# changelog

author: Kun Lai <laikun@linux.alibaba.com> - 0.2.0-1
changelog:
  - RPM Build Improvements:
    * Add cryptpilot-convert to RPM package
    * Fix RPM build in Docker environments without TTY
    * Separate cargo configuration from .spec file
    * Add static binary build support
    * Update dependency names for aa and cdh

  - Feature Enhancements:
    * Add OIDC Key Provider Plugin (contributed by xynnn007)
    * Support configuration loading from cloud-init
    * Add runtime measurement based on AAEL
    * Implement dynamic log level adjustment (switch to tracing framework)

  - Service Optimizations:
    * Optimize automatic decryption flow during initrd stage
    * Fix systemd service dependencies
    * Add emergency shell fallback for boot failures
    * Improve console logging output

  - Security Improvements:
    * Omit sensitive information in logs
    * Enforce verification of /sysroot mount source
    * Add timeout handling for KBS client

  - Documentation & CI:
    * Add CI and license badges to README
    * Implement GitHub Actions RPM build workflow
    * Fix missing LICENSE file inclusion

  - Bug Fixes:
    * Fix grub2-mkconfig failures under overlayfs
    * Resolve device busy issues during conversion
    * Fix builds on stable Rust versions
    * Correct Alibaba Cloud Linux 3 UEFI conversion issues


author: Kun Lai <laikun@linux.alibaba.com> - 0.2.1-1
changelog:
  - Add OIDC key provider Plugin
  - Fix path of confidential-data-hub
  - Fix failed to launch containers due to overlayfs
  - Not install attestation-agent as dependency unless user install it


author: Kun Lai <laikun@linux.alibaba.com> - 0.2.2-1
changelog:
  - Fix TLS support in dracut initrd
  - Add RUST_LOG environment variable to control log level
  - Fix udev env SYSTEMD_READY=0 when integrity is on


author: Kun Lai <laikun@linux.alibaba.com> - 0.2.3-1
changelog:
  - Add new key provider plugin type "exec"
  - Fix wrong lvm part size in disk image converted by cryptpilot-convert
  - Change systemd service in initrd from RequiredBy to WantedBy for weaker dependency


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 3.6.9-1
changelog:
  - Update to 3.6.9 to fix CVE-2024-52333 CVE-2024-34509 CVE-2024-27628
  - Delete patch as CVE-2022-43272 fixed in 3.6.9
  - Add patch to place in correct locations


author: lzq11122 <lzq02303433@alibaba-inc.com> - 3.7.0-1
changelog:
  - Update to 3.7.0 for fix CVE-2025-9732 CVE-2025-14841 and CVE-2025-14607
  - Remove patch  new version included


author: zhoujiajia111 <zjl02254423@alibaba-inc.com> - 26.2.5.15-1
changelog:
  - Update to version 26.2.5.11 to fix CVE-2025-48038,CVE-2025-48040,CVE-2025-48041,CVE-2025-48039
  - Remove CVE-2025-4748 patch fixed in new version


author: GreatSQL <greatsql@greatdb.com> - 8.0.32-27.3
changelog:
  - greatsql-mysql-config was removed previously, my.cnf was moved
    into greatsql-server package without conflicts and obsoletes
  - add /usr/lib64/mysql/private into ld.so.conf.d/mysql-x86_64.conf


author: GreatSQL <greatsql@greatdb.com> - 8.0.32-27.5
changelog:
  - remove greatsql-test, greatsql-tokudb, greatsql-rocksdb package
  - updated conflict declarations with MySQL/MariaDB/Percona
  - new file /etc/greatsql.cnf for GreatSQL
  - remove some duplicate requires
  - change PROTOBUF=bundled to system
  - add new library libfido2.so
  - fixed several incorrect conflict declarations


author: GreatSQL <greatsql@greatdb.com> - 8.0.32-27.7
changelog:
  - add conflicts and obsoletes on greatsql-test/greatsql-icu-data-files package
  - remove greatsql-icu-data-files package


author: zhongling.h <zhonglingh@linux.alibaba.com> - 0.4.0-1
changelog:
  - downgrade to be compatible with gast 0.4.0, which is the max possible version supported by tensorflow2


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 9.9.5.90363-1
changelog:
  - to #IBCMZV
  - update to 9.9.5.90363 for fix CVE-2024-47910
  - Project: TC2024080204
  - Signed-off-by: mgb01105731 mgb01105731@alibaba-inc.com


author: Kun Lai <laikun@linux.alibaba.com> - 1.0.6
changelog:
  - Add control interface with RESTful API for checking status of tng instances
  - Add metric exporter (open-falcon, stdout) for metrics reporting
  - Update rats-rs to handle "jwk" field in JWT header, so that tng can be used with CoCo Trustee
  - Some improvements on artifacts building and testing workflow


author: Kun Lai <laikun@linux.alibaba.com> - 2.1.0-1
changelog:
  - Fixed the issue of using incorrect spans in some async tasks during request handling.
  - Add traces exporter (otlp, stdout) for traces reporting.
  - Add the "refresh_interval" field in the configuration to control the evidence caching strategy.
  - Add a RESTful control interface ("/readyz", "/livez") to check the status of tng instances.
  - Add metrics exporter (otlp, falcon, stdout) for metrics reporting.
  - Fix the behavior of the "domain" field in "ingress/http_proxy" and added the "domain_regex" field.


author: Kun Lai <laikun@linux.alibaba.com> - 2.2.0-1
changelog:
  - Add new ingress type "netfilter" with cgroup match support.
  - Add systemd service file.
  - Fix error when io stream is closed by peer in egress.
  - Fix connection refused caused by wrong listen address in netfilter mode egress.
  - Fix missing authority header when forwarding http request in http_proxy mode ingress.
  - Fix path_rewrites feature.
  - Fix decap_from_http.allow_non_tng_traffic_regexes feature.


