# changelog

author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.24-1
changelog:
  - Rebase to upstream scap-security-guide-0.1.24 version
  - Start producing the -doc subpackage to provide the HTML formatted
    documents containing security guides generated from shipped XCCDF benchmarks


author: Martin Preisler <mpreisle@redhat.com> 0.1.24-2
changelog:
  - Break-down firewalld rule description for Red Hat Enterprise Linux 7 product
    into multiple lines, prevents HTML guide UX issues


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.24-3
changelog:
  - Add remediation script for 'accounts_passwords_pam_faillock_unlock_time' rule
    for Red Hat Enterprise Linux 7 product
  - Override title and description for all existing profiles for Red Hat
    Enterprise Linux 6 product that are extending another SCAP profile
    (RHBZ#1246529)
  - Correct various issues in the included Oscap Anaconda Addon PCI-DSS profile
    kickstart file for Red Hat Enterprise Linux 7 product
  - Add remediation script for 'audit_rules_time_clock_settime' rule for
    Red Hat Enterprise Linux 7 product
  - Add remediation scripts for 'audit_rules_time_adjtimex',
    'audit_rules_time_settimeofday', and 'audit_rules_time_stime' rules for
    Red Hat Enterprise Linux 7 product
  - Tag current PCI-DSS profile for Red Hat Enterprise Linux 7 product with
    "Draft" label
  - Disable the following rules in the PCI-DSS profile for the Red Hat Enterprise
    Linux 7 product:
    * dconf_gnome_screensaver_idle_delay -- missing remediation script,
    * dconf_gnome_screensaver_idle_activation -- missing remediation script,
    * dconf_gnome_screensaver_lock_enabled -- missing remediation script,
    * audit_rules_login_events -- incorrect OVAL check (upstream issue #607),
    * audit_rules_privileged_commands -- missing remediation script, and
    * audit_rules_immutable -- missing remediation script.


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.25-3
changelog:
  - Drop "Verify and Correct File Permissions with RPM" rule from the PCI-DSS
    profile for Red Hat Enterprise Linux 7 (RH BZ#1267861)


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-1
changelog:
  - Update to upstream's 0.1.30 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30
    (RH BZ#1289533)
  - Drop remediation functions library since starting from 0.1.30 release
    remediation scripts are part of the benchmarks directly
  - Drop three patches that have been accepted upstream in the meantime
  - Update drop-rpm-verify-permissions-rule patch to work properly against
    0.1.30 release


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-2
changelog:
  - Fix issue of two STIG profiles for Red Hat Enterprise Linux 6 benchmark
    having the identical title (RH BZ#1351541)
  - Enhance the shared OVAL check for 'Set Deny For Failed Password Attempts'
    rule and also Red Hat Enterprise Linux 7 OVAL check for 'Configure the root
    Account for Failed Password Attempts' rule to report correct system status
    WRT to these requirements also in the case the SSSD daemon is used
    (RH BZ#1344581)
  - Include currently available kickstart files and produced HTML tables for
    Red Hat Enterprise Linux 6 and 7 products into the produced RPM package
    (RH BZ#1351751)


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.30-3
changelog:
  - Correct the remediation script for 'Enable Smart Card Login' rule
    for Red Hat Enterprise Linux 7 (RH BZ#1357019)


author: Watson Sato <wsato@redhat.com> 0.1.30-5
changelog:
  - Fix template remediation function used by SSHD remediation
  - Reduce scope of patch that fixes SSHD remediation (RH BZ#1415152)


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.35-1
changelog:
  - Update to upstream release 0.1.35
  - Remove Red Hat Enterprise Linux 5 content due to being End-of-Life March 31, 2017
  - Added several templates for OVAL checks
  - Many optimizations in build process
  - Different title for PCI-DSS Benchmark variants
  - Remediation roles moved to /usr/share/scap-security
  - Fix duplicated roles and guides (RHBZ#1465691)


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-1
changelog:
  - Update to upstream release 0.1.36
  - Introduction of SCAP Security Guide Test Suite
  - Better alignment of RHEL6 and RHEL7 with DISA STIG
  - Remove JBoss EAP5 content due to being End-of-Life
  - New STIG Profile for JBOSS EAP 6
  - Updates in C2S Profile for RHEL 7
  - Variables can be directly tailored in Ansible roles
  - Content presents less false positives in containers
  - Changes in directory layout


author: Matěj Týč <matyc@redhat.com> - 0.1.36-5
changelog:
  - Patched not to check library ownership in libexec.
  - Patched to fix title of DISA STIG profile.
  - Patched to deprecate RhostsRSAAuthentication.
  - Patched to fix umask_for_daemons.


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-7
changelog:
  - Fix sshd_required unset (RHBZ#1522956)
  - Fix missing bash remediation functions include (RHBZ#1524738)
  - Fix empty columns in SRG HTML Table (RHBZ#1531105)
  - Fix reference to oudated PAM config manual (RHBZ#1447760)


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-8
changelog:
  - Allow AIDE to notify other emails than only root (RHBZ#1571315)
  - Fix some failing rules from profiles PCI-DSS, DISA STIG and USGCB (RHBZ#1571312)
  - Fix kernel module loading rules (RHBZ#1571319)


author: Matěj Týč <matyc@redhat.com> - 0.1.40-3
changelog:
  - Don't generate remediations for Anaconda for /dev/cdrom mount point (RHBZ#1618840)
  - Install dracut-fips when fips mode is enabled in the profile (RHBZ#1587911)


author: Matěj Týč <matyc@redhat.com> - 0.1.40-6
changelog:
  - Applied a batch of patches that improve OSPP 4.2 profile support for RHEL7 (RHBZ#1619689)
  - Fixed the xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled check (RHBZ#1609122)


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.40-8
changelog:
  - Add Bash remediation for rule grub2_audit_arguments (RHBZ#1619689)
  - Allow remediation for rule dconf_gnome_screensaver_lock_delay to fix commented settings (RHBZ#1609122)
  - Select missing audit rules for privileged commands for OSPP4.2 Profile (RHBZ#1619689)


author: Matěj Týč <matyc@redhat.com> - 0.1.40-11
changelog:
  - Fixes for RHBZ#1619689:
  - Added support for kernel parameters yama.ptrace_scope, kptr_restrict, dmesg_restrict and kexec_load_disabled.
  - Added support for boot parameters audit_backlog_limit=8192, slub_debug=P, page_poison=1 and vsyscall=none.
  - Added support for proper /dev/shm handling (noexec,nosuid,nodev,mode=1777)
  - Added support for checking that sendmail and abrt are not installed.
  - Introduced OSPP to the OSPP profile title.
  - Disabled linkcheck tests during the build.


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.40-13
changelog:
  - Added support to platform tag and mark rules as machine only (RHBZ#1698752)
  - Fix content support for UBI-Minimal (RHBZ#1698751)


author: Watson Sato <wsato@redhat.com> - 0.1.49-7
changelog:
  - Bug fixes on CIS profile (RHBZ#1821633)
    Added Ansible remediations
    Fixed CIS references
    Fixed integration issues with CIS profile


author: Watson Sato <wsato@redhat.com> - 0.1.49-9
changelog:
  - CIS Profile fixes (RHBZ#1821633)
    - Fix Ansible mount_option template
    - Add Ansible for ensure_logrotate_activated
    - Add warnings to rpm_verify_permissions and ownership about findindings that may need further inspection


author: Watson Sato <wsato@redhat.com> - 0.1.49-10
changelog:
  - CIS Profile fixes (RHBZ#1821633)
    - Fix Ansible mount_option template
    - Re-order rpm_verify_permissions to avoid file permission conflicts


author: Watson Sato <wsato@redhat.com> - 0.1.49-11
changelog:
  - HIPAA Profile improvement (RHBZ#1513087)
    - Add Ansible remediation for audit_rules_system_shutdown


author: Watson Sato <wsato@redhat.com> - 0.1.49-12
changelog:
  - CIS Profile (RHBZ#1821633)
    - Make sure boot target is multi-user.target when xorg package is removed
    - Add CIS Profile content attribution to Center for Internet Security


