# changelog

author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-4
changelog:
  - Decrease priority of sssd-libwbclient 20 -> 5
  - It should be lower than priority of samba veriosn of libwbclient.
  - https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-6
changelog:
  - Fix double free in monitor
  - Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
                          sssd killed by SIGABRT


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-2
changelog:
  - Add support for python3 bindings
  - Add requirement to python3 or python3 bindings
  - Resolves: rhbz#1014594 - sssd: Support Python 3


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-5
changelog:
  - Fix regressions with ipa and SELinux
  - Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
                               context on client is staff_u


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-6
changelog:
  - Fix slow login with ipa and SELinux
  - Resolves: upstream #2624 - Only set the selinux context if the context
                               differs from the local one


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-8
changelog:
  - Backport important patches from upstream 1.13 prerelease
  - Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
                             attribute for group name
  - Resolves: upstream #2335 - Investigate using the krb5 responder
                               for driving the PAM conversation with OTPs
  - Enable cmocka tests for secondary architectures


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-4
changelog:
  - Fix ipa-migration bug
  - Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
                               migration mode


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-6
changelog:
  - Fix OTP bug
  - Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
                               entered separately


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-2
changelog:
  - Fix few segfaults
  - Resolves: upstream #2811 - PAM responder crashed if user was not set
  - Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-3
changelog:
  - python-sssdconfig: Fix parssing sssd.conf without config_file_version
  - Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-5
changelog:
  - Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
                             groups during getgrnam and getgrgid
  - Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
                             in call to 'print'


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-6
changelog:
  - Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
                             prompts (e.g. Password + Token)
  - Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
                             by remote host" if locale not available


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.4-3
changelog:
  - Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
                             sssd_ifp killed by SIGSEGV


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-2
changelog:
  - Backport important patches from upstream 1.14.2 prerelease
  - Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
                               boot
  - Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-3
changelog:
  - Fix regression with krb5_map_user
  - Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
  - Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
                             default if nonexistent domain is mentioned


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.2-2
changelog:
  - Resolves: rhbz#1369130 - nss_sss should not link against libpthread
  - Resolves: rhbz#1392916 - sssd failes to start after update
  - Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
                             on the directory /etc/sssd


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.0-4
changelog:
  - Cherry-pick patches from upstream that enable the files provider
  - Enable the files domain
  - Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
    which is superseded by the files domain autoconfiguration
  - Related: rhbz#1357418 - SSSD fast cache for local users


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.2
changelog:
  - Fix issue with IPA + SELinux in containers
  - Resolves: upstream https://fedorahosted.org/sssd/ticket/3297


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.3
changelog:
  - Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
  - Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
                             file from package sssd-common-1.15.1-1.fc25.x86_64
  - Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-4
changelog:
  - Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
                             access on the sock_file system_bus_socket
  - Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
                             fails to download desktop profile data
  - Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
  - Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
                              after applying ID Views for them in IPA server
  - Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
                              mapping is applied


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-5
changelog:
  - Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database access on
                             the sock_file system_bus_socket


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.16.0-5
changelog:
  - Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
                              setnetgrent_result_timeout
  - Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
                              or machine swaps
  - Resolves: failure in glibc tests
              https://sourceware.org/bugzilla/show_bug.cgi?id=22530
  - Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
                              auth_provider ldap, login fails if the LDAP server
                              is not allowing anonymous binds
  - Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
                              corrected with AD
  - Resolves: upstream#3586 - Give a more detailed debug and system-log message
                              if krb5_init_context() failed
  - Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
                             in /etc/systemd/system
  - Backport few upstream features from 1.16.1


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.0-12
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Resolves: upstream#3621 - FleetCommander integration must not require
                              capability DAC_OVERRIDE


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-2
changelog:
  - Resolves: upstream#3573 - sssd won't show netgroups with blank domain
  - Resolves: upstream#3660 - confdb_expand_app_domains() always fails
  - Resolves: upstream#3658 - Application domain is not interpreted correctly
  - Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
                              json_loads()
  - Resolves: upstream#3386 - KCM: Payload buffer is too small
  - Resolves: upstream#3666 - Fix usage of str.decode() in our tests
  - A few KCM misc fixes


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-3
changelog:
  - Resolves: upstream#3684 - A group is not updated if its member is removed
                              with the cleanup task, but the group does not
                              change
  - Resolves: upstream#3558 - sudo: report error when two rules share cn
  - Tone down shutdown messages for socket activated responders
  - IPA: Qualify the externalUser sudo attribute
  - Resolves: upstream#3550 - refresh_expired_interval does not work with
                              netgrous in 1.15
  - Resolves: upstream#3402 - Support alternative sources for the files provider
  - Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
  - Resolves: upstream#3679 - Make nss netgroup requests more robust
  - Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
                              configured
  - Resolves: upstream#3469 - extend sss-certmap man page regarding priority
                              processing
  - Improve docs/debug message about GC detection
  - Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
                              list out of bound?
  - Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
                              set.
  - Document which principal does the AD provider use
  - Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
                              defined, but contains no SIDs
  - Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
  - Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
                             Provider returned an error
                             [org.freedesktop.sssd.Error.DataProvider.Fatal]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-1
changelog:
  - Update to 1.16.2 release
  - Cleanup unused global definitions
  - Remove python2 references from the spec file
  - Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-2
changelog:
  - Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
                             fails with the KCM ccache


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-4
changelog:
  - Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                             users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-7
changelog:
  - Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
                             differs from the default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-8
changelog:
  - Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
                              /usr/libexec/sssd/sssd_be killed by 11 crash
                              func _dbus_list_unlink


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-9
changelog:
  - Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
                             commands in man pages since local provider
                             is deprecated


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-10
changelog:
  - Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
                             started due to a misconfiguration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-11
changelog:
  - Resolves: rhbz#1628122 - Printing incorrect information about domain
                             with sssctl utility


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-16
changelog:
  - Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
                            PKCS#11 URI


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-17
changelog:
  - Related: rhbz#1637131 - pam_unix unable to match fully qualified username
                            provided by sssd during smartcard auth using gdm


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-18
changelog:
  - Related: rhbz#1638006 - Files: The files provider always enumerates
                            which causes duplicate when running getent passwd


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-19
changelog:
  - Add OSCP checks for p11_child
  - Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                            users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-21
changelog:
  - Related: rhbz#1638150 - session not recording for local user when groups defined
  - Also add silence a Coverity warning, which is related to rhbz#1637131


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-23
changelog:
  - Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
                             with smart card


author: Michal Židek <mzidek@redhat.com> - 2.0.0-24
changelog:
  - Resolves: rhbz#1646168 - sssctl access-report always prints an error message
  - Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
                             configuration without having to restart the whole
                             sssd
  - Resolves: rhbz#1640576 - sssctl reports incorrect information about local
                             user's cache entry expiration time
  - Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
  - Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys


author: Michal Židek <mzidek@redhat.com> - 2.0.0-25
changelog:
  - Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
                             for D-bus, resulting in a crash


author: Michal Židek <mzidek@redhat.com> - 2.0.0-27
changelog:
  - Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
                             if ID provider is authenticated with GSSAPI


author: Michal Židek <mzidek@redhat.com> - 2.0.0-29
changelog:
  - Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
                             /usr/libexec/sssd/proxy_child killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.0.0-30
changelog:
  - Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
                        retrieve AD users through IPA Trust


author: Michal Židek <mzidek@redhat.com> - 2.0.0-32
changelog:
  - Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
              and libtevent to avoid an issue in GPO processing


author: Michal Židek <mzidek@redhat.com> - 2.0.0-33
changelog:
  - Resolves: rhbz#1646113 - Missing concise documentation about valid options
                             for sssd-files-provider


author: Michal Židek <mzidek@redhat.com> - 2.0.0-34
changelog:
  - Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
                             kdestroy caused by KCM returning a wrong error
                             code during the delete operation


author: Michal Židek <mzidek@redhat.com> - 2.0.0-36
changelog:
  - Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
                             suggests using * for backend sss


author: Michal Židek <mzidek@redhat.com> - 2.0.0-38
changelog:
  - Resolves: rhbz#1578014 - sssd does not work under non-root user
  - Note: Actually the patches were in the 2.0.0-37, this one just adds this
          changelog because it was missing.


author: Michal Židek <mzidek@redhat.com> - 2.0.0-39
changelog:
  - Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
                             1.x, this can result in time outs


author: Michal Židek <mzidek@redhat.com> - 2.0.0-40
changelog:
  -Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
                            UnknownProperty: Unknown property


author: Michal Židek <mzidek@redhat.com> - 2.0.0-41
changelog:
  -Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
                            subdomain service name being used


author: Michal Židek <mzidek@redhat.com> - 2.0.0-42
changelog:
  - Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
                             of gen_new to avoid a subsequent switch call
                             failure


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-43
changelog:
  - Resolves: rhbz#1672780 - gdm login not prompting for username when smart
                             card maps to multiple users


author: Michal Židek <mzidek@redhat.com> - 2.0.0-45
changelog:
  - Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
    done here in order to unblock gating changes before rebase.
  - Related: rhbz#1682305


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-2
changelog:
  - Resolves: rhbz#1673443 - sssd man pages: The default value of
                             "ldap_user_home_directory" is not mentioned
                             with AD server configuration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-3
changelog:
  - Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
                             no members


