# changelog

author: Eduardo Lima (Etrunko) <elima@redhat.com> - 5.2.0-7.el8
changelog:
  - kvm-virtio-Add-corresponding-memory_listener_unregister-.patch [bz#1903521]
  - kvm-block-Honor-blk_set_aio_context-context-requirements.patch [bz#1918966 bz#1918968]
  - kvm-nbd-server-Quiesce-coroutines-on-context-switch.patch [bz#1918966 bz#1918968]
  - kvm-block-Avoid-processing-BDS-twice-in-bdrv_set_aio_con.patch [bz#1918966 bz#1918968]
  - kvm-storage-daemon-Call-bdrv_close_all-on-exit.patch [bz#1918966 bz#1918968]
  - kvm-block-move-blk_exp_close_all-to-qemu_cleanup.patch [bz#1918966 bz#1918968]
  - Resolves: bz#1903521
    (hot unplug vhost-user cause qemu crash: qemu-kvm: ../softmmu/memory.c:2818: do_address_space_destroy: Assertion `QTAILQ_EMPTY(&as->listeners)' failed.)
  - Resolves: bz#1918966
    ([incremental_backup] qemu aborts if guest reboot during backup when using virtio-blk: "aio_co_schedule: Co-routine was already scheduled in 'aio_co_schedule'")
  - Resolves: bz#1918968
    ([incremental_backup] qemu deadlock after poweroff in guest during backup in nbd_export_close_all())


author: Eduardo Lima (Etrunko) <elima@redhat.com> - 5.2.0-8.el8
changelog:
  - kvm-block-nbd-only-detach-existing-iochannel-from-aio_co.patch [bz#1887883]
  - kvm-block-nbd-only-enter-connection-coroutine-if-it-s-pr.patch [bz#1887883]
  - kvm-nbd-make-nbd_read-return-EIO-on-error.patch [bz#1887883]
  - kvm-virtio-move-use-disabled-flag-property-to-hw_compat_.patch [bz#1907255]
  - kvm-virtiofsd-extract-lo_do_open-from-lo_open.patch [bz#1920740]
  - kvm-virtiofsd-optionally-return-inode-pointer-from-lo_do.patch [bz#1920740]
  - kvm-virtiofsd-prevent-opening-of-special-files-CVE-2020-.patch [bz#1920740]
  - kvm-spapr-Adjust-firmware-path-of-PCI-devices.patch [bz#1920941]
  - kvm-pci-reject-too-large-ROMs.patch [bz#1917830]
  - kvm-pci-add-romsize-property.patch [bz#1917830]
  - kvm-redhat-Add-some-devices-for-exporting-upstream-machi.patch [bz#1917826]
  - kvm-vhost-Check-for-valid-vdev-in-vhost_backend_handle_i.patch [bz#1880299]
  - Resolves: bz#1887883
    (qemu blocks client progress with various NBD actions)
  - Resolves: bz#1907255
    (Migrate failed with vhost-vsock-pci from RHEL-AV 8.3.1 to RHEL-AV 8.2.1)
  - Resolves: bz#1920740
    (CVE-2020-35517 virt:8.4/qemu-kvm: QEMU: virtiofsd: potential privileged host device access from guest [rhel-av-8.4.0])
  - Resolves: bz#1920941
    ([ppc64le] [AV]--disk cdimage.iso,bus=usb fails to boot)
  - Resolves: bz#1917830
    (Add romsize property to qemu-kvm)
  - Resolves: bz#1917826
    (Add extra device support to qemu-kvm, but not to rhel machine types)
  - Resolves: bz#1880299
    (vhost-user mq connection fails to restart after kill host testpmd which acts as vhost-user client)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 5.2.0-9.el8
changelog:
  - kvm-docs-generate-qemu-storage-daemon-qmp-ref-7-man-page.patch [bz#1901323]
  - kvm-docs-add-qemu-storage-daemon-1-man-page.patch [bz#1901323]
  - kvm-docs-Add-qemu-storage-daemon-1-manpage-to-meson.buil.patch [bz#1901323]
  - kvm-qemu-storage-daemon-Enable-object-add.patch [bz#1901323]
  - kvm-spec-Package-qemu-storage-daemon.patch [bz#1901323]
  - kvm-default-configs-Enable-vhost-user-blk.patch [bz#1930033]
  - kvm-qemu-nbd-Use-SOMAXCONN-for-socket-listen-backlog.patch [bz#1925345]
  - kvm-pcie-don-t-set-link-state-active-if-the-slot-is-empt.patch [bz#1917654]
  - Resolves: bz#1901323
    (QSD (QEMU Storage Daemon): basic support - TechPreview)
  - Resolves: bz#1930033
    (enable vhost-user-blk device)
  - Resolves: bz#1925345
    (qemu-nbd needs larger backlog for Unix socket listen())
  - Resolves: bz#1917654
    ([failover vf migration][RHEL84 vm] After start a vm with a failover vf + a failover virtio net device, the failvoer vf do not exist in the vm)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 5.2.0-10.el8
changelog:
  - kvm-migration-dirty-bitmap-Use-struct-for-alias-map-inne.patch [bz#1930757]
  - kvm-migration-dirty-bitmap-Allow-control-of-bitmap-persi.patch [bz#1930757]
  - kvm-qemu-iotests-300-Add-test-case-for-modifying-persist.patch [bz#1930757]
  - kvm-failover-fix-indentantion.patch [bz#1819991]
  - kvm-failover-Use-always-atomics-for-primary_should_be_hi.patch [bz#1819991]
  - kvm-failover-primary-bus-is-only-used-once-and-where-it-.patch [bz#1819991]
  - kvm-failover-Remove-unused-parameter.patch [bz#1819991]
  - kvm-failover-Remove-external-partially_hotplugged-proper.patch [bz#1819991]
  - kvm-failover-qdev_device_add-returns-err-or-dev-set.patch [bz#1819991]
  - kvm-failover-Rename-bool-to-failover_primary_hidden.patch [bz#1819991]
  - kvm-failover-g_strcmp0-knows-how-to-handle-NULL.patch [bz#1819991]
  - kvm-failover-Remove-primary_device_opts.patch [bz#1819991]
  - kvm-failover-remove-standby_id-variable.patch [bz#1819991]
  - kvm-failover-Remove-primary_device_dict.patch [bz#1819991]
  - kvm-failover-Remove-memory-leak.patch [bz#1819991]
  - kvm-failover-simplify-virtio_net_find_primary.patch [bz#1819991]
  - kvm-failover-should_be_hidden-should-take-a-bool.patch [bz#1819991]
  - kvm-failover-Rename-function-to-hide_device.patch [bz#1819991]
  - kvm-failover-virtio_net_connect_failover_devices-does-no.patch [bz#1819991]
  - kvm-failover-Rename-to-failover_find_primary_device.patch [bz#1819991]
  - kvm-failover-simplify-qdev_device_add-failover-case.patch [bz#1819991]
  - kvm-failover-simplify-qdev_device_add.patch [bz#1819991]
  - kvm-failover-make-sure-that-id-always-exist.patch [bz#1819991]
  - kvm-failover-remove-failover_find_primary_device-error-p.patch [bz#1819991]
  - kvm-failover-split-failover_find_primary_device_id.patch [bz#1819991]
  - kvm-failover-We-don-t-need-to-cache-primary_device_id-an.patch [bz#1819991]
  - kvm-failover-Caller-of-this-two-functions-already-have-p.patch [bz#1819991]
  - kvm-failover-simplify-failover_unplug_primary.patch [bz#1819991]
  - kvm-failover-Remove-primary_dev-member.patch [bz#1819991]
  - kvm-virtio-net-add-missing-object_unref.patch [bz#1819991]
  - kvm-x86-cpu-Populate-SVM-CPUID-feature-bits.patch [bz#1926785]
  - kvm-i386-Add-the-support-for-AMD-EPYC-3rd-generation-pro.patch [bz#1926785]
  - Resolves: bz#1930757
    (Allow control of block-dirty-bitmap persistence via 'block-bitmap-mapping')
  - Resolves: bz#1819991
    (Hostdev type interface with net failover enabled exists in domain xml and doesn't reattach to host after hot-unplug)
  - Resolves: bz#1926785
    ([RFE] AMD Milan - Add KVM/support for EPYC-Milan CPU Model - Fast Train)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 5.2.0-11.el8
changelog:
  - kvm-qxl-set-qxl.ssd.dcl.con-on-secondary-devices.patch [bz#1932190]
  - kvm-qxl-also-notify-the-rendering-is-done-when-skipping-.patch [bz#1932190]
  - kvm-virtiofsd-Save-error-code-early-at-the-failure-calls.patch [bz#1935071]
  - kvm-virtiofs-drop-remapped-security.capability-xattr-as-.patch [bz#1935071]
  - Resolves: bz#1932190
    (Timeout when dump the screen from 2nd VGA)
  - Resolves: bz#1935071
    (CVE-2021-20263 virt:8.4/qemu-kvm: QEMU: virtiofsd: 'security.capabilities' is not dropped with xattrmap option [rhel-av-8])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 5.2.0-12.el8
changelog:
  - kvm-scsi-disk-move-scsi_handle_rw_error-earlier.patch [bz#1927530]
  - kvm-scsi-disk-do-not-complete-requests-early-for-rerror-.patch [bz#1927530]
  - kvm-scsi-introduce-scsi_sense_from_errno.patch [bz#1927530]
  - kvm-scsi-disk-pass-SCSI-status-to-scsi_handle_rw_error.patch [bz#1927530]
  - kvm-scsi-disk-pass-guest-recoverable-errors-through-even.patch [bz#1927530]
  - kvm-hw-intc-arm_gic-Fix-interrupt-ID-in-GICD_SGIR-regist.patch [bz#1936948]
  - Resolves: bz#1927530
    (RHEL8 Hypervisor - OVIRT  - Issues seen on a virtualization guest with direct passthrough LUNS  pausing when a host gets a Thin threshold warning)
  - Resolves: bz#1936948
    (CVE-2021-20221 virt:av/qemu-kvm: qemu: out-of-bound heap buffer access via an interrupt ID field [rhel-av-8.4.0])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 5.2.0-13.el8
changelog:
  - kvm-i386-acpi-restore-device-paths-for-pre-5.1-vms.patch [bz#1934158]
  - Resolves: bz#1934158
    (Windows guest looses network connectivity when NIC was configured with static IP)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 5.2.0-14.el8
changelog:
  - kvm-vhost-user-blk-fix-blkcfg-num_queues-endianness.patch [bz#1937004]
  - kvm-block-export-fix-blk_size-double-byteswap.patch [bz#1937004]
  - kvm-block-export-use-VIRTIO_BLK_SECTOR_BITS.patch [bz#1937004]
  - kvm-block-export-fix-vhost-user-blk-export-sector-number.patch [bz#1937004]
  - kvm-block-export-port-virtio-blk-discard-write-zeroes-in.patch [bz#1937004]
  - kvm-block-export-port-virtio-blk-read-write-range-check.patch [bz#1937004]
  - kvm-spec-ui-spice-sub-package.patch [bz#1936373]
  - kvm-spec-ui-opengl-sub-package.patch [bz#1936373]
  - Resolves: bz#1937004
    (vhost-user-blk server endianness and input validation fixes)
  - Resolves: bz#1936373
    (move spice & opengl modules to rpm subpackages)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 5.2.0-15.el8_4
changelog:
  - kvm-block-Simplify-qmp_block_resize-error-paths.patch [bz#1903511]
  - kvm-block-Fix-locking-in-qmp_block_resize.patch [bz#1903511]
  - kvm-block-Fix-deadlock-in-bdrv_co_yield_to_drain.patch [bz#1903511]
  - Resolves: bz#1903511
    (no response on  QMP command 'block_resize')


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 5.2.0-16.el8
changelog:
  - kvm-virtio-pci-compat-page-aligned-ATS.patch [bz#1942362]
  - Resolves: bz#1942362
    (Live migration with iommu from rhel8.3.1 to rhel8.4 fails: qemu-kvm: get_pci_config_device: Bad config data)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-17.el8
changelog:
  - kvm-redhat-s390x-add-rhel-8.5.0-compat-machine.patch [bz#1951476]
  - kvm-redhat-add-missing-entries-in-hw_compat_rhel_8_4.patch [bz#1957834]
  - kvm-redhat-Define-pseries-rhel8.5.0-machine-type.patch [bz#1957834]
  - Resolves: bz#1951476
    ([s390x] RHEL AV 8.5 new machine type for s390x)
  - Resolves: bz#1957834
    ([ppc64le] RHEL AV 8.5 new machine type for ppc64le)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-18.el8
changelog:
  - kvm-virtio-net-failover-add-missing-remove_migration_sta.patch [bz#1953045]
  - kvm-hw-arm-virt-Add-8.5-machine-type.patch [bz#1957667]
  - kvm-hw-arm-virt-Disable-PL011-clock-migration-through-hw.patch [bz#1957667]
  - kvm-arm-virt-Register-highmem-and-gic-version-as-class-p.patch [bz#1957667]
  - kvm-virtio-blk-Fix-rollback-path-in-virtio_blk_data_plan.patch [bz#1927108]
  - kvm-virtio-blk-Configure-all-host-notifiers-in-a-single-.patch [bz#1927108]
  - kvm-virtio-scsi-Set-host-notifiers-and-callbacks-separat.patch [bz#1927108]
  - kvm-virtio-scsi-Configure-all-host-notifiers-in-a-single.patch [bz#1927108]
  - kvm-hw-arm-smmuv3-Another-range-invalidation-fix.patch [bz#1929720]
  - Resolves: bz#1953045
    (qemu-kvm NULL pointer de-reference  during migration at migrate_fd_connect ->...-> notifier_list_notify)
  - Resolves: bz#1957667
    ([aarch64] Add 8.5 machine type)
  - Resolves: bz#1927108
    (It's too slow to load scsi  disk when use 384 vcpus)
  - Resolves: bz#1929720
    ([aarch64] Handle vsmmuv3 IOTLB invalidation with non power of 2 size)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-19.el8
changelog:
  - kvm-pc-bios-s390-ccw-don-t-try-to-read-the-next-block-if.patch [bz#1965626]
  - kvm-redhat-Install-the-s390-netboot.img-that-we-ve-built.patch [bz#1966463]
  - kvm-sockets-update-SOCKET_ADDRESS_TYPE_FD-listen-2-backl.patch [bz#1967177]
  - kvm-target-i386-sev-add-support-to-query-the-attestation.patch [bz#1957022]
  - kvm-spapr-Don-t-hijack-current_machine-boot_order.patch [bz#1960119]
  - kvm-target-i386-Add-CPU-model-versions-supporting-xsaves.patch [bz#1942914]
  - kvm-spapr-Remove-stale-comment-about-power-saving-LPCR-b.patch [bz#1940731]
  - kvm-spapr-Set-LPCR-to-current-AIL-mode-when-starting-a-n.patch [bz#1940731]
  - Resolves: bz#1965626
    (RHEL8.2 - QEMU BIOS fails to read stage2 loader (kvm))
  - Resolves: bz#1966463
    (Rebuild the s390-netboot.img for downstream instead of shipping the upstream image)
  - Resolves: bz#1967177
    (QEMU 6.0.0 socket_get_fd() fails with the error "socket_get_fd: too many connections")
  - Resolves: bz#1957022
    (SEV: Add support to query the attestation report)
  - Resolves: bz#1960119
    ([regression]Failed to reset guest)
  - Resolves: bz#1942914
    ([Hyper-V][RHEL8.4]Nested Hyper-V on KVM: On Intel CPU L1 2016 can not start with cpu model Skylake-Server-noTSX-IBRS or Skylake-Client-noTSX-IBRS)
  - Resolves: bz#1940731
    ([ppc64le] Hotplug vcpu device hit call trace:[qemu output] KVM: unknown exit, hardware reason 7fff9ce87ed8)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-20.el8
changelog:
  - kvm-x86-Add-x86-rhel8.5-machine-types.patch [bz#1957838]
  - kvm-redhat-x86-Enable-kvm-asyncpf-int-by-default.patch [bz#1967603]
  - kvm-yank-Unregister-function-when-using-TLS-migration.patch [bz#1964326]
  - Resolves: bz#1957838
    (8.5 machine types for x86)
  - Resolves: bz#1967603
    (Enable interrupt based asynchronous page fault mechanism by default)
  - Resolves: bz#1964326
    (Qemu core dump when do tls migration via tcp protocol)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-21.el8
changelog:
  - kvm-block-backend-add-drained_poll.patch [bz#1960137]
  - kvm-nbd-server-Use-drained-block-ops-to-quiesce-the-serv.patch [bz#1960137]
  - kvm-disable-CONFIG_USB_STORAGE_BOT.patch [bz#1866133]
  - kvm-doc-Fix-some-mistakes-in-the-SEV-documentation.patch [bz#1954750]
  - kvm-docs-Add-SEV-ES-documentation-to-amd-memory-encrypti.patch [bz#1954750]
  - kvm-docs-interop-firmware.json-Add-SEV-ES-support.patch [bz#1954750]
  - Resolves: bz#1960137
    ([incremental backup] qemu-kvm hangs when Rebooting the VM during full backup)
  - Resolves: bz#1866133
    (Disable usb-bot device in QEMU (unsupported))
  - Resolves: bz#1954750
    (firmware scheme for sev-es)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-22.el8
changelog:
  - kvm-redhat-Expose-upstream-machines-pc-4.2-and-pc-2.11.patch [bz#1897923]
  - kvm-redhat-Enable-FDC-device-for-upstream-machines-too.patch [bz#1897923]
  - kvm-redhat-Add-hw_compat_4_2_extra-and-apply-to-upstream.patch [bz#1897923]
  - kvm-ppc-pef.c-initialize-cgs-ready-in-kvmppc_svm_init.patch [bz#1789757]
  - kvm-virtio-gpu-handle-partial-maps-properly.patch [bz#1932279]
  - kvm-redhat-Fix-unversioned-Obsoletes-warning.patch [bz#1950405 bz#1967330]
  - kvm-redhat-Move-qemu-kvm-docs-dependency-to-qemu-kvm.patch [bz#1950405 bz#1967330]
  - kvm-redhat-introducting-qemu-kvm-hw-usbredir.patch [bz#1950405 bz#1967330]
  - kvm-spapr-Fix-EEH-capability-issue-on-KVM-guest-for-PCI-.patch [bz#1976015]
  - Resolves: bz#1897923
    (support Live Migration from Ubuntu 18.04 i440fx to RHEL)
  - Resolves: bz#1789757
    ([IBM 8.5 FEAT] Add machine option to enable secure VM support)
  - Resolves: bz#1932279
    ([aarch64] qemu core dumped when using smmuv3 and iommu_platform enabling at virtio-gpu-pci)
  - Resolves: bz#1950405
    (review qemu-kvm-core dependencies)
  - Resolves: bz#1967330
    (Make qemu-kvm use versioned obsoletes for qemu-kvm-ma and qemu-kvm-rhev)
  - Resolves: bz#1976015
    (spapr: Fix EEH capability issue on KVM guest for PCI passthru)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-23.el8
changelog:
  - kvm-Add-mtod_check.patch [bz#1970823 bz#1970842 bz#1970850 bz#1970858]
  - kvm-bootp-limit-vendor-specific-area-to-input-packet-mem.patch [bz#1970823 bz#1970842 bz#1970850 bz#1970858]
  - kvm-bootp-check-bootp_input-buffer-size.patch [bz#1970823]
  - kvm-upd6-check-udp6_input-buffer-size.patch [bz#1970842]
  - kvm-tftp-check-tftp_input-buffer-size.patch [bz#1970850]
  - kvm-tftp-introduce-a-header-structure.patch [bz#1970823 bz#1970842 bz#1970850 bz#1970858]
  - kvm-udp-check-upd_input-buffer-size.patch [bz#1970858]
  - kvm-Fix-DHCP-broken-in-libslirp-v4.6.0.patch [bz#1970823 bz#1970842 bz#1970850 bz#1970858]
  - kvm-redhat-use-the-standard-vhost-user-JSON-path.patch [bz#1804196]
  - Resolves: bz#1970823
    (CVE-2021-3592 virt:av/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) [rhel-av-8])
  - Resolves: bz#1970842
    (CVE-2021-3593 virt:av/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) [rhel-av-8])
  - Resolves: bz#1970850
    (CVE-2021-3595 virt:av/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) [rhel-av-8])
  - Resolves: bz#1970858
    (CVE-2021-3594 virt:av/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) [rhel-av-8])
  - Resolves: bz#1804196
    (inconsistent paths for interop json files)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-24.el8
changelog:
  - kvm-s390x-css-Introduce-an-ESW-struct.patch [bz#1968326]
  - kvm-s390x-css-Split-out-the-IRB-sense-data.patch [bz#1968326]
  - kvm-s390x-css-Refactor-IRB-construction.patch [bz#1968326]
  - kvm-s390x-css-Add-passthrough-IRB.patch [bz#1968326]
  - kvm-vhost-user-blk-Fail-gracefully-on-too-large-queue-si.patch [bz#1935014 bz#1935019 bz#1935020 bz#1935031]
  - kvm-vhost-user-blk-Make-sure-to-set-Error-on-realize-fai.patch [bz#1935014 bz#1935019 bz#1935020 bz#1935031]
  - kvm-vhost-user-blk-Don-t-reconnect-during-initialisation.patch [bz#1935014 bz#1935019 bz#1935020 bz#1935031]
  - kvm-vhost-user-blk-Improve-error-reporting-in-realize.patch [bz#1935014 bz#1935019 bz#1935020 bz#1935031]
  - kvm-vhost-user-blk-Get-more-feature-flags-from-vhost-dev.patch [bz#1935014 bz#1935019 bz#1935020 bz#1935031]
  - kvm-virtio-Fail-if-iommu_platform-is-requested-but-unsup.patch [bz#1935014 bz#1935019 bz#1935020 bz#1935031]
  - kvm-vhost-user-blk-Check-that-num-queues-is-supported-by.patch [bz#1935014 bz#1935019 bz#1935020 bz#1935031]
  - kvm-vhost-user-Fix-backends-without-multiqueue-support.patch [bz#1935014 bz#1935019 bz#1935020 bz#1935031]
  - Resolves: bz#1968326
    ([vfio_ccw] I/O error when checking format - dasdfmt requires --force in quick mode when passed through)
  - Resolves: bz#1935014
    (qemu crash when attach vhost-user-blk-pci with option queue-size=4096)
  - Resolves: bz#1935019
    (qemu guest failed boot when attach vhost-user-blk-pci with option iommu_platform=on)
  - Resolves: bz#1935020
    (qemu guest failed boot when attach vhost-user-blk-pci with option packed=on)
  - Resolves: bz#1935031
    (qemu guest failed boot when attach vhost-user-blk-pci with unmatched num-queues with qsd)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-25.el8
changelog:
  - kvm-s390x-cpumodel-add-3931-and-3932.patch [bz#1976171]
  - kvm-file-posix-fix-max_iov-for-dev-sg-devices.patch [bz#1943653]
  - kvm-scsi-generic-pass-max_segments-via-max_iov-field-in-.patch [bz#1943653]
  - kvm-osdep-provide-ROUND_DOWN-macro.patch [bz#1943653]
  - kvm-block-backend-align-max_transfer-to-request-alignmen.patch [bz#1943653]
  - kvm-block-add-max_hw_transfer-to-BlockLimits.patch [bz#1943653]
  - kvm-file-posix-try-BLKSECTGET-on-block-devices-too-do-no.patch [bz#1943653]
  - Resolves: bz#1976171
    ([IBM 8.5 FEAT] CPU Model for new IBM Z Hardware - qemu part)
  - Resolves: bz#1943653
    (RHV VM pauses due to 'qemu-kvm' getting EINVAL on i/o to a direct lun with scsi passthrough enabled)


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.0.0-26
changelog:
  - kvm-acpi-pc-revert-back-to-v5.2-PCI-slot-enumeration.patch [bz#1977798]
  - kvm-migration-failover-reset-partially_hotplugged.patch [bz#1787194]
  - kvm-hmp-Fix-loadvm-to-resume-the-VM-on-success-instead-o.patch [bz#1959676]
  - kvm-migration-Move-bitmap_mutex-out-of-migration_bitmap_.patch [bz#1959729]
  - kvm-i386-cpu-Expose-AVX_VNNI-instruction-to-guest.patch [bz#1924822]
  - kvm-ratelimit-protect-with-a-mutex.patch [bz#1838221]
  - kvm-Update-Linux-headers-to-5.13-rc4.patch [bz#1838221]
  - kvm-i386-Add-ratelimit-for-bus-locks-acquired-in-guest.patch [bz#1838221]
  - kvm-iothread-generalize-iothread_set_param-iothread_get_.patch [bz#1930286]
  - kvm-iothread-add-aio-max-batch-parameter.patch [bz#1930286]
  - kvm-linux-aio-limit-the-batch-size-using-aio-max-batch-p.patch [bz#1930286]
  - kvm-block-nvme-Fix-VFIO_MAP_DMA-failed-No-space-left-on-.patch [bz#1848881]
  - Resolves: bz#1977798
    (RHEL8.5 guest network interface name changed after upgrade to qemu-6.0)
  - Resolves: bz#1787194
    (After canceling the migration of a vm with VF which enables failover, using "migrate -d tcp:invalid uri" to re-migrating the vm will cause the VF in vm to be hot-unplug.)
  - Resolves: bz#1959676
    (guest status is paused after loadvm on rhel8.5.0)
  - Resolves: bz#1959729
    (SAP/3TB VM migration slowness [idle db])
  - Resolves: bz#1924822
    ([Intel 8.5 FEAT] qemu-kvm AVX2 VNNI - Fast Train)
  - Resolves: bz#1838221
    ([Intel 8.5 FEAT]  qemu-kvm Bus Lock VM Exit - Fast Train)
  - Resolves: bz#1930286
    (randread and randrw regression with virtio-blk multi-queue)
  - Resolves: bz#1848881
    (nvme:// block driver can exhaust IOMMU DMAs, hanging the VM, possible data loss)


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.0.0-27
changelog:
  - kvm-migration-move-wait-unplug-loop-to-its-own-function.patch [bz#1976852]
  - kvm-migration-failover-continue-to-wait-card-unplug-on-e.patch [bz#1976852]
  - kvm-aarch64-Add-USB-storage-devices.patch [bz#1974579]
  - Resolves: bz#1976852
    ([failover vf migration]  The failover vf will be unregistered  if canceling the migration whose status is "wait-unplug")
  - Resolves: bz#1974579
    (It's not possible to start installation from a virtual USB device on aarch64)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-28.el8
changelog:
  - kvm-iotests-Improve-and-rename-test-291-to-qemu-img-bitm.patch [bz#1946084]
  - kvm-qemu-img-Fail-fast-on-convert-bitmaps-with-inconsist.patch [bz#1946084]
  - kvm-qemu-img-Add-skip-broken-bitmaps-for-convert-bitmaps.patch [bz#1946084]
  - kvm-audio-Never-send-migration-section.patch [bz#1991671]
  - Resolves: bz#1946084
    (qemu-img convert --bitmaps fail if a bitmap is inconsistent)
  - Resolves: bz#1991671
    (vmstate differs between -audiodev and QEMU_AUDIO_DRV when no sound frontends devs present.)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 6.0.0-29.el8
changelog:
  - kvm-file-posix-Cap-max_iov-at-IOV_MAX.patch [bz#1994494]
  - kvm-migration-Move-yank-outside-qemu_start_incoming_migr.patch [bz#1974366]
  - Resolves: bz#1994494
    (VM remains in paused state when trying to write on a resized disk resides on iscsi)
  - Resolves: bz#1974366
    (Fail to set migrate incoming for 2nd time after the first time failed)


author: Jon Maloy <jmaloy@redhat.com> - 6.1.0-2
changelog:
  - kvm-qxl-fix-pre-save-logic.patch [bz#2002907]
  - kvm-redhat-Define-hw_compat_rhel_8_5.patch [bz#1998949]
  - kvm-redhat-Update-pseries-rhel8.5.0.patch [bz#1998949]
  - kvm-redhat-Add-s390x-machine-type-compatibility-update-f.patch [bz#1998950]
  - Resolves: bz#2002907
    (Unexpectedly failed when managedsave the guest which has qxl video device)
  - Resolves: bz#1998949
    (Add machine type compatibility update for 6.1 rebase [ppc64le])
  - Resolves: bz#1998950
    (Add machine type compatibility update for 6.1 rebase [s390x])


author: Jon Maloy <jmaloy@redhat.com> - 6.1.0-3
changelog:
  - kvm-virtio-net-fix-use-after-unmap-free-for-sg.patch [bz#1999221]
  - Resolves: bz#1999221
    (CVE-2021-3748 virt:rhel/qemu-kvm: QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 6.1.0-4
changelog:
  - kvm-spec-Remove-qemu-kiwi-build.patch [bz#2002694]
  - kvm-hw-arm-virt-Add-hw_compat_rhel_8_5-to-8.5-machine-ty.patch [bz#1998947]
  - Resolves: bz#2002694
    (remove qemu-kiwi rpm from qemu-kvm sources in rhel-8.6)
  - Resolves: bz#1998947
    (Add machine type compatibility update for 6.1 rebase [aarch64])


author: Jon Maloy <jmaloy@redhat.com> - 6.1.0-5
changelog:
  - kvm-e1000-fix-tx-re-entrancy-problem.patch [bz#1930092]
  - kvm-hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch [bz#2020720]
  - Resolves: bz#1930092
    (CVE-2021-20257 virt:rhel/qemu-kvm: QEMU: net: e1000: infinite loop while processing transmit descriptors [rhel-8.5.0])
  - Resolves: bz#2020720
    (CVE-2021-3930 virt:rhel/qemu-kvm: QEMU: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-2
changelog:
  - kvm-redhat-Add-rhel8.6.0-machine-type-for-s390x.patch [bz#2005325]
  - kvm-redhat-Define-pseries-rhel8.6.0-machine-type.patch [bz#2031041]
  - Resolves: bz#2005325
    (Fix CPU Model for new IBM Z Hardware - qemu part)
  - Resolves: bz#2031041
    (Add rhel-8.6.0 machine types for RHEL 8.6 [ppc64le])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-4
changelog:
  - kvm-hw-arm-virt-Register-iommu-as-a-class-property.patch [bz#2031039]
  - kvm-hw-arm-virt-Register-its-as-a-class-property.patch [bz#2031039]
  - kvm-hw-arm-virt-Rename-default_bus_bypass_iommu.patch [bz#2031039]
  - kvm-hw-arm-virt-Add-8.6-machine-type.patch [bz#2031039]
  - kvm-hw-arm-virt-Check-no_tcg_its-and-minor-style-changes.patch [bz#2031039]
  - kvm-rhel-machine-types-x86-set-prefer_sockets.patch [bz#2029582]
  - Resolves: bz#2031039
    (Add rhel-8.6.0 machine types for RHEL 8.6 [aarch64])
  - Resolves: bz#2029582
    ([8.6] machine types: 6.2: Fix prefer_sockets)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-5
changelog:
  - kvm-acpi-validate-hotplug-selector-on-access.patch [bz#2036580]
  - kvm-x86-Add-q35-RHEL-8.6.0-machine-type.patch [bz#2031035]
  - Resolves: bz#2036580
    (CVE-2021-4158 virt:rhel/qemu-kvm: QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c [rhel-8])
  - Resolves: bz#2031035
    (Add rhel-8.6.0 machine types for RHEL 8.6 [x86])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-6
changelog:
  - kvm-virtiofsd-Drop-membership-of-all-supplementary-group.patch [bz#2046198]
  - kvm-softmmu-fix-device-deletion-events-with-device-JSON-.patch [bz#2033279]
  - kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch [bz#2021778 bz#2036178]
  - kvm-iotests-stream-error-on-reset-New-test.patch [bz#2021778 bz#2036178]
  - kvm-block-rbd-fix-handling-of-holes-in-.bdrv_co_block_st.patch [bz#2037135]
  - kvm-block-rbd-workaround-for-ceph-issue-53784.patch [bz#2037135]
  - Resolves: bz#2046198
    (CVE-2022-0358 virt:av/qemu-kvm: QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405 [rhel-8.6])
  - Resolves: bz#2033279
    ([wrb][qemu-kvm 6.2] The hot-unplugged device can not be hot-plugged back)
  - Resolves: bz#2021778
    (Qemu core dump when do full backup during system reset)
  - Resolves: bz#2036178
    (Qemu core dumped when do block-stream to a snapshot node on non-enough space storage)
  - Resolves: bz#2037135
    (Booting from Local Snapshot Core Dumped Whose Backing File Is Based on RBD)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-7
changelog:
  - kvm-numa-Enable-numa-for-SGX-EPC-sections.patch [bz#1518984]
  - kvm-numa-Support-SGX-numa-in-the-monitor-and-Libvirt-int.patch [bz#1518984]
  - kvm-doc-Add-the-SGX-numa-description.patch [bz#1518984]
  - kvm-Enable-SGX-RH-Only.patch [bz#1518984]
  - kvm-qapi-Cleanup-SGX-related-comments-and-restore-sectio.patch [bz#1518984]
  - kvm-block-io-Update-BSC-only-if-want_zero-is-true.patch [bz#2041480]
  - kvm-iotests-block-status-cache-New-test.patch [bz#2041480]
  - Resolves: bz#1518984
    ([Intel 8.6 Feat] qemu-kvm: SGX 1.5 (SGX1 + Flexible Launch Control) support)
  - Resolves: bz#2041480
    ([incremental_backup] Inconsistent block status reply in qemu-nbd)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-8
changelog:
  - kvm-block-nbd-Delete-reconnect-delay-timer-when-done.patch [bz#2035185]
  - kvm-block-nbd-Assert-there-are-no-timers-when-closed.patch [bz#2035185]
  - kvm-iotests.py-Add-QemuStorageDaemon-class.patch [bz#2035185]
  - kvm-iotests-281-Test-lingering-timers.patch [bz#2035185]
  - kvm-block-nbd-Move-s-ioc-on-AioContext-change.patch [bz#2035185]
  - kvm-iotests-281-Let-NBD-connection-yield-in-iothread.patch [bz#2035185]
  - Resolves: bz#2035185
    (Qemu core dump when start guest with nbd node or do block jobs to nbd node)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-9
changelog:
  - kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch [bz#2062613]
  - kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch [bz#2062613]
  - kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch [bz#2062613]
  - kvm-hw-virtio-vdpa-Fix-leak-of-host-notifier-memory-regi.patch [bz#2060843]
  - kvm-pci-expose-TYPE_XIO3130_DOWNSTREAM-name.patch [bz#2062610]
  - kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch [bz#2062610]
  - kvm-vmxcap-Add-5-level-EPT-bit.patch [bz#2065207]
  - kvm-i386-Add-Icelake-Server-v6-CPU-model-with-5-level-EP.patch [bz#2065207]
  - kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch [bz#2062611]
  - kvm-tests-acpi-whitelist-expected-blobs-before-changing-.patch [bz#2062611]
  - kvm-tests-acpi-add-SLIC-table-test.patch [bz#2062611]
  - kvm-tests-acpi-SLIC-update-expected-blobs.patch [bz#2062611]
  - kvm-tests-acpi-manually-pad-OEM_ID-OEM_TABLE_ID-for-test.patch [bz#2062611]
  - kvm-tests-acpi-whitelist-nvdimm-s-SSDT-and-FACP.slic-exp.patch [bz#2062611]
  - kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch [bz#2062611]
  - kvm-tests-acpi-update-expected-blobs.patch [bz#2062611]
  - kvm-tests-acpi-test-short-OEM_ID-OEM_TABLE_ID-values-in-.patch [bz#2062611]
  - kvm-rhel-workaround-for-lack-of-binary-patches-in-SRPM.patch [bz#2062611]
  - Resolves: bz#2062613
    (Revert IBM-specific Ubuntu-compatibility machine type for 8.6-AV GA [rhel-8.7.0])
  - Resolves: bz#2060843
    ([virtual network][vDPA] qemu crash after hot unplug vdpa device [rhel-8.7.0])
  - Resolves: bz#2062610
    (Do operation to disk will hang in the guest of target host after hotplugging and migrating [rhel-8.7.0])
  - Resolves: bz#2065207
    (Win11 (q35+edk2) guest broke after install wsl2 through 'wsl --install -d Ubuntu-20.04' [rhel-8.7.0])
  - Resolves: bz#2062611
    (Guest can not start with SLIC acpi table [rhel-8.7.0])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-10
changelog:
  - kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch [bz#2068202]
  - kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch [bz#2067118]
  - kvm-iotests-Test-blockdev-reopen-with-iothreads-and-thro.patch [bz#2067118]
  - kvm-s390x-css-fix-PMCW-invalid-mask.patch [bz#2071070]
  - kvm-Set-permission-on-installing-files.patch [bz#2072377]
  - Resolves: bz#2068202
    (RHEL 9.0 guest with vsock device migration failed from RHEL 9.0 > RHEL 8.6 [rhel-8.7.0])
  - Resolves: bz#2067118
    (qemu crash after execute blockdev-reopen with  iothread)
  - Resolves: bz#2071070
    (s390x/css: fix PMCW invalid mask)
  - Resolves: bz#2072377
    (Fix build warnings that occur when installing the keymap files)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-11
changelog:
  - kvm-hw-intc-arm_gicv3-Check-for-MEMTX_OK-instead-of-MEMT.patch [bz#1999236]
  - kvm-softmmu-physmem-Simplify-flatview_write-and-address_.patch [bz#1999236]
  - kvm-softmmu-physmem-Introduce-MemTxAttrs-memory-field-an.patch [bz#1999236]
  - Resolves: bz#1999236
    (CVE-2021-3750 virt:rhel/qemu-kvm: QEMU: hcd-ehci: DMA reentrancy issue leads to use-after-free [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-12
changelog:
  - kvm-display-qxl-render-fix-race-condition-in-qxl_cursor-.patch [bz#2040738]
  - kvm-vhost-vsock-detach-the-virqueue-element-in-case-of-e.patch [bz#2063262]
  - Resolves: bz#2040738
    (CVE-2021-4207 virt:rhel/qemu-kvm: QEMU: QXL: double fetch in qxl_cursor() can lead to heap buffer overflow [rhel-8])
  - Resolves: bz#2063262
    (CVE-2022-26354 virt:rhel/qemu-kvm: QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-13
changelog:
  - kvm-s390x-ipl-support-extended-kernel-command-line-size.patch [bz#2043830]
  - kvm-virtio-net-fix-map-leaking-on-error-during-receive.patch [bz#2063206]
  - kvm-qcow2-Improve-refcount-structure-rebuilding.patch [bz#1519071]
  - kvm-iotests-108-Test-new-refcount-rebuild-algorithm.patch [bz#1519071]
  - kvm-qcow2-Add-errp-to-rebuild_refcount_structure.patch [bz#1519071]
  - kvm-iotests-108-Fix-when-missing-user_allow_other.patch [bz#1519071]
  - Resolves: bz#2043830
    ([IBM 8.7 FEAT] KVM: Allow long kernel command lines for QEMU)
  - Resolves: bz#2063206
    (CVE-2022-26353 virt:rhel/qemu-kvm: QEMU: virtio-net: map leaking on error during receive [rhel-8])
  - Resolves: bz#1519071
    (Fail to rebuild the reference count tables of qcow2 image on host block devices (e.g. LVs))


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-14
changelog:
  - kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch [bz#2065043]
  - kvm-target-i386-properly-reset-TSC-on-reset.patch [bz#2070417]
  - kvm-ui-cursor-fix-integer-overflow-in-cursor_alloc-CVE-2.patch [bz#2040734]
  - Resolves: bz#2065043
    (Remove upstream-only devices from the qemu-kvm binary)
  - Resolves: bz#2070417
    (Windows guest hangs after updating and restarting from the guest OS [rhel-8.7.0])
  - Resolves: bz#2040734
    (CVE-2021-4206 virt:rhel/qemu-kvm: QEMU: QXL: integer overflow in cursor_alloc() can lead to heap buffer overflow [rhel-8.7])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-15
changelog:
  - kvm-virtio-gpu-do-not-byteswap-padding.patch [bz#1916415]
  - kvm-linux-headers-update-to-5.16-rc1.patch [bz#1916415]
  - kvm-linux-headers-Update-headers-to-v5.17-rc1.patch [bz#1916415]
  - kvm-linux-headers-include-missing-changes-from-5.17.patch [bz#1916415]
  - kvm-x86-Fix-the-64-byte-boundary-enumeration-for-extende.patch [bz#1916415]
  - kvm-x86-Add-AMX-XTILECFG-and-XTILEDATA-components.patch [bz#1916415]
  - kvm-x86-Grant-AMX-permission-for-guest.patch [bz#1916415]
  - kvm-x86-Add-XFD-faulting-bit-for-state-components.patch [bz#1916415]
  - kvm-x86-Add-AMX-CPUIDs-enumeration.patch [bz#1916415]
  - kvm-x86-add-support-for-KVM_CAP_XSAVE2-and-AMX-state-mig.patch [bz#1916415]
  - kvm-x86-Support-XFD-and-AMX-xsave-data-migration.patch [bz#1916415]
  - kvm-target-i386-kvm-do-not-access-uninitialized-variable.patch [bz#1916415]
  - kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch [bz#1916415]
  - kvm-virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch [bz#2069946]
  - kvm-virtio-net-align-ctrl_vq-index-for-non-mq-guest-for-.patch [bz#2069946]
  - kvm-vhost-vdpa-fix-improper-cleanup-in-net_init_vhost_vd.patch [bz#2069946]
  - kvm-vhost-net-fix-improper-cleanup-in-vhost_net_start.patch [bz#2069946]
  - kvm-vhost-vdpa-backend-feature-should-set-only-once.patch [bz#2069946]
  - kvm-vhost-vdpa-change-name-and-polarity-for-vhost_vdpa_o.patch [bz#2069946]
  - kvm-virtio-net-don-t-handle-mq-request-in-userspace-hand.patch [bz#2069946]
  - kvm-ide-Increment-BB-in-flight-counter-for-TRIM-BH.patch [bz#2029980]
  - kvm-block-Make-bdrv_refresh_limits-non-recursive.patch [bz#2072932]
  - kvm-iotests-Allow-using-QMP-with-the-QSD.patch [bz#2072932]
  - kvm-iotests-graph-changes-while-io-New-test.patch [bz#2072932]
  - Resolves: bz#1916415
    ([Intel 8.7 FEAT] qemu-kvm Sapphire Rapids (SPR) AMX Instructions)
  - Resolves: bz#2069946
    (PXE boot crash qemu when using multiqueue vDPA)
  - Resolves: bz#2029980
    (Failed assertion in IDE emulation with Ceph backend)
  - Resolves: bz#2072932
    (Qemu coredump when refreshing block limits on an actively used iothread block device [rhel.8.7])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-16
changelog:
  - kvm-virtiofsd-Fix-breakage-due-to-fuse_init_in-size-chan.patch [bz#2097209]
  - kvm-hw-block-fdc-Prevent-end-of-track-overrun-CVE-2021-3.patch [bz#1951521]
  - kvm-tests-qtest-fdc-test-Add-a-regression-test-for-CVE-2.patch [bz#1951521]
  - Resolves: bz#2097209
    ([virtiofs] mount virtiofs failed: SELinux: (dev virtiofs, type virtiofs) getxattr errno 111)
  - Resolves: bz#1951521
    (CVE-2021-3507 virt:rhel/qemu-kvm: QEMU: fdc: heap buffer overflow in DMA read data transfers [rhel-8])


author: Camilla Conte <cconte@redhat.com> - 6.2.0-17
changelog:
  - kvm-migration-Never-call-twice-qemu_target_page_size.patch [bz#2072049]
  - kvm-multifd-Rename-used-field-to-num.patch [bz#2072049]
  - kvm-multifd-Add-missing-documentation.patch [bz#2072049]
  - kvm-multifd-The-variable-is-only-used-inside-the-loop.patch [bz#2072049]
  - kvm-multifd-remove-used-parameter-from-send_prepare-meth.patch [bz#2072049]
  - kvm-multifd-remove-used-parameter-from-send_recv_pages-m.patch [bz#2072049]
  - kvm-multifd-Fill-offset-and-block-for-reception.patch [bz#2072049]
  - kvm-multifd-Make-zstd-compression-method-not-use-iovs.patch [bz#2072049]
  - kvm-multifd-Make-zlib-compression-method-not-use-iovs.patch [bz#2072049]
  - kvm-migration-All-this-fields-are-unsigned.patch [bz#2072049]
  - kvm-multifd-Move-iov-from-pages-to-params.patch [bz#2072049]
  - kvm-multifd-Make-zlib-use-iov-s.patch [bz#2072049]
  - kvm-multifd-Make-zstd-use-iov-s.patch [bz#2072049]
  - kvm-multifd-Remove-send_write-method.patch [bz#2072049]
  - kvm-multifd-Use-a-single-writev-on-the-send-side.patch [bz#2072049]
  - kvm-multifd-Use-normal-pages-array-on-the-send-side.patch [bz#2072049]
  - kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch [bz#2072049]
  - kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch [bz#2072049]
  - kvm-migration-Add-zero-copy-send-parameter-for-QMP-HMP-f.patch [bz#2072049]
  - kvm-migration-Add-migrate_use_tls-helper.patch [bz#2072049]
  - kvm-multifd-multifd_send_sync_main-now-returns-negative-.patch [bz#2072049]
  - kvm-multifd-Send-header-packet-without-flags-if-zero-cop.patch [bz#2072049]
  - kvm-multifd-Implement-zero-copy-write-in-multifd-migrati.patch [bz#2072049]
  - kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch [bz#2072049]
  - kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch [bz#2072049]
  - kvm-migration-Change-zero_copy_send-from-migration-param.patch [bz#2072049]
  - kvm-migration-Add-migration_incoming_transport_cleanup.patch [bz#2097652]
  - kvm-migration-Allow-migrate-recover-to-run-multiple-time.patch [bz#2097652]
  - kvm-pc-bios-s390-ccw-virtio-Introduce-a-macro-for-the-DA.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-bootmap-Improve-the-guessing-logic-.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-blkdev-Simplify-fix-virtio_i.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-blkdev-Remove-virtio_assume_.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-Set-missing-status-bits-whil.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-Read-device-config-after-fea.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-Beautify-the-code-for-readin.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-Split-virtio-scsi-code-from-virtio_.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-blkdev-Request-the-right-fea.patch [bz#2098076]
  - Resolves: bz#2072049
    (Pull  MSG_ZEROCOPY on QEMU Live Migration Patches into RHEL 8)
  - Resolves: bz#2097652
    (The migration port is not released if use it again for recovering postcopy migration)
  - Resolves: bz#2098076
    (virtio-blk: Can't boot fresh installation from used virtio-blk dasd disk under certain conditions)


author: Camilla Conte <cconte@redhat.com> - 6.2.0-18
changelog:
  - kvm-linux-aio-fix-unbalanced-plugged-counter-in-laio_io_.patch [bz#2105410]
  - kvm-linux-aio-explain-why-max-batch-is-checked-in-laio_i.patch [bz#2105410]
  - Resolves: bz#2105410
    (Stalled IO Operations in VM)


