ#1658309
  - ipa upgrade: handle double-encoded certificates
    Resolves: RHBZ#1658310
  - PKINIT: fix ipa-pkinit-manage enable|disable
    Resolves: RHBZ#1658313
  - Enable LDAP debug output in client to display TLS errors in join
    Resolves: RHBZ#1658316
  - rpc: always read response
    Resolves: RHBZ#1639890
  - ipa vault-retrieve: fix internal error
    Resolves: RHBZ#1658485
  - Move ipa's systemd tmpfiles from /var/run to /run
    Resolves: RHBZ#1658487
  - Fix authselect invocations to work with 1.0.2
    Resolves: RHBZ#1654291
  - ipa-client-automount and NFS unit name changes
    Resolves: RHBZ#1645501
  - Fix compile issue with new 389-ds
    Resolves: RHBZ#1659448


author: Christian Heimes <cheimes@redhat.com> - 4.7.1-8
changelog:
  - Create systemd-user HBAC service and rule
    Resolves: RHBZ#1664974
  - ipaserver/dcerpc: fix exclusion entry with a forest trust domain info returned
    Resolves: RHBZ#1664023


author: Rob Crittenden <rcritten@redhat.com> - 4.7.1-11
changelog:
  - Handle NFS configuration file changes. nfs-utils moved the
    configuration file from /etc/sysconfig/nfs to /etc/nfs.conf.
    Resolves: RHBZ#1676981


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.1-12
changelog:
  - Remove strict dependencies to krb5-server version in order to allow
    update of krb5 to 1.17 and change dependency to KDB DAL version.
    Resolves: RHBZ#1700121


author: Thomas Woerner <twoerner@redhat.com> - 4.7.90-1
changelog:
  - Update to 4.7.90-pre1
    Related: RHBZ#1684528
  - Removed patches 0002 to 0031 as these are upsteram and part of 4.7.90-pre1
  - Added new patches 0001-revert-minssf-defaults.patch and
    0001-Correct-default-fontawesome-path-broken-by-da2cf1c5.patch


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.90-3
changelog:
  - Fix upgrade issue with AD trust when no trust yet established
    Fixes: RHBZ#1708874
    Related: RHBZ#1684528


author: Thomas Woerner <twoerner@redhat.com> - 4.8.0-1
changelog:
  - New upstream release 4.8.0
    - New subpackage: freeipa-client-samba
    - Added command ipa-cert-fix with man page
    - New sysconfdir sysconfig/certmonger
  - Updated pki_version, certmonger_version, sssd_version and kdcproxy_version
    Related: RHBZ#1684528


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.8.0-3
changelog:
  - Make sure ipa-server depends on krb5-kdb-version to pick up
    right MIT Kerberos KDB ABI
    Related: RHBZ#1700121
  - User field separator uses '$$' within ipaSELInuxUserMapOrder
    Fixes: RHBZ#1729099


author: Thomas Woerner <twoerner@redhat.com> - 4.8.0-5
changelog:
  - Remove posixAccount from service_find search filter
    Resolves: RHBZ#1731437
  - Fix repeated uninstallation of ipa-client-samba crashes
    Resolves: RHBZ#1732529
  - WebUI: Add PKINIT status field to 'Configuration' page
    Resolves: RHBZ#1518153


author: Thomas Woerner <twoerner@redhat.com> - 4.8.2-1
changelog:
  - Rebase to upstream release 4.8.2
    - Removed upstream patches 0001 to 0010 that are part of version 4.8.2
    - Updated branding patch
    Resolves: RHBZ#1748987


author: Thomas Woerner <twoerner@redhat.com> - 4.8.2-3
changelog:
  - Use default ssh host key algorithms
    Resolves: RHBZ#1756432
  - Do not run trust upgrade code if master lacks Samba bindings
    Resolves: RHBZ#1757064
  - Finish group membership management UI
    Resolves: RHBZ#1773528


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.8.2-4
changelog:
  - CVE-2019-14867: Denial of service in IPA server due to wrong use of ber_scanf()
    Resolves: RHBZ#1767304
  - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
    Resolves: RHBZ#1776939


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.8.3-1
changelog:
  - Rebase to security release 4.8.3 (CVE-2019-14867, CVE-2019-10195)
    Resolves: RHBZ#1767304
    Resolves: RHBZ#1776939
  - Support KDC ticket policies for authentication indicators
    Resolves: RHBZ#1777564


author: Thomas Woerner <twoerner@redhat.com> - 4.8.3-2
changelog:
  - Use default crypto policy for TLS and enable TLS 1.3 support
    Resolves: RHBZ#1777809
  - Covscan fixes
    Resolves: RHBZ#1777920
  - Change pki_version to 10.8.0
    Related: RHBZ#1748987


author: Thomas Woerner <twoerner@redhat.com> - 4.8.4-1
changelog:
  - Rebase to upstream release 4.8.4
    - Removed upstream patches 0001 to 0008 that are part of version 4.8.3-3
    Resolves: RHBZ#1782658
    Resolves: RHBZ#1782169
    Resolves: RHBZ#1783046
    Related: RHBZ#1748987


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.8.4-3
changelog:
  - Depend on krb5-kdb-version-devel for BuildRequires
  - Update nss dependency to 3.44.0-4
  - Reset per-indicator Kebreros policy
    Resolves: RHBZ#1784761


author: Thomas Woerner <twoerner@redhat.com> - 4.8.4-5
changelog:
  - Fixed weekday in 4.8.4-2 changelog date
    Related: RHBZ#1784003
  - adtrust: print DNS records for external DNS case after role is enabled
    Resolves: RHBZ#1665051
  - AD user without override receive InternalServerError with API
    Resolves: RHBZ#1782572
  - ipa-client-automount fails after repeated installation/uninstallation
    Resolves: RHBZ#1790886
  - install/updates: move external members past schema compat update
    Resolves: RHBZ#1803165
  - kdb: make sure audit_as_req callback signature change is preserved
    Resolves: RHBZ#1803786


author: Thomas Woerner <twoerner@redhat.com> - 4.8.6-1
changelog:
  - Upstream release FreeIPA 4.8.6
  - New SELinux sub package to provide own module
  - Depend on selinux-policy-devel 3.14.3-43 for build due to a makefile issue in
    SELinux external policy support
    Related: RHBZ#1818765


author: Thomas Woerner <twoerner@redhat.com> - 4.8.7-1
changelog:
  - Upstream release FreeIPA 4.8.7
  - Require new samba build 4.12.3-0
    Related: RHBZ#1818765
  - New client-epn sub package
    Resolves: RHBZ#913799


author: Thomas Woerner <twoerner@redhat.com> - 4.8.7-3
changelog:
  - [WebUI] IPA Error 3007: RequirmentError" while adding members in
    "User ID overrides" tab
    Resolves: RHBZ#1757045
  - EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in
    freeipa-client-epn
    Resolves: RHBZ#1847999
  - FreeIPA - Utilize 256-bit AJP connector passwords
    Resolves: RHBZ#1849914
  - ipa: typo issue in ipanthomedirectoryrive deffinition
    Resolves: RHBZ#1851411


author: Thomas Woerner <twoerner@redhat.com> - 4.8.7-6
changelog:
  - selinux don't audit rules deny fetching trust topology
    Resolves: RHBZ#1845596
  - fix iPAddress cert issuance for >1 host/service
    Resolves: RHBZ#1846352
  - Specify cert_paths when calling PKIConnection
    Resolves: RHBZ#1849155
  - Update crypto policy to allow AD-SUPPORT when installing IPA
    Resolves: RHBZ#1851139
  - Add version to ipa-idoverride-memberof obsoletes
    Related: RHBZ#1846434


author: Thomas Woerner <twoerner@redhat.com> - 4.8.7-8
changelog:
  - [WebUI] IPA Error 3007: RequirmentError" while adding members in
    "User ID overrides" tab (updated)
    Resolves: RHBZ#1757045
  - ipa-client-install: use the authselect backup during uninstall
    Resolves: RHBZ#1810179
  - Replace SSLCertVerificationError with CertificateError for py36
    Resolves: RHBZ#1858318
  - Fix AVC denial during ipa-adtrust-install --add-agents
    Resolves: RHBZ#1859213


author: Thomas Woerner <twoerner@redhat.com> - 4.8.7-9
changelog:
  - CAless installation: set the perms on KDC cert file
    Resolves: RHBZ#1863616
  - EPN: handle empty attributes
    Resolves: RHBZ#1866938
  - IPA-EPN: enhance input validation
    Resolves: RHBZ#1866291
  - EPN: enhance input validation
    Resolves: RHBZ#1863079
  - Require new samba build 4.12.3-52
    Related: RHBZ#1868558
  - Require new selinux-policy build 3.14.3-52
    Related: RHBZ#1869311


author: Thomas Woerner <twoerner@redhat.com> - 4.9.0-0.rc1
changelog:
  - Upstream pre release FreeIPA 4.9.0rc1
    Resolves: RHBZ#1891832
  - Requirements and design for libpwquality integration
    Resolves: RHBZ#1340463
  - When parsing options require name/value pairs
    Resolves: RHBZ#1357495
  - WebUI: Fix issue with opening links in new tab/window
    Resolves: RHBZ#1484088
  - Use a state to determine if a 389-ds upgrade is in progress
    Resolves: RHBZ#1569011
  - Unlock user accounts after a password reset and replicate that unlock to
    all IdM servers
    Resolves: RHBZ#1784657
  - Set the certmonger subject with a string, not an object
    Resolves: RHBZ#1810148
  - Implement ACME certificate enrolment
    Resolves: RHBZ#1851835
  - [WebUI] Backport jQuery patches from newer versions of the library (e.g.
    3.5.0)
    Resolves: RHBZ#1859249
  - It is not possible to edit KDC database when the FreeIPA server is running
    Resolves: RHBZ#1875001
  - Fix nsslapd-db-lock tuning of BDB backend
    Resolves: RHBZ#1882340
  - ipa-kdb: support subordinate/superior UPN suffixes
    Resolves: RHBZ#1891056
  - wgi/plugins.py: ignore empty plugin directories
    Resolves: RHBZ#1894800


author: Thomas Woerner <twoerner@redhat.com> - 4.9.0-0.1.rc1
changelog:
  - Fix requirement for python3-kdcproxy, add no autoreqprov for ipatests sub
    package
    Related: RHBZ#1891832


author: Thomas Woerner <twoerner@redhat.com> - 4.9.0-0.2.rc2
changelog:
  - Upstream pre release FreeIPA 4.9.0rc2
    Related: RHBZ#1891832
  - Synchronize spec file with upstream and Fedora
    Related: RHBZ#1891832
  - Traceback while doing ipa-backup
    Resolves: RHBZ#1901068
  - ipa-client-install changes system wide ssh configuration
    Resolves: RRBZ#1544379
  - ipa-kdb: support subordinate/superior UPN suffixes
    Resolves: RHBZ#1891056
  - KRA Transport and Storage Certificates do not renew
    Resolves: RHBZ#1872603
  - Move where the restore state is marked during IPA server upgrade
    Resolves: RHBZ#1569011
  - Intermittent IdM Client Registration Failures
    Resolves: RHBZ#1812871
  - Nightly test failure in test_acme.py::TestACME::test_third_party_certs
    (updates-testing)
    Resolves: RHBZ#1903025
  - Add IPA RA Agent to ACME group on the CA
    Resolves: RHBZ#1902727


author: Thomas Woerner <twoerner@redhat.com> - 4.9.5-1
changelog:
  - Upstream release FreeIPA 4.9.5
    Related: RHBZ#1945038
  - IPA to allow setting a new range type
    Resolves: RHBZ#1688267
  - ipa-server-install displays debug output when --debug output is not
    specified.
    Resolves: RHBZ#1943151
  - ACME fails to generate a cert on migrated RHEL8.4 server
    Resolves: RHBZ#1934991
  - Switch ipa-client to use the JSON API
    Resolves: RHBZ#1937856
  - IDM - Allow specifying permanent logging settings for BIND
    Resolves: RHBZ#1951511
  - Cache LDAP data within a request
    Resolves: RHBZ#1953656
  - ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
    Resolves: RHBZ#1957768


author: Thomas Woerner <twoerner@redhat.com> - 4.9.6-1
changelog:
  - Upstream release FreeIPA 4.9.6
    Related: RHBZ#1945038
  - Revise PKINIT upgrade code
    Resolves: RHBZ#1886837
  - ipa-cert-fix man page: add note about certmonger renewal
    Resolves: RHBZ#1780317
  - Certificate Serial Number issue
    Resolves: RHBZ#1919384


author: Thomas Woerner <twoerner@redhat.com> - 4.9.6-2
changelog:
  - IPA server in debug mode fails to run because time.perf_counter_ns is
    Python 3.7+
    Resolves: RHBZ#1974822
  - Add checks to prevent assigning authentication indicators to internal IPA
    services
    Resolves: RHBZ#1979625
  - Unable to set ipaUserAuthType with stageuser-add
    Resolves: RHBZ#1979605


author: Thomas Woerner <twoerner@redhat.com> - 4.9.6-3
changelog:
  - man page: update ipa-server-upgrade.1
    Resolves: RHBZ#1973273
  - Fall back to krbprincipalname when validating host auth indicators
    Resolves: RHBZ#1979625
  - Add dependency for sssd-winbind-idmap to server-trust-ad
    Resolves: RHBZ#1982211


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.9.6-7
changelog:
  - Hardening for CVE-2020-25717
  - Harden processing of trusted domains' users in S4U operations
  - Resolves: RHBZ#2021443


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.8-3
changelog:
  - Config plugin: return EmptyModlist when no change is applied.
    Resolves: RHBZ#2031825
  - Custodia: use a stronger encryption algo when exporting keys.
    Resolves: RHBZ#2032806
  - ipa-kdb: do not remove keys for hardened auth-enabled users.
    Resolves: RHBZ#2033342
  - ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus
    Resolves: RHBZ#2049167
  - Backport latest test fxes in python3 ipatests.
    Resolves: RHBZ#2048509
  - Removed unused patch files that were part of 4.9.8 rebase.


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.8-4
changelog:
  - Don't always override the port in import_included_profiles
    Fixes: RHBZ#2022483
  - Remove ipa-join errors from behind the debug option
    Fixes: RHBZ#2048558
  - Enable the ccache sweep timer during installation
    Fixes: RHBZ#2051575


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.8-5
changelog:
  - ipatests: remove additional check for failed units.
    Resolves: RHBZ#2053024
  - ipa-cldap: fix memory leak.
    Resolves: RHBZ#2032738


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.8-8
changelog:
  - Backport latest test fixes in python3-ipatests
    Resolves: RHBZ#2060841
  - extdom: user getorigby{user|group}name if available
    Resolves: RHBZ#2062379
  - Set the mode on ipaupgrade.log during RPM post snipppet
    Resolves: RHBZ#2061957
  - test_krbtpolicy: skip SPAKE-related tests in FIPS mode
    Resolves: RHBZ#1909630


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-1
changelog:
  - Rebase to upstream release 4.9.10
    Remove upstream patches 0002 to 0016 that are part of version 4.9.10
    Remove patches 1101 that is part of version 4.9.10
    Rename patch 0001 to 1002 as it will be used in future RHEL 8 releases
    Add patches 0001 and 0002 to fix build on RHEL 8.7
    Resolves: RHBZ#2079466
    Resolves: RHBZ#2063155
    Resolves: RHBZ#1958777
    Resolves: RHBZ#2068088
    Resolves: RHBZ#2004646
    Resolves: RHBZ#782917
    Resolves: RHBZ#2059396
    Resolves: RHBZ#2092015


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-2
changelog:
  - Preserve user: fix the confusing summary
    Resolves: RHBZ#2022028
  - Only calculate LDAP password grace when the password is expired
    Related: RHBZ#782917


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-6
changelog:
  - webui: Allow grace login limit
    Resolves: RHBZ#2109243
  - check_repl_update: in progress is a boolean
    Resolves: RHBZ#2117303
  - Disabling gracelimit does not prevent LDAP binds
    Resolves: RHBZ#2109236
  - Set passwordgracelimit to match global policy on group pw policies
    Resolves: RHBZ#2115475


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-8
changelog:
  - ipa man page format the EXAMPLES section
    Resolves: RHBZ#2129895
  - Fix canonicalization issue in Web UI
    Resolves: RHBZ#2127035
  - Remove idnssoaserial argument from dns zone API. 
    Resolves: RHBZ#2108630
  - Warn for permissions with read/write/search/compare and no attrs
    Resolves: RHBZ#2098187
  - Add PKINIT support to ipa-client-install
    Resolves: RHBZ#2075452
  - Generate CNAMEs for TXT+URI location krb records
    Resolves: RHBZ#2104185
  - Vault: fix interoperability issues with older RHEL systems
    Resolves: RHBZ#2144737
  - Fix typo on ipaupgrade.log chmod during RPM %post snipppet
    Resolves: RHBZ#2140994