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-4
changelog:
  - Resolves: rhbz#1283798 - sssd failover does not work on connecting to
                             non-responsive ldaps:// server


author: Michal Židek <mzidek@redhat.com> - 2.2.0-6
changelog:
  - Resolves: rhbz#1726945 - negative cache does not use values from
                             'filter_users' config option for known domains


author: Michal Židek <mzidek@redhat.com> - 2.2.0-7
changelog:
  - Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
                             not FIPS140 compliant


author: Michal Židek <mzidek@redhat.com> - 2.2.0-8
changelog:
  - Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
                             repository
                           - This just required a raise in release number
                             and changelog for the record.


author: Michal Židek <mzidek@redhat.com> - 2.2.0-10
changelog:
  - Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
                             the trailing colon


author: Michal Židek <mzidek@redhat.com> - 2.2.0-11
changelog:
  - Resolves: rhbz#1733372 - permission denied on logs when running sssd as
                             non-root user


author: Michal Židek <mzidek@redhat.com> - 2.2.0-13
changelog:
  - Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
              systemd-user service in the account phase in RHEL-8


author: Michal Židek <mzidek@redhat.com> - 2.2.0-14
changelog:
  - Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
                             should not cause files domain entries to be
                             qualified, this can break sudo access


author: Michal Židek <mzidek@redhat.com> - 2.2.0-15
changelog:
  - Resolves: rhbz#1736265 - Smart Card auth of local user: endless
                             loop if wrong PIN was provided


author: Michal Židek <mzidek@redhat.com> - 2.2.0-16
changelog:
  - Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
                             the IP address of the machine updated in IPA upon
                             sssd.service startup


author: Michal Židek <mzidek@redhat.com> - 2.2.0-17
changelog:
  - Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
                             keyring
  - Also apply a patch to fix gating tests issue


author: Michal Židek <mzidek@redhat.com> - 2.2.0-18
changelog:
  - Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
  - Also sync. kcm multihost tests with master


author: Michal Židek <mzidek@redhat.com> - 2.2.0-19
changelog:
  - Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
                             new ones (kcm)


author: Michal Židek <mzidek@redhat.com> - 2.2.3-2
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              PART2: Fix gating issue.


author: Michal Židek <mzidek@redhat.com> - 2.2.3-3
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              Increasing version number to pick latest libldb


author: Michal Židek <mzidek@redhat.com> - 2.2.3-4
changelog:
  * Resolves: rhbz#1781728 - sssctl config-check command does not give proper
                             error messages with line numbers


author: Michal Židek <mzidek@redhat.com> - 2.2.3-5
changelog:
  * Resolves: rhbz#1744500 - [Doc]Provide explanation on escape character
                             for match rules sss-certmap


author: Michal Židek <mzidek@redhat.com> - 2.2.3-9
changelog:
  * Resolves: rhbz#1783190 - [abrt] [faf] sssd:
                             raise(): /usr/libexec/sssd/sssd_autofs killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.2.3-10
changelog:
  * Resolves: rhbz#1583592 - [RFE] Add configurable randomness to SSSD ldap
                             connection timeout


author: Michal Židek <mzidek@redhat.com> - 2.2.3-14
changelog:
  - Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
                             specified up to the seconds


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-16
changelog:
  - Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
                             omitted and auth_provider is krb5


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-17
changelog:
  - Resolves: rhbz#1718193 - p11_child should have an option to skip
                             C_WaitForSlotEvent if the PKCS#11 module
                             does not implement it properly


author: Michal Židek <mzidek@redhat.com> - 2.2.3-18
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
                             information


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate
                             (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
  - Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
  - Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
  - Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
  - Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
  - Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
  - Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
  - Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
  - Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
  - Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
  - Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
  - Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
  - Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
  - Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
  - Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
  - Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
  - Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
  - Resolves: RHEL-10721 - very bad performance when requesting service tickets
  - Resolves: RHEL-19011 - Invalid handling groups from child domain
  - Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
  - Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
  - Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.1
changelog:
  - Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
  - Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
  - Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
  - Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
  - Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
  - Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.2
changelog:
  - Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
  - Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
  - Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]


author: Alejandro López <allopez@redhat.com> - 2.9.4-5.3
changelog:
  - Resolves: RHEL-112455 - p11_child currently has an infinite timeout [rhel-8.10.z]
  - Resolves: RHEL-120292 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-8.10.z]


author: Fernando Pacheco <fpacheco@redhat.com> - 1.16-1
changelog:
  - stald/utils: Space, lines and voids clenaups
  - stalld: Add an option to easily set stalld as SCHED_DEADLINE
  - stalld: Comments cleanup
  - src/utils: Comments cleanup
  - src/throttling: Comments cleanup
  - src/stalld.h Comments cleanup
    Resolves: rhbz#2068549


author: Leah Leshchinsky <lleshchi@redhat.com> - 1.17.1-1
changelog:
  - stalld: Fix memory leak in print_boosted_info()
  - utils: Check if the system is in lockdown mode
  - stalld: print process comm and cpu when boosting
  Resolves: rhbz#2120800


author: Dennis Keefe <dkeefe@redhat.com> - 2.0.0-4
changelog:
  - Update to 2.0.0
  - Resolves: rhbz#1760906
  - Fix a bug where last update time for variable length metadata was not set
    properly on startup:
  - Resolves: rhbz#1720399
  - Specify path of PID file as "/run/stratisd.pid" instead of 
    "/var/run/stratisd.pid".
  - Resolves: rhbz#1754649
  - For a particular log entry, reduce log level from INFO to DEBUG and make the
    log message more detailed:
  - Resolves: rhbz#1680052


author: Dennis Keefe <dkeefe@redhat.com> - 2.1.0-1
changelog:
  - Update to 2.1.0
  - Resolves: rhbz#1791473
  - Update Stratis RPM Spec File
  - Resolves: rhbz#1828487
  - Support per-pool encryption of the devices that form a pool's data tier
  - Resolves: rhbz#1768580
  - Improve systemd unit file description
  - Resolves: rhbz#1756525


author: Dennis Keefe <dkeefe@redhat.com> - 2.3.0-2
changelog:
  - Update to 2.3.0
  - Resolves: rhbz#1885328
  - Stratis devices inhabit an existing root directory path
  - Resolves: rhbz#1798244
  - Add Clevis Support
  - Resolves: rhbz#1868100
  - Improve stratisd log levels
  - Resolves: rhbz#1757976


author: Bryan Gurney <bgurney@redhat.com> - 2.4.0-3
changelog:
  - Update to 2.4.0
  - Resolves: rhbz#1931671
  - Improve stratis by adding Multi-threading
  - Resolves: rhbz#1927485
  - Dump stratis configuration on demand or in debug
  - Resolves: rhbz#1735475
  - Add noalign option to XFS creation on MDV
  - Resolves: rhbz#1908318
  - Cap thinpool metadata device size at devicemapper-set limit
  - Resolves: rhbz#1707461


author: Bryan Gurney <bgurney@redhat.com> - 2.4.2-1
changelog:
  - Update to 2.4.2
  - Resolves: rhbz#1931671
  - Ensure that binaries are installed with proper features enabled
  - Split dracut modules out to subpackage
  - Add additional dependencies in dracut module


author: John Kacur <jkacur@redhat.com> - 0.15.00-1
changelog:
  - Rebase to upstream V0.15.00
  - Add the following upstream patches
  - stress-shm: move /dev/shm check to earlier in the setup phase
  - stress-shm: skip stressor if /dev/shm is not mounted with tmpfs on linux
  - stress-sysfs: check for zero sysfs entries after pruning the directory
  Resolves: rhbz#2144070


author: John Kacur <jkacur@redhat.com> - 0.17.08-1
changelog:
  - Rebase to upstream V0.17.08
  - ARM: Don't declare inlined yield helper if yield is not available
  Resolves: RHEL-33304


author: John Kacur <jkacur@redhat.com> - 0.18.06-1
changelog:
  - Update the stress-ng-0.18.06 upstream
  - Include some upstream patches after 0.18.06
  Resolves: RHEL-65474


author: Michael Catanzaro <mcatanzaro@redhat.com> - 3.28.3-3
changelog:
  - Use autosetup so WebKitGTK patch actually gets applied, and rewrite the patch to work
    Resolves: RHEL-26699


author: Tom Stellard <tstellar@redhat.com> - 4.0.2-2
changelog:
  - Use make macros
    https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Disable Go tests


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.0-2.20200828git0c238a2
changelog:
  - Backport fixes from 0.4.0 stable branch. Resolves: rhbz#1868375
    (fixes usage of swtpm-localca with passwords when signing keys)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.2-1.20201201git2df14e3
changelog:
  - Update to 0.4.2, to address potential symlink vulnerabilities (CVE-2020-28407).
    Resolves: rhbz#1906043


author: <msekleta@redhat.com> - 11.7.3-7
changelog:
  - Don't trigger autofs mounts when running sadc (#2000910)
  - sar: Add missing %gnice CPU value for tickless CPU (#2000916)
  - sadf: Fix seg fault on empty data files (#1910841)
  - sar: Fix typo in manual page (#1877836)


author: Pavel Šimovec <psimovec@redhat.com> - 11.7.3-11
changelog:
  - fix the arithmetic overflow in allocate_structures() that is still possible on some 32 bit systems (CVE-2023-33204)


author: Lukáš Zaoral <lzaoral@redhat.com> - 11.7.3-13
changelog:
  - fix memory allocation errors with malformed sa files (RHEL-35511)
  - reorder patches to prevent errors during their application


author: Stan Cox <scox@redhat.com> - 4.7-1
changelog:
  - Upstream release, see wiki page below for detailed notes.
    https://sourceware.org/systemtap/wiki/SystemTapReleases


author: Frank Ch. Eigler <fche@redhat.com> - 4.8-2
changelog:
  - rhbz2156092 = rhbz1997192
  - rhbz2145241 = rhbz2145242
  - rhbz2156093 = rhbz2149223
  - rhbz2156095 = rhbz2149666
  - rhbz2156094 = rhbz2154430