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-19
changelog:
  - kvm-migration-Introduce-ram_transferred_add.patch [bz#2110203]
  - kvm-migration-Tally-pre-copy-downtime-and-post-copy-byte.patch [bz#2110203]
  - kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch [bz#2110203]
  - kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch [bz#2110203]
  - kvm-migration-multifd-Report-to-user-when-zerocopy-not-w.patch [bz#2110203]
  - kvm-migration-Avoid-false-positive-on-non-supported-scen.patch [bz#2110203]
  - kvm-migration-add-remaining-params-has_-true-in-migratio.patch [bz#2110203]
  - kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch [bz#2110203]
  - kvm-pc-bios-s390-ccw-Fix-booting-with-logical-block-size.patch [bz#2112296]
  - Resolves: bz#2110203
    (zerocopy capability can be enabled when set migrate capabilities with multifd and compress/xbzrle together)
  - Resolves: bz#2112296
    (virtio-blk: Can't boot fresh installation from used 512 cluster_size image under certain conditions)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-20
changelog:
  - kvm-scsi-generic-Fix-emulated-block-limits-VPD-page.patch [bz#2120279]
  - Resolves: bz#2120279
    (Wrong max_sectors_kb and Maximum transfer length on the pass-through device [rhel-8.7])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-21
changelog:
  - kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch [bz#2117149]
  - kvm-i386-reset-KVM-nested-state-upon-CPU-reset.patch [bz#2125271]
  - kvm-i386-do-kvm_put_msr_feature_control-first-thing-when.patch [bz#2125271]
  - Resolves: bz#2117149
    (Can't run when memory backing with hugepages and backend type memfd)
  - Resolves: bz#2125271
    ([RHEL8.7] Guests in VMX root operation fail to reboot with QEMU's 'system_reset' command [rhel-8.8.0])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-22
changelog:
  - kvm-redhat-Update-linux-headers-linux-kvm.h-to-v5.18-rc6.patch [bz#2124757]
  - kvm-target-s390x-kvm-Honor-storage-keys-during-emulation.patch [bz#2124757]
  - kvm-virtiofsd-use-g_date_time_get_microsecond-to-get-sub.patch [bz#2018885]
  - Resolves: bz#2124757
    (RHEL8: skey test in kvm_unit_test got failed)
  - Resolves: bz#2018885
    ([virtiofs] virtiofsd debug log's timestamp is NULL)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-23
changelog:
  - kvm-virtio-fix-the-condition-for-iommu_platform-not-supp.patch [bz#2116302]
  - kvm-virtio-fix-feature-negotiation-for-ACCESS_PLATFORM.patch [bz#2116302]
  - Resolves: bz#2116302
    (RHEL8.6 - virtiofs will not mount fs on secure execution guest)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-24
changelog:
  - kvm-s390x-pci-use-a-reserved-ID-for-the-default-PCI-grou.patch [bz#1664378 bz#2043909]
  - kvm-s390x-pci-don-t-use-hard-coded-dma-range-in-reg_ioat.patch [bz#1664378 bz#2043909]
  - kvm-s390x-pci-use-the-passthrough-measurement-update-int.patch [bz#1664378 bz#2043909]
  - kvm-s390x-pci-add-supported-DT-information-to-clp-respon.patch [bz#1664378 bz#2043909]
  - kvm-Update-linux-headers-to-v6.0-rc4.patch [bz#1664378 bz#2043909]
  - kvm-s390x-pci-add-routine-to-get-host-function-handle-fr.patch [bz#1664378 bz#2043909]
  - kvm-s390x-pci-enable-for-load-store-interpretation.patch [bz#1664378 bz#2043909]
  - kvm-s390x-pci-don-t-fence-interpreted-devices-without-MS.patch [bz#1664378 bz#2043909]
  - kvm-s390x-pci-enable-adapter-event-notification-for-inte.patch [bz#1664378 bz#2043909]
  - kvm-s390x-pci-let-intercept-devices-have-separate-PCI-gr.patch [bz#1664378 bz#2043909]
  - kvm-s390x-pci-reflect-proper-maxstbl-for-groups-of-inter.patch [bz#1664378 bz#2043909]
  - kvm-s390x-s390-virtio-ccw-Switch-off-zPCI-enhancements-o.patch [bz#1664378 bz#2043909]
  - kvm-dump-Use-ERRP_GUARD.patch [bz#1664378 bz#2043909]
  - kvm-dump-Remove-the-sh_info-variable.patch [bz#1664378 bz#2043909]
  - kvm-dump-Introduce-shdr_num-to-decrease-complexity.patch [bz#1664378 bz#2043909]
  - kvm-dump-Remove-the-section-if-when-calculating-the-memo.patch [bz#1664378 bz#2043909]
  - kvm-dump-Add-more-offset-variables.patch [bz#1664378 bz#2043909]
  - kvm-dump-Introduce-dump_is_64bit-helper-function.patch [bz#1664378 bz#2043909]
  - kvm-dump-Consolidate-phdr-note-writes.patch [bz#1664378 bz#2043909]
  - kvm-dump-Cleanup-dump_begin-write-functions.patch [bz#1664378 bz#2043909]
  - kvm-dump-Consolidate-elf-note-function.patch [bz#1664378 bz#2043909]
  - kvm-dump-Replace-opaque-DumpState-pointer-with-a-typed-o.patch [bz#1664378 bz#2043909]
  - kvm-dump-Rename-write_elf_loads-to-write_elf_phdr_loads.patch [bz#1664378 bz#2043909]
  - kvm-dump-Refactor-dump_iterate-and-introduce-dump_filter.patch [bz#1664378 bz#2043909]
  - kvm-dump-Rework-get_start_block.patch [bz#1664378 bz#2043909]
  - kvm-dump-Rework-filter-area-variables.patch [bz#1664378 bz#2043909]
  - kvm-dump-Rework-dump_calculate_size-function.patch [bz#1664378 bz#2043909]
  - kvm-dump-Split-elf-header-functions-into-prepare-and-wri.patch [bz#1664378 bz#2043909]
  - kvm-dump-Rename-write_elf-_phdr_note-to-prepare_elf-_phd.patch [bz#1664378 bz#2043909]
  - kvm-dump-simplify-a-bit-kdump-get_next_page.patch [bz#1664378 bz#2043909]
  - kvm-dump-fix-kdump-to-work-over-non-aligned-blocks.patch [bz#1664378 bz#2043909]
  - kvm-dump-Use-a-buffer-for-ELF-section-data-and-headers.patch [bz#1664378 bz#2043909]
  - kvm-dump-Write-ELF-section-headers-right-after-ELF-heade.patch [bz#1664378 bz#2043909]
  - kvm-dump-Reorder-struct-DumpState.patch [bz#1664378 bz#2043909]
  - kvm-dump-Reintroduce-memory_offset-and-section_offset.patch [bz#1664378 bz#2043909]
  - kvm-dump-Add-architecture-section-and-section-string-tab.patch [bz#1664378 bz#2043909]
  - kvm-s390x-Add-protected-dump-cap.patch [bz#1664378 bz#2043909]
  - kvm-s390x-Introduce-PV-query-interface.patch [bz#1664378 bz#2043909]
  - kvm-include-elf.h-add-s390x-note-types.patch [bz#1664378 bz#2043909]
  - kvm-s390x-Add-KVM-PV-dump-interface.patch [bz#1664378 bz#2043909]
  - kvm-s390x-pv-Add-dump-support.patch [bz#1664378 bz#2043909]
  - kvm-ui-vnc-clipboard-fix-integer-underflow-in-vnc_client.patch [bz#2129760]
  - Resolves: bz#1664378
    ([IBM 8.8 FEAT] Enhanced Interpretation for PCI Functions (kvm) - qemu part)
  - Resolves: bz#2043909
    ([IBM 8.8 FEAT] KVM: Secure Execution guest dump encryption with customer keys - qemu part)
  - Resolves: bz#2129760
    (CVE-2022-3165 virt:rhel/qemu-kvm: QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-25
changelog:
  - kvm-hw-acpi-Add-ospm_status-hook-implementation-for-acpi.patch [bz#2132609]
  - kvm-target-arm-kvm-Retry-KVM_CREATE_VM-call-if-it-fails-.patch [bz#2132609]
  - Resolves: bz#2132609
    (qemu-kvm: backport some aarch64 fixes)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-26
changelog:
  - kvm-docs-system-s390x-Document-the-loadparm-machine-prop.patch [bz#2128225]
  - kvm-s390x-Register-TYPE_S390_CCW_MACHINE-properties-as-c.patch [bz#2128225]
  - kvm-ui-vnc.c-Fixed-a-deadlock-bug.patch [bz#2141896]
  - Resolves: bz#2128225
    ([s390x] [RHEL8][s390x-ccw bios] lacking document about parameter loadparm in qemu)
  - Resolves: bz#2141896
    (VMs hung on vnc_clipboard_send)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-27
changelog:
  - kvm-hw-display-qxl-Have-qxl_log_command-Return-early-if-.patch [bz#2148545]
  - kvm-hw-display-qxl-Document-qxl_phys2virt.patch [bz#2148545]
  - kvm-hw-display-qxl-Pass-requested-buffer-size-to-qxl_phy.patch [bz#2148545]
  - kvm-hw-display-qxl-Avoid-buffer-overrun-in-qxl_phys2virt.patch [bz#2148545]
  - kvm-hw-display-qxl-Assert-memory-slot-fits-in-preallocat.patch [bz#2148545]
  - Resolves: bz#2148545
    (CVE-2022-4144 virt:rhel/qemu-kvm: QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-28
changelog:
  - kvm-s390x-tod-kvm-don-t-save-restore-the-TOD-in-PV-guest.patch [bz#2155448]
  - Resolves: bz#2155448
    (RHEL8.8 - KVM: s390: pv: don't allow userspace to set the clock under PV - QEMU part)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-29
changelog:
  - kvm-block-mirror-Do-not-wait-for-active-writes.patch [bz#2125119]
  - kvm-block-mirror-Drop-mirror_wait_for_any_operation.patch [bz#2125119]
  - kvm-block-mirror-Fix-NULL-s-job-in-active-writes.patch [bz#2125119]
  - kvm-accel-introduce-accelerator-blocker-API.patch [bz#2161188]
  - kvm-KVM-keep-track-of-running-ioctls.patch [bz#2161188]
  - kvm-kvm-Atomic-memslot-updates.patch [bz#2161188]
  - kvm-migration-Read-state-once.patch [bz#2074205]
  - kvm-s390x-pci-RPCIT-second-pass-when-mappings-exhausted.patch [bz#2163713]
  - kvm-s390x-pci-coalesce-unmap-operations.patch [bz#2163713]
  - kvm-s390x-pci-shrink-DMA-aperture-to-be-bound-by-vfio-DM.patch [bz#2163713]
  - kvm-s390x-pci-reset-ISM-passthrough-devices-on-shutdown-.patch [bz#2163713]
  - Resolves: bz#2125119
    (Mirror job with "copy-mode":"write-blocking" that used for storage migration can't converge under heavy I/O)
  - Resolves: bz#2161188
    (SVM: non atomic memslot updates cause boot failure with seabios and cpu-pm=on)
  - Resolves: bz#2074205
    (while live-migrating many instances concurrently, libvirt sometimes return internal error: migration was active, but no RAM info was set)
  - Resolves: bz#2163713
    ([s390x] VM fails to start with ISM passed through)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-30
changelog:
  - kvm-qcow2-Fix-theoretical-corruption-in-store_bitmap-err.patch [bz#2147617]
  - kvm-qemu-img-commit-Report-errors-while-closing-the-imag.patch [bz#2147617]
  - kvm-qemu-img-bitmap-Report-errors-while-closing-the-imag.patch [bz#2147617]
  - kvm-qemu-iotests-Test-qemu-img-bitmap-commit-exit-code-o.patch [bz#2147617]
  - Resolves: bz#2147617
    (qemu-img finishes successfully while having errors in commit or bitmaps operations)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-31
changelog:
  - kvm-io-Add-support-for-MSG_PEEK-for-socket-channel.patch [bz#2137740]
  - kvm-migration-check-magic-value-for-deciding-the-mapping.patch [bz#2137740]
  - kvm-target-s390x-arch_dump-Fix-memory-corruption-in-s390.patch [bz#2168187]
  - Resolves: bz#2137740
    (Multifd migration fails under a weak network/socket ordering race)
  - Resolves: bz#2168187
    ([s390x] qemu-kvm coredumps when SE crashes)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-32.el8_8
changelog:
  - kvm-aio_wait_kick-add-missing-memory-barrier.patch [bz#2168472]
  - kvm-qatomic-add-smp_mb__before-after_rmw.patch [bz#2168472]
  - kvm-qemu-thread-posix-cleanup-fix-document-QemuEvent.patch [bz#2168472]
  - kvm-qemu-thread-win32-cleanup-fix-document-QemuEvent.patch [bz#2168472]
  - kvm-edu-add-smp_mb__after_rmw.patch [bz#2168472]
  - kvm-aio-wait-switch-to-smp_mb__after_rmw.patch [bz#2168472]
  - kvm-qemu-coroutine-lock-add-smp_mb__after_rmw.patch [bz#2168472]
  - kvm-physmem-add-missing-memory-barrier.patch [bz#2168472]
  - kvm-async-update-documentation-of-the-memory-barriers.patch [bz#2168472]
  - kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch [bz#2168472]
  - kvm-scsi-protect-req-aiocb-with-AioContext-lock.patch [bz#2090990]
  - kvm-dma-helpers-prevent-dma_blk_cb-vs-dma_aio_cancel-rac.patch [bz#2090990]
  - kvm-virtio-scsi-reset-SCSI-devices-from-main-loop-thread.patch [bz#2090990]
  - Resolves: bz#2168472
    (Guest hangs when starting or rebooting)
  - Resolves: bz#2090990
    (qemu crash with error scsi_req_unref(SCSIRequest *): Assertion `req->refcount > 0' failed or scsi_dma_complete(void *, int): Assertion `r->req.aiocb != NULL' failed [8.7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-33
changelog:
  - kvm-s390x-pv-Implement-a-CGS-check-helper.patch [bz#2187159]
  - Resolves: bz#2187159
    (RHEL8.8 - KVM - Secure Guest crashed during booting with 248 vcpus)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-40
changelog:
  - kvm-ui-vnc-clipboard-fix-infinite-loop-in-inflate_buffer.patch [bz#2218488]
  - Resolves: bz#2218488
    (CVE-2023-3255 virt:rhel/qemu-kvm: QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-41
changelog:
  - kvm-s390x-ap-fix-missing-subsystem-reset-registration.patch [bz#2111390]
  - kvm-s390x-do-a-subsystem-reset-before-the-unprotect-on-r.patch [bz#2111390]
  - kvm-redhat-Update-linux-headers-for-kvm_s390_vm_cpu_uv_f.patch [bz#2111390]
  - kvm-target-s390x-kvm-Refactor-AP-functionalities.patch [bz#2111390]
  - kvm-target-s390x-AP-passthrough-for-PV-guests.patch [bz#2111390]
  - Resolves: bz#2111390
    ([IBM 8.10 FEAT] KVM: Enable Secure Execution Crypto Passthrough - qemu part)


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-42
changelog:
  - kvm-target-s390x-dump-Remove-unneeded-dump-info-function.patch [RHEL-16696]
  - kvm-dump-Add-arch-cleanup-function.patch [RHEL-16696]
  - kvm-target-s390x-arch_dump-Add-arch-cleanup-function-for.patch [RHEL-16696]
  - Resolves: RHEL-16696
    (RHEL8 - KVM : Secure execution guest remains in "paused" state, post "virsh dump" failure (qemu-kvm))


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-43
changelog:
  - kvm-net-Provide-MemReentrancyGuard-to-qemu_new_nic.patch [RHEL-7309]
  - kvm-net-Update-MemReentrancyGuard-for-NIC.patch [RHEL-7309]
  - kvm-vhost-release-memory_listener-object-in-error-path.patch [RHEL-7567]
  - kvm-ui-fix-crash-when-there-are-no-active_console.patch [RHEL-2600]
  - Resolves: RHEL-7309
    (CVE-2023-3019 virt:rhel/qemu-kvm: QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest() [rhel-8])
  - Resolves: RHEL-7567
    ([RHEL8][clone]VM crash when guest running testpmd and delete created vhostuserclient port on host)
  - Resolves: RHEL-2600
    (qemu core dump occurs when client connects to VNC server because qemu cmd only adds vnc but without graphics device)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-44
changelog:
  - kvm-hw-ide-reset-cancel-async-DMA-operation-before-reset.patch [RHEL-15437]
  - kvm-tests-qtest-ahci-test-add-test-exposing-reset-issue-.patch [RHEL-15437]
  - Resolves: RHEL-15437
    (CVE-2023-5088 virt:rhel/qemu-kvm: QEMU: improper IDE controller reset can lead to MBR overwrite [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-45
changelog:
  - kvm-acpi-fix-acpi_index-migration.patch [RHEL-20189]
  - kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch [RHEL-20189]
  - kvm-hw-arm-virt-Do-not-load-efi-virtio.rom-for-all-virti.patch [RHEL-14870]
  - Resolves: RHEL-20189
    ([RHEL.8.10.0]Failed to migrate guest with pc (i440x)  between RHELAV 8.4.0 and RHEL 8.10.0)
  - Resolves: RHEL-14870
    ([rhel8]ipxe-roms-qemu does not provide efi-virtio.rom)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-46
changelog:
  - kvm-MAINTAINERS-split-out-s390x-sections.patch [RHEL-18214]
  - kvm-s390x-pv-remove-semicolon-from-macro-definition.patch [RHEL-18214]
  - kvm-hw-s390x-pv-Restrict-Protected-Virtualization-to-sys.patch [RHEL-18214]
  - kvm-hw-s390x-Move-KVM-specific-PV-from-hw-to-target-s390.patch [RHEL-18214]
  - kvm-target-s390x-kvm-pv-Provide-some-more-useful-informa.patch [RHEL-18214]
  - Resolves: RHEL-18214
    ([RHEL8][Secure-execution][s390x]  The error message is not clear when boot up a SE guest with wrong encryption)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-47
changelog:
  - kvm-s390x-pci-avoid-double-enable-disable-of-aif.patch [RHEL-22411]
  - kvm-s390x-pci-refresh-fh-before-disabling-aif.patch [RHEL-22411]
  - kvm-s390x-pci-drive-ISM-reset-from-subsystem-reset.patch [RHEL-22411]
  - Resolves: RHEL-22411
    ([s390x] VM fails to start with ISM passed through)


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-48
changelog:
  - kvm-iotests-add-filter_qmp_generated_node_ids.patch [RHEL-7353]
  - kvm-iotests-port-141-to-Python-for-reliable-QMP-testing.patch [RHEL-7353]
  - kvm-monitor-only-run-coroutine-commands-in-qemu_aio_cont.patch [RHEL-7353]
  - kvm-iotests-Make-144-deterministic-again.patch [RHEL-7353]
  - Resolves: RHEL-7353
    ([qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-8])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-49
changelog:
  - kvm-glib-compat-Introduce-g_memdup2-wrapper.patch [RHEL-19628]
  - kvm-ui-clipboard-mark-type-as-not-available-when-there-i.patch [RHEL-19628]
  - kvm-virtio-net-correctly-copy-vnet-header-when-flushing-.patch [RHEL-19496]
  - Resolves: RHEL-19628
    (CVE-2023-6683 virt:rhel/qemu-kvm: QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() [rhel-8])
  - Resolves: RHEL-19496
    (CVE-2023-6693 virt:rhel/qemu-kvm: QEMU: virtio-net: stack buffer overflow in virtio_net_flush_tx() [rhel-8])


author: Jacob Wang <jacob.wang@openanolis.org> - 6.2.0-49.0.1
changelog:
  - Adjust limit for virtiofsd minor version
  - Add loongarch supporti (lixianglai@loongson.cn)
  - Add package qemu-user-static (fuyuan.wh@alibaba-inc.com)
  - Modify-smbios-option-lack-and-Modify-the-maximum-num.patch (lixianglai@loongson.cn)
  - rename-kvm_msr_buf-with-kvm_csr_buf.patch (lixianglai@loongson.cn)
  - code-cleanup-for-loongarch-kvm.patch (lixianglai@loongson.cn)
  - Support-TPM.patch (lixianglai@loongson.cn)
  - kvm-csr-save-and-restore-optimization.patch (lixianglai@loongson.cn)
  - address-space-code-cleanup-on-7A-virt-machine.patch (lixianglai@loongson.cn)
  - Fix-irq-routing-and-fpu-option-to-compat-with-kernel.patch (lixianglai@loongson.cn)
  - Support-vfio-config.patch (lixianglai@loongson.cn)
  - pass-to-make-check.patch (lixianglai@loongson.cn)
  - fixup-can-t-find-cpu-type.patch (lixianglai@loongson.cn)
  - fix-smbios-type4-info-for-numa-support.patch (lixianglai@loongson.cn)
  - Fix-smp.cores-value.patch (lixianglai@loongson.cn)
  - Add-lbt-support-for-kvm.patch (lixianglai@loongson.cn)
  - Modify-the-ioctl-command-of-kvm.patch (lixianglai@loongson.cn)
  - Add-usb-storage-config-for-loongarch.patch (zhaotianrui@loongson.c)
  - Add-loongarch-into-QEMU_ARCH_VIRTIO_PCI-to-support-q.patch (zhaotianrui@loongson.c)
  - Fix-host-architecture-macro-of-LoongArch-to-HOST_LOO.patch (zhaotianrui@loongson.c)
  - Fix-LoongArch-KVM-header-macros.patch (zhaotianrui@loongson.c)
  - loongarch: Fixed the issue where qemu specifies the boot order (lixianglai@loongson.cn)
  - Fix CVE-2023-3354 (Liwei Ge <liwei.glw@alibaba-inc.com>)
  - 0001-anolis-csv-i386-add-CSV-context.patch (jiangxin@hygon.cn)
  - 0002-anolis-csv-i386-add-command-to-initialize-CSV-contex.patch (jiangxin@hygon.cn)
  - 0003-anolis-csv-i386-add-command-to-load-data-to-guest-me.patch (jiangxin@hygon.cn)
  - 0004-anolis-csv-i386-add-command-to-load-vmcb-to-guest-me.patch (jiangxin@hygon.cn)
  - 0005-anolis-cpu-i386-populate-CPUID-0x8000_001F-when-CSV-.patch (jiangxin@hygon.cn)
  - 0006-anolis-csv-i386-CSV-guest-do-not-need-register-unreg.patch (jiangxin@hygon.cn)
  - 0007-anolis-target-i386-csv-load-initial-image-to-private.patch (jiangxin@hygon.cn)
  - 0008-anolis-vga-force-full-update-for-CSV-guest.patch (jiangxin@hygon.cn)
    (Hygon CSV3 feature)
  - Support Hygon CSV/CSV2 live migration, CSV2 reboot (hanliyang@hygon.cn)
  - Support CSV3 live migration (jiangxin@hygon.cn)
  - CVE-2023-3019 virt:rhel/qemu-kvm: QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest() (wangkaiqiang.inspur.com)
  - Support reuse ASID for CSV guests (hanliyang@hygon.cn)
  - Support tkm key isolation (xiongmengbiao@hygon.cn)


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-50
changelog:
  - kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch [RHEL-35616]
  - kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch [RHEL-35616]
  - kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch [RHEL-35616]
  - kvm-block-introduce-bdrv_open_file_child-helper.patch [RHEL-35616]
  - kvm-block-Parse-filenames-only-when-explicitly-requested.patch [RHEL-35616]
  - Resolves: RHEL-35616
    (CVE-2024-4467 virt:rhel/qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-8.10.z])


author: Jacob Wang <jacob.wang@openanolis.org> - 6.2.0-50.0.1
changelog:
  - Adjust limit for virtiofsd minor version
  - Add loongarch supporti (lixianglai@loongson.cn)
  - Add package qemu-user-static (fuyuan.wh@alibaba-inc.com)
  - Modify-smbios-option-lack-and-Modify-the-maximum-num.patch (lixianglai@loongson.cn)
  - rename-kvm_msr_buf-with-kvm_csr_buf.patch (lixianglai@loongson.cn)
  - code-cleanup-for-loongarch-kvm.patch (lixianglai@loongson.cn)
  - Support-TPM.patch (lixianglai@loongson.cn)
  - kvm-csr-save-and-restore-optimization.patch (lixianglai@loongson.cn)
  - address-space-code-cleanup-on-7A-virt-machine.patch (lixianglai@loongson.cn)
  - Fix-irq-routing-and-fpu-option-to-compat-with-kernel.patch (lixianglai@loongson.cn)
  - Support-vfio-config.patch (lixianglai@loongson.cn)
  - pass-to-make-check.patch (lixianglai@loongson.cn)
  - fixup-can-t-find-cpu-type.patch (lixianglai@loongson.cn)
  - fix-smbios-type4-info-for-numa-support.patch (lixianglai@loongson.cn)
  - Fix-smp.cores-value.patch (lixianglai@loongson.cn)
  - Add-lbt-support-for-kvm.patch (lixianglai@loongson.cn)
  - Modify-the-ioctl-command-of-kvm.patch (lixianglai@loongson.cn)
  - Add-usb-storage-config-for-loongarch.patch (zhaotianrui@loongson.c)
  - Add-loongarch-into-QEMU_ARCH_VIRTIO_PCI-to-support-q.patch (zhaotianrui@loongson.c)
  - Fix-host-architecture-macro-of-LoongArch-to-HOST_LOO.patch (zhaotianrui@loongson.c)
  - Fix-LoongArch-KVM-header-macros.patch (zhaotianrui@loongson.c)
  - loongarch: Fixed the issue where qemu specifies the boot order (lixianglai@loongson.cn)
  - 0001-anolis-csv-i386-add-CSV-context.patch (jiangxin@hygon.cn)
  - 0002-anolis-csv-i386-add-command-to-initialize-CSV-contex.patch (jiangxin@hygon.cn)
  - 0003-anolis-csv-i386-add-command-to-load-data-to-guest-me.patch (jiangxin@hygon.cn)
  - 0004-anolis-csv-i386-add-command-to-load-vmcb-to-guest-me.patch (jiangxin@hygon.cn)
  - 0005-anolis-cpu-i386-populate-CPUID-0x8000_001F-when-CSV-.patch (jiangxin@hygon.cn)
  - 0006-anolis-csv-i386-CSV-guest-do-not-need-register-unreg.patch (jiangxin@hygon.cn)
  - 0007-anolis-target-i386-csv-load-initial-image-to-private.patch (jiangxin@hygon.cn)
  - 0008-anolis-vga-force-full-update-for-CSV-guest.patch (jiangxin@hygon.cn)
    (Hygon CSV3 feature)
  - Support Hygon CSV/CSV2 live migration, CSV2 reboot (hanliyang@hygon.cn)
  - Support CSV3 live migration (jiangxin@hygon.cn)
  - Support reuse ASID for CSV guests (hanliyang@hygon.cn)
  - Support tkm key isolation (xiongmengbiao@hygon.cn)
  - Add Hygon Dhyana-v3 and Dharma CPU model (zhouyanjing@hygon.cn)


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-51.el8
changelog:
  - kvm-virtio-gpu-free-BHs-by-implementing-unrealize.patch [RHEL-32276]
  - kvm-virtio-gpu-reset-gfx-resources-in-main-thread.patch [RHEL-32276]
  - kvm-hw-virtio-Introduce-virtio_bh_new_guarded-helper.patch [RHEL-32276]
  - kvm-hw-display-virtio-gpu-Protect-from-DMA-re-entrancy-b.patch [RHEL-32276]
  - kvm-hw-char-virtio-serial-bus-Protect-from-DMA-re-entran.patch [RHEL-32276]
  - kvm-hw-virtio-virtio-crypto-Protect-from-DMA-re-entrancy.patch [RHEL-32276]
  - Resolves: RHEL-32276
    (CVE-2024-3446 virt:rhel/qemu-kvm: QEMU: virtio: DMA reentrancy issue leads to double free vulnerability [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-52.el8
changelog:
  - kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch [RHEL-52611]
  - kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch [RHEL-52611]
  - kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch [RHEL-52611]
  - kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch [RHEL-52611]
  - kvm-vnc-increase-max-display-size.patch [RHEL-50854]
  - Resolves: RHEL-52611
    (CVE-2024-7409 virt:rhel/qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-8.10.z])
  - Resolves: RHEL-50854
    (vnc: increase max display size to 4K)


author: Jacob Wang <jacob.wang@openanolis.org> - 6.2.0-52.0.1
changelog:
  - Adjust limit for virtiofsd minor version
  - Add loongarch supporti (lixianglai@loongson.cn)
  - Add package qemu-user-static (fuyuan.wh@alibaba-inc.com)
  - Modify-smbios-option-lack-and-Modify-the-maximum-num.patch (lixianglai@loongson.cn)
  - rename-kvm_msr_buf-with-kvm_csr_buf.patch (lixianglai@loongson.cn)
  - code-cleanup-for-loongarch-kvm.patch (lixianglai@loongson.cn)
  - Support-TPM.patch (lixianglai@loongson.cn)
  - kvm-csr-save-and-restore-optimization.patch (lixianglai@loongson.cn)
  - address-space-code-cleanup-on-7A-virt-machine.patch (lixianglai@loongson.cn)
  - Fix-irq-routing-and-fpu-option-to-compat-with-kernel.patch (lixianglai@loongson.cn)
  - Support-vfio-config.patch (lixianglai@loongson.cn)
  - pass-to-make-check.patch (lixianglai@loongson.cn)
  - fixup-can-t-find-cpu-type.patch (lixianglai@loongson.cn)
  - fix-smbios-type4-info-for-numa-support.patch (lixianglai@loongson.cn)
  - Fix-smp.cores-value.patch (lixianglai@loongson.cn)
  - Add-lbt-support-for-kvm.patch (lixianglai@loongson.cn)
  - Modify-the-ioctl-command-of-kvm.patch (lixianglai@loongson.cn)
  - Add-usb-storage-config-for-loongarch.patch (zhaotianrui@loongson.c)
  - Add-loongarch-into-QEMU_ARCH_VIRTIO_PCI-to-support-q.patch (zhaotianrui@loongson.c)
  - Fix-host-architecture-macro-of-LoongArch-to-HOST_LOO.patch (zhaotianrui@loongson.c)
  - Fix-LoongArch-KVM-header-macros.patch (zhaotianrui@loongson.c)
  - loongarch: Fixed the issue where qemu specifies the boot order (lixianglai@loongson.cn)
  - 0001-anolis-csv-i386-add-CSV-context.patch (jiangxin@hygon.cn)
  - 0002-anolis-csv-i386-add-command-to-initialize-CSV-contex.patch (jiangxin@hygon.cn)
  - 0003-anolis-csv-i386-add-command-to-load-data-to-guest-me.patch (jiangxin@hygon.cn)
  - 0004-anolis-csv-i386-add-command-to-load-vmcb-to-guest-me.patch (jiangxin@hygon.cn)
  - 0005-anolis-cpu-i386-populate-CPUID-0x8000_001F-when-CSV-.patch (jiangxin@hygon.cn)
  - 0006-anolis-csv-i386-CSV-guest-do-not-need-register-unreg.patch (jiangxin@hygon.cn)
  - 0007-anolis-target-i386-csv-load-initial-image-to-private.patch (jiangxin@hygon.cn)
  - 0008-anolis-vga-force-full-update-for-CSV-guest.patch (jiangxin@hygon.cn)
    (Hygon CSV3 feature)
  - Support Hygon CSV/CSV2 live migration, CSV2 reboot (hanliyang@hygon.cn)
  - Support CSV3 live migration (jiangxin@hygon.cn)
  - Support reuse ASID for CSV guests (hanliyang@hygon.cn)
  - Support tkm key isolation (xiongmengbiao@hygon.cn)
  - Add Hygon Dhyana-v3 and Dharma CPU model (zhouyanjing@hygon.cn)
  - Intel-SIG: Supprt Intel SPR/GNR/SRF new ISAs and cpu models (quanxian.wang@intel.com)


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-53.el8
changelog:
  - kvm-nbd-server-Favor-qemu_aio_context-over-iohandler-con.patch [RHEL-52611]
  - kvm-iotests-test-NBD-TLS-iothread.patch [RHEL-52611]
  - kvm-nbd-server-CVE-2024-7409-Avoid-use-after-free-when-c.patch [RHEL-52611]
  - Resolves: RHEL-52611
    (CVE-2024-7409 virt:rhel/qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-8.10.z])


author: Jacob Wang <jacob.wang@openanolis.org> - 6.2.0-53.0.1
changelog:
  - Adjust limit for virtiofsd minor version
  - Add loongarch supporti (lixianglai@loongson.cn)
  - Add package qemu-user-static (fuyuan.wh@alibaba-inc.com)
  - Modify-smbios-option-lack-and-Modify-the-maximum-num.patch (lixianglai@loongson.cn)
  - rename-kvm_msr_buf-with-kvm_csr_buf.patch (lixianglai@loongson.cn)
  - code-cleanup-for-loongarch-kvm.patch (lixianglai@loongson.cn)
  - Support-TPM.patch (lixianglai@loongson.cn)
  - kvm-csr-save-and-restore-optimization.patch (lixianglai@loongson.cn)
  - address-space-code-cleanup-on-7A-virt-machine.patch (lixianglai@loongson.cn)
  - Fix-irq-routing-and-fpu-option-to-compat-with-kernel.patch (lixianglai@loongson.cn)
  - Support-vfio-config.patch (lixianglai@loongson.cn)
  - pass-to-make-check.patch (lixianglai@loongson.cn)
  - fixup-can-t-find-cpu-type.patch (lixianglai@loongson.cn)
  - fix-smbios-type4-info-for-numa-support.patch (lixianglai@loongson.cn)
  - Fix-smp.cores-value.patch (lixianglai@loongson.cn)
  - Add-lbt-support-for-kvm.patch (lixianglai@loongson.cn)
  - Modify-the-ioctl-command-of-kvm.patch (lixianglai@loongson.cn)
  - Add-usb-storage-config-for-loongarch.patch (zhaotianrui@loongson.c)
  - Add-loongarch-into-QEMU_ARCH_VIRTIO_PCI-to-support-q.patch (zhaotianrui@loongson.c)
  - Fix-host-architecture-macro-of-LoongArch-to-HOST_LOO.patch (zhaotianrui@loongson.c)
  - Fix-LoongArch-KVM-header-macros.patch (zhaotianrui@loongson.c)
  - loongarch: Fixed the issue where qemu specifies the boot order (lixianglai@loongson.cn)
  - 0001-anolis-csv-i386-add-CSV-context.patch (jiangxin@hygon.cn)
  - 0002-anolis-csv-i386-add-command-to-initialize-CSV-contex.patch (jiangxin@hygon.cn)
  - 0003-anolis-csv-i386-add-command-to-load-data-to-guest-me.patch (jiangxin@hygon.cn)
  - 0004-anolis-csv-i386-add-command-to-load-vmcb-to-guest-me.patch (jiangxin@hygon.cn)
  - 0005-anolis-cpu-i386-populate-CPUID-0x8000_001F-when-CSV-.patch (jiangxin@hygon.cn)
  - 0006-anolis-csv-i386-CSV-guest-do-not-need-register-unreg.patch (jiangxin@hygon.cn)
  - 0007-anolis-target-i386-csv-load-initial-image-to-private.patch (jiangxin@hygon.cn)
  - 0008-anolis-vga-force-full-update-for-CSV-guest.patch (jiangxin@hygon.cn)
    (Hygon CSV3 feature)
  - Support Hygon CSV/CSV2 live migration, CSV2 reboot (hanliyang@hygon.cn)
  - Support CSV3 live migration (jiangxin@hygon.cn)
  - Support reuse ASID for CSV guests (hanliyang@hygon.cn)
  - Support tkm key isolation (xiongmengbiao@hygon.cn)
  - Add Hygon Dhyana-v3 and Dharma CPU model (zhouyanjing@hygon.cn)
  - Intel-SIG: Supprt Intel SPR/GNR/SRF new ISAs and cpu models (quanxian.wang@intel.com)
  - Intel-SIG: Supprt new SPR models (quanxian.wang@intel.com)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-53.el8.1
changelog:
  - kvm-block-move-bdrv_qiov_is_aligned-to-file-posix.patch [RHEL-60553]
  - kvm-block-use-the-request-length-for-iov-alignment.patch [RHEL-60553]
  - Resolves: RHEL-60553
    (Frequent VM pauses on OpenShift Virtualization with Portworx storage)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-53.el8.2
changelog:
  - kvm-Fix-thread-pool-size-default-value-in-the-man-page.patch [RHEL-26197]
  - Resolves: RHEL-26197
    (virtiofsd --help and manpage does not agree on --thread-pool-size default value)


author: Jacob Wang <jacob.wang@openanolis.org> - 6.2.0-53.0.1.2
changelog:
  - Adjust limit for virtiofsd minor version
  - Add loongarch supporti (lixianglai@loongson.cn)
  - Add package qemu-user-static (fuyuan.wh@alibaba-inc.com)
  - Modify-smbios-option-lack-and-Modify-the-maximum-num.patch (lixianglai@loongson.cn)
  - rename-kvm_msr_buf-with-kvm_csr_buf.patch (lixianglai@loongson.cn)
  - code-cleanup-for-loongarch-kvm.patch (lixianglai@loongson.cn)
  - Support-TPM.patch (lixianglai@loongson.cn)
  - kvm-csr-save-and-restore-optimization.patch (lixianglai@loongson.cn)
  - address-space-code-cleanup-on-7A-virt-machine.patch (lixianglai@loongson.cn)
  - Fix-irq-routing-and-fpu-option-to-compat-with-kernel.patch (lixianglai@loongson.cn)
  - Support-vfio-config.patch (lixianglai@loongson.cn)
  - pass-to-make-check.patch (lixianglai@loongson.cn)
  - fixup-can-t-find-cpu-type.patch (lixianglai@loongson.cn)
  - fix-smbios-type4-info-for-numa-support.patch (lixianglai@loongson.cn)
  - Fix-smp.cores-value.patch (lixianglai@loongson.cn)
  - Add-lbt-support-for-kvm.patch (lixianglai@loongson.cn)
  - Modify-the-ioctl-command-of-kvm.patch (lixianglai@loongson.cn)
  - Add-usb-storage-config-for-loongarch.patch (zhaotianrui@loongson.c)
  - Add-loongarch-into-QEMU_ARCH_VIRTIO_PCI-to-support-q.patch (zhaotianrui@loongson.c)
  - Fix-host-architecture-macro-of-LoongArch-to-HOST_LOO.patch (zhaotianrui@loongson.c)
  - Fix-LoongArch-KVM-header-macros.patch (zhaotianrui@loongson.c)
  - loongarch: Fixed the issue where qemu specifies the boot order (lixianglai@loongson.cn)
  - 0001-anolis-csv-i386-add-CSV-context.patch (jiangxin@hygon.cn)
  - 0002-anolis-csv-i386-add-command-to-initialize-CSV-contex.patch (jiangxin@hygon.cn)
  - 0003-anolis-csv-i386-add-command-to-load-data-to-guest-me.patch (jiangxin@hygon.cn)
  - 0004-anolis-csv-i386-add-command-to-load-vmcb-to-guest-me.patch (jiangxin@hygon.cn)
  - 0005-anolis-cpu-i386-populate-CPUID-0x8000_001F-when-CSV-.patch (jiangxin@hygon.cn)
  - 0006-anolis-csv-i386-CSV-guest-do-not-need-register-unreg.patch (jiangxin@hygon.cn)
  - 0007-anolis-target-i386-csv-load-initial-image-to-private.patch (jiangxin@hygon.cn)
  - 0008-anolis-vga-force-full-update-for-CSV-guest.patch (jiangxin@hygon.cn)
    (Hygon CSV3 feature)
  - Support Hygon CSV/CSV2 live migration, CSV2 reboot (hanliyang@hygon.cn)
  - Support CSV3 live migration (jiangxin@hygon.cn)
  - Support reuse ASID for CSV guests (hanliyang@hygon.cn)
  - Support tkm key isolation (xiongmengbiao@hygon.cn)
  - Add Hygon Dhyana-v3 and Dharma CPU model (zhouyanjing@hygon.cn)
  - Intel-SIG: Supprt Intel SPR/GNR/SRF new ISAs and cpu models (quanxian.wang@intel.com)
  - Intel-SIG: Supprt new SPR models (quanxian.wang@intel.com)
  - Intel-SIG: Sync more intel platform related features/fixes from upstream (jason.zeng@intel.com)


author: Zdenek Dohnal <zdohnal@redhat.com> - 7.1.1-5
changelog:
  - CVE-2018-9918 qpdf: stack exhaustion in QPDFObjectHandle and QPDF_Dictionary classes in libqpdf.a [fedora-all]


author: Jan Grulich <jgrulich@redhat.com> - 5.15.3-2
changelog:
  - Fix specific overflow in qtextlayout
  - Fix incorrect parsing of the strict-transport-security (HSTS) header
  - Fix buffer over-read via a crafted reply from a DNS server
    Resolves: bz#2209491


author: Jan Grulich <jgrulich@redhat.com> - 5.15.3-3
changelog:
  - Don't allow remote attacker to bypass security restrictions caused by
    flaw in certificate validation (CVE-2023-34410)
    Resolves: bz#2212753


author: Jan Grulich <jgrulich@redhat.com> - 5.15.3-4
changelog:
  - Don't allow remote attacker to bypass security restrictions caused by
    flaw in certificate validation (CVE-2023-34410) (version #2)
    Resolves: bz#2212753


author: Rex Dieter <rdieter@fedoraproject.org> 5.0.0-0.1.beta2
changelog:
  - %build: -accessibility
  - macros.qt5: +%_qt5_archdatadir +%_qt5_settingsdir
  - pull in a couple more configure-related upstream patches


author: Rex Dieter <rdieter@fedoraproject.org> 5.0.1-4
changelog:
  - create/own %{_qt5_plugindir}/iconengines
  - -devel: create/own %{_qt5_archdatadir}/mkspecs/modules
  - cleanup .prl


author: Rex Dieter <rdieter@fedoraproject.org> 5.0.1-5
changelog:
  - -static subpkg, Requires: fontconfig-devel,glib2-devel,zlib-devel
  - -devel: Requires: pkgconfig(gl)


author: Rex Dieter <rdieter@fedoraproject.org> - 5.2.0-0.1.alpha
changelog:
  - 5.2.0-alpha
  - -system-harfbuzz
  - rename subpkg -x11 => -gui
  - move some gui-related plugins base => -gui
  - don't use symlinks in %_qt5_bindir (more qtchooser-friendly)


author: Rex Dieter <rdieter@fedoraproject.org> 5.2.0-0.10.rc1
changelog:
  - 5.2.0-rc1
  - revert/omit recent egl packaging changes
  - -doc install changes-5.* files here (#989149)


author: Rex Dieter <rdieter@fedoraproject.org> - 5.2.0-0.11.rc1
changelog:
  - needs a minimum version on sqlite build dependency (#1038617)
  - fix build when doc macro not defined