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.52-1
changelog:
  - Update to the latest upstream release (RHBZ#1665233)
  - Update RHEL7 DISA STIG to V2R8 (RHBZ#1665233)


author: Watson Sato <wsato@redhat.com> - 0.1.54-1
changelog:
  - Rebase to incorporate ANSSI Profile (RHBZ#1497415)
  - Update RHEL7 STIG profile to V3R2 (RHBZ#1921643)
  - Add Minimal, Intermediary and Enhanced ANSSI Profiles (RHBZ#1497415)


author: Watson Sato <wsato@redhat.com> - 0.1.54-2
changelog:
  - Remove Kickstart for not shipped profile (RHBZ#1497415)
  - Fix STIG id reference format for sshd_x11_use_localhost (RHBZ#1921643)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.54-5
changelog:
  - Create subpackage to hold ansible playbooks per rule (RHBZ#1966589)
  - Fix Bash remediation of dconf_gnome_login_retries (RHBZ#1967566)


author: Jan Černý <jcerny@redhat.com> - 0.1.57-1
changelog:
  - Rebase to the 0.1.57 upstream release
  - Update RHEL7 DISA STIG profile to v3r4 (RHBZ#1996678)
  - Split CIS profile (RHBZ#1953787)


author: Watson Sato <wsato@redhat.com> - 0.1.57-7
changelog:
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix name of antivirus package in STIG profile (RHBZ#2066321)
  - Update RHEL7 DISA STIG profile to v3r7 (RHBZ#2079217)


author: Watson Sato <wsato@redhat.com> - 0.1.63-1
changelog:
  - Update to the latest upstream release (RHBZ#2116359)
  - Fix SSH Key permissions (RHBZ#2021258)
  - Remove PCI-DSS Benchmark(RHBZ2038165)
  - Updated source of CVE data feed(RHBZ#2028432)
  - Improved alignment with DISA's RHEL7 STIG(RHBZ#1967950)
  - Update RHEL7 STIG profile to v3r8 (RHBZ#2112939)
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix smartcard_auth rule for systems installed without authconfig (RHBZ#2116359)
  - Fix check of enable_fips_mode on s390x (RHBZ#2116359)
  - Fix applicability of pam_pkcs11 and grub2 rules on s390x (RHBZ#2116359)


author: Watson Sato <wsato@redhat.com> - 0.1.66-1
changelog:
  - Rebase to a new upstream release 0.1.66 (RHBZ#2158410)
  - Update RHEL7 STIG profile to V3R10 (RHBZ#2152657)
  - Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2123284)
  - Fix remediation of audit watch rules (RHBZ#2123367)
  - Fix check firewalld_sshd_port_enabled (RHBZ#2158410)
  - Fix accepted control flags for pam_pwhistory (RHBZ#2158410)
  - Unselect rule logind_session_timeout (RHBZ#2158410)
  - Add support rainer scripts in rsyslog rules (RHBZ#2170038)


author: Jan Černý <jcerny@redhat.com> - 0.1.69-1
changelog:
  - Rebase to the latest upstream release (RHBZ#2221694)
  - Make IPv6 related rules applicable only in case IPv6 is actually enabled. (RHBZ#2210276)
  - update ANSSI BP-028 profiles to be aligned with version 2.0 (RHBZ#2155793)
  - Correct URL used to download CVE checks. (RHBZ#2223817)


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.72-1
changelog:
  - Rebase to a new upstream release 0.1.72 (RHEL-25251)
  - Include filter to dracut files in audit_rules_privileged_commands rule (RHEL-11938)


author: Martin Preisler <mpreisle@redhat.com> 0.8.6-1
changelog:
  - Upgrade to upstream 0.8.6 version:
    https://fedorahosted.org/scap-workbench/query?milestone=0.8.6&status=closed
  - Require polkit


author: Lubos Kardos <lkardos@redhat.com - 20130529-8
changelog:
  - Modified paths of state and conf files
  - Add owning and creating of state and conf files if nfsmountable is defined
  - Add printing file names in error messages


author: Lubos Kardos <lkardos@redhat.com> - 20130529-10
changelog:
  - Allow to use vendor prefix in packages names
  - Include %nfsmountable macro into scl's rpm macros file


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-13
changelog:
  - bump the version to get in sync with 7.1 branch
  - Reflect the state of %nfsmountable macro in collections' rpm macro files
  - escape all the % chars in changelog


author: Jindrich Novy <jnovy@redhat.com> 20121110-1
changelog:
  - introduce sclbuild utility
  - fix exporting of env. variables when mutiple collections are
    enabled at the same time
  - better bash completion
  - fix changelog


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-2
changelog:
  - add scl_source script for intercollection dependencies (#1032444)
  - updated macros in macros.scl-filesystem (#1032451, #1032451)
  - add delimiter between collections and command (#1032460)
  - fix the name of attr macros (#1023628)


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-4
changelog:
  - fixed some coverity-reported bugs (related: #1032616)
  - a note about env. variables in man page (#968954)
  - drop the /var/spool/uucp from the default fs structure (#1033674)


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-6
changelog:
  Catch up with Fedora and RHEL6
  - add automatic Provides: scl-package(%scl) to all scl packages
    (except for metapackages)
  - add automatic Requires: %scl_runtime to all scl packages
    (except for metapackages)
  - the "filesystem" file renamed back to "filelist"
  - add correct dependencies to debug packages.
  - allow disabling debuginfo generation
  - remove automatic creation of debuginfo for metapackage.
  - rephrase command description in man page
  - fix system paths in __os_install_post
  - remove the sclbuild utility, as it's mostly useless
  - add the command set to register/deregister collection
  - fix missing allocation check in read_script_output()
  - drop recursive ownership of /usr/lib within SCL root
  - introduce %scl_dependency_generators macro


author: Lubos Kardos <lkardos@redhat.com - 20130529-7
changelog:
  Support for importing collections from NFS mounts
  - Add execution of register and deregister scripts during registration
    and deregistration if they exist.
  - Add capability to make collection nfs mountable using macro nfsmountable.


author: Petr Hracek <phracek> - 4.1.0-0.20.20120314git3c2946
changelog:
  - Multiple packages are installing files under /etc/tmpfiles.d
  - comply http://fedoraproject.org/wiki/Packaging:Guidelines#Tmpfiles.d
  - Resolves: rhbz#1121958


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-2.el7
changelog:
  - seabios-fw-pci-add-Q35-S3-support.patch [bz#1185721]
  - Resolves: bz#1185721
    (win7 guest (boot with q35) show dark screen after do S3)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-3.el7
changelog:
  - seabios-redhat-reserve-more-memory-on-fseg.patch [bz#1327060]
  - seabios-redhat-turn-off-some-config-options.patch [bz#1327060]
  - Resolves: bz#1327060
    ([Seabios]Limited boot number supported for SCSI/SATA)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-4.el7
changelog:
  - seabios-Build-vgabios-virtio.bin.patch [bz#1327001]
  - Resolves: bz#1327001
    (vgabios-virtio.bin should be included  in seavgabios-bin package)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7
changelog:
  - seabios-pci-don-t-map-virtio-1.0-storage-devices-above-4G.patch [bz#1373154]
  - Resolves: bz#1373154
    (Guest fails boot up with ivshmem-plain and virtio-pci device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7_3.1
changelog:
  - seabios-vgabios-Reorder-video-modes-to-work-around-a-Windows.patch [bz#1392028]
  - Resolves: bz#1392028
    ([virtio-win][svvp][ws2016] cannot generate dump file when using nmi on ws2016 and win10-32/64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.1-2.el7
changelog:
  - seabios-smm-disable-by-default.patch [bz#1378006]
  - seabios-ahci-Set-upper-32-bit-registers-to-zero.patch [bz#1418320]
  - Resolves: bz#1378006
    (guest paused on target host sometimes when do migration during guest boot)
  - Resolves: bz#1418320
    (Seabios does not fully reset AHCI adapters)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.2-2.el7
changelog:
  - seabios-resume-Don-t-attempt-to-use-generic-reboot-mechanism.patch [bz#1428347]
  - Resolves: bz#1428347
    (reboot hangs on rhel6 machine types (~1/20 times))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.2-3.el7
changelog:
  - seabios-blockcmd-accept-only-disks-and-CD-ROMs.patch [bz#1020622]
  - seabios-blockcmd-generic-SCSI-luns-enumeration.patch [bz#1020622]
  - seabios-virtio-scsi-enumerate-luns-with-REPORT-LUNS.patch [bz#1020622]
  - seabios-usb-uas-enumerate-luns-with-REPORT-LUNS.patch [bz#1020622]
  - Resolves: bz#1020622
    (seabios fail to recognize virtio-scsi device if specify LUN not 0)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.10.2-3.el7_4.1
changelog:
  - seabios-virtio-IOMMU-support.patch [bz#1472131]
  - Resolves: bz#1472131
    (Guest OS will down when disk enable the IOMMU for Virtio)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.2.2-11.el7
changelog:
  - seabios-init_virtio_scsi-reset-the-HBA-before-freeing-its-vi.patch [bz#1013418]
  - seabios-smbios-catch-zero-length-strings.patch [bz#1052837]
  - seabios-resume-restore-piix-pm-config-registers-after-resume.patch [bz#1049860]
  - seabios-pci-align-64bit-pci-regions-to-1G.patch [bz#1055832]
  - seabios-pci-log-pci-windows.patch [bz#1055832]
  - seabios-pci-improve-io-address-space-allocation.patch [bz#1055832]
  - Resolves: bz#1013418
    (qemu-kvm with a virtio-scsi controler without devices attached quits after stop/cont in HMP/QMP)
  - Resolves: bz#1049860
    (Guest agent command hang there after restore the guest from the save file)
  - Resolves: bz#1052837
    (The wrong DMI structures could not be decoded while booting vm with -smbios params)
  - Resolves: bz#1055832
    (can not see seabios GUI when boot with 155 virtio-blk-pci disks via pci-bridge)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-2.el7
changelog:
  - seabios-Build-seabios-as-noarch.patch [bz#1118380]
  - Resolves: bz#1118380
    (Seabios build required for ppc64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-4.el7
changelog:
  - seabios-smbios-set-bios-vendor-version-fields-to-Seabios-0.5.patch [bz#1123299]
  - Resolves: bz#1123299
    (smbios table 0 vendor string should be Seabios (for rhel6 compatibility) [7.1+7.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-5.el7
changelog:
  - seabios-Workaround-for-a-win8.1-32-S4-resume-bug.patch [bz#1050775]
  - seabios-boot-Fix-boot-order-for-SCSI-target-lun-9.patch [bz#1096560]
  - Resolves: bz#1096560
    (fail to assign correct order for the boot device in seabios as we specified the bootindex in qemu-kvm cli(under the same virtio-scsi-pci))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-6.el7
changelog:
  - seabios-Extend-ExclusiveArch-to-power64-architectures.patch [bz#1163924]
  - Resolves: bz#1163924
    (seabios is needed for ppc64 and ppc64le but marked ExclusiveArch aarch64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-8.el7
changelog:
  - seabios-turn-off-stack-switching-for-vgabios.patch [bz#1182634]
  - Resolves: bz#1182634
    (Remove CONFIG_VGA_ALLOCATE_EXTRA_STACK)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-9.el7_1
changelog:
  - seabios-boot.c-delay-exiting-boot-if-menu-key-is-ESC.patch [bz#841638]
  - seabios-boot-switch-default-menu-key-to-ESC.patch [bz#841638]
  - Resolves: bz#841638
    (Provide a platform agnostic approach to invoking the BIOS, boot menu, or other BIOS functions)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.7.5-10.el7
changelog:
  - seabios-fw-pci-scan-all-buses-if-extraroots-romfile-is-prese.patch [bz#1235381]
  - seabios-fw-pci-map-memory-and-IO-regions-for-multiple-pci-ro.patch [bz#1235381]
  - Resolves: bz#1235381
    (RFE: configure guest NUMA node locality for guest PCI devices)