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Removing build-time dependency on sharutils(rhbz#1587877)
  - Changing git dependency to smaller git-core


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-6
changelog:
  - Resolves: #1715423 - tcpdump pre creates user and groups unconditionally
  - Resolves: #1655622 - CVE-2018-19519 Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-2
changelog:
  - Resolves: #1860216 - tcpdump can not parse mptcp options
  - Resolves: #1901635 - ppp decapsulator can be convinced to allocate a large amount of memory
  - Adding tedude test to gating


author: Hangbo Fan <fanhangbo.fhb@alibaba-inc.com> - 14:4.9.3-5.0.1
changelog:
  - Add doc sub package
  - cherry-pick `add sw patch #199f8102fc30b385b28c16494d2a683ecd265166`.(nijie@wuxiat.com)


author: Jan Macku <jamacku@redhat.com> - 6.22.03-1
changelog:
  - Update to tcsh-6.22.03
  - Drop tcsh-6.22.02-avoid-gcc-to-fail.patch                              - applied by upstream
  - Drop tcsh-6.22.02-call-seterror-consistently-and-abort-quickly.patch   - applied by upstream
  - Drop tcsh-6.22.02-avoid-crashing-when-loading-corrupted-history.patch  - applied by upstream


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-69
changelog:
  - Resolves: #1445259 - telnet won't build with latest gcc
  - added note about address resolution in manpage


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-73
changelog:
  - Resolves: #1602711 - Please review important issues found by covscan
  - Resolves: #1637085 - Option -i is missing in telnet in el8 but is available in el7


author: Than Ngo <than@redhat.com> - 9:20200327-19
changelog:
  - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 9:20200406-26.0.1
changelog:
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - anolis texlive add loongarch64(Yaxuan Liu)


author: Lukáš Zaoral <lzaoral@redhat.com> - 5.2-25
changelog:
  - Fix inconsistent --map-file option spelling in manual (rhbz#2066853)
  - Fix memory corruption in tftpd when filename remapping with macro \x
    is used (rhbz#2066862)


author: Weitao Zhou <zhouwt@linux.alibaba.com> 5.2-27.0.1
changelog:
  - Make configure an order-only prerequisite of aconfig.h.in
  - remove autoreconf in %build to fix parallel build error
  - use extern in header files when declaring global variables for compatible gcc10 build
  - Add doc sub package


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-7
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20388
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20382
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20530
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21214


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-9
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-30755
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30767
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-10
changelog:
  - Drop patches that are already part of xorg-x11-server
    Resolves: RHEL-30755
    Resolves: RHEL-30767
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-14
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-61999


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-15
changelog:
  - Fix CVE-2025-26594 xorg-x11-server Use-after-free of the root cursor
    Resolves: RHEL-79397
  - Fix CVE-2025-26595 xorg-x11-server Buffer overflow in XkbVModMaskText()
    Resolves: RHEL-79401
  - Fix CVE-2025-26596 xorg-x11-server Heap overflow in XkbWriteKeySyms()
    Resolves: RHEL-79386
  - Fix CVE-2025-26597 xorg-x11-server Buffer overflow in XkbChangeTypesOfKey()
    Resolves: RHEL-79380
  - Fix CVE-2025-26598 xorg-x11-server Out-of-bounds write in CreatePointerBarrierClient()
    Resolves: RHEL-79369
  - Fix CVE-2025-26599 xorg-x11-server Use of uninitialized pointer in compRedirectWindow()
    Resolves: RHEL-79364
  - Fix CVE-2025-26600 xorg-x11-server Use-after-free in PlayReleasedEvents()
    Resolves: RHEL-79360
  - Fix CVE-2025-26601 xorg-x11-server Use-after-free in SyncInitTrigger()
    Resolves: RHEL-79348


author: Adam Tkac <atkac redhat com> 0.0.90-0.4.20090403svn3751
changelog:
  - update to r3751
  - patches merged
    - tigervnc-xclients.patch
    - tigervnc-clipboard.patch
    - tigervnc-rh212985.patch
  - basic RandR support in Xvnc (resize of the desktop)
  - use built-in libjpeg (SSE2/MMX accelerated encoding on x86 platform)
  - use Tight encoding by default
  - use TigerVNC icons


author: Adam Tkac <atkac redhat com> 0.0.90-0.6.20090427svn3789
changelog:
  - update to r3789
    - tigervnc-rh494801.patch merged
  - tigervnc-newfbsize.patch is no longer needed
  - fix problems when vncviewer and Xvnc run on different endianess (#496653)
  - UltraVNC and TightVNC clients work fine again (#496786)


author: Adam Tkac <atkac redhat com> 0.0.90-0.10
changelog:
  - rebuild against 1.6.1.901 X server (#497835)
  - disable i18n, vncviewer is not UTF-8 compatible (#501832)


author: Adam Tkac <atkac redhat com> 0.0.91-0.11
changelog:
  - update to 0.0.91 (1.0.0 RC1)
  - patches merged
    - tigervnc10-rh499401.patch
    - tigervnc10-rh497592.patch
    - tigervnc10-rh501832.patch
  - after discusion in upstream drop tigervnc-bounds.patch
  - configure flags cleanup


author: Adam Tkac <atkac redhat com> 0.0.91-0.13
changelog:
  - temporary use F11 Xserver base to make Xvnc compilable
  - BuildRequires: libXi-devel
  - don't ship tigervnc-server-module on s390/s390x


author: Adam Tkac <atkac redhat com> 1.0.0-2
changelog:
  - update underlying X source to 1.6.4-0.3.fc11
  - remove bogus '-nohttpd' parameter from /etc/sysconfig/vncservers (#525629)
  - initscript LSB compliance fixes (#523974)
  - improve -LowColorSwitch documentation and handling (#510185)
  - honor dotWhenNoCursor option (and it's changes) every time (#524340)


author: Adam Tkac <atkac redhat com> 1.0.90-0.1.20091221svn3929
changelog:
  - update to 1.0.90 snapshot
  - patches merged
    - tigervnc10-compat.patch
    - tigervnc10-rh510185.patch
    - tigervnc10-rh524340.patch
    - tigervnc10-rh516274.patch


author: Adam Tkac <atkac redhat com> 1.0.90-0.2.20091221svn3929
changelog:
  - add patch for upstream X.Org issue #25909
  - add libXdmcp-devel to build requires to build Xvnc with XDMCP support (#552322)


author: Adam Tkac <atkac redhat com> 1.0.90-0.4.20091221svn3929
changelog:
  - mark stack as non-executable in jpeg ASM code
  - add xorg-x11-xauth to Requires
  - add support for X.Org 1.8
  - drop shave sources, they are no longer needed


author: Adam Tkac <atkac redhat com> 1.0.90-0.6.20100219svn3993
changelog:
  - add mesa-dri-drivers and xkeyboard-config to -server Requires
  - update to r3993 1.0.90 snapshot
    - tigervnc11-noexecstack.patch merged
    - tigervnc11-xorg18.patch merged
    - xserver18.patch is no longer needed


author: Adam Tkac <atkac redhat com> 1.0.90-0.9.20100219svn3993
changelog:
  - add server-applet subpackage which contains Java vncviewer applet
  - fix Java applet; it didn't work when run from web browser
  - add xorg-x11-xkb-utils to server Requires


author: Adam Tkac <atkac redhat com> 1.0.90-0.10.20100420svn4030
changelog:
  - update to r4030 snapshot
  - patches merged to upstream
    - tigervnc11-rh522369.patch
    - tigervnc11-rh551262.patch
    - tigervnc11-r4002.patch
    - tigervnc11-r4014.patch


author: Adam Tkac <atkac redhat com> 1.0.90-0.11.20100420svn4030
changelog:
  - link libvnc.so "now" to catch "undefined symbol" errors during Xorg startup
  - use always XkbConvertCase instead of XConvertCase (#580159, #586406)
  - don't link libvnc.so against libXi.la, libdix.la and libxkb.la; use symbols
    from Xorg instead


author: Adam Tkac <atkac redhat com> 1.0.90-0.14.20100420svn4030
changelog:
  - fix memory leak in Xvnc input code (#597172)
  - don't crash when receive negative encoding (#600070)
  - explicitly disable udev configuration support
  - add gettext-autopoint to BR


author: Adam Tkac <atkac redhat com> 1.0.90-0.17.20100721svn4113
changelog:
  - update to r4113
  - patches merged
    - tigervnc11-rh586406.patch
    - tigervnc11-libvnc.patch
    - tigervnc11-rh597172.patch
    - tigervnc11-rh600070.patch
    - tigervnc11-options.patch
  - don't own %{_datadir}/icons directory (#614301)
  - minor improvements in the .desktop file (#616340)
  - bundled libjpeg configure requires nasm; is executed even if system-wide
    libjpeg is used


author: Adam Tkac <atkac redhat com> 1.0.90-0.19.20100813svn4123
changelog:
  - separate Xvnc, vncpasswd and vncconfig to -server-minimal subpkg (#626946)
  - move license to separate subpkg and Requires it from main subpkgs
  - Xvnc: handle situations when no modifiers exist well (#611677)