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.11-1
changelog:
  - Rebase ipa to 4.9.11
    Resolves: RHBZ#2141316
  - updates: fix memberManager ACI to allow managers from a specified group
    Resolves: RHBZ#2056009
  - Defer creating the final krb5.conf on clients
    Resolves: RHBZ#2148259
  - Exclude installed policy module file from RPM verification
    Resolves: RHBZ#2149567
  - Spec file: ipa-client depends on krb5-pkinit-openssl
    Resolves: RHBZ#2149889


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.12-1
changelog:
  - Rebase ipa to 4.9.12
    Resolves: RHBZ#2196425
  - user or group name: explain the supported format
    Resolves: RHBZ#2150217


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.12-4
changelog:
  - kdb: Use-krb5_pac_full_sign_compat() when available
    Resolves: RHBZ#2176406
  - OTP: fix-data-type-to-avoid-endianness-issue
    Resolves: RHBZ#2218293
  - Upgrade: fix replica agreement
    Resolves: RHBZ#2216551
  - Upgrade: add PKI drop-in file if missing
    Resolves: RHBZ#2215336
  - Use the python-cryptography parser directly in cert-find
    Resolves: RHBZ#2164349
  - Backport test updates
    Resolves: RHBZ#221884


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.12-6
changelog:
  - ipa-kdb: fix error handling of is_master_host()
    Resolves: RHBZ#2214638
  - ipatests: enable firewall rule for http service on acme client
    Resolves: RHBZ#2230256
  - User plugin: improve error related to non existing idp
    Resolves: RHBZ#2224572
  - Prevent admin user from being deleted
    Resolves: RHBZ#1821181
  - Fix memory leak in the OTP last token plugin
    Resolves: RHBZ#2227783


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.12-7
changelog:
  - ipatests: fix test_topology
    Resolves: RHBZ#2232351
  - Installer: activate nss and pam services in sssd.conf
    Resolves: RHBZ#2216532


author: Julien Rische <jrische@redhat.com> - 4.9.12-10
changelog:
  - ipa-kdb: Detect and block Bronze-Bit attacks
    Resolves: RHEL-16532
  - Fix for CVE-2023-5455
    Resolves: RHEL-12577


author: Julien Rische <jrische@redhat.com> - 4.9.12-12
changelog:
  - ipa-kdb: Rework ipadb_reinit_mspac()
    Resolves: RHEL-25745
  - kdb: PAC generator: do not fail if canonical principal is missing
    Resolves: RHEL-24356
  - sidgen: fix missing prototypes
    Resolves: RHEL-24380
  - sidgen: ignore staged users when generating SIDs
    Resolves: RHEL-24380
  - ipa-kdb: Fix memory leak during PAC verification
    Resolves: RHEL-24384
  - ipapython: Propagate KRB5Error exceptions on iterating ccache
    Resolves: RHEL-24387
  - ipapython: Correct return type of krb5_free_cred_contents
    Resolves: RHEL-24387
  - ipapython: Clean up krb5_error
    Resolves: RHEL-24387
  - ipa-kdb: Disable Bronze-Bit check if PAC not available
    Resolves: RHEL-24390
  - ipatests: wait for replica update in test_dns_locations
    Resolves: RHEL-24395
  - adtrustinstance: make sure NetBIOS name defaults are set properly
    Resolves: RHEL-24399


author: lihaipeng <lihaipeng@openanolis.org> - 4.9.12-14.0.1
changelog:
  - Set IPAPLATFORM=rhel when build on anolis
  - Remove loongarch64 arch
  - Fix CVE-2020-17049 (zhaozhiyuan05@ieisystem.com)
  - Fix CVE-2023-5455 (zhaozhiyuan05@ieisystem.com)


author: Julien Rische <jrische@redhat.com> - 4.9.13-3
changelog:
  - ipa-kdb: Detect and block Bronze-Bit attacks
    Resolves: RHEL-9984
  - Fix for CVE-2023-5455
    Resolves: RHEL-12578


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-4
changelog:
  - Improve server affinity for CA-less deployments
    Resolves: RHEL-22283
  - host: update system: Manage Host Keytab permission
    Resolves: RHEL-22286
  - adtrustinstance: make sure NetBIOS name defaults are set properly
    Resolves: RHEL-21938
  - ipatests: Fix healthcheck report when nsslapd accesslog logbuffering is set to off
    Resolves: RHEL-19672


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-5
changelog:
  - kdb: PAC generator: do not fail if canonical principal is missing
    Resolves: RHEL-23630
  - ipa-kdb: Fix memory leak during PAC verification
    Resolves: RHEL-22644
  - Fix session cookie access
    Resolves: RHEL-23622
  - Do not ignore staged users in sidgen plugin
    Resovlves: RHEL-23626
  - ipa-kdb: Disable Bronze-Bit check if PAC not available
    Resolves: RHEL-22313
  - krb5kdc: Fix start when pkinit and otp auth type are enabled
    Resolves: RHEL-4874
  - hbactest was not collecting or returning messages
    Resolves: RHEL-12780


author: Julien Rische <jrische@redhat.com> - 4.9.13-6
changelog:
  - ipa-kdb: Rework ipadb_reinit_mspac()
    Resolves: RHEL-25742
  - ipatests: wait for replica update in test_dns_locations
    Resolves: RHEL-22373
  - ipatests: fix tasks.wait_for_replication() method
    Resolves: RHEL-25708


author: Julien Rische <jrische@redhat.com> - 4.9.13-7
changelog:
  - ipa-kdb: Fix double free in ipadb_reinit_mspac()
    Resolves: RHEL-25742
  - kra: set RSA-OAEP as default wrapping algo when FIPS is enabled
    Resolves: RHEL-12153
  - Vault: improve vault server archival/retrieval calls error handling
    Resolves: RHEL-12153
  - Vault: add support for RSA-OAEP wrapping algo
    Resolves: RHEL-12153


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-8
changelog:
  - rpcserver: validate Kerberos principal name before running kinit
    Resolves: RHEL-26153
  - Vault: add additional fallback to RSA-OAEP wrapping algo
    Resolves: RHEL-28259


author: Rafael Jeffman <rjeffman@redhat.com> - 9.4.13-9
changelog:
  - dcerpc: invalidate forest trust intfo cache when filtering out realm domains
    Resolves: RHEL-28559
  - Backport latests test fixes in python3-tests
    ipatests: add xfail for autoprivate group test with override
    ipatests: remove xfail thanks to sssd 2.9.4
    ipatests: adapt for new automembership fixup behavior
    ipatests: Fixes for test_ipahealthcheck_ipansschainvalidation testcases
    test_xmlrpc: adopt to automember plugin message changes in 389-ds
    Resolves: RHEL-29908


author: Julien Rische <jrische@redhat.com> - 4.9.13-10
changelog:
  - kdb: apply combinatorial logic for ticket flags (CVE-2024-3183)
    Resolves: RHEL-29927
  - kdb: fix vulnerability in GCD rules handling (CVE-2024-2698)
    Resolves: RHEL-29692


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.13-9
changelog:
  - Allow the admin user to be disabled
    Resolves: RHEL-34756
  - ipa-otptoken-import: open the key file in binary mode
    Resolves: RHEL-39616
  - ipa-crlgen-manage: manage the cert status task execution time
    Resolves: RHEL-30280
  - idrange-add: add a warning because 389ds restart is required
    Resolves: RHEL-28996
  - PKINIT certificate: fix renewal on hidden replica
    Resolves: RHEL-4913, RHEL-45908


author: François Cami <fcami@redhat.com> - 0.2-4
changelog:
  - Fix ipa-healthcheck.sh installation path (rhbz#1729188)
  - Create and own log directory (rhbz#1729188)


author: François Cami <fcami@redhat.com> - 0.3-1
changelog:
  - Update to upstream 0.3 (#1701351)
  - Add logrotate configs + depend on anacron and logrotate (#1729207)


author: Rob Crittenden <rcritten@redhat.com> - 0.4-1
changelog:
  - Rebase to upstream 0.4 (#1770346)
  - Create subpackage to split out core processing (#1771710)
  - Correct URL (#1773512)
  - Errors not translated to strings (#1752849)
  - JSON output not indented by default (#1729043)
  - Add dependencies to checks to avoid false-positives (#1727900)
  - Verify expected DNS records (#1695125)


author: Rob Crittenden <rcritten@redhat.com> - 0.4-5
changelog:
  - Remove the Obsoletes < 0.4 and add same-version Requires to each
    subpackage so that upgrades from 0.3 will work (#1852244)


author: Rob Crittenden <rcritten@redhat.com> - 0.4-6
changelog:
  - The core subpackage can be installed standalone, drop the Requires
    on the base package. (#1852244)
  - Add Conflicts < 0.4 to to core to allow downgrading with
    --allowerasing (#1852244)


author: Rob Crittenden <rcritten@redhat.com> - 0.7-1
changelog:
  - Update to upstream 0.7 (#1891850)
  - Include Directory Server healthchecks (#1824193)
  - Document that default output format is JSON (#1780328)
  - Fix return value on exit with --input-file (#1866558)
  - Fix examples in man page (#1809215)
  - Replace man page reference to output-format with output-type (#1780303)
  - Add dependencies on services to avoid false positives (#1780510)


author: Rob Crittenden <rcritten@redhat.com> - 0.7-5
changelog:
  - Return a user-friendly message when no issues are found (#1780062)
  - Report on FIPS status (#1781107)
  - Detect mismatches beteween certificates in LDAP and filesystem (#1886770)
  - Verify owner/perms for important log files (#1780020)


author: Rob Crittenden <rcritten@redhat.com> - 0.7-7
changelog:
  - ipa-healthcheck command takes some extra time to complete when dirsrv
    instance is stopped (#1776687)
  - ipa-healthcheck complains about pki.server.healthcheck errors even CA
    is not configured on the replica (#1983060)


author: Rob Crittenden <rcritten@redhat.com> - 0.7-8
changelog:
  - Suppress the CRLManager check false positive when a CA is not
    configured (#1983060)
  - Fix the backport of the pki.server.healthcheck suppression (#1983060)


author: Rob Crittenden <rcritten@redhat.com> - 0.12-1
changelog:
  - Update to upstream 0.12 (#2139529)
  - Verify that the number of krb5kdc worker processes is aligned to the
    number of configured CPUs (#2052930)
  - IPADNSSystemRecordsCheck displays warning message for 2 expected
    ipa-ca AAAA records (#2099484)


author: François Cami <fcami@fedoraproject.org> - 3.0.3-3
changelog:
  - Drop static library support (#1081486).
  - iperf3-devel subpackage must require iperf3.
  - iperf3-devel should only contain the unversioned shared library.
  - Call ldconfig since we are installing a shared library now.
  - Removed INSTALL file.


author: Helge Deller <hdeller@redhat.de>
changelog:
  - updated to iproute2-2.2.4-now-ss001007.tar.gz
  - bzip2 source tar file
  - "License" replaces "Copyright"
  - added "BuildPrereq: tetex-latex tetex-dvips psutils"
  - rebuilt for 7.2


author: Phil Knirsch <pknirsch@redhat.com> 2.4.7-3
changelog:
  - Fixed missing diffserv and atm support in config (#57278).
  - Fixed inconsistent numeric base problem for command line (#65473).


author: Phil Knirsch <pknirsch@redhat.com>
changelog:
  - Updated to latest version. Used by other distros, so seems stable. ;-)
  - Quite a few patches needed updating in that turn.
  - Added ss (#107363) and several other new nifty tools.


author: Phil Knirsch <pknirsch@redhat.com> 2.4.7-14
changelog:
  - Fixed -f option for ss (#118355).
  - Small description fix (#110997).
  - Added initialization of some vars (#74961).
  - Added patch to initialize "default" rule as well (#60693).


author: Radek Vokal <rvokal@redhat.com> - 2.6.18-1
changelog:
  - upgrade to upstream 2.6.18
  - initcwnd patch merged
  - bug fix for xfrm monitor
  - alignment fixes for cris
  - documentation corrections


author: Marcela Maslanova <mmaslano@redhat.com> - 2.6.23-2
changelog:
  - rebuild with fix tetex and linuxdoc-tools -> manual pdf
  - clean unnecessary patches
  - add into spec *.so objects, new BR linux-atm-libs-devel


author: Marcela Maslanova <mmaslano@redhat.com> - 2.6.23-3
changelog:
  - rebuild without tetex files. It isn't working in rawhide yet. Added
    new source for ps files.
  - #431179 backward compatibility for previous iproute versions


author: Marcela Maslanova <mmaslano@redhat.com> - 2.6.27-1
changelog:
  - aead support was included into upstream version
  - patch for moving libs is now deprecated
  - update to 2.6.27


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.27-2
changelog:
  - 475130 - Negative preferred lifetimes of IPv6 prefixes/addresses
    displayed incorrectly
  - 472878 - “ip maddr show” in IB interface causes a stack corruption
  - both patches will be probably in iproute v2.6.28


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.28-2
changelog:
  - 483484 install distribution files into /usr/share and also fixed
   install paths in spec
  - add the latest change from git which add DRR support
   c86f34942a0ce9f8203c0c38f9fe9604f96be706


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.29-1
changelog:
  - update to 2.6.29
  - remove DDR patch which became part of sourc
  - add patch with correct headers 1957a322c9932e1a1d2ca1fd37ce4b335ceb7113


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.29-2
changelog:
  - c3651bf4763d7247e3edd4e20526a85de459041b ip6tunnel: Fix no default
   display of ip4ip6 tunnels
  - e48f73d6a5e90d2f883e15ccedf4f53d26bb6e74 missing arpd directory


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.29-3
changelog:
  - new iptables (xtables) bring problems to tc, when ipt is used.
    rhbz#497344 still broken. tc_modules.patch brings correct paths to
    xtables, but that doesn't fix whole issue.
  - 497355 ip should allow creation of an IPsec SA with 'proto any'
    and specified sport and dport as selectors


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.32-2
changelog:
  - add macvlan aka VESA support d63a9b2b1e4e3eab0d0577d0a0f412d50be1e0a7
  - kernel headers 2.6.33 ab322673298bd0b8927cdd9d11f3d36af5941b93
    are needed for macvlan features and probably for other added later.
  - fix number of release which contains 2.6.32 kernel headers and features
    but it was released as 2.6.31


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.33-2
changelog:
  - 578729 6rd tunnel correctly 3979ef91de9ed17d21672aaaefd6c228485135a2
  - change BR texlive to tex according to guidelines


author: Petr Sabata <psabata@redhat.com> - 2.6.38.1-2
changelog:
  - General cleanup
  - Use global instead of define
  - Buildroot removal
  - Correcting URL and Source links
  - Install genl, ifstat, routef, routel and rtpr (rhbz#697319)


author: Petr Sabata <psabata@redhat.com> - 2.6.38.1-3
changelog:
  - Install ctstat, rtstat and routef manpage symlinks
  - Install m_xt & m_ipt tc modules
  - Creating devel and virtual static subpackages with libnetlink


author: Petr Šabata <contyk@redhat.com> - 3.1.0-1
changelog:
  - 3.1.0 bump
  - Point URL and Source to the new location on kernel.org
  - Remove now obsolete defattr
  - Dropping various patches now included upstream
  - Dropping iproute2-2.6.25-segfault.patch; I fail to understand the reason for
    this hack


author: Petr Šabata <contyk@redhat.com> - 3.6.0-3
changelog:
  - Include section 7 manpages (#876857)
  - Fix ancient bogus dates in the changelog (correction based upon commits)
  - Explicitly require some TeX fonts no longer present in the base distribution


author: Petr Šabata <contyk@redhat.com> - 3.10.0-1
changelog:
  - 3.10.0 bump
  - Drop the SHAREDIR patch and revert to upstream ways (#966445)
  - Fix an XFRM regression with FORTIFY_SOURCE


author: Petr Šabata <contyk@redhat.com> - 3.10.0-4
changelog:
  - lnstat -i: Run indefinitely if the --count isn't specified (#977845)
  - Switch to unversioned %docdir


author: Phil Sutter <psutter@redhat.com> - 4.5.0-3
changelog:
  - Fix upgrade path by adding correct Requires/Obsoletes statements to spec file
  - Move README.iproute2+tc into tc subpackage


author: Phil Sutter <psutter@redhat.com> - 4.10.0-1
changelog:
  - Ship new header iproute2/bpf_elf.h
  - Document content of remaining docs fixup patch in spec file
  - Drop patches already applied upstream
  - New version 4.10.0


author: Phil Sutter <psutter@redhat.com> [4.17.0-1.el8]
changelog:
  - rdma: print driver resource attributes (Phil Sutter) [1610334]
  - rdma: update rdma_netlink.h to get new driver attributes (Phil Sutter) [1610334]
  - rdma: Print net device name and index for RDMA device (Phil Sutter) [1610334]
  - devlink: CTRL_ATTR_FAMILY_ID is a u16 (Phil Sutter) [1589317]
  - tc: Do not use addattr_nest_compat on mqprio and netem (Phil Sutter) [1589317]
  - ipaddress: Fix and make consistent label match handling (Phil Sutter) [1589317]
  - rt_dsfield: Ship deprecated values for compatibility (Phil Sutter) [1595683]
  - New version 4.17.0 including upstream-suggested fixes (Phil Sutter) [1589317]