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 5.2.0-4
changelog:
  - fix QTBUG-35459 (too low entityCharacterLimit=1024 for CVE-2013-4549)
  - fix QTBUG-35460 (error message for CVE-2013-4549 is misspelled)
  - reenable docs on Fedora (accidentally disabled)


author: Kevin Kofler <Kevin@tigcc.ticalc.org> 5.3.1-4
changelog:
  - support the old versions of libxcb and libxkbcommon in F19 and F20
  - don't use the bundled libxkbcommon


author: Rex Dieter <rdieter@fedoraproject.org> - 5.3.1-5
changelog:
  - drop dep on xorg-x11-xinit (own shared dirs instead)
  - fix/improve qtchooser support using alternatives (#1122316)


author: Rex Dieter <rdieter@fedoraproject.org> - 5.4.0-0.1.beta
changelog:
  - 5.4.0-beta
  - avoid extra -devel deps by moving *Plugin.cmake files to base pkgs
  - support bootstrap macro, to disable -doc,-examples


author: Rex Dieter <rdieter@fedoraproject.org> - 5.4.1-3
changelog:
  - pull in handful of upstream fixes, particularly...
  - Fix a division by zero when processing malformed BMP files (QTBUG-44547, CVE-2015-0295)


author: Rex Dieter <rdieter@fedoraproject.org> - 5.4.1-12
changelog:
  - backport a couple more upstream fixes
  - introduce -common noarch subpkg, should help multilib issues


author: Helio Chissini de Castro <helio@kde.org> - 5.5.0-11
changelog:
  - Add mesa-dri-drivers as recommends on gui package as reported by Kevin Kofler
  - Reference https://bugzilla.redhat.com/1249280


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 5.5.0-14
changelog:
  - remove GDB hackery again, -12 built fine on i686, hack breaks ARM build
  - fix 10-qt5-check-opengl2.sh for multiple screens (#1245755)


author: Rex Dieter <rdieter@fedoraproject.org> 5.5.0-16
changelog:
  - backport 0055-Respect-manual-set-icon-themes.patch (kde#344469)
  - conditionally use valgrind only if needed


author: Rex Dieter <rdieter@fedoraproject.org> 5.5.0-18
changelog:
  - When a screen comes back online, the windows need to be told about it (QTBUG-47041)
  - xcb: Ignore disabling of outputs in the middle of the mode switch


author: Helio Chissini de Castro <helio@kde.org> - 5.5.1-8
changelog:
  - qt5-qdoc need requires >= current version, otherwise will prevent the usage further when moved to qttools


author: Helio Chissini de Castro <helio@kde.org> - 5.6.0-0.2
changelog:
  - Valgrind still needed as buildreq due recent split qdoc package, but we can get rid of
    specific arch set.
  - Added missing libproxy buildreq
  - Epel and RHEL doesn't have libinput, so a plugin need to be excluded for this distros


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-0.4
changelog:
  - re-introduce bootstrap/examples macros
  - put examples-manifest.xml in -examples
  - restore -doc multilib hack (to be on the safe side, can't hurt)
  - %build: s/-optimized-qmake/-optimized-tools/


author: Rex Dieter <rdieter@fedoraproject.org> 5.6.0-0.40.rc
changelog:
  - respin QTBUG-51649 patch
  - %build: use -dbus-runtime unconditionally
  - drop (unused) build deps: atspi, dbus, networkmanager


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-6
changelog:
  - macros.qt5: we really only want the null-pointer-checks flag here
    and definitely no arch-specific ones


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-8
changelog:
  - make 10-qt5-check-opengl2.sh xinit script more robust
  - enable journald support for el7+ (#1315239)


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-17
changelog:
  - support out-of-tree build
  - better %check
  - pull in final/upstream fixes for QTBUG-51648,QTBUG-51649
  - disable examples/tests in bootstrap mode


author: Rex Dieter <rdieter@fedoraproject.org> - 5.7.0-10
changelog:
  - fix Source0: https://download.qt.io/official_releases/qt/5.9/5.9.0/submodules/qtbase-opensource-src-5.9.0.tar.xz


author: Rex Dieter <rdieter@fedoraproject.org> - 5.7.1-6
changelog:
  - namespace QT_VERSION_CHECK to workaround major/minor being pre-defined (#1396755)
  - update moc patch to define _SYS_SYSMACROS_H (#1396755)


author: Rex Dieter <rdieter@fedoraproject.org> - 5.8.0-6
changelog:
  - bootstrap (rawhide)
  - revert some minor changes introduced since 5.7
  - move *Plugin.cmake items to runtime (not -devel)


author: Rex Dieter <rdieter@fedoraproject.org> - 5.9.1-6
changelog:
  - enable openssl11 support only for f27+ (for now)
  - Use mariadb-connector-c-devel, f28+ (#1493909)
  - Backport upstream mariadb patch (#1491316)


author: Rex Dieter <rdieter@fedoraproject.org> - 5.10.0-2
changelog:
  - re-enable gold linker (#1458003)
  - drop qt5_null_flag/qt5_deprecated_flag hacks (should be fixed upstream for awhile)
  - make qt_settings/journald support unconditional


author: Rex Dieter <rdieter@fedoraproject.org> - 5.10.1-5
changelog:
  - QOpenGLShaderProgram: glProgramBinary() resulting in LINK_STATUS=FALSE not handled properly (QTBUG-66420)


author: Jan Grulich <jgrulich@redhat.com> - 5.11.1-7
changelog:
  - Move libQt5EglFSDeviceIntegration lib out of the -devel subpkg
    Resolves: bz#1692970

  - Fix QImage allocaion failure
    Resolve: bz#1667860

  - Fix double free in QXmlStreamReader
    Resolve: bz#1667858

  - Fix segmentation fault on malformed BMP file
    Resolve: bz#1667859


author: Jan Grulich <jgrulich@redhat.com> - 5.12.5-5
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814739
    Resolves: bz#1814683

  - Fix: XML entity expansion vulnerability
    Resolves: bz#1822193


author: Rex Dieter <rdieter@fedoraproject.org> - 5.7.1-2
changelog:
  - 5.7.1 dec5 snapshot
  - drop BR: cmake (handled by qt5-rpm-macros now)
  - BR: qt5-qtbase-private-devel


author: Remi Collet <rcollet@redhat.com> - 4.0.10-2
changelog:
  - drop build dependency on pandoc
  - drop dependency on jemalloc #1591762
  - fix License (BSD and MIT)
  - add bundled libraries licences
  - cleanup conditions from spec file


author: Remi Collet <rcollet@redhat.com> - 5.0.3-2
changelog:
  - fix Heap buffer overflow in HyperLogLog triggered by malicious client
    CVE-2019-10192
  - fix Stack buffer overflow in HyperLogLog triggered by malicious client
    CVE-2019-10193


author: Remi Collet <rcollet@redhat.com> - 5.0.3-4
changelog:
  - fix lua scripts can overflow the heap-based Lua stack
    CVE-2021-32626
  - fix integer overflow issue with Streams
    CVE-2021-32627
  - fix integer overflow bug in the ziplist data structure
    CVE-2021-32628
  - fix integer overflow issue with intsets
    CVE-2021-32687
  - fix integer overflow issue with strings
    CVE-2021-41099


author: Silas Sewell <silas@sewell.ch> - 1.2.6-3
changelog:
  - Add Fedora build flags
  - Send all scriplet output to /dev/null
  - Remove debugging flags
  - Add redis.conf check to init script


author: Fabian Deutsch <fabiand@fedoraproject.org> - 2.4.6-1
changelog:
  - Update to 2.4.6
  - systemd unit file added
  - Compiler flags changed to compile 2.4.6
  - Remove doc/ and Changelog


author: Fabian Deutsch <fabian.deutsch@gmx.de> - 2.6.16-1
changelog:
  - Update to 2.6.16
  - Fix rhbz#973151
  - Fix rhbz#656683
  - Fix rhbz#977357 (Jan Vcelak <jvcelak@fedoraproject.org>)


author: Haïkel Guémar <hguemar@fedoraproject.org> - 2.8.14-1
changelog:
  - Upstream 2.8.14 (RHBZ #1136287)
  - Bugfix for lua scripting users (server crash)
  - Refresh patches
  - backport spec from EPEL7 (thanks Warren)


author: Haïkel Guémar <hguemar@fedoraproject.org> - 2.8.14-2
changelog:
  - Cleanup spec
  - Fix shutdown for redis-{server,sentinel}
  - Backport fixes from Remi Collet repository (ie: sentinel working)


author: Haïkel Guémar <hguemar@fedoraproject.org> - 2.8.15-1
changelog:
  - Upstream 2.8.15 (critical bugfix for sentinel)
  - Fix to sentinel systemd service and configuration (thanks Remi)
  - Refresh patch management


author: Remi Collet <remi@fedoraproject.org> - 2.8.17-1
changelog:
  - Upstream 2.8.17
  - fix redis-sentinel service unit file for systemd
  - fix redis-shutdown for sentinel
  - also use redis-shutdown in init scripts


author: Haïkel Guémar <hguemar@fedoraproject.org> - 2.8.19-1
changelog:
  - Upstream 2.8.19 (RHBZ #1175232)
  - Fix permissions for tmpfiles (RHBZ #1182913)
  - Add limits config files
  - Spec cleanups


author: Haïkel Guémar <hguemar@fedoraproject.org> - 3.0.2-1
changelog:
  - Upstream 3.0.2 (RHBZ #1228245)
  - Fix Lua sandbox escape and arbitrary code execution (RHBZ #1228331)


author: Haïkel Guémar <hguemar@fedoraproject.org> - 3.2.3-1
changelog:
  - Upstream 3.2.3
  - Security fix for CVE-2013-7458 (redis-cli history world readable)
  - RHBZ#1363670 RHBZ#1363671


author: Remi Collet <remi@fedoraproject.org> - 3.2.3-2
changelog:
  - add missing man pages #1374577
    using patch from https://github.com/antirez/redis/pull/3491
  - data and configuration should not be publicly readable #1374700
  - remove /var/run/redis with systemd #1374728
  - provide redis-check-rdb as a symlink to redis-server #1374736
    using patch from https://github.com/antirez/redis/pull/3494
  - move redis-shutdown to libexec


author: Nathan Scott <nathans@redhat.com> - 3.2.9-1
changelog:
  - Upstream 3.2.9
  - Add RuntimeDirectory=redis to systemd unit file (RHBZ #1454700)
  - Mark rundir as %ghost since it may disappear (tmpfs - #1454700)
  - Fix a shutdown failure with Unix domain sockets (RHBZ #1444988)


author: Nathan Scott <nathans@redhat.com> - 3.2.10-1
changelog:
  - Upstream 3.2.10 release
  - Ensure both the redis and redis-sentinel service files set correct perms
  - Dropped systemd tmpfiles source, handled directly in systemd service files


author: Nathan Scott <nathans@redhat.com> - 3.2.11-1
changelog:
  - Upstream 3.2.11 bug-fix-only release
  - Switch to using Type=notify for Redis systemd services (RHBZ #1172841)
  - Add Provides:bundled hiredis, linenoise, lua-libs clauses (RHBZ #788500)


author: Nathan Scott <nathans@redhat.com> - 4.0.2-1
changelog:
  - Upstream 4.0.2 release.  (RHBZ #1389592)
  - Add redis-devel for loadable module development.
  - Add redis-doc for man pages and detailed documentation.
  - Provide redis-check-aof as a symlink to redis-server also now.


author: Remi Collet <remi@remirepo.net> - 4.0.3-1
changelog:
  - Redis 4.0.3
  - fix ownership of /usr/share/doc/redis
  - use make_flags for test to avoid rebuild and failure
  - fix rpm macro location on EL-6
  - add /var/run/redis on EL-6
  - add spec file license header
  - drop duplicated documentation from main package
  - keep man in main page


author: Nathan Scott <nathans@redhat.com> - 4.0.4-1
changelog:
  - Upstream 4.0.4 release.
  - Update to current upstream redis-doc also.
  - Fix man page issues (RHBZ #1513594 and RHBZ #1515417).


author: Remi Collet <remi@remirepo.net> - 4.0.5-1
changelog:
  - Redis 4.0.5 - Released Thu Dec 1 16:03:32 CET 2017
  - Upgrade urgency CRITICAL: Redis 4.0.4 fix for PSYNC2 was broken,
    causing the slave to crash when receiving an RDB file from the
    master that contained a duplicated Lua script.


author: Liwei Ge <geliwei@openanolis.org> - 6.2.17-1.0.1
changelog:
  - Support loongarch64 platform
  - cherry-pick `add sw patch $cbad809d90a96439e196e8610d5b1868bcca5d3d`. (nijie@wxiat.com)


author: Kalev Lember <kalevlember@gmail.com> - 0.7.93-1
changelog:
  - Update to 0.7.93
  - Tighten deps with the _isa macro
  - Don't manually require pkgconfig; rpmbuild generates this automatically
  - Use license macro for the COPYING file


author: Bastien Nocera <bnocera@redhat.com> - 3.4.2-5
changelog:
  + rhythmbox-3.4.2-5
  - Remove LIRC plugin
  - Fix 2 build warnings
  - Remove BRs for removed visualiser plugin


author: Bastien Nocera <bnocera@redhat.com> - 3.4.2-7
changelog:
  + rhythmbox-3.4.2-7
  - Fix warnings in art search when playing a radio
  - Fix initial import never finishing
  - Fix multimedia keys integration in GNOME


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - adjust for rpmdb index name change
  - drop unnecessary vendor-macro patch for real
  - add ISA-dependencies among rpm subpackages
  - make lzma and sqlite deps conditional and disabled by default for now


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - rpm 4.5.90-0.git8424.1 (alpha snapshot)
  - adjust to build against Berkeley DB 4.5.20 from compat-db for now
  - add posttrans to clean up db environment mismatch after upgrade
  - forward-port devel autodeps patch


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - 4.5.90-0.git8426.5
  - flip back to external bdb
  - fix tab vs spaces complaints from rpmlint
  - add dep for lzma and require unzip instead of zip in build (#310694)
  - add pkgconfig dependency to rpm-devel
  - drop ISA-dependencies for initial introduction
  - new snapshot from upstream for documentation fixes


author: Florian Festi <ffesti@redhat.com>
changelog:
  - 4.5.90-0.git8426.10
  - rpm-4.5.90-posttrans.patch
  - use header from rpmdb in posttrans to make anaconda happy


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - 4.5.90-0.git8461.1
  - new snapshot from upstream
  - fixes #68290, #455972, #446202, #453364, #456708, #456103, #456321, #456913,
    - partial fix for #457360


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - add support for noarch subpackages
  - fix segfault in case of insufficient disk space detected (#460146)


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - fix parsing of boolean expressions in spec (#456103)
    (unbreaks pam, jpilot and maybe other builds)


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - create directory structure for rpmbuild prior to build if it doesn't exist (#455387)
  - create _topdir if it doesn't exist when installing SRPM
  - don't generate broken cpio in case of hardlink pointing on softlink,
    thanks to pixel@mandriva.com


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - add hack to support extracting gstreamer plugin provides (#438225)
  - fix another macro argument handling regression (#461180)


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to official 4.5.90 alpha tarball 
  - a big pile of misc bugfixes + translation updates
  - isa-macro generation fix for ppc (#464754)
  - avoid pulling in pile of perl dependencies for an unused script
  - handle both "invalid argument" and clear env version mismatch on posttrans


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to 4.6.0-rc1 
  - fixes #465586, #466597, #465409, #216221, #466503, #466009, #463447...
  - avoid using %configure macro for now, it has unwanted side-effects on rpm


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - Make noarch sub-packages actually work
  - Fix defaultdocdir logic in installplatform to avoid hardwiring mandir


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to 4.6.0-rc2
  - fixes #471820, #473167, #469355, #468319, #472507, #247374, #426672, #444661
  - enable automatic generation of pkg-config and libtool dependencies #465377


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-0.rc4.2
changelog:
  - change platform sharedstatedir to something more sensible (#185862)
  - add rpmdb_foo links to db utils for documentation compatibility


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-0.rc4.3
changelog:
  - extract mimehandler provides from .desktop files
  - preliminaries for extracting font provides (not enabled yet)
  - dont classify font metrics data as fonts
  - only run script dep extraction once per file, duh


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-1
changelog:
  - update to 4.6.0 final
  - revert libmagic looking into compressed files for now, breaks ooffice build


author: Jindrich Novy <jnovy@redhat.com> - 4.6.0-4
changelog:
  - inherit group tag from the main package (#470714)
  - ignore BuildArch tags for anyarch actions (#442105)
  - don't check package BuildRequires when doing --rmsource (#452477)
  - don't fail because of missing sources when only spec removal
    is requested (#472427)


author: Jindrich Novy <jnovy@redhat.com> - 4.6.0-5
changelog:
  - remove two offending hunks from anyarch patch causing that
    RPMTAG_BUILDARCHS isn't written to SRPMs


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-7
changelog:
  - loosen up restrictions on dependency names (#455119)
  - handle inter-dependent pkg-config files for requires too (#473814)
  - error/warn on elf binaries in noarch package in build


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-0.beta1.9
changelog:
  - fix recorded file state of otherwise skipped files (#492947)
  - compress ChangeLog, drop old CHANGES file (#492440)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-1
changelog:
  - update to 4.7.0 final (http://rpm.org/wiki/Releases/4.7.0)
  - fixes #494049, #495429
  - dont permit test-suite failure anymore


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-2
changelog:
  - file classification tweaks for text files (#494817)
    - disable libmagic text token checks, it's way too error-prone
    - consistently classify all text as such and include description


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-3
changelog:
  - couple of merge-review fixes (#226377)
    - eliminate bogus leftover rpm:rpm rpmdb ownership
    - unescaped macro in changelog
  - fix find-lang --with-kde with KDE3 (#466009)
  - switch back to default file digest algorithm


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-4
changelog:
  - split cron-job into a sub-package to avoid silly deps on core rpm (#500722)
  - rpm requires coreutils but not in %post
  - build with libcap and libacl
  - fix pgp pubkey signature tag parsing


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-5
changelog:
  - don't mess up problem altNEVR in python ts.check() (#501068)
  - fix hardlink size calculation on build (#503020)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-8
changelog:
  - updated OSGi dependency extractor (#506471)
  - fix segfault in symlink fingerprinting (#505777)
  - fix invalid memory access causing bogus file dependency errors (#506323)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-5
changelog:
  - fix duplicate dependency filtering on build (#490378)
  - permit absolute paths in file lists again (#521760)
  - use permissions 444 for all .debug files (#522194)
  - add support for optional bugurl tag (#512774)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-6
changelog:
  - use relative paths within db environment (related to #507309, #507309...)
  - remove db environment on close in chrooted operation (related to above)
  - initialize rpmlib earlier in rpm2cpio (#523260)
  - fix file dependency tag extension formatting (#523282)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-7
changelog:
  - fix build with BDB 4.8.x by removing XA "support" from BDB backend 
  - perl dep extractor heredoc parsing improvements (#524929)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-8
changelog:
  - support multiple python implementations in brp-python-bytecompile (#531117)
  - make disk space problem reporting a bit saner (#517418)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.2-2
changelog:
  - missing error exit code from signing password checking (#496754)
  - dont fail build on unrecognized data files (#532489)
  - dont try to parse subkeys and secret keys (#436812)
  - fix chmod test on selinux, breaking %{_fixperms} macro (#543035)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-0.beta1.1
changelog:
  - update to 4.8.0-beta1 (http://rpm.org/wiki/Releases/4.8.0)
  - rpm-build conflicts with current ocaml-runtime


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-0.beta1.2
changelog:
  - fix noise from python bytecompile on non-python packages (#539635)
  - make all our -devel [build]requires isa-specific
  - trim out superfluous -devel dependencies from rpm-devel


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-3
changelog:
  - fix segfault on failed url retrieval
  - fix verification error code depending on verbosity level
  - if anything in testsuite fails, dump out the log


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-8
changelog:
  - more fixes to postscript provides extractor (#562228)
  - avoid accessing unrelated mount points in disk space checking (#547548)
  - fix disk space checking with erasures present in transaction (#561160)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-11
changelog:
  - support single PPD providing driver for devices (#568351)
  - merge the psdriver patch pile into one
  - preserve empty lines in spec prep section (#573339)
  - teach python bindings about RPMTRANS_FLAG_NOCONTEXTS (related to #573111)
  - dont own localized man directories through find_lang (#569536)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-15
changelog:
  - handle non-existent dependency sets correctly in python (#593553)
  - make find-lang look in all locale dirs (#584866)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-16
changelog:
  - adjust to new pkg-config behavior wrt private dependencies (#596433)
  - rpm-build now requires pkgconfig >= 0.24


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-1
changelog:
  - update to 4.8.1 (http://rpm.org/wiki/Releases/4.8.1)
  - drop no longer needed patches
  - fix source url pointing to testing directory


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-2
changelog:
  - fix a potential getOutputFrom() error from font provide extraction
  - debug-friendlier message to aid finding other similar cases (#565223)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-5
changelog:
  - create gdb index on debuginfo generation (#617166)
  - rpm-build now requires /usr/bin/gdb-add-index for consistent index creation
  - include COPYING in -apidocs for licensing guidelines compliance


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-7
changelog:
  - bunch of spec tweaks, cleanups + corrections:
    - shorten rpm-build filelist a bit with glob use, reorder for saner grouping
    - missing isa in popt version dependency
    - only add rpmdb_foo symlinks for actually relevant db_* utils
    - drop no longer necessary file-devel dependency from rpm-devel
    - drop sqlite backend build-conditional
    - preliminaries for moving from db4 to libdb
  - use gnupg2 for signing as that's more likely to be installed by default


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.beta1.1
changelog:
  - rpm 4.9.0-beta1 (http://rpm.org/wiki/Releases/4.9.0)
    - drop no longer needed patches
    - adjust requires + buildrequires to match current needs
    - adjust rpmdb index ghosts to match the new release
    - split librpmbuild and librpmsign to a separate rpm-build-libs package
    - split rpmsign to its own package to allow signing without all the build goo
    - build-conditionalize plugins, disabled for now
    - gstreamer and printer dependency generation moving out
    - handle .so symlink dependencies with fileattrs
    - use gnupg2 for signing as that's what typically installed by default


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.beta1.3
changelog:
  - avoid division by zero in rpmdb size calculation (#671056)
  - fix secondary index iteration returing duplicate at end (#671149)
  - fix rebuilddb creating duplicate indexes for first header


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.beta1.5
changelog:
  - dont try to remove environment files if private env used (related to #671200)
  - unbreak mono dependency extraction (#673663)
  - complain instead of silent abort if cwd is not readable (#672576)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.rc1.1
changelog:
  - update to 4.9.0-rc1
  - drop upstream patches
  - nss packaging has changed, buildrequire nss-softokn-freebl-devel


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.rc1.4
changelog:
  - spec cosmetics clean up extra whitespace + group more logically
  - wipe out BDB environment at boot via tmpfiles.d


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-5
changelog:
  - verify some properties of replaced and wrong-colored files (#528383)
  - only list packages that would be generated on spec query (#693338)
  - preferred color packages should be erased last (#680261)
  - fix leaks when freeing a populated transaction set
  - take file state into account for file dependencies


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-8
changelog:
  - add dwarf-4 support to debugedit (#707677)
  - generate build-id symlinks for all filenames sharing a build-id (#641377)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-9
changelog:
  - fix crash if prep or changelog section in spec is empty (#706959)
  - fix crash on macro which undefines itself
  - fix script dependency generation with file 5.07 string changes (#712251)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.1.2-3
changelog:
  - adjust db util prefix & dependency due to #749293
  - warn but dont fail the build if STABS encountered by debugedit (#725378)


author: Kay Sievers <kay@redhat.com> - 4.9.1.2-8
changelog:
  - add temporary rpmlib patch to support filesystem transition
    https://fedoraproject.org/wiki/Features/UsrMove


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.1.2-13
changelog:
  - fix memory corruption on rpmdb size estimation (#766260)
  - fix couple of memleaks in python bindings (#782147)
  - fix regression in verify output formatting (#797964)
  - dont process spec include in false branch of if (#782970)
  - only warn on missing excluded files on build (#745629)
  - dont free up file info sets on test transactions


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.90-0.git11505.5
changelog:
  - add temporary fake library provides to get around deltarpm "bootstrap"
    dependency (yes its dirty)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.90-0.git11519.1
changelog:
  - newer git snapshot to keep patch-count down
  - fixes CVE-2012-0060, CVE-2012-0061 and CVE-2012-0815
  - fix obsoletes in installing set getting matched on provides (#810077)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.90-0.git11536.1
changelog:
  - newer git snapshot (#809402, #808750)
  - adjust posttrans script wrt bdb string change (#803866, #805613)


author: Panu Matilainen <pmatilai@redhat.com> - 4.10.90-0.git11989.1
changelog:
  - update to 4.11 (http://rpm.org/wiki/Releases/4.11.0) post-alpha snapshot
  - drop/adjust patches as necessary


author: Panu Matilainen <pmatilai@redhat.com> - 4.10.90-0.git11989.3
changelog:
  - package /usr/lib/rpm/macros.d directory (related to #846679)
  - fixup a bunch of old incorrect dates in spec changelog


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.0-0.beta1.2
changelog:
  - armv7hl and armv7hnl should not have -mthumb (#901901)
  - fix duplicate directory ownership between rpm and rpm-build (#894201)
  - fix regression on paths shared between a real file/dir and a ghost


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.1-7
changelog:
  - fix build-time double-free on file capability processing (#956190)
  - fix relocation related regression on file sanity check (#1001553)
  - fix segfault on empty -p <lua> scriptlet body (#1004062)
  - fix source url, once again


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.1-11
changelog:
  - generate kmod(module.ko) provides for kernel (#1025513)
  - dont override CONFIG_SITE if already set (related to #962837)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.2-0.rc1.1
changelog:
  - update to 4.11.2-rc1 (http://rpm.org/wiki/Releases/4.11.2)
  - drop upstreamed patches, adjust others as needed
  - handle python egg-info's version munging in file lists


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.2-3
changelog:
  - dont eat newlines on parametrized macro invocations (#1045723)
  - fully reset file actions between rpmtsRun() calls (#1076552)
  - fix build and sign module initialization in python3 (#1064758)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.2-6
changelog:
  - build with -fsanitize=address and -fsanitize=undefined for now
  - add spec build conditional for sanitizer build


author: Tom Callaway <spot@fedoraproject.org> - 4.11.2-10
changelog:
  - remove _isa from all BuildRequires (bz 554854)
    See: https://fedoraproject.org/wiki/Packaging:Guidelines#BuildRequires_and_.25.7B_isa.7D


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.90-0.git12844.1
changelog:
  - Update to rpm 4.12-alpha ((http://rpm.org/wiki/Releases/4.12.0)
  - Drop/adjust patches as appropriate
  - New sub-package(s) for plugins


author: Panu Matilainen <pmatilai@redhat.com> - 4.12.0-0.beta1.1
changelog:
  - Update to 4.12.0-beta1 (http://rpm.org/wiki/Releases/4.12.0)
  - Fixes #1122004, #1111349, #1117912, #1123722
  - Drop upstreamed patches


author: Panu Matilainen <pmatilai@redhat.com> - 4.12.0.1-1
changelog:
  - Update to rpm-4.12.0.1 final (http://rpm.org/wiki/Releases/4.12.0.1)
  - Temporary workaround payload size mismatch issue in rpm2cpio (#1142949)


author: Panu Matilainen <pmatilai@redhat.com> - 4.12.0.1-3
changelog:
  - Skip ghost files in payload (#1156497)
  - Fix size and archice size tag generation on big-endian systems


author: Lubos Kardos <lkardos@redhat.com> - 4.12.0.1-5
changelog:
  - Add check against malicious CPIO file name size (#1168715)
  - Fixes CVE-2014-8118
  - Fix race condidition where unchecked data is exposed in the file system
    (#1039811)
  - Fixes CVE-2013-6435


author: Lubos Kardos <lkardos@redhat.com> 4.12.0-11
changelog:
  - Pass _find_debuginfo_opts -g to eu-strip for executables (#1186563)
  - add_minidebug is not ran when strip_g is set (#1186563)


author: Lubos Kardos <lkardos@redhat.com> - 4.12.90-5
changelog:
  - If globbing of a filename fails, try use the filename without globbing.
    (#1246743)
  - Modify rpmIsGlob() to be more precise and compatible with glob().
    (#1246743)


author: Lubos Kardos <lkardos@redhat.com> - 4.13-0.rc1.6
changelog:
  - If %_wrong_version_format_terminate_build is 1 then terminate build in case
    that version format is wrong i. e. epoch is not unsigned integer or version
    contains more separators (":", "-"). %_wrong_version_format_terminate_build
    is 1 by deafault (#1265700)


author: Lubos Kardos <lkardos@redhat.com> - 4.13-0.rc1.7
changelog:
  - Fix reading a memory right after the end of an allocated area (#1260248)
  - Add support for various types of dependencies to rpmdeps tool (#1247092)
  - fix %autopatch when patch do not exist (#1244172)


author: Lubos Kardos <lkardos@rpm.org> - 4.13.0-0.rc1.13
changelog:
  - Add possibility to disable file triggers
  - Fix unwanted multiple execution of filetriggers in dnf (#1282115)


author: Lubos Kardos <lkardos@redhat.com> - 4.13.0-0.rc1.20
changelog:
  - Revert using %configure, it causes problems
  - Temporary set %_gnu macro explictly, just for one build (#1303265)


author: Florian Festi <ffesti@rpm.org> - 4.13.0-0.rc1.24
changelog:
  - Also block idle and sleep in the systemd-inhibit plugin (#1297984)
  - Add support for MIPS release 6
  - Add mips32 mips64 mipsel and mipseb macros (#1285116)


author: Lubos Kardos <lkardos@redhat.com> 4.13.0-0.rc1.31
changelog:
  - Enable --no-backup-if-mismatch by default in %patch macro (#884755)
  - Add %{_default_patch_flags} to %__patch which is used in %autosetup
  - Use fuzz settings for %autopatch/%autosetup


author: Lubos Kardos <lkardos@redhat.com> 4.13.0-0.rc1.33
changelog:
  - Fix sigsegv in stringFormat() (#1316903)
  - Fix reading rpmtd behind its size in formatValue() (#1316896)


author: Igor Gnatenko <ignatenko@redhat.com> - 4.13.0-0.rc1.41
changelog:
  - Add %{?system_python_abi}
  - rpm-python -> python2-rpm && rpm-python3 -> python3-rpm with providing old names
  - Fixes and cleanups


author: Thierry Vignaud <tvignaud@redhat.com> - 4.13.0-2
changelog:
  - Fix package name references in python sub-packages to match reality
  - Re-enable test-suite now that it works again


author: Panu Matilainen <pmatilai@redhat.com> - 4.13.0-11
changelog:
  - Fix malformed packages being generated around 4GB boundary (#1405570)
  - Resurrect debuginfo GDB index generation (#1410907)


author: Mark Wielaard <mjw@redhat.com> - 4.13.0.1-13
changelog:
  - Add tests fix for sed file build-id regexp matching.
  - Add fix for build-ids in non-executable ELF files (#1433837).


author: Panu Matilainen <pmatilai@redhat.com> - 4.13.0.1-17
changelog:
  - Work around missing python[23] during build dependency parse
  - Include ISA in the new python library version dependencies too


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-19
changelog:
  - Minisymtab should only be added for executables or shared libraries.
  - Add find-debuginfo.sh -n (debugedit --no-recompute-build-id) option.


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-25
changelog:
  - Add support for debugsource and debuginfo subpackages
    - find-debuginfo-untangle-unique-build-options.patch
    - debugsrc-and-sub-debuginfo-packages.patch


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-28
changelog:
  - Add debugedit-prefix.patch.
  - Add find-debuginfo-filter-built-ins.patch.
  - Add find-debuginfo-dwz-multi.patch.
  - Add find-debuginfo-and-macro-docs.patch.


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-29
changelog:
  - Track patches using https://pagure.io/rpm-fedora
  - Use file list to explicitly set mode for build-id dirs/files
    (#1452893, #1458839)


author: Miro Hrončok <mhroncok@redhat.com> - 4.13.90-0.git14000.4
changelog:
  - Add platform-python bytecompilation patch: platform-python-bytecompile.patch
  - Add platform python deps generator patch: platform-python-abi.patch
  - Add a platform-python subpackage and remove system python related declarations
  - Build rpm without platform_python for bytecompilation
    (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.0-0.rc1.1
changelog:
  - Rebase to rpm 4.14.0-rc1 (http://rpm.org/wiki/Releases/4.14.0)
  - Re-enable SHA256 header digest generation (see #1480407)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.0-0.rc1.2
changelog:
  - Actually honor with/without libimaevm option
  - ima-evm-utils-devel >= 1.0 is required for rpm >= 4.14.0


author: Tomas Orsava <torsava@redhat.com> - 4.14.1-5
changelog:
  - Add envvar that will be present during RPM build,
    Part of a Fedora Change for F28: "Avoid /usr/bin/python in RPM build"
    https://fedoraproject.org/wiki/Changes/Avoid_usr_bin_python_in_RPM_Build


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.1-6
changelog:
  - Avoid unnecessary macro helper dependency on /usr/bin/python (#1538657)
  - Fix release of previous changelog entry


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-0.rc2.1
changelog:
  - Update to rpm 4.14.2-rc2
  - Fixes a regression in rpmlog error handling (#1597274)
  - Fixes several resource leaks found by covscan (#1602681)
  - Fixes DISTTAG not getting copied to source rpms (#1596193)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-1
changelog:
  - Buildrequire audit-libs-devel to actually enable the feature (#1607612)
  - Update to rpm 4.14.2 final (http://rpm.org/wiki/Releases/4.14.2)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-7
changelog:
  - Move python-macro-helper to main package where the macros are (#1651926)
  - Document --noverify in the man page (#1646458)
  - Handle unsupported digests the same as disabled ones (#1652529)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-11
changelog:
  - Revised patch for Py3 string data as surrogate-escaped utf-8 (#1631292)
  - Add a .decode() method to returned Py3 strings for compatibility


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-14
changelog:
  - Verify packages before signing (#1646388)
  - Make rpmsign exist values more consistent with our other tools


author: Florian Festi <ffesti@redhat.com> - 4.14.2-16
changelog:
  - Sort list of hard linked files in find-debuginfo.sh (#1421272)
  - Correct rpm -ql exit value when optional -p is omitted (#1680610)
  - Show list of files only once when use rpm -ql and multiple rpm files (#1689898)


author: Florian Festi <ffesti@redhat.com> - 4.14.2-23
changelog:
  - Use --dpbath only with full path (#1696408)
  - Fix memory leaks (#1714657)
  - Remove capabilities instead of setting empty caps via. --setcaps (#1700920)
  - Fix bash warning from solution for #1689810


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-27
changelog:
  - Support generating build-id's from compressed ELF files (#1650074)
  - Compress annobit notes in find-debuginfo (#1719837)


author: Florian Festi <ffesti@redhat.com> - 4.14.2-31
changelog:
  - Parallelize /usr/lib/rpm/brp-strip-static-archive (#1691824)
  - Parallelize /usr/lib/rpm/check-buildroot (#1704354)


author: Florian Festi <ffesti@redhat.com> - 4.14.3-5
changelog:
  - Don't error out when replacing an invalid signature (#1874062)
  - Raise an expection when erasing a package fails in Python (#1872623)
  - Fix builds on NFS filesystems (#1840728)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-12
changelog:
  - Bump up the limit of signature header to 64MB (#1918777)
  - Add fapolicyd plugin (#1923167)
  - Unblock signals in forked scriptlets (#1913765)
  - Fix ambiguous diagnostics output on file triggers (#1883338)
  - Ensure ELF files get stripped when debuginfo is disabled (#1634084)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-13
changelog:
  - Fix minor issues found by COVSCAN in fapolicyd plugin
  - Actually honor libarchive bcond at configure time (#1902887)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-15
changelog:
  - Add out-of-bounds checks to hdrblobInit() (#1929445)
  - Fixes CVE-2021-20266
  - Fix regression in brp-strip causing kmods to lose SecureBoot sig (#1967291)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-16
changelog:
  - Add support for read-only sqlite rpmdb (#1938928)
  - Drop compat .decode() method from returned Py3 strings (#1840142)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-20
changelog:
  - Add --path query option (#1940895)
  - Macroize find-debuginfo script location (#2019540)
  - Validate and require subkey binding sigs on PGP pubkeys (#1958480)
  - Fixes CVE-2021-3521


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
changelog:
  - Fix spurious %transfiletriggerpostun execution (#2023693)
  - Skip recorded symlinks in --setperms (#1900662)


author: Florian Festi <ffesti@redhat.com> - 4.14.3-31
changelog:
  - Backport file handling code from rpm-4.19 to fix CVE-2021-35937,
    CVE-2021-35938 and CVE-2021-35939


author: Liwei Ge <geliwei@openanolis.org> - 4.14.4-31.0.1
changelog:
  - Rebrand for Anolis OS
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Support loongarch for rpm
  - Add loongarch64 support for debugedit(doupengda@loongson.cn)
  - Modify the spec to add debugedit for loongarch64(zhangwenlong@loongson.cn)
  - Support and switch rpmdb to sqlite (flin@linux.alibaba.com)
  - conditional set relbuf for loongarch debugedit (geliwei@openanolis.org)
  - avoid dead loop in db3_dbiOpen when db_create failed (xuchunmei@linux.alibaba.com)
  - do not switch rpmdb to sqlite (xuchunmei@linux.alibaba.com)
  - Fix a copy-paste --help description of --whatconflicts (wangkaiqiang@inspur.com)
  - https://bugzilla.openanolis.cn/show_bug.cgi?id=8035 (wangkaiqiang@inspur.com)
  - Add sw64 Architecture (nijie@wxiat.com)
  - update config to support sw64 Architecture. (Weisson@linux.alibaba.com)
  - keep compatibility between sw and other architecture. (Weisson@linux.alibaba.com)
  - Fix compatibility of debugedit tool on sw_64 platform. (Weisson@linux.alibaba.com)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-32
changelog:
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63069)
  - Fix IMA signature lengths assumed constant (RHEL-39896)
  - Fix root relocation regression (RHEL-49494)
  - Report unsafe symlinks during installation as a specific case (RHEL-39897)
  - Don't segfault on missing priority tag (RHEL-39894)


author: Liwei Ge <geliwei@openanolis.org> - 4.14.4-32.0.1
changelog:
  - Rebrand for Anolis OS
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Support loongarch for rpm
  - Add loongarch64 support for debugedit(doupengda@loongson.cn)
  - Modify the spec to add debugedit for loongarch64(zhangwenlong@loongson.cn)
  - Support and switch rpmdb to sqlite (flin@linux.alibaba.com)
  - conditional set relbuf for loongarch debugedit (geliwei@openanolis.org)
  - avoid dead loop in db3_dbiOpen when db_create failed (xuchunmei@linux.alibaba.com)
  - do not switch rpmdb to sqlite (xuchunmei@linux.alibaba.com)
  - Fix a copy-paste --help description of --whatconflicts (wangkaiqiang@inspur.com)
  - https://bugzilla.openanolis.cn/show_bug.cgi?id=8035 (wangkaiqiang@inspur.com)
  - Add sw64 Architecture (nijie@wxiat.com)
  - update config to support sw64 Architecture. (Weisson@linux.alibaba.com)
  - keep compatibility between sw and other architecture. (Weisson@linux.alibaba.com)
  - Fix compatibility of debugedit tool on sw_64 platform. (Weisson@linux.alibaba.com)
  - cherry-pick Add sw8a Architecture #d96aa474da407c806ef6b68c669f8027e366f302 (nijie@wxiat.com)
  - cherry-pick Add sw8a patch #923576a65dc00eb4fbe1f10a5d0027c4de1f5be0 (nijie@wxiat.com)


author: Liming Sun <lsun@mellanox.com> - 2.0.2-1
changelog:
  - Remove unnecessary dependency in .spec and use make_build
  - Add package build for debian/ubuntu
  - Fix some format in the man page
  - Add check for syslog headers


author: Liming Sun <lsun@mellanox.com> - 2.0.3-1
changelog:
  - Enable pci device during probing
  - Map the pci resource0 file instead of /dev/mem
  - Add copyright header in bootstrap.sh
  - Add 'Requires' tag check in the rpm .spec for kernel-modules-extra
  - Fix the 'rshim --version' output


author: Liming Sun <lsun@mellanox.com> - 2.0.4-1
changelog:
  - Update .spec file according to review comments
  - Fix the 'KillMode' in rshim.service
  - Support process termination by SIGTERM
  - Fix some compiling warnings and configure issue for FreeBSD
  - Fix a read()/write() issue in rshim_pcie.c caused by optimization


author: Dean Nelson <dnelson@redhat.com> - 2.0.4-4
changelog:
  - Expose gating.yaml file in order to enable manual CI gating for rshim
    in RHEL-8.4, by bumping release and doing a Brew build.
  - Partially resolves: rhbz#1912248


author: Dean Nelson <dnelson@redhat.com> - 2.0.5-1
changelog:
  - Update user-space rshim driver source to version 2.0.5.
  - Modify rshim.spec accordingly.
  - Resolves: rhbz#1950425


author: Dean Nelson <dnelson@redhat.com> - 2.0.5-2
changelog:
  - Add sysconfig/rshim file and update rshim.service to source it.
  - jbastian made the first cut of this patch, which needed to be
    modified due to the update to 2.0.5. And I chose to go with
    %autosetup to handle Patch0, instead of sticking with %setup.
  - Resolves: rhbz#1946349


author: Dean Nelson <dnelson@redhat.com> - 2.0.8-1
changelog:
  - Update user-space rshim driver source to version 2.0.8
  - Modify rshim.spec accordingly
  - Resolves: rhbz#2196852


author: Radovan Sroka <rsroka@redhat.com> - 8.32.0-1
changelog:
  - initial clean build with plugins from rhel7
  - removed plugins:
    - libdbi
    - omruleset
    - pmrfc3164sd
  - imported from fedora26


author: Marek Tamaskovic <mtamasko@redhat.com> - 8.35.0-1
changelog:
  - rebase to 8.35
  - rebased patches from 8.32 to 8.35
    - fixed imjournal-duplicates
    - fixed imjournal-default-tag
    - fixed service patch
    - fixed in upstream deserialize-property-name


author: Jiri Vymazal <jvymazal@redhat.com> - 8.35.0-1
changelog:
  - spec file cleanup
  - enabled kafka and hiredis modules
    resolves: rhbz#1542497
    resolves: rhbz#1542504
  - renamed patch fixing imjournal duplicating messages
    resolves: rhbz#1544394


author: Jiri Vymazal <jvymazal@redhat.com> - 8.36.0-1
changelog:
  - rebase to 8.36
  - removed hiredis module
  - removed omudpspoof module
    resolves: rhbz#1593762
  - finished converting config to new-style syntax


author: Jiri Vymazal <jvymazal@redhat.com> - 8.36.0-1
changelog:
  - changed PID file name to follow upstream
  - removed config option to disable stdlog as it is now
    disabled by default


author: Jiri Vymazal <jvymazal@redhat.com> - 8.36.0-3
changelog:
  - dropped json_nonoverwrite patch as there is no reason for
    keeping it
  - renumbered rest of patches
  - added release number to AC_INIT to have it in package error logs