author: Adam Tkac <atkac redhat com> 1.0.90-0.20.20100813svn4123
changelog:
  - press fake modifiers correctly (#633931)
  - supress unneeded debug information emitted from initscript (#633645)


author: Adam Tkac <atkac redhat com> 1.0.90-0.24.20100813svn4123
changelog:
  - rebuild against xserver 1.10.X
  - 0001-Return-Success-from-generate_modkeymap-when-max_keys.patch merged


author: Adam Tkac <atkac redhat com> 1.0.90-0.25.20101208svn4225
changelog:
  - update to r4225
  - patches merged
    - tigervnc11-rh611677.patch
    - tigervnc11-rh633931.patch
    - tigervnc11-xorg1.10.patch
  - enable VeNCrypt and PAM support


author: Adam Tkac <atkac redhat com> - 1.0.90-3
changelog:
  - fix wrong usage of memcpy which caused screen artifacts (#652590)
  - don't point to inaccessible link in sysconfig/vncservers (#644975)


author: Adam Tkac <atkac redhat com> - 1.1.0-1
changelog:
  - update to 1.1.0
  - update the xorg11 patch
  - patches merged
    - tigervnc11-glx.patch
    - tigervnc11-CVE-2011-1775.patch
    - 0001-Use-memmove-instead-of-memcpy-in-fbblt.c-when-memory.patch


author: Adam Tkac <atkac redhat com> - 1.1.0-3
changelog:
  - don't build X.Org devel docs (#755782)
  - applet: BR generic java-devel instead of java-gcj-devel (#755783)
  - use runuser to start Xvnc in systemd service file (#754259)
  - don't attepmt to restart Xvnc session during update/erase (#753216)


author: Adam Tkac <atkac redhat com> - 1.1.0-5
changelog:
  - clean Xvnc's /tmp environment in service file before startup
  - fix building against the latest JAVA 7 and X.Org 1.12


author: Adam Tkac <atkac redhat com> 1.2.80-0.1.20120905svn4996
changelog:
  - update to 1.2.80
  - remove deprecated patches
    - tigervnc-102434.patch
    - tigervnc-viewer-reparent.patch
    - tigervnc11-java7.patch
  - patches merged
    - tigervnc11-xorg111.patch
    - tigervnc11-xorg112.patch


author: Adam Tkac <atkac redhat com> - 1.2.80-0.12.20130314svn5065
changelog:
  - include /etc/X11/xorg.conf.d/10-libvnc.conf sample configuration (#712482)
  - vncserver now honors specified -geometry parameter (#755947)


author: Tim Waugh <twaugh@redhat.com> 1.2.80-0.14.20130314svn5065
changelog:
  - Use systemd rpm macros (bug #850340).  Moved systemd requirements
    from main package to server sub-package.
  - Applied Debian patch to fix busy loop when run from inetd in nowait
    mode (bug #920373).
  - Added dependency on xorg-x11-xinit to server sub-package so that
    default window manager can be found (bug #896284, bug #923655).
  - Fixed bogus changelog date.


author: Tim Waugh <twaugh@redhat.com> 1.3.0-3
changelog:
  - Avoid PIDFile problems in systemd unit file (bug #983232).
  - libvnc.so: don't use unexported key_is_down function.
  - Don't use shebang in vncserver script.


author: Tim Waugh <twaugh@redhat.com> 1.3.0-15
changelog:
  - Disable dri3 to enable building (bug #1063392).
  - Fixed heap-based buffer overflow (CVE-2014-0011, bug #1050928).


author: Tim Waugh <twaugh@redhat.com> - 1.3.1-8
changelog:
  - Input reset fixes from upstream (bug #1116956).
  - No longer need ppc64le patch as it's now in xorg-x11-server.
  - Rebased xserver114.patch again.


author: Tim Waugh <twaugh@redhat.com> - 1.4.2-1
changelog:
  - Rebased xserver116.patch against xorg-x11-server-1.17.1.
  - Allow build against xorg-x11-server-1.17.
  - 1.4.2.


author: Jan Grulich <jgrulich@redhat.com> - 1.6.0-4
changelog:
  - Utilize system-wide crypto policies
    Resolves: bz#1179345
  - Try to disable patch4 as it was previously written to support an
    older version of a different client and breaks some other usage
    Resolves: bz#1280440


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-3
changelog:
  - Bug 1438704 - CVE-2017-7392 CVE-2017-7393 CVE-2017-7394
                  CVE-2017-7395 CVE-2017-7396 tigervnc: various flaws
    + other upstream related fixes


author: Jan Grulich <jgrulich@redhat.com> - 1.9.0-7
changelog:
  - Improve coverity scan fixes
    Resolves: bz#1602714

    Inform whether view-only password is used or not
    Resolves: bz#1639169

    Backport fixes from RHEL 7
    Resolves: bz#1651254


author: Jan Grulich <jgrulich@redhat.com> - 1.10.1-5
changelog:
  - Install the HOWTO file to correct location
  - Add /usr/bin/vncserver file informing users to read the HOWTO.md file
    Resolves: bz#1790443


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-1
changelog:
  - Update to 1.11.0
    Resolves: bz#1880985
  - Backport fix to allow Tigervnc use boolean values in config files
    Resolves: bz#1883415


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-2
changelog:
  - Revert removal of vncserver
    Resolves: bz#1897504
  - Correctly start vncsession as a daemon
    Resolves: bz#1897498


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-4
changelog:
  - Added vncsession-restore script for SELinux policy migration
    Fix SELinux context for root user
    Resolves: bz#2021892


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-1
changelog:
  - 1.13.1
    Resolves: bz#2175748
  - Restore "--fallbacktofreeport" option in the vncserver script
    Resolves: bz#2174398


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege
    Escalation Vulnerability
    Resolves: bz#2180306


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-4
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
    Resolves: RHEL-15236

  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15230


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-5
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18410
  - Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18422


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-4
changelog:
  - Add option "ApproveLoggedUserOnly" allowing to connect only the user
    owning the running session
    Resolves: RHEL-91104


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-6
changelog:
  - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors
    Resolves: RHEL-97268
  - Fix CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97294
  - Fix CVE-2025-49178: xorg-x11-server: Unprocessed Client Request Due to Bytes to Ignore
    Resolves: RHEL-97364
  - Fix CVE-2025-49179: xorg-x11-server: Integer overflow in X Record extension
    Resolves: RHEL-97397
  - Fix CVE-2025-49180: xorg-x11-server: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension
    Resolves: RHEL-97232


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-7
changelog:
  - Additional fix to CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97294


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-8
changelog:
  - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation
    Resolves: RHEL-119979

  - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal
    Resolves: RHEL-120001

  - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb extension XkbSetCompatMap()
    Resolves: RHEL-120762


author: Justin Stephenson <jstephen@redhat.com> - 8-1
changelog:
  - Release v8
  - Spec file fixes for EL6
  - Spec file improvements for Debian/Ubuntu pkg-config
  - Tlog-play improve authentication options
  - Handle piped in I/O from stdin and improve the main recording transfer exit
    condition.
  - Use empty string on hostname resolution failure


author: Justin Stephenson <jstephen@redhat.com> - 9-1
changelog:
  - Release v9
  - Add libutempter support
  - Require journal match filter
  - Add file reader match functionality
  - Restore cursor visibility and color attributes on tlog-play exit
  - Add "time" real clock timestamp message field
  - Various upstream CI improvements


author: Justin Stephenson <jstephen@redhat.com> - 11-1
changelog:
  - Fire SIGCHLD after utempter_add_record since it probably eats it.
  - Correct suse rpmbuild
  - Update debbuild for travis CI


author: Justin Stephenson <jstephen@redhat.com> - 12-1
changelog:
  - Release v12
  - Prevent infinite transfer loop on GDM login.
  - tlog-play: add journal namespace support.
  - tlitest: extend delay for limit-action delay test.


author: Justin Stephenson <jstephen@redhat.com> - 12.1
changelog:
  - Exit transfer loop when output fd is closed
  - Revert "Prevent infinite transfer loop on GDM login"


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-3
changelog:
  - Rebuild for CVE-2022-41723, CVE-2023-24534, CVE-2023-24536 and
    CVE-2023-24538
  Resolves: #2187345, #2187368, #2203690