author: Phil Sutter <psutter@redhat.com> [4.18.0-2.el8]
changelog:
  - bridge/mdb: fix missing new line when show bridge mdb (Phil Sutter) [1625500]
  - ip-route: Fix segfault with many nexthops (Phil Sutter) [1625358]
  - Update kernel headers (Phil Sutter) [1615915]
  - tc/flower: Add match on encapsulating tos/ttl (Phil Sutter) [1615915]
  - tc/act_tunnel_key: Enable setup of tos and ttl (Phil Sutter) [1615915]
  - iprule: Fix destination prefix output (Phil Sutter) [1623503]
  - ip: Add missing -M flag to help text (Phil Sutter) [1612704]
  - man: ss.8: Describe --events option (Phil Sutter) [1612704]
  - rtmon: List options in help text (Phil Sutter) [1612704]
  - man: rtacct.8: Fix nstat options (Phil Sutter) [1612704]
  - man: ifstat.8: Document --json and --pretty options (Phil Sutter) [1612704]
  - genl: Fix help text (Phil Sutter) [1612704]
  - man: devlink.8: Document -verbose option (Phil Sutter) [1612704]
  - devlink: trivial: Make help text consistent (Phil Sutter) [1612704]
  - bridge: trivial: Make help text consistent (Phil Sutter) [1612704]
  - man: bridge.8: Document -oneline option (Phil Sutter) [1612704]


author: Phil Sutter <psutter@redhat.com> [4.18.0-4.el8]
changelog:
  - iplink_vxlan: take into account preferred_family creating vxlan device (Phil Sutter) [1626321]
  - ip-addrlabel: Fix printing of label value (Phil Sutter) [1639412]
  - bridge: fdb: Fix for missing keywords in non-JSON output (Phil Sutter) [1636532]


author: Phil Sutter <psutter@redhat.com> [4.18.0-5.el8]
changelog:
  - utils: fix get_rtnl_link_stats_rta stats parsing (Phil Sutter) [1626306]
  - uapi: add snmp header file (Phil Sutter) [1626306]
  - macsec: fix off-by-one when parsing attributes (Phil Sutter) [1628428]
  - json: make 0xhex handle u64 (Phil Sutter) [1628428]


author: Phil Sutter <psutter@redhat.com> [4.18.0-6.el8]
changelog:
  - Update kernel headers (Phil Sutter) [1637440]
  - tc_util: Add support for showing TCA_STATS_BASIC_HW statistics (Phil Sutter) [1637440]
  - tc: Remove pointless assignments in batch() (Phil Sutter) [1602555]
  - tipc: Drop unused variable 'genl' (Phil Sutter) [1602555]
  - ip-route: Fix parse_encap_seg6() srh parsing (Phil Sutter) [1602555]
  - rdma: Don't pass garbage to rd_check_is_filtered() (Phil Sutter) [1602555]
  - ip-route: Fix for memleak in error path (Phil Sutter) [1602555]
  - rdma: Fix for ineffective check in add_filter() (Phil Sutter) [1602555]
  - devlink: Fix error reporting in cmd_resource_set() (Phil Sutter) [1602555]
  - libnetlink: fix use-after-free of message buf (Phil Sutter) [1602555]
  - libnetlink: don't return error on success (Phil Sutter) [1602555]
  - libnetlink: fix leak and using unused memory on error (Phil Sutter) [1602555]
  - tc: htb: Print default value in hex (Phil Sutter) [1641053]


author: Phil Sutter <psutter@redhat.com> [4.18.0-7.el8]
changelog:
  - ip-route: Fix nexthop encap parsing (Phil Sutter) [1625358]
  - man: ip-route.8: Document nexthop limit (Phil Sutter) [1625358]


author: Phil Sutter <psutter@redhat.com> [4.18.0-11.el8]
changelog:
  - tc: m_tunnel_key: Add tunnel option support to act_tunnel_key (Phil Sutter) [1654761]
  - tc: f_flower: add geneve option match support to flower (Phil Sutter) [1654761]
  - l2tp: Fix printing of cookie and peer_cookie values (Phil Sutter) [1643805]


author: Andrea Claudi <aclaudi@redhat.com> [4.18.0-12.el8]
changelog:
  - devlink: Add param command support (Andrea Claudi) [1663199]
  - rdma: Fix representation of PortInfo CapabilityMask (Andrea Claudi) [1664694]
  - uapi: update ib_verbs (Andrea Claudi) [1664694]
  - tc: flower: Add support for QinQ (Andrea Claudi) [1615928]
  - ip rule: Add ipproto and port range to filter list (Andrea Claudi) [1678111]


author: Andrea Claudi <aclaudi@redhat.com> [4.18.0-13.el8]
changelog:
  - ip-xfrm: Respect family in deleteall and list commands (Andrea Claudi) [1656717]
  - Update kernel headers (Andrea Claudi) [1716361]
  - uapi: update bpf header (Andrea Claudi) [1716361]
  - uapi: update headers to 4.20-rc1 (Andrea Claudi) [1716361]
  - bpf: add btf func and func_proto kind support (Andrea Claudi) [1716361]
  - lib/bpf: fix build warning if no elf (Andrea Claudi) [1716361]
  - bpf: initialise map symbol before retrieving and comparing its type (Andrea Claudi) [1716361]
  - Include bsd/string.h only in include/utils.h (Andrea Claudi) [1716361]
  - Use libbsd for strlcpy if available (Andrea Claudi) [1716361]
  - bpf: check map symbol type properly with newer llvm compiler (Andrea Claudi) [1716361]
  - bpf: implement btf handling and map annotation (Andrea Claudi) [1716361]
  - bpf: implement bpf to bpf calls support (Andrea Claudi) [1716361]
  - bpf: remove strict dependency on af_alg (Andrea Claudi) [1716361]
  - bpf: move bpf_elf_map fixup notification under verbose (Andrea Claudi) [1716361]
  - iplink: add support for reporting multiple XDP programs (Andrea Claudi) [1716361]
  - rdma: Document IB device renaming option (Andrea Claudi) [1663228]
  - rdma: Add an option to rename IB device interface (Andrea Claudi) [1663228]
  - rdma: Introduce command execution helper with required device name (Andrea Claudi) [1663228]
  - rdma: Update kernel include file to support IB device renaming (Andrea Claudi) [1663228]
  - libnetlink: Convert GETADDR dumps to use rtnl_addrdump_req (Andrea Claudi) [1716772]


author: Andrea Claudi <aclaudi@redhat.com> [4.18.0-15.el8]
changelog:
  - netns: make netns_{save,restore} static (Andrea Claudi) [1719759]
  - ip vrf: use hook to change VRF in the child (Andrea Claudi) [1719759]
  - netns: switch netns in the child when executing commands (Andrea Claudi) [1719759]
  - m_mirred: don't bail if the control action is missing (Andrea Claudi) [1711760]
  - tc: introduce support for chain templates (Andrea Claudi) [1710291]
  - ip: reset netns after each command in batch mode (Andrea Claudi) [1671016]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-2.el8]
changelog:
  - man: ip.8: Add missing vrf subcommand description (Andrea Claudi) [1780010]
  - xfrm: not try to delete ipcomp states when using deleteall (Andrea Claudi) [1808634]
  - ip-xfrm: Fix help messages (Andrea Claudi) [1796045]
  - man: rdma.8: Add missing resource subcommand description (Andrea Claudi) [1786576]
  - man: rdma-statistic: Add filter description (Andrea Claudi) [1786565]
  - tc: implement support for action flags (Andrea Claudi) [1770671]
  - Update kernel headers (Andrea Claudi) [1770671]
  - Update kernel headers (Andrea Claudi) [1770671]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-3.el8]
changelog:
  - xfrm: also check for ipv6 state in xfrm_state_keep (Andrea Claudi) [1828033]
  - man: bridge.8: fix bridge link show description (Andrea Claudi) [1817571]
  - ip: fix ip route show json output for multipath nexthops (Andrea Claudi) [1738633]
  - ip link: xstats: fix TX IGMP reports string (Andrea Claudi) [1796041]
  - nstat: print useful error messages in abort() cases (Andrea Claudi) [1824896]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-4.el8]
changelog:
  - tc: f_flower: add options support for erspan (Andrea Claudi) [1830485]
  - tc: f_flower: add options support for vxlan (Andrea Claudi) [1830485]
  - tc: m_tunnel_key: add options support for erpsan (Andrea Claudi) [1830485]
  - tc: m_tunnel_key: add options support for vxlan (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for erspan metadata (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for vxlan metadata (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for geneve metadata (Andrea Claudi) [1830485]
  - Update kernel headers (Andrea Claudi) [1830485]
  - man: ip.8: add reference to mptcp man-page (Andrea Claudi) [1812207]
  - man: mptcp man page (Andrea Claudi) [1812207]
  - ss: allow dumping MPTCP subflow information (Andrea Claudi) [1812207]
  - Update kernel headers (Andrea Claudi) [1812207]
  - Update kernel headers (Andrea Claudi) [1812207]
  - add support for mptcp netlink interface (Andrea Claudi) [1812207]
  - Update kernel headers and import mptcp.h (Andrea Claudi) [1812207]
  - ip: xfrm: add espintcp encapsulation (Andrea Claudi) [1844045]
  - Update kernel headers and import udp.h (Andrea Claudi) [1844045]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-5.el8]
changelog:
  - man: tc-ct.8: Add manual page for ct tc action (Andrea Claudi) [1844637]
  - tc: flower: Add matching on conntrack info (Andrea Claudi) [1844637]
  - tc: Introduce tc ct action (Andrea Claudi) [1844637]
  - tc: add NLA_F_NESTED flag to all actions options nested block (Andrea Claudi) [1844637]
  - Import tc_act/tc_ct.h uapi file (Andrea Claudi) [1844637]
  - ss: allow dumping kTLS info (Andrea Claudi) [1812207]
  - devlink: Add health error recovery status monitoring (Andrea Claudi) [1821039]


author: Andrea Claudi <aclaudi@redhat.com> [5.9.0-2.el8]
changelog:
  - tc: flower: fix json output with mpls lse (Andrea Claudi) [1885770]
  - tc-mpls: fix manpage example and help message string (Andrea Claudi) [1885770]
  - tc-vlan: fix help and error message strings (Andrea Claudi) [1885770]
  - m_mpls: test the 'mac_push' action after 'modify' (Andrea Claudi) [1885770]
  - m_mpls: add mac_push action (Andrea Claudi) [1885770]
  - m_vlan: add pop_eth and push_eth actions (Andrea Claudi) [1885770]
  - Update kernel headers (Andrea Claudi) [1885770]


author: Andrea Claudi <aclaudi@redhat.com> [5.12.0-1.el8]
changelog:
  - tc: f_flower: Add missing ct_state flags to usage description (Andrea Claudi) [1957243]
  - tc: f_flower: Add option to match on related ct state (Andrea Claudi) [1957243]


author: Andrea Claudi <aclaudi@redhat.com> [5.12.0-3.el8]
changelog:
  - tc: htb: improve burst error messages (Andrea Claudi) [1910745]
  - tc: u32: Fix key folding in sample option (Andrea Claudi) [1979425]
  - police: Fix normal output back to what it was (Andrea Claudi) [1981393]
  - police: Add support for json output (Andrea Claudi) [1981393]
  - police: add support for packet-per-second rate limiting (Andrea Claudi) [1981393]
  - Update kernel headers (Andrea Claudi) [1981393]
  - mptcp: add support for port based endpoint (Andrea Claudi) [1984733]


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-2.el8
changelog:
  - vdpa: Enable user to set mtu of the vdpa device (Andrea Claudi) [2036880]
  - vdpa: Enable user to set mac address of vdpa device (Andrea Claudi) [2036880]
  - vdpa: Enable user to query vdpa device config layout (Andrea Claudi) [2036880]
  - vdpa: align uapi headers (Andrea Claudi) [2036880]


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-3.el8
changelog:
  - tc: u32: add json support in `print_raw`, `print_ipv4`, `print_ipv6` (Andrea Claudi) [1989591]
  - tc: u32: add support for json output (Andrea Claudi) [1989591]


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-4.el8
changelog:
  - vdpa: Update man page with added support to configure max vq pair (Andrea Claudi) [2056827]
  - vdpa: Support reading device features (Andrea Claudi) [2056827]
  - vdpa: Support for configuring max VQ pairs for a device (Andrea Claudi) [2056827]
  - vdpa: Allow for printing negotiated features of a device (Andrea Claudi) [2056827]
  - vdpa: Remove unsupported command line option (Andrea Claudi) [2056827]
  - uapi: update vdpa.h (Andrea Claudi) [2056827]
  - Update kernel headers and import virtio_net (Andrea Claudi) [2056827]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-2.el8
changelog:
  - macvlan: Add bclim parameter (Andrea Claudi) [2188134]
  - Update kernel headers (Andrea Claudi) [2188134]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-4.el8
changelog:
  - ip vrf: make ipvrf_exec SELinux-aware (Andrea Claudi) [1780023]
  - lib: add SELinux include and stub functions (Andrea Claudi) [1780023]
  - ss: make SELinux stub functions conformant to API definitions (Andrea Claudi) [1780023]
  - ss: make is_selinux_enabled stub work like in SELinux (Andrea Claudi) [1780023]


author: Liwei Ge <geliwei@openanolis.org> - 6.2.0-5.0.1
changelog:
  - delete the rt_dsfield file due to three Aones (hengqi@linux.alibaba.com)
  - [kernelself-tests]net.fib_rule_tests.sh: TEST rule4 del by pref, rule6 del by pref FAIL


author: Liwei Ge <geliwei@openanolis.org> - 6.2.0-6.0.1
changelog:
  - delete the rt_dsfield file due to three Aones (hengqi@linux.alibaba.com)
  - [kernelself-tests]net.fib_rule_tests.sh: TEST rule4 del by pref, rule6 del by pref FAIL
  - cherry-pick `add sw patch #89d57a068e2a72e13980eef179ae85fa0f9dd348`. (nijie@wxiat.com)
  - Disable bpf feature for sw_64. (Weisson@linux.alibaba.com)


author: Mathieu Bridon <bochecha@fedoraproject.org> - 6.11-1
changelog:
  - New upstream release.
  - Removed our patch, it has been integrated upstream. As such, we also don't
    need to re-run autoreconf any more.


author: Mathieu Bridon <bochecha@fedoraproject.org> - 6.14-1
changelog:
  - New upstream release.
  - Fix scriptlets, ldconfig is needed for the libs subpackage, not the main one.


author: Quentin Armitage <quentin@armitage.org.uk> 6.19-2
changelog:
  - Add service pkg - adds save and reload functionality on shutdown/startup
  - Add requires dependency of ipset on matching ipset-libs


author: Mathieu Bridon <bochecha@fedoraproject.org> - 6.21.1-2
changelog:
  - Remove runtime requirement on the kernel.
    https://lists.fedoraproject.org/pipermail/devel/2014-March/196565.html


author: Thomas Woerner <twoerner@redhat.com> - 6.29-1
changelog:
  - New upstream version 6.29 (RHBZ#1317208)
    - Suppress unnecessary stderr in command loop for resize and list
    - Correction in comment test
    - Support chroot buildroots (reported by Jan Engelhardt)
    - Fix "configure" breakage due to pkg-config related changes
      (reported by Jan Engelhardt)
    - Support older pkg-config packages
    - Add bash completion to the install routine (Mart Frauenlob)
    - Fix misleading error message with comment extension
    - Test added to check 0.0.0.0/0,iface to be matched in hash:net,iface type
    - Fix link with libtool >= 2.4.4 (Olivier Blin)


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-3
changelog:
  - Fix loading of sets with dependencies on other sets (RHBZ#1647096), and
    hardcode 6.38-1.el7 for ipset-service upgrade and downgrade triggers, so that
    we don't run into issues with z-stream updates


author: Stefano Brivio <sbrivio@redhat.com> - 7.1-1
changelog:
  - Rebase to 7.1 (RHBZ#1649090):
    - Add compatibility support for strscpy()
    - Correct the manpage about the sort option
    - Add missing functions to libipset.map
    - configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
    - Implement sorting for hash types in the ipset tool
    - Fix to list/save into file specified by option (reported by Isaac Good)
    - Introduction of new commands and protocol version 7, updated kernel include files
    - Add compatibility support for async in pernet_operations
    - Use more robust awk patterns to check for backward compatibility
    - Prepare the ipset tool to handle multiple protocol version
    - Fix warning message handlin
    - Correct to test null valued entry in hash:net6,port,net6 test
    - Library reworked to support embedding ipset completely
    - Add compatibility to support kvcalloc()
    - Validate string type attributes in attr2data() (Stefano Brivio)
    - manpage: Add comment about matching on destination MAC address (Stefano Brivio)
      (RHBZ#1649079)
    - Add compatibility to support is_zero_ether_addr()
    - Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649085)
    - Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649085)
    - Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649085)
    - tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio) 
  - Fixes:
    - Fix all shellcheck warnings in init script (RHBZ#1649085)
    - Make error reporting consistent, introduce different severities (RHBZ#1683711)
    - While restoring, on invalid entries, remove them and retry (RHBZ#1683713)
    - Fix covscan SC2166 warning in init script (RHBZ#1649085)


author: P.Copeland <copeland@redhat.com>
changelog:
  - Added 'dist' and 'rpms' to the Makefile
  - Added Obsoletes tag since there were early versions
    of ipvsadm-*.rpm that installed in /sbin
  - Obsolete tag was a bit vicious re: piranha


author: Horms <horms@vergenet.net>
changelog:
  - Removed Obseletes tag as ipvsadm is back in /sbin where it belongs 
    as it is more or less analogous to both route and ipchains both of
    which reside in /sbin.
  - Create directory to install init script into. Init scripts won't install
    into build directory unless this is done


author: P.opeland <bryce@redhat.com>
changelog:
  - Small modifications to make the compiler happy in RH7 and the Alpha
  - Fixed the documentation file that got missed off in building
    the rpm
  - Made a number of -pedantic mods though popt will not compile with
    -pedantic


author: Mike McLean <mikem@redhat.com> 1.21-9.ipvs108
changelog:
  - Dropping kernel-source BuildRequires and including a local copy of 
    net/ip_vs.h to compensate.
  - Incorporating some upstream changes, most notably the --sort option.