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-1
changelog:
  - rebase to 8.37.0
    resolves: rhbz#1613880
    resolves: rhbz#1564054
    resolves: rhbz#1598218
    - dropped invalid statefile patch - upstreamed
    - dropped imjournal duplicates patch - upstreamed
    resolves: rhbz#1544394
  - renumbered default tag patch and fitted onto rebased version


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-5
changelog:
  - rebuild for rebased dependencies
  - dependency cleanup and sorted sub-packages in spec
    resolves: rhbz#1613880


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-10
changelog:
  RHEL 8.1.0 ERRATUM
  - added option for imfile endmsg.regex
    resolves: rhbz#1627941
  - added patch enhancing imfile rotation detection
    resolves: rhbz#1674471
  - added patch fixing msgOffset datatype preventing crash on
    message with too long other fields
    resolves: rhbz#1677037
  - added patch introducing "preservecase" option for imudp/imtcp
    resolves: rhbz#1614181


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-11
changelog:
  RHEL 8.1.0 ERRATUM
  - fixed memory leak in imjournal by proper cursor releasing
    resolves: rhbz#1716867


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-12
changelog:
  RHEL 8.1.0 ERRATUM
  - edited imjournal memleak patch to not cause double-free crash
    resolves: rhbz#1729995
  - added patch calling journald API only when there are no
    preceeding errors
    resolves: rhbz#1722165
  - added patch fixing imrelp module when invoked with old syntax
    resolves: rhbz#1724218


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-13
changelog:
  RHEL 8.1.0 ERRATUM
  - added patch enabling stricter TLS certs checking conforming to
    common criteria requirements
    resolves: rhbz#1733244


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-1
changelog:
  RHEL 8.2.0 ERRATUM
  - rebased to 8.1911.0 upstream version, removed, previously
    upstreamed patches
    resolves: rhbz#1740683
    resolves: rhbz#1659383
    resolves: rhbz#1746876
    resolves: rhbz#1676559
    resolves: rhbz#1692072
    resolves: rhbz#1692073
    resolves: rhbz#1692074
    resolves: rhbz#1699242
    resolves: rhbz#1738213
    resolves: rhbz#1744691
    resolves: rhbz#1755218
    resolves: rhbz#1768321
    resolves: rhbz#1768324
  - added patch fixing imfile stefiles naming
    resolves: rhbz#1763757


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-3
changelog:
  RHEL 8.2.0 ERRATUM
  - added patch reverting rejecting expired certs by default
    resolves: rhbz#1782353
  - added patch silencing false errors on config.enabled statement
    resolves: rhbz#1659383


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-5
changelog:
  RHEL 8.3.0 ERRATUM
  - added qpid-proton as another source and enabled omamqp1 module
    in a separate sub-package with it statically linked
    resolves: rhbz#1713427
  - extended config.enabled patch to cover rest of the cases
    resolves: rhbz#1659383
  - added patch making json serialization thread-safe
    resolves: rhbz#1789675
  - added another patch for imfile state-files id
    resolves: rhbz#1793569
  - fixed typo in commend-out part of default rsyslog.conf


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-6
changelog:
  RHEL 8.3.0 ERRATUM
  - added patch preventing imfile crash when selinux blocks symlink
    access
    resolves: rhbz#1843994
  - fixed config-enabled patch
    resolves: rhbz#1659383


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-2
changelog:
  RHEL 8.5.0 ERRATUM
  - rebase to 8.2102.0
    resolves: rhbz#1932795
  - Enable openssl
    resolves: rhbz#1891458
  - EKU check for client cert on server side
    resolves: rhbz#1783348
  - Use GNUTLS_SHUT_WR when ending TLS connections
    resolves: rhbz#1880434
  - Use librelp with openssl enabled
    resolves: rhbz#1795607
  - Close dir when fsync=on
    resolves: rhbz#1960536


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-3
changelog:
  - Priority field must have valid length
    resolves: rhbz#1866877
  - Allocate more memory on too large groups
    resolves: rhbz#1944718


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-5
changelog:
  - Do not exit when user/group can not be found
    resolves: rhbz#1984489
  - Remove abortOnIDResolution fail


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-9
changelog:
  - Add deleteStateOnFileMove imfile module option
    resolves: rhbz#1909639
  - Add inotify_rm_watch() inotify API call when object needs to be destroyed
    resolves: rhbz#2052403


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-10
changelog:
  - openssl: Correct gnutlsPriorityString (custom ciphers) behaviour
  - Fix error handling in gtlsRecordRecv that can cause 100 percent CPU usage
    resolves: rhbz#2046158
  - Address CVE-2022-24903, Heap-based overflow in TCP syslog server
    resolves: rhbz#2081401


author: Attila Lakatos <alaktos@redhat.com> - 8.2102.0-13
changelog:
  - Make rsyslog-relp require librelp>= 1.9.0
    resolves: rhbz#2029352
  - Reorder logrotate parameters to work with POSIXLY_CORRECT env var
    resolves: rhbz#2070496


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-14
changelog:
  - Fix wrong type conversion in cstrLen()
    resolves: rhbz#2157804
  - imjournal: by default retrieves _PID from journal as PID number
    resolves: rhbz#2176398
  - Systemd service file hardening
    resolves: rhbz#2176404


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-15
changelog:
  - omelasticsearch: make compatible with elasticsearch>=8
  - add new action specific parameter esversion.major
    resolves: rhbz#2192955


author: Stephen Gallagher <sgallagh@redhat.com> - 0.11-15
changelog:
  - Temporarily disable -Werror=format-security to unbreak the build
  - Build with verbose command-line visible in the logs
  - Resolves: rhbz#1424270


author: John Kacur <jkacur@redhat.com> - 5.14.0-3
changelog:
  - Fix exit status when returning from calls to usage()
  Resolves: rhbz#2161423
  jiraProject == RHELPLAN-145250


author: John Kacur <jkacur@redhat.com> - 5.14.0-6
changelog:
  - Forward port the tests directory for ci testing
  Resolves: rhbz#2196611
  jiraProject == RHELPLAN-156801


author: John Kacur <jkacur@redhat.com> - 6.6.0-1
changelog:
  Update to rtla in linux-6.6.0
  - Add patch to use SYS_gettid and add -lpthread to the Makefile
  Resolves: RHEL-10081


author: Toru Hoshina <hoshina@best.com>
changelog:
  - Modified SPEC in order to install libruby.a so that it should be used by
    another ruby entention.
  - 2nd release.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/12/2000 CVS).
  - Added manuals and FAQs.
  - Split into ruby, ruby-devel, ruby-tcltk, ruby-docs, irb.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/20/2000 CVS).
  - Removed ruby-list.23190.patch(included into ruby_cvs.patch).
  - Added ruby-dev.10054.patch.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/22/2000 CVS).
  - Removed ruby-dev.10054.patch(included into ruby_cvs.patch).


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.6.
  - removed ruby-dev.10123.patch(included into ruby-1.4.6).
  - Added ruby_cvs.2000082901.patch(upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Updated to upstream version 1.6.1.
  - Removed ruby_cvs.2000082901.patch and added ruby_cvs.2000092718.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000092718.patch and added ruby_cvs.2000100218.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100218.patch and added ruby_cvs.2000100313.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100313.patch and added ruby_cvs.2000100313.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100313.patch and added ruby_cvs.2000101117.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000101117.patch and added ruby_cvs.2000101901.patch
    (upgraded ruby to latest cvs version).
  - Added ruby-dev.11262.patch.
  - Added ruby-dev.11265.patch.


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000101901.patch, added ruby_cvs.2000121413.patch
    (upgraded ruby to latest cvs version).
  - Removed ruby-dev.11262.patch, ruby-dev.11265.patch,
    and ruby-dev.11268.patch (included into above patch).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000121413.patch, added ruby_cvs.2000122019.patch
    (upgraded ruby to latest cvs version).
  - new package: libruby


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000122019.patch, added ruby_cvs.2000122215.patch
    (upgraded ruby to latest cvs version, 1.6.2-preview4).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Applied patch: upgraded to cvs version (2001-01-15):
    fixed minor bugs(e.g. ruby makes extention librares too large...).


author: akira yamada <akira@vinelinux.org>
changelog:
  - fixed bad group for libruby.
  - Applied patch: upgraded to cvs version (2001-02-08):
    fixed minor bugs.


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.6.4-2
changelog:
  - Remove Japanese description and summaries; they belong in specspo and
    break rpm
  - Clean up specfile
  - Mark language specific files (README.jp) as such
  - bzip2 sources
  - rename the libruby package to ruby-libs for consistency
  - Exclude ia64 (doesn't build - the code doesn't seem to be 64-bit clean
    [has been excluded on alpha forever])


author: Akira TAGOH <tagoh@redhat.com> 1.6.6-1
changelog:
  - New upstream release.
  - Applied bug fix patches:
    - ruby-1.6.6-501-ruby-mode.patch: ruby-talk#30479: disables font-lock
      coloring.
    - ruby-1.6.6-100.patch: ruby-talk#30203: Ruby 1.6.6 bug and fix
                            ruby-list#33047: regex bug
                            PR#230: problem with -d in 1.6.6
  - Added ruby-mode and ruby-mode-xemacs packages.
  - Ruby works fine for ia64. so re-enable to build with ia64.
    (probably it should be worked for alpha)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-1
changelog:
  - New upstream release.
  - ruby-1.6.6-100.patch, ruby-1.6.6-501-ruby-mode.patch:
    removed. these patches no longer should be needed.
  - ruby-1.6.7-500-marshal-proc.patch: applied a fix patch.
    (ruby-dev#16178: Marshal::dump should call Proc#call.)
  - ruby-1.6.7-501-class-var.patch: applied a fix patch.
    (ruby-talk#35157: class vars broken in 1.6.7)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-2
changelog:
  - ruby-man-1.4.6-jp.tar.bz2: removed.
  - ruby-refm-rdp-1.4.7-ja-html.tar.bz2: uses it instead of.
  - ruby-1.6.7-500-marshal-proc.patch, ruby-1.6.7-501-class-var.patch:
    removed.
  - ruby-1.6.7-100.patch: applied a bug fix patch.
    (ruby-dev#16274: patch for 'wm state')
    (PR#206ja: SEGV handle EXIT)
  - ruby-1.6.7-101.patch: applied a bug fix patch.
    (ruby-list#34313: singleton should not be Marshal.dump'ed)
    (ruby-dev#16411: block local var)
  - ruby-1.6.7-102.patch: applied a bug fix patch.
    (handling multibyte chars is partially broken)
  - ruby-1.6.7-103.patch: applied a bug fix patch.
    (ruby-dev#16462: preserve reference for GC, but link should be cut)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-10
changelog:
  - moved sitedir to /usr/lib/ruby/site_ruby again according as our perl and
    python.
  - ruby-1.6.7-resolv1.patch, ruby-1.6.7-resolv2.patch: applied to fix 'Too many
    open files - "/etc/resolv.conf"' issue. (Bug#64830)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-11
changelog:
  - use %configure macro instead of configure script.
  - use the latest config.{sub,guess}.
  - get archname from rbconfig.rb for %dir
  - applied some patches from Debian:
    - 801_extmk.rb-shellwords.patch: use Shellwords
    - 801_mkmf.rb-shellwords.patch: mkmf.rb creates bad Makefile. the Makefile
      links libruby.a to the target.
    - 803_sample-fix-shbang.patch: all sample codes should be
      s|/usr/local/bin|/usr/bin|g
    - 804_parse.y-new-bison.patch: fix syntax warning.
    - 805_uri-bugfix.patch: uri.rb could not handle correctly broken mailto-uri.
  - add ExcludeArch x86_64 temporarily to fix Bug#74581. Right now ruby can't be
    built on x86_64.


author: Elliot Lee <sopwith@redhat.com> 1.6.7-13
changelog:
  - Remove ExcludeArch: x86_64
  - Fix x86_64 ruby with long2int.patch (ruby was assuming that sizeof(long)
    == sizeof(int). The patch does not fix the source of the problem, just
    makes it a non-issue.)
  - _smp_mflags


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-1
changelog:
  - New upstream release.
  - removed some patches. it's no longer needed.
    - ruby-1.6.7-100.patch
    - ruby-1.6.7-101.patch
    - ruby-1.6.7-102.patch
    - ruby-1.6.7-103.patch
    - 801_extmk.rb-shellwords.patch
    - 801_mkmf.rb-shellwords.patch
    - 804_parse.y-new-bison.patch
    - 805_uri-bugfix.patch
    - ruby-1.6.6-900_XXX_strtod.patch
    - ruby-1.6.7-sux0rs.patch
    - ruby-1.6.7-libobj.patch


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-2
changelog:
  - ruby-1.6.8-require.patch: applied to fix the search bug in require.
  - don't apply long2int patch to s390 and s390x. it doesn't work.


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-7
changelog:
  - fix the gcc warnings. (#82192)
  - ruby-1.6.8-fix-x86_64.patch: correct a patch.
    NOTE: DON'T USE THIS PATCH FOR BIG ENDIAN ARCHITECTURE.
  - ruby-1.6.7-long2int.patch: removed.


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-9
changelog:
  - ruby-1.6.8-castnode.patch: handling the nodes with correct cast.
    use this patch now instead of ruby-1.6.8-fix-x86_64.patch.


author: Akira TAGOH <tagoh@redhat.com> 1.8.1-1
changelog:
  - New upstream release.
  - don't use any optimization for ia64 to avoid the build failure.
  - ruby-1.8.1-ia64-stack-limit.patch: applied to fix SystemStackError when the optimization is disabled.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.1-9
changelog:
  - ruby-1.8.1-cgi-dos.patch: security fix [CAN-2004-0983]
  - ruby-1.8.1-cgi_session_perms.patch: security fix [CAN-2004-0755]


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-1
changelog:
  - New upstream release.
  - ruby-1.8.1-ia64-stack-limit.patch: removed - it's no longer needed.
  - ruby-1.8.1-cgi_session_perms.patch: likewise.
  - ruby-1.8.1-cgi-dos.patch: likewise.
  - generated Ruby interactive documentation - senarated package.
    it's now provided as ri package. (#141806)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-7
changelog:
  - ruby-1.8.2-deadcode.patch: removed the dead code from the source. (#146108)
  - make sure that all documentation files in ruby-docs are the world-
    readable. (#147279)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-9
changelog:
  - ruby-1.8.2-xmlrpc-CAN-2005-1992.patch: fixed the arbitrary command execution
    on XMLRPC server. (#161096)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-1
changelog:
  - New upstream release.
  - Build-Requires xorg-x11-devel instead of XFree86-devel.
  - ruby-multilib.patch: applied for only 64-bit archs.
  - ruby-1.8.2-xmlrpc-CAN-2005-1992.patch: removed. it has already been in upstream.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-3
changelog:
  - fixed the wrong file list. the external library for tcl/tk was included
    in ruby-libs unexpectedly.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-4
changelog:
  - moved the documents from ruby-libs to ruby-docs, which contains the arch
    specific thing and to be multilib support. (#168826)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-0.4.preview2
changelog:
  - updates to 1.8.4-preview2.
  - renamed the packages to ruby-* (#175765)
    - irb  -> ruby-irb
    - rdoc -> ruby-rdoc
    - ri   -> ruby-ri
  - added tcl-devel and tk-devel into BuildRequires.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-1
changelog:
  - New upstream release.
    - fixed a missing return statement. (#140833)
    - fixed an use of uninitialized variable. (#144890)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-3
changelog:
  - ruby-1.8.4-no-eaccess.patch: backported from ruby CVS to avoid conflict
    between newer glibc. (#179835)


author: Akira TAGOH <tagoh@redhat.com>
changelog:
  - ruby-rubyprefix.patch: moved all arch-independent modules under /usr/lib/ruby
    and keep arch-dependent modules under /usr/lib64/ruby for 64bit archs.
    so 'rubylibdir', 'sitelibdir' and 'sitedir' in Config::CONFIG points to
    the kind of /usr/lib/ruby now. (#184199)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-6
changelog:
  - ruby-deprecated-search-path.patch: added the deprecated installation paths
    to the search path for the backward compatibility.
  - added a Provides: ruby(abi) to ruby-libs.
  - ruby-1.8.4-64bit-pack.patch: backport patch from upstream to fix unpack("l")
    not working on 64bit arch and integer overflow on template "w". (#189350)
  - updated License tag to be more comfortable, and with a pointer to get more
    details, like Python package does. (#179933)
  - clean up.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-7
changelog:
  - exclude ppc64 to make ruby-mode package. right now emacs.ppc64 isn't provided
    and buildsys became much stricter.
  - ruby-deprecated-sitelib-search-path.patch: applied to add more search path
    for backward compatiblity.
  - added byacc to BuildReq. (#194161)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-11
changelog:
  - security fixes [CVE-2006-3694]
    - ruby-1.8.4-fix-insecure-dir-operation.patch:
    - ruby-1.8.4-fix-insecure-regexp-modification.patch: fixed the insecure
      operations in the certain safe-level restrictions. (#199538)
    - ruby-1.8.4-fix-alias-safe-level.patch: fixed to not bypass the certain
      safe-level restrictions. (#199543)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-1
changelog:
  - New upstream release.
  - removed the unnecessary patches:
    - ruby-1.8.4-no-eaccess.patch
    - ruby-1.8.4-64bit-pack.patch
    - ruby-1.8.4-fix-insecure-dir-operation.patch
    - ruby-1.8.4-fix-insecure-regexp-modification.patch
    - ruby-1.8.4-fix-alias-safe-level.patch
  - build with --enable-pthread except on ppc.
  - ruby-1.8.5-hash-memory-leak.patch: backported from CVS to fix a memory leak
    on Hash. [ruby-talk:211233]


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-4
changelog:
  - security fix release.
  - ruby-1.8.5-cgi-CVE-2006-5467.patch: fix a CGI multipart parsing bug that
    causes the denial of service. (#212396)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.36-3
changelog:
  - ruby-r12567.patch: backport patch from upstream svn to get rid of
    the unnecessary declarations. (#245446)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.110-1
changelog:
  - New upstream release.
    - ruby-r12567.patch: removed.
  - ruby-1.8.6-CVE-2007-5162.patch: security fix for Net::HTTP that is
    insufficient verification of SSL certificate.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.110-2
changelog:
  - Enable pthread support for ppc too. (#201452)
  - Fix unexpected dependencies appears in ruby-libs. (#253325)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.111-1
changelog:
  - New upstream release.
  - ruby-1.8.6.111-CVE-2007-5162.patch: Update a bit with backporting the changes
     at trunk to enable the fix without any modifications on the users' scripts.
     Note that Net::HTTP#enable_post_connection_check isn't available anymore.
     If you want to disable this post-check, you should give OpenSSL::SSL::VERIFY_NONE
     to Net::HTTP#verify_mode= instead of.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.111-3
changelog:
  - Clean up the spec file.
  - Remove ruby-man-1.4.6 stuff. this is entirely the out-dated document.
    this could be replaced by ri.
  - Disable the static library building.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.114-1
changelog:
  - Security fix for CVE-2008-1145.
  - Improve a spec file. (#226381)
    - Correct License tag.
    - Fix a timestamp issue.
    - Own a arch-specific directory.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.230-1
changelog:
  - New upstream release.
  - Security fixes. (#452295)
    - CVE-2008-1891: WEBrick CGI source disclosure.
    - CVE-2008-2662: Integer overflow in rb_str_buf_append().
    - CVE-2008-2663: Integer overflow in rb_ary_store().
    - CVE-2008-2664: Unsafe use of alloca in rb_str_format().
    - CVE-2008-2725: Integer overflow in rb_ary_splice().
    - CVE-2008-2726: Integer overflow in rb_ary_splice().
  - ruby-1.8.6.111-CVE-2007-5162.patch: removed.
  - Build ruby-mode package for all archtectures.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.230-3
changelog:
  - Backported from upstream SVN to fix a segfault issue. (#452825)
  - Backported from upstream SVN to fix an integer overflow in rb_ary_fill.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.287-1
changelog:
  - New upstream release.
  - Security fixes.
    - CVE-2008-3655: Ruby does not properly restrict access to critical
                     variables and methods at various safe levels.
    - CVE-2008-3656: DoS vulnerability in WEBrick.
    - CVE-2008-3657: Lack of taintness check in dl.
    - CVE-2008-1447: DNS spoofing vulnerability in resolv.rb.
    - CVE-2008-3443: Memory allocation failure in Ruby regex engine.
  - Remove the unnecessary backported patches.


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.383-4
changelog:
  - Use bison to regenerate parse.c to keep the original format of error
    messages (bug 530275 comment 4)


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.383-5
changelog:
  - Change mkmf.rb to use LIBRUBYARG_SHARED so that have_library() works
    without libruby-static.a (bug 428384)
  - And move libruby-static.a to -static subpackage


author: Jeroen van Meeuwen <j.van.meeuwen@ogd.nl> - 1.8.6.388-8
changelog:
  - Backport openssl/digest functions providing digest and hexdigest functions
    directly in OpenSSL::Digest.methods
  - Make sure that Red Hat people version their changelog entries
  - This is actually release #1, but now needs to be release #7


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-2
changelog:
  - tcltk: Give up using potentially unmaintained ruby_1_8_6 branch
    and instead completely replace with ruby_1_8 branch head
    (at this time, using rev 27738)
    (seems to fix 560053, 590503)
  - Fix Japanese encoding strings under ruby-tcltk/ext/tk/sample/


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-3
changelog:
  - ruby-1.8.x-null-class-must-be-Qnil.patch (bug 530407)
  - Recreate some patches using upstream svn when available, and
    add some comments for patches


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-4
changelog:
  - Patch36 (ruby-1.8.x-RHASH_SIZE-rb_hash_lookup-def.patch)
    also backport rb_hash_lookup definition (bug 592936)


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-5
changelog:
  - Retry for bug 559158, Simplify the OpenSSL::Digest class
    pull more change commits from ruby_1_8 branch


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.249-3
changelog:
  - Integrated Jim Meyering's feedback and changes in to:
  - remove trailing blanks
  - placate rpmlint
  - ruby_* definitions: do not use trailing slashes in directory names
  - _normalized_cpu: simplify definition


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.299-1
changelog:
  - integrate more of jmeyering's and mtaska's feedback
  - removed emacs bits that are now shipped with the emacs package
  - various patch and spec cleanup
  - rebased to ruby 1.8.7 patch 299, removed patches no longer needed:
     ruby-1.8.7-openssl-1.0.patch, ruby-1.8.7-rb_gc_guard_ptr-optimization.patch


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.299-2
changelog:
  - readded bits to pull tk package from upstream source branch
  - removed unecessary .tk.old dir
  - renamed macros which may cause confusion, removed unused ones


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.299-3
changelog:
  - updated packaged based on feedback (from mtasaka)
  - added comments to all patches / sources
  - obsoleted ruby-mode, as it's now provided by the emacs package itself
  - readded missing documentation
  - various small compatability/regression fixes


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.7.299-4
changelog:
  - Cleanup spec file
  - Make -irb, -rdoc subpackage noarch
  - Make dependencies between arch-dependent subpackages isa specific
  - Improve sample documentation gathering


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.7.302-1
changelog:
  - Update to 1.8.7.302
  - CVE-2010-0541 (bug 587731) is fixed in this version
  - Update ext/tk to the latest head


author: Mamoru Tasaka <mtasaka@fedoraproject.org> - 1.8.7.352-1
changelog:
  - Update to 1.8.7 p352
  - CVE-2011-2686 is fixed in this version (bug 722415)
  - Update ext/tk to the latest git
  - Remove duplicate path entry (bug 718695)


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.0-2
changelog:
  - Install RubyGems outside of Ruby directory structure.
  - RubyGems has not its own -devel subpackage.
  - Enhanced macros.ruby and macros.rubygems.
  - All tests are green now (bkabrda).


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.0-4
changelog:
  - Bundled gems moved into dedicated directories and subpackages.
  - Create and own RubyGems directories for binary extensions.
  - Fix build with GCC 4.7.


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.0-5
changelog:
  - Initial release of Ruby 1.9.3.
  - Add rubygems dependency on io-console for user interactions.
  - Gems license clarification.


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.9.3.286-19
changelog:
  - Update to 1.9.3 p286
  - Don't create files when NUL-containing path name is passed
    (bug 865940, CVE-2012-4522)


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.9.3.327-21
changelog:
  - Update to 1.9.3.327
  - Fix Hash-flooding DoS vulnerability on MurmurHash function
    (CVE-2012-5371)


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.9.3.374-27
changelog:
  - Update to 1.9.3 p374
  - Fix provided variables in pkgconfig (bug 789532:
    Vít Ondruch <vondruch@redhat.com>)


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-0.1.r39387
changelog:
  - Upgrade to Ruby 2.0.0 (r39387).
  - Introduce %gem_install macro.
  - Build against libdb instead of libdb4 (rhbz#894022).
  - Move native extensions from exts to ruby directory.
  - Enable most of the PPC test suite.
  - Change ruby(abi) -> ruby(release).
  - Rename ruby executable to ruby-mri, to be prepared for RubyPick.
  - Add ruby(runtime_executable) virtual provide, which is later used
    by RubyPick.
  - RDoc now depends on JSON.
  - Try to make -doc subpackage noarch again, since the new RDoc should resolve
    the arch dependent issues (https://github.com/rdoc/rdoc/issues/71).
  - Enable SystemTap support.
  - Add TapSet for Ruby.
  - Split Psych into rubygem-psych subpackage.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-1
changelog:
  - Update to Ruby 2.0.0-p0.
  - Change %{ruby_extdir} to %{ruby_extdir_mri} in preparation for better
    JRuby support.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-3
changelog:
  - Avoid "method redefined;" warnings due to modified operating_system.rb.
  - Fix strange paths created during build of binary gems.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-7
changelog:
  - Macro definition moved into macros.ruby and macros.rubygems files.
  - Added filtering macros.
  - Filter automatically generated provides of private libraries (rhbz#947408).


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.195-8
changelog:
  - Update to Ruby 2.0.0-p195 (rhbz#917374).
  - Fix object taint bypassing in DL and Fiddle (CVE-2013-2065).
  - Fix build against OpenSSL with enabled ECC curves.
  - Add aarch64 support (rhbz#926463).


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-9
changelog:
  - Update to Ruby 2.0.0-p247 (rhbz#979605).
  - Fix CVE-2013-4073.
  - Fix for wrong makefiles created by mkmf (rhbz#921650).
  - Add support for ABRT autoloading.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-13
changelog:
  - Fixes multilib conlicts of .gemspec files.
  - Make symlinks for psych gem to ruby stdlib dirs (rhbz#979133).
  - Use system-wide cert.pem.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-14
changelog:
  - Add forgotten psych.rb link into rubygem-psych to fix "private method `load'
    called for Psych:Moduler" error (rhbz#979133).


author: Vít Ondruch <vondruch@redhat.com> - 2.1.0-17
changelog:
  - Upgrade to Ruby 2.1.0.
  - Move RPM macros into /usr/lib/rpm/macros.d directory.
  - Allow MD5 in OpenSSL for tests.


author: Vít Ondruch <vondruch@redhat.com> - 2.1.0-18
changelog:
  - Don't generate documentation on unexpected places.
  - Detect if rubygems are running under rpmbuild and install gem binary
    extensions into appropriate place.
  - Add support for ppc64le arch (rhbz#1053263).
  - Re-enable some test cases, which are passing now with Kernel 3.12.8+.
  - Backport fix for floating point issues on i686.


author: Vít Ondruch <vondruch@redhat.com> - 2.1.1-20
changelog:
  - Remove useless exclude (rhbz#1065897).
  - Extract load macro into external file and include it.
  - Kill bundled certificates.


author: Vít Ondruch <vondruch@redhat.com> - 2.1.4-24
changelog:
  - Update to Ruby 2.1.4.
  - Include only vendor directories, not their content (rhbz#1114071).
  - Fix "invalid regex" warning for non-rubygem packages (rhbz#1154067).
  - Use load macro introduced in RPM 4.12.


author: Vít Ondruch <vondruch@redhat.com> - 2.2.0-1
changelog:
  - Upgrade to Ruby 2.2.0.
  - Explicitly list RubyGems directories to avoid accidentaly packaged content.
  - Split test-unit and power_assert gems into separate sub-packages.
  - Drop libdb dependency in favor of gdbm.


author: Vít Ondruch <vondruch@redhat.com> - 2.2.2-40
changelog:
  - Fix upgrade path (rubygem-io-console's version was recently bumped in F21
    and makes the higher release to win).


author: Vít Ondruch <vondruch@redhat.com> - 2.3.0-50
changelog:
  - Upgrade to Ruby 2.3.0.
  - Move gemified net-telnet into subpackage.
  - Add did_you_mean subpackage.
  - Add virtual provides for CCAN copylibs.
  - Use weak dependencies.


author: Vít Ondruch <vondruch@redhat.com> - 2.3.1-59
changelog:
  - Continue to use OpenSSL 1.0 for the moment.
  - Add gemspec_add_dep and gemspec_remove_dep macros.
  - Harden package.


author: Vít Ondruch <vondruch@redhat.com> - 2.4.0-70
changelog:
  - Upgrade to Ruby 2.4.0.
  - Move gemified xmlrpc into subpackage.
  - Move gemified openssl into subpackage.
  - Tk is removed from stdlib.
  - Extend 'gem_' macros for pre-release version support.


author: Vít Ondruch <vondruch@redhat.com> - 2.4.1-83
changelog:
  - Fix "IOError: stream closed" errors affecting Puma.
  - Temporary disable checksec on PPC64LE (rhbz#1479302).


author: Vít Ondruch <vondruch@redhat.com> - 2.5.0-89
changelog:
  - Drop obsolete ldconfig scriptlets.
  - Add GMP dependency.
  - Use 'with' operator in RPM dependency generator.
  - Add conflicts RPM generator.
  - Fix thread_safe test suite segfaults.
  - Fix invalid licenses.


author: Pavel Valena <pvalena@redhat.com> - 2.5.0-89
changelog:
  - Fix: Multiple vulnerabilities in RubyGems
    https://bugzilla.redhat.com/show_bug.cgi?id=1547431
    https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/


author: Florian Weimer <fweimer@redhat.com> - 2.5.0-89
changelog:
  - Rebuild with new LDFLAGS from redhat-rpm-config
  - Use --with-setjmp-type=setjmp on aarch64 to work around gcc issue (#1545239)


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-92
changelog:
  - Conflict requirement needs to generate dependency.
  - Stop using --with-setjmp-type=setjmp on aarch64 (rhbz#1545239).


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-97
changelog:
  - Fix TLS 1.3 issues.
    * ruby-2.6.0-fix-test-failure-with-TLS-1.3.patch
    * ruby-2.6.0-net-http-net-ftp-fix-session-resumption-with-TLS-1.3.patch
    Related: rhbz#1616213


author: Jun Aruga <jaruga@redhat.com> - 2.5.1-99
changelog:
  - Fix generated rdoc template issues.
    * ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch
    Resolves: rhbz#1612026


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-99
changelog:
  - Additional OpenSSL 1.1.1 fixes.
    * ruby-2.6.0-fix-test-failure-with-TLS-1.3-maint.patch
    * ruby-2.6.0-config-support-include-directive.patch
    * ruby-2.6.0-use-larger-keys-for-SSL-tests.patch
    Related: rhbz#1616213


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-100
changelog:
  - Properly harden package using -fstack-protector-strong.
    * ruby-2.6.0-configure-fstack-protector-strong.patch
    Resolves: rhbz#1624168


author: Vít Ondruch <vondruch@redhat.com> - 2.5.5-104
changelog:
  - Update to Ruby 2.5.5.
    * Remove Patch25: ruby-2.6.0-Update-for-tzdata-2018f.patch; subsumed
    * Remove Patch11: ruby-2.6.0-Try-to-update-cert.patch; subsumed
    * Remove Patch19: ruby-2.6.0-net-http-net-ftp-fix-session-resumption-with
        -TLS-1.3.patch; subsumed
    Resolves: rhbz#1688758
  - Don't ship .stp files when SystemTap support is disabled.
    Related: rhbz#1657915
  - Fix CovScan issues.
    Resolves: rhbz#1628592


author: Jun Aruga <jaruga@redhat.com> - 2.6.3-105
changelog:
  - Update to Ruby 2.6.3 by merging Fedora master branch (commit: 1cc2a49)
    * Properly generate "ruby(rubygems)" versioned dependencies.
    * Extract composition of dependecy strings into helper.
    * Loosen RDoc dependency.
    * Upstream fix adding -C flag instead of changing directory for gem build.
    * Remove obsolete Group tag
    * Fix ".include =" support in openssl.cnf.
    * Link IRB back to StdLib.
    * Link IRB files instead of directories.
    * Exclude irb.rb from ruby-libs.
    Resolves: rhbz#1672575


author: Jun Aruga <jaruga@redhat.com> - 2.6.3-106
changelog:
  - Use ffi_closure_alloc to avoid segmentation fault by libffi on aarch64.
    Resolves: rhbz#1727832
  - Properly support %prerelease in %gemspec_ macros.
    Related: rhbz#1672575


author: Jun Aruga <jaruga@redhat.com> - 2.7.1-132
changelog:
  - Update to Ruby 2.7.1 by merging Fedora master branch (commit: 2981648)
    * Skip unstable tests on s390x.
    * Skip JIT tests in RHEL 8.
    Resolves: rhbz#1817135


author: Vít Ondruch <vondruch@redhat.com> - 2.7.1-133
changelog:
  - Fix `require` behavior allowing to load libraries multiple times.
    Resolves: rhbz#1842989
  - Add ruby-default-gems dependency on irb.


author: Pavel Valena <pvalena@redhat.com> - 2.7.3-136
changelog:
  - Upgrade to Ruby 2.7.3.
    Resolves: rhbz#1947938
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
    contains leading zero
    Resolves: rhbz#1944227


author: Jarek Prokop <jprokop@redhat.com> - 3.0.1-138
changelog:
  - Upgrade to Ruby 3.0.1 by merging Fedora rawhide branch (commit: 6b2ff68).
    * Add missing `rubygem-` prefix for bundled provide of 'connection_pool'.
    * Pass ldflags to gem install via CONFIGURE_ARGS
    * Remove IRB dependency from rubygem-rdoc.
    * Fix flaky excon test suite.
    * Properly support DWARF5 debug information.
        Related: rhbz#1920533
    * Bundle OpenSSL into StdLib.
    * Fix SEGFAULT in rubygem-shoulda-matchers test suite.
    * Provide `gem.build_complete` file for binary gems.
    * Re-enable test suite.
    * ruby-default-gems have to depend on rubygem(io-console) due to reline.
    * Fix SEGFAULT preventing rubygem-unicode to build on armv7hl.
    * Add support for reworked RubyGems plugins.
    * Use proper path for plugin wrappers.
    * Extract RSS and REXML into separate subpackages, because they were moved from
       default gems to bundled gems.
    * Drop Net::Telnet and XMLRPC packages, because they were dropped from Ruby.
    Resolves: rhbz#1938942
  - Fix FTBFS due to an incompatible load directive.


author: Jarek Prokop <jprokop@redhat.com> - 3.0.2-139
changelog:
  - Upgrade to Ruby 3.0.2.
    Related: rhbz#1938942
  - Fix command injection vulnerability in RDoc. (CVE-2021-31799)
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    (CVE-2021-31810)
  - Fix StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)
  - Fix dependencies of gems with explicit source installed from a
    different source. (CVE-2020-36327)
  - Pass ldflags to gem install via CONFIGURE_ARGS.
    The same comment on the changelog 3.0.1-138 was wrong.


author: Jarek Prokop <jprokop@redhat.com> - 3.0.2-140
changelog:
  - Fix rubygem-irb upgrade not working due to directory -> symlink conversion.
    Resolves: rhbz#2010949


author: Jarek Prokop <jprokop@redhat.com> - 3.3.1-2
changelog:
  - Upgrade to Ruby 3.3.1.
    Resolves: RHEL-37446
  - Fix buffer overread vulnerability in StringIO.
    (CVE-2024-27280)
    Resolves: RHEL-37448
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    (CVE-2024-27281)
    Resolves: RHEL-37449
  - Fix Arbitrary memory address read vulnerability with Regex search.
    (CVE-2024-27282)
    Resolves: RHEL-37447


author: Jarek Prokop <jprokop@redhat.com> - 3.3.5-3
changelog:
  - Upgrade to Ruby 3.3.5
    Resolves: RHEL-55409
  - Fix DoS vulnerability in rexml.
    (CVE-2024-39908)
    (CVE-2024-41946)
    (CVE-2024-43398)
    Resolves: RHEL-57049
    Resolves: RHEL-57054
    Resolves: RHEL-57069
  - Fix REXML DoS when parsing an XML having many specific characters such as
    whitespace character, >] and ]>.
    (CVE-2024-41123)
    Resolves: RHEL-52783


author: Jun Aruga <jaruga@redhat.com> - 2.5.5-105
changelog:
  - Use ffi_closure_alloc to avoid segmentation fault by libffi on aarch64.
    Resolves: rhbz#1727832
  - Properly support %prerelease in %gemspec_ macros.
    Related: rhbz#1688758
  - Fix rdoc gzipped javascript pages are not the same across multilib.
    Resolves: rhbz#1719647


author: Pavel Valena <pvalena@redhat.com> - 2.5.9-107
changelog:
  - Update to Ruby 2.5.9.
    * Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed
    Resolves: rhbz#1757844
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
    contains leading zero
    Resolves: rhbz#1950308


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-108
changelog:
  - Fix command injection vulnerability in RDoc.
    Resolves: CVE-2021-31799
  - Fix StartTLS stripping vulnerability in Net::IMAP
    Resolves: CVE-2021-32066
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    Resolves: CVE-2021-31810


author: Jun Aruga <jaruga@redhat.com> - 2.5.9-110
changelog:
  - Fix FTBFS due to an incompatible load directive.
  - Fix a fiddle import test on an optimized glibc on Power 9.
  - Fix by adding length limit option for methods that parses date strings.
    Resolves: CVE-2021-41817
  - CGI::Cookie.parse no longer decodes cookie names to prevent spoofing security
    prefixes in cookie names.
    Resolves: CVE-2021-41819


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-111
changelog:
  - Fix HTTP response splitting in CGI.
    Resolves: CVE-2021-33621
  - Fix Buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739
  - Fix ReDoS vulnerability in URI.
    Resolves: CVE-2023-28755
  - Fix ReDoS vulnerability in Time.
    Resolves: CVE-2023-28756


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 2.5.9-111.0.1
changelog:
  - Fix FTBFS due to glibc 2.31.9000 implementing lchmod(2), compatible with glibc2.28 also
    * Patch: ruby-2.8.0-Brace-the-fact-that-lchmod-can-EOPNOTSUPP.patch
    * Patch: ruby-2.8.0-Moved-not-implemented-method-tests.patch
  - Avoid possible timeout errors in TestBugReporter#test_bug_reporter_add.
    * Patch: ruby-2.7.1-Timeout-the-test_bug_reporter_add-witout-raising-err.patch


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-112
changelog:
  - Fix ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755.
    (CVE-2023-36617)
    Resolves: RHEL-5614
  - Fix Buffer overread vulnerability in StringIO.
    (CVE-2024-27280)
    Resolves: RHEL-34125
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    (CVE-2024-27281)
    Resolves: RHEL-34117
  - Fix Arbitrary memory address read vulnerability with Regex search.
    (CVE-2024-27282)
    Resolves: RHEL-33867
  - Fix REXML DoS parsing an XML with many `<`s in an attribute value.
    (CVE-2024-35176)
    Resolves: RHEL-37877


author: Jarek Prokop <jprokop@redhat.com> - 2.6.7-107
changelog:
  - Upgrade to Ruby 2.6.7.
    Resolves: rhbz#1757846
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given an address
    containing leading zero
    Resolves: rhbz#1950307
  - Fix: Rubygem-bundler: Don't use insecure tmp directory as home
    allows for execution of malicious code.
    Resolves: CVE-2019-3881


author: Jun Aruga <jaruga@redhat.com> - 2.6.9-108
changelog:
  - Upgrade to Ruby 2.6.9.
  - Skip JIT tests in RHEL 8.
  - Fix the issues required to start the "make test-bundler" itself.
  - Fix Bundler dependency confusion.
    Resolves: CVE-2020-36327


author: Vít Ondruch <vondruch@redhat.com> - 2.6.10-109
changelog:
  - Upgrade to Ruby 2.6.10.
    Resolves: rhbz#2088415
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739
  - Fix FTBFS due to an incompatible load directive.
  - Fix a fiddle import test on an optimized glibc on Power 9.