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-7
changelog:
  - Rebuild for CVE-2023-29406, CVE-2023-39318 and CVE-2023-39319
  Resolves: RHEL-4231, RHEL-4475, RHEL-4502


author: Honggang Li <honli@redhat.com> - 4.2.10-25
changelog:
  - Rebase to latest Fedora release
  - Fix file conflicts in torque-devel multilib packages
  - Resolve: bz1853167


author: Kalev Lember <klember@redhat.com> - 3.38.2-2
changelog:
  - Use conflicts for totem-video-thumbnailer split instead of self-obsoletes
  - Resolves: rhbz#1949422


author: Wim Taymans <wtaymans@redhat.com> - 0.3.13-12
changelog:
  - Add explicit Requires for the -libs package.
  - Do NVR bump to move twolame-devel from buildroot to CRB
  - Resolves: rhbz#1843275


author: Nils Philippsen <nils@redhat.com> - 1.2.1-3
changelog:
  - drop requirements on cmake, pkgconfig and rather own the directories for the
    files augmenting these packages


author: Andreas Schneider <asn@redhat.com> - 1.2.2-1
changelog:
  - Update to version 1.2.2:
    * Added support for fork'ed and then exec'ed processes
    * Added support for Alpha


author: Andreas Schneider <asn@redhat.com> - 1.2.4-1
changelog:
  - Update to version 1.2.4
    * Added deadlock workaround for glibc < 2.24
    * Fixed a possible deadlock bug if uid_wrapper is turned off
    * Logging is always turned on now
    * Fixed a memory leak
    * Limited number of groups during fork+exec


author: Attila Lakatos <alakatos@redhat.com> - 0.7.8-4
changelog:
  - RHEL 8.3.0 ERRATUM
  - Spec file clean up
  - Rebase to 0.7.8
  Resolves: rhbz#1738590
  - Added selinux subpackage
  Resolves: rhbz#1683567
  - Added notifier subpackage
  - Installing /etc/usbguard/rules.d/
  Resolves: rhbz#1667395
  - Fixed sigwaitinfo handling
  Resolves: rhbz#1835210


author: Radovan Sroka <rsroka@redhat.com> - 0.7.8-5
changelog:
  - RHEL 8.3.0 ERRATUM
  - Use old-fasioned forking style in unit file
  Resolves: rhbz#1846885
  - Allow usbguard to read /proc/cpuinfo
  Resolves: rhbz#1847870
  - Removed notifier's Requires for usbguard-devel
  Resolves: rhbz#1667395
  - Allow usbguard to read /dev/urandom
  Resolves: rhbz#1848618


author: Radovan Sroka <rsroka@redhat.com> - 0.7.8-6
changelog:
  - RHEL 8.3.0 ERRATUM
  - Removed execstack from .spec
  - Removed AuthorizedDefault=wired from the usbguard
  Resolves: rhbz#1852539
  - Missing error message on bad configuration
  Resolves: rhbz#1857299
  - /etc/usbguard/usbguard-daemon.conf file does not contain all default options
  Resolves: rhbz#1862907


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-1
changelog:
  - Rebase to 1.0.0
  Resolves: rhbz#1887448
  - Filtering rules by attribute
  Resolves: rhbz#1873953
  - Change device policy of multiple devices using rule instead of ID
  Resolves: rhbz#1852568


author: Zoltan Fridrich <zfridric@redhat.com> - 1.0.0-8
changelog:
  - change usbguard icon injection
  - fix DSP module definition in spec file
  Resolves: rhbz#2014441
  - add execstack to spec
  - remove IPAddressDeny from usbguard service
  Resolves: rhbz#1929364
  - fix file conflict when installing usbguard on rhel
  Resolves: rhbz#1963271
  - fix IPC access control files override
  Resolves: rhbz#2004511
  - validate ACL permission existence
  Resolves: rhbz#2005020
  - decrease usbguard-notifier spam when denied connection
  Resolves: rhbz#2000000


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-8.2
changelog:
  - Fix unauthorized access via D-bus
  - Fix memory leak on D-bus connection failure
  Resolves: rhbz#2127848


author: Victor Toso <victortoso@redhat.com> - 0.13.0-1
changelog:
  - Rebase to latest upstream: 0.13.0
  - Keeps usbredirserver binary (removed upstream)
    Related: rhbz#2135760


author: Victor Toso <victortoso@redhat.com> - 0.13.0-2
changelog:
  - Fixes 100% CPU usage when usbredirect used as TCP server
    Related: rhbz#2157520
  - Fixes USB redirection of identical devices
    Resolves: rhbz#2157520


author: Mark Wielaard <mjw@redhat.com> - 3.21.0-2
changelog:
  - Upgrade to upstream 3.21.0
  - Remove upstreamed patches
  - Add valgrind-3.21.0-no-memcpy-replace-check.patch


author: Mark Wielaard <mjw@redhat.com> - 3.21.0-7
changelog:
  - Add valgrind-3.21.0-callgrind_control-no-strict.patch
  - Add valgrind-3.21.0-realloc-again.patch
  - Update valgrind-3.21.0-no-memcpy-replace-check.patch (memcpy_chk)
  - Add valgrind-3.21.0-vgm.patch and valgrind-3.21.0-vgm-tests.patch
  - Add valgrind-3.21.0-pgste.patch


author: Mark Wielaard <mjw@redhat.com> - 3.22.0-1
changelog:
  - Upstream 3.22.0 final
  - BuildRequires elfutils-debuginfod for testing
  - Remove all upstreamed patches
  - Adjust valgrind-3.16.0-some-stack-protector.patch
  - Adjust valgrind-3.16.0-some-Wl-z-now.patch
  - Add cachegrind.h to valgrind-devel package
  - Use %patch -Pn instead of deprecated %patchn


author: Binbin Zhou <zhoubinbin@loongson.cn> - 3.22.0-3
changelog:
  - Add valgrind-3.22.0-Add-LoongArch64-Linux-support.patch
  - Add valgrind-3.22.0-LoongArch64-Sync-kernel-4.19.patch


author: Lubos Uhliarik <luhliari@redhat.com> - 0.15.0-1
changelog:
  - updated to newer version (0.15.0)
  - Drop EPEL and older Fedora releases support
  - Drop broken manual ABI dependency to Varnish
  - Drop commented out references to past patches
  - Verbose test suite
  - Simplified configure step
  - Dependencies cleanup


author: Karsten Hopp <karsten@redhat.com> 7.3.638-2
changelog:
  - fix some man page typos (#668894, #675480)
  - own usr/share/vim/vimfiles/doc/tags (#845564)
  - add path to csope database (#844843)


author: Karsten Hopp <karsten@redhat.com> 7.4.5-1
changelog:
  - patchlevel 5
  - when closing a window fails ":bwipe" may hang
  - "vaB" while 'virtualedit' is set selects the wrong area


author: Karsten Hopp <karsten@redhat.com> 7.4.009-1
changelog:
  - patchlevel 009
    mkdir("foo/bar/", "p") gives an error message
    creating a preview window on startup messes up the screen
    new regexp engine can't be interrupted
    too easy to write a file was not decrypted (yet)


author: Karsten Hopp <karsten@redhat.com> 7.4.909-1
changelog:
  - patchlevel 909
  - Fedora vim now uses tarballs created from upstream git instead
    of just upstream patches. Now runtime files will have fixes, too.


author: Karsten Hopp <karsten@redhat.com> - 7.4.1718-2
changelog:
  - add vimfiles_root macro (rhbz#844975)
  - add %_libdir/vim  directory for plugins (rhbz#1193230)
  - vi, rvi, rview, ex, view don't read vimrc anymore. They use virc instead
    (rhbz#1045815)
  - fix dates in changelogs when spec.vim is used and locale != 'C'


author: Karsten Hopp <karsten@redhat.com> - 7.4.1797-3
changelog:
  - use uncompressed help files. vimtutor and vi will access those when
    vim-common is installed.  (rhbz#1262182)
    No hard requirement vim-minimal -> vim-common added, to allow minimal
    installations


author: Karsten Hopp <karsten@redhat.com> - 7.4.1830-3
changelog:
  - mv vim.sh and vim.csh to source files
  - sh profile.d improvements: don't leak $ID, don't fail on nounset
    (rhbz#1339106 Ville Skyttä)


author: Karsten Hopp <karsten@redhat.com> 8.0.134-1
changelog:
  - patchlevel 134
  - f24->f25 vim: copy paste no longer works (bug #1401410) - revert previous changes, set mouse=v in defaults.vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.134-2
changelog:
  - f24->f25 vim: copy paste no longer works (bug #1401410) - deleting mouse setting block from defaults.vim


author: Karsten Hopp <karsten@redhat.com> 8.0.347-1
changelog:
  - patchlevel 347
  - 1405234 - Gvim fails to properly render after Openbox desktop switch
  - 1426296 - vim: FTBFS with python3-3.6.0-18.fc26


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.685-3
changelog:
  - update python dependencies accordingly Fedora Guidelines for Python (python-devel -> python2-devel)


author: Karsten Hopp <karsten@redhat.com> 8.0.1092-1
changelog:
  - editing vim-update.sh for building package
  - patchlevel 1092
  - 1487175 - VIm conflicts in man pages


author: Karsten Hopp <karsten@redhat.com> 8.0.1102-1
changelog:
  - vim-update.sh - add test for succesful build and fixing grepping of update's list
  - patchlevel 1102


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1428-4
changelog:
  - throw vim.1.gz out from vim-minimal and other manpages from vim-common
  - appdata should be in metainfo folder now


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1523-2
changelog:
  - gcc is no longer in buildroot by default
  - 1546116 - make vim-filesystem noarch package
  - remove %{_libdir}/vim, because it is unused


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1666-2
changelog:
  - suggests ruby-libs, python2-libs, python3-libs, perl-libs and lua-libs for vim and gvim(bug #1562057)


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1763-2
changelog:
  - 1576470 - Suggest correct packages to get embedded interpreters working
  - add libappstream-glib for appstream-util
  - 1576483 - Vim needs Python2 to build


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-8
changelog:
  - 1640919 - augroup fedora, test case failure: /CoreOS/vim/Regression/bz241308-use-augroup-for-rh-autocmds


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16
changelog:
  - 2004975 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-8.6.0]
  - 2004892 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-17
changelog:
  - 2016201 - CVE-2021-3872 vim: heap-based buffer overflow in win_redr_status() drawscreen.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - 2028341 - CVE-2021-3984 vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow [rhel-8.6.0]
  - 2028430 - CVE-2021-4019 vim: heap-based buffer overflow in find_help_tags() in src/help.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read
  - CVE-2021-4192 vim: vulnerable to Use After Free