author: Matthias Saou <http://freshrpms.net/> 1.24-9
changelog:
  - Spec file cleanup.
  - Update License field.
  - Don't "chkconfig --del" upon update.
  - Add missing kernel-headers build requirement.
  - Update URL and Source locations.
  - Remove outdated piranha obsoletes, it has never been part of any Fedora.
  - No longer mark init script as config.
  - Include Makefile patch to prevent stripping and install init script.
  - The init script could use a rewrite... leave that one for later.


author: Matthias Saou <http://freshrpms.net/> 1.24-10
changelog:
  - Update to latest upstream sources. Same filename, but updated content!
  - Update kernhdr patch for it to still apply, update ip_vs.h from 1.2.0 to
    1.2.1 from kernel 2.6.23.1.


author: Matthias Saou <http://freshrpms.net/> 1.25-1
changelog:
  - Prepare update to 1.25 for when devel will update to kernel 2.6.28.
  - Build require libnl-devel and popt-devel (+ patch to fix popt detection).


author: Matthias Saou <http://freshrpms.net/> 1.26-2
changelog:
  - Backport the init script from RHEL6, which contains lots of changes to make
    it behave simlarly to the iptables init script (#593276).


author: Ryan O'Hara <rohara@redhat.com> - 1.29-7
changelog:
  - Add 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS (#1543790)


author: Matt Domsch <mdomsch@fedoraproject.org> - 0.9.9-1
changelog:
  - new upstream version 0.9.9
  -- plus patches from git up to 20090818 which fix build errors and
     other release-critical bugs.
  -- 0.9.9: added Attansic L1E and sis190/191 ethernet drivers.  Fixes
     and updates to e1000 and 3c90x drivers.
  -- 0.9.8: new commands: time, sleep, md5sum, sha1sum. 802.11 wireless
     support with Realtek 8180/8185 and non-802.11n Atheros drivers.
     New Marvell Yukon-II gigabet Ethernet driver.  HTTP redirection
     support.  SYSLINUX floppy image type (.sdsk) with usable file
     system.  Rewrites, fixes, and updates to 3c90x, forcedeth, pcnet32,
     e1000, and hermon drivers.


author: Matt Domsch <mdomsch@fedoraproject.org> - 1.0.1-1
changelog:
  - New drivers: Intel e1000, e1000e, igb, EFI snpnet, JMicron jme,
    Neterion X3100, vxge, pcnet32.
  - Bug fixes and improvements to drivers, wireless, DHCP, iSCSI,
    COMBOOT, and EFI.


author: Daniel P. Berrange <berrange@redhat.com> - 20120319-2.git0b2c788
changelog:
  - Remove BuildRoot & rm -rf of it in install/clean sections
  - Remove defattr in file section
  - Switch to use global, instead of define for macros
  - Add note about Patch1 not going upstream
  - Split BRs across lines for easier readability


author: Paolo Bonzini <pbonzini@redhat.com> - 20130103-3.git717279a
changelog:
  - Fix BuildRequires, use cross-compiler when building on 32-bit i686
  - Build UEFI drivers for QEMU and include them (patch from Gerd Hoffmann.
    BZ#958875)


author: Cole Robinson <crobinso@redhat.com> - 20140303-1.gitff1e7fc7
changelog:
  - Allow access to ipxe prompt if VM is set to pxe boot (bz #842932)
  - Enable PNG support (bz #1058176)


author: Paolo Bonzini <pbonzini@redhat.com> - 20150407-1.gitdc795b9f
changelog:
  - Update to latest upstream snapshot
  - Switch source to .tar.xz
  - Include patches from QEMU submodule
  - Use config file for configuration
  - Distribute additional permissions on top of GPLv2 ("UBDL")


author: Paolo Bonzini <pbonxini@redhat.com> - 20190125-2.git36a4c85f
changelog:
  - Allow removing IA32 EFI images from combined oproms
  - Check that the ROMs fit in 256K and pad them


author: Cole Robinson <aintdiscole@gmail.com> - 20200823-1.git4bd064de.git
changelog:
  - Update to newer git snapshot, synced with qemu.git
  - Re-enable HTTPS support, with edk2 fix included (bz 1820836)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200823-4.git4bd064de
changelog:
  - ipxe-Skip-some-QEMU-ROMs-when-building-for-RHEL.patch [bz#1956931]
  - ipxe-spec-combine-BIOS-and-EFI-roms-using-util-catrom.pl.patch [bz#1957246]
  - Resolves: bz#1956931
    (ipxe-roms-qemu list: Clean out old ROMs)
  - Resolves: bz#1957246
    (boot vm from pxe failed)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200823-5.git4bd064de
changelog:
  - ipxe-Disable-SHA-1.patch [bz#1935932]
  - ipxe-Replace-genisoimage-with-xorriso.patch [bz#1971981]
  - ipxe-spec-Drop-disabled-efi-ia32-build-infrastructure.patch [bz#1980138]
  - ipxe-spec-Generate-qemu-compatible-rom-filenames.patch [bz#1980138]
  - Resolves: bz#1935932
    (ipxe implements and/or uses the deprecated SHA-1 algorithm by default ()
  - Resolves: bz#1971981
    (Please replace genisoimage with xorriso)
  - Resolves: bz#1980138
    (install qemu rom symlinks so qemu doesn't have to)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200823-6.git4bd064de
changelog:
  - ipxe-Add-ping-command-support.patch [bz#1985658]
  - ipxe-Add-VLAN-tagging-support.patch [bz#1985658]
  - ipxe-netdevice-Strip-802.Q-VLAN-0-priority-tags.patch [bz#1985658]
  - ipxe-Provide-snponly.efi-rom.patch [bz#1985658]
  - ipxe-Build-hwcert-subpackage.patch [bz#1985658]
  - Resolves: bz#1985658
    (carry forward rhel8 ipxe packaging changes)


author: Dams <anvil[AT]livna.org> 0:0.8.9-0.fdr.2
changelog:
  - Fixed changelog typo
  - Added trigger.pl as replace.pl wont be maintained anymore
  - Updated replace.pl to 0.1.4 version
  - Added replace.pl URL in Source tag
  - Removed .packlist files
  - Added as doc a script to convert pref from replace.pl to trigger.pl


author: Dams <anvil[AT]livna.org> - 0.8.10-0.1.rc7
changelog:
  - Dropped patch 2 (seems applied upstream) and 3 (no longer needed)
  - Removed conditionnal build against glib1 parts


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.8.15-8
changelog:
  - Fixed crash that can occur if term is resized during irssi init
    (init-resize-crash-fix patch)
    Resolves: rhbz#796457


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.8.16-0.1.rc1
changelog:
  - New version
  - Dropped init-resize-crash-fix (upstreamed)
  - Fixed bogus date in changelog (best effort)
  - Disabled unloading static modules (by no-static-unload patch)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.8.17-1
changelog:
  - New version
    Resolves: rhbz#1152060
  - Dropped no-static-unload and man-fix patches (both upstreamed)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.8.21-1
changelog:
  - New version
    Resolves: CVE-2017-5193
    Resolves: CVE-2017-5194
    Resolves: CVE-2017-5195
    Resolves: CVE-2017-5196
    Resolves: CVE-2017-5356
  - Dropped CVE-2016-7553 patch (upstreamed)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1.0.4-1
changelog:
  - New version
    Resolves: rhbz#1468785
    Resolves: CVE-2017-10965
    Resolves: CVE-2017-10966
  - Dropped allow-negative-values-in-settings patch (not needed)


author: Hans de Goede <hdegoede@redhat.com> - 6.2.0.872-11
changelog:
  - Fix iscsid autostarting when upgrading from an older version
    (add iscsid.startup key to iscsid.conf on upgrade)
  - Fix printing of [ OK ] when successfully stopping iscsid
  - systemd related fixes:
   - Add Should-Start/Stop tgtd to iscsi init script to fix (re)boot from
     hanging when using locally hosted targets
   - %ghost /var/lock/iscsi and contents (#656605)


author: Hans de Goede <hdegoede@redhat.com> - 6.2.0.872-12
changelog:
  - Change iscsi init scripts to check for networking being actually up, rather
    then for NetworkManager being started (#692230)


author: Mike Christie <mchristi@redhat.com> 6.2.0.872.18
changelog:
  - 789683 Fix boot slow down when the iscsi service is started
    (regression added in 6.2.0.872.16 when the nm wait was added).


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-1
changelog:
  - rebase to new upstream code
  - systemd conversion
  - 565245 Fix multilib issues caused by timestamp in doxygen footers


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-4
changelog:
  - build with libkmod support, instead of calling out to modprobe
  - enable socket activation by default


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-7
changelog:
  - Use the systemd tmpfiles service to recreate lockfiles in /var/lock
  - 955167 build as a position independent executable
  - 894576 fix order of setuid/setgid and drop additional groups


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-10
changelog:
  - sync with upstream git, minor context fixes after rebase of out-of-tree patches
  - iscsiuio is merged upstream, remove old source archive and patches
  - spec cleanups to fix rpmlint issues


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-11
changelog:
  - iscsi boot related fixes
    make sure iscsid gets started if there are any boot sessions running
    add reload target to fix double session problem when restarting from NM
    don't rely on session list passed from initrd, never got fully implemented
    remove patches related to running iscsid from initrd, possible to revisit later


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-16
changelog:
  - fix iscsiuio socket activation
  - have systemd start socket units on iscsiadm use, if not already listening


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-17
changelog:
  - fix regression in glob use, inappropriate error code escape
  - clean up dead node links from discovery when reusing tpgt


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-21
changelog:
  - boot session handling improvements
  - split out iscsiuio into a seperate sub-package
  - sync with new upstream additions
  - revert change to return code when calling login_portal for sessions
    that already exist, as it impacts users scripting around iscsiadm


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-24.gitc9d830b
changelog:
  - sync with upstream v2.0.873-84-gc9d830b
  - ignore iscsiadm return in iscsi.service
  - make sure systemd order against remote mounts is correct
  - add discovery as a valid mode in iscsiadm.8
  - make sure to pass --with-security=no to isns configure


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-25.gitc9d830b
changelog:
  - split out session logout on shutdown to a separate service
  - 985321 roll up libiscsi patches, update python bindings to support python3
  - scriptlets were never split out properly for the iscsiuio subpackage
  - fix regression in network interface binding
  - created iscsi-shutdown.service to ensure that session cleanup happens
  - Add --with-slp=no
  - segfault from unexpected netlink event during discovery
  - inhibit strict aliasing optimizations in iscsiuio, rpmdiff error


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-26.git6aa2c9b
changelog:
  - rebase to upstream snapshot
  - add patch to improve GIL lock performance in libiscsi
  - Split Python 2 and Python 3 bindings out into subpackages


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-28.git6aa2c9b
changelog:
  - fixed broken multiple trigger scripts, removed old pre-systemd migration triggers
  - added libiscsi session API patch (bz #1262279)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 6.2.0.874-7.git86e8892
changelog:
  - Python 2 binary package renamed to python2-iscsi-initiator-utils
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Chris Leech <cleech@redhat.com> - 6.2.0.876-1.git4ef9261
changelog:
  - pull in post 2.0.876 tagged fixes from upstream git
  - minimal packaging of libopeniscsiusr (internal use only, no dev package yet)


author: Chris Leech <cleech@redhat.com> - 6.2.0.876-5.gitf3c8e90
changelog:
  - iscsiuio: add mutex to protect netlink buffer for pass-through xmit
  - iscsid: get gateway information from sysfs when recovering sessions
  - enabled MaxOustandingR2T negotiation during login


author: Chris Leech <cleech@redhat.com> - 6.2.0.878-0.gitd791ce0
changelog:
  - 1761940 iSCSI CHAP authentication not function with FIPS enabled
  - Service file improvements forward ported from RHEL 7.8
  - various static analysis fixes from upstream


author: Chris Leech - 6.2.0.878-5.gitd791ce0
changelog:
  - 1849931, 1869438 go back to MD5 CHAP only by default
    new CHAP modes can cause issue with some targets,
    so SHA1/SHA256/SHA3-256 modes must be configured to enable now


author: Christopher Aillon <caillon@redhat.com> 0.46-2
changelog:
  - The .pc file should be installed in %{_datadir} instead of %{_libdir}
    since this is a noarch package.  64bit platforms will otherwise look in
    the 64bit version of the %{_libdir} and not find the .pc file and 
    cause them to not find iso-codes


author: Matthias Clasen <mclasen@redhat.com> 1.3-1
changelog:
  - Update to 1.3
  - Update the license field
  - Use %find_lang for translations
  - Don't create debuginfo


author: Ville Skyttä <ville.skytta at iki.fi> - 3.3-1
changelog:
  - Update to 3.3.
  - Address minor issues in merge review (#225918): update %description,
    don't use %makeinstall, drop unneeded %debug_package override, use
    parallel build.


author: Jeremy Katz <katzj@redhat.com> - 1:1.0.4-1
changelog:
  - Add man pages from Ryan Finnie (ryan AT finnie DOT org)
  - Use popt in checkisomd5 (Ryan Finnie)
  - Fix verbose/gauge interactions (Ryan Finnie)
  - A few other little janitorial things (Ryan Finnie)


author: Radek Vykydal <rvykydal@redhat.com> - 1:1.0.6-1
changelog:
  - Add abort check feature (#555107) (dpierce, rvykydal)
    Changes prototype of exported checkMediaFile function.
  - Fix exit value of checkisomd5 (rvykydal)
  - Remove output to stderr from library (#576251) (bcl)
  - Use separate return value for image not found (#578160) (bcl)


author: Brian C. Lane <bcl@redhat.com> 1.0.9-1
changelog:
  - Add python-isomd5sum package with python bindings
  - Add callback and interrupt support to the python library
  - Add RPM_OPT_FLAGS to CFLAGS and update makefile to use CFLAGS from environment


author: Brian C. Lane <bcl@redhat.com> 1.0.10-1
changelog:
  - Fix for gcc type-punned and sizeof pointer warnings. (bcl)
  - Add exit code 2 for user abort (#907600) (bcl)
  - Cleanup TABs and update Copyrights (bcl)
  - Standardize *FLAGS in Makefile (ryan)


author: Brian C. Lane <bcl@redhat.com> - 1:1.2.0-1
changelog:
  - New Version 1.2.0 (bcl)
  - Improve the python test and add a test target to the Makefile (bcl)
  - Improve error handling of libimplantisomd5 (squimrel)
  - Fix popt memory leak and avoid exit in main (squimrel)
  - Add derived clang format and editorconfig (squimrel)
  - Format, constify, castify, decl-at-use code (squimrel)
  - Make libimplantisomd5 use the utilities (squimrel)
  - Implement shared utilities (squimrel)
  - Refactor libcheckisomd5 (squimrel)


author: Brian C. Lane <bcl@redhat.com> - 1:1.2.1-1
changelog:
  - New Version 1.2.1 (bcl)
  - Let the user pass their own file descriptor (squimrel)
  - Correct format specifiers (squimrel)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:1.2.1-4
changelog:
  - Python 2 binary package renamed to python2-isomd5sum
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Brian C. Lane <bcl@redhat.com> - 1:1.2.2-1
changelog:
  - Don't put DESTDIR in the isomd5sum.pc file
  - New Version 1.2.2 (bcl)
  - Fix aligned alloc parameters and overflow on 32bit size_t (#1497458) (squimrel)
  - Fix memory leak (squimrel)
  - Add pkgconfig file (squimrel)
  - Remove line-breaks from error messages (squimrel)
  - Make library C++ compatible (squimrel)
  - Constify function signatures (squimrel)
  - Revert checkCallback function signature (squimrel)


author: Brian C. Lane <bcl@redhat.com> - 1:1.2.3-1
changelog:
  - New Version 1.2.3 (bcl)
  - Fix 32bit bug on large files (squimrel)
  - Don't put DESTDIR in the isomd5sum.pc file (bcl)


author: Petr Viktorin <pviktori@redhat.com> - 2.0.2-8
changelog:
  - Be more explicit about Python build dependencies
    (Require python2-devel, tell autotools that PYTHON is python2)


author: Mat Booth <mat.booth@redhat.com> - 2.9.8-1
changelog:
  - Update to latest upstream release, fixes CVE-2018-14718 CVE-2018-147189
    CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 CVE-2018-12022 CVE-2018-12023
    CVE-2018-14720 CVE-2018-14721