author: Jun Aruga <jaruga@redhat.com> - 2.7.4-137
changelog:
  - Upgrade to Ruby 2.7.4.
  - Fix command injection vulnerability in RDoc.
    Resolves: CVE-2021-31799
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    Resolves: CVE-2021-31810
  - Fix StartTLS stripping vulnerability in Net::IMAP.
    Resolves: CVE-2021-32066
  - Upgrade to Bundler 2.2.24.
    Resolves: CVE-2020-36327


author: Jarek Prokop <jprokop@redhat.com> - 2.7.6-138
changelog:
  - Upgrade to Ruby 2.7.6.
    Resolves: rhbz#2109424
  - Fix FTBFS due to an incompatible load directive.
    Related: rhbz#2109424
  - Fix a fiddle import test on an optimized glibc on Power 9.
    Related: rhbz#2109424
  - Fix regular Expression Denial of Service Vulnerability of Date Parsing Methods.
    Resolves: CVE-2021-41817
  - Fix cookie prefix spoofing in CGI::Cookie.parse.
    Resolves: CVE-2021-41819
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739


author: Jarek Prokop <jprokop@redhat.com> - 3.0.4-141
changelog:
  - Upgrade to Ruby 3.0.4.
    Resolves: rhbz#2109431
    Resolves: rhbz#2110981
  - Fix double free in Regexp compilation.
    Resolves: CVE-2022-28738
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739


author: Jarek Prokop <jprokop@redhat.com> - 3.0.4-141
changelog:
  - Upgrade to Ruby 3.0.4.
    Resolves: rhbz#2096346
    Resolves: rhbz#2000056
  - Fix double free in Regexp compilation.
    Resolves: CVE-2022-28738
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739


author: Jun Aruga <jaruga@redhat.com> - 3.0.7-142
changelog:
  - Upgrade to Ruby 3.0.7.
    Resolves: RHEL-36189
  - Fix HTTP response splitting in CGI.
    Resolves: RHEL-36193
  - Fix ReDoS vulnerability in URI.
    Resolves: RHEL-36196
  - Fix ReDoS vulnerability in Time.
    Resolves: RHEL-36205
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-36198
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-36200
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-36203


author: Jun Aruga <jaruga@redhat.com> - 0.5.2-1
changelog:
  - New upstream release 0.5.2 by merging Fedora master branch (commit: cc15309)
    Resolves: rhbz#1672575


author: Jun Aruga <jaruga@redhat.com> - 0.5.3-1
changelog:
  - New upstream release 0.5.3 by merging Fedora master branch (commit: 674d475)
    Resolves: rhbz#1817135


author: Jarek Prokop <jprokop@redhat.com> 0.5.3-2
changelog:
  - Update by merging Fedora rawhide branch (commit: 81e2cc9)
  - Fix Mysql2::Result test for Ruby 3.1.
  - Remove gem_make.out and mkmf.log files from the binary RPM package.
  - Fix test assertion for mariadb-connector-c.
    Related: rhbz#2063772


author: lihaipeng <lihaipeng@openanolis.org> - 1.0.0-3.0.1
changelog:
  - Changed the way how/when parameters are interpret
  - Reference https://github.com/ged/ruby-pg/commit/73cd5e158ba4af73243c22f8918b1754256db17b


author: Jun Aruga <jaruga@redhat.com> - 1.1.4-1
changelog:
  - Update to pg 1.1.4 by merging Fedora master branch (commit: 397796e)
    * BuildRequires: s/postgresql-devel/libpq-devel/
    * Add marking lines at the start and end of the setup.log
    Resolves: rhbz#1672575


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.12-1
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.1.12
  - fixes CVE-2024-21626
  - Resolves: RHEL-23587


author: Lokesh Mandvekar <lsm5@redhat.com> - 0.0.8-1.git4155b68
changelog:
  - Resolves: rhbz#1277245 - bump to 0.0.8
  - Resolves: rhbz#1302363 - criu is a runtime dep
  - Resolves: rhbz#1302348 - libseccomp-golang is bundled in Godeps
  - manpages included


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.0.0-1.rc2
changelog:
  - Resolves: #1412239 - *CVE-2016-9962* - set init processes as non-dumpable,
  runc patch from Michael Crosby <crosbymichael@gmail.com>


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.0.0-9.1.gitf8ce01d
changelog:
  - Resolves: #1447078 - change default root path
  - add commit e800860 from runc @projectatomic/change-root-path


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1.0.0-24.rc4.dev.gitc6e4a1e.1
changelog:
  - rebase to c6e4a1ebeb1a72b529c6f1b6ee2b1ae5b868b14f
  - https://github.com/opencontainers/runc/pull/1651


author: Dan Walsh <dwalsh@redhat.com> - 2:1.0.0-40.rc5.dev.gitad0f525
changelog:
  - Remove sysclt handling, not needed in RHEL8
  - Make sure package built with seccomp flags
  - Remove rectty
  - Add completions


author: Dan Walsh <dwalsh@redhat.name> - 2:1.0.0-46.dev.gitb4e2ecb
changelog:
  - Add patch https://github.com/opencontainers/runc/pull/1807 to allow
  - runc and podman to work with sd_notify


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-68.rc92
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0.3-6
changelog:
  - Fix every podman run invocation generates two "Couldn't stat device
    /dev/char/10:200: No such file or directory" lines in the journal
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.3-3
changelog:
  - fix "Error: runc: exec failed: unable to start container process:
    open /dev/pts/0: operation not permitted: OCI permission denied"
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.10-1
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.1.10
  - require container-selinux >= 2.224.0 for dmz feature
  - Related: Jira:RHEL-2110


author: Matej Habrnal <mhabrnal@redhat.com> 0.21-1
changelog:
  - New upstream version
    - Introduce 'serial' field in uReport
    - normalization: actualize list of functions


author: Jakub Filak <jakub@thefilaks.net> 0.22-1
changelog:
  - New upstream version
    - Added support fof JavaScript (V8) stack traces
    - Most parts of the in-hook core unwinder callable under unprivileged user
    - GDB core unwinder limits number of unwound frames
    - Fixed a pair of compile warnings - Chris Redmon <credmonster@gmail.com>


author: Matej Habrnal <mhabrnal@redhat.com> 0.23-1
changelog:
  - New upstream version
    - Allow rpm to be optional at build time
    - Do not use deprecated fedorahosted.org


author: Julius Milan <jmilan@redhat.com> 0.24-1
changelog:
  - New upstream version
    - Allow to report unpackaged problems
    - apidoc: generate html docs using doxygen
    - Fix parsing of subset of arm kernel oopses


author: Martin Kutlak <mkutlak@redhat.com> 0.25-1
changelog:
  - New upstream version
   - Normalization: actualize list of functions
   - Fix some compilation warnings
   - Allow to build python3 for rhel8
   - Makefile: add make release-* subcommands
   - Elfutils: Add missing stubs from earlier commit


author: Matej Habrnal <mhabrnal@redhat.com> 0.26-1
changelog:
  - spec: fix Allow python2 to be optional at build time
  - Allow python2 to be optional at build time
  - normalization: actualize list of functions
  - Append Python interpreter as related package
  - makefile: create .tar.xz with make release


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.2-1
changelog:
  - rebase to upstream v1.4.2
  - make sbd default to do pacemakerd-api handshake
  - conflict with pacemaker-libs < 2.0.5-4 to assure pacemaker
    is defaulting to pacemakerd-api handshake

    Resolves: rhbz#1903730
    Resolves: rhbz#1873135


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.2-3
changelog:
  - change the default for SBD_WATCHDOG_TIMEOUT to 10s
    s390(x) stays at 15s as before

    Resolves: rhbz#1922143


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.0-2
changelog:
  - reverted watchdog_timeout_default to 5s
    (slipped in via an unreleased change on 8.4.0 branch)

    Resolves: rhbz#1980797


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-1
changelog:
  - rebase to upstream v1.5.2
  - convert license naming to SPDX
  - make static analysis happy with a few checks & rearanges with
    dynamic-memory-management

    Resolves: rhbz#2168567


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-2
changelog:
  - add required tests subdirectory in addition to gating.yaml
    that had already been brought over before

    Related: rhbz#2168567


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-10
changelog:
  - Fix docdir patch (patch Makefile.am, not Makefile.in)
  - Use correct short name for Eclipse Public License 1.0
  - Use %license
  - Add explicit dependencies for libraries in Makefile.am (fixes FTBFS)
    Resolves: #1606302


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-14
changelog:
  - Fix getting of InstallDate property, improve it to work on non en_US locales
    and update support for recent Fedora distributions
    Resolves: #1776670


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.9-24
changelog:
  - Fix important coverity issues
    Resolves: #1989603
  - Fix incorrect use of temporary paths
    Resolves: #1989605


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.5.0-1
changelog:
  - Update to latest upstream version
  - Change license to Eclipse Public License 1.0
  - Use %license
  - Fix URL


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-10
changelog:
  - Fix null pointer (DoS) vulnerability via POST request to /cimom (CVE-2018-6644)
    (patch by Adam Majer)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-16
changelog:
  - Use %license for file which contains the text of the license
  - Change versioned docdir to unversioned and rename the docdir to match
    the package name
  - Remove %defattr
    Resolves: #1638007


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-9
changelog:
  - Use %license for file which contains the text of the license
  - Change versioned docdir to unversioned and rename the docdir to match
    the package name
  - Fix license tag
    Resolves: #1638015


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.24-1
changelog:
  - Add 'fur' into shipped locales
  - Update translations (#1820570)
  - Log full reports with correct syslog identifier
  - Cancel pending alarm during AVC analyses


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.24-2
changelog:
  - Optimize get_rpm_nvr_by_type by adding a cache (#1794807)
  - Stop building seappletlegacy (#1878792)
  - Update translations


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-1
changelog:
  - Revert "Replace pydbus with dasbus"
  - Fix typos in --help, man pages and developer's guide (#2028226)
  - Do not use Python slip package
  - Stop SetroubleshootFixit after 10 seconds of inactivity
  - Fix plugin exception reporting
  - export alert dbus signal
  - Make sure local_policy_package is not None
  - sealert: add "Last Seen" column to alert list


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-4
changelog:
  - Decrease setroubleshootd priority and limit RAM utilization to 1GB (#2064727)
  - doc: Document performance related changes


author: Dan Walsh <dwalsh@redhat.com> - 0.7-1
changelog:
  - Fix setroubleshoot_dispatcher to catch all information from
     avc. Much cleaner interface and no longer uses audit2allow cruft.
  - Remove toolbar from popup window since it did nothing, and I
     think it looks better without it.
  - fix allow_execmod plugin to report better data.


author: Dan Walsh <dwalsh@redhat.com> - 0.8-1
changelog:
  - Added a bunch more plugins
      [Karl MacMillan <kmacmill@redhat.com>]
  - Add allow_cvs_read_shadow.py, allow_ftp_use_cifs, allow_ftp_use_nfs, and allow_gssd_read_tmp.
  - Change AVC to have additional helpers for matching messages.
  - Change Plugin to work better with more than one solution.


author: Dan Walsh <dwalsh@redhat.com> - 0.15-1
changelog:
  [Karl MacMillan <kmacmill@redhat.com>]
  - Add generic templating mechanism to Plugin
  - Ported all plugins to use templating mechanism


author: Dan Walsh <dwalsh@redhat.com> - 0.16-1
changelog:
  [John Dennis <jdennis@redhat.com>]
  - modify SetFilter in server to return errors instead of
     throwing an exception. Default the filter list on each alert display.
  - minor tweaks to alert queue handling
  - fix analyze() parameter list in ftp_is_daemon.py plugin
  - sealert now responds to pending alerts more correctly, it shows
     how many pending alerts are in the queue, if you filter the pending
     alert status is updated, the next alert button will advance you
     to the next alert in the queue
  - simplify major pieces of sealert by coalescing common code
     into subroutines.
      [Dan  Walsh <dwalsh@redhat.com>]
  - Complete all boolean plugins except disable
  - Make Close button work.
  - Make setroubleshoot_dispatcher exit if it gets an avc about itself


author: Dan Walsh <dwalsh@redhat.com> - 0.17-1
changelog:
  [John Dennis <jdennis@redhat.com>]
  - clean up and rework the timestamp code in util.py so that
     time zones are handled properly, there were a number of bugs.
     Hopefully it's correct now because timezone handling is a pain.
  - change the time format in the browser so all times are displayed
     identically, the friendly time relative format was hard to compare.
  - modify the plugin 'make install' to delete all existing plugin's
     prior to installing the new ones
  - add popup menu to status icon to choose between browser and
     alert GUI (not fully connected yet). Several bug fixes related
     to changing the filter_type from a string to an int.
  - add filter selection to bottom pane, change filter_type from
     string to integer constant. Enhance how columns are handled.
     Get init_combo_box to work. Remove unused RPM and Bugzilla
     fields from bottom pane. Modify the default size of the browser
     window. Fix missing import in util.py.
  - add ability in broswer to sort on columns, initially the report
     count column and the last seen date column. The date column now
     stores a TimeStamp object instead of a string. Add new method
     to TimeStamp to return a friendly string relative to the current
     time. The date column in the browser now has a cell data function
     which invokes the friendly format method of the TimeStamp object.
  - add ability fo serialize to/from xml for classes which can
     inititialized from strings and serialized as strings (e.g. numbers,
     TimeStamps, etc.)
  - add count of how many times a signature is reported, the date
     when first and last reported, add columns for report count and
     last date count to browser.
  - checkpoint browser code, list pane and detail pane now working.
  - add initial support for browser applet, move some functions which
     kept getting reused to util.py
  - add reporting of environment to email alert (email alerts still
     need work)
      [Dan  Walsh <dwalsh@redhat.com>]
  - Fix disable_trans.py set_boolean call
  - Complete all boolean plugins except disable
  - Change interface to use audit unix domain socket


author: Dan Walsh <dwalsh@redhat.com> - 0.19-1
changelog:
  2006-08-08  Dan Walsh <dwalsh@redhat.com>
  - Fix up handling of mls ranges in context
  - Cleanup some pychecker errors

  2006-08-07  John Dennis <jdennis@redhat.com>
  - add first seen, last seen, and report count to alert detail view
  - make the seen icon work, if the alert has been displayed more
     than N seconds, mark the alert as having been seen by the user
     and update the icon is the list view
  - change the schema for the xml data; the database now has a version,
     there is a local id attached to each signature, the filter list in
     the siginfo was replaced by a list of per user data, the per user
     data now contains the filter, seen_flag. Modify all the code which
     was operating on the filter information to use the new model.
  - fix the xml serialization so that booleans can be used as a basic
     type and also so that non-string types can be used in element
     attributes (e.g. int, bool) and the serialization code will
     automatically convert between python types and strings.


author: John Dennis <jdennis@redhat.com> - 0.27-1
changelog:
  - load_plugins() now catches exceptions when a plugin won't load,
     reports the traceback in the log file, and continues with the next
     plugin. Previously a bad plugin caused the entire plugin loading
     to abort and no plugins were loaded.
  - Add "daemon_name" to automake variables, change pid file to match
  - turn off "noreplace" on config file till things settle down a bit
  - browser.py now validates data, also test for missing column data in the
     cell_data function to avoid exceptions.
  - add stub for analyzie_logfile() rpc call
  - turn off balloon notifications by default in config file,
     libnotify is just plain busted at this point :-(
  - only the setroubleshootd daemon creates it's log file
     under /var/log now, the user app's do it in /tmp, change file
     permissions on /var/log/setroubleshoot back to 0644.
  - sealert now looks up the username rather than hardcoding it to "foo"
  - CamelCase to lowercase_underscore clean up


author: John Dennis <jdennis@redhat.com> - 0.30-1
changelog:
  - fix bug 203479, missing requires of audit-libs-python
  - add support to sealert to listen on a dbus session signal to display
     the gui. This is needed for when the status icon is not visible and
     the user wants to see the UI. There is now a seperate program
     setroubleshoot_launch_gui which emits the signal.


author: Dan Walsh <dwalsh@redhat.com> - 0.32-1
changelog:
  - Add avc_syslog to syslog translated avc message
  - Fix submitbug button
      [John Dennis <jdennis@redhat.com>]
  - fix signature inflation, all data attached to a signature is now
     encapsulated in a SEFaultSignatureInfo (siginfo) class. The GUI no
     longer reaches into a signature looking for information, it looks
     in the siginfo. The Plugin class now defines the method
     get_signature() which report() calls to obtain the signature. The
     default signature provided by the Plugin class includes the
     analysisID, an AVC with just the src & target contexts, and the
     object_path. All data accesses and parameters which had been "sig
     and solution" are now done via the unified siginfo class. There is
     still a bit more work to be done on this but this represents a
     reasonble point to checkpoint the code in CVS.


author: Dan Walsh <dwalsh@redhat.com> - 0.34-1
changelog:
  - Standardize on the browser. remove alert window
      [John Dennis <jdennis@redhat.com>]
  - remove all vestiges of popup alert, now browser is the only
     UI game in town
  - restore the automatic updating of the browser window which had
     been a regression, the AlertClient class now emits signals which
     the GUI classes can connect to receive signals from the fault server,
     also fix the "mark seen" regression
  - browser.py: restore mark_seen timeout


author: John Dennis <jdennis@redhat.com> - 0.35-1
changelog:
  - add sorting on category column and seen column in browser,
     fix reference to my_draw() in print function.

  - make browser window hidden by default so it does not flash
     when it's first realized, connect to the "realize" signal to
     initially position the vpane, add signal handlers to track
     when the browser is visible, the presentation of the status
     icon now checks if the browser is visible, the status icon is
     not presented if the browser is already displayed.


author: Dan Walsh <dwalsh@redhat.com> - 0.38-1
changelog:
  [Dan  Walsh]
  - Hook up the rest of the menu bars on browser window
  - Add public_content.py plugin
      [John Dennis <jdennis@redhat.com>]
  - add delete_signatures() method to AlertClient class
  - start using the AppBar in the browser.
  - "open logfile" now connected all the way from browser menu
     to server rpc, still needs implementation, but "plumbing" is working.
  - fixes for the date/time dialog
  - remove install of setroubleshoot.glade, we now only use
     setroubleshoot_browser.glade
  - some fixed to DateTimeDialog


author: Dan Walsh <dwalsh@redhat.com> - 0.39-1
changelog:
  - Add Icon
      [John Dennis <jdennis@redhat.com>]
  - dispatcher.py: rework how audit messages injected into the
     system and processed. Much of this work was in support of log file
     scanning which should be coupled to the exact same processing code
     as audit messages arriving from the audit socket. In essence log
     file scanning synthesizes an audit message and we inject it into
     the system the same way socket messages are injected. This was
     also an excellent moment correctly handle out of order audit
     messages, something we were not able to handle previously. This
     may have been contributing to splitting what should have been a
     single alert into two or more separate alerts because we didn't
     recongize the incoming audit events as a single event. Correctly
     assembling out of order messages introduced a fair amount of extra
     complexity as we now maintain a cache of recent audit events, this
     is fully documented in dispatcher.py
  - Turn notifications back on by default.
      [Karl MacMillan <kmacmill@redhat.com>]
  - Separated out HTML rendering and made it easier to translate.


author: Dan Walsh <dwalsh@redhat.com> - 0.40-1
changelog:
  - Fix notification window problems.  Now dissappears and does not regenerate if
  it has already been seen


author: Dan Walsh <dwalsh@redhat.com> - 0.42-1
changelog:
  [Karl MacMillan <kmacmill@redhat.com>]
  - Add rpm information for target.
  - Add hostname and uname to signature info
  - Add display of the full AVC
  - Add display of the analysis id
  - Change html generation to be separated out and us elemmenttree
      [John Dennis <jdennis@redhat.com>]
  - add CommunicationChannel class to encapsulate data transfer
     operations, in particular to provide an object threads can lock
     during data transfer.
  - checkpoint the logfile scanning code, somewhat working


author: Dan Walsh <dwalsh@redhat.com> - 0.43-1
changelog:
  - Fix mail handling
  - fix bugs related to recording per user per signature filtering
      [John Dennis <jdennis@redhat.com>]
  - fix bugs related to recording per user per signature filtering
      [Karl MacMillan <kmacmill@redhat.com>]
  - Add signal handling to client and server.
  - Fix minor plugin bugs.


author: Dan Walsh <dwalsh@redhat.com> - 0.46-1
changelog:
  - Add new plugins cvs_data, rsync_data, xen_image, swapfile, samba_share
      [John Dennis <jdennis@redhat.com>]
  - clear the GUI of old data before loading new data,
     fix the code used to display the filter icon in the filter column


author: Dan Walsh <dwalsh@redhat.com> - 0.48-1
changelog:
  - Sealert only notify dropped connection once
  - setroubleshoot shutdown cleanly
      [John Dennis <jdennis@redhat.com>]
  - Gui cleanups


author: Dan Walsh <dwalsh@redhat.com> - 1.0-1
changelog:
  - Release of first version
  - Fix icon
      [John Dennis <jdennis@redhat.com>]
  - Memory leak fixes
  - Substitution fixes
  - File names in hex fixes


author: Dan Walsh <dwalsh@redhat.com> - 1.3-1
changelog:
  - Speed enhancments
      [John Dennis <jdennis@redhat.com>]
  - log file parsing now approx 4 times faster
  - greatly enhance the statistics reporting capability in attempt
     to diagnose slow log file parsing performance
  - make gathering of environmenatal information optional,
     environment information is only relevant at the time the
     alert fires, not in a post processing scenario
  - clean up several places where environmental information was
     assumed and/or was always gathered, or gathered in the wrong place.


author: Dan Walsh <dwalsh@redhat.com> - 1.7-1
changelog:
  [John Dennis <jdennis@redhat.com>]
  - Add command line utilities
  - logfile scanning finally seems to work connected to browser
  - Additional Information section of report now includes line
     number information (if alert was generated from logfile)
  - replace database update_callback() with notify interface, a more
     generic solution more easily shared between components
  - object implementing rpc method is now explicitly attached via
     connect_rpc_interface() instead of walking the MRO chain with
     magic exclusions. explicitly connecting is more flexible and
     robust (no getting the wrong object by mistake)
  - fix handling of return args in local rpc case
  - fix signal connections between audit and logfile
  - split databae and database_properties for audit and logfile
  - fix initial connection state
  - fix lookup_local_id


author: John Dennis <jdennis@redhat.com> - 1.8.1-1
changelog:
  - Fixes 216936, bug 215290, add 'Copy Alert' edit menu item
  - clean up menu items, add tooltips
  - fix printing so it will work with multiple alerts, force font to
     monospace 10pt, display error dialog if printing fails.
  - Fixes 216908, platform and raw audit messages were not wrapped
     to fit on page.
  - Related: 216575, update i18n po files
  - Fixes 216941, set default folder for save operation, also set
     default filename
  - Fixes 216327 add menu items "toggle hide deleted", "select none". Add model
     filter to control visibility of alerts
  - Fixes 214218, sealert with no command line
     arguments induces startup as dbus service, this had been a
     regression.
  - Fixes 216327, rework how deletes are performed in browser. Delete
     now marks each seleted siginfo with a delete flag, expunge
     permanently deletes siginfo's marked for deletion, also add undelete
     command, removed delete confirmation dialog. Modify how text
     attributes in cell renderer are computed to allow for
     strike-throughs of alerts marked for deletion.
  - multiple alerts can now be selected, add select all command,


author: John Dennis <jdennis@redhat.com> - 1.8.3-1
changelog:
  - Fixes 217961, sealert needs pygtk2-libglade
  - more i18n translations
  - Fixes 217710, date representation did not respect locale,
     at the same time remove old date formatting code, now cruft since
     we can't use it because it was specific to US English.
  - fix how selections are handled when rows are expunged.
  - add Copy to Edit menu, for copying selection from detail pane,
     unfortunately gtkhtml2 widget does not preserve line breaks between
     table rows.


author: John Dennis <jdennis@redhat.com> - 1.8.5-1
changelog:
  - fix bug, "could not convert path to a GtkTreePath" when database 
     is initially empty, caused by last_selected_row == None


author: John Dennis <jdennis@redhat.com> - 1.8.6-1
changelog:
  - Fixes 218150,
     "If view is set to "hide delete" you cannot filter new entries"
     Actually, the bug was toggle cell renderer was connected to the
     base model instead of the model attached to the view, the sort
     model, this meant the toggle was occuring on the wrong row if
     the view was sorted differently than the base model.


author: John Dennis <jdennis@redhat.com> - 1.8.11-1
changelog:
  - Fixes 216575, more translations
  - Replace delete and expunge menu labels with something more intuitive
  - add ability for browser to be restarted with identical window
     position and state
  - add pkg version and protocol version to logon handshake, test for
     compatibility between clint and server, prompt for restart
  - add non-modal restart dialog
  - add dialog to display traceback if sealert faults with an uncaught
     exception, try to limit invisible errors
  - fix return args on rpc method
  - add instance id to server


author: John Dennis <jdennis@redhat.com> - 1.8.13-1
changelog:
  - update translations

  - change SETroubleshootDatabase so it is optional if it's backed
     by a file, this fixes the problem of us littering temporary files
     when scanning logfiles which does not require persistence.

  - disable the view logfile menu item if no logfile has been opened

  - fix redundant log messages for case where there is no log file and
     the console flag is set. When there is no log file the logging
     module opens a console stream, thus the console stream produced
     by the console flag was redundant.

  - add username and password command line arguments
     rework startup logic so that all command line args are processed
     before we do any real work
   
  - rework the email preferences so that each email address can
     have a filter type associated with it.

     add a new filter_type "Ignore After First Alert" which filters
     after the first alert has been delivered

  - add UI for setting the email addresses alerts are sent to.
     Add menu item to edit email list, add email list dialog.
     Remove 'recipient' config file entry, now list is stored
     in seperate file. Add rpc to query and set the email list,
     the GUI calls this to get the current list from the server
     and set it in the server, it is the server which reads and 
     writes the file. Add 'enable' flag to each email entry.
     Modify how the server iterates over the email list when it
     receives an alert. When marking an alert as having been sent
     the username is the email address but with 'email:' prepended so
     as not to collide with non-email filtering options for the same user.


author: John Dennis <jdennis@redhat.com> - 1.8.14-1
changelog:
  - Fixes 221850
     plugin module loading was failing in python 2.5 with the message
     "SystemError: Parent module 'plugins' not loaded". This is due to a
     change in behavior between python 2.4 and 2.5, in python 2.4 the lack
     of a parent module was silently ignored. The fix is to load
     plugins.__init__ first.


author: John Dennis <jdennis@redhat.com> - 1.8.16-1
changelog:
  [John Dennis <jdennis@redhat.com>]
  - Fixes Bug# 224343 sealert's "Aditional Info:" text should be in white box
  - Fixes Bug# 224336 sealert should have GtkRadioButtons in menu View
  - Related: bug 224351
     Rewrite parts of logging support to better support changing output
     categories, output destinations. Now -v -V verbose works in sealert.
  - Resolves bug 225161, granted AVC's incorrectly identified as a denial
  - add alert count to status bar
  - add "Help" command to Help menu, opens web browser on wiki User FAQ
      [Dan Walsh  <dwalsh@redhat.com>]
  - Make setroubleshoot.logrotate correctly


author: John Dennis <jdennis@redhat.com> - 1.9.3-1
changelog:
  - install icon in /usr/share/icons, refer to icon by name using standard API
  - Fix performance problems in setroubleshoot browser log file scanning
  - Significant rewrite of data/view management code in setroubleshoot
     browser. data and view now cleanly separated, can easily switch
     between data views while maintaining selections, view state, with
     proper update of status information in status area
  - Resolves Bug# 227806: right click context menu resets selection
  - Logfile scans now operate in independent thread, proper asynchronous
     updates of browser during scan, browser used to appear to hang
  - Resolves Bug# 224340: Rewrite Menu/Toobar/Popup to use UIManger instead of glade
  - Add toobar support
  - Implement GUI to edit email recipient list in setroubleshoot browser
  - Added user help to setroubleshoot browser
  - Related Bug# 224343: Fix setroubleshoot browser to respond to desktop theme changes
  - improve traceback error reporting in sealert
  - rewrite AboutDialog, replacing glade version
  - Resolves bug 229849  Bug# 230115, Relates bug 221850: fix uuid code to resolve
     '_uuid_generate_random' is not defined error


author: Dan Walsh <dwalsh@redhat.com> - 1.9.4-1
changelog:
  - Remove disable_trans boolean
  - Check for paths in filesystem before suggesting chcon -R 
  - Remove default to listen on local ports


author: John Dennis <jdennis@redhat.com> - 1.9.6-1
changelog:
  - add avc_auparse.py, now has option to use audit parsing library instead of
     built-in audit parsing.
  - fix bug in log file scanning and detail display update
  - Resolves Bug# 238516, python pkg directory not owned


author: John Dennis <jdennis@redhat.com> - 1.9.7-1
changelog:
  - Resolves Bug# 241739, this bug is the lead bug for several bug reports,
     all consequences of the same problem, setroubleshootd/sealert when run
     in a non latin language environment because of incompatibilities in
     i18n encoding between components.


author: John Dennis <jdennis@redhat.com> - 1.10.0-1
changelog:
  - move all plugins and their translations to independent package
  - wrap XML generation inside try/except
  - correct how access list is obtained in avc_auparse.py
  - add try/except around top level of AnalyzeThread.run so exceptions
     in the thread get reported and the analysis thread does not just die.
  - also add try/except around LogfileThread.process_logfile
  - add new function assure_file_ownership_permissions()
  - server now forces it's database file permissions/ownership to be 0600 root:root
  - rpm now forces the server's database file permissions/ownership to be 0600 root:root
  - Resolves Bug #251545: Review Request: setroubleshoot-plugins - analysis plugins for setroubleshoot
  - clean up some other rpmlint warnings in setroubleshoot.spec
  - fix missing install of setroubleshoot icon and sym link to it
  - Resolves Bug #251551, setroubleshoot shows up in in wrong desktop menu
     also run desktop-file-install in rpm install
  - add /etc/dbus-1/system.d/setroubleshootd.conf dbus configuration file
  - Resolves Bug #250979, Bug #250932 Missing dependencies
  - Restore plugins/Makefile.am which got nuked somehow
  - remove dus.dbus_bindings.bus_name_has_owner(), deprecated as of F7
  - wrap rpm transactions in try/except


author: John Dennis <jdennis@redhat.com> - 1.10.2-1
changelog:
  - remove all copied code from test_setroubleshootd, now we import
     from setroubleshoot
   
  - export ClientConnectionHandler from rpc.py as a base class.
     Derive SetroubleshootdClientConnectionHandler and
     AuditClientConnectionHandler from ClientConnectionHandler.

  - add audisp_listen as test program

  - create setroubleshoot sym link in top devel directory pointing
     to src so import setroubleshoot.foo if PYTHONPATH=topdir

  - add get_option, convert_cfg_type to config.py.in so that one
     can pass optional dict to override config file settings

  - rewrite log_init() so it's easier for other programs to use it,
     fix the import logic concering log & config

  - remove log code from test_setroubleshoot, now just does import
     from setroubleshoot.
   
  - test_setroubleshootd can now handle audit records in both text
     and binary formats, can be selected by command line arg. It can now
     either output to clients connecting on a socket or to stdout. Can
     now optionally exit after N socket client connections.

  - remove non audit record lines from test data

  - remove config_init() and log_init() from package __init__.py
     It was the wrong place to call them, now call them when the
     process initializes before the first setroubleshoot imports

  - add parse_config_setting() and set_config() to config module
  - setroubleshootd now accepts -c --config command line arg
  - test_sectroubleshoot: add err defines & program_error exception
     add is_valid() tests to assure we read a valid audit record
     log the unrecognized line if not valid, clean up socket close()

  - Relates Bug #247056, update initscript to LSB standards
     Note: LSB initscripts in Fedora is not yet a resolved issue,
     the changes implemented were to add an LSB block and support
     the new LSB try-restart and force-reload commands. However
     the new /lib/lsb/init-functions are NOT currently used as this
     is the unstable part.


author: John Dennis <jdennis@redhat.com> - 1.10.3-1
changelog:
  - modify avc_audit.py to use new audit_data.py implementation

  - can listen for audit events on either /var/run/audit_events
     in bindary protocol mode or /var/run/audisp_events in
     text protocol mode


author: John Dennis <jdennis@redhat.com> - 1.10.5-1
changelog:
  - update code for command line log file scanning to work with
     new log file scanning code introduced for the browser.

  - update Bulgarian translation (Doncho N. Gunchev (gunchev@gmail.com))

  - update Polish translation (Piotr Drąg (raven@pmail.pl))

  - Resolves bug 239893: sealert wakes up very often
     This was caused by the use of threads and pygtk's thread signal
     handling.  The only use of threads in sealert was for log file
     scanning so that the UI would remain responsive during a
     scan. Threads in sealert have now been completely
     removed. Instead the scanning work is performed in a gobject idle
     function called from the main loop. The idle function is written
     as a python generator function which allows for the function to
     perform a small amount of work, save it's execution state and
     return. The next time the idle function is called from the main
     loop it resumes execution from it's last state until it decides
     to yield control again. This way the long running scan/analysis
     can be performed in small successive units of work during the
     time the application is otherwise idle and it does not interfere
     with the rest of the GUI event processing. Everything now occurs
     in an event loop, think of it as the applications process/thread
     scheduler whose event handlers execute time slices.

  - rewrote parts of the audit input pipeline to use generators
     instead of callbacks, thus permitting the logfile scanning code
     to yield control with more granularity. Also updated
     test_setroubleshootd and audisp_listen to use the new
     generator/yield logic.

  - rewrote the dialog used for scanning log files, progress bar
     updates are now in the dialog, the scan can be terminated part
     way through, errors from the scan are reported in pop-up dialog,
     one can only dismiss the dialog with success if the scan had
     been successfully run to completion, otherwise the user is only
     left with the option to cancel.

  - Relates bug 252035  bug 247469, setroubleshootd and sealert should
     exit if SELinux is disabled.

  - add utility functions escape_html() and unescape_html()

  - fix initial sort order in browser, track sort order in browser

  - modify AVC.get_path() to only return a value if the 'path' field is
     set, formerly it also considered the fields 'name' & 'file' which were
     incorrect. get_path() now also looks to see if the string begins with a
     slash for a fully qualified path, if not it looks to see if its a 
     pseudo path such as 'pipe[12345]' or 'socket[12345]' and if so strips out
     the instance information inside the brackets and returns just the type of 
     the pseudo path. This is done because we do not want path information
     in the signature to be unique for each instance of the denial.

  - modify the TimeStamp class to hide it's internal datetime member,
     remove the cmp() method, the internal __cmp__ will be automatically invoked.

  - require selinux policy version in spec file to allow system dbus use
   
  - Resolves bug 256601: audit2allow generates incorrect syntax when comma "," in
     denied list

  - update po i18n files

  - Add support for pruning database by age and size


author: John Dennis <jdennis@redhat.com> - 1.10.7-1
changelog:
  - Fix spec file requires for opening an HTML page
     In configure.ac search for xdg-open and htmlview in priority order,
     set variable html_browser_open to the one found, in spec file require
     xdg-utils for fedora and htmlview for RHEL.

  - add "Host" column in browser
     add "Toggle Column Visibility" menu to toggle display of any column on/off

  - Resolves bug 310261: setroubleshoot notifications aren't throttled

  - add support for AUDIT_EOE, end-of-event, if AUDIT_EOE immediately
     emit cached event. Disable timeouts used to flush events if
     AUDIT_EOE has been seen.


author: <jdennis@redhat.com> - 2.0.0-1
changelog:
  - prepare for v2 test release
  - Completed most work for version 2 of setroubleshoot, prepare for test release
  - import Dan's changes from the mainline
     primarily allow_postfix_local_write_mail_spool plugin
  - escape html, fix siginfo.format_html(), siginfo.format_text()
  - add async-error signal
  - change identity to just username
  - make sure set_filter user validation works and reports error in browser
  - fix generation of line numbers and host when connected to audispd
  - add permissive notification, resolves bug 231334: Wording doesn't change for permissive mode
  - resolves bug 244345: avc path information incomplete
  - get the uid,gid when a client connects to the server
  - set_filter now verifies the filter is owned by the user,
  - resolves bug 288261: setroubleshoot lack of user authentication
  - remove filter options which weren't being used
  - change '@' in audit data hostname to '.'
  - remove restart dialog
     resolves bug 321171: sealert's dialog after update is higly confusing
  - fix rpc xml arg
  - fix handling of host value
  - tweak what fields are in signature
  - move data items which had been in 'avc' object into siginfo
  - clean up siginfo format
  - large parts of new audit data pipeline working, checkpoint
  - fix duplicate xml nodes when generating xml tree
  - audit event can now be xml serialized
  - switch from using int's for audit record types to strings
  - avoid conversion headaches and possibilty of not being
     able to convert a new unknown type
  - add logic to allow XmlSerialize to be subclassed and init_from_xml_node to be overridden
  - add support to xml serialize classes AuditEventID, AuditEvent, AuditRecord
  - use metaclass for xml class init
  - start adding xml support to audit data classes
  - Use metaclass to wrap class init
  - move xml serialization code from signature.py to xml_serialize.py
  - simplify aspect of the serialization code
  - add unstructured xml mapping, each xml element name has its content mapped to obj.name
  - modify xml serialization to be driven by xml contents
  - general clean up
  - checkpoint conversion of serialization to use metaclasses
  - clean up class/data specifications for XmlSerializable
  - add support for client rpc testing
  - add changelog entry
  - add SubProcess class to setroubleshootd in preparation to
  - run daemon as subprocess so we can gather results and
     compare them to the expected data we sent
  - rewrite all plugins to use new v2 audit data
  - add SubProcess class to setroubleshootd in preparation to 
            run daemon as subprocess so we can gather results and
            compare them to the expected data we sent
  - add new test support: add config section 'test', add boolean 'analyze' to
     config test section, add class TestPluginReportReceiver which is installed
     if test.analyze is True, it prints analysis report. In test_setroubleshootd
     send AUDIT_EOE to assure sequential event processing so analysis results
     have same ordering as events that are sent by test_setroubleshootd
  - alert signatures now include host information, alerts will be grouped by host


author: <jdennis@redhat.com> - 2.0.1-1
changelog:
  - make connection error message persist instead of timeout in browser
  - updated Brazilian Portuguese translation: Igor Pires Soares <igor@fedoraproject.org>
  - implement uid,username checks
  - rpc methods now check for authenticated state
  - fix html handling of summary string
  - add 'named' messages to status bar, make sure all messages either timeout or are named
  - fix ordering of menus, resolves bug 427418
  - add 'hide quiet' to browser view filtering, resolves bug 427421
  - tweak siginfo text formatting
  - add logon to SECommandLine so that sealert -l <local_id> works


author: <jdennis@redhat.com> - 2.0.2-1
changelog:
  - Resolve bug 428252: Problem with update/remove old version
  - Add code to validate xml database version, if file is incompatible it is not read,
     the next time the database is written it will be in the new version format.
     This means the database contents are not preserved across database version upgrades.
  - Remove postun trigger from spec file used to clear database between incompatible versions
     the new database version check during database read will handle this instead
  - bullet proof exit status in init script and rpm scriptlets
  - Resolve bug 247302: setroubleshoot's autostart .desktop file fails to start under a KDE session
  - Resolve bug 376041: Cannot check setroubleshoot service status as non-root
  - Resolve bug 332281: remove obsolete translation
  - Resolve bug 344331: No description in gnome-session-properties
  - Resolve bug 358581: missing libuser-python dependency
  - Resolve bug 426586: Renaming translation po file from sr@Latn to sr@latin
  - Resolve bug 427260: German Translation
  - enhance the sealert man page


author: <jdennis@redhat.com> - 2.0.4-1
changelog:
  - Resolve bug 430421: audit_listener_database.xml:3029: parser error in xmlParseDoc()
    rewrite the audit_msg_decode logic to beaware of specific audit fields
  - add new template substitution $SOURCE, a friendly name, $SOURCE_PATH still exists
    and is the full path name of $SOURCE, also add 'source' attribute in AVC class,
    fix how source and source_path are computed from audit's comm and exe fields
  - fix the computation of tpath to also look at the audit name field, formerly
    it had only been looking at path, fixes <Unknown> showing up for many targets
  - add exception handling around xml file writes (Alan Cox reports problem when /var is full)
  - add testing documentation
  - Resolve bug 430845: obsolete URL in setroubleshoot package description
  - Resolve bug 428960: Permissive message makes no sense.
  - init script now allows extra test options
  - show_browser() now opens and raises the window (e.g. presents) rather than just
    assuring it's realized (e.g. iconified, or hidden)
  - sealert -l message in syslog converts from html before writing to syslog
  - Resolve bug 320881: export setroubleshoot_selinux_symposium in PDF format
  - add code to verify all async rpc's have been cleared from the async rpc cache
  - add code to set a default rpc method return if the interface does not define a callbak
    (methods which did not have a callback were not returning anything and hence were no
     getting cleared from the cache)


author: John Dennis <jdennis@redhat.com> - 2.0.5-1
changelog:
  - allow sealert -l lookup to accept * wildcard
  - add a few more audit fields needing special decode handling


author: <jdennis@redhat.com> - 2.0.6-1
changelog:
  - add dialog to run a command in the background, capture it's stdout & stderr
      report it's status, kill it, and pass it a pseudo terminal for password prompts
      - separate the fix command into it's own section in formatted alerts
      - add UI for running the fix command, enable only if there is a single selection
        and the selected alert has a fix command
        - add a config parameters 'run_fix_cmd_enable' to control if fix commands
        can be run, defaults to False
        - Resolve bug 431380: prevent notify popups while setroubleshoot is open


author: Dan Walsh <dwalsh@redhat.com> - 2.0.11-1
changelog:
  - Update to upstream
    - 2008-10-22    <jdennis@redhat.com>
      - Fix pruning code
      - Fix time stamps


author: Dan Walsh <dwalsh@redhat.com> - 2.0.12-1
changelog:
  - Update to upstream
    - 2008-10-06  Dan Walsh <dwalsh@redhat.com>
    - remove .png from desktop files


author: Dan Walsh <dwalsh@redhat.com> - 2.1.3-1
changelog:
  - sedispatch needs to connect to dbus on avc arrival, 
    instead of startup, since the dbus daemon is not started 
    when sedispatch starts


author: Dan Walsh <dwalsh@redhat.com> - 2.2.1-1
changelog:
  - Update to upstream
    * Thomas Liu <tliu@redhat.com>
    Bug fixes to GUI, added Delete All Alerts menu item.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.9-1
changelog:
  - Update to upstream
    2009-6-25  Thomas Liu <tliu@redhat.com>
    - Added a "Copy to Clipboard" button to the browser GUI.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.11-1
changelog:
  - Update to upstream
    2009-7-01 Thomas Liu <tliu@redhat.com> 
    - Fixed browser behavior when there are no alerts
    - Fixed seapplet behavior when there are no alerts
    - Made delete all button delete alerts on server side and on local side


author: Dan Walsh <dwalsh@redhat.com> - 2.2.13-1
changelog:
  - Update to upstream
    2009-7-07 Thomas Liu <tliu@redhat.com> 
    - Fixed detail doc not clearing when deleting all alerts
    - Hid notify check when deleting all alerts.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.14-1
changelog:
  - Update to upstream
    2009-7-15 Dan Walsh <dwalsh@redhat.com> 
    - Fix handling of syscall record a1 field
    - Translate "/" to mountpoint when returned by kernel


author: Dan Walsh <dwalsh@redhat.com> - 2.2.20-1
changelog:
  -Update to upstream 
          - 2009-8-18 Thomas Liu <tliu@redhat.com>
          - Added check for new policy.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.35-1
changelog:
  - Fix translations, plurals and glade
    - Update Po
    - Fix plural form
    - Add support for Green Plugins


author: Dan Walsh <dwalsh@redhat.com> - 2.2.50-1
changelog:
  - Exit with error code if you run sealert as root and try to connect to session bus
  - Fix Crash when ino is not defined


author: Dan Walsh <dwalsh@redhat.com> - 2.2.61-1
changelog:
  - Add Gavin Romig-Koch report patch
  - Cleanup Browser window
  - Remove avc messages that are allowed or dontaudited in current poilcy


author: Dan Walsh <dwalsh@redhat.com> - 2.2.67-1
changelog:
  - Fix browser to handle ignore flag
  - Remove tpath for signature 
  - Fix audit2why handling for sealert and setroubleshoot
  - Fix sort order selection
  - Fix dontnotify handling


author: <dwalsh@redhat.com> - 3.0.7-1
changelog:
  - Apply patch from Yuri Chornoivan to fix spelling mistakes
  - Remove py files that are no longer used
  - Add details button


author: <dwalsh@redhat.com> - 3.0.11-1
changelog:
  - Better handling of tracebacks in terminal mode
  - Fix up messages on process and capability avc messages
  - Update translations


author: <dwalsh@redhat.com> - 3.0.19-1
changelog:
  - Fix man page to reflect change in gui
  - Fix sealert -fixit call to import load_plugins
  - update translations
  - Fix handling of empty tpath in gui


author: <dwalsh@redhat.com> - 3.0.30-1
changelog:
  - Change seapplet to only check for AVCs on login, if checkonlogin flag is turned on in ~/.setroubleshoot file
  - Fix list_all_alerts bug causing crash on bad type


author: <dwalsh@redhat.com> - 3.0.37-1
changelog:
  - Move serverconnection.py and FixIt commands from setroubleshoot to setroubleshoot-server
  - Remove run_cmd.py


author: <dwalsh@redhat.com> - 3.0.40-1
changelog:
  - Apply Miroslav patch that rewrites sealert option handling with using optparse. Fixing conflicting options problems.