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0261 vim: Heap-based Buffer Overflow in block_insert() in src/ops.c
  - CVE-2022-0318 vim: heap-based buffer overflow in utf_head_off() in mbyte.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - fix test suite after fix for CVE-2022-0318
  - CVE-2022-0359 vim: heap-based buffer overflow in init_ccline() in ex_getln.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-20
changelog:
  - CVE-2022-1785 vim: Out-of-bounds Write
  - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
  - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-21
changelog:
  - RHEL-112003 CVE-2025-53905 vim: Vim path traversial
  - RHEL-112007 CVE-2025-53906 vim: Vim path traversal


author: Mahailiang <mahailiang@openanolis.org> - 2:8.0.1763-21.0.1
changelog:
  - Rebrand to Anolis(Xiaoxuan Yang)
  - Fix build issue with ruby(Liwei Ge)
  - add sw patch
  - add support for gcc having version beyond 10.0.


author: Marek Kasik <mkasik@redhat.com> - 3.22.0-22
changelog:
  - Rebuild due to new version of FreeRDP
  - Fix an issue when RDP connection shows just black screen
  - Resolves: #1839744


author: Uri Lublin <uril@redhat.com> - 10.0-3
changelog:
  - Show OS-ID when running 'remote-viewer -V'
    Resolves: rhbz#1953282
  - Clear auth entry fields
    Resolves: rhbz#1953933


author: Daniel P. Berrangé <berrange@redhat.com> - 11.0-1
changelog:
  - Rebase to 11.0 release
  - Add missing dep on libvirt-client for bash completion
  - Resolves: rhbz#2028604, rhbz#2000528


author: Jiri Kucera <jkucera@redhat.com> - 0.3.11-4
changelog:
  - fixed License
  - Requires: /usr/bin/gpg2 in libs subpackage
  - Added support for opening all types of LUKS devices
    Resolves: #1626974


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.3-32
changelog:
  - Removed a hint about the ftp_home_dir SELinux boolean from the config file
  - Resolves: rhbz#1623424


author: Artem Egorenkov <aegorenk@redhat.com> - 3.0.3-34
changelog:
  - Enable support for wide-character strings in logs
  - Replace unprintables with HEX code, not question marks
  - Resolves: rhbz#1947900


author: Brian C. Lane <bcl@redhat.com> - 35.5-1
changelog:
  - New release: 35.5 (bcl)
    Resolves: rhbz#2052604
  - docs: Explain how to undo blueprints delete (bcl)
  - test: server status no longer returns devel (bcl)
  - Use GetFrozenBlueprintsTOML for blueprints freeze save (bcl)
  - Add a test for float uid/gid in frozen blueprint (bcl)
  - Use GetBlueprintsTOML for blueprints save (bcl)
  - test: Add a test for float uid/gid in saved blueprint (bcl)
  - build(deps): bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0 (49699333+dependabot[bot])
  - tests: trigger on push to main (jrusz)
  - build(deps): bump github.com/spf13/cobra from 1.2.1 to 1.3.0 (49699333+dependabot[bot])
  - ci: add keystore for sonarqube (jrusz)
  - spec: Switch to using %gobuild macro on Fedora (bcl)
  - ci: change workflow name (jrusz)
  - ci: add gitlab-ci and sonarqube (jrusz)
  - doc: fix example links from the README (tdecacqu)
  - build(deps): bump actions/checkout from 2.3.4 to 2.4.0 (49699333+dependabot[bot])
  - ci: Enable Coverity Scan tool (atodorov)


author: Brian C. Lane <bcl@redhat.com> - 35.9-1
changelog:
  - Copy rhel-88.json test repository from osbuild-composer
  - Update osbuild-composer test repositories from osbuild-composer
  - New release: 35.9 (bcl)
    Resolves: rhbz#2168666
  - tests: Replace os.MkdirTemp with t.TempDir (bcl)
  - blueprint save: Allow overriding bad blueprint names (bcl)
  - tests: Clean up checking err in tests (bcl)
  - composer-cli: Implement blueprints diff (bcl)
  - saveBlueprint: Return the filename to the caller (bcl)
  - composer-cli: Add tests for using --commit with old servers (bcl)
  - weldr: Return error about the blueprints change route (bcl)
  - weldr: Save the http status code as part of APIResponse (bcl)
  - Add --commit support to blueprints save (bcl)
  - Add --commit to blueprints show (bcl)
  - gitleaks: Exclude the test password used in tests (bcl)
  - ci: add tags to AWS instances (tlavocat)
  - Update github.com/BurntSushi/toml to 1.2.1
  - Update github.com/stretchr/testify to 1.8.1
  - Update bump github.com/spf13/cobra to 1.6.1
  - New release: 35.8 (bcl)
  - completion: Remove providers from bash completion script (bcl)
  - completion: Filter out new headers from compose list (bcl)
  - docs: Remove unneeded Long descriptions (bcl)
  - docs: Use a custom help template (bcl)
  - docs: Add more command documentation (bcl)
  - cmdline: Add package glob support to modules list command (bcl)
  - workflow: Add govulncheck on go v1.18 (bcl)
  - tests: Update to use golangci-lint 1.49.0 (bcl)
  - New release: 35.7 (bcl)
  - spec: Move %gometa macro above %gourl (bcl)
  - weldr: When starting a compose pass size as bytes, not MiB (bcl)
  - tests: Use correct size value in bytes for test (bcl)
  - workflow: Add Go 1.18 to text matrix (bcl)
  - Replace deprecated ioutil functions (bcl)
  - New release: 35.6 (bcl)
  - tests: Update tests for osbuild-composer changes (bcl)
  - CMD: Compose status format (eloy.coto)
  - CMD: Compose list format (eloy.coto)
  - tests: Update tests to check for JSON list output (bcl)
  - composer-cli: Change JSON output to be a list of objects (bcl)
  - weldr: Simplify the old ComposeLog, etc. functions (bcl)
  - composer-cli: Add --filename to blueprints freeze save command (bcl)
  - composer-cli: Add --filename to blueprints save command (bcl)
  - composer-cli: Add --filename to compose logs command (bcl)
  - composer-cli: Add --filename to compose image command (bcl)
  - composer-cli: Add --filename to compose metadata command (bcl)
  - composer-cli: Add --filename to compose results command (bcl)
  - weldr: Add saving to a new filename to GetFilePath function (bcl)
  - github: Fix issue with codecov and forced pushes in PRs (bcl)
  - Use golangci-lint 1.45.2 in workflow (bcl)
  - Run workflow tests for go 1.16.x and 1.17.x (bcl)
  - Move go.mod to go 1.16 (bcl)
  - workflows/trigger-gitlab: run Gitlab CI in new image-builder project (jrusz)
  - Update GitHub actions/setup-go to 3
  - Update GitHub actions/checkout to 3


author: Brian C. Lane <bcl@redhat.com> - 35.12-1
changelog:
  - Copy rhel-8.10.json test repository from osbuild-composer
  - New release: 35.12 (bcl)
    Resolves: RHEL-1770
  - Add support for compose start warning messages (bcl)
  - Update documentation urls for new locations (bcl)
  - weldr: go fmt changes to a couple comments (bcl)
  - weldr: Update ostree test for parentid with no url (bcl)
  - Makefile: Turn off seccomp for build-in-podman (bcl)
  - composer-cli: Update doc links (simon.steinbeiss)
  - docs: fix typo/formatting in HACKING.md (idiez)
  - Add release creation documentation (bcl)
  - spec: Require createrepo_c for weldr-client-tests package (bcl)
  - spec: migrate the license field to SPDX (ondrej)
  - Go: Switch to go 1.19 (bcl)
  - CI: Update terraform hash (bcl)
  - Actions: add workflow for marking and closing stale issues and PRs (thozza)
  - workflows: Stop using golint (bcl)
  - workflows: Add Go 1.21 and 1.22 to test matrix (bcl)
  - workflows: Update to golangci-lint 1.56.2 (bcl)
  - workflow: Ignore govulncheck failures (bcl)
  - workflow: Switch to testing on go 1.18, 1.19, 1.20 (bcl)
  - build(deps): bump actions/setup-go from 3 to 5 (49699333+dependabot[bot])
  - build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.8.0 (49699333+dependabot[bot])
  - build(deps): bump actions/checkout from 3 to 4 (49699333+dependabot[bot])
  - build(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 (49699333+dependabot[bot])
  - build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.4 (49699333+dependabot[bot])


author: Brian C. Lane <bcl@redhat.com> - 35.12-3
changelog:
  - Update test repository snapshot urls rhel 8.10 and remove cs8 repos
    The snapshots for cs8 have been removed from the service
  - Rebuild for CVE-2025-22871
    Resolves: RHEL-89289


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 1.19.5-12.0.1
changelog:
  - use extern in header files when declaring global variables for compatible gcc10 build
  - Add doc sub package(taifu.gc@alibaba-inc.com)


author: Petr Menšík <pemensik@redhat.com> - 5.5.9-4
changelog:
  - Enable mkpasswd building (#2054043)
  - Remove changelog from mkpasswd, it has double size of actual tool


author: Michal Ruprich <mruprich@redhat.com> - 1:2.6.2-15
changelog:
  - Resolves: #2119126 - Wireshark source rpm fails to build due to looking for incorrect libssh header files


author: Tomas Popela <tpopela@redhat.com> - 1.6.0-5
changelog:
  - Drop PipeWire 0.2 requirement as Chrom[e|ium] 90 now depends on PipeWire 0.3
  - Resolves: rhbz#1949809


author: Debarshi Ray <rishi@fedoraproject.org> - 41.1-2
changelog:
  - Make the Supplements specific to Fedora to retain consistency with
    xdg-desktop-portal-gtk
  Resolves: #2051473