author: Yash Mankad <ymankad@redhat.com> - 1.7.5-11.el7
changelog:
  - seabios-bootorder-Update-extra-pci-root-buses-bootorder-form.patch [bz#1242968]
  - Resolves: bz#1242968
    (pci: support booting of devices behind PXB)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7_3.2
changelog:
  - seabios-acpi_extract-Move-main-code-to-new-function-main.patch [bz#1400102]
  - seabios-acpi_extract-Make-the-generated-.hex-files-more-huma.patch [bz#1400102]
  - seabios-acpi_extract-Don-t-generate-unused-and-empty-q35-acp.patch [bz#1400102]
  - seabios-acpi-Don-t-build-SSDT-files-on-every-build-store-the.patch [bz#1400102]
  - Resolves: bz#1400102
    (decouple the SeaBIOS build from iasl)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7_3.3
changelog:
  - seabios-resume-Make-KVM-soft-reboot-loop-detection-more-flex.patch [bz#1440706]
  - seabios-resume-Don-t-attempt-to-use-generic-reboot-mechanism.patch [bz#1440706]
  - Resolves: bz#1440706
    (reboot hangs on rhel6 machine types (~1/20 times))


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-163
changelog:
  - Allow sssd_t to read realmd lib files.
  Resolves: rhbz#1436689
  - Add permission open to files_read_inherited_tmp_files() interface
  Resolves: rhbz#1290633
  Resolves: rhbz#1457106


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-164
changelog:
  - Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
  Resolves: rhbz#1424621
  - Add interface lvm_manage_metadata
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166
changelog:
  - Add new boolean gluster_use_execmem
  Resolves: rhbz#1469027
  - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
  Resolves: rhbz#1468581


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166.6
changelog:
  - Allow tomcat domain to connect to mssql port
  Resolves: rhbz#1500697
  - Add keepalived domain setpgid capability
  Resolves: rhbz#1500813


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166.7
changelog:
  - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
  Resolves: rhbz:#1513075


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-186
changelog:
  - Allow virt_domains to acces infiniband pkeys.
  Resolves: rhbz#1533183
  - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t
  Resolves: rhbz#1535133
  - Allow audisp_remote_t domain write to files on all levels
  Resolves: rhbz#1534924


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-187
changelog:
  - Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets
  Resolves: rhbz#1535196
  - Add new interface ppp_filetrans_named_content()
  Resolves: rhbz#1530601
  - Allow keepalived_t read sysctl_net_t files
  Resolves: rhbz#1477542
  - Allow puppetmaster_t domtran to puppetagent_t
  Resolves: rhbz#1376893
  - Allow kdump_t domain to read kernel ring buffer
  Resolves: rhbz#1540004
  - Allow ipsec_t domain to exec ifconfig_exec_t binaries.
  Resolves: rhbz#1539416
  - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock
  Resolves: rhbz#1530601
  - Allow updpwd_t domain to create files in /etc with shadow_t label
  Resolves: rhbz#1412838
  - Allow iptables sysctl load list support with SELinux enforced
  Resolves: rhbz#1535572


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-188
changelog:
  - Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t
  Resolves: rhbz#1540702
  - Allow keepalived_t domain getattr proc filesystem
  Resolves: rhbz#1477542
  - Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t
  Resolves: rhbz#1538544
  - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t
  Resolves: rhbz:#1539416
  - Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t
  Resolves: rhbz#1479350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-189
changelog:
  - Allow dirsrv_t domain to create tmp link files
  Resolves: rhbz#1536011
  - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t
  Resolves: rhbz#1428568
  - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries
  - Allow ipsec_mgmt_t nnp domain transition to ifconfig_t
  Resolves: rhbz#1539416


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-190
changelog:
  - Allow openvswitch domain to manage svirt_tmp_t sock files
  Resolves: rhbz#1540702
  - Fix broken systemd_tmpfiles_run() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-192
changelog:
  - Label /usr/libexec/dbus-1/dbus-daemon-launch-helper  as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled.
  Resolves: rhbz#1546721


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.3
changelog:
  - Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.4
changelog:
  - Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging'
  Resolves: rhbz#1638427


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.5
changelog:
  - Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.6
changelog:
  - Allow nova_t domain to use pam
  Resolves: rhbz:#1645270
  - sysstat: grant sysstat_t the search_dir_perms set
  Resolves: rhbz#1645271


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.8
changelog:
  - Add interface domain_rw_all_domains_keyrings()
  Resolves: rhbz#1665815
  - Allow gssd_t domain to read/write kernel keyrings of every domain.
  Resolves: rhbz#1665815


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.9
changelog:
  - Allow gssd_t domain to manage kernel keyrings of every domain.
  Resolves: rhbz#1665815
  - Add new interface domain_manage_all_domains_keyrings()
  Resolves: rhbz#1665815


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.11
changelog:
  - Update nagios_run_sudo boolean with few allow rules related to accessing sssd
  Resolves: rhbz#1692893


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.14
changelog:
  - Allow nrpe_t domain to read process state of systemd_logind_t
  - Alow nrpe_t to send signull to sssd domain when nagios_run_sudo boolean is turned on
  - Allow nrpe_t domain to be dbus cliennt
  - Allow ngaios to use chown capability
  Resolves: rhbz#1692893


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-225
changelog:
  - Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs
  Resolves: rhbz#1627114
  - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t
  Resolves: rhbz#1567753


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-226
changelog:
  - Allow tomcat servers to manage usr_t files
  Resolves: rhbz#1625678
  - Dontaudit tomcat serves to append to /dev/random device
  Resolves: rhbz#1625678
  - Allow sys_nice capability to mysqld_t domain
  - Allow dirsrvadmin_script_t domain to read httpd tmp files
  Resolves: rhbz#1622602
  - Allow syslogd_t domain to manage cert_t files
  Resolves: rhbz#1615995


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-227
changelog:
  - Add interface apache_read_tmp_dirs()
  - Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs
  Resolves: rhbz#1622602


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-228
changelog:
  - Allow tomcat_domain to read /dev/random
  Resolves: rhbz#1631666
  - Allow neutron_t domain to use pam
  Resolves: rhbz#1630318


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-249
changelog:
  - Allow nrpe_t domain to read process state of systemd_logind_t
  - Add interface systemd_logind_read_state()
  Resolves: rhbz#1653309


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-252.4
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command.
  Resolves: rhbz#1766095


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-258
changelog:
  - Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessions
  Resolves: rhbz#1688729
  - Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t label
  Resolves: rhbz#1658319


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-259
changelog:
  - Allow ganesha_t domain to read system network state and connect to cyphesis_port_t
  Resolves: rhbz#1653857
  - Label /var/log/collectd.log as collectd_log_t
  - Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessions
  Resolves: rhbz#1688729
  - Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t label
  Resolves: rhbz#1658319
  - Update sbd policy to allow manage cgroups
  Resolves: rhbz#1715136
  - Allow sudo userdomain to run rpm related commands
  - Update rpm_run() interface to avoid duplicate role transition in sudo_role_template
  Resolves: rhbz#1651253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-261
changelog:
  - Update sudo_role_template() to allow caller domain to read syslog pid files
  Resolves: rhbz#1651253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-264
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command
  Resolves: rhbz#1765063


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-267
changelog:
  - Allow chronyd_t domain to exec shell
  Resolves: rhbz#1775573
  - Allow pmie daemon to send signal pcmd daemon
  Resolves: rhbz#1770123
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1780332


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268
changelog:
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1837461
  - Allow ipa-adtrust-install restart sssd and dirsrv services
  Resolves: rhbz#1820298
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1824625
  - selinux policy: add the right context for org.freeipa.server.trust-enable-agent
  Related: rhbz#1820298