author: Rex Dieter <rdieter@fedoraproject.org> 3.0.45-2
changelog:
  - optimize/update scriptlets
  - don't own icons/hicolor
  - drop %config tag on applications/*.desktop

  - Patch from Mgrepl to stop printable from crashing if None is passed in
  - Update to latest translations


author: Dan Walsh <dwalsh@redhat.com> - 3.1.1-1
changelog:
  - remove specific logging and move to syslog
  - Fix handling of AVC messages broken by fix for memory leaks


author: Dan Walsh <dwalsh@redhat.com> - 3.1.3-1
changelog:
  - Update to latest translations
  - Fix handling of avc messages, missing \n
  - Default to check for AVC's on login


author: Dan Walsh <dwalsh@redhat.com> - 3.1.16-1
changelog:
  - Fix sealert to handle avc's in /var/log/messages which will be numbered 1400 and 1107 rather then AVC and USER_AVC
  - Update Translations
  - Fix hostname substitution to only effect hostnames


author: Dan Walsh <dwalsh@redhat.com> - 3.2.1-1
changelog:
  - Remove sesearch from package and start using sepolicy from policycoreutils-python
  - Fix retrieval of writable types to translate attributes into the group of types available, and not return non file types.


author: Dan Walsh <dwalsh@redhat.com> - 3.2.9-1
changelog:
  - On update cp instead of rename, since there could be a situation where
  someone has ~/.config on a different file sytem then ~.  It has happened.
  - Fix --password spelling error
  - Remove --quit option from sealert
  - Update translations


author: Petr Lautrbach <plautrba@redhat.com> 3.2.22-1
changelog:
  - Ship a symbolic setroubleshoot icon (#1182652)
  - Fix get_rpm_nvr_*_temporary functions - CVE-2015-1815 (#1203352)


author: Petr Lautrbach <plautrba@redhat.com> 3.2.24-1
changelog:
  - translations updated from https://fedora.zanata.org/project/view/setroubleshoot
  - setroubleshoot_database.xml and email_alert_recipients are %ghost again


author: Petr Lautrbach <plautrba@redhat.com> 3.3.3-1
changelog:
  - fixed few UI browser problems
  - extended DBUS API, see DBUS.md
  - import MIMEText from the right module (#1297111)
  - Fix several GTK deprecated warnings


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.5-1
changelog:
  - get_alert() DBUS API extended with more parameters
  - sedispatch uses a timeout when collecting audit events (#1322771)
  - Use correct packaging for byte compiled files (#1321047)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.8-1
changelog:
  - added setroubleshootd_log.log_full=True|False directive
  - setroubleshootd_log.level and sealert_log.level can be set to
    different values
  - get_alert() and get_all_alerts_since() DBUS APIs change to use
    number of microseconds instead of date string
  - setroubleshoot.conf cleanup


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.9.1-1
changelog:
  - Do not use dangerous shell=True
  - Use subprocess.check_output() with a sequence of program arguments


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.11-1
changelog:
  - Fix "list all alerts" in sealert gui (#1370272, #1332485)
  - Fix sealert message for capability2 (#1360392)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.12-1
changelog:
  - Remove "Report bug" button when mozplugger plugin is used (#1290135)
  - Change "check_for_man" return value upon failure (#1431191)
  - Fix "plugin details" message content
  - Add "init_args" function to Plugin
  - Fix sealert crash when setroubleshootd fails to start (#1405003)
  - Improve obtaining AVC object path
  - Fix setroubleshootd.8
  - Fix report problem summary string
  - sealert - provide a better error message when SELinux is disabled
  - Spelling fixes
  - Python 3.6 invalid escape sequence deprecation fixes


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.13-1
changelog:
  - Don't stop when the plugin directory is empty
  - Fix missing margins on Troubleshoot window
  - Resize all solutions panels horizontally
  - Fix missing priority color for proposed solutions
  - Do not split If sentences to framework and plugins - requires
    setroubleshoot-plugins 3.3.8 at least (rhbz#1210243, rhbz#1322734, rhbz#1115510)
  - Set translation domain for Gtk.Builder() object to have strings
    correctly translated
  - Make labels on GtkButtons translatable
  - Handla all exceptions from do_analyze_logfile()
  - Fix semi-translated messages
  - Update translations
  - Do not catch POSIX signals (rhbz#1366004, rhbz#1419245)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.14-1
changelog:
  - Increase the space for suggested solutions in sealert
  - Highlight suggestions with the highest confidence
  - Remove additional "If " string from plugin messages
  - Fix sealert message for process2 (#1507909)
  - Do not change if_string[0] to lowercase


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.15-1
changelog:
  - Rewrite seapplet to Python3 to use Notify and Gtk 3.0
  - Add setroubleshoot-seappletlegacy with legacy seappletlegacy based on Gtk 2
  - sealert: Finish dbus communication after error


author: Björn Esser <besser82@fedoraproject.org> - 3.3.15-2
changelog:
  - Fix runtime dependency: 's!lipreport!libreport!g' (#1536580)
  - Prefer %global over %define
  - Remove obsolete %defattr(-,root,root,-)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.16-1
changelog:
  - Do not show status_icon when there's no alert (#1543758)
  - Run seapplet only on SELinux enabled system (#1541631)
  - Use context in Gio.AppInfo.launch (#1542156)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.17-1
changelog:
  - Set auto_save_interval to 5 (#1548913,#1523406,#1539180)
  - seapplet: Try send and close notifications (#1541624,#1541719,#1544222,#1539367)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.18-1
changelog:
  - Move sedispatch.conf to /etc/audit/plugins.d/
  - Fix summary and "if" text for AVCs with unknown target path


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.19-2
changelog:
  - Update "missing" scripts to automake-1.15
  - Add active polling for acquiring policy file
  - Fix translation of hex values in AVCs (#1477236, #1709742)
  - require initscripts to ensure that "service" call works properly


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.21-1
changelog:
  - Use dbus.mainloop.glib.DBusGMainLoop() instead of dbus.glib
  - Fix AVC.__typeMatch to handle aliases properly
  - Handle sockets with abstract path properly (#1775135)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.22-2
changelog:
  - Log plugin exception traceback when log level is DEBUG
  - sepolicy.info() returns a generator, not a list (#1784564)


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.23-1
changelog:
  - browser: Check return value of Gdk.Screen().get_default() (#1574434)
  - Improve and unify error messages (#1763982)
  - setroubleshoot.util: Catch exceptions from sepolicy import
  - Add dpkg support
  - Do not refer to hardcoded selinux-policy rpm in signature
  - Make date/time format locale specific (#1812674)
  - Improve speed of plugin evaluation (#1794807)
  - Do not try to report a bug on None package
  - sealert: Drop unused import slib.dbus.service
  - Drop updater.py - it's not used and doesn't work
  - root user doesn't need to use SetroubleshootPrivileged API
  - Use pydbus, a modern Python dbus API, for SetroubleshootPrivileged
  - Report bug on a package which owns the related SELinux domain (#1811644)
    https://pagure.io/setroubleshoot/issue/18
  - Add Local SELinux policy package version to analyses reports
  - setroubleshoot.utils.get_rpm_nvr_by_scontext add option to use DBUS method
  - Export setroubleshoot.utils.get_rpm_nvr_by_scontext via DBUS
  - setroubleshoot.util: get_rpm_nvr_by_type() and get_rpm_nvr_by_scontext()


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-6
changelog:
  - Fix shebang of SetroubleshootPrivileged.py (#2231023)
  - Check that SELinux is enabled before running (#2178950)


author: Petr Pisar <ppisar@redhat.com> - 4.15.2-10
changelog:
  - License corrected to "GPLv3+ and (GPLv3+ and BSD) and (LGPLv3+ or BSD) and
    LGPLv2+ and Public Domain and GFDL"


author: Jindrich Novy <jnovy@redhat.com> - 1.1.6-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.6
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.7-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.7
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.8-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.8
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.2.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.1
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 0.4.0-1
changelog:
  - update to v.0.4.0
  - sync with fedora spec
  - drop applied CVE-2019-14378 patch
  - Resolves: #1766774


author: Jindrich Novy <jnovy@redhat.com> - 1.0.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/archive/v1.0.1.tar.gz
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.1
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.2
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.3
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.4-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.4
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.2.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.2
  - Related: Jira:RHEL-2110


author: Jindrich Novy <jnovy@redhat.com> - 1.2.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3
  - Related: Jira:RHEL-2110


author: Paul Wouters <pwouters@redhat.com> - 1.7.4.1-1
changelog:
  - Resolves: rhbz#1805132 socat does not recognize IP addresses of the SAN extensions in ssl mode
  - Resolves: rhbz#1870279 Transfer via socat fails with openssl enabled
  - Resolves: rhbz#1914989 Socat udp4-recvfrom cause endless loop error when target is not vaild


author: Andreas Schneider <asn@redhat.com> - 1.1.8-1
changelog:
  - Update to version 1.1.8
    * Added support for openat()
    * Added support for open64() and fopen64()
    * Always enabled logging support
    * Increased maximum for wrapped interfaces to 64
    * Improved fd duplication code
    * Fixed strict-aliasing issues
    * Fixed some use after free issues
    * Fixed issues on ppc64le


author: Andreas Schneider <asn@redhat.com> - 1.2.0-1
changelog:
  - Update to vesrion 1.2.0
    * Added threading support
    * Moved to modern cmake
    * Several smaller bugfixes


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.6.0-1
changelog:
  - Fixes: rhbz#1818877 - rebase to softhsm 2.6.0+
  - Fixes: rhbz#1701233 - support setting supported signature methods on the token


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.6.0-3
changelog:
  - Fixes: rhbz#1834909 - softhsm use-after-free on process exit
  - Synchronize the final fix with Fedora


author: Paul Wouters <paul@xelerance.com> - 1.3.0-3
changelog:
  - Initial Fedora package
  - Do not install the .a file
  - Use a separate "opendnssec" user to own /var/sofhsm


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-3
changelog:
  - Add support for CKM_RSA_PKCS_OAEP key un/wrapping [Petr Spacek]
  - Use OpenSSL EVP interface for AES key wrapping [Petr Spacek]
  - Fix softhsm2-pk11install buid and post call
  - Do not use --with-objectstore-backend-db (causes issues on i686)
  - Change install directory to /usr/lib*/pkcs11/
  - Install pkcs11 module file
  - Use official upstream tar ball
  - Create ods user to own softhsm/token files
  - Enable migration tools (for softhsm-v1 installs)
  - Add softlink for softhsm-v1 .so (needed for opendnssec's conf.xml)
  - Require p11-kit, nss-tools, for SoftHSM PKCS #11 Module file
  - Copy pk11install.c from coolkey package
  - Enable hardened build
  - Add upstream official source url


author: Paul Wouters <pwouters@redhat.com> - 2.0.0-1
changelog:
  - Resolves: rhbz#1244461 Update to softhsm-2.0.0
  - Resolves: rhbz#1177086 A marked as trusted certificate cannot be written in a softhsmv2 db
  - Resolves: rhbz#1159827 Typo in homedir in /etc/passwd
  - Added global prever to toggle snapshot vs full release build changes


author: Paul Wouters <pwouters@redhat.com> - 2.1.0-1
changelog:
  - Resolves: rhbz#1244461 Updated to 2.1.0
  - Resolves: rhbz#1272423 Softhsm PKCS#11 module not visible to NSS becasue it is not in the search path
  - Resolves: rhbz#1177086 A marked as trusted certificate cannot be written in a softhsmv2 db
  - Resolves: rhbz#1272453 - A marked as CA certificate cannot be written in a softhsmv2 db
  - Removed merged in bug#162 patch
  - Temporarily disable make check because cppunit is broken


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.2.0-2
changelog:
  - Increased the level of messages that go to syslog, thus softhsm
    will no longer write on syslog when it cannot open the shared DB (#1425135)
  - Allow users in the 'ods' group to store their keys in /var/lib/softhsm/tokens/
    while at the same time disallow deleting other users' keys (using the
    sticky bit). Prevent users in the 'ods' group from writing in /var/lib/softhsm.


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.3.0-3
changelog:
  - Remove softhsm2-pk11install. Software modules are to be registered with
    p11-kit as in https://fedoraproject.org/wiki/PackagingDrafts/Pkcs11Support (#1541095).


author: Hans de Goede <hdegoede@redhat.com> - 2.0.0-6
changelog:
  - The last round of security fixes also fixes CVE-2018-14044, CVE-2018-14045
    (rhbz#1601618, rhbz#1601620, rhbz#1601624, rhbz#1601625)


author: Sérgio Basto <sergio@serjux.com> - 2.1.1-1
changelog:
  - Update to 2.1.1
    Bugfixes: Fixed potential buffer overwrite bugs in WavFile routines. Replaced asserts with runtime exceptions.
    Android: Migrated the SoundTouch Android example to new Android Studio
    Automake: unset ACLOCAL in bootstrap script to avoid error in case earlier build script has set it


author: Per Øyvind Karlsen <peroyvind@linux-mandrake.com> 1.8-1mdk
changelog:
  - 1.8
  - drop Prefix tag
  - clean out redundant buildrequires
  - rm -rf $RPM_BUILD_ROOT at the beginning of %install, not %prep
  - use %makeinstall_std macro
  - cosmetics


author: Adrian Reber <adrian@lisas.de> - 2.3-2
changelog:
  - using a new url.lang to fix #195720
    (https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=131352)


author: Leigh Scott <leigh123linux@googlemail.com> - 3.1.3-1
changelog:
  - updated to 3.1.3
  - change configure command so it finds boost_regex
  - fix source url's
  - add devel package
  - fix directory ownership
  - fix rpath on binary


author: Adrian Reber <adrian@lisas.de> - 3.1.6-1
changelog:
  - updated to 3.1.6
  - removed buildroot and clean section
  - fixed "missing c++ source language detection for .cxx extension" (#728311)
  - fixed "source-highlight : Conflicts with autoconf-archive" (#797794)


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.2-10
changelog:
  - Fixed CVE-2018-11805
  - Resolves: rhbz#1787514
  - Fixed CVE-2020-1930
  - Resolves: rhbz#1820649
  - Fixed CVE-2020-1931
  - Resolves: rhbz#1820650


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.2.0-1
changelog:
  - update to 1.2.0
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - include soname in file list
  - use license macro


author: Uri Lublin <uril@redhat.com> - 0.21.0-2
changelog:
  - Build without pciaccess
    Resolves: rhbz#1964922
  - Fix g_memdup deprecation warning with glib >= 2.68


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-5
changelog:
  - Resolves: #2130260 - CVE-2022-41318 squid:4/squid: buffer-over-read in SSPI and SMB
    authentication


author: Tomas Korbar <tkorbar@redhat.com> - 4.15-6
changelog:
  - Resolves: #2072988 - [RFE] Add the "IP_BIND_ADDRESS_NO_PORT"
    flag to sockets created for outgoing connections in the squid source code.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-7.1
changelog:
  - Resolves: RHEL-14801 - squid: squid: Denial of Service in HTTP Digest
    Authentication
  - Resolves: RHEL-14776 - squid: squid: Request/Response smuggling in HTTP/1.1
    and ICAP


author: hezhongkun <hezhongkun@inspur.com> - 4.15-8.1
changelog:
  - Fix CVE-2023-5824: Supply ALE with HttpReply before checking http_reply_access (#398)
      Replace adjustable base reply - downstream change neccessary for backport


author: wangkaiqiang <wangkaiqiang@inspur.com> - 4.15-11.1
changelog:
  - Fix CVE-2023-46728: Remove support for Gopher protocol
  - Fix CVE-2023-49286: Exit without asserting when helper process startup fails


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - first build against glibc
  - patched out the use of setresuid(), which is available only on kernels
    2.1.44 and later


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated the init script to use reconfigure option to restart squid instead
    of shutdown/restart (both safer and quicker)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - cache & log dirs shouldn't be world readable
  - remove preun script (leave logs & cache @ uninstall)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - switch to using group squid
  - turn off icmp (insecure)
  - update to 2.2.DEVEL3
  - build FAQ docs from source


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Fix compliance with ftp RFCs
    (http://www.wu-ftpd.org/broken-clients.html)
  - Work around a bug in some versions of autoconf
  - BuildPrereq sgml-tools - we're using sgml2html


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix init script again (#11699)
  - add --enable-delay-pools (#11695)
  - update to STABLE3
  - update FAQ


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix path references in QUICKSTART (#15114)
  - fix initscript translations (#24086)
  - fix shutdown logic (#24234), patch from <jos@xos.nl>
  - add /etc/sysconfig/squid for daemon options & shutdown timeouts
  - three more bugfixes from the Squid people
  - update FAQ.sgml
  - build and ship auth modules (#23611)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.4.STABLE1 + patches
  - enable some more configure options (#24981)
  - oops, ship /etc/sysconfig/squid


author: Bill Nottingham <notting@redhat.com>
changelog:
  - 2.4.STABLE3 + patches
  - turn off HTCP at request of maintainers
  - leave SNMP enabled in the build, but disabled in the default config


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE3-0
changelog:
  - Spec file change to enable the nul storage module. bugzilla #74654
  - Upgrade to 2.5STABLE3 with current official patches.
  - Added --enable-auth="basic,ntlm": closes bugzilla #90145
  - Added --with-winbind-auth-challenge: closes bugzilla #78691
  - Added --enable-useragent-log and --enable-referer-log, closes
  - bugzilla #91884


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE4-1
changelog:
  - New upstream version.
  - Fix the Source: line in this spec file to point to the correct URL.
  - redo the -location patch to work with the new upstream version.


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Incorporate many upstream patches
  - Include many spec file changes from D.Johnson <dj@www.uk.linux.org>


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE4-3
changelog:
  - Clean up the spec file to work on 64-bit platforms (use %{_libdir}
    instead of /usr/lib, etc)
  - Make the release number in the changelog section agree with reality.
  - use -fPIE rather than -fpie.  s390 fails with just -fpie


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE5-1
changelog:
  - New upstream version, obsoletes many patches.
  - Fix --datadir passed to configure.  Configure automatically adds /squid
    so we shouldn't.
  - Remove the problematic triggerpostun trigger, since is's broken, and FC2
    never shipped with that old version.
  - add %{?_smp_mflags} to make line.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE5-2
changelog:
  - Include the first 10 upstream patches
  - Add a patch for the correct location of the winbindd pipe.  This closes
    bugzilla #107561
  - Remove the change to ssl_support.c from squid-2.5.STABLE3-build patch
    This closes #117851
  - Include /etc/pam.d/squid .  This closes #113404
  - Include a patch to close #111254 (assignment in assert)
  - Change squid.init to put output messages in /var/log/squid/squid.out
    This closes #104697
  - Only useradd the squid user if it doesn't already exist, and error out
    if the useradd fails.  This closes #118718.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5STABLE5-5
changelog:
  - Merge current upstream patches.
  - Fix the -pipe patch to have the correct name of the winbind pipe.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE6-1
changelog:
  - New upstream version, with 32 upstream patches.
    This closes #133970, #133931, #131728, #128143, #126726

  - Change the permissions on /etc/squid/squid.conf to 640.  This closes
    bugzilla #125007


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE6-3
changelog:
  - include patch from Ulrich Drepper <drepper@redhat.com> to stop
    problems with O_NONBLOCK.  This closes #136049


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-1
changelog:
  - new upstream version, with 3 upstream patches.
    Updated the -build and -config patches
  - Include patch from Ulrich Drepper <frepper@redhat.com> to more
    intelligently close all file descriptors.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-2
changelog:
  - Add a triggerin on samba-common to make /var/cache/samba/winbindd_privileged
    accessable so that ntlm_auth will work.  It needs to be in this rpm,
    because the Samba RPM can't assume the squid user exists.
    Note that this will only work if the Samba RPM is recent enough to create
    that directory at install time instead of at winbindd startup time.
    That should be samba-common-3.0.0-15 or later.
    This fixes bugzilla #103726
  - Clean up extra whitespace in this spec file.
  - Add additional upstream patches. (Now 18 upstream patches).
  - patch #112 closes CAN-2005-0096 and CAN-2005-0097, remote DOS security holes.
  - patch #113 closes CAN-2005-0094, a remote buffer-overflow DOS security hole.
  - patch #114 closes CAN-2005-0095, a remote DOS security hole.
  - Remove the -nonbl (replaced by #104) and -close (replaced by #111) patches, since
    they're now fixed by upstream patches.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-4
changelog:
  - Include two more upstream patches for security vulns:
    bz#146783 Correct handling of oversized reply headers
    bz#146778 CAN-2005-0211 Buffer overflow in WCCP recvfrom() call


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE8-2
changelog:
  - new upstream version with 4 upstream patches.
  - Reorganize spec file to apply upstream patches first


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE9-4
changelog:
  - More upstream patches, including the fixed 2GB patch.
  - include the -libbind patch, which prevents squid from using the optional
    -lbind library, even if it's installed.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE9-6
changelog:
  - More upstream patches, including a fix for
    bz#157456 CAN-2005-1519 DNS lookups unreliable on untrusted networks


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE10-1
changelog:
  - new upstream version
  - enabled fakeauth utility (#154020)
  - enabled digest authentication scheme (#155882)
  - all error pages marked as config (#127836)
  - patch for 64bit statvfs interface (#153274)
  - added httpd config file for cachemgr.cgi (#112725)


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE10-3
changelog:
  - removed "--enable-truncate" option (#165948)
  - added "--enable-cache-digests" option (#102134)
  - added "--enable-ident-lookups" option (#161640)
  - some clean up (#165949)


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE11-5
changelog:
  - fix for #171213 - CVE-2005-3258 Squid crash due to malformed FTP response
  - more fixes from upstream


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE12-2
changelog:
  - rewriten patch squid-2.5.STABLE10-64bit.patch, it works with
    "--with-large-files" option now
  - fix for #72896 - squid does not support > 1024 file descriptors,
    new "--enable-fd-config" option for it.


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE1-1
changelog:
  - new upstream + the latest CVS snapshot from 2006/07/18
  - updated fd config patch
  - enabled epoll
  - fixed release format (#197405)
  - enabled WCCPv2 support (#198642)


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE4-2
changelog:
  - upstream fixes:
    * Accept 00:00-24:00 as a valid time specification (upstream BZ #1794)
    * aioDone() could be called twice
    * Squid reconfiguration (upstream BZ #1800)


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE4-3
changelog:
  - added fix for #183869 - squid can abort when getting status
  - added upstream fixes:
      * Bug #1796: Assertion error HttpHeader.c:914: "str"
      * Bug #1779: Delay pools fairness, correction to first patch
      * Bug #1802: Crash on exit in certain conditions where cache.log is not writeable
      * Bug #1779: Delay pools fairness when multiple connections compete for bandwidth
      * Clarify the select/poll/kqueue/epoll configure --enable/disable options
  - reworked fd patch for STABLE4


author: Martin Bacovsky <mbacovsk@redhat.com> - 7:2.6.STABLE16-2
changelog:
  - our fd_config patch was replaced by upstream's version 
  - Source1 (FAQ.sgml) points to local source (upstream's moved to wiki)


author: Martin Nagy <mnagy@redhat.com> - 7:3.0.STABLE2-1
changelog:
  - upgrade to latest upstream 3.0.STABLE2
  - check config file before starting (#428998)
  - whitespace unification of init script
  - some minor path changes in the QUICKSTART file
  - configure with the --with-filedescriptors=16384 option


author: Martin Nagy <mnagy@redhat.com> - 7:3.0.STABLE5-2
changelog:
  - fix configure detection of netfilter kernel headers (#435499),
    patch by aoliva@redhat.com
  - add support for negotiate authentication (#445337)


author: Jiri Skala <jskala@redhat.com> - 7:3.0.STABLE7-2
changelog:
  - used ncsa_auth.8 from man-pages. there will be this file removed due to conflict
  - fix #458593 noisy initscript
  - fix #463129 init script tests wrong conf file
  - fix #450352 - build.patch patches only generated files


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.0.STABLE13-2
changelog:
  - backported logfile.cc syslog parameters patch from 3.1 (b9443.patch)
  - GCC-4.4 workaround in src/wccp2.cc


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.0.STABLE17-2
changelog:
  - Bug #514014, update to 3.0.STABLE17 fixing the denial of service issues
    mentioned in Squid security advisory SQUID-2009_2.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.13-1
changelog:
  - Upgrade to next upstream release 3.1.0.13 with many new features
    * IPv6 support
    * NTLM-passthru
    * Kerberos/Negotiate authentication scheme support
    * Localized error pages based on browser language preferences
    * Follow X-Forwarded-For capability
    * and more..


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.13-7
changelog:
  - Include upstream patches fixing important operational issues
  - Enable ESI support now that it does not conflict with normal operation


author: Jiri Skala <jskala@redhat.com> 7:3.1.0.14-2
changelog:
  - fixed #532930 Syntactic error in /etc/init.d/squid
  - fixed #528453 cannot initialize cache_dir with user specified config file


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.15-3
changelog:
  - fixed #551302 PROXY needs libcap. Also increases security a little.
  - merged relevant upstream bugfixes waiting for next 3.1 release


author: Jiri Skala <jskala@redhat.com> - 7:3.1.0.16-4
changelog:
  - spec file modified to be fedora packaging guidline compliant
  - little shifting lines in init script header due to rpmlint complaint
  - fixes assertion during start up


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.16-6
changelog:
  - Patch for Squid security advisory SQUID-2010:2, denial of service
    issue in HTCP processing (CVE-2010-0639)


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.1-2
changelog:
  - Update to 3.1.1 Squid bug #2827 crash with assertion failed:
    FilledChecklist.cc:90: "conn() != NULL" under high load.


author: Jiri Skala <jskala@redhat.com>
changelog:
  - fixes #548903 - "comm_open: socket failure: (97) Address family not supported by protocol" if IPv6 disabled


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.3-2
changelog:
  - Fully fix #548903 - "comm_open: socket failure: (97) Address family not supported by protocol" if IPv6 disabled
  - Various IPv6 related issues fixed, making tcp_outgoing_address behave
    as expected and no commResetFD warnings when using tproxy setups.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.4-1
changelog:
  - Upstream 3.1.4 bugfix release, issues relating to IPv6, TPROXY, Memory
    management, follow_x_forwarded_for, and stability fixes


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.5-2
changelog:
  - Upstream 3.1.5 bugfix release
  - Upstream patch for Bug #614665: Squid crashes with  ident auth
  - Upstream patches for various memory leaks


author: Jiri Skala <jskala@redhat.com> - 7:3.2.0.9-1
changelog:
  - upgrade to squid-3.2
  - fixes #720445 - Provide native systemd unit file
  - SysV initscript moved to subpackage
  - temproary disabled eCap


author: Jiri Skala <jskala@redhat.com> - 7:3.2.0.13-2
changelog:
  - fixes #747103 - squid does not start if /var/spool/squid is empty
  - fixes #747110 - squid does not start adding "memory_pools off"


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.2.0.14-6
changelog:
  - upstream gcc-4.7 patch
  - fix for bug #772483 running out of memory, mem_node growing out of bounds


author: Michal Luscon <mluscon@redhat.com> - 7:3.2.3-2
changelog:
  - Resolved: #854356 - squid.service use PIDFile
  - Resolved: #859393 - Improve cache_swap script
  - Resolved: #791129 - disk space warning
  - Resolved: #862252 - reload on VPN or network up/down
  - Resolved: #867531 - run test suite during build
  - Resolved: #832684 - missing after dependency nss-lookup.target
  - Removed obsolete configure options


author: Michal Luscon <mluscon@redhat.com> - 7:3.2.9-1
changelog:
  - Update to latest upstream version 3.2.9
  - Fixed: CVE-2013-1839
  - Removed: makefile-patch (+make check)


author: Ville Skyttä <ville.skytta@iki.fi> - 7:3.3.4-2
changelog:
  - Fix basic auth and log daemon DB helper builds.
  - Use xz compressed tarball, fix source URLs.
  - Fix bogus dates in %changelog.


author: Michal Luscon <mluscon@redhat.com> - 7:3.3.9-1
changelog:
  - Update to latest upstream version 3.3.9
  - Fixed #976815: file descriptors are hard coded to 16384
  - Fixed: active ftp crashing
  - Fixed: offset of patches


author: Michal Luscon <mluscon@redhat.com> - 7:3.4.1-1
changelog:
  - Rebase to latest stable upstream release 3.4.1
  - Fixed #1034306: fails to build for AArch64
  - Fixed: active ftp


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.4.12-1
changelog:
  - Update to latest upstream version 3.4.12
  - bug #1173946: Disable -march=native compile time optimization, use Fedora defaults.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.5.2-2
changelog:
  - Update to latest upstream version 3.5.2
  - Remove deprecated (and renamed) squid_msnt_auth basic auth helper. Only
    performs LM authentication and not considered useful in todays networks.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.13-3
changelog:
  - Resolves: #1308866 - CVE-2016-2390 squid: incorrect server error 
    handling resulting in denial of service


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.15-1
changelog:
  - new version 3.5.15
  - Resolves: #1311585 - squid: Multiple Denial of Service issues in
    HTTP Response processing
  - Resolves: #1312267 - squid: SQUID-2016_2 advisory, multiple DoS issues


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.0.23-5
changelog:
  - Resolves: #1585617 - Build against libdb only instead of libdb4
  - disabled strict checking for now (squid can not be built with GCC8)


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-1
changelog:
  - Resolves: #1656871 - squid rebase to 4.4
  - Resolves: #1645148 - CVE-2018-19131 squid: Cross-Site Scripting when
    generating HTTPS response messages about TLS errors
  - Resolves: #1645156 - CVE-2018-19132 squid: Memory leak in SNMP query
    rejection code


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-6
changelog:
  - Resolves: #1679526 - Missing detailed configuration file
  - Resolves: #1703117 - RHEL 7 to 8 fails with squid installed because dirs
    changed to symlinks
  - Resolves: #1691741 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1683527 - "Reloading" message on a fresh reboot after enabling
    squid


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-8
changelog:
  - Resolves: # 1738485 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow
    in HttpHeader::getAuth


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-9
changelog:
  - Resolves: #1738583 - CVE-2019-12525 squid:4/squid: parsing of header
    Proxy-Authentication leads to memory corruption
  - Resolves: #1828369 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828370 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-1
changelog:
  - new version 4.11
  - libsystemd integration
  - Resolves: #1829467 - squid:4 rebase
  - Resolves: #1828378 - CVE-2019-12521 squid:4/squid: off-by-one error in
    addStackElement allows for a heap buffer overflow and a crash
  - Resolves: #1828377 - CVE-2019-12520 squid:4/squid: improper input validation
    in request allows for proxy manipulation
  - Resolves: #1828375 - CVE-2019-12524 squid:4/squid: improper access restriction
    in url_regex may lead to security bypass
  - Resolves: #1820664 - CVE-2019-18860 squid: mishandles HTML in the host
    parameter to cachemgr.cgi which could result in squid behaving in unsecure way
  - Resolves: #1802514 - CVE-2020-8449 squid:4/squid: Improper input validation
    issues in HTTP Request processing
  - Resolves: #1802513 - CVE-2020-8450 squid:4/squid: Buffer overflow in a Squid
    acting as reverse-proxy
  - Resolves: #1802512 - CVE-2019-12528 squid:4/squid: Information Disclosure
    issue in FTP Gateway
  - Resolves: #1771288 - CVE-2019-18678 squid:4/squid: HTTP Request Splitting
    issue in HTTP message processing
  - Resolves: #1771283 - CVE-2019-18679 squid:4/squid: Information Disclosure
    issue in HTTP Digest Authentication
  - Resolves: #1771280 - CVE-2019-18677 squid:4/squid: Cross-Site Request Forgery
    issue in HTTP Request processing
  - Resolves: #1771275 - CVE-2019-12523 squid:4/squid: Improper input validation
    in URI processor
  - Resolves: #1771272 - CVE-2019-18676 squid:4/squid: Buffer overflow in URI
    processor
  - Resolves: #1771264 - CVE-2019-12526 squid:4/squid: Heap overflow issue in URN
    processing
  - Resolves: #1738581 - CVE-2019-12529 squid: OOB read in Proxy-Authorization
    header causes DoS


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-2
changelog:
  - Resolves: #1853130 - CVE-2020-15049 squid:4/squid: request smuggling and
    poisoning attack against the HTTP cache
  - Resolves: #1853136 - CVE-2020-14058 squid:4/squid: DoS in TLS handshake


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-3
changelog:
  - Resolves: #1871705 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1871702 - CVE-2020-15811 squid: HTTP Request Splitting could result
    in cache poisoning
  - Resolves: #1871700 - CVE-2020-15810 squid: HTTP Request Smuggling could result
    in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-5
changelog:
  - Resolves: #1944261 - CVE-2020-25097 squid:4/squid: improper input validation
    may allow a trusted client to perform HTTP Request Smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-2
changelog:
  - Resolves: #2006121 - SQUID shortens FTP Link wrong that contains a semi-colon
    and as a result is not able to download zip file.CODE 404 TO CLIENT)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-3
changelog:
  - Resolves: #1941506 - CVE-2021-28116 squid:4/squid: out-of-bounds read in WCCP
    protocol data may lead to information disclosure


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-8
changelog:
  - Resolves: RHEL-18351 - squid:4/squid: Buffer over-read in the HTTP Message
    processing feature (CVE-2023-49285)
  - Resolves: RHEL-18342 - squid:4/squid: Incorrect Check of Function Return
    Value In Helper Process management (CVE-2023-49286)
  - Resolves: RHEL-18230 - squid:4/squid: Denial of Service in SSL Certificate
    validation (CVE-2023-46724)
  - Resolves: RHEL-15911 - squid:4/squid: NULL pointer dereference in the gopher
    protocol code (CVE-2023-46728)
  - Resolves: RHEL-18251 - squid crashes in assertion when a parent peer exists
  - Resolves: RHEL-14794 - squid: squid multiple issues in HTTP response caching
    (CVE-2023-5824)
  - Resolves: RHEL-14803 - squid: squid: Denial of Service in HTTP Digest
    Authentication (CVE-2023-46847)
  - Resolves: RHEL-14777 - squid: squid: Request/Response smuggling in HTTP/1.1
    and ICAP (CVE-2023-46846)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-9
changelog:
  - Resolves: RHEL-19552 - squid:4/squid: denial of service in HTTP request 
    parsing (CVE-2023-50269)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10
changelog:
  - Resolves: RHEL-28529 - squid:4/squid: Denial of Service in HTTP Chunked
    Decoding (CVE-2024-25111)
  - Resolves: RHEL-26088 - squid:4/squid: denial of service in HTTP header
    parser (CVE-2024-25617)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-13.1
changelog:
  - Resolves: RHEL-56024 - (Regression) Transfer-encoding:chunked data is not sent
    to the client in its complementary


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.2
changelog:
  - Disable ESI support
  - Resolves: RHEL-65075 - CVE-2024-45802 squid:4/squid: Denial of Service
    processing ESI response content


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-13.3
changelog:
  - Resolves: RHEL-22593 - CVE-2024-23638 squid:4/squid: vulnerable to
    a Denial of Service attack against Cache Manager error responses


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New stable upstream version 1.2.1
  - Resolves: rhbz#595529 - spec file should eschew %define in favor of
  -                         %global
  - Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart.
  - Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
  -                         keyring
  - Resolves: rhbz#599724 - sssd is broken on Rawhide


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.91-20
changelog:
  - New upstream version 1.2.91 (1.3.0rc1)
  - Improved LDAP failover
  - Synchronous sysdb API (provides performance enhancements)
  - Better online reconnection detection


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-30
changelog:
  - Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
  -                           against LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-32
changelog:
  - Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
  -                         doesn't require it


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-1
changelog:
  - New upstream release 1.4.0
  - Added support for netgroups to the LDAP provider
  - Performance improvements made to group processing of RFC2307 LDAP servers
  - Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
  - Build-system improvements to support Gentoo
  - Split out several libraries into the ding-libs tarball
  - Manpage reviewed and updated


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-1
changelog:
  - New upstream release 1.4.1
  - Add support for netgroups to the proxy provider
  - Fixes a minor bug with UIDs/GIDs >= 2^31
  - Fixes a segfault in the kerberos provider
  - Fixes a segfault in the NSS responder if a data provider crashes
  - Correctly use sdap_netgroup_search_base


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-3
changelog:
  - Solve a shutdown race-condition that sometimes left processes running
  - Resolves: rhbz#606887 - SSSD stops on upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  -Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Fix nested group member filter sanitization for RFC2307bis
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#677768 - name service caches names, so id command shows
  -                         recently deleted users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.2-1
changelog:
  - New upstream release 1.5.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
  - Fixes for support of FreeIPA v2
  - Fixes for failover if DNS entries change
  - Improved sss_obfuscate tool with better interactive mode
  - Fix several crash bugs
  - Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
  - Delete users from the local cache if initgroups calls return 'no such user'
  - (previously only worked for getpwnam/getpwuid)
  - Use new Transifex.net translations
  - Better support for automatic TGT renewal (now survives restart)
  - Netgroup fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.4-1
changelog:
  - New upstream release 1.5.4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
  - Fixes for Active Directory when not all users and groups have POSIX attributes
  - Fixes for handling users and groups that have name aliases (aliases are ignored)
  - Fix group memberships after initgroups in the IPA provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-1
changelog:
  - New upstream release 1.5.5
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
  - Fixes for several crash bugs
  - LDAP group lookups will no longer abort if there is a zero-length member
  - attribute
  - Add automatic fallback to 'cn' if the 'gecos' attribute does not exist


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-3
changelog:
  - Fix systemd conversion. Upgrades from SysV to systemd weren't properly
  - enabling the systemd service.
  - Fix a serious memory leak in the memberOf plugin
  - Fix an issue where the user's full name would sometimes be removed
  - from the cache


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
changelog:
  - Resolves: rhbz#697057 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server
  - Upgrades from SysV should now maintain enabled/disabled status


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.6-1
changelog:
  - New upstream release 1.5.6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
  - Fixed a serious memory leak in the memberOf plugin
  - Fixed a regression with the negative cache that caused it to be essentially
  - nonfunctional
  - Fixed an issue where the user's full name would sometimes be removed from
  - the cache
  - Fixed an issue with password changes in the kerberos provider not working
  - with kpasswd


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-1
changelog:
  - Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
  -                         cached password with predicatable filename


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-3
changelog:
  - Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
  - Make sure to properly convert to systemd if upgrading from newer
  - updates for Fedora 14


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.8-1
changelog:
  - New upstream release 1.5.8
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
  - Support for the LDAP paging control
  - Support for multiple DNS servers for name resolution
  - Fixes for several group membership bugs
  - Fixes for rare crash bugs


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.9-1
changelog:
  - New upstream release 1.5.9
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
  - Support for overriding home directory, shell and primary GID locally
  - Properly honor TTL values from SRV record lookups
  - Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
  - servers)
  - Properly escape IPv6 addresses in the failover code
  - Do not crash if inotify fails (e.g. resource exhaustion)
  - Don't add multiple TGT renewal callbacks (too many log messages)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.10-1
changelog:
  - New upstream release 1.5.10
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
  - Fixed a regression introduced in 1.5.9 that could result in blocking calls
  - to LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.11-2
changelog:
  - New upstream release 1.5.11
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
  - Fix a serious regression that prevented SSSD from working with ldaps:// URIs
  - IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
  - address being saved to the AAAA record


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
changelog:
  - New upstream release 1.6.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
  - Add host access control support for LDAP (similar to pam_host_attr)
  - Finer-grained control on principals used with Kerberos (such as for FAST or
  - validation)
  - Added a new tool sss_cache to allow selective expiring of cached entries
  - Added support for LDAP DEREF and ASQ controls
  - Added access control features for Novell Directory Server
  - FreeIPA dynamic DNS update now checks first to see if an update is needed
  - Complete rewrite of the HBAC library
  - New libraries: libipa_hbac and libipa_hbac-python


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.1-1
changelog:
  - New upstream release 1.6.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
  - Fixes a serious issue with LDAP connections when the communication is
    dropped (e.g. VPN disconnection, waking from sleep)
  - SSSD is now less strict when dealing with users/groups with multiple names
    when a definitive primary name cannot be determined
  - The LDAP provider will no longer attempt to canonicalize by default when
    using SASL. An option to re-enable this has been provided.
  - Fixes for non-standard LDAP attribute names (e.g. those used by Active
    Directory)
  - Three HBAC regressions have been fixed.
  - Fix for an infinite loop in the deref code


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-1
changelog:
  - Improved handling of users and groups with multi-valued name attributes
    (aliases)
  - Performance enhancements
      Initgroups on RFC2307bis/FreeIPA
      HBAC rule processing
  - Improved process-hang detection and restarting
  - Enabled the midpoint cache refresh by default (fewer cache misses on
    commonly-used entries)
  - Cleaned up the example configuration
  - New tool to change debug level on the fly