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.04-0.1
changelog:
  - disabled w3c-libwww because it does not exist anymore in FC5 and
    seems to be unmaintained upstream
  - added missing libxml2-devel
  - cleaned up list of %doc files
  - fixed gcc4.1 build issues
  - removed static libraries when there exists a corresponding dynamic one


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.04-1
changelog:
  - added libxml2-devel and openssl-devel Requires: for the -devel
    subpackage
  - ship doc/* instead of doc
  - initial Fedora Extras package (review 175840)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.06.11-2
changelog:
  - rediffed cmake patch against current version
  - made the xmlrpc-c-config compatible to the upstream version
  - added compatibility symlinks for some header files (thx to Robert de
    Vries for reporting these two issues)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.06.23-1
changelog:
  - use correct pkg-config script for 'xmlrpc-config abyss-server'
    output (#355411)
  - updated to 1.06.23 (#355411)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.13.07-2
changelog:
  - moved to advanced branched; rediffed/updated existing cmake patch
    and fixed other compilation issues (#369841)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.13.8-2
changelog:
  - fixed cmake quoting so that pkgconfig files get correct version number
  - fixed handling of 'server-util' and '--cflags' within xmlrpc-c-config


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.16.4.1567-2
changelog:
  - updated to 1.16.4
  - rediffed/updated patches
  - splitted some subpackages (c++, client) out of main package as they
    introduce additional dependencies (c++, curl)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.20.3-1.1841
changelog:
  - updated to rev1841
  - rediffed patches
  - added patch to fix handling of wrong certificates (Nikola Pajkovsky)
  - added support for $XMLRPC_TRACE_CURL env (John Dennis)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.21.00-1301.1851
changelog:
  - replaced .so symlinks by linker scripts which add all implicit
    dependencies in AS_NEEDED() commands (#564607, #565577)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.21.00-1401.1851
changelog:
  - require the various subpackages explicitly for -devel; the ld linker
    scripts broke rpm's autodetection (#567400)
  - removed -devel Requires: which are covered by pkgconfig autodeps
  - added %{?_isa} annotations


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.24.1-1500.svn1987
changelog:
  - updated to 1.24.1
  - set -Wno-uninitialized CFLAGS; code contains lot of constructs
    triggering this warning and the 'int a=a' defeaters have been
    removed in this version


author: Rob Crittenden <rcritten@redhat.com> - 1.51.0-7
changelog:
  - lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
    (#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
  - Prevent integer overflow on m_groupSize in doProlog
    (CVE-2021-46143) (#2058560)


author: Ondrej Vasik <ovasik@redhat.com> 0.0.27-1
changelog:
  - New version 0.0.27
  - remove several bashisms in scripts
  - add new option --profile for preprocessing documents
    with profiling stylesheet
  - fix several potential crashes in xmlif (found by static analysis)


author: Adam Jackson <ajax@redhat.com> - 7.7-21
changelog:
  - oclock 1.0.4
  - xeyes 1.1.2
  - xfontsel 1.0.6
  - xload 1.1.3
  - xmessage 1.0.5
  - xpr 1.0.5
  - xwd 1.0.7
  - xwud 1.0.5


author: Michel Dänzer <mdaenzer@redhat.com> - 19.1.0-1
changelog:
  - ati 19.1.0 (#1728818)
  - Drop patch 0001-Don-t-set-up-black-scanout-buffer-if-LeaveVT-is-call.patch,
    merged upstream
  - Add patches 0001-Handle-NULL-fb_ptr-in-pixmap_get_fb.patch &
    0002-Don-t-crash-X-server-if-GPU-acceleration-is-not-avai.patch from
    upstream Git master, fixing crashes with ShadowFB


author: Peter Hutterer <peter.hutterer@redhat.com> 1.0.1-2
changelog:
  - xf86-input-libinput 1.0.1 (#1951879)
  - Fix the upstream source URL
  - Use autosetup instead of manual patch handling


author: Peter Hutterer <peter.hutterer@redhat.com> 0.2.0-1
changelog:
  - Only match on specific device types, don't match on joysticks or tablets
  - libinput 0.2.0
  - switch to new fdo host


author: Peter Hutterer <peter.hutterer@redhat.com> 0.22.0-3
changelog:
  - Provide xorg-x11-drv-synaptics. The actual content is now provided by
    xorg-x11-drv-synaptics-legacy (#1394836). For details, see
    https://fedoraproject.org/wiki/Changes/RetireSynapticsDriver


author: Peter Hutterer <peter.hutterer@redhat.com> 0.23.0-2
changelog:
  - Ignore LED updates for disabled devices, avoids a null-pointer dereference
    when an AccessX timeout is set


author: Peter Hutterer <peter.hutterer@redhat.com> 0.25.1-2
changelog:
  - Add a new option to provide a workaround for the slow pointer movement on
    hidpi displays (#1413306) .
    That's a fedora-only patch for now, no idea what the permanent upstream
    solution will be here.


author: Hans de Goede <hdegoede@redhat.com> - 1.0.12-4
changelog:
  - Fix the crtc not being turned off, causing the dgpu to not suspend,
    after using a dgpu attached output


author: Christophe Fergeau <cfergeau@redhat.com> - 0.1.5-7
changelog:
  - Add upstream patches for Python 3 support
  - Validate RANDR output property atoms
  - Add patch fixing crash with multiple QXL devices
  - This syncs the RHEL branch with both current rawhide and RHEL 7.6


author: José Expósito <jexposit@redhat.com> - 1.20.11-20
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18321
    Resolves: https://issues.redhat.com/browse/RHEL-18327


author: José Expósito <jexposit@redhat.com> - 1.20.11-21
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21207
    Resolves: https://issues.redhat.com/browse/RHEL-20528
    Resolves: https://issues.redhat.com/browse/RHEL-20378
    Resolves: https://issues.redhat.com/browse/RHEL-20384
    Resolves: https://issues.redhat.com/browse/RHEL-21191
    Resolves: https://issues.redhat.com/browse/RHEL-21198


author: José Expósito <jexposit@redhat.com> - 1.20.11-23
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: Hangbo Fan <fanhangbo.fhb@alibaba-inc.com> - 1.20.11-25.0.1
changelog:
  - Add doc sub package
  - Fix doc package installation (wangkaiyuan@inspur.com)
  - cherry-pick `add sw arch #1ba6a0036d929c82c5516a18350d5c27cc28e210`. (nijie@wxiat.com)
  - cherry-pick: `add sw arch #3b1aa1ee2c00aeebe71a618589826c2d1cab136e`. (Weisson@linux.alibaba.com)
  - Fix the splash screen issue in the phytium S5000C (yuanxia2073@phytium.com.cn)


author: Hans de Goede <hdegoede@redhat.com> - 1.19.0-0.3.20161026
changelog:
  - Sync with upstream git, bringing in a bunch if bug-fixes
  - Add some extra fixes which are pending upstream
  - This also adds PointerWarping emulation to Xwayland, which should improve
    compatiblity with many games


author: Ben Crocker <bcrocker@redhat.com> - 1.19.0-0.6.20161028
changelog:
  - Fix Config record allocation during startup: if xorg.conf.d directory
  - was absent, a segfault resulted.


author: Hans de Goede <hdegoede@redhat.com> - 1.19.0-0.7.rc2
changelog:
  - Update to 1.19.0-rc2
  - Fix (hopefully) various crashes in FlushAllOutput() (rhbz#1382444)
  - Fix Xwayland crashing in glamor on non glamor capable hw (rhbz#1390018)


author: Olivier Fourdan <ofourdan@redhat.com> 1.19.0-1
changelog:
  - xserver 1.19.0
  - Fix use after free of cursors in Xwayland (rhbz#1385258)
  - Fix an issue where some monitors would show only black, or
    partially black when secondary GPU outputs are used


author: Hans de Goede <hdegoede@redhat.com> - 1.19.0-2
changelog:
  - Add some patches for better integration with the nvidia binary driver
  - Add a patch from upstream fixing a crash (rhbz#1389886)


author: Olivier Fourdan <ofourdan@redhat.com> 1.19.6-5
changelog:
  - xwayland: avoid race condition on new keymap
  - xwayland: Keep separate variables for pointer and tablet foci (rhbz#1519961)
  - xvfb-run now support command line option “--auto-display”


author: Olivier Fourdan <ofourdan@redhat.com> - 1.19.99.904-2
changelog:
  - Re-fix "use type instead of which in xvfb-run (rhbz#1443357)" which
    was overridden inadvertently


author: Adam Jackson <ajax@redhat.com> - 1.20.1-3
changelog:
  - Assorted RHEL mustard:
    - Don't probe for drivers we're not shipping
    - Enable PAM
    - Link Xorg with -z now
    - Nerf modesetting's atomic ioctl support
    - Don't autoconfigure vesa or fbdev from X -configure
    - Call LeaveVT on RANDR's CloseScreen path so we drop drm master
    - Try harder to get initial spanning desktop if the output's
      preferred mode was filtered away
  - Sync va_gl/vdpau patch from F29


author: Ben Crocker <bcrocker@redhat.com> - 1.20.3-5
changelog:
  - Add Eric Anholt's patch e50c85f4ebf559 from upstream:
  - Fix segfault on probing a non-PCI platform device on a system with PCI
  - NOTE: also pertains on a system with no PCI, e.g. s390x.
    Resolves: #1652013