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268.2
changelog:
  - Allow certmonger add new entries in a generic certificates directory
  Resolves: rhbz#1879496
  - Allow slapd add new entries in ldap certificates directory
  Resolves: rhbz#1879496
  - Add miscfiles_add_entry_generic_cert_dirs() interface
  Resolves: rhbz#1879496


author: Petr Lautrbach <plautrba@redhat.com> 3.2.24-1.1
changelog:
  - Stop sending syslog.LOG_DEBUG Messages unless loglevel is set to debug
  - Add the policy rpm string to the user comments of an already reported bug from jfilak@redhat.com
  - Remove at_console lines from policykit so cockpit can use dbus interfaces.
  - Fix handling of target paths that decode screws up
  - Provide the policy rpm in Bugzilla bug reports by jfilak@redhat.com
  - setroubleshootd is set to be run as setroubleshoot user instead of root user
  - translations updated from https://fedora.zanata.org/project/view/setroubleshoot


author: Dan Walsh <dwalsh@redhat.com> - 3.0.52-1
changelog:
  - Update Translations
  - Only translate catchall_boolean descritpions if the are not unicode to start with.


author: Dan Walsh <dwalsh@redhat.com> - 3.0.53-1
changelog:
  - Update Translations
  - Add sandbox_connect plugin to point out the use of alternate types with the sandbox -X command.


author: Dan Walsh <dwalsh@redhat.com> - 3.0.57-1
changelog:
  - Add restorecon_source plugin, to check the source program is labeled correclty.
  - Fix restorecon.py to handle customized_files properly.
  - Update Translations


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-3
changelog:
  - add more securetty required for mainframes (#1067347)
  - set SHELL envvar to /bin/bash in bashrc (#1063552)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-5
changelog:
  - reserve uidgid pair 142:142 for activemq (#1086923)
  - add xfs to /etc/filesystems, fallback to /proc/filesystems
    (#1123832)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-6
changelog:
  - change reservation of 185:185 to jboss user (#1192413)
  - reserve uidgid pair 167:167 for ceph (#1221043)
  - reserve uidgid for systemd-network(192:192) (#1213820)
  - reserve uidgid for systemd-resolve(193:193) (#1213820)
  - mention systemd-jounal-gateway can be dynamic (#1213820)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-7
changelog:
  - add basic empty subuid/subgid files for docker (#1311278)
  - specify full path to utilities in /etc/profile and /etc/bashrc
    (#1331871)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-8
changelog:
  - fix group id for tape in /etc/group (should be 33) (#1433020)
  - provide a way how to override set envvars through sh.local file(#1344007)
  - provide a way how to override set ennvars through csh.local file


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-10
changelog:
  - fix crudp name in /etc/protocols (#1566469)
  - do not list /sbin/nologin and /usr/sbin/nologin in /etc/shells
    (#1571104)


author: Ondrej Vasik <ovasik@redhat.com> 2.8.66-1
changelog:
  - assign :190 gid for systemd-journal (#918120)
  - assign 191:191 uidgid pair for systemd-journal-gateway (#918120)


author: Ondrej Vasik <ovasik@redhat.com> 2.8.67-1
changelog:
  - assign 166:166 uidgid pair for ceilometer (#923891)
  - change 187:187 reservation from openstack-heat
    to just heat(#923858)
  - longer shell names support caused by UsrMove to
    the /etc/shells (#922527)
  - drop gopher (uid 13, gid 30) from groups created by default
    -> dropped completely - no gopher server in Fedora (#918206)
  - drop dip (gid 40) from groups created by default
    -> moved to ppp (#918206)
  - drop uucp (uidgid 14) from groups created by default
    -> moved to uucp (#918206)
  - create cdrom, tape, dialout, floppy groups in setup(#919285)


author: Gris Ge <fge@redhat.com> 1.37-17
changelog:
  - Fix help documents of sg_requests, sg_senddiag and sg_write_buffer.
    (RHBZ #1359282, #1359286, #1359292)


author: Tomas Bzatek <tbzatek@redhat.com> 1:1.37-19
changelog:
  - Reorder 59-fc-wwpn-id.rules to run after 60-persistent-storage.rules (#1785303)
  - Fix the 59-fc-wwpn-id.rules syntax (#1750417)
  - Add 59-fc-wwpn-id.rules (#1684302)


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-6
changelog:
  - report error to stdout when SELinux context for home directory
    cannot be determined (#973647)
  - audit the changing home directory owner (#885797)
  - do not set the default SELinux MLS range (#852676)


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-8
changelog:
  - slightly more meaningful error messages if crypt() returns NULL (#988184)
  - explicit suid permissions


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-14
changelog:
  - label the newly created home dir correctly (#1077809)
  - mention that chage -d 0 forces password change (#1135010)
  - improve date parsing and error detecting in chage
  - avoid full group database scanning in newgrp in most common case
  - report error if usermod asked for moving homedir and it does not exist


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-16
changelog:
  - update auditing to cover more events and fix some incorrect audit
    records - patch by Steve Grubb (#1151580)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-19
changelog:
  - documentation fixes (#1292820)
  - usermod: make password unlocking compatible with passwd (#1185425)
  - usermod: disallow ':' in raw password setting (#1292815)
  - improve the gid and uid allocation mechanism (#1279321)
  - lastlog: add options to unexpire unused accounts (#1285547)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-25
changelog:
  - prevent creating users ".." or "." or with all numeric usernames (#1373645)
  - raise limit for passwd and shadow entry length but also prevent
    writing longer entries (#1422497)
  - consider also supplementary group membership in newgrp (#1425078)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-25.1
changelog:
  - re-allow all numeric usernames when SHADOW_ALLOW_ALL_NUMERIC_USER
    environment variable is set (#1651450)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-1
changelog:
  - rebase to current upstream release to bring newuidmap and newgidmap
  - re-allow all numeric usernames when SHADOW_ALLOW_ALL_NUMERIC_USER
    environment variable is set


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-2
changelog:
  - ignore LOGIN_PLAIN_PROMPT variable in login.defs
  - correct wrong SUB_UID/GID_COUNT default in manual page (#1690522)


author: Peter Jones <pjones@redhat.com> - 0.7-8
changelog:
  - Build -8 for arm as well.
    Related: rhbz#1100048
  - out-of-bounds memory read flaw in DHCPv6 packet processing
    Resolves: CVE-2014-3675
  - heap-based buffer overflow flaw in IPv6 address parsing
    Resolves: CVE-2014-3676
  - memory corruption flaw when processing Machine Owner Keys (MOKs)
    Resolves: CVE-2014-3677


author: Peter Jones <pjones@redhat.com> - 0.7-10
changelog:
  - Fix a couple more minor bugs aavmf has found in fallback.
    Related: rhbz#1190191
  - Build lib/ with the right CFLAGS
    Related: rhbz#1190191


author: Peter Jones <pjones@redhat.com> - 0.9-1
changelog:
  - Update to 0.9-1
  - Fix early call to BS->Exit()
    Resolves: rhbz#1115843
  - Implement shim on aarch64
    Resolves: rhbz#1100048
    Resolves: rhbz#1190191


author: Peter Jones <pjones@redhat.com> - 11-1
changelog:
  - Update to 11-1
    Related: rhbz#1310766
  - Fix regression in PE loader
    Related: rhbz#1310766
  - Fix case where BDS invokes us wrong and we exec shim again as a result
    Related: rhbz#1310766


author: Peter Jones <pjones@redhat.com> - 15-3
changelog:
  - Fight with binutils to try to get a binary without timestamps in it.  Again.
    Related: rhbz#1649270


author: Peter Jones <pjones@redhat.com> - 15-4
changelog:
  - Fight with binutils to try to get a binary without timestamps in it.
    Again, but without breaking aarch64 this time.
    Related: rhbz#1649270


author: Peter Jones <pjones@redhat.com> - 15-5
changelog:
  - Fix a couple more things that are breaking reproducability, and thus
    breaking external review.
    Related: rhbz#1649270


author: Peter Jones <pjones@redhat.com> - 15-6
changelog:
  - Rebuild for bug fixes and new signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Implement Lenny's workaround.
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-8.el7
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1862045
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 15-8.el7.cloudlinux
changelog:
  - CloudLinux de-branding: vanish db.x64.esl file and add securebootca.cer back.
  - Changes efidir to centos to avoid migration issues.


author: Peter Jones <pjones@redhat.com> - 0.7-7
changelog:
  - Make sure we use the right keys on Aarch64.
    (It's only a demo at this stage.)
    Related: rhbz#1100048


author: Peter Jones <pjones@redhat.com> - 0.7-8
changelog:
  - Build for aarch64 as well 
    Related: rhbz#1100048
  - out-of-bounds memory read flaw in DHCPv6 packet processing
    Resolves: CVE-2014-3675
  - heap-based buffer overflow flaw in IPv6 address parsing
    Resolves: CVE-2014-3676
  - memory corruption flaw when processing Machine Owner Keys (MOKs)
    Resolves: CVE-2014-3677


author: Peter Jones <pjones@redhat.com> - 0.7-10
changelog:
  - Rebuild for Aarch64 to get \EFI\BOOT\BOOTAA64.EFI named right.
    (I managed to fix the inputs but not the outputs in -9.)
    Related: rhbz#1100048


author: Peter Jones <pjones@redhat.com> - 0.7-14
changelog:
  - Pull in aarch64 build so they can compose that tree.
    (-14 to match -unsigned)
    Related: rhbz#1100048


author: Peter Jones <pjones@redhat.com> - 0.9-2
changelog:
  - Apparently I'm *never* going to learn to build this in the right target
    the first time through.
    Related: rhbz#1100048