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-4
changelog:
  - Change selinux policy requirement to Conflicts: with the old version,
    rather than Requires: the supported version.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release 1.6.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
  - Fixes a major cache performance issue introduced in 1.6.2
  - Fixes a potential infinite-loop with certain LDAP layouts


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-4
changelog:
  - Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758425 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.4-1
changelog:
  - New upstream release 1.6.4
  - Rolls up previous patches applied to the 1.6.3 tarball
  - Fixes a rare issue causing crashes in the failover logic
  - Fixes an issue where SSSD would return the wrong PAM error code for users
    that it does not recognize.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-1
changelog:
  - New upstream release 1.7.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
  - Support for case-insensitive domains
  - Support for multiple search bases in the LDAP provider
  - Support for the native FreeIPA netgroup implementation
  - Reliability improvements to the process monitor
  - New DEBUG facility with more consistent log levels
  - New tool to change debug log levels without restarting SSSD
  - SSSD will now disconnect from LDAP server when idle
  - FreeIPA HBAC rules can choose to ignore srchost options for significant
    performance gains
  - Assorted performance improvements in the LDAP provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-3
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-5
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features - fix netgroups and sudo as well


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta1
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta2
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
  - Fix two minor manpage bugs
  - Include the IPA AutoFS provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - New upstream release 1.8.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed several memory-corruption bugs
  - Finalized the ABI for the autofs support
  - Fixed a regression in the proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - New upstream release 1.8.0
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)
  - Include the IPA AutoFS provider
  - Fixed several memory-corruption bugs
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed a regression in the proxy provider
  - Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
  - Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
                            logged at each login
  - Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-7
changelog:
  - New upstream release 1.8.1
  - Resolve issue where we could enter an infinite loop trying to connect to an
    auth server
  - Fix serious issue with complex (3+ levels) nested groups
  - Fix netgroup support for case-insensitivity and aliases
  - Fix serious issue with lookup bundling resulting in requests never
    completing
  - IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
    in addition to pam_authenticate
  - Fix several regressions in the proxy provider
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-8
changelog:
  - Fix uninitialized value bug causing crashes throughout the code
  - Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-9
changelog:
  - Don't duplicate libsss_autofs.so in two packages
  - Set explicit package contents instead of globbing


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.2-10
changelog:
  - New upstream release 1.8.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
  - Several fixes to case-insensitive domain functions
  - Fix for GSSAPI binds when the keytab contains unrelated principals
  - Fixed several segfaults
  - Workarounds added for LDAP servers with unreadable RootDSE
  - SSH knownhostproxy will no longer enter an infinite loop preventing login
  - The provided SYSV init script now starts SSSD earlier at startup and stops
    it later during shutdown
  - Assorted minor fixes for issues discovered by static analysis tools


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.3-11
changelog:
  - New upstream release 1.8.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
  - Numerous manpage and translation updates
  - LDAP: Handle situations where the RootDSE isn't available anonymously
  - LDAP: Fix regression for users using non-standard LDAP attributes for user
    information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-1.beta1
changelog:
  - New upstream release 1.9.0 beta 1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
  - Add native support for autofs to the IPA provider
  - Support for ID-mapping when connecting to Active Directory
  - Support for handling very large (> 1500 users) groups in Active Directory
  - Support for sub-domains (will be used for dealing with trust relationships)
  - Add a new fast in-memory cache to speed up lookups of cached data on
    repeated requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-2.beta1
changelog:
  - Fix several regressions since 1.5.x
  - Ensure that the RPM creates the /var/lib/sss/mc directory
  - Add support for Netscape password warning expiration control
  - Rebuild against libldb 1.1.6


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-5.beta2
changelog:
  - New upstream release 1.9.0 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
  - Add support for the Kerberos DIR cache for storing multiple TGTs
    automatically
  - Major performance enhancement when storing large groups in the cache
  - Major performance enhancement when performing initgroups() against Active
    Directory
  - SSSDConfig data file default locations can now be set during configure for
    easier packaging


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-7.beta2
changelog:
  - Switch unicode library from libunistring to Glib
  - Drop unnecessary explicit Requires on keyutils
  - Guarantee that versioned Requires include the correct architecture


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-8.beta3
changelog:
  - New upstream release 1.9.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
  - Add a new PAC responder for dealing with cross-realm Kerberos trusts
  - Terminate idle connections to the NSS and PAM responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-9.beta4
changelog:
  - New upstream release 1.9.0 beta 4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
  - Add a new AD provider to improve integration with Active Directory 2008 R2
    or later servers
  - SUDO integration was completely rewritten. The new implementation works
    with multiple domains and uses an improved refresh mechanism to download
    only the necessary rules
  - The IPA authentication provider now supports subdomains
  - Fixed regression for setups that were setting default_tkt_enctypes
    manually by reverting a previous workaround.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-12.beta5
changelog:
  - New upstream release 1.9.0 beta 5
  - Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
  - Many fixes for the support for setting default SELinux user context from
    FreeIPA, most notably fixed the specificity evaluation
  - Fixed an incorrect default in the krb5_canonicalize option of the AD
    provider which was preventing password change operation
  - The shadowLastChange attribute value is now correctly updated with the
    number of days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-13.beta6
changelog:
  - New upstream release 1.9.0 beta 6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
  - A new option, override_shell was added. If this option is set, all users
    managed by SSSD will have their shell set to its value.
  - Fixes for the support for setting default SELinux user context from FreeIPA.
  - Fixed a regression introduced in beta 5 that broke LDAP SASL binds
  - The SSSD supports the concept of a Primary Server and a Back Up Server in
    failover
  - A new command-line tool sss_seed is available to help prime the cache with
    a user record when deploying a new machine
  - SSSD is now able to discover and save the domain-realm mappings
    between an IPA server and a trusted Active Directory server.
  - Packaging changes to fix ldconfig usage in subpackages (#843995)
  - Rebuild against libldb 1.1.9


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-14.beta6
changelog:
  - Don't discard HBAC rule processing result if SELinux is on
    Resolves: rhbz#846792 (CVE-2012-3462)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-18.beta6
changelog:
  - Change the default ccache location to DIR:/run/user/${UID}/krb5cc
    and patch man page accordingly
  - Resolves: rhbz#851304


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.4-3
changelog:
  - Recreate Kerberos ccache directory if it's missing
  - Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
                            directory /run/user/UID/ccdir does not exist


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-4.beta1
changelog:
  - Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
    in ding-libs
  - Fix SSH integration with fully-qualified domains
  - Add the ability to dynamically discover the NetBIOS name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-6.beta1
changelog:
  - Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
                            realm join
  - Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
                            default for AD Provider
  - Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
                            parent directory when logging in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-7.beta1
changelog:
  - Apply a couple of patches from upstream git that resolve crashes when
    ID mapping object was not initialized properly but needed later


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-8.beta2
changelog:
  - New upstream release 1.10 beta2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
  - BuildRequire libcmocka-devel in order to run all upstream tests during build
  - BuildRequire libnl3 instead of libnl1
  - No longer BuildRequire initscripts, we no longer use /sbin/service
  - Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
    older krb5-libs version


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-9.beta2
changelog:
  - Fix typo in Requires that prevented an upgrade (#973916)
  - Use a hardcoded version in Conflicts, not less-than-current


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-11.beta2
changelog:
  - Apply a number of patches from upstream to fix issues found post-beta,
    in particular:
    -- segfault with a high DEBUG level
    -- Fix IPA password migration (upstream #1873)
    -- Fix fail over when retrying SRV resolution (upstream #1886)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-14
changelog:
  - Fix Obsoletes: to account for dist tag
  - Convert post and pre scripts to run on the sssd-common subpackage
  - Remove old conversion from SYSV


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-16
changelog:
  - Move sssd_pac to the sssd-ipa and sssd-ad subpackages
  - Trim out RHEL5-specific macros since we don't build on RHEL 5
  - Trim out macros for Fedora older than F18
  - Update libldb requirement to 1.1.16
  - Trim RPM changelog down to the last year


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0.2beta2
changelog:
  - Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
                        pam libraries


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-0.4.beta2
changelog:
  - Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
                        Process /usr/libexec/sssd/sssd_nss was killed by
                        signal 11 (SIGSEGV)
  - Resolves: #996214 - sssd proxy_child segfault


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-2
changelog:
  - Backport simplification of ccache management from 1.11.1
  - Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-3
changelog:
  - Fix multicast checks in the SSSD
  - Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
                             code getting the host info


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-1
changelog:
  - New upstream release 1.11.2
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.3-1
changelog:
  - New upstream release 1.11.3
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.4-1
changelog:
  - New upstream release 1.11.4
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.5-1
changelog:
  - New upstream release 1.11.5
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.1-2
changelog:
  - Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
                             private group from server


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.2-6
changelog:
  - Fix regressions and bugs in sssd upstream 1.12.2
  - https://fedorahosted.org/sssd/ticket/{id}
  - Regressions: #2471, #2475, #2483, #2487, #2529, #2535
  - Bugs: #2287, #2445


author: Sumit Bose <sbose@redhat.com> - 1.12.2-7
changelog:
  - Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
                             crash in wbinfo
                             - in addition to the patch libwbclient.so is
                               filtered out of the Provides list of the package


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-1
changelog:
  - New upstream release 1.12.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
  - Fix spelling errors in description (fedpkg lint)


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-2
changelog:
  - Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
  - Resolves: rhbz#1179379 - gzip: stdin: file size changed while
                             zipping when rotating logfile


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-3
changelog:
  - Apply a number of patches from upstream to fix issues found 1.12.3
  - Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
                             interfaces, or isn't documented to be able to
  - Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
                            not running
  - Resolves: upstream #2557  authentication failure with user from AD


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-4
changelog:
  - Decrease priority of sssd-libwbclient 20 -> 5
  - It should be lower than priority of samba veriosn of libwbclient.
  - https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-6
changelog:
  - Fix double free in monitor
  - Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
                          sssd killed by SIGABRT


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-2
changelog:
  - Add support for python3 bindings
  - Add requirement to python3 or python3 bindings
  - Resolves: rhbz#1014594 - sssd: Support Python 3


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-5
changelog:
  - Fix regressions with ipa and SELinux
  - Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
                               context on client is staff_u


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-6
changelog:
  - Fix slow login with ipa and SELinux
  - Resolves: upstream #2624 - Only set the selinux context if the context
                               differs from the local one


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-8
changelog:
  - Backport important patches from upstream 1.13 prerelease
  - Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
                             attribute for group name
  - Resolves: upstream #2335 - Investigate using the krb5 responder
                               for driving the PAM conversation with OTPs
  - Enable cmocka tests for secondary architectures


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-4
changelog:
  - Fix ipa-migration bug
  - Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
                               migration mode


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-6
changelog:
  - Fix OTP bug
  - Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
                               entered separately


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-2
changelog:
  - Fix few segfaults
  - Resolves: upstream #2811 - PAM responder crashed if user was not set
  - Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-3
changelog:
  - python-sssdconfig: Fix parssing sssd.conf without config_file_version
  - Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-5
changelog:
  - Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
                             groups during getgrnam and getgrgid
  - Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
                             in call to 'print'


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-6
changelog:
  - Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
                             prompts (e.g. Password + Token)
  - Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
                             by remote host" if locale not available


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.4-3
changelog:
  - Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
                             sssd_ifp killed by SIGSEGV


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-2
changelog:
  - Backport important patches from upstream 1.14.2 prerelease
  - Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
                               boot
  - Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-3
changelog:
  - Fix regression with krb5_map_user
  - Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
  - Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
                             default if nonexistent domain is mentioned


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.2-2
changelog:
  - Resolves: rhbz#1369130 - nss_sss should not link against libpthread
  - Resolves: rhbz#1392916 - sssd failes to start after update
  - Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
                             on the directory /etc/sssd


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.0-4
changelog:
  - Cherry-pick patches from upstream that enable the files provider
  - Enable the files domain
  - Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
    which is superseded by the files domain autoconfiguration
  - Related: rhbz#1357418 - SSSD fast cache for local users


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.2
changelog:
  - Fix issue with IPA + SELinux in containers
  - Resolves: upstream https://fedorahosted.org/sssd/ticket/3297


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.3
changelog:
  - Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
  - Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
                             file from package sssd-common-1.15.1-1.fc25.x86_64
  - Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-4
changelog:
  - Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
                             access on the sock_file system_bus_socket
  - Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
                             fails to download desktop profile data
  - Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
  - Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
                              after applying ID Views for them in IPA server
  - Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
                              mapping is applied


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-5
changelog:
  - Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database access on
                             the sock_file system_bus_socket


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.16.0-5
changelog:
  - Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
                              setnetgrent_result_timeout
  - Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
                              or machine swaps
  - Resolves: failure in glibc tests
              https://sourceware.org/bugzilla/show_bug.cgi?id=22530
  - Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
                              auth_provider ldap, login fails if the LDAP server
                              is not allowing anonymous binds
  - Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
                              corrected with AD
  - Resolves: upstream#3586 - Give a more detailed debug and system-log message
                              if krb5_init_context() failed
  - Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
                             in /etc/systemd/system
  - Backport few upstream features from 1.16.1


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.0-12
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Resolves: upstream#3621 - FleetCommander integration must not require
                              capability DAC_OVERRIDE


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-2
changelog:
  - Resolves: upstream#3573 - sssd won't show netgroups with blank domain
  - Resolves: upstream#3660 - confdb_expand_app_domains() always fails
  - Resolves: upstream#3658 - Application domain is not interpreted correctly
  - Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
                              json_loads()
  - Resolves: upstream#3386 - KCM: Payload buffer is too small
  - Resolves: upstream#3666 - Fix usage of str.decode() in our tests
  - A few KCM misc fixes


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-3
changelog:
  - Resolves: upstream#3684 - A group is not updated if its member is removed
                              with the cleanup task, but the group does not
                              change
  - Resolves: upstream#3558 - sudo: report error when two rules share cn
  - Tone down shutdown messages for socket activated responders
  - IPA: Qualify the externalUser sudo attribute
  - Resolves: upstream#3550 - refresh_expired_interval does not work with
                              netgrous in 1.15
  - Resolves: upstream#3402 - Support alternative sources for the files provider
  - Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
  - Resolves: upstream#3679 - Make nss netgroup requests more robust
  - Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
                              configured
  - Resolves: upstream#3469 - extend sss-certmap man page regarding priority
                              processing
  - Improve docs/debug message about GC detection
  - Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
                              list out of bound?
  - Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
                              set.
  - Document which principal does the AD provider use
  - Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
                              defined, but contains no SIDs
  - Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
  - Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
                             Provider returned an error
                             [org.freedesktop.sssd.Error.DataProvider.Fatal]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-1
changelog:
  - Update to 1.16.2 release
  - Cleanup unused global definitions
  - Remove python2 references from the spec file
  - Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-2
changelog:
  - Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
                             fails with the KCM ccache


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-4
changelog:
  - Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                             users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-7
changelog:
  - Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
                             differs from the default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-8
changelog:
  - Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
                              /usr/libexec/sssd/sssd_be killed by 11 crash
                              func _dbus_list_unlink


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-9
changelog:
  - Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
                             commands in man pages since local provider
                             is deprecated


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-10
changelog:
  - Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
                             started due to a misconfiguration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-11
changelog:
  - Resolves: rhbz#1628122 - Printing incorrect information about domain
                             with sssctl utility


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-16
changelog:
  - Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
                            PKCS#11 URI


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-17
changelog:
  - Related: rhbz#1637131 - pam_unix unable to match fully qualified username
                            provided by sssd during smartcard auth using gdm


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-18
changelog:
  - Related: rhbz#1638006 - Files: The files provider always enumerates
                            which causes duplicate when running getent passwd


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-19
changelog:
  - Add OSCP checks for p11_child
  - Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                            users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-21
changelog:
  - Related: rhbz#1638150 - session not recording for local user when groups defined
  - Also add silence a Coverity warning, which is related to rhbz#1637131


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-23
changelog:
  - Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
                             with smart card


author: Michal Židek <mzidek@redhat.com> - 2.0.0-24
changelog:
  - Resolves: rhbz#1646168 - sssctl access-report always prints an error message
  - Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
                             configuration without having to restart the whole
                             sssd
  - Resolves: rhbz#1640576 - sssctl reports incorrect information about local
                             user's cache entry expiration time
  - Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
  - Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys


author: Michal Židek <mzidek@redhat.com> - 2.0.0-25
changelog:
  - Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
                             for D-bus, resulting in a crash


author: Michal Židek <mzidek@redhat.com> - 2.0.0-27
changelog:
  - Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
                             if ID provider is authenticated with GSSAPI


author: Michal Židek <mzidek@redhat.com> - 2.0.0-29
changelog:
  - Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
                             /usr/libexec/sssd/proxy_child killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.0.0-30
changelog:
  - Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
                        retrieve AD users through IPA Trust


author: Michal Židek <mzidek@redhat.com> - 2.0.0-32
changelog:
  - Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
              and libtevent to avoid an issue in GPO processing


author: Michal Židek <mzidek@redhat.com> - 2.0.0-33
changelog:
  - Resolves: rhbz#1646113 - Missing concise documentation about valid options
                             for sssd-files-provider


author: Michal Židek <mzidek@redhat.com> - 2.0.0-34
changelog:
  - Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
                             kdestroy caused by KCM returning a wrong error
                             code during the delete operation


author: Michal Židek <mzidek@redhat.com> - 2.0.0-36
changelog:
  - Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
                             suggests using * for backend sss


author: Michal Židek <mzidek@redhat.com> - 2.0.0-38
changelog:
  - Resolves: rhbz#1578014 - sssd does not work under non-root user
  - Note: Actually the patches were in the 2.0.0-37, this one just adds this
          changelog because it was missing.


author: Michal Židek <mzidek@redhat.com> - 2.0.0-39
changelog:
  - Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
                             1.x, this can result in time outs


author: Michal Židek <mzidek@redhat.com> - 2.0.0-40
changelog:
  -Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
                            UnknownProperty: Unknown property


author: Michal Židek <mzidek@redhat.com> - 2.0.0-41
changelog:
  -Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
                            subdomain service name being used


author: Michal Židek <mzidek@redhat.com> - 2.0.0-42
changelog:
  - Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
                             of gen_new to avoid a subsequent switch call
                             failure


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-43
changelog:
  - Resolves: rhbz#1672780 - gdm login not prompting for username when smart
                             card maps to multiple users


author: Michal Židek <mzidek@redhat.com> - 2.0.0-45
changelog:
  - Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
    done here in order to unblock gating changes before rebase.
  - Related: rhbz#1682305


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-2
changelog:
  - Resolves: rhbz#1673443 - sssd man pages: The default value of
                             "ldap_user_home_directory" is not mentioned
                             with AD server configuration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-3
changelog:
  - Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
                             no members


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-4
changelog:
  - Resolves: rhbz#1283798 - sssd failover does not work on connecting to
                             non-responsive ldaps:// server


author: Michal Židek <mzidek@redhat.com> - 2.2.0-6
changelog:
  - Resolves: rhbz#1726945 - negative cache does not use values from
                             'filter_users' config option for known domains


author: Michal Židek <mzidek@redhat.com> - 2.2.0-7
changelog:
  - Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
                             not FIPS140 compliant


author: Michal Židek <mzidek@redhat.com> - 2.2.0-8
changelog:
  - Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
                             repository
                           - This just required a raise in release number
                             and changelog for the record.


author: Michal Židek <mzidek@redhat.com> - 2.2.0-10
changelog:
  - Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
                             the trailing colon


author: Michal Židek <mzidek@redhat.com> - 2.2.0-11
changelog:
  - Resolves: rhbz#1733372 - permission denied on logs when running sssd as
                             non-root user


author: Michal Židek <mzidek@redhat.com> - 2.2.0-13
changelog:
  - Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
              systemd-user service in the account phase in RHEL-8


author: Michal Židek <mzidek@redhat.com> - 2.2.0-14
changelog:
  - Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
                             should not cause files domain entries to be
                             qualified, this can break sudo access


author: Michal Židek <mzidek@redhat.com> - 2.2.0-15
changelog:
  - Resolves: rhbz#1736265 - Smart Card auth of local user: endless
                             loop if wrong PIN was provided


author: Michal Židek <mzidek@redhat.com> - 2.2.0-16
changelog:
  - Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
                             the IP address of the machine updated in IPA upon
                             sssd.service startup


author: Michal Židek <mzidek@redhat.com> - 2.2.0-17
changelog:
  - Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
                             keyring
  - Also apply a patch to fix gating tests issue


author: Michal Židek <mzidek@redhat.com> - 2.2.0-18
changelog:
  - Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
  - Also sync. kcm multihost tests with master


author: Michal Židek <mzidek@redhat.com> - 2.2.0-19
changelog:
  - Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
                             new ones (kcm)


author: Michal Židek <mzidek@redhat.com> - 2.2.3-2
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              PART2: Fix gating issue.


author: Michal Židek <mzidek@redhat.com> - 2.2.3-3
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              Increasing version number to pick latest libldb


author: Michal Židek <mzidek@redhat.com> - 2.2.3-4
changelog:
  * Resolves: rhbz#1781728 - sssctl config-check command does not give proper
                             error messages with line numbers


author: Michal Židek <mzidek@redhat.com> - 2.2.3-5
changelog:
  * Resolves: rhbz#1744500 - [Doc]Provide explanation on escape character
                             for match rules sss-certmap


author: Michal Židek <mzidek@redhat.com> - 2.2.3-9
changelog:
  * Resolves: rhbz#1783190 - [abrt] [faf] sssd:
                             raise(): /usr/libexec/sssd/sssd_autofs killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.2.3-10
changelog:
  * Resolves: rhbz#1583592 - [RFE] Add configurable randomness to SSSD ldap
                             connection timeout


author: Michal Židek <mzidek@redhat.com> - 2.2.3-14
changelog:
  - Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
                             specified up to the seconds


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-16
changelog:
  - Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
                             omitted and auth_provider is krb5


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-17
changelog:
  - Resolves: rhbz#1718193 - p11_child should have an option to skip
                             C_WaitForSlotEvent if the PKCS#11 module
                             does not implement it properly


author: Michal Židek <mzidek@redhat.com> - 2.2.3-18
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
                             information


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate
                             (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
  - Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
  - Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
  - Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
  - Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
  - Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
  - Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
  - Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
  - Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
  - Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
  - Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
  - Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
  - Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
  - Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
  - Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
  - Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
  - Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
  - Resolves: RHEL-10721 - very bad performance when requesting service tickets
  - Resolves: RHEL-19011 - Invalid handling groups from child domain
  - Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
  - Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
  - Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.1
changelog:
  - Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
  - Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
  - Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
  - Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
  - Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
  - Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]


author: Clark Williams <williams@redhat.com> - 1.10-1
changelog:
  - utils: Fix bounds check on cpu and end_cpu variables
  - stalld: Support denylisting of tasks in stalld
  - src/utils: use right argument for warning printf


author: Clark Williams <williams@redhat.com> - 1.11-1
changelog:
  - redhat/stalld.spec: pick up gating test version for changelog
  - utils.c: set daemon umask to restrict global write/execute (1934586)
  - hardening fixes from coverity scan (1934590)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.12-1
changelog:
  - stalld.8: fix diff cruft left in manpage source
  - stalld.c: clean up handling of nr_running
  - stalld.c: remove duplicate parameter to fill_waiting_task()
  - stalld: Add error handling in get_cpu_idle_time()
  - stalld.service: Run stalld as sched_fifo via systemd
  - packaging: clean up Makefiles and rpm specfile
  - stalld: Always print current function for info messages
  - stalld: Always print current function for warn messages
  - stalld: Always print current function for die messages
  - utils: change PATHMAX to 4096


author: Fernando Pacheco <fpacheco@redhat.com> - 1.13-1
changelog:
  - stalld: Fix log message on boost_cpu_starving_vector()
  - stalld: Add the overload control to the single-threaded mode
  - stalld: Add the adaptive mode option
  - stalld: Use the last mode set in the cmdline
  - stalld: Fallback to the adaptive mode if force_fifo is selected
  - stalld: Make single-threaded mode the default one
  - stalld.service: Always restart stalld on exit
  - utils.c: Fail if user is not root
  - utils.c: Make the path to sched_debug path dynamic


author: Fernando Pacheco <fpacheco@redhat.com> - 1.14.1-1
changelog:
  - stalld: Coding style cleanup
  - stalld: spaces in place of <TAB>
  - throttling: Use RT_RUNTIME_PATH in rt_throttling_is_off()
  - throttling: Check open() on turn_off_rt_throttling
  - throttling: Adjust variables in restore_rt_throttling()
  - stalld.c: utils.c: Remove complex assignments from variable declarations
  - stalld.h: Define MAX_PATH/DIR_PATH/FILE_NAME and use them
  - stalld: Adjust variables in parse_old_task_format()
  - utils.c: Use MAX_PATH for pidfile
  - stalld.c: Remove variable declaration from the middle of  the function
  - stalld: Respect -l option in single threaded mode (1983103)
  - utils: s/try_to_open_file/check_file_exists/
  - utils: use check_file_exists in setup_hr_tick()
  - utils: Check for the new sched_features path


author: Fernando Pacheco <fpacheco@redhat.com> - 1.15-1
changelog:
  - stalld: Fix incorrect open() return value checks
  - stalld: Pass errno to strerror() on sig*set() failures
  - throttling: Always null terminate sched_rt_runtime_us output
  - stalld: Remove unreachable statement in detect_task_format()
  - tests: Fix uninitialized value action.sa_mask
  - utils: Bail if malloc() returns null in parse_cpu_list()
  - stalld: Use correct format specifier for long types
    Resolves: rhbz#2016010


author: Fernando Pacheco <fpacheco@redhat.com> - 1.16-1
changelog:
  - stald/utils: Space, lines and voids clenaups
  - stalld: Add an option to easily set stalld as SCHED_DEADLINE
  - stalld: Comments cleanup
  - src/utils: Comments cleanup
  - src/throttling: Comments cleanup
  - src/stalld.h Comments cleanup
    Resolves: rhbz#2068550


author: Leah Leshchinsky <lleshchi@redhat.com> - 1.17.1-1
changelog:
  - stalld: Fix memory leak in print_boosted_info()
  - utils: Check if the system is in lockdown mode
  - stalld: print process comm and cpu when boosting
  Resolves: rhbz#2120799


author: Clark Williams <williams@redhat.com> - 0.0-1
changelog:
  - initial version of specfile
  - Makefile mods for RPM builds
  - added systemd service and config files


author: Clark Williams <williams@redhat.com> - 1.0-2
changelog:
  - use _docdir macro for README.md
  - use _mandir macro for stalld.8 manpage
  - use tabs for spacing
  - added push Makefile target to copy latest to upstream URL


author: Clark Williams <williams@redhat.com> - 1.0-3
changelog:
  - Place BuildRequires on individual lines
  - Fix changelog notations
  - Modify build command to pass in CFLAGS and LDFLAGS
  - fix compiler warnings in stalld.c


author: Clark Williams <williams@redhat.com> - 1.0-4
changelog:
  - Fix an option in README.md; consistency in user facing docs.
  - gitignore: ignore object files and the stalld executable
  - Makefile: add 'static' target to link stalld statically
  - use FIFO for boosting (v3)
  - stalld: update usage message to include --force_fifo/-F option
  - stalld.c: fix sched_debug parsing and modify waiting task parsing


author: Clark Williams <williams@redhat.com> - 1.1-1
changelog:
  - Fix an option in README.md; consistency in user facing docs.
  - Makefile: add 'static' target to link stalld statically
  - gitignore: ignore object files and the stalld executable
  - use FIFO for boosting (v3)
  - stalld.c: fix sched_debug parsing and modify waiting task parsing
  - redhat:  update release for features and bugfix
  - stalld: Do not die if sched_debug returns an invalid value
  - src/stalld: Do not die if the comm is too large
  - src/stalld: Do not die if cannot write a message to the log
  - src/stalld: Do not die if the main runs while a thread is monitoring the CPU
  - implement RT throttling management and refactor source files
  - more refactoring
  - src/stalld: Reuse already read nr_running nr_rt_running
  - src/stalld: Gracefully handle CPUs not found on sched_debug
  - src/stalld: Use dynamically allocated memory to read sched_debug
  - src/utils: Die with a divizion by zero if verbose
  - src/stalld: Add config_buffer_size variable
  - src/stalld: Increase the sched_debug read buffer if it gets too small
  - src/stalld: Fix an retval check while reading sched_debug
  - src/throttling: Fix a compilation warning


author: Clark Williams <williams@redhat.com> - 1.2-1
changelog:
  - utils.c: added info() functions
  - detect and correctly parse old-style /proc/sched_debug
  - src/stalld: Fix an retval check while reading sched_debug
  - src/throttling: Fix a compilation warning
  - ensure we only count task lines in old-format sched_debug info
  - Add comments, clean up trailing whitespace
  - src/utils: Fix runtime parameters check
  - stalld: Do not take actions if log_only is set
  - remove warning from parse_old_task_format


author: Clark Williams <williams@redhat.com> - 1.3-1
changelog:
  - Readme: Add information about repositories
  - Add version management and version option
  - create doc and scripts directory and add info on releases


author: Clark Williams <williams@redhat.com> - 1.4-1
changelog:
  - stalld: Set rt_runtime to -1 before trying the SCHED_DEADLINE
  - Fix incorrect recursion of specfile version field


author: Clark Williams <williams@redhat.com> - 1.7-1
changelog:
  - rework detect_task_format and buffer_size logic
  - make CFLAGS for local compile match rpmbuild CFLAGS


author: Clark Williams <williams@redhat.com> - 1.8-1
changelog:
  - Fix Readiness Protocol Mismatch with systemd
  - test01:  update to use buildin atomic operations
  - test01: add throttling check


author: Clark Williams <williams@redhat.com> - 1.9-1
changelog:
  - Set starvation threshold default to 30 seconds
  - rework read buffer allocation to properly find page size
  - Add the -g/--granularity option
  - Change the default granularity to five seconds
  - Implement idle detection
  - Implement the single-threaded mode
  - Add HRTICK_DL support


author: Fernando Pacheco <fpacheco@redhat.com> - 1.12-1
changelog:
  - stalld.8: fix diff cruft left in manpage source
  - stalld.c: clean up handling of nr_running
  - stalld.c: remove duplicate parameter to fill_waiting_task() (1934582)
  - stalld.service: Run stalld as sched_fifo via systemd
  - stalld: Add error handling in get_cpu_idle_time() (1966259)
  - packaging: clean up Makefiles and rpm specfile (1972806)
  - stalld: Always print current function for info messages
  - stalld: Always print current function for warn messages
  - stalld: Always print current function for die messages
  - utils: change PATHMAX to 4096 (1934581)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.13-1
changelog:
  - stalld: Fix log message on boost_cpu_starving_vector()
  - stalld: Add the overload control to the single-threaded mode
  - stalld: Add the adaptive mode option
  - stalld: Use the last mode set in the cmdline
  - stalld: Fallback to the adaptive mode if force_fifo is selected
  - stalld: Make single-threaded mode the default one (1920041)
  - stalld.service: Always restart stalld on exit
  - utils.c: Fail if user is not root
  - utils.c: Make the path to sched_debug path dynamic (1977663)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.14.1-1
changelog:
  - stalld: Coding style cleanup
  - stalld: spaces in place of <TAB>
  - throttling: Use RT_RUNTIME_PATH in rt_throttling_is_off()
  - throttling: Check open() on turn_off_rt_throttling
  - throttling: Adjust variables in restore_rt_throttling()
  - stalld.c: utils.c: Remove complex assignments from variable declarations
  - stalld.h: Define MAX_PATH/DIR_PATH/FILE_NAME and use them
  - stalld: Adjust variables in parse_old_task_format()
  - utils.c: Use MAX_PATH for pidfile
  - stalld.c: Remove variable declaration from the middle of  the function
  - stalld: Respect -l option in single threaded mode (1983100)
  - utils: s/try_to_open_file/check_file_exists/
  - utils: use check_file_exists in setup_hr_tick()
  - utils: Check for the new sched_features path


author: Fernando Pacheco <fpacheco@redhat.com> - 1.15-1
changelog:
  - stalld: Fix incorrect open() return value checks
  - stalld: Pass errno to strerror() on sig*set() failures
  - throttling: Always null terminate sched_rt_runtime_us output
  - stalld: Remove unreachable statement in detect_task_format()
  - tests: Fix uninitialized value action.sa_mask
  - utils: Bail if malloc() returns null in parse_cpu_list()
  - stalld: Use correct format specifier for long types
    Resolves: rhbz#1990057, rhbz#1996799, rhbz#1996825


author: Fernando Pacheco <fpacheco@redhat.com> - 1.16-1
changelog:
  - stald/utils: Space, lines and voids clenaups
  - stalld: Add an option to easily set stalld as SCHED_DEADLINE
  - stalld: Comments cleanup
  - src/utils: Comments cleanup
  - src/throttling: Comments cleanup
  - src/stalld.h Comments cleanup
    Resolves: rhbz#2068549


author: Leah Leshchinsky <lleshchi@redhat.com> - 1.17.1-1
changelog:
  - stalld: Fix memory leak in print_boosted_info()
  - utils: Check if the system is in lockdown mode
  - stalld: print process comm and cpu when boosting
  Resolves: rhbz#2120800


author: Dennis Keefe <dkeefe@redhat.com> - 2.0.0-4
changelog:
  - Update to 2.0.0
  - Resolves: rhbz#1760906
  - Fix a bug where last update time for variable length metadata was not set
    properly on startup:
  - Resolves: rhbz#1720399
  - Specify path of PID file as "/run/stratisd.pid" instead of 
    "/var/run/stratisd.pid".
  - Resolves: rhbz#1754649
  - For a particular log entry, reduce log level from INFO to DEBUG and make the
    log message more detailed:
  - Resolves: rhbz#1680052


author: Dennis Keefe <dkeefe@redhat.com> - 2.1.0-1
changelog:
  - Update to 2.1.0
  - Resolves: rhbz#1791473
  - Update Stratis RPM Spec File
  - Resolves: rhbz#1828487
  - Support per-pool encryption of the devices that form a pool's data tier
  - Resolves: rhbz#1768580
  - Improve systemd unit file description
  - Resolves: rhbz#1756525


author: Dennis Keefe <dkeefe@redhat.com> - 2.3.0-2
changelog:
  - Update to 2.3.0
  - Resolves: rhbz#1885328
  - Stratis devices inhabit an existing root directory path
  - Resolves: rhbz#1798244
  - Add Clevis Support
  - Resolves: rhbz#1868100
  - Improve stratisd log levels
  - Resolves: rhbz#1757976


author: Bryan Gurney <bgurney@redhat.com> - 2.4.0-3
changelog:
  - Update to 2.4.0
  - Resolves: rhbz#1931671
  - Improve stratis by adding Multi-threading
  - Resolves: rhbz#1927485
  - Dump stratis configuration on demand or in debug
  - Resolves: rhbz#1735475
  - Add noalign option to XFS creation on MDV
  - Resolves: rhbz#1908318
  - Cap thinpool metadata device size at devicemapper-set limit
  - Resolves: rhbz#1707461


author: Bryan Gurney <bgurney@redhat.com> - 2.4.2-1
changelog:
  - Update to 2.4.2
  - Resolves: rhbz#1931671
  - Ensure that binaries are installed with proper features enabled
  - Split dracut modules out to subpackage
  - Add additional dependencies in dracut module


author: John Kacur <jkacur@redhat.com> - 0.15.00-1
changelog:
  - Rebase to upstream V0.15.00
  - Add the following upstream patches
  - stress-shm: move /dev/shm check to earlier in the setup phase
  - stress-shm: skip stressor if /dev/shm is not mounted with tmpfs on linux
  - stress-sysfs: check for zero sysfs entries after pruning the directory
  Resolves: rhbz#2144070


author: John Kacur <jkacur@redhat.com> - 0.17.08-1
changelog:
  - Rebase to upstream V0.17.08
  - ARM: Don't declare inlined yield helper if yield is not available
  Resolves: RHEL-33304


author: Kalev Lember <kalevlember@gmail.com> - 0.5.1-1
changelog:
  - Update to 0.5.1
  - Build with libmusicbrainz4
  - Adjust the spec file for the changes in private library location
  - Remove and obsolete the -devel subpackage


author: David King <amigadave@amigadave.com> - 3.15.90-1
changelog:
  - Update to 3.15.90
  - Use license macro for COPYING
  - Use pkgconfig for BuildRequires
  - Compile GSettings schemas


author: Michael Catanzaro <mcatanzaro@redhat.com> - 3.28.3-3
changelog:
  - Use autosetup so WebKitGTK patch actually gets applied, and rewrite the patch to work
    Resolves: RHEL-26699


author: Tom Stellard <tstellar@redhat.com> - 4.0.2-2
changelog:
  - Use make macros
    https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Disable Go tests


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.0-2.20200828git0c238a2
changelog:
  - Backport fixes from 0.4.0 stable branch. Resolves: rhbz#1868375
    (fixes usage of swtpm-localca with passwords when signing keys)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.2-1.20201201git2df14e3
changelog:
  - Update to 0.4.2, to address potential symlink vulnerabilities (CVE-2020-28407).
    Resolves: rhbz#1906043


author: Michal Sekletár <msekleta@redhat.com> - 11.7.3-2
changelog:
  - sysstat's buildsystem doesn't really use LDFLAGS, we have to merge CFLAGS and LDFLAGS to get binaries with full RELRO (#1624177)


author: <msekleta@redhat.com> - 11.7.3-7
changelog:
  - Don't trigger autofs mounts when running sadc (#2000910)
  - sar: Add missing %gnice CPU value for tickless CPU (#2000916)
  - sadf: Fix seg fault on empty data files (#1910841)
  - sar: Fix typo in manual page (#1877836)


author: psimovec <psimovec@redhat.com> - 11.7.3-11
changelog:
  - fix the arithmetic overflow in allocate_structures() that is still possible on some 32 bit systems (CVE-2023-33204)


author: Ivana Varekova <varekova@redhat.com> - 8.0.1-1
changelog:
  - update to 8.0.1
  - remove useless patches
  - spec file cleanup
  - remove smp build flag (ar problem)
  - add libdir flags


author: Ivana Varekova <varekova@redhat.com> - 8.0.2-2
changelog:
  - change license tag
  - remove sysstat.crond source (add -d)
  - remove obsolete sysconfig file
  - spec file cleanup


author: Ivana Varekova <varekova@redhat.com> - 9.0.4-3
changelog:
  - fix init script - add INIT INFO flags (#522740)
    and add condrestart, try-restart and force-reload (#522743)


author: Ivana Hutarova Varekova <varekova@redhat.com> - 9.0.6.1-7
changelog:
  - remove needless DOCDIR setting
  - remove needless INIT_DIR setting
  - fix the problem with --disable-man-group option


author: Ivana Hutarova Varekova <varekova@redhat.com> - 10.0.0-4
changelog:
  - close the file descriptor in a special situation in read_uoptime function
  - fix the number on open files in cifsiostat output


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.1-1
changelog:
  - resolves: #844387
    update to 10.1.1
  - keep log files for 28 days instead of 7
  - collect all aditional statistics


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-1
changelog:
  - resolves: #863791
    updated to 10.1.2
  - resolves: #850333
    migrated to the new systemd-rpm macros
  - cleaned .spec file


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-2
changelog:
  - added new -y option to iostat command to skip first since boot report if
    displaying multiple reports


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.6-1
changelog:
  - resolves: #972508
    updated to 10.1.6
  - resolves: #993394
    fixed FTBFS (added BR on systemd)
  - install the docs in the new pkgdocdir
    (thanks to Mathieu Bridon <bochecha@fedoraproject.org> for the patch)


author: Lukáš Zaoral <lzaoral@redhat.com> - 11.7.3-13
changelog:
  - fix memory allocation errors with malformed sa files (RHEL-35511)
  - reorder patches to prevent errors during their application


author: Stan Cox <scox@redhat.com> - 4.7-1
changelog:
  - Upstream release, see wiki page below for detailed notes.
    https://sourceware.org/systemtap/wiki/SystemTapReleases


author: Frank Ch. Eigler <fche@redhat.com> - 4.8-2
changelog:
  - rhbz2156092 = rhbz1997192
  - rhbz2145241 = rhbz2145242
  - rhbz2156093 = rhbz2149223
  - rhbz2156095 = rhbz2149666
  - rhbz2156094 = rhbz2154430


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Removing build-time dependency on sharutils(rhbz#1587877)
  - Changing git dependency to smaller git-core


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-6
changelog:
  - Resolves: #1715423 - tcpdump pre creates user and groups unconditionally
  - Resolves: #1655622 - CVE-2018-19519 Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-2
changelog:
  - Resolves: #1860216 - tcpdump can not parse mptcp options
  - Resolves: #1901635 - ppp decapsulator can be convinced to allocate a large amount of memory
  - Adding tedude test to gating


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - separate package for libpcap.
  - update tcpdump to 3.4, libpcap to 0.4.
  - added arpwatch (but disabled for now)


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - include A. Kuznetsov's patches to libpcap/tcpdump.
  - added arpsnmp to package (#3258).
  - arp2ethers written for different of awk (#4326).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - remove sparc64 SIOCGIFNAME hack, not needed with (at least) kernel 2.2.12-40.
  - upgrade to ANK ss991030 snapshot with pcap magic fix (#6773).
  - add getprotobyname lookup (#6725).
  - getservbyname port lookup appears functional (#7569).
  - remove uid 2090 backdoor (sorry Dave) (#7116).


author: Matt Wilson <msw@redhat.com>
changelog:
  - source /etc/init.d/functions
  - back out /etc/init.d/arpwatch, place file in /etc/rc.d
  - move initscript to /etc/init.d
  - changed initscript to use start() and stop() functions
  - added condrestart to init script
  - added %post %preun %postun scripts to register arpwatch script
  - added Prereq: for all things needed in post/preun/postun


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - eliminate more buffer overflows (from FreeBSD) (#20069).
  - 802.1q ether type incorrect (#19850).
  - add -u flag to drop arpwatch privs (#19696).


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - tcpdump: spice up the manpage about interfaces
  - tcpdump: add 'all' and 'any' keywords to -i, saner default behaviour.
  - upgrade arpwatch to 2.1a10


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - Initial packaging with latest tcpdump.org CVS tcpdump-3.6 and libpcap-0.6.
  - add earlier print-domain.c, the latest is segfaulting
  - don't unnecesessarily include snprintf.o, it didn't compile with gcc 2.96 anyway
  - don't use savestr, require openssl, tweak tweak tweak
  - add tcpslice, patch it a bit for egcs detection


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - Update to 20010108 CVS, disable some upstreamed patches.
  - Change some additional .1 pages to .8.
  - Add droproot patch, some --usage and man page fixes.