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 2.10.0-1
changelog:
  - Update to latest upstream release
  - Fixes: CVE-2019-14540
  - Fixes: CVE-2019-16335
  - Resolves: rhbz#1760274
  - Resolves: rhbz#1760278


author: Mat Booth <mat.booth@redhat.com> - 2.9.3-1
changelog:
  - Update to latest upstream release
  - Obsoletes standalone jaxb-annotations package now provided by this package


author: Red Hat PKI Team <rhcs-maint@redhat.com> - 2.11.4-6
changelog:
  - Drop jackson-module-afterburner, jackson-module-guice, jackson-module-mrbean,
    jackson-module-osgi, jackson-module-paranamer, and jackson-module-javadoc


author: Jie Kang <jkang@redhat.com> - 1.2.1-3
changelog:
  - Remove osgiversion-maven-plugin build requirement
  - Remove javadoc plugin not needed in Fedora builds


author: Guillaume Rousse <guillomovitch@users.sourceforge.net> 1.0-4jpp
changelog:
  - renamed to jakarta-commons-httpclient
  - additional sources in individual archives
  - versioned dir for javadoc
  - no dependencies for javadoc package
  - dropped j2ee package
  - adapted to new jsse package
  - section macro


author: Ville Skyttä <ville.skytta at iki.fi> 2.0-0.20020909alpha1.1jpp
changelog:
  - 2.0alpha1 snapshot 20020909.
  - Use sed instead of bash extensions when symlinking jars during build.
  - Add distribution tag.
  - Require commons-logging instead of log4j.


author: Ville Skyttä <ville.skytta at iki.fi> - 0:2.0-3.rc1.1jpp
changelog:
  - Update to 2.0rc1.
  - Include "jakarta-"-less jar symlinks for consistency with other packages.
  - Exclude example and contrib sources from main package, they're in -demo.


author: Ville Skyttä <ville.skytta at iki.fi> - 0:2.0-3.rc2.1jpp
changelog:
  - Update to 2.0rc2.
  - Manual subpackage.
  - Crosslink with local J2SE javadocs.
  - Own unversioned javadoc dir symlink.


author: Deepak Bhole <dbhole@redhat.com> - 1:3.0-6jpp_1fc
changelog:
  - Added conditional native compilation.
  - Disable certain ssl related tests that are known to fail with libgcj.


author: Marek Goldmann <mgoldman@redhat.com> - 1.11-1
changelog:
  - Upstream release 1.11 RHBZ#962761
  - CVE-2013-2035 HawtJNI: predictable temporary file name leading to local arbitrary code execution RHBZ#962614


author: Marek Goldmann <mgoldman@redhat.com> 1.1-2
changelog:
  - Updated summary
  - Removed debuginfo package
  - Added license to javadoc package
  - Fixed dependency on maven-hawtjni-plugin


author: Marek Goldmann <mgoldman@redhat.com> - 1.4-1
changelog:
  - Upstream release 1.4
  - Fixing "archiver requires 'AM_PROG_AR' in 'configure.ac'" error
  - FTBFS: config.status: error: cannot find input file: `Makefile.in' RHBZ#858377


author: Sean Middleditch <sean@middleditch.us> 1.1.3-2
changelog:
  - Fix Changelog dates.
  - Mix autoheader warning.
  - Added make check.
  - Build and install HTML documentation in -devel package.


author: Xin Long <lxin@redhat.com> - 2.11-3
changelog:
  - Deal with warnings under gcc 8
  - Call va_end after va_copy in json_vsprintf
  - Fix bogus date in jansson.spec


author: Rex Dieter <rdieter[AT]fedoraproject.org> 1.900.1-4
changelog:
  - -libs subpkg to be multilib friendlier
  - -utils subpkg for non-essential binaries jiv, tmrdemo (#244153)


author: Rex Dieter <rdieter@fedoraproject.org> - 1.900.1-13
changelog:
  - CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)
  - CVE-2008-3522 jasper: possible buffer overflow in 
    jas_stream_printf() (#461478)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-18
changelog:
  - CVE-2011-4516, CVE-2011-4517 jasper: heap buffer overflow flaws
    lead to arbitrary code execution (CERT VU#887409) (#765660)
  - Fixed problems found by static analysis of code (#761440)
  - spec file modernized


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-28
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1170650)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-29
changelog:
  - CVE-2014-8137 - double-free in jas_iccattrval_destroy() (oCERT-2014-012) (#1175761)
  - CVE-2014-8138 - heap overflow in jp2_decode() (oCERT-2014-012) (#1175761)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-30
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1184750)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1184750)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-33
changelog:
  - CVE-2015-5203 - double free in jasper_image_stop_load() (#1254244)
  - CVE-2015-5221 - Use-after-free and double-free flaws (#1255714)
  - CVE-2016-1867 - out-of-bounds read in the jpc_pi_nextcprl() function (#1298138)
  - CVE-2016-1577 - double free vulnerability in jas_iccattrval_destroy (#1314468)
  - CVE-2016-2116 - memory leak in jas_iccprof_createfrombuf causing 
  		  memory consumption (#1314473)


author: Dave Airlie <airlied@redhat.com> - 1.900.1-34
changelog:
  - patch 14 is an ABI break, this breaks gnome-software and steam
  - this would require a new revision of the .so to fix properly
  - as sizeof (int) != sizeof (size_t)


author: Josef Ridky <jridky@redhat.com> - 1.900.13-1
changelog:
  - New upstream release 1.900.13 (#1385637)
  - Release contains security fix for CVE-2016-8690, CVE-2016-8691, CVE-2016-8692, CVE-2016-8693 (#1385516)


author: Josef Ridky <jridky@redhat.com> - 2.0.2-1
changelog:
  - New upstream release 2.0.2 (#1395929)
  - CVE-2016-9262 jasper: Multiple overflow vulnerabilities leading to use after free (#1393883)
  - CVE-2016-8654 jasper: Heap-based buffer overflow in QMFB code in JPC codec (#1399168)
  - CVE-2016-9388 jasper: Reachable assertion in RAS encoder/decoder
  - CVE-2016-9389 jasper: Improper equality testing of component domains via assertion
  - CVE-2016-9390 jasper: Assertion failure when tiles lie outside of the image area
  - CVE-2016-9391 jasper: reachable assertions in the JPC bitstream code
  - CVE-2016-9392 jasper: Missing sanity checks on the date in SIZ marker segment
  - CVE-2016-9393 jasper: Missing sanity checks on the date in SIZ marker segment
  - CVE-2016-9394 jasper: Missing sanity checks on the data in a SIZ marker segment
  - CVE-2016-9395 jasper: Assertion failure in jas_seq2d_create
  - CVE-2016-9557 jasper: Signed integer overflow in jas_image.c
  - CVE-2016-9560 jasper: Stack-based buffer overflow in jpc_tsfb.c
  - Upgrade libjasper.so.1* to libjasper.so.4*


author: Josef Ridky <jridky@redhat.com> - 2.0.14-5
changelog:
  - Fix CVE-2021-26927 (#1933860)
  - Fix CVE-2021-26926 (#1922316)
  - Fix CVE-2021-3272 (#1922283)
  - Fix CVE-2020-27828 (#1905692)


author: Omair Majid <omajid@redhat.com> 1:1.8.0.0-0.5.b87
changelog:
  - Update to b87
  - Remove all rhino support; use nashorn instead
  - Remove upstreamed/unapplied patches


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.0-0.11.b89
changelog:
  - prelink dependence excluded also for aaech64
  - arm64 added to jitarches
  - added source100 config.guess to repalce the outdated one in-tree
  - added source101 config.sub  to repalce the outdated one in-tree
  - added patch2011 system-libjpegAARCH64.patch (as aarch64-port is little bit diferent)
  - added patch2031 system-lcmsAARCH64.patch (as aarch64-port is little bit diferent)
  - added gcc-c++ build depndece so builddep will  result to better situation


author: Deepak Bhole <dbhole@redhat.com> - 1:1.8.0.0-0.15.b89
changelog:
  - Added a missing includes patch (#302/%{name}-arm64-missing-includes.patch)
  - Added --disable-precompiled-headers for arm64 build


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.0-0.26.b129
changelog:
  - Add -headless subpackage based on java-1.7.0-openjdk
  - Add abrt connector support
  - Add -accessibility subpackage


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.0-0.31.b132
changelog:
  - updated to rc4 aarch64 tarball
  - outdated removed: patch2031 system-lcmsAARCH64.patch patch2011 system-libjpeg-aarch64.patch
    patch2021 system-libpng-aarch64.patch


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.0-2.b132
changelog:
  - Include version information in desktop files
  - Move desktop files from tarball to top level source


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-11.b12
changelog:
  - backporting old fixes:
  - get rid of jre-abrt, uniquesuffix, parallel install, jsa files,
    config(norepalce) bug, -fstack-protector-strong, OrderWithRequires,
    nss config, multilib arches, provides/requires excludes
  - some additional cosmetic changes


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-12.b12
changelog:
  - bumped release to build by previous release.
  - forcing rebuild by jdk8
  - uncommenting forgotten comment on tzdb link


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-17.b12
changelog:
  - added build requires and requires for headles  _datadir/javazi-1.8/tzdb.dat
  - restriction of tzdata provider, so we will be aware of another possible failure


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-1.b01
changelog:
  - updated to u40-b01
  - adapted  rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
  - adapted  jdk8042159-allow_using_system_installed_lcms2.patch
  - removed patch8 set-active-window.patch
  - removed patch9 javadoc-error-jdk-8029145.patch
  - removed patch10 javadoc-error-jdk-8037484.patch
  - removed patch99 applet-hole.patch - itw 1.5.1 is able to ive without it


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-5.b26
changelog:
  - Update aarch64 hotspot to jdk7u40-b02 to match the rest of the JDK
  - commented out patch2 (obsolated by 666)
  - all ppc64 added to jitarches


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-12.b02
changelog:
  - added patch12,removeSunEcProvider-RH1154143
  - xdump excluded from ppc64le (rh1156151)
  - Add check for src.zip completeness. See RH1130490 (by sgehwolf@redhat.com)
  - Resolves: rhbz#1125260


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-13.b02
changelog:
  - preparing for parallel debug+normal build
  - files and scripelts moved to extendable macros as first step to dual build
  - install and build may be done in loop for both release and slowdebug
  - debugbuild off untill its completed


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-15.b02
changelog:
  - enabled debug packages
  - removed all provides duplicating package name
  - comments about files moved inside files section (to prevent different javadoc postuns)
   - see (RH1160693)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-17.b12
changelog:
  - obsoleted gcj and sindoc. rh1149674 and rh1149675
  - removed backup/restore on images and docs in favor of reconfigure in different directory


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-20.b25
changelog:
  - bumped to b25
  - removed upstreamed patch11 hotspot-build-j-directive.patch
  - policies repacked to stop spamming yum update
  - added and used source20 repackReproduciblePolycies.sh
  - added mehanism to force priority size


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.40-21.b25
changelog:
  - Fix building with gcc 5 by ignoring return-local-addr warning
  - Include additional debugging info for java class files and test that they are
    present


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-24.b25
changelog:
  - added patch501 1182011_JavaPrintApiDoesNotPrintUmlautCharsWithPostscriptOutputCorrectly.patch
  - added patch502 1182694_javaApplicationMenuMisbehave.patch
  - both upstreamed, will be gone with u60


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-30.b13
changelog:
  - updated to security u45
  - removed patch6: disable-doclint-by-default.patch
  - added patch d318d83c4e74.patch
  - added  rhbz1206656_fix_current_stack_pointer.patch
  - renamed PStack-808293.patch -> java-1.8.0-openjdk-PStack-808293.patch
  - renamed remove-intree-libraries.sh -> java-1.8.0-openjdk-remove-intree-libraries.sh
  - renamed to preven conflix with jdk7


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-35.b13
changelog:
  - Omit jsa files from power64 file list as well, as they are never generated
  - moved to boot build by openjdk8
  - Use the template interpreter on ppc64le


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.45-36.b13
changelog:
  - Patch hotspot to not use undefined code rather than passing
    -fno-tree-vrp via CFLAGS.
    Resolves: RHBZ#1208369
  - Add upstream patch for DNS nameserver issue with IPv6 addresses.
    Resolves: RHBZ#1210739


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-37.b13
changelog:
  - added runtime requires for tzdata
  - Remove reference to tz.properties which is no longer used (by gnu.andrew)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-1.b16
changelog:
  - updated to u60b16
  - deleted upstreamed patches:
     patch501 1182011_JavaPrintApiDoesNotPrintUmlautCharsWithPostscriptOutputCorrectly.patch
     patch502 1182694_javaApplicationMenuMisbehave.patch
     patch504 1210739_dns_naming_ipv6_addresses.patch
     patch402 atomic_linux_zero.inline.hpp.patch
     patch401 fix_ZERO_ARCHDEF_ppc.patch
     patch400 ppc_stack_overflow_fix.patch
     patch204 zero-interpreter-fix.patch
  - added Patch506 gif4.1.patch to allow build agaisnt giflib > 4.1


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-2.b16
changelog:
  - Patch503 d318d83c4e74.patch, patch505 1208369_memory_leak_gcc5.patch (and patch506 gif4.1.patch)
     moved out of "if with_systemtap" block


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-2.b24
changelog:
  - updated to security u60-b24
  - moved to openjdk instead of jdk8 topdir in sources
  - removed upstreamed patch99 java-1.8.0-openjdk-linux-4.x.patch
  - removed upstreamed patch503 pr2444.patch
  - removed upstreamed patch505 1208369_memory_leak_gcc5.patch
  - removed upstreamed patch506: gif4.1.patch
   - note: usptream version is suspicious
    GIFLIB_MAJOR >= 5 SplashStreamGifInputFunc, NULL
    ELSE SplashStreamGifInputFunc
   - but the condition seems to be viceversa


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-3.b24
changelog:
  - added one more md5sum test (thanx to Severin!)
   - I guess one more missing
  - doubled slash in md5sum test in post


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-14.b24
changelog:
  - updated aarch64 tarball to contain whole forest of latest jdk8-aarch64-jdk8u60-b24.2.tar.xz
  - using this forest instead of only hotspot
  - generate_source_tarball.sh - temporarily excluded repos="hotspot" compression of download
  - not only openjdk/hotspot is replaced, by wholeopenjdk
  - ln -s openjdk jdk8 done after replacing of openjdk
  - patches 9999 601 and 602 exclded for aarch64


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.60-15.b28
changelog:
  - moved to single source integration forest
  - removed patch patch9999 enableArm64.patch
  - removed patch patch600  %{name}-rh1191652-hotspot.patch


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-2.b17
changelog:
  - added and applied patch605 soundFontPatch.patch as repalcement for removed sound font links
  - removed hardcoded soundfont links


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-7.b17
changelog:
  - changed way of generating the sources. As result:
  - "updated" to aarch64-jdk8u65-b17 (from aarch64-port/jdk8u60)
  - used aarch64-port-jdk8u60-aarch64-jdk8u65-b17.tar.xz as new sources


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-8.b17
changelog:
  - used extracted lua scripts.
  - now depnding on copy-jdk-configs
  - config files persisting in pre instead of %pretrans


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-9.b17
changelog:
  - extracted lua scripts moved from pre where they don't work to pretrans
  - requirement on copy-jdk-configs made Week.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-11.b17
changelog:
  - Define our own optimisation flags based on the optflags macro and pass to OpenJDK build cflags/cxxflags.
  - Remove -fno-devirtualize as we are now on GCC 5 where the GCC bug it worked around is fixed.
  - Pass __global_ldflags to --with-extra-ldflags so Fedora linker flags are used in the build.
  - Also Pass ourcppflags to the OpenJDK build cflags as it wrongly uses them for the HotSpot C++ build.
  - Add PR2428, PR2462 & S8143855 patches to fix build issues that arise.
  - Resolves: rhbz#1283949
  - Resolves: rhbz#1120792


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-12.b17
changelog:
  -removed patch4 java-1.8.0-openjdk-PStack-808293.patch
  -removed patch13 libjpeg-turbo-1.4-compat.patch


author: jvanek <jvanek@redhat.com> - 1:1.8.0.72-1.b15
changelog:
  - updated to aarch64-jdk8u72-b15 (from aarch64-port/jdk8u)
  - used aarch64-port-jdk8u-aarch64-jdk8u72-b15.tar.xz as new sources
  - removed already upstreamed patch501 8146566.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-5.b15
changelog:
  - Explicitly set the C++ standard to use, as the default has changed to C++ 2014 in GCC 6.
  - Turn off -Werror due to format warnings in HotSpot and -std usage warnings in SCTP.
  - Run tests under the check stage and use the debug build first.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.72-5.b15
changelog:
  - Add -fno-delete-null-pointer-checks -fno-guess-branch-probability flags to resolve x86/x86_64 crash.


author: jvanek <jvanek@redhat.com> - 1:1.8.0.72-10.b15
changelog:
  - returning accidentlay removed hunk from renamed and so wrongly merged remove_aarch64_jvm.cfg_divergence.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-11.b15
changelog:
  - Add patches to allow the SunEC provider to be built with the system NSS install.
  - Re-generate source tarball so it includes ecc_impl.h.
  - Adjust tarball generation script to allow ecc_impl.h to be included.
  - Bring over NSS changes from java-1.7.0-openjdk spec file (NSS_CFLAGS/NSS_LIBS)
  - Remove patch which disables the SunEC provider as it is now usable.
  - Correct spelling mistakes in tarball generation script.
  - Move completely unrelated AArch64 gcc 6 patch into separate file.
  - Resolves: rhbz#1019554 (fedora bug)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-5.b16
changelog:
  - Fix regression introduced on s390 by large code cache change.
  - Update to u72b16.
  - Drop 8147805 and jvm.cfg fix which are applied upstream.