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-1
changelog:
  - Add support for IDM's ID views
  - Allow searching SSSD-provided users as memberUid case-insensitevly
  - Resolves: #1151436


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-2
changelog:
  - Complete ID views support to BIND operation
  - Ignore ID views outside schema-compat subtrees
  - Use 389-ds API compatible with RHEL 7.0
  - Resolves: #1151436


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-6
changelog:
  - delay sending responses from compat tree after map cache search
  - Resolves: #1281748
  - fix processing of ID views
  - Resolves: #1281750, #1281752


author: Nalin Dahyabhai <nalin@redhat.com> - 0.49-1
changelog:
  - add {nis,schema-compat}-ignore-subtree and -restrict-subtree settings,
    which should let us avoid deadlocks when tasks are modifying data in
    the backend database (#1007451)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.50-1
changelog:
  - if we get an EPIPE while registering with rpcbind, try to reconnect and
    retransmit before giving up


author: Nalin Dahyabhai <nalin@redhat.com> - 0.51-1
changelog:
  - fix another request argument memory leak in NIS server (#1040159)
  - fix miscellaneous items found by static analysis


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-1
changelog:
  - correctly reflect whether or not we're built with transaction support in
    the module's nsslapd-pluginVersion attribute
  - fix a couple of should've-used-memmove()-instead-of-memcpy() cases which
    would hit when removing maps or groups of maps (#1043546/#1043638)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-3
changelog:
  - remove ExclusiveArch if %{rhel} is 7 or higher, because 389-ds-base gets
    built for everything now (#1055711)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-5
changelog:
  - backport correction to the default settings for hosts.byname and
    hosts.byaddr NIS maps, so that their data items start with the host's
    address rather than a name (#1090948)


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-8
changelog:
  - Fixed: #1473572
  - Changes of ID overrides now force clearing of affected SSSD cache entries on IPA master
  - Related: #1473577
  - Synchronize timeout-enabled code with ipa-extdom-extop


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-1
changelog:
  - Upstream release 0.56.5
  - Resolves: rhbz#1820124 When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming
  - Resolves: rhbz#1820122 ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED
  - Resolves: rhbz#1819018 ipa slapi-nis stack traces review request for LDAP server deadlock
  - Resolves: rhbz#1830894 Memory leak during search of idview overrides


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-4
changelog:
  - CVE 2021-3480:  slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1942937


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Resolves: rhbz#1978748
    Release adds following fixes:
    - Fix ID views integration
    - Fix base scope lookups
    - Bump NIS max dgram size to 8KB by default instead of 1KB
    - Allow to rebuild the compat tree


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-4
changelog:
  - Ignore updates from non-tracked subtrees during modify/modrdn/update
    to avoid deadlocks with retro changelog
  - Resolves: RHEL-11869


author: Michal Hlavinka <mhlavink@redhat.com> - 1:6.5-1
changelog:
  - smartmontools updated to 6.5
  - adds support for NVMe devices (#1369731)
  - minor spec cleanup (#1463148)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:7.0-1
changelog:
  - smartmontools updated to 7.0 (#1588532)
  - fixed detection of Device Statistics log with 256 sectors (#1590190)


author: Ondrej Kozina <okozina@redhat.com> - 0.1.5-1
changelog:
  - updated to latest upstream
  - allow whitespace in ALLOW_USERS and ALLOW_GROUPS in snapper's config
  - enable new pam module
  - patch: pam module installed in proper libdir


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-3
changelog:
  - enable btrfs compare using send/receive in libbtrfs
  - patch: adapt sources to change in libtrfs API (btrfs_read_and_process_send_stream)
  - Resolves: #1055579


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-5
changelog:
  - patch: Fix failure in invoking btrfs internal comparison of subvolumes
  - patch: Remove references to missing programs from man pages
  - Resolves: #1060806, #1063844


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-6
changelog:
  - patch: Add norecovery option mounting XFS read-only snapshot
  - patch: Fix ACL modification failure with XFS filesystem
  - patch: Sync SELinux context of .snapshots subvolume (btrfs only)
  - Resolves: #1064111, #1065969, #1069312


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-7
changelog:
  - patch: fix empty-pre-post cleanup algorithm
  - patch: add conditionals for btrfs library versions
  - Resolves: #1071973 #1142954


author: Ondrej Kozina <okozina@redhat.com> - 0.1.7-9
changelog:
  - patch: fix snapperd abort while passing large data over dbus
  - patch: workaround linkage issue on s390 and ppc64le
  - Resolves: #1229353


author: Ondrej Kozina <okozina@redhat.com> - 0.1.2-1.20130211git676556f
changelog:
  - updated to latest upstream version
  - fixed wrong include: "auto_ptr.h" -> <memory>
  - moved diffutils dependency to client


author: Ondrej Kozina <okozina@redhat.com> - 0.1.3-1.20130418git7ca81a2
changelog:
  - updatet to latest upstream version
  - add support to compare extended attributes ('xadiff' command)
  - add support to revert modificiations in file's extended attributes
  - patch: avoid useless build dependency on libattr-devel


author: Paul Wouters <pwouters@redhat.com> - 1.7.2.1-1
changelog:
  - Updated to 1.7.2.1 for CVE-2012-0219, rhbz#821553, rhbz#821688
  - Remove patch merged upstream
  - Remove --disable-fips from configure


author: Paul Wouters <pwouters@redhat.com> - 1.7.2.2-2
changelog:
  - Resolves: rhel#1017015 Use readline, not compat-readline5-devel
  - Added two patches fixing -Wformat issues
  - Enable hardened build
  - Cleanup obsolete spec file lines


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-2
changelog:
  - Change install directory to /usr/lib*/pkcs11/
  - Install pkcs11 module file
  - Use official upstream tar ball
  - Create ods user to own softhsm/token files
  - Enable migration tools (for epel6 softhsm-v1 installs)
  - Require p11-kit, nss-tools, for SoftHSM PKCS #11 Module file
  - Copy pk11install.c from coolkey package which is not built on all arches
  - Enable hardened build
  - Add upstream official source url
  - Add devel package
  - Excluding i686/ppc (make check fails and we are a leave package)
  - (thanks to Petr for jumping in for the initial build while I was too busy)


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-3
changelog:
  - Fix softhsm2-pk11install buid and post call
  - Do not use --with-objectstore-backend-db (causes issues on i686)


author: Petr Spacek <pspacek@redhat.com> - 2.0.0rc1-1
changelog:
  - Resolves: rhbz#1193892 Rebase to latest upstream version
  - i686/ppc/s390 architectures are now included in the build


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-27
changelog:
  - [plugin] pass stderr through _collect_cmd_output
  - split dependencies of bz1185990 fix from bz1185990 patch
    Resolves: bz1185990


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-29
changelog:
  - [openvswitch] capture the logs, db and OVS bridges details
    Resolves: bz1242507
  - [logs] fix reference to missing 'rsyslog_conf' variable
    Resolves: bz1249705
  - [sapnw] Add check if saphostctrl is not present, dont use Set
    Resolves: bz1195608
  - [Plugin] fix handling of symlinks in non-sysroot environments
    Resolves: bz1248672


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-35.1
changelog:
  - [ceph] collect /var/lib/ceph and /var/run/ceph
    Resolves: bz1291347
  - [sosreport] prepare report in a private subdirectory
    Resolves: bz1290954


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-36
changelog:
  - [ceph] collect /var/lib/ceph and /var/run/ceph
    Resolves: bz1260607
  - [sosreport] prepare report in a private subdirectory
    Resolves: bz1290955


author: Pavel Moravec <pmoravec@redhat.com> = 3.3-2
changelog:
  - [grub2] grub2-mkconfig loads ext4 and brctl kernel
    Resolves: bz1116670
  - [ceph] skip collecting of all keyring and bindpass files
    Resolves: bz1260607
  - [omsa] add omreport storage controller
    Resolves: bz1299603
  - [atomichost] fix collection of 'docker info' output
    Resolves: bz1302146
  - [monit] fix add_copy_spec() arguments
    Resolves: bz1356945
  - [virtwho] add new plugin for virt-who agent
    Resolves: bz1353552


author: Pavel Moravec <pmoravec@redhat.com> = 3.3-3
changelog:
  - [nodejs][nms]: new plugins
    Resolves: bz1368393
  - [docker]: Gather more data and expand plugin options
    Resolves: bz1351647


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-3
changelog:
  - [ceph] fix list formatting
    Resolves: bz1438269
  - [virsh] Handle properly cases when virsh commands fail
    Resolves: bz1444641
  - [openstack_*] fix issue with --verify option, extend pkglist for instack
    Resolves: bz1250346
  - [policies/redhat] accept 'oci' as a valid container type
    Resolves: bz1442078
  - [pacemaker] Collect user-defined logfile
    Resolves: bz1416535


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-4
changelog:
  - [libvirt] fix per-process cgroup collection
    Resolves: bz1148381
  - [ceph] exclude temporary mount locations from collection
    Resolves: bz1449904
  - [policies/redhat] make missing 'filesystem' package non-fatal
    Resolves: bz1393961