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-3
changelog:
  - Downgrade modesetting "glamor initialization failed" X_ERROR → X_INFO
    Resolves: #1724573
  - Xwayland / Present leak fixes for #1728684


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-5
changelog:
  - xwayland: Hold a pixmap reference in struct xwl_present_event
    Related: #1728684
  - glamor: Fix glamor_poly_fill_rect_gl xRectangle::width/height handling
    Resolves: #1740250


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-8
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872391), CVE-2020-14346 (#1872395),
    CVE-2020-14361 (#1872402), CVE-2020-14362 (#1872409)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-4
changelog:
  - CVE fix for: CVE-2021-4008 (#2030162), CVE-2021-4009 (#2030172),
    CVE-2021-4010 (#2030175), CVE-2021-4011 (#2030181)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-9
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2108156, rhbz#2108161


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-11
changelog:
  - CVE fix for: CVE-2022-4283 (#2151799), CVE-2022-46340 (#2151774),
    CVE-2022-46341 (#2151779), CVE-2022-46342 (#2151784),
    CVE-2022-46343 (#2151789), CVE-2022-46344 (#2151794)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-26
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97273), CVE-2025-49176 (RHEL-97329),
                 CVE-2025-49178 (RHEL-97369), CVE-2025-49179 (RHEL-97422),
                 CVE-2025-49180 (RHEL-97235)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-27
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119953), CVE-2025-62230 (RHEL-120027),
                 CVE-2025-62231 (RHEL-124993)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.9-5
changelog:
  Fix for CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408, CVE-2024-0409


author: Olivier Fourdan <ofourdan@redhat.com> - 21.0.99.902-1
changelog:
  - xwayland 21.0.99.902
  - Remove xdmcp, udev, udev_kms build options
  - Stop overriding the vendor name, same as xorg-x11-server


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-2
changelog:
  - CVE fix for: CVE-2021-4008 (#2038067), CVE-2021-4009 (#2038070),
    CVE-2021-4010 (#2038072), CVE-2021-4011 (#2038074)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-3
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2110440, rhbz#2110433


author: Peter Hutterer <peter.hutterer@redhat.com> - 21.1.3-5
changelog:
  - CVE fix for: CVE-2022-4283 (#2151803), CVE-2022-46340 (#2151778),
    CVE-2022-46341 (#2151783), CVE-2022-46342 (#2151786),
    CVE-2022-46343 (#2151793), CVE-2022-46344 (#2151796)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-3
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-80204), CVE-2025-26595 (RHEL-80187),
                 CVE-2025-26596 (RHEL-80190), CVE-2025-26597 (RHEL-80193),
                 CVE-2025-26598 (RHEL-80195), CVE-2025-26599 (RHEL-80202),
                 CVE-2025-26600 (RHEL-80203), CVE-2025-26601 (RHEL-80207)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-3
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-79126), CVE-2025-26595 (RHEL-79130),
                 CVE-2025-26596 (RHEL-79134), CVE-2025-26597 (RHEL-79140),
                 CVE-2025-26598 (RHEL-79141), CVE-2025-26599 (RHEL-79146),
                 CVE-2025-26600 (RHEL-79154), CVE-2025-26601 (RHEL-79150)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97341), CVE-2025-49176 (RHEL-97335),
                 CVE-2025-49177 (RHEL-97358), CVE-2025-49178 (RHEL-97395),
                 CVE-2025-49179 (RHEL-97405), CVE-2025-49180 (RHEL-97245)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119975), CVE-2025-62230 (RHEL-120020),
                 CVE-2025-62231 (RHEL-125016)


author: Adam Jackson <ajax@redhat.com> - 7.7-25
changelog:
  - iceauth 1.0.8
  - xkill 1.0.5
  - xrdb 1.1.1
  - xrefresh 1.0.6
  - xset 1.2.4
  - xsetroot 1.1.2
  - HTTPS URLs


author: Adam Jackson <ajax@redhat.com> - 7.7-24
changelog:
  - Make -devel Require the base package, so the pc file will point to an
    xkbcomp that actually exists.


author: Zdenek Dohnal <zdohnal@redhat.com> - 0.999-28
changelog:
  - remove dependency on ImageMagick and netpbm-progs, because they were needed for
    tests during %build phase, which were removed in commit SHA 0595c15da29


author: Ray Strode <rstrode@redhat.com> 2.9.3-6
changelog:
  - Disable man support
  - Disable info support
  - Don't try to install schemas during install (bug 154035)


author: David Malcolm <dmalcolm@redhat.com> - 2.13.2-2
changelog:
  - Patched to include DocBook mimetype in desktop file, and added preun and post
    hooks to update-desktop-database (#175880)
  - Patched to ensure that Yelp recognizes that it can handle the mimetype of the
    documentation as reported by gnomevfs (also #175880)


author: Matthew Barnes <mbarnes@redhat.com> - 2.15.1-2
changelog:
  - Add build requirements: startup-notification-devel
                            libgnomeprintui22-devel
                            libXt-devel


author: Matthew Barnes <mbarnes@redhat.com> - 2.19.1-1
changelog:
  - Update to 2.19.1
  - Adapt the "apropos" patch for 2.19.1.
  - The "posix-man" patch appears to no longer apply.
  - Update dependencies based on configure.ac.


author: Matthew Barnes <mbarnes@redhat.com> - 2.19.90-1
changelog:
  - Update to 2.19.90
  - Remove "info-gnutls" patch (fixed upstream).
  - Remove patch for GNOME bug #370167 (fixed upstream).
  - Remove patch for GNOME bug #430365 (fixed upstream).
  - Remove patch for GNOME bug #431078 (fixed upstream).


author: Kalev Lember <kalevlember@gmail.com> - 1:3.8.1-3
changelog:
  - Make yelp-libs dep arch-specific, thanks to Michael Schwendt (#967180)
  - Don't create empty /usr/share/gnome/help directory: this should be owned by
    individual packages that install files in there (#964421)
  - Use configure --disable-static instead of removing the static .a afterwards


author: Kalev Lember <klember@redhat.com> - 2:40~beta-2
changelog:
  - Drop libtool as-needed hack as as-needed is in default LDFLAGS now
  - Remove unneeded ldconfig_scriptlets macro call
  - Tighten soname globs


author: Matej Mužila <mmuzila@redhat.com> - 3:2.4-5
changelog:
  - Add "Wants" dependency on network-online.target
  - Remove "After" dependency on NetworkManager-wait-online.service


author: Michel Alexandre Salim <salimma@centosproject.org> - 1.5.1-1
changelog:
  - Rebase to the latest upstream version
  - Enable optional gz, xz/lzma, and lz4 support in the zstd tool
  - Disable amd64 assembly on non-x86_64 architectures (rhbz#2035802)
    this should avoid the issue where an executable stack is created
  - Re-enable CET protections (rhbz#2039353)
    Resolves: rhbz#2039488


author: Jakub Martisko <jamartis@redhat.com> - 0.13.71-7
changelog:
  - Remove the doc/zzipdoc/{options,match}.py scritps from the original tar
  - Replace them with a current github version
  - The original version of the files contains autogenerated header with incompatible license
  - This build thus uses modified tar archive
  Resolves: rhbz#1982241


author: Matthias Saou <http://freshrpms.net/> 0.13.45-3
changelog:
  - Split off -utils sub-package (#199467). Could have been plain "zzip"?
  - Have sub-packages require exact release too.
  - Build require automake to make the aclocal-1.9 check happy.
  - Use --enable-frame-pointer otherwise -g gets removed from the CFLAGS.


author: Matthias Saou <http://freshrpms.net/> 0.13.49-1
changelog:
  - Update to 0.13.49 to fix CVE-2007-1614 (rhbz #233700).
  - Include new man3 pages to the devel sub-package.


author: Matthias Saou <http://freshrpms.net/> 0.13.49-2
changelog:
  - Disable static lib build instead of excluding it later.
  - Remove rpath on 64bit archs.
  - Switch to using DESTDIR install method.


author: Matthias Saou <http://freshrpms.net/> 0.13.49-4
changelog:
  - Include patch to fix fd.open calls with recent glibc.
  - Disable _smp_mflags since the docs fail to build.


author: Matthias Saou <http://freshrpms.net/> 0.13.59-1
changelog:
  - Update to 0.13.59.
  - Remove no longer needed 'open' patch.
  - Rebase the multilib patch, still required.
  - Re-enable _smp_mflags, build works again with it apparently.


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.13.69-1
changelog:
  - Update to 0.13.69 release
  - Fixes: #1598246 (CVE-2018-6541)
  - Fixes: #1554673 (CVE-2018-7727)
  - Use versioned python executables everywhere


author: Jakub Martisko <jamartis@redhat.com> - 0.13.69-4
changelog:
  - Add the missing CVE-2018-17828.part2.patch file
  - Fix Formating of the previous 2 changelog entries


author: Jakub Martisko <jamartis@redhat.com> - 0.13.71-1
changelog:
  - Rebase to 0.13.71
  - Drop the CVE patches, they are now part of the upstream package
  - Build no longer requires python2
  - Resolves: 1807565