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.72-12.b15
changelog:
  - Use a simple backport for PR2462/8074839.
  - Don't backport the crc check for pack.gz. It's not tested well upstream.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-2.b03
changelog:
  - Avoid WithSeed versions of NSS functions as they do not fully process the seed
  - List current java.security md5sum so that java.security is replaced and ECC gets enabled.
  - Resolves: rhbz#1245810


author: jvanek <jvanek@redhat.com> - 1:1.8.0.77-2.b03
changelog:
  - added patch400  jdk8-archivedJavadoc.patch
  - added javadoc-zip(-debug) subpackage with compressed javadoc


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Use basename of test file to avoid misinterpretation of full path as a package
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Enable a full bootstrap on JIT archs. Full build held back by Zero archs anyway.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Add 8132051 port to Zero.
  - Turn on bootstrap build for all to ensure we are now good to go.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Revert settings to production defaults so we can at least get a build.
  - Switch to a slowdebug build to try and unearth remaining issue on s390x.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Turn off -Werror so s390 can build in slowdebug mode.
  - Add fix for formatting issue found by previous s390 build.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Temporarily remove power64 from JIT arches to see if endian issue appears on Zero.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Add additional fix to Zero patch to properly handle result on 64-bit big-endian
  - Revert debugging options (aarch64 back to JIT, product build, no -Wno-error)
  - Enable full bootstrap on all architectures to check we are good to go.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Roll back release number as release 1 never succeeded, even with tests disabled.
  - Resolves: rhbz#1325423


author: jvanek <jvanek@redhat.com> - 1:1.8.0.91-4.b14
changelog:
  - updated to aarch64-shenandoah-jdk8u71-b15-beta02 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u71-b15-beta02.tar.xz as new sources for hotspot
  - reverted  nss version fix


author: jvanek <jvanek@redhat.com> - 1:1.8.0.91-6.b14
changelog:
  - Enable weak reference discovery in ShenandoahMarkCompact. Otherwise we never process any weak references in full-gc.


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.92-1.b14
changelog:
  - updated to u92
  - removed upstreamed patches 8132051-aarch64.patch, 8143855.patch, criticalShenandoahFix.patch, rhbz1206656_fix_current_stack_pointer.patch
  - 8132051-zero.patch, remove_aarch64_template_for_gcc6.patch
  - jdwpCrash.abrt.patch renamed to 8044762-pr2960.patch
  - httpsFix1329342.patch renamed to pr2934-sunec_provider_throwing_keyexception_withine.separator_current_nss_thus_initialise_the_random_number_generator_and_feed_the_seed_to_it.patch
  - added known regresisonos fixes for u92 scheduled for next u (519-525)


author: jvanek <jvanek@redhat.com> - 1:1.8.0.101-1.b14
changelog:
  - updated to aarch64-jdk8u101-b14 (from aarch64-port/jdk8u)
  - updated to aarch64-shenandoah-jdk8u101-b14-shenandoah-merge-2016-07-25 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-aarch64-jdk8u101-b14.tar.xz as new sources
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u101-b14-shenandoah-merge-2016-07-25.tar.xz as new sources for hotspot
  - priority lowered for ine zero digit, tip moved to 999
  - added jdk6260348-pr3066-gtk_laf_jtextcomponent_not_respecting_desktop_caret_blink_rate.patch, pr3083-rh1346460-for_ssl_debug_return_null_instead_of_exception_when_theres_no_ecc_provider.patch, 8159244-pr3074.patch, corba_typo_fix.patch
  renamed: jdk8-archivedJavadoc.patch -> jdk8154313-generated_javadoc_scattered_all_over_the_place.patch, pr2991-rh1341258.patch -> 8158260-pr2991-rh1341258.patch
  - not added 8147771-additional_hunk.patch, already in b14


author: jvanek <jvanek@redhat.com> - 1:1.8.0.101-2.b14
changelog:
  - added patch532 hotspot-1358661.patch - to fix performance of bimorphic inlining may be bypassed by type speculation
  - added patch301 bz1204159_java8.patch - to fix systemtap on multiple jdks


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-3.b14
changelog:
  - Replace patch for S8162384 with upstream version. Document correctly along with SystemTap RH1204159 patch.
  - Resolves: rhbz#1358661
  - Replace patch for S8157306 with upstream version, documented & applied on all archs with conditional in patch
  - Resolves: rhbz#1360863


author: jvanek <jvanek@redhat.com> - 1:1.8.0.102-1.b14
changelog:
  - updated to aarch64-jdk8u102-b14 (from aarch64-port/jdk8u)
  - updated to aarch64-shenandoah-jdk8u102-b14 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-aarch64-jdk8u102-b14.tar.xz as new sources
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u102-b14.tar.xz as new sources for hotspot
  - removed upstreamed patches 519, 520 and 605
  - updated to systemtap 3, removed related patches 300 and 301
  - jjs provides moved to headless


author: jvanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - @prefix@ in tapsetfiles substitued by prefix as necessary to work with systemtap3 (rhbz1371005)


author: jvanek <jvanek@redhat.com> - 1:1.8.0.111-1.b16
changelog:
  - updated to aarch64-jdk8u111-b16 (from aarch64-port/jdk8u)
  - updated to aarch64-shenandoah-jdk8u111-b16 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-aarch64-jdk8u111-b16.tar.xz as new sources
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u111-b16.tar.xz as new sources for hotspot
  - adapted patches


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.111-2.b16
changelog:
  - added dont-add-unnecessary-debug-links.patch
  - added hotspot-assembler-debuginfo.patch
  - returned accidentally removed  hotspot-remove-debuglink.patch
  - eu-readelfs on libraries improved, added gdb call


author: jvanek <jvanek@redhat.com - 1:1.8.0.111-3.b16
changelog:
  - added patch207 - PR3183.patch
  - java SSL/TLS implementation: should follow the policies of system-wide crypto policy


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-1.b14
changelog:
  - updated to aarch64-jdk8u121-b14 (from openjdk8-forests/latest-aarch64)
  - updated to aarch64-shenandoah-jdk8u121-b14 (from openjdk8-forests/latest-shenandoah) of hotspot
  - used openjdk8-forests-latest-aarch64-aarch64-jdk8u121-b14.tar.xz as new sources
  - used openjdk8-forests-latest-shenandoah-aarch64-shenandoah-jdk8u121-b14.tar.xz as new sources for hotspot
  - deleted:    8044762-pr2960.patch 8049226-pr2960.patch 8154210.patch 8158260-pr2991-rh1341258.patch 8159244-pr3074.patch
  - adapted java-1.8.0-openjdk-size_t.patch pr1834-rh1022017-reduce_ellipticcurvesextension_to_provide_only_three_nss_supported_nist_curves_23_24_25.patch rh1163501-increase_2048_bit_dh_upper_bound_fedora_infrastructure_in_dhparametergenerator.patch
  - updated from internal (rhel) repo  OPENJDK_URL_DEFAULT=ssh://t...redhat.com//...ty/
  - with custom PR2126=/.../pr2126.patch (removed newly added brainpool curves)
  - withspecial values of PROJECT_NAME="openjdk8-forests", REPO_NAME="latest-aarch64"
  - with correct tag VERSION="aarch64-jdk8u121-b14"
  - and for shenandoah hotspot used custom repo REPO_NAME=latest-shenandoah
  - with correct tag VERSION="aarch64-shenandoah-jdk8u121-b14"
  - complete changes to  generate_source_tarball.sh  update_package.sh NOT commited (willbe regenerated from official repos soon)


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-2.b14
changelog:
  - revertrd patch535, excludeECDHE-1415137.patch and related changes
  - issue casued by nss, see rhbz#1415137 c#35


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-5.b14
changelog:
  - patch 536 reordered to 537
  - added patch 536 - Backport "8170888: [linux] Experimental support for cgroup memory limits in container (ie Docker) environments"
  - added patch 538 - 1423421: Javadoc crashes when method name ends with "Property"
  - rhbz#1423751 - added -fno-split-loops worakround sigsew when building with GCC7 (probably bug in jdk's JIT )


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-7.b14
changelog:
  - fixed the config(noreplace) issue with various left files lke java.security (rhbz#1183793)
  - by calling new c-j-c hooks
  - removed self-tail-bitting check check_sum_presented_in_spec
  - release 6+7 to verify update path


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-9.b14
changelog:
  - updated to latest stable shenandoah hotspot
  - updated to properly tagged upstream forest (no update, just rename)
  - fixed update package to verify PR2126 patch and work with sha512


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-11.b14
changelog:
  - sync from rhel, reordered patches, enabled shenanoah on aarch64
  - Patch OpenJDK to check the system cacerts database directly
  - Remove unneeded symlink to the system cacerts database
  - Drop outdated openssl dependency from when the RPM built the cacerts database
  - udpated to latest stable shenandoah hotspot


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-1.b12
changelog:
  - updated to aarch64-jdk8u131-b12 (from aarch64-port/jdk8u)
  - updated to aarch64-shenandoah-jdk8u131-b12-shenandoah-merge-2017-04-20 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-aarch64-jdk8u131-b12.tar.xz as new sources
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u131-b12-shenandoah-merge-2017-04-20.tar.xz as new sources for hotspot


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-3.b12
changelog:
  - source999 moved to source1
  - added two pathces 8181055-pr3394-rh1448880.patch and 8175813/PR3394/RH1448880
  - enabled (commented out) system NSS via patch1000, rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.144-1.b01
changelog:
  - Update to aarch64-jdk8u144-b01 and aarch64-shenandoah-jdk8u144-b01.
  - Exclude 8175887 from Shenandoah builds as it has been included in that repo.
  - Added 8164293-pr3412-rh1459641.patch backport from 8u development tree
  - get rid of bin/* and lib/*, fixed rhbz1480777
  - adapted to rpm 4.14: all expanding macros changed to define, all %1 and %1 replaced by %{?1}, all expandable macros parameter preffixed by --
  - get rid of generated filelists all except javafx and demos


author: jvanek <jvanek@redhat.com> - 1:1.8.0.144-7.b01
changelog:
  - updated to aarch64-shenandoah-jdk8u144-b02-shenandoah-merge-2017-10-02 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u144-b02-shenandoah-merge-2017-10-02.tar.xz as new sources for hotspot


author: jvanek <jvanek@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - updated to aarch64-jdk8u151-b12 (from aarch64-port/jdk8u)
  - updated to aarch64-shenandoah-jdk8u151-b12 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-aarch64-jdk8u151-b12.tar.xz as new sources
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u151-b12.tar.xz as new sources for hotspot
  - tapset updated to 3.6pre02
  - policies adapted to new limited/unlimited schmea
  - above acomapnied by c-j-c 3.3
  - alligned patches and added PPC ones (thanx to gnu_andrew)
  - added patch209: 8035496-hotspot.patch
  - added patch210: suse_linuxfilestore.patch


author: jvanek <jvanek@redhat.com> - 1:1.8.0.161-0.b14
changelog:
  - updated to u161, rmeoved upstreamed patches
  - removed patch555 8164293-pr3412-rh1459641.patch
  - removed patch550 8175813-pr3394-rh1448880.patch
  - removed patch547 8173941-pr3326.patch
  - removed patch532 8162384-pr3122-rh1358661.patch
  - removed patch535 8153711-pr3313-rh1284948.patch
  - removed patch561 8075484-pr3473-rh1490713.patch
  - removed patch554 8175887-pr3415.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-1.b12
changelog:
  - Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
  - Remove upstreamed patches for 8181055/PR3394/RH1448880,
  -  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
  -  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
  -  8181810/PR3466/RH1498319.


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Update to aarch64-jdk8u171-b10 and aarch64-shenandoah-jdk8u171-b10.
  - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550) (gnu_andrew)
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones (gnu_andrew)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-6.b10
changelog:
  - aligning with java-openjdk in fedora:
  - removed fx binding
  - config files to etc
  - slowdebug instead simply debug subpackage
  - purged provides
  - many macros renamed
  - typos correction
  - bumped jstack (may be wrong)


author: Jiri Vanek <jvanek@redhat.com> - 1:10.0.1.10-7
changelog:
  - quoted sed expressions, changed possibly confussing # by @
  - added vendor(origin) into icons
  - removed last trace of relative symlinks
  - added BuildRequires of javapackages-tools to fix build failure after Requires change to javapackages-filesystem


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.172-1.b11
changelog:
  - updated to u172-b11
  - removed patches:
  - patch207 8200556-pr3566.patch
  - patch104 pr3458-rh1540242.patch
  - patch209 8035496-hotspot.patch
  - patch700 pr3573-fix_TCK_crash_with_shenandoah_in_shenandoahsupport_cpp_in_case_of_dead_brnach_in_is_independent.patch
  - fixed issue with atkwrapper wrongly palced broken symlink
  - fixed libjvm path for system tap
  - returned patch104 pr3458-rh1540242.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-5.b11
changelog:
  - Sync with IcedTea 3.8.0.
  - Label architecture-specific fixes with architecture concerned
  - x86: S8199936, PR3533: HotSpot generates code with unaligned stack, crashes on SSE operations (-mstackrealign workaround)
  - PR3539, RH1548475: Pass EXTRA_LDFLAGS to HotSpot build
  - 8171000, PR3542, RH1402819: Robot.createScreenCapture() crashes in wayland mode
  - 8197546, PR3542, RH1402819: Fix for 8171000 breaks Solaris + Linux builds
  - 8185723, PR3553: Zero: segfaults on Power PC 32-bit
  - 8186461, PR3557: Zero's atomic_copy64() should use SPE instructions on linux-powerpcspe
  - PR3559: Use ldrexd for atomic reads on ARMv7.
  - 8187577, PR3578: JVM crash during gc doing concurrent marking
  - 8201509, PR3579: Zero: S390 31bit atomic_copy64 inline assembler is wrong
  - 8165489, PR3589: Missing G1 barrier in Unsafe_GetObjectVolatile
  - PR3591: Fix for bug 3533 doesn't add -mstackrealign to JDK code
  - 8184309, PR3596: Build warnings from GCC 7.1 on Fedora 26


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-5.b11
changelog:
  - Update Shenandoah tarball to include 2018-05-15 merge.
  - Split PR3458/RH1540242 fix into AArch64 & Zero sections, so former can be skipped on Shenandoah builds.
  - Drop PR3573 patch applied upstream.
  - Restrict 8187577 fix to non-Shenandoah builds, as it's included in the new tarball.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-6.b11
changelog:
  - Remove build flags exemption for aarch64 now the platform is more mature and can bootstrap OpenJDK with these flags.
  - Remove duplicate -fstack-protector-strong; it is provided by the RHEL cflags.
  - Add missing changelog credits


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-11.b11
changelog:
  - Add additional fix (PR3601) to fix -Wreturn-type failures introduced by 8061651
  - Backport 8064786 (PR3601) to fix -Wreturn-type failure on debug builds.
  - Bring in PR3519 from IcedTea 3.7.0 to fix remaining -Wreturn-type failure on AArch64.
  - Sync with IcedTea 3.8.0 patches to use -Wreturn-type.
  - Add backports of 8141570, 8143245, 8197981 & 8062808.
  - Drop pr3458-rh1540242-zero.patch which is covered by 8143245.


author: Jiri Vanek <jvanek@redhat.com> - 11:1.8.0.172-16.b11
changelog:
  - added Recommends gtk2 for main package
  - added Suggests lksctp-tools, pcsc-lite-devel, cups for headless package
  - see RHBZ1598152


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-0.b03
changelog:
  - Update to aarch64-jdk8u181-b03 and aarch64-shenandoah-jdk8u181-b03.
  - Remove AArch64 patch for PR3458/RH1540242 as applied upstream.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-4.b04
changelog:
  - Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-5.b04
changelog:
  - Add "8146115, PR3508, RH1463098: Improve docker container detection and resource configuration usage"