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-7
changelog:
  - [openstack plugins] Tripleo specific containerized services
    Resolves: bz1463635
  - [jars] Scan only /usr/{share,lib}/java by default
    Resolves: bz1482574
  - [gluster_block] Added new plugin gluster_block
    Resolves: bz1491964


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-12
changelog:
  - [openstack_cinder] check for api service running
    Resolves: bz1511087
  - [plugins] allow add_cmd_output to collect binary output
    Resolves: bz1515113


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-2
changelog:
  - [vdo] revise collected files
    Resolves: bz1509079
  - further updates to OSP plugins in containerized environment
    Resolves: bz1506908
  - [opendaylight] new plugin
    Resolves: bz1483414
  - collect all keystone domains
    Resolves: bz1491042
  - haproxy, etcd and docker tracebacks
    Resolves: bz1519267
  - [origin] fix typo in oc adm diagnostics
    Resolves: bz1463509
  - [postgresql] Call SCL pg_dump with proper path
    Resolves: bz1494420


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-4
changelog:
  - [pcp] really apply sizelimit to logs collected
    Resolves: bz1353873
  - [opendaylight] collect more logs and puppet config
    Resolves: bz1483414
  - [plugins] allow add_cmd_output to collect binary output
    Resolves: bz1494420
  - [openstack_ironic] collect drivers, ports and much more
    Resolves: bz1517767
  - [openstack_cinder] check for api service running
    Resolves: bz1506908


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-5
changelog:
  - [rabbitmq] Log collection when run in containerized OSP
    Resolves: bz1525620
  - [ipa] add KRA logs and correct PKI directories
    Resolves: bz1535390
  - [opendaylight] Enable plugin by puppet-opendaylight package
    Resolves: bz1483414
  - [etcd] Do not collect private etcd keys
    Resolves: bz1539038


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-7
changelog:
  - [kernel] Disable gathering /proc/timer* statistics
    Resolves: bz1568884
  - [openstack_octavia] Add new plugin
    Resolves: bz1568882
  - [ovirt-provider-ovn] A new plugin
    Resolves: bz1568960


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-8
changelog:
  - [docker] backport three container related patches
    Resolves: bz1580526
  - [ovn] add two OpenVSwitch plugins
    Resoles: bz1580525


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-2
changelog:
  - [archive] fix add_string()/do_*_sub() regression
    Resolves: bz1474976
  - [kernel] handle case when bpftool installed but not implemented
    Resolves: bz1559756


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-3
changelog:
  - [sosreport] Add mechanism to encrypt final archive
    Resolves: bz1594327
  - [archive] fix stat typo
    Resolves: bz1597532
  - [rhui] Fix detection of CDS for RHUI3
    Resolves: bz1596494


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-4
changelog:
  - [apparmor,ceph] fix typo in add_forbidden_path
    Resolves: bz1609135
  - [policies] sanitize report label
    Resolves: bz1608384
  - [policies,process] make lsof execution optional, dont call on RHOSP
    Resolves: bz1613806


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-5
changelog:
  - [rhv-log-collector-analyzer] Add new plugin for RHV
    Resolves: bz1600158
  - [kubernetes|etcd] Support OpenShift 3.10 deployments
    Resolves: bz1616030


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-6
changelog:
  - [archive] fix leading path creation
    Resolves: bz1624043
  - [atomic] Define valid preset for RHEL Atomic
    Resolves: bz1626159
  - [utilities] wait till AsyncReader p.poll() returns None
    Resolves: bz1623070


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-13
changelog:
  - [ovirt_node] New plugin for oVirt Node
    Resolves: bz1656732
  - [podman] Add support for gathering information on podman
    Resolves: bz1658570
  - [postgresql] Do not limit dump size
    Resolves: bz1658571


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-2
changelog:
  - [sos] bump release
    Resolves: bz1656812
  - [pcp] collect pmlogger without a sizelimit
    Resolves: bz1639166
  - [maas,mysql,npm,pacemaker,postgresql] fix plugopts data types
    Resolves: bz1697854
  - [foreman,satellite] increase plugin default timeouts
    Resolves: bz1697813
  - [sosreport] update sos.conf manpages
    Resolves: bz1311129
  - [openstack_instack] add ansible.log
    Resolves: bz1702802


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-3
changelog:
  - [katello] support both locations of qpid SSL certs
    Resolves: bz1711305
  - [plugins] add vdsm plugin
    Resolves: bz1706060


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-6
changelog:
  - [utilities] Fix high CPU usage and slow command collection
    Resolves: bz1736422
  - [sosreport,plugins] Stop plugin execution after timeout hit
    Resolves: bz1736424


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-7
changelog:
  - [ovirt_hosted_engine] Add gluster deployment and cleanup log
    Resolves: bz1751576
  - [vdsm]: Fix executing shell commands
    Resolves: bz1751577
  - [ovn_*] Add support to containerized setups, add commands
    Resolves: bz1751578


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-12
changelog:
  - [ovirt_node] New plugin for oVirt Node
    Resolves: bz1591433
  - [podman] Add support for gathering information on podman
    Resolves: bz1646698
  - [postgresql] Do not limit dump size
    Resolves: bz1656278


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-6
changelog:
  - [utilities] Fix high CPU usage and slow command collection
    Resolves: bz1733367
  - [sosreport,plugins] Stop plugin execution after timeout hit
    Resolves: bz1731007


author: Pavel Moravec <pmoravec@redhat.com> = 3.8-3
changelog:
  - [gluster] process files only from a statedump dir
    Resolves: bz1699381
  - [kernel] Don't collect trace file by default
    Resolves: bz1757662


author: Jan Jansky <jjansky@redhat.com> = 3.8-8
changelog:
  - Added Obsolete for leapp-repository-sos-plugin to solve
    conflicts during install/upgrade/downgrade of RPM.


author: Jan Jansky <jjansky@redhat.com> = 3.9-5
changelog:
  - [gluster] remove generated state files
    Resolves: bz1857697
  - [kubernetes] ignore blank+empty lines
    Resolves: bz1859885
  - [networking] remove 'ethtool -e' option for bnx2x NICs
    Resolves: bz1870379
  - [auditd] collect /etc/audisp
    Resolves: bz1871207
  - [policy] Fix several failure conditions with upload
    Resolves: bz1886432
  - [postgresql] reorganize postgres from SCL
    Resolves: bz1897903


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.3
changelog:
  - [candlepin/foreman] psql with --no-password
    Resolves: bz1932772
  - [foreman] proxy_password scrub in installer logs
    Resolves: bz1785813


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.4
changelog:
  - [candlepin/foreman] psql with --no-password
    Resolves: bz1932772
  - [pacemaker] password scrub fix
    Resolves: bz1903144
  - [filesys] never collect panfs
    Resolves: bz1886784
  - [openstack_ceilometer] backend_url protected
    Resolves: bz1892692


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.5
changelog:
  - [sssd] Add individual SSSD log files
    Resolves: bz1938932
  - [sssd] sssd plugin when sssd-common
    Resolves: bz1946641
  - [foreman] fix unmatched group in scrubbing installer logs
    Resolves: bz1956817
  - [foreman] Sizelimit foreman-maintain and installer logs
    Resolves: bz1964000
  - [pulpcore] add plugin for pulp-3
    Resolves: bz1956672


author: Barbora Vassova <bvassova@redhat.com> = 3.9-5.12
changelog:
  - [redhat] Change authentication method for RHEL
    Resolves: RHEL-21176
  - [rpm] Capture the output of 'rpm --showrc'
    Resolves: RHEL-2357
  - [candlepin] collect information about SCA
    Resolves: RHEL-22263
  - [foreman] scrub admin init password in installer logs
    Resolves: RHEL-22264


author: Jake Hunsaker <jhunsake@redhat.com> - 1.5-3
changelog:
  - Resolve race condition in cluster profile loading
  - Quote all options globally
  - RHBZ#1633515
  - RHBZ#1647955


author: Jake Hunsaker <jhunsake@redhat.com> - 1.6-3
changelog:
  - Fix local command execution
  - Fix quoting for non-root commands
  - Backport Satellite support
  - Backport RHCOS support


author: Jake Hunsaker <jhunsake@redhat.com> - 1.7-2
changelog:
  - Fix 'none' cluster type enablement
  - Update RHCOS image to use RHEL 8 support-tools
  - Fix execution from within a container


author: Kevin Fenzi <kevin@scrye.com> - 3.3.2-12
changelog:
  - Fix sa-update not detecting spamd running. Fixes bug #755644
  - Add restart=always to systemd file to work around upstream bug. Bug #812359


author: Petr Lautrbach <plautrba@redhat.com> 3.3.2-17
changelog:
  - document rawbody's split into chunks (#892350)
  - avoid using array of cleaned uris <fkrska@redhat.com> (#892348)


author: Petr Lautrbach <plautrba@redhat.com> 3.4.0-1
changelog:
  - update to 3.4.0
  - Apply fix for amavisd and spampd reloading after rules updates. Fixes bug #1145654


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-3
changelog:
  - Fix CVE-2018-11781 - Local user code injection in the meta rule syntax
  - Fix CVE-2017-15705 - Certain unclosed tags in crafted emails allow for
  - scan timeouts and resulting denial of service
  - Resolves: rhbz#1632998