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - Make SMB printing output a lot more quiet unless in verbose mode.
  - Make -n resolve port/protocol numbers but not hostnames, -nn for no
    resolving at all
  - Separate droproot patch from a more generic man/usage fix one
  - Add non-promiscuous mode -by default patch, but don't apply it by default


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - use --enable-ipv6
  - Add two patches from CVS to enhance 802.2 printing, and more importantly,
    to be able to specify 'no stp'


author: Harald Hoyer <harald@redhat.com>
changelog:
  - fixed EINTR stopping for e.g. SIGSTOP. (#22008)
  - added -u option for tcpdump (#20231)
  - new arpwatch version (#23172)
  - added "all" and "one" interface for -i (#20907)
  - added arpwatch sysconfig (#23172)


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - fix building of tcpslice on glibc 2.2.2 (time.h)
  - disable /etc/init.d requirement and fix %post scripts in arpwatch


author: Harald Hoyer <harald@redhat.de> 12:3.6.2-10
changelog:
  - took old purge patch for filters
  - fixed #54225,#58346
  - drop root by default #49635
  - fixed #54593
  - fixed #57711


author: Harald Hoyer <harald@redhat.com> - 14:3.8.2-1
changelog:
  - update to tcpdump-3.8.2, libpcap-0.8.2, arpwatch-2.1a13
  - patched tcpdump configure for gcc34 optimizations
  - removed obsolete patches


author: Ivana Varekova <varekova@redhat.com> - 14:3.8.2-9
changelog:
  - added arpsnmp options to specify sender and recipient
    and corrected arpwatch and arpsnmp man pages (#70386)


author: Martin Stransky <stransky@redhat.com> - 14:3.9.3-1
changelog:
  - New upstream version - 3.9.3
  - fix for #164227 (buffer overflow)
  - fix for #164230 (missing debug info)


author: Miroslav Lichvar <mlichvar@redhat.com> - 14:3.9.4-9
changelog:
  - fix processing of Prism and AVS headers (#206686)
  - fix arp2ethers script
  - update ethercodes.dat
  - move pcap man page to devel package


author: Miroslav Lichvar <mlichvar@redhat.com> - 14:3.9.7-1
changelog:
  - update to 3.9.7
  - with -C option, drop root privileges before opening first savefile (#244860)
  - update tcpslice to 1.2a3
  - include time patch from Debian to fix tcpslice on 64-bit architectures


author: Miroslav Lichvar <mlichvar@redhat.com> - 14:3.9.8-5
changelog:
  - update config.{guess,sub} when building tcpslice
  - remove -D_GNU_SOURCE from CFLAGS
  - disable libsmi check in configure


author: Miroslav Lichvar <mlichvar@redhat.com> - 14:4.0.0-1.20090818git832d2c
changelog:
  - update to post 4.0.0 git snapshot 20090818git832d2c
  - print retrans and reachable times in ICMPv6 as milliseconds (#474264)


author: Michal Sekletar <msekleta@redhat.com> - 14:4.1.1-3
changelog:
  - Fix manpage (#663739)
  - Fix improper handling of bad date format in tcpslice (#684005)
  - Spec file clean up


author: Michal Sekletar <msekleta@redhat.com> - 14:4.2.0-1
changelog:
  - updated to 4.2.0
  - added new source file ppi.h, missing in upstream tarball
  - disabled make check because of missing .pcap files in testsuite
  - dropped unnecessary patches


author: Michal Sekletar <msekleta@redhat.com> - 14:4.6.2-2
changelog:
  - fix for CVE-2014-8767 (#1165160)
  - fix for CVE-2014-8768 (#1165161)
  - fix for CVE-2014-8769 (#1165162)


author: Michal Sekletar <msekleta@redhat.com> - 14:4.7.3-1
changelog:
  - rebase to 4.7.3 (#1201573)
  - contains fixes for CVE-2015-0261 CVE-2015-2154 CVE-2015-2153 CVE-2015-2155 (#1201799,#1201792,#1201795,#1201797)


author: Hangbo Fan <fanhangbo.fhb@alibaba-inc.com> - 14:4.9.3-5.0.1
changelog:
  - Add doc sub package
  - cherry-pick `add sw patch #199f8102fc30b385b28c16494d2a683ecd265166`.(nijie@wuxiat.com)


author: Jan Macku <jamacku@redhat.com> - 6.22.03-1
changelog:
  - Update to tcsh-6.22.03
  - Drop tcsh-6.22.02-avoid-gcc-to-fail.patch                              - applied by upstream
  - Drop tcsh-6.22.02-call-seterror-consistently-and-abort-quickly.patch   - applied by upstream
  - Drop tcsh-6.22.02-avoid-crashing-when-loading-corrupted-history.patch  - applied by upstream


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-69
changelog:
  - Resolves: #1445259 - telnet won't build with latest gcc
  - added note about address resolution in manpage


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-73
changelog:
  - Resolves: #1602711 - Please review important issues found by covscan
  - Resolves: #1637085 - Option -i is missing in telnet in el8 but is available in el7


author: Than Ngo <than@redhat.com> - 9:20200327-19
changelog:
  - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 9:20200406-26.0.1
changelog:
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - anolis texlive add loongarch64(Yaxuan Liu)


author: Lukáš Zaoral <lzaoral@redhat.com> - 5.2-25
changelog:
  - Fix inconsistent --map-file option spelling in manual (rhbz#2066853)
  - Fix memory corruption in tftpd when filename remapping with macro \x
    is used (rhbz#2066862)


author: Weitao Zhou <zhouwt@linux.alibaba.com> 5.2-26.0.1
changelog:
  - Make configure an order-only prerequisite of aconfig.h.in
  - remove autoreconf in %build to fix parallel build error
  - use extern in header files when declaring global variables for compatible gcc10 build
  - Add doc sub package


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - fix to permit tftp put's (#18128).
  - startup as root with chroot to /tftpboot with early reversion to nobody
    is preferable to starting as nobody w/o ability to chroot.
  - %post is needed by server, not client. Add %postun for erasure as well.


author: Helge Deller <hdeller@redhat.de>
changelog:
  - updated tftp client to 0.17 stable (#19640),
  - drop dependency on xinetd for tftp client (#25051),


author: Helge Deller <hdeller@redhat.de>
changelog:
  - changed "wait" in xinetd file to "yes" (hpa-tftpd forks and exits) (#26467)
  - fixed hpa-tftpd to handle files greater than 32MB (#23725)
  - added "-l" flag to hpa-tftpd for file-logging (#26467)
  - added description for "-l" to the man-page


author: Helge Deller <hdeller@redhat.de> (0.17-13)
changelog:
  - updated tftp-hpa source to tftp-hpa-0.17
  - tweaked specfile with different defines for tftp-netkit and tftp-hpa version
  - use hpa's tftpd.8 man page instead of the netkits one


author: Elliot Lee <sopwith@redhat.com> 0.17-15
changelog:
  - Add patch4: netkit-tftp-0.17-defaultport.patch for bug #57562
  - Update to tftp-hpa-0.28 (bug #56131)
  - Remove include/arpa/tftp.h to fix #57259
  - Add resource limits in tftp-xinetd (#56722)


author: Martin Nagy <mnagy@redhat.com> - 0.48-1
changelog:
  - upgrade to 0.48
  - remove the old sigjmp patch (fixed in upstream)
  - make some changes in spec file (#226489)


author: Jiri Skala <jskala@redhat.com> - 0.49-7
changelog:
  - fixes #666746 - Packaging mistake: confusing %doc files patched+unpatched
  - fixes printing statistics using -v option


author: Adam Tkac <atkac redhat com> 0.0.90-0.4.20090403svn3751
changelog:
  - update to r3751
  - patches merged
    - tigervnc-xclients.patch
    - tigervnc-clipboard.patch
    - tigervnc-rh212985.patch
  - basic RandR support in Xvnc (resize of the desktop)
  - use built-in libjpeg (SSE2/MMX accelerated encoding on x86 platform)
  - use Tight encoding by default
  - use TigerVNC icons


author: Adam Tkac <atkac redhat com> 0.0.90-0.6.20090427svn3789
changelog:
  - update to r3789
    - tigervnc-rh494801.patch merged
  - tigervnc-newfbsize.patch is no longer needed
  - fix problems when vncviewer and Xvnc run on different endianess (#496653)
  - UltraVNC and TightVNC clients work fine again (#496786)


author: Adam Tkac <atkac redhat com> 0.0.90-0.10
changelog:
  - rebuild against 1.6.1.901 X server (#497835)
  - disable i18n, vncviewer is not UTF-8 compatible (#501832)


author: Adam Tkac <atkac redhat com> 0.0.91-0.11
changelog:
  - update to 0.0.91 (1.0.0 RC1)
  - patches merged
    - tigervnc10-rh499401.patch
    - tigervnc10-rh497592.patch
    - tigervnc10-rh501832.patch
  - after discusion in upstream drop tigervnc-bounds.patch
  - configure flags cleanup


author: Adam Tkac <atkac redhat com> 0.0.91-0.13
changelog:
  - temporary use F11 Xserver base to make Xvnc compilable
  - BuildRequires: libXi-devel
  - don't ship tigervnc-server-module on s390/s390x


author: Adam Tkac <atkac redhat com> 1.0.0-2
changelog:
  - update underlying X source to 1.6.4-0.3.fc11
  - remove bogus '-nohttpd' parameter from /etc/sysconfig/vncservers (#525629)
  - initscript LSB compliance fixes (#523974)
  - improve -LowColorSwitch documentation and handling (#510185)
  - honor dotWhenNoCursor option (and it's changes) every time (#524340)


author: Adam Tkac <atkac redhat com> 1.0.90-0.1.20091221svn3929
changelog:
  - update to 1.0.90 snapshot
  - patches merged
    - tigervnc10-compat.patch
    - tigervnc10-rh510185.patch
    - tigervnc10-rh524340.patch
    - tigervnc10-rh516274.patch


author: Adam Tkac <atkac redhat com> 1.0.90-0.2.20091221svn3929
changelog:
  - add patch for upstream X.Org issue #25909
  - add libXdmcp-devel to build requires to build Xvnc with XDMCP support (#552322)


author: Adam Tkac <atkac redhat com> 1.0.90-0.4.20091221svn3929
changelog:
  - mark stack as non-executable in jpeg ASM code
  - add xorg-x11-xauth to Requires
  - add support for X.Org 1.8
  - drop shave sources, they are no longer needed


author: Adam Tkac <atkac redhat com> 1.0.90-0.6.20100219svn3993
changelog:
  - add mesa-dri-drivers and xkeyboard-config to -server Requires
  - update to r3993 1.0.90 snapshot
    - tigervnc11-noexecstack.patch merged
    - tigervnc11-xorg18.patch merged
    - xserver18.patch is no longer needed


author: Adam Tkac <atkac redhat com> 1.0.90-0.9.20100219svn3993
changelog:
  - add server-applet subpackage which contains Java vncviewer applet
  - fix Java applet; it didn't work when run from web browser
  - add xorg-x11-xkb-utils to server Requires


author: Adam Tkac <atkac redhat com> 1.0.90-0.10.20100420svn4030
changelog:
  - update to r4030 snapshot
  - patches merged to upstream
    - tigervnc11-rh522369.patch
    - tigervnc11-rh551262.patch
    - tigervnc11-r4002.patch
    - tigervnc11-r4014.patch


author: Adam Tkac <atkac redhat com> 1.0.90-0.11.20100420svn4030
changelog:
  - link libvnc.so "now" to catch "undefined symbol" errors during Xorg startup
  - use always XkbConvertCase instead of XConvertCase (#580159, #586406)
  - don't link libvnc.so against libXi.la, libdix.la and libxkb.la; use symbols
    from Xorg instead


author: Adam Tkac <atkac redhat com> 1.0.90-0.14.20100420svn4030
changelog:
  - fix memory leak in Xvnc input code (#597172)
  - don't crash when receive negative encoding (#600070)
  - explicitly disable udev configuration support
  - add gettext-autopoint to BR


author: Adam Tkac <atkac redhat com> 1.0.90-0.17.20100721svn4113
changelog:
  - update to r4113
  - patches merged
    - tigervnc11-rh586406.patch
    - tigervnc11-libvnc.patch
    - tigervnc11-rh597172.patch
    - tigervnc11-rh600070.patch
    - tigervnc11-options.patch
  - don't own %{_datadir}/icons directory (#614301)
  - minor improvements in the .desktop file (#616340)
  - bundled libjpeg configure requires nasm; is executed even if system-wide
    libjpeg is used


author: Adam Tkac <atkac redhat com> 1.0.90-0.19.20100813svn4123
changelog:
  - separate Xvnc, vncpasswd and vncconfig to -server-minimal subpkg (#626946)
  - move license to separate subpkg and Requires it from main subpkgs
  - Xvnc: handle situations when no modifiers exist well (#611677)


author: Adam Tkac <atkac redhat com> 1.0.90-0.20.20100813svn4123
changelog:
  - press fake modifiers correctly (#633931)
  - supress unneeded debug information emitted from initscript (#633645)


author: Adam Tkac <atkac redhat com> 1.0.90-0.24.20100813svn4123
changelog:
  - rebuild against xserver 1.10.X
  - 0001-Return-Success-from-generate_modkeymap-when-max_keys.patch merged


author: Adam Tkac <atkac redhat com> 1.0.90-0.25.20101208svn4225
changelog:
  - update to r4225
  - patches merged
    - tigervnc11-rh611677.patch
    - tigervnc11-rh633931.patch
    - tigervnc11-xorg1.10.patch
  - enable VeNCrypt and PAM support


author: Adam Tkac <atkac redhat com> - 1.0.90-3
changelog:
  - fix wrong usage of memcpy which caused screen artifacts (#652590)
  - don't point to inaccessible link in sysconfig/vncservers (#644975)


author: Adam Tkac <atkac redhat com> - 1.1.0-1
changelog:
  - update to 1.1.0
  - update the xorg11 patch
  - patches merged
    - tigervnc11-glx.patch
    - tigervnc11-CVE-2011-1775.patch
    - 0001-Use-memmove-instead-of-memcpy-in-fbblt.c-when-memory.patch


author: Adam Tkac <atkac redhat com> - 1.1.0-3
changelog:
  - don't build X.Org devel docs (#755782)
  - applet: BR generic java-devel instead of java-gcj-devel (#755783)
  - use runuser to start Xvnc in systemd service file (#754259)
  - don't attepmt to restart Xvnc session during update/erase (#753216)


author: Adam Tkac <atkac redhat com> - 1.1.0-5
changelog:
  - clean Xvnc's /tmp environment in service file before startup
  - fix building against the latest JAVA 7 and X.Org 1.12


author: Adam Tkac <atkac redhat com> 1.2.80-0.1.20120905svn4996
changelog:
  - update to 1.2.80
  - remove deprecated patches
    - tigervnc-102434.patch
    - tigervnc-viewer-reparent.patch
    - tigervnc11-java7.patch
  - patches merged
    - tigervnc11-xorg111.patch
    - tigervnc11-xorg112.patch


author: Adam Tkac <atkac redhat com> - 1.2.80-0.12.20130314svn5065
changelog:
  - include /etc/X11/xorg.conf.d/10-libvnc.conf sample configuration (#712482)
  - vncserver now honors specified -geometry parameter (#755947)


author: Tim Waugh <twaugh@redhat.com> 1.2.80-0.14.20130314svn5065
changelog:
  - Use systemd rpm macros (bug #850340).  Moved systemd requirements
    from main package to server sub-package.
  - Applied Debian patch to fix busy loop when run from inetd in nowait
    mode (bug #920373).
  - Added dependency on xorg-x11-xinit to server sub-package so that
    default window manager can be found (bug #896284, bug #923655).
  - Fixed bogus changelog date.


author: Tim Waugh <twaugh@redhat.com> 1.3.0-3
changelog:
  - Avoid PIDFile problems in systemd unit file (bug #983232).
  - libvnc.so: don't use unexported key_is_down function.
  - Don't use shebang in vncserver script.


author: Tim Waugh <twaugh@redhat.com> 1.3.0-15
changelog:
  - Disable dri3 to enable building (bug #1063392).
  - Fixed heap-based buffer overflow (CVE-2014-0011, bug #1050928).


author: Tim Waugh <twaugh@redhat.com> - 1.3.1-8
changelog:
  - Input reset fixes from upstream (bug #1116956).
  - No longer need ppc64le patch as it's now in xorg-x11-server.
  - Rebased xserver114.patch again.


author: Tim Waugh <twaugh@redhat.com> - 1.4.2-1
changelog:
  - Rebased xserver116.patch against xorg-x11-server-1.17.1.
  - Allow build against xorg-x11-server-1.17.
  - 1.4.2.


author: Jan Grulich <jgrulich@redhat.com> - 1.6.0-4
changelog:
  - Utilize system-wide crypto policies
    Resolves: bz#1179345
  - Try to disable patch4 as it was previously written to support an
    older version of a different client and breaks some other usage
    Resolves: bz#1280440


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-3
changelog:
  - Bug 1438704 - CVE-2017-7392 CVE-2017-7393 CVE-2017-7394
                  CVE-2017-7395 CVE-2017-7396 tigervnc: various flaws
    + other upstream related fixes


author: Jan Grulich <jgrulich@redhat.com> - 1.9.0-7
changelog:
  - Improve coverity scan fixes
    Resolves: bz#1602714

    Inform whether view-only password is used or not
    Resolves: bz#1639169

    Backport fixes from RHEL 7
    Resolves: bz#1651254


author: Jan Grulich <jgrulich@redhat.com> - 1.10.1-5
changelog:
  - Install the HOWTO file to correct location
  - Add /usr/bin/vncserver file informing users to read the HOWTO.md file
    Resolves: bz#1790443


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-1
changelog:
  - Update to 1.11.0
    Resolves: bz#1880985
  - Backport fix to allow Tigervnc use boolean values in config files
    Resolves: bz#1883415


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-2
changelog:
  - Revert removal of vncserver
    Resolves: bz#1897504
  - Correctly start vncsession as a daemon
    Resolves: bz#1897498


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-4
changelog:
  - Added vncsession-restore script for SELinux policy migration
    Fix SELinux context for root user
    Resolves: bz#2021892


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-1
changelog:
  - 1.13.1
    Resolves: bz#2175748
  - Restore "--fallbacktofreeport" option in the vncserver script
    Resolves: bz#2174398


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege
    Escalation Vulnerability
    Resolves: bz#2180306


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-4
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
    Resolves: RHEL-15236

  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15230


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-5
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18410
  - Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18422


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-7
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20388
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20382
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20530
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21214


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-9
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-30755
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30767
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-10
changelog:
  - Drop patches that are already part of xorg-x11-server
    Resolves: RHEL-30755
    Resolves: RHEL-30767
    Resolves: RHEL-30761


author: Kaiqiang Wang <wangkaiqiang@inspur.com> - 1.13.1-10.0.1
changelog:
  - Fic CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer


author: Jan Grulich <jgrulich@redhat.com>
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-61999


author: Justin Stephenson <jstephen@redhat.com> - 7-1
changelog:
  - Release v7
  - Allow tlog-play redirection of stdout
  - Add -i/--interactive option to tlog-rec-session. Allows login
    programs to call tlog-rec-session more transparently.
  - Make in_txt/out_txt fields optional. This handles missing fields
    when reading from Elasticsearch or other backends.


author: Justin Stephenson <jstephen@redhat.com> - 8-1
changelog:
  - Release v8
  - Spec file fixes for EL6
  - Spec file improvements for Debian/Ubuntu pkg-config
  - Tlog-play improve authentication options
  - Handle piped in I/O from stdin and improve the main recording transfer exit
    condition.
  - Use empty string on hostname resolution failure


author: Justin Stephenson <jstephen@redhat.com> - 9-1
changelog:
  - Release v9
  - Add libutempter support
  - Require journal match filter
  - Add file reader match functionality
  - Restore cursor visibility and color attributes on tlog-play exit
  - Add "time" real clock timestamp message field
  - Various upstream CI improvements


author: Justin Stephenson <jstephen@redhat.com> - 11-1
changelog:
  - Fire SIGCHLD after utempter_add_record since it probably eats it.
  - Correct suse rpmbuild
  - Update debbuild for travis CI


author: Justin Stephenson <jstephen@redhat.com> - 12-1
changelog:
  - Release v12
  - Prevent infinite transfer loop on GDM login.
  - tlog-play: add journal namespace support.
  - tlitest: extend delay for limit-action delay test.


author: Justin Stephenson <jstephen@redhat.com> - 12.1
changelog:
  - Exit transfer loop when output fd is closed
  - Revert "Prevent infinite transfer loop on GDM login"


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 1-1
changelog:
  - Release v1. Not ready for production. Following features are included.
  - Recording of user input, program output and window size changes.
  - Support for writing into syslog and files.
  - Tlog-rec configuration through system-wide configuration file
    /etc/tlog/tlog-rec.conf, environment variables and command line.
  - Very basic playback directly from ElasticSearch.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2-1
changelog:
  - Release v2. Not ready for production. Following features are added.
  - Fully-fledged command-line interface to tlog-play, along with config file
    and man pages.
  - Support for playback from file in tlog-play.
  - Make tlog-play follow mode controllable and off by default.
  - Get tlog-rec shell also from TLOG_REC_SHELL environment variable.
  - Support non-TTY stdin/stdout in tlog-rec, allowing its use with
    non-interactive SSH sessions.
  - Support building on and packaging for EPEL5.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3-1
changelog:
  - Release v3. Added features and implemented fixes follow.
  - Make each JSON message timing data start with window size.
    This makes it possible to pick up the stream from any message and also
    combine messages, with window size known and preserved at all times.
  - Add "term" field to JSON messages, specifying terminal type.
  - Add "ver" field to JSON messages, specifying message format version.
  - Set "SHELL" environment variable to actual user shell in tlog-rec.
  - Check for locale's charset and abort tlog-rec if it's anything but the only
    supported UTF-8.
  - Add -v/--version option support to tlog-rec and tlog-play.
  - Fix tlog-rec and tlog-play error output by accumulating error messages and
    outputting them only after terminal settings are restored, on exit. Output
    startup warnings before switching to raw terminal settings.
  - Output a newline after restoring terminal settings in tlog-rec and
    tlog-play, so that following output is not stuck to the end of the last line
    of the raw output.
  - Add an Elasticsearch mapping to documentation directory.
  - Disable input logging by default to avoid storing passwords. Please enable
    it explicitly in configuration, or on the command line, if necessary.
  - Close log file written by tlog-rec on executing the shell in the child to
    prevent log modification by the recorded user.
  - Support running tlog-rec SUID/SGID to prevent recorded users from killing or
    modifying it. Make tlog-rec SUID/SGID to user "tlog" in the RPM package.
  - Add session locking to tlog-rec. This prevents tlog-rec from recording if
    the audit session is already recorded by creating per-audit-session lock
    files in /var/run/tlog. This only makes sense with tlog-rec SUID/SGID.
    When certain failures occur while creating a lock file, session is assumed
    unlocked and is recorded anyway, as it is safer to record a session than
    not. Add corresponding setup to the RPM package.
  - Reproduce the recorded program (shell) exit status in tlog-rec similarly to
    how Bash reproduces the last executed command status.
  - Update and expand README.md to describe secure log message filtering with
    rsyslog, and playback directly from Elasticsearch, among other, smaller
    additions.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 4-1
changelog:
  - Release v4. Added features and implemented fixes follow. See README.md and
    manpages for documentation of new features.
  - Extract user session recording functionality from tlog-rec into a new tool:
    tlog-rec-session. It should be used as the user's login shell now, and
    tlog-rec should be used as a general recording and testing tool.
  - Add (optional) support for writing to and reading from Systemd Journal - the
    "journal" reader and writer.
  - Make tlog-rec default to "file" writer, and tlog-rec-session to "journal",
    if built with Journal support, and to "syslog" otherwise.
  - Add "-o" option to tlog-rec as an alias to "--file-path".
  - Add "-i" option to tlog-play as an alias to "--file-path".
  - Assume locale charset is UTF-8, if ASCII charset is detected, since that is
    a likely indication the locale settings were lost. E.g. upon console login
    or "su -" on Fedora and RHEL.
  - Switch the "ver" JSON field type to string. Now it should be two numbers
    separated by a dot. The increase of the first number indicates
    forward-incompatible changes, the increase of the second number -
    forward-compatible. If the dot and the second number are omitted, the second
    number is considered to be zero. Bump the format version to "2".
  - Add a new JSON field: "rec", containing an opaque host-unique recording ID.
    Bump the format version to "2.1".
  - Add support for playback controls, both through the command line and via
    playback-time control keys, including: speed adjustment, pause/resume,
    fast-forward to a time, and packet-by-packet stepping through the recording.
  - Add optional rate-limiting of logged messages. Both throttling and dropping
    messages are supported.
  - Add "--lax" option to tlog-play to allow playing back recordings with
    missing messages.
  - Fix input being ignored when there is a lot of output, while recording.
  - Remove addition of tlog-rec (tlog-rec-session) to /etc/shells from RPM
    packaging to prevent users from changing their shells themselves once it has
    been assigned.
  - Add support for specifying the shell to start via the tlog-rec-session
    executable name. E.g. by making a tlog-rec-session-shell-zsh ->
    tlog-rec-session symlink and executing it. That can be used to specify
    particular shells to be recorded for specific users by assigning these
    symlinks as their login shells.
  - Make error messages from all the tools a bit less noisy and more readable.


author: Kirill Glebov <kgliebov@redhat.com> - 5-1
changelog:
  - Release v5. Added features and implemented fixes follow. See README.md and
    manpages for documentation of new features.
  - Implement support for --configuration option for all programs.
    The option makes the program output its configuration in JSON and then
    exit.
  - Add BuildDependencies to allow yum-builddep.
  - Open JSON writer file with euid/egid. To allow creating protected log files
    with tlog-rec-session, open the JSON writer's file with the EUID and
    GUID the program was started with.
  - Installing Packages with the APT Addon instead of apt-get.
  - Switch to using TLOG_ERRS_RAISE macros.
  - Fix tlog-play cleanup-path segfault.
  - Modify command-line option parsing.
  - Remove "fields" field from ES query URL to fix compatibility with
    Elasticsearch 5.
  - Remove unused _source parameter from ES query URL.
  - Fix tlog-rec-session file permissions bug.
  - Use CLOCK_MONOTONIC for rate-limiting writing.
  - Filter out some more input control sequences.


author: Justin Stephenson <jstephen@redhat.com> - 6-1
changelog:
  - Release v6. Added features and implemented fixes follow. See README.md and
    manpages for documentation of new features.
  - Add integration tests for end-to-end test coverage.
  - Fix compiler type comparison error with json-c json_object_array_length
    return value.
  - Fix a distribution issue causing incorrect M4_CONF_PATH expansion.
  - Log more detailed error when systemd journal is not present.


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-3
changelog:
  - Rebuild for CVE-2022-41723, CVE-2023-24534, CVE-2023-24536 and
    CVE-2023-24538
  Resolves: #2187345, #2187368, #2203690


author: Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-1
changelog:
  - Update to 0.0.99.2
  - Make 'toolbox' create or fall back to a container if possible
  Resolves: #1914687
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-2
changelog:
  - Actually apply the patch to make 'toolbox' create or fall back to a
    container if possible
  - Support logging into a registry if necessary
  - Related: #1934415


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-2
changelog:
  - Update to 0.0.99.3
  - BuildRequire only systemd-rpm-macros as recommended by the Fedora packaging
    guidelines
  - Update the Summary to match upstream
  - Update the URL to point to the website
  Resolves: #2047290


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-7
changelog:
  - Rebuild for CVE-2023-29406, CVE-2023-39318 and CVE-2023-39319
  Resolves: RHEL-4231, RHEL-4475, RHEL-4502


author: Honggang Li <honli@redhat.com> - 4.2.10-25
changelog:
  - Rebase to latest Fedora release
  - Fix file conflicts in torque-devel multilib packages
  - Resolve: bz1853167


author: Kalev Lember <klember@redhat.com> - 3.38.2-2
changelog:
  - Use conflicts for totem-video-thumbnailer split instead of self-obsoletes
  - Resolves: rhbz#1949422


author: Wim Taymans <wtaymans@redhat.com> - 0.3.13-12
changelog:
  - Add explicit Requires for the -libs package.
  - Do NVR bump to move twolame-devel from buildroot to CRB
  - Resolves: rhbz#1843275


author: Nils Philippsen <nils@redhat.com> - 1.2.1-3
changelog:
  - drop requirements on cmake, pkgconfig and rather own the directories for the
    files augmenting these packages


author: Andreas Schneider <asn@redhat.com> - 1.2.2-1
changelog:
  - Update to version 1.2.2:
    * Added support for fork'ed and then exec'ed processes
    * Added support for Alpha


author: Andreas Schneider <asn@redhat.com> - 1.2.4-1
changelog:
  - Update to version 1.2.4
    * Added deadlock workaround for glibc < 2.24
    * Fixed a possible deadlock bug if uid_wrapper is turned off
    * Logging is always turned on now
    * Fixed a memory leak
    * Limited number of groups during fork+exec


author: Daniel Kopecek <dkopecek@redhat.com> 0.3-1
changelog:
  - Update to version 0.3
  - disabled silent rules
  - install license file
  - added man pages
  - use _hardened_build 1 instead of custom compilation flags
  - fix file permissions on files in /etc
  - do not install an empty rule set file


author: Daniel Kopecek <dkopecek@redhat.com> 0.3p3-1
changelog:
  - Update to version 0.3p3
  - added %check section
  - removed explicit -devel requires on systemd, libqb and
    libsodium devel files
  - added -devel requires on libstdc++-devel


author: Daniel Kopecek <dkopecek@redhat.com> 0.4-4
changelog:
  - Update to version 0.4
  - added usbguard CLI
  - added a tools subpackage with usbguard-rule-parser binary


author: Daniel Kopeček <dkopecek@redhat.com> 0.6.3-0.1.20170317
changelog:
  - Update to latest git snapshot
  - Use --enable-werror configure option as the upstream default
    changed to not use -Werror.


author: Daniel Kopeček <dkopecek@redhat.com> 0.7.0-1
changelog:
  - Update to 0.7.0
    - changed PresentDevicePolicy setting from keep to apply-policy
    - added AuditFilePath configuration option pointing to
      /var/log/usbguard/usbguard-audit.log file
    - install bash-completion script
    - use 0600 file permissions for usbguard-daemon.conf and rules.conf


author: Daniel Kopeček <dkopecek@redhat.com> 0.7.0-4
changelog:
  - Added patch to disable unused parameter warning for protobuf
    generated sources to fix compilation with newer protobuf version


author: Daniel Kopeček <dkopecek@redhat.com> - 0.7.2-1
changelog:
  - Update to 0.7.2
  - Don't use --enable-werror downstream
  - Removed patches related to compiler warnings


author: Attila Lakatos <alakatos@redhat.com> - 0.7.8-4
changelog:
  - RHEL 8.3.0 ERRATUM
  - Spec file clean up
  - Rebase to 0.7.8
  Resolves: rhbz#1738590
  - Added selinux subpackage
  Resolves: rhbz#1683567
  - Added notifier subpackage
  - Installing /etc/usbguard/rules.d/
  Resolves: rhbz#1667395
  - Fixed sigwaitinfo handling
  Resolves: rhbz#1835210


author: Radovan Sroka <rsroka@redhat.com> - 0.7.8-5
changelog:
  - RHEL 8.3.0 ERRATUM
  - Use old-fasioned forking style in unit file
  Resolves: rhbz#1846885
  - Allow usbguard to read /proc/cpuinfo
  Resolves: rhbz#1847870
  - Removed notifier's Requires for usbguard-devel
  Resolves: rhbz#1667395
  - Allow usbguard to read /dev/urandom
  Resolves: rhbz#1848618


author: Radovan Sroka <rsroka@redhat.com> - 0.7.8-6
changelog:
  - RHEL 8.3.0 ERRATUM
  - Removed execstack from .spec
  - Removed AuthorizedDefault=wired from the usbguard
  Resolves: rhbz#1852539
  - Missing error message on bad configuration
  Resolves: rhbz#1857299
  - /etc/usbguard/usbguard-daemon.conf file does not contain all default options
  Resolves: rhbz#1862907


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-1
changelog:
  - Rebase to 1.0.0
  Resolves: rhbz#1887448
  - Filtering rules by attribute
  Resolves: rhbz#1873953
  - Change device policy of multiple devices using rule instead of ID
  Resolves: rhbz#1852568


author: Zoltan Fridrich <zfridric@redhat.com> - 1.0.0-8
changelog:
  - change usbguard icon injection
  - fix DSP module definition in spec file
  Resolves: rhbz#2014441
  - add execstack to spec
  - remove IPAddressDeny from usbguard service
  Resolves: rhbz#1929364
  - fix file conflict when installing usbguard on rhel
  Resolves: rhbz#1963271
  - fix IPC access control files override
  Resolves: rhbz#2004511
  - validate ACL permission existence
  Resolves: rhbz#2005020
  - decrease usbguard-notifier spam when denied connection
  Resolves: rhbz#2000000


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-10
changelog:
  - Fix unauthorized access via D-bus
  - Fix memory leaks on connection failure to D-bus
  Resolves: rhbz#2059067


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-13
changelog:
  - Set OOMScoreAdjust to -1000 in service file
  Resolves: rhbz#2159411
  - Fix race condition in usbguard-daemon when forking
  Resolves: rhbz#2159409
  - Add missing files to documentation
  Resolves: rhbz#2159412
  - Disable logging to console, logging to syslog is still enabled
  - Store permanent rules even if RuleFile is not set but RuleFolder is
  - Neither RuleFolder nor RuleFile exists bugfix
  Resolves: rhbz#2159413
  - Remove build for i686 arch
  Resolves: rhbz#2105091


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-8.2
changelog:
  - Fix unauthorized access via D-bus
  - Fix memory leak on D-bus connection failure
  Resolves: rhbz#2127848


author: Victor Toso <victortoso@redhat.com> - 0.13.0-1
changelog:
  - Rebase to latest upstream: 0.13.0
  - Keeps usbredirserver binary (removed upstream)
    Related: rhbz#2135760


author: Victor Toso <victortoso@redhat.com> - 0.13.0-2
changelog:
  - Fixes 100% CPU usage when usbredirect used as TCP server
    Related: rhbz#2157520
  - Fixes USB redirection of identical devices
    Resolves: rhbz#2157520


author: Mark Wielaard <mjw@redhat.com> - 3.18.1-5
changelog:
  - Add valgrind-3.18.1-dhat-tests-copy.patch
  - Add valgrind-3.18.1-s390x-EXRL.patch
  - Add valgrind-3.18.1-ppc64-lxsibzx-lxsihzx.patch
  - Add valgrind-3.18.1-ppc-pstq.patch
  - Add valgrind-3.18.1-ppc-pstq-tests.patch
  - Add valgrind-3.18.1-gdbserver_tests-hwcap.patch
  - Add valgrind-3.18.1-rust-v0-demangle.patch
  - Add valgrind-3.18.1-arm64-doubleword-cas.patch
  - Add valgrind-3.18.1-arm64-ldaxp-stlxp.patch
  - Add valgrind-3.18.1-arm64-atomic-align.patch
  - Add valgrind-3.18.1-amd64-more-spec-rules.patch
  - Add valgrind-3.18.1-condvar.patch
  - Add valgrind-3.18.1-demangle-namespace.patch


author: Mark Wielaard <mjw@redhat.com> - 3.21.0-2
changelog:
  - Upgrade to upstream 3.21.0
  - Remove upstreamed patches
  - Add valgrind-3.21.0-no-memcpy-replace-check.patch


author: Mark Wielaard <mjw@redhat.com> - 3.21.0-7
changelog:
  - Add valgrind-3.21.0-callgrind_control-no-strict.patch
  - Add valgrind-3.21.0-realloc-again.patch
  - Update valgrind-3.21.0-no-memcpy-replace-check.patch (memcpy_chk)
  - Add valgrind-3.21.0-vgm.patch and valgrind-3.21.0-vgm-tests.patch
  - Add valgrind-3.21.0-pgste.patch


author: Binbin Zhou <zhoubinbin@loongson.cn> - 3.21.0-8
changelog:
  - Add valgrind-3.21.0-Add-LoongArch64-Linux-support.patch
  - Add valgrind-3.21.0-LoongArch64-Sync-kernel-4.19.patch


author: Jeff Johnson <jbj@redhat.com> 1.9.3-4.20030207
changelog:
  - move _pthread_desc to vg_include.h.
  - implement pthread_mutex_timedlock().
  - implement pthread_barrier_wait().


author: Graydon Hoare <graydon@redhat.com> 1.9.3-5.20030207
changelog:
  - add handling for separate debug info (+fix).
  - handle blocking readv/writev correctly.
  - comment out 4 overly zealous pthread checks.


author: Jeff Johnson <jbj@redhat.com> 1.9.4-0.20030228
changelog:
  - update to 1.9.4 from CVS.
  - dwarf patch from Graydon Hoare.
  - sysinfo patch from Graydon Hoare, take 1.


author: Jakub Jelinek <jakub@redhat.com> 2.1.2-1
changelog:
  - update to 2.1.2
  - run make regtest as part of package build
  - use glibc-2.3 suppressions instead of glibc-2.2 suppressions


author: Jakub Jelinek <jakub@redhat.com> 2.2.0-6
changelog:
  - act as if NVALGRIND is defined when using <valgrind.h>
    in non-m32/i386 programs (#138923)
  - remove weak from VALGRIND_PRINTF*, make it static and
    add unused attribute


author: Colin Walters <walters@redhat.com> 2.4.0-1
changelog:
  - New upstream version 
  - Update valgrind-2.2.0-regtest.patch to 2.4.0; required minor
    massaging
  - Disable valgrind-2.1.2-4G.patch for now; Not going to touch this,
    and Fedora does not ship 4G kernel by default anymore
  - Remove upstreamed valgrind-2.2.0.ioctls.patch
  - Remove obsolete valgrind-2.2.0-warnings.patch; Code is no longer
    present
  - Remove upstreamed valgrind-2.2.0-valgrind_h.patch
  - Remove obsolete valgrind-2.2.0-unnest.patch and
    valgrind-2.0.0-pthread-stacksize.patch; valgrind no longer
    includes its own pthread library


author: Jakub Jelinek <jakub@redhat.com> 2.4.0-2
changelog:
  - resurrect the non-upstreamed part of valgrind_h patch
  - remove 2.1.2-4G patch, seems to be upstreamed
  - resurrect passing -fno-builtin in memcheck tests


author: Jakub Jelinek <jakub@redhat.com> 2.4.0-3
changelog:
  - build some insn tests with -mmmx, -msse or -msse2 (#161572)
  - handle glibc-2.3.90 the same way as 2.3.[0-5]


author: Jakub Jelinek <jakub@redhat.com> 3.0.0-1
changelog:
  - upgrade to 3.0.0
    - x86_64 support
  - temporarily obsolete valgrind-callgrind, as it has not been
    ported yet


author: Jakub Jelinek <jakub@redhat.com> 3.0.0-2
changelog:
  - lower x86_64 stage2 base from 112TB down to 450GB, so that
    valgrind works even on 2.4.x kernels.  Still way better than
    1.75GB that stock valgrind allows


author: Jakub Jelinek <jakub@redhat.com> 3.0.0-3
changelog:
  - fix amd64 handling of cwtd instruction
  - fix amd64 handling of e.g. sarb $0x4,val(%rip)
  - speedup amd64 insn decoding


author: Jakub Jelinek <jakub@redhat.com> 3.1.0-2
changelog:
  - add support for DW_CFA_val_offset{,_sf}, DW_CFA_def_cfa_sf
    and skip over DW_CFA_val_expression quietly
  - adjust libc/ld.so filenames in glibc-2.4.supp for glibc 2.4
    release


author: Jakub Jelinek <jakub@redhat.com> 3.1.1-3
changelog:
  - handle [sg]et_robust_list syscalls on i?86/x86_64
  - handle *at syscalls on ppc
  - ensure on x86_64 both 32-bit and 64-bit glibc{,-devel} are
    installed in the buildroot (#191820)


author: Jakub Jelinek <jakub@redhat.com> 3.2.1-1
changelog:
  - update to 3.2.1 bugfix release
    - SSE3 emulation fixes, reduce memcheck false positive rate,
      4 dozens of bugfixes


author: Jakub Jelinek <jakub@redhat.com> 3.2.3-3
changelog:
  - add suppressions for glibc >= 2.6
  - avoid valgrind internal error if io_destroy syscall is
    passed a bogus argument


author: Jakub Jelinek <jakub@redhat.com> 3.2.3-5
changelog:
  - add ppc64-linux symlink in valgrind ppc.rpm, so that when
    rpm prefers 32-bit binaries over 64-bit ones 32-bit
    /usr/bin/valgrind can find 64-bit valgrind helper binaries
    (#249773)
  - power5+ and power6 support (#240762)


author: Jakub Jelinek <jakub@redhat.com> 3.2.3-6
changelog:
  - handle new x86_64 nops (#256801, KDE#148447)
  - add support for private futexes (KDE#146781)
  - update License tag


author: Jakub Jelinek <jakub@redhat.com> 3.5.0-2
changelog:
  - add STT_GNU_IFUNC support (Dodji Seketeli, #518247)
  - wrap inotify_init1 syscall (Dodji Seketeli, #527198)
  - fix mmap/mprotect handling in memcheck (KDE#210268)


author: Jakub Jelinek <jakub@redhat.com> 3.5.0-3
changelog:
  - handle many more DW_OP_* ops that GCC now uses
  - handle the more compact form of DW_AT_data_member_location
  - don't strip .debug_loc etc. from valgrind binaries


author: Jakub Jelinek <jakub@redhat.com> 3.5.0-4
changelog:
  - handle reading of .debug_frame in addition to .eh_frame
  - ignore unknown DWARF3 expressions in evaluate_trivial_GX
  - suppress helgrind race errors in helgrind's own mythread_wrapper
  - fix compilation of x86 tests on x86_64 and ppc tests


author: Jakub Jelinek <jakub@redhat.com> 3.5.0-7
changelog:
  - add perf_counter_open syscall support (#531271)
  - add handling of some sbb/adc insn forms on x86_64 (KDE#211410)


author: Jakub Jelinek <jakub@redhat.com> 3.5.0-10
changelog:
  - add handling of a bunch of recent syscalls and fix some
    other syscall wrappers (Dodji Seketeli)
  - handle prelink created split of .bss into .dynbss and .bss
    and similarly for .sbss and .sdynbss (#539874)


author: Jakub Jelinek <jakub@redhat.com> 3.5.0-15
changelog:
  - handle i686 nopw insns with more than one data16 prefix (#574889)
  - DWARF4 support
  - handle getcpu and splice syscalls


author: Jakub Jelinek <jakub@redhat.com> 3.5.0-16
changelog:
  - change pub_tool_basics.h not to include config.h (#579283)
  - add valgrind-openmpi package for OpenMPI support (#565541)
  - allow NULL second argument to capget (#450976)


author: Jakub Jelinek <jakub@redhat.com> 3.6.0-1
changelog:
  - update to 3.6.0
  - add s390x support (#632354)
  - provide a replacement for str{,n}casecmp{,_l} (#626470)


author: Jakub Jelinek <jakub@redhat.com> 3.6.0-2
changelog:
  - rebuilt against glibc 2.13 (#673046)
  - hook in pwrite64 syscall on ppc64 (#672858)
  - fix PIE handling on ppc/ppc64 (#665289)


author: Jakub Jelinek <jakub@redhat.com> 3.6.1-2
changelog:
  - fix build on ppc64 (#711608)
  - don't fail if s390x support patch hasn't been applied,
    move testing into %check (#708522)
  - rebuilt against glibc 2.14


author: Jakub Jelinek <jakub@redhat.com> 3.7.0-1
changelog:
  - update to 3.7.0 (#769213, #782910, #772343)
  - handle some further SCSI ioctls (#783936)
  - handle fcntl F_SETOWN_EX and F_GETOWN_EX (#770746)


author: Jakub Jelinek <jakub@redhat.com> 3.7.0-4
changelog:
  - adjust suppressions so that it works even with ld-2.15.so (#806854)
  - handle DW_TAG_unspecified_type and DW_TAG_rvalue_reference_type
    (#810284, KDE#278313)
  - handle .debug_types sections (#810286, KDE#284124)