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-6.b13
changelog:
  - Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13.
  - Remove 8187577/PR3578 now applied upstream.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b13-8
changelog:
  - Adjust system NSS patch, pr1983-rh1565658-support_using_the_system_installation_of_nss_with_the_sunec_provider_jdk8.patch, so as to filter
    -Wl,--as-needed. Resolves RHBZ#1622186.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b13-9
changelog:
  - Adjust system jpeg patch, jdk8043805-allow_using_system_installed_libjpeg.patch, so as to filter
    -Wl,--as-needed. Resolves RHBZ#1622186.
  - Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.181.b15-1
changelog:
  - fixed unexpanded arch in policy tool desktop file
  - fixed versions (8->1.8.0) of images used in desktop files
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-2
changelog:
  - Update(s) from upstreamed patches:
    - 8036003-dont-add-unnecessary-debug-links.patch =>
      jdk8036003-add_with_native_debug_symbols_configure_flag.patch
    - rh1176206-jdk.patch =>
      jdk8150954-pr2866-rh1176206-screenshot_xcomposite_jdk.patch =>
      Deleted rh1176206-root.patch as thats no longer needed with
      upstream 8150954.
    - Refreshed jdk8165852-pr3468-mount_point_not_found_for_a_file_which_is_present_in_overlayfs.patch from upstream.
    - Refreshed jdk8201495-zero_reduce_limits_of_max_heap_size_for_boot_JDK_on_s390.patch from upstream.
    - 8207057-pr3613-hotspot-assembler-debuginfo.patch =>
      jdk8207057-pr3613-no_debug_info_for_assembler_files_hotspot.patch and
      jdk8207057-pr3613-no_debug_info_for_assembler_files_root.patch. From JDK 8u
      review.
  - Renamed pr2842-02.patch => jdk8148351-pr2842-02-only_display_resolved_symlink_for_compiler_do_not_change_path.patch.
  - Renamed spec-only patch:
    pr3183.patch => pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
  - Renamed java-1.8.0-openjdk-size_t.patch =>
    jdk8201495-zero_reduce_limits_of_max_heap_size_for_boot_JDK_on_s390.patch
  - Moved SunEC provider via system NSS to RPM specific patches section.
  - Moved upstream 8u patches to appropriate sections (8u192/8u202).
  - Removed rh1214835.patch since it's invalid. See:
    https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2304#c3
  - Use --with-native-debug-symbols=internal which JDK-8036003 adds.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-3
changelog:
  - Renamed more patches for clarity:
    include-all-srcs.patch => jdk8044235-src_zip_should_include_all_sources.patch
    java-1.8.0-openjdk-rh1191652-hotspot-aarch64.patch => jdk8073139-pr2236-rh1191652--use_ppc64le_as_the_arch_directory_on_that_platform_and_report_it_in_os_arch_aarch64_forest.patch
    java-1.8.0-openjdk-rh1191652-jdk.patch => jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_jdk.patch
    java-1.8.0-openjdk-rh1191652-root.patch => jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_root.patch
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-4
changelog:
  - Add fixes for optimization gaps (annocheck issues):
    - 8210761: libjsig is being compiled without optimization
    - 8210647: libsaproc is being compiled without optimization
    - 8210416: [linux] Poor StrictMath performance due to non-optimized compilation
    - 8210425: [x86] sharedRuntimeTrig/sharedRuntimeTrans compiled without optimization
               8u upstream and aarch64/jdk8u upstream versions.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-5
changelog:
  - Add explicit requirement for libXcomposite which is used when performing
    screenshots from Java.
  - Add explicit BR unzip required for building OpenJDK.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
  - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
  - Update to aarch64-shenandoah-jdk8u181-b15.
  - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
  - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
  - Update pr3539-rh1548475.patch to apply after 8187045.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
  - Update to aarch64-shenandoah-jdk8u181-b16.
  - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b10.
  - Drop 8146115/PR3508/RH1463098 applied upstream.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-6
changelog:
  - Refreshed upstreamed patches (from 8u202):
    - jdk8044235-src_zip_should_include_all_sources.patch: src.zip should include all sources.
    - jdk8073139-pr2236-rh1191652--use_ppc64le_as_the_arch_directory_on_that_platform_and_report_it_in_os_arch_aarch64_forest.patch,
      jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_jdk.patch,
      jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_root.patch: PPC64LE JVM reporting issues.
  - Moved both patch series to 8u202 sections.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.181.b15-7
changelog:
  - Add patch jdk8210425-rh1632174-03-compile_with_o2_and_ffp_contract_off_as_for_fdlibm_zero.patch:
    - Annother fix for optimization gaps (annocheck issues)
    - Zero 8u version fix was missing. Hence, only shows up on Zero arches.
  - Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-1
changelog:
  - updated to aarch64-shenandoah-jdk8u191-b12
  - deleted 8146115-pr3508-rh1463098.patch, pr3619.patch, pr3620.patch - should be upstreamed
  - create pr3634-fix_shenandoah_for_size_t_on_s390.patch to fix build failure on s390
  - Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-8
changelog:
  - added Patch583 jdk8172850-rh1640127-01-register_allocator_crash.patch
  - added Patch584 jdk8209639-rh1640127-02-coalesce_attempted_spill_non_spillable.patch
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-9
changelog:
  - Fix patch organisation in the spec file:
  -   * Move ECC patches back to upstreamable section
  -   * Move system cacerts & crypto policy patches to upstreamable section
  -   * Merge "Local fixes" and "RPM fixes" which amount to the same thing
  -   * Move system libpng & lcms patches back to 8u upstreamable section
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-9
changelog:
  - Note why PR1834/RH1022017 is not suitable to go upstream in its current form.
  - Resolves: rhbz#1661577


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-12
changelog:
  - Add backport of JDK-8029661 which adds TLSv1.2 support to the PKCS11 provider.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b13-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b13.
  - Update tarball generation script in preparation for PR3667/RH1656676 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b14.
  - Adjust JDK-8073139/PR1758/RH1191652 to apply following 8155627 backport.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-0
changelog:
  - Introduce sa_arches for architectures with sa-jdi.jar and include aarch64
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-1
changelog:
  - Add 8131048 & 8164920 (PR3574/RH1498936) to provide a CRC32 intrinsic for PPC64.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-0
changelog:
  - Update to aarch64-shenandoah-jdk8u192-b12.
  - Remove patches included upstream
    - JDK-8031668/PR2842
    - JDK-8148351/PR2842
    - JDK-6260348/PR3066
    - JDK-8061305/PR3335/RH1423421
    - JDK-8188030/PR3459/RH1484079
    - JDK-8205104/PR3539/RH1548475
    - JDK-8185723/PR3553
    - JDK-8186461/PR3557
    - JDK-8201509/PR3579
    - JDK-8075942/PR3602
    - JDK-8203182/PR3603
    - JDK-8206406/PR3610/RH1597825
    - JDK-8206425
    - JDK-8036003
    - JDK-8201495/PR2415
    - JDK-8150954/PR2866/RH1176206
  - Re-generate patches (mostly due to upstream build changes)
    - JDK-8073139/PR1758/RH1191652
    - JDK-8143245/PR3548 (due to JDK-8202600)
    - JDK-8197429/PR3546/RH1536622 (due to JDK-8189170)
    - JDK-8199936/PR3533
    - JDK-8199936/PR3591
    - JDK-8207057/PR3613
    - JDK-8210761/RH1632174 (due to JDK-8207402)
    - PR3559 (due to JDK-8185723/JDK-8186461/JDK-8201509)
    - PR3593 (due to JDK-8081202)
    - RH1566890/CVE-2018-3639 (due to JDK-8189170)
    - RH1649664 (due to JDK-8196516)
  - Add 8160748 for AArch64 which is missing from upstream 8u version.
  - Add port of 8189170 to AArch64 which is missing from upstream 8u version.
  - Resolves: rhbz#1661577


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b09-1
changelog:
  - Add backport of JDK-8145096 (PR3693) to fix undefined behaviour issues on newer GCCs
  - Resolves: rhbz#1661577


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.201.b09-5
changelog:
  - Update patch for RH1566890.
    - Renamed rh1566890_speculative_store_bypass_so_added_more_per_task_speculation_control_CVE_2018_3639 to
      rh1566890-CVE_2018_3639-speculative_store_bypass.patch
    - Added dependent patch,
      rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b13-1
changelog:
  - Update to aarch64-shenandoah-jdk8u201-b13.
  - Drop JDK-8160748 & JDK-8189170 AArch64 patches now applied upstream.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.202.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u202-b08.
  - Remove patches included upstream
    - JDK-8211387/PR3559
    - JDK-8207057/PR3613
    - JDK-8165852/PR3468
    - JDK-8073139/PR1758/RH1191652
    - JDK-8044235
    - JDK-8172850/RH1640127
    - JDK-8209639/RH1640127
    - JDK-8131048/PR3574/RH1498936
    - JDK-8164920/PR3574/RH1498936
  - Re-generate patches
    - JDK-8210647/RH1632174
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-1
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b02.
  - Remove patches included upstream
    - JDK-8197429/PR3546/RH153662{2,3}
    - JDK-8184309/PR3596
    - JDK-8210647/RH1632174
    - JDK-8029661/PR3642/RH1477159
    - JDK-8145096/PR3693
  - Re-generate patches
    - JDK-8203030
  - Add casts to resolve s390 ambiguity in calls to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-2
changelog:
  - Add JDK-8223219 to avoid -fstack-protector overriding -fstack-protector-strong
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-3
changelog:
  - Remove additions to EXTRA_CFLAGS and EXTRA_CPP_FLAGS which are now made by upstream.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-4
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b04-shenandoah-merge-2019-04-30.
  - Update version logic to handle -shenandoah* tag suffix.
  - Drop PR3634 as applied upstream.
  - Adjust 8214206 fix for S390 as BinaryMagnitudeSeq moved to shenandoahNumberSeq.cpp
  - Update 8214206 to use log2_long rather than casting to intptr_t, which may be smaller than size_t.
  - Resolves: rhbz#1688365
  - Resolves: rhbz#1688382


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-5
changelog:
  - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
  - Drop unused use_shenandoah_hotspot variable.
  - Resolves: rhbz#1724452


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.212.b04-5
changelog:
  - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
  - Don't perform a bootcycle build for the debug variant build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-5
changelog:
  - Obsolete javadoc-debug and javadoc-debug-zip packages via javadoc and javadoc-zip respectively.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b01.
  - Refactor PR2888 after inclusion of 8129988 upstream. Now includes PR3575.
  - Drop 8171000 & 8197546 as applied upstream.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - Drop unnecessary build requirement on gtk2-devel, as OpenJDK searches for Gtk+ at runtime.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - Add missing build requirements for libXext-devel and libXrender-devel, previously masked by Gtk2+ dependency.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - fontconfig build requirement should be fontconfig-devel, previously masked by Gtk2+ dependency
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b02.
  - Drop 8064786/PR3599 & 8210416/RH1632174 as applied upstream (8064786 silently in 8176100).
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b03.
  - Drop 8210425 patches applied upstream. Still need to add AArch64 version in aarch64/shenandoah-jdk8u.
  - Re-generate JDK-8141570 & JDK-8143245 patches due to 8210425 zeroshark.make changes.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b04.
  - Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b07-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b08-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b08.
  - Adjust PR3083/RH134640 to apply after JDK-8182999
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b10-2
changelog:
  - Backport FIPS mode patch to java-1.8.0-openjdk, simplifying provider removal.
  - Resolves: rhbz#1655466


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b10-2
changelog:
  - nss.fips.cfg needs to be moved to %{etcjavadir} and symlinked into the JDK, like nss.cfg
  - Resolves: rhbz#1655466


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b10-3
changelog:
  - SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file.
  - Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg.
  - Resolves: rhbz#1750752


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b01.
  - Switch to EA mode.
  - Drop JDK-8210761/RH1632174 as now upstream.
  - Drop JDK-8223219 as now upstream.
  - JDK-8226870 removed clhsdb and hdsdb from the JRE bin directory, so we should do likewise.
  - Add alternatives support for these two new SDK binaries.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05.
  - Drop upstreamed patch JDK-8141570/PR3548.
  - Adjust context of JDK-8143245/PR3548 to apply against upstream JDK-8141570.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-1
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b09.
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-4
changelog:
  - Remove CVE-2018-3639 mitigation due to performance regression and
      OpenJDK position on speculative execution vulnerabilities.
      https://mail.openjdk.java.net/pipermail/vuln-announce/2019-July/000002.html
  - Resolves: rhbz#1750419


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-5
changelog:
  - Revert SSBD removal for now, until appropriate messaging has been decided.
  - Resolves: rhbz#1750419


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-6
changelog:
  - Update generate_source_tarball.sh script to use the PR3756 patch and retain the secp256k1 curve.
  - Regenerate source tarball using the updated script and add the -'4curve' suffix.
  - Resolves: rhbz#1746879


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b05.
  - Attempt to fix Shenandoah formatting failures on S390, introduced by JDK-8232102.
  - Revise b05 snapshot to include JDK-8236178.
  - Add additional Shenandoah formatting fixes revealed by successful -Wno-error=format run
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b07.
  - Switch to GA mode for final release.
  - Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b08.
  - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions.
  - Resolves: rhbz#1785753


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-2
changelog:
  - Sync SystemTap & desktop files with upstream IcedTea release 3.11.0 using new script
  - Resolves: rhbz#1737112


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-2
changelog:
  - Sync SystemTap & desktop files with upstream IcedTea release 3.15.0, removing previous workarounds
  - Resolves: rhbz#1737112


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-3
changelog:
  - Add JDK-8165996/PR3506 & JDK-8195607/PR3776 to support NSS SQLite databases.
  - Resolves: rhbz#1760437


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-4
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Resolves: rhbz#1737112


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b01.
  - Switch to EA mode.
  - Adjust JDK-8199936/PR3533 patch following JDK-8227397 configure change
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b03.
  - Adjust PR2974/RH1337583 & PR3083/RH1346460 following context changes in JDK-8230978
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-1
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-5
changelog:
  - Add support for fastdebug builds on x86_64 only.
  - Drop redundant slowdebug/debug sed invocation on the docs zip filename as it is only now built for non-debug.
  - Resolves: rhbz#1836067


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-7
changelog:
  - Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable).
  - Resolves: rhbz#1655466


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b01.
  - Switch to EA mode.
  - Adjust JDK-8143245/PR3548 patch following context changes due to JDK-8203287 for JFR
  - Adjust RH1648644 following context changes due to introduction of JFR packages
  - Add jfr binary to devel package and alternatives set
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b02-0.2.ea
changelog:
  - Enable JFR in our builds, ahead of upstream default.
  - Only enable JFR for JIT builds, as it is not supported with Zero.
  - Turn off JFR on x86 for now due to assert(SerializePageShiftCount == count) crash.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b02-0.2.ea
changelog:
  - Introduce jfr_arches for architectures which support JFR.
  - Fix path to jfr.jar.
  - Use sa_arches for libsaproc.so inclusion.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b05-0.2.ea
changelog:
  - Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY
  - Resolves: rhbz#1582504


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b07-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b07.
  - Require tzdata 2020a so system tzdata matches resource updates in b07
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.1.ea
changelog:
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.3.ea
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-1
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.262.b10-3
changelog:
  - ASSEMBLY_EXCEPTION LICENSE THIRD_PARTY_README moved to fully versioned dirs
  - Resolves: rhbz#1831665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-1
changelog:
  - Update to aarch64-shenandoah-jdk8u265-b01.
  - Update release notes for 8u265 release.
  - Resolves: rhbz#1860453


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-2
changelog:
  - Add backport of JDK-8223482 so PKCS#11 FIPS provider does not offer unsupported ciphers.
  - Resolves: rhbz#1860965


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-3
changelog:
  - Add backport of JDK-8251117 to allow key length to be retrieved from PKCS#11 FIPS keys
  - Resolves: rhbz#1860993


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b01.
  - Switch to EA mode.
  - Add debugging output for build.
  - JFR must now be explicitly disabled when unwanted (e.g. x86), following switch of upstream default.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b02.
  - Remove JDK-8154313 backport now applied upstream.
  - Change target from 'zip-docs' to 'docs-zip', which is the naming used upstream.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b04.
  - Update tarball generation script to use PR3795, following inclusion of JDK-8177334
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b05.
  - Add additional s390 size_t case in g1ConcurrentMarkObjArrayProcessor.cpp introduced by JDK-8057003
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b05-shenandoah-merge-2020-08-28.
  - Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.3.ea
changelog:
  - Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b06-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b06.
  - Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
  - Remove JDK-8165996/PR3506/RH1760437 & JDK-8251117/RH1860990 as now applied upstream.
  - Replace JDK-8223482/RH1860965 with RH1860986 (disable TLSv1.3 when using the NSS-FIPS provider)
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b09-0.2.ea
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.2.ea
changelog:
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Delay tzdata 2020b dependency until tzdata update has shipped.
  - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-2
changelog:
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-4
changelog:
  - Bump release number to build on RHEL 8.4.0 branch.
  - Resolves: rhbz#1876665
  - Resolves: rhbz#1889414