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-4
changelog:
  - Add missing Requires for perl(XSLoader) and perl(ExtUtils::MakeMaker),
  - which are no longer auto-generated due to a (expected) change in rpm-build
  - Related: rhbz#1632998


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-3
changelog:
  - Fix CVE-2018-11781 - Local user code injection in the meta rule syntax
  - Fix CVE-2017-15705 - Certain unclosed tags in crafted emails allow for
  - scan timeouts and resulting denial of service
  - Resolves: rhbz#1632999


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-4
changelog:
  - Add missing Requires for perl(XSLoader) and perl(ExtUtils::MakeMaker),
  - which are no longer auto-generated due to a (expected) change in rpm-build
  - Related: rhbz#1632999


author: Fabiano Fidêncio <fidencio@redhat.com> 0.12.4-10
changelog:
  - Fix qemu segmentation fault (core dumped) when boot KVM guest with
    spice in FIPS enabled mode.
    Resolves: rhbz#1071176


author: Fabiano Fidêncio <fidencio@redhat.com> 0.12.4-11
changelog:
  - Don't assert on invalid client message
    Resolves: rhbz#1227410
  - Don't truncate large 'now' values in _spice_timer_set
    Resolves: rhbz#1227408
  - Avoid race conditions reading monitor configs from guest
    Resolves: rhbz#1239128
  - Lock the pixmap image cache for the entire fill_bits call
    Resolves: rhbz#1235443


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-16
changelog:
  - Use autosetup
    Related: CVE-2016-0749
  - Fix heap-based memory corruption within smartcard handling
    Resolves: CVE-2016-0749
  - Fix host memory access from guest with invalid primary surface parameters
    Resolves: CVE-2016-2150


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-17
changelog:
  - Fix crash when the client sends a wrong header (for example when using spice-html5)
    Resolves: rhbz#1281442
  - Fix crash when guest provides wrong address
    Resolves: rhbz#1264356
  - Fix thread-safety issue causing a crash when playing a Youtube video spanning
    multiple monitors
    Resolves: rhbz#1253375
  - Add patches reducing QEMU wake-ups
    Related: rhbz#912763, rhbz#1186146
  - Fix use-after-free after resetting a VM
    Resolves: rhbz#1281455
  - Send KeepAlive probes every 10 minutes
    Resolves: rhbz#1298590
  - Add client to guest volume synchronization
    Resolves: rhbz#1264107


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-18
changelog:
  - Fix crash when connecting to VM using smartcard passthrough
    Resolves: rhbz#1340899
  - Fix hang after unredirecting a USB device
    Resolves: rhbz#1338752
  - Backport spice_qxl_set_max_monitors()
    Resolves: rhbz#1283202


author: Frediano Ziglio <fziglio@redhat.com> - 0.12.4-20
changelog:
  - Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large
    messages.
    Resolves: CVE-2016-9577
  - Fix remote DoS via crafted message.
    Resolves: CVE-2016-9578


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-1
changelog:
  - Rebase to spice-server 0.12.8
    Resolves: rhbz#1388947
    Resolves: rhbz#1377551
    Resolves: rhbz#1283202


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-3
changelog:
  - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages
    sent from an authenticated client
    Resolves: CVE-2017-7506


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-2.3
changelog:
  - Revert back to spice 0.12 behaviour where QXL guest resources for cursor
    commands are only released when the current cursor is replaced. This avoids
    a QEMU regression causing crashes during migration
    Resolves: rhbz#1572489


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-4
changelog:
  - Revert back to spice 0.12 behaviour where QXL guest resources for cursor
    commands are only released when the current cursor is replaced. This avoids
    a QEMU regression causing crashes during migration
    Resolves: rhbz#1567944


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-5
changelog:
  - Don't mute Record channel on client reconnection
    Resolves: rhbz#1549132
  - Allow to configure TLS protocol versions and ciphers which SPICE will use for
    TLS communications
    Resolves: rhbz#1562213
  - Enable ECDH ciphers with OpenSSL 1.0
    Resolves: rhbz#1566597


author: Marc-Andre Lureau <marcandre.lureau@redhat.com> - 0.22-1
changelog:
  - Rebase to 0.22
    Resolves: rhbz#1109397
  - Fix screenshot of secondary displays
    Resolves: rhbz#1029761
  - Fix potential crash when freeing primary surface.
    Resolves: rhbz#1082555
  - Add RHEL-only SPICE_NOSCALE to disable display scaling.
    Resolves: rhbz#1067346
  - Fix connection to RHEL5 Spice server
    Resolves: rhbz#1017862
  - Fix coroutine leak
    Resolves: rhbz#1007841
  - Fix clipboard hang on clipboard loop
    Resolves: rhbz#1073364


author: Jonathon Jongsma <jjongsma@redhat.com> - 0.22-2
changelog:
  - Additional display pop out when restarting service spice-vdagentd in guest
    Resolves: rhbz#1043782
  - Coverity scan fixes
    Resolves: rhbz#885719
  - Send data message for file copy of 0 size
    Resolves: rhbz#1135104
  - add spice_channel_get_error()
    Resolves: rhbz#1116048
  - Prefix proxy lookup errors
    Resolves: rhbz#1116048


author: Marc-Andre Lureau <marcandre.lureau@redhat.com> - 0.26-1
changelog:
  - Rebase to 0.26
    Resolves: rhbz#1214101
  - Allow to transfer multiple files at once
    Resolves: rhbz#1167829
  - Fix smartcard cannot work after restart guest
    Resolves: rhbz#1205548


author: Fabiano Fidêncio <fidencio@redhat.com> - 0.26-5
changelog:
  - Connecting to VM changes its resolution
    Resolves: rhbz#1242602
  - Cannot enable display 1 when it was disabled in previous session
    Resolves: rhbz#1247907
  - Windows needs to send complete monitors_config message to client
    Resolves: rhbz#1244878
  - High Resolution Multi-Monitor Windows Guest freeze
    Resolves: rhbz#1235442
  - Print file transfer summary to the log
    Resolves: rhbz#1140512
  - Enable proxy when requested
    Related: rhbz#1182252


author: Victor Toso <victortoso@redhat.com> - 0.26-6
changelog:
  - Implements volume-sync from guest to client
    Resolves: rhbz#1264105
  - Avoid crash in virt-manager
    Resolves: rhbz#1301863
  - Fix focus in fullscreen mode
    Resolves: rhbz#1275231
  - Add Client capability for Windows monitor_config message
    Resolves: rhbz#1248189
  - Fix error message for file transfer
    Resolves: rhbz#1265562


author: Pavel Grunt <pgrunt@redhat.com> - 0.26-7
changelog:
  - Improve message for number of usb channels in usb device widget
    Resolves: rhbz#1299931
  - Fix usbredir leak when redirecting a webcam
    Resolves: rhbz#1270363


author: Pavel Grunt <pgrunt@redhat.com> - 0.26-8
changelog:
  - Check runtime usbredir version
    Resolves: rhbz#1320827
  - Allow connection to password protected guests
    Resolves: rhbz#1320806
  - Fix runtime warnings related to shared folders and usb redirection
    Resolves: rhbz#1319405
  - Change runtime warning for empty monitor config to debug message
    Resolves: rhbz#1319405
  - Fix 16 bpp LZ image decompression
    Resolves: rhbz#1285469


author: Victor Toso <victortoso@redhat.com> - 0.31-3
changelog:
  - Fix client's crash when agent is killed
    Resolves: rhbz#1336321
  - Parse ipv6 address
    Resolves: rhbz#1335239
  - Improving parsing of Smartcard messages
    Resolves: rhbz#1338727
  - Fix hangs with "Connected to graphic server"
    Resolves: rhbz#1323092


author: Pavel Grunt <pgrunt@redhat.com> - 0.31-4
changelog:
  - Fix SASL GSSAPI (kerberos authentication)
    Resolves: rhbz#1343361
  - Allow to connect to ipv6 behind proxy
    Resolves: rhbz#1331777


author: Pavel Grunt <pgrunt@redhat.com> - 0.31-5
changelog:
  - Allow to connect to ipv6 without proxy
    Resolves: rhbz#1361478
  - Silence a critical when migrating
    Resolves: rhbz#1356162
  - Disable EPOXY / EGL usage
    Resolves: rhbz#1362460


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-1
changelog:
  - Rebase to 0.33
    Resolves: rhbz#1402474
  - Rebuilt with correct hardening flags due to bug 1387475
    Resolves: rhbz#1420778
  - Fix copy paste issues
    Resolve: rhbz#1409854


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-2
changelog:
  - Add missing patch for rebase
    Resolves: rhbz#1402474
  - Add obsoletes to the spec file to ease updates
    Resolves: rhbz#1432776
  - Fix black screen in virt-manager
    Resolves: rhbz#1433242
  - Make connection error message more clear
    Resolves: rhbz#1365736


author: Victor Toso <victortoso@redhat.com> - 0.33-3
changelog:
  - Avoid CRITICALs on copy-paste
    Resolves: rhbz#1440096
  - Avoid assertions on file-xfer while agent disconnects
    Related: rhbz#1440096