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-6
changelog:
  - Add backport of JDK-8223940: "Private key not supported by chosen signature algorithm" to handle lack of provider RSAPSS support
  - Resolves: rhbz#1892216


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.275.b01-2
changelog:
  - Update to aarch64-shenandoah-jdk8u275-b01 (GA)
  - Update release notes for 8u275.
  - Remove JDK-8223940/RH1892216 backport now included in upstream 8u275.
  - Remove JDK-8236512/RH1889414 backport now included in upstream 8u275.
  - Resolves: rhbz#1895060


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.275.b01-3
changelog:
  - added patch600, rh1750419-redhat_alt_java.patch
  - Replaced alt-java palceholder by real pathced alt-java
  - remove patch529 rh1566890-CVE_2018_3639-speculative_store_bypass.patch
  - remove patch531 rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - both suprassed by new patch
  - Resolves: rhbz#1750419


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b01 (EA)
  - Update release notes for 8u282-b01.
  - Switch to EA mode.
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Remove PR3601, covered upstream by JDK-8062808.
  - Remove upstreamed JDK-8197981/PR3548, JDK-8062808/PR3548, JDK-8254177 & JDK-8215727.
  - Extend RH1750419 alt-java fix to include external debuginfo, following JDK-8252395
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b02 (EA)
  - Update release notes for 8u282-b02.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b02-0.2.ea
changelog:
  - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs.
  - Resolves: rhbz#1906862


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b03 (EA)
  - Update release notes for 8u282-b03.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b04 (EA)
  - Update release notes for 8u282-b04.
  - Remove upstreamed patch PR3519
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b05 (EA)
  - Update release notes for 8u282-b05 and make some minor corrections.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b06-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b06 (EA)
  - Update release notes for 8u282-b06.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b07-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b07 (EA)
  - Update release notes for 8u282-b07.
  - Fix placement issue in release notes, caught by comparing with vanilla version.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b08 (GA)
  - Update release notes for 8u282-b08.
  - Resolves: rhbz#1908967


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b08-2
changelog:
  - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
  - Resolves: rhbz#1913868


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b01-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b01 (EA)
  - Update release notes for 8u292-b01.
  - Switch to EA mode.
  - Update tarball generation script to use PR3822 which handles
      JDK-8233228 & JDK-8035166 changes
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b02-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b02 (EA)
  - Update release notes for 8u292-b02.
  - Remove RH1868759 patch as this is now resolved upstream by JDK-8258833.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b03-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b03 (EA)
  - Update release notes for 8u292-b03.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b04-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b04 (EA)
  - Update release notes for 8u292-b04.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05 (EA)
  - Update release notes for 8u292-b05.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.3.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
  - Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
  - Re-organise S/390 patches for upstream submission, separating 8u upstream from Shenandoah fixes.
  - Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
  - Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813 in 8u.
  - Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are accurate.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b06-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b06 (EA)
  - Update release notes for 8u292-b06.
  - Require tzdata 2020f due to JDK-8259048
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b07-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b07 (EA)
  - Update release notes for 8u292-b07.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b08-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b08 (EA)
  - Update release notes for 8u292-b08.
  - Require tzdata 2021a due to JDK-8260356
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b09-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b09 (EA)
  - Update release notes for 8u292-b09.
  - Resolves: rhbz#1942306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b10-2
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b10 (GA)
  - Update release notes for 8u292-b10.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1938201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b01 (EA)
  - Update release notes for 8u302-b01.
  - Switch to EA mode.
  - Resolves: rhbz#1967812


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.302.b01-0.1.ea
changelog:
  - adapted to newst cjc to fix issue with rpm 4.17
  - Disable copy-jdk-configs for Flatpak builds
  - removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in transaction
  - Resolves: rhbz#1953923


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b01-0.2.ea
changelog:
  - Cleanup architecture handling in preparation for extending set of fastdebug architectures
  - Fixed not-including fastdebug build in case of --without fastdebug
  - Resolves: rhbz#1969254


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b02 (EA)
  - Update release notes for 8u302-b02.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03 (EA)
  - Update release notes for 8u302-b03.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
  - Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.3.ea
changelog:
  - Introduced nm based check to verify alt-java on x86_64 is patched, and no other alt-java or java is patched
  - Patch600, rh1750419-redhat_alt_java.patch, amended to die, if it is used wrongly
  - Introduced ssbd_arches with currently only valid arch of x86_64 to separate real alt-java architectures
  - Resolves: rhbz#1966233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b04 (EA)
  - Update release notes for 8u302-b04.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b05 (EA)
  - Update release notes for 8u302-b05.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.1.ea
changelog:
  - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics.
  - Resolves: rhbz#1966233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.2.ea
changelog:
  - Remove restriction on disabling product build, as debug packages no longer have javadoc packages.
  - Fix name of javadoc debug packages in Obsoletes declarations and add version where it was removed.
  - Resolves: rhbz#1966233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b06 (EA)
  - Update release notes for 8u302-b06.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
  - Update release notes for 8u302-b07.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b08 (EA)
  - Update release notes for 8u302-b08.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Martin Balao <mbalao@redhat.com> - 1:1.8.0.302.b08-2
changelog:
  - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
  - Resolves: rhbz#1971679


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-2
changelog:
  - Port FIPS system detection support to OpenJDK 8u
  - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure.
  - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM.
  - Resolves: rhbz#1971679


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b01 (EA)
  - Update release notes for 8u312-b01.
  - Switch to EA mode.
  - Remove "-clean" suffix as no 8u312 builds are unclean.
  - Related: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b02 (EA)
  - Update release notes for 8u312-b02.
  - Related: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b03 (EA)
  - Update release notes for 8u312-b03.
  - Related: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b04 (EA)
  - Update release notes for 8u312-b04.
  - Related: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05 (EA)
  - Update release notes for 8u312-b05.
  - Resolves: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#1994659


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.3.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
  - Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
  - Related: rhbz#1999937


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-3
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b07 (EA)
  - Update release notes for 8u312-b07.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2012339


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.312.b07-4
changelog:
  - Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
    secmod.db file as part of nss
  - Resolves: rhbz#2023532


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-5
changelog:
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b01 (EA)
  - Update release notes for 8u322-b01.
  - Switch to EA mode.
  - Related: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b02 (EA)
  - Update release notes for 8u322-b02.
  - Related: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b03 (EA)
  - Update release notes for 8u322-b03.
  - Related: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b04 (EA)
  - Update release notes for 8u322-b04.
  - Require tzdata 2021c as of JDK-8274407.
  - Related: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b05 (EA)
  - Update release notes for 8u322-b05.
  - Require tzdata 2021e as of JDK-8275766.
  - Update tarball generation script to use git following shenandoah-jdk8u's move to github
  - Resolves: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-2
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-3
changelog:
  - Fix FIPS issues in native code and with initialisation of java.security.Security
  - Resolves: rhbz#2021263


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-4
changelog:
  - Refactor build functions so we can build just HotSpot without any attempt at installation.
  - Introduce architecture restriction logic for the gdb test. (RH2041970)
  - Pass compiler flags to the ADLC build (JDK-8281098)
  - Adjust JDK8199936/PR3533 -mstackrealign patch to instead pass -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4
  - Explicitly list JIT architectures rather than relying on those with slowdebug builds
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - Add backport of JDK-8257794 to fix bogus assert on slowdebug x86-32 Zero builds
  - Sync minor placement differences with Fedora & RHEL 9
  - Resolves: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-5
changelog:
  - Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent
  - Resolves: rhbz#2052817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-6
changelog:
  - Detect NSS at runtime for FIPS detection
  - Turn off build-time NSS linking and go back to an explicit Requires on NSS
  - Resolves: rhbz#2052828


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.322.b06-8
changelog:
  - alternatives creation moved to posttrans
  - Thus fixing the old reisntall issue:
  - https://bugzilla.redhat.com/show_bug.cgi?id=1200302
  - https://bugzilla.redhat.com/show_bug.cgi?id=1976053
  - Resolves: rhbz#2008192


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.322.b06-11
changelog:
  - Storing and restoring alterntives during update manually
  - Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and select (as auto) system JDK/JRE
  -- The move of alternatives creation to posttrans to fix:
  -- Bug 1200302 - dnf reinstall breaks alternatives
  -- Had caused the alternatives to be removed, and then created again,
  -- instead of being added, and then removing the old, and thus persisting
  -- the selection in family
  -- Thus this fix, is storing the family of manually selected master, and if
  -- stored, then it is restoring the family of the master
  - Resolves: rhbz#2008192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b01 (EA)
  - Update release notes for shenandoah-8u332-b01.
  - Switch to EA mode.
  - Remove JDK-8279077 patch now upstream.
  - Related: rhbz#2047536


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b06 (EA)
  - Update release notes for shenandoah-8u332-b06.
  - Resolves: rhbz#2047536


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.2.ea
changelog:
  - Allow the default keystore to be configured using security.systemCACerts
  - Use of the property can now be disabled using -Djava.security.disableSystemCACerts=true
  - Resolves: rhbz#2055274


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-3
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2074646


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:1.8.0.332.b09-4
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2102431


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-5
changelog:
  - Rebase FIPS patches from fips branch and simplify by using a single patch from that repository
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Rebase PR2888/RH2055274 cacerts patch so it applies after the current FIPS patch
  - Perform configuration changes (e.g. nss.cfg, nss.fips.cfg, tzdb.dat) in installjdk
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2097152
  - Resolves: rhbz#2100675


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u342-b06 (EA)
  - Update release notes for shenandoah-8u342-b06.
  - Switch to EA mode for 8u342 pre-release builds.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Remove redundant "REPOS" variable from tarball script
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Resolves: rhbz#2083265


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-2
changelog:
  - Update to shenandoah-jdk8u342-b07 (GA)
  - Update release notes for 8u342-b07.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2106507


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-2
changelog:
  - Update to shenandoah-jdk8u345-b01 (GA)
  - Update release notes for 8u345-b01.
  - Resolves: rhbz#2112403


author: Stephan Bergmann <sbergman@redhat.com> - 1:1.8.0.345.b01-3
changelog:
  - Disable copy-jdk-configs for Flatpak builds
  - Fix flatpak builds by exempting them from bootstrap
  - Resolves: rhbz#2102733


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-4
changelog:
  - Sync system cacerts support with RHEL 9, disabling using -Dsecurity.systemCACerts=
  - Move cacerts replacement to install section and retain original of this and tzdb.dat
  - Related: rhbz#2055274


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-5
changelog:
  - Switch to static builds, reducing system dependencies and making build more portable
  - Resolves: rhbz#2048542


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b07-0.2.ea
changelog:
  - Update to shenandoah-jdk8u352-b07 (EA)
  - Update release notes for shenandoah-8u352-b07.
  - Switch to EA mode for 8u352 pre-release builds.
  - Rebase FIPS patch against 8u352-b07
  - Resolves: rhbz#2130612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Switch to GA mode for final release.
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b01-0.3.ea
changelog:
  - Update to shenandoah-jdk8u362-b01 (EA)
  - Update release notes for shenandoah-8u362-b01.
  - Switch to EA mode for 8u362 pre-release builds.
  - Drop JDK-8195607/PR3776/RH1760437 now this is upstream
  - Related: rhbz#2150193


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.3.ea
changelog:
  - Update to shenandoah-jdk8u362-b07 (EA)
  - Update release notes for shenandoah-8u362-b07.
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Drop JDK-8255559/RH2124390 patch which is now upstream
  - Resolves: rhbz#2150193


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-3
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Fix broken links and missing release notes in older releases.
  - Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
    - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
    - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
    - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b09-3
changelog:
  - Update cacerts patch to fix OPENJDK-1433 SecurityManager issue
  - Update to shenandoah-jdk8u352-b09 (GA)
  - Update release notes for shenandoah-8u352-b09.
  - Resolves: rhbz#2162715


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b09-4
changelog:
  - On portable architectures, replace build section with extraction of existing builds from portables
  - Rewrite ELF files so the source file path is correct and debugsources can be assembled
  - Resolves: rhbz#2150203


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-2
changelog:
  - Update to shenandoah-jdk8u372-b07 (GA)
  - Update release notes for shenandoah-8u372-b07.
  - Require tzdata 2023c due to inclusion of JDK-8305113 in 8u372-b07
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Drop JDK-8275535/RH2053256 patch which is now upstream
  - Include JDK-8271199 backport early ahead of 8u382 (RH2175317)
  - Drop hack for difference in local and portable build version
  - Replace local copies of JDK portable binaries with build dependencies
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2189328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-3
changelog:
  - Revert "Restore native build for x86 as there is no portable build"
  - Retain portable_build-arches with x86-32 added for reference
  - Remove NEWS.
  - Related: rhbz#2189328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-4
changelog:
  - Include the java-1.8.0-openjdk-portable.spec file with instructions on how to rebuild.
  - Remove duplicate use of README.md inside the *-src package (it is no longer about sources)
  - Related: rhbz#2189328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b01 (EA)
  - Switch to EA mode.
  - Remove JDK-8271199 patch which is now upstream.
  - Add version of bundled zlib (bumped from 1.2.11 to 1.2.13 with this update)
  - Introduce 'prelease' for the portable release versioning, to handle EA builds
  - Sync the copy of the portable specfile with the latest update
  - Related: rhbz#2217710


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b04-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b04 (EA)
  - Sync the copy of the portable specfile with the latest update
  - Resolves: rhbz#2217710


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u372-b05 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Add note at top of spec file about rebuilding
  - Use tapsets from the misc tarball
  - Make sure root installation directory is created first
  - Use in-place substitution for all but the first of the tapset changes
  - The 'prelease' variable should refer to 'portablerelease', not 'rpmrelease'
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-13641


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-2
changelog:
  - Update to shenandoah-jdk8u392-b08 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Regenerate PR2462 patch following JDK-8315135
  - Bump version of bundled libpng to 1.6.39
  - Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
  - Add missing JFR, alt-java, jre-* and java-* alternative ghosts
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12309
  - Resolves: RHEL-13600
  - Resolves: RHEL-13628
  - Resolves: RHEL-13635
  - Resolves: RHEL-13641
  - Resolves: RHEL-13612
  - Resolves: RHEL-13621


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-5
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19636


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.2.ea
changelog:
  - Update to shenandoah-jdk8u402-b06 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Drop local copy of JDK-8312489 which is now included upstream
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-21477
  - Resolves: RHEL-20975


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.2.ea
changelog:
  - Invoke xz in multi-threaded mode
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Related: RHEL-30931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.2.ea
changelog:
  - Turn off xz multi-threading on i686 as it fails with an out of memory error
  - Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
  - generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
  - generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
  - generate_source_tarball.sh: Adapt version logic to work with 8u
  - generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - Move maintenance scripts to a scripts subdirectory
  - icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - Remove obsolete file generate_singlerepo_source_tarball.sh
  - Remove obsolete file get_sources.sh
  - Remove obsolete file update_main_sources.sh
  - generate_source_tarball.sh: Handle an existing checkout
  - generate_source_tarball.sh: Sync indentation with java-21-openjdk version
  - generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
  - Sync patch set with portable build
  - Related: RHEL-30931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.2.ea
changelog:
  - Update to shenandoah-jdk8u412-b07 (EA)
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-30931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-2
changelog:
  - Update to shenandoah-jdk8u412-b08 (GA)
  - Update release notes for shenandoah-8u412-b08.
  - Complete release note for Certainly roots
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-32396


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u422-b01 (EA)
  - Update release notes for shenandoah-8u422-b01.
  - Switch to EA mode.
  - Sync the copy of the portable specfile with the latest update
  - Restore NEWS file and rename remove-intree-libraries.sh so portable can be rebuilt
  - Document policy repacking script and rename to correct spelling and style
  - Limit Java only tests to one architecture using jdk_test_arch
  - Related: RHEL-46866
  - Resolves: RHEL-47067
  - Resolves: RHEL-47087


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b05-1.1
changelog:
  - Update to shenandoah-jdk8u422-b05 (GA)
  - Update release notes for shenandoah-8u422-b05.
  - Rebase PR2462 patch following patched hunk being removed by JDK-8322106
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - Actually require tzdata 2024a now it is available in the buildroot
  - Add missing build dependencies on zlib-devel and tar
  - Update LCMS version to match JDK-8245400
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
  - Resolves: RHEL-46866
  - Resolves: RHEL-47001


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.432.b06-1
changelog:
  - Update to shenandoah-jdk8u432-b06 (GA)
  - Update release notes for shenandoah-8u432-b06.
  - Drop JDK-828109{6,7,8}/PR3836 patch following integration of upstream version
  - Regenerate JDK-8199936/PR3533 patch following JDK-828109{6,7,8} integration
  - Bump version of bundled zlib to 1.3.1 following JDK-8324632
  - Include backport of JDK-8328999 to update giflib to 5.2.2
  - Bump version of bundled giflib to 5.2.2 following JDK-8328999
  - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-58791
  - Resolves: RHEL-62278
  - Resolves: RHEL-61285
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **