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-4
changelog:
  - Make connection error message more clear
    Resolves: rhbz#1365736
  - Improve audio debug
    Resolves: rhbz#1436249
  - Fix wrong encoding of transferred files
    Resolves: rhbz#1440206


author: Hans de Goede <hdegoede@redhat.com> - 0.14.0-1
changelog:
  - New upstream release 0.14.0
  - Adds support for file transfers from client to guest
  - Adds manpages for spice-vdagent and spice-vdagentd


author: Hans de Goede <hdegoede@redhat.com> - 0.14.0-3
changelog:
  - Advertise clipboard line-endings for copy and paste line-ending conversion
  - Build spice-vdagentd as pie + relro


author: Hans de Goede <hdegoede@redhat.com> - 0.14.0-5
changelog:
  - Silence session agent error logging when not running in a vm (rhbz#999804)
  - Release guest clipboard ownership on client disconnect (rhbz#1003977)


author: Christophe Fergeau <cfergeau@redhat.com> 0.14.0-8
changelog:
  - Fix copy and paste issues with vncclient
    Resolves: rhbz#1130218
  - Make vdagent more robust against xrandr failures
    Resolves: rhbz#1066422
  - Fix autostart of vdagent in gdm
    Resolves: rhbz#1052172


author: Christophe Fergeau <cfergeau@redhat.com> 0.14.0-9
changelog:
  - Don't install rsyslog config file. This can cause duplicate logging
    to syslog in rhel6->rhel7 upgrades, and is not really useful anyway
    as the same functionality can be achieved with journald
    Resolves: rhbz#1136881


author: Christophe Fergeau <cfergeau@redhat.com> 2.8-7
changelog:
  - Adjust selinux policy to allow use of USB redirection
    Resolves: rhbz#1075173
  - Add test page to package
    Resolves: rhbz#959194


author: Jai S <jsathyapalan@cloudlinux.com> - 3.7.17-8.1.tuxcare.els2
changelog:
  - CVE-2025-6965: fix memory corruption issue caused by a query where the number
    of aggregate terms could exceed the number of columns available.


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.17.git5c6f0024
changelog:
  - Latest pre 4.3 snapshot
  - Includes fix for mksquashfs hangs
  - Switch to get pre-release updates from the stable branch at kernel.org


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.18.gitaae0aff4
changelog:
  - Latest pre 4.3 stable snapshot
  - A few minor bug fixes
  - Improvements in getting status info while running unsquashfs


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-22
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Creation of this directory was moved to service file.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-23
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Creation of this directory was moved to tmpfiles.d conf file.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-24
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Creation of /var/run/squid was also needed to be in SPEC file.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-25
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Squid needs write access to /var/run/squid.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-26.1
changelog:
  - Resolves: #1330576 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-26.2
changelog:
  - Related: #1330576 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-26.3
changelog:
  - Related: #1330576 - CVE-2016-4553 squid: Cache poisoning issue in
    HTTP Request handling
  - Related: #1334491 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-5
changelog:
  - Resolves: #1404817 - SIGSEV in TunnelStateData::handleConnectResponse()
    during squid reconfigure and restart


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15
changelog:
  - Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1680022 - squid can't display download/upload packet size for HTTPS
    sites
  - Resolves: #1717430 - Excessive memory usage when running out of descriptors
  - Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts
  - Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter
    in cachemgr.cgi
  - Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15.1
changelog:
  - Resolves: #1828359 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828360 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow
  - Resolves: #1829772 - CVE-2019-12525 squid: parsing of header
    Proxy-Authentication leads to memory corruption


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17
changelog:
  - Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow [rhel


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2
changelog:
  - Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues
    in HTTP Request processing
  - Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
    as reverse-proxy
  - Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning
    attack against the HTTP cache
  - Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in
    FTP Gateway


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4
changelog:
  - Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could
    result in cache poisoning
  - Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could
    result in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6
changelog:
  - Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow
    a trusted client to perform HTTP Request Smuggling


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.10
changelog:
  - Resolves: RHEL-16779 - squid: NULL pointer dereference in the gopher protocol
    code -- Remove support for Gopher protocol (CVE-2023-46728)
  - Resolves: RHEL-18176 - squid: Buffer over-read in the HTTP Message processing
    feature (CVE-2023-49285)
  - Resolves: RHEL-18171 - squid: Incorrect Check of Function Return Value In
    Helper Process management (CVE-2023-49286)
  - Resolves: RHEL-16758 - squid: Denial of Service in SSL Certificate validation
    (CVE-2023-46724)
  - Resolves: RHEL-19557 - squid: denial of service in HTTP request parsing
    (CVE-2023-50269)
  - Resolves: RHEL-26082 - squid: denial of service in HTTP header parser
    (CVE-2024-25617)


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 7:3.5.20-17.0.3.10.tuxcare.els1
changelog:
  - CVE-2021-28651: fix memory leak in RFC 2169 response parsing
  - CVE-2021-28652: fix broken cache manager URL parsing
  - CVE-2021-31806: fix memory management bug
  - CVE-2021-31807: fix integer overflow problem
  - CVE-2021-31808: fix input validation bug
  - CVE-2021-33620: handle more partial responses


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 7:3.5.20-17.0.5.99.tuxcare.els2
changelog:
  - CVE-2025-62168: fix failure to redact HTTP authentication credentials in error
    handling to prevent information disclosure
  - email_err_data directive now defaults to 'off' for security (previously 'on')


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7:3.5.20-17.0.5.99.tuxcare.els4
changelog:
  - CVE-2026-33526: fix heap use-after-free due to double rfc1738_escape in ICP error handling
  - CVE-2026-33515: fix validation of ICP packet sizes and URLs to prevent out-of-bounds reads
  - CVE-2026-32748: fix HttpRequest use-after-free in ICP v3 query handling


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7:3.5.20-17.0.5.99.tuxcare.els5
changelog:
  - CVE-2021-28116: fix out-of-bounds read in WCCPv2 message parsing via
    stricter bounds validation of security, service, router, view, and
    capability items


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7:3.5.20-17.0.5.99.tuxcare.els6
changelog:
  - CVE-2023-49288: fix use-after-free in store_client lifetime by locking
    StoreEntry for the duration of the store_client object


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-16
changelog:
  - Resolves: #1738582 - CVE-2019-12525 squid: parsing of header 
    Proxy-Authentication leads to memory corruption


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-4
changelog:
  - Resolves: #1349775 - Provide migration tools needed due to rebase
    to squid 3.5 as a separate sub-package


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-5
changelog:
  - Related: #1349775 - Provide migration tools needed due to rebase
    to squid 3.5 as a separate sub-package


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-2.3
changelog:
  - Resolves: #1428378 - SIGSEV in TunnelStateData::handleConnectResponse()
    during squid reconfigure and restart


author: Doug Ledford <dledford@redhat.com> - 0.0.4-13
changelog:
  - Further tweaks to LSB init script headers
  - Add a %post and %preun scriptlets to add/remove the init script


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.1
changelog:
  - Resolves: rhbz#1478250 - Idle nss file descriptors should be closed
                             [rhel-7.4.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.2
changelog:
  - Resolves: rhbz#1478252 - Querying the AD domain for external domain's
                             ID can mark the AD domain offline [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.3
changelog:
  - Resolves: rhbz#1482927 - sssd_be is utilizing more CPU during sudoi
                             rules refresh [rhel-7.4.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50.4
changelog:
  - Resolves: rhbz#1489290 - samba shares with sssd authentication broken
                             on 7.4 [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.6
changelog:
  - Add a patch that was missed in 1.15.2-50.4
  - Related: rhbz#1489290 - samba shares with sssd authentication broken
                            on 7.4 [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.7
changelog:
  - Resolves: rhbz#1506142 - SSSD can crash due to ABI changes in
                             libldb >= 1.2.0 (1.1.30) [rhel-7.4.z]
  - Resolves: rhbz#1506682 - sssd_client: add mutex protected call to the
                             PAC responder [rhel-7.4.z]
  - Resolves: rhbz#1499658 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.8
changelog:
  - Resolves: rhbz#1508972 - Accessing IdM kerberos ticket fails while id
                             mapping is applied [rhel-7.4.z]
  - Resolves: rhbz#1509177 - Race condition between refreshing the cr_domain
                             list and a request that is using the list can
                             cause a segfault is sssd_nss [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.9
changelog:
  - Resolves: rhbz#1525110 - NSS by-id requests are not checked against
                             max_id/min_id ranges before triggering the
                             backend [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50-10
changelog:
  - Resolves: rhbz#1530975 - sssd_be stuck in an infinite loop after
                             completing full refresh of sudo rules
                             [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50-11
changelog:
  - Resolves: rhbz#1516700 - SELINUX: Use getseuserbyname to get IPA
                             seuser [rhel-7.4.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-47
changelog:
  - Resolves: rhbz#1430415 - ldap_purge_cache_timeout in RHEL7.3 invalidate
                             most of the entries once the cleanup task kicks in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-48
changelog:
  - Resolves: rhbz#1459846 - krb5: properly handle 'password expired'
                             information retured by the KDC during
                             PKINIT/Smartcard authentication


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-49
changelog:
  - Resolves: rhbz#1450107 - SSSD doesn't handle conflicts between users
                             from trusted domains with the same name when
                             shortname user resolution is enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.2-50
changelog:
  - Resolves: rhbz#1457926 - Wrong search base used when SSSD is directly
                             connected to AD child domain


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-15
changelog:
  - Resolves: rhbz#1517971 - AD Domain goes offline immediately during
                             subdomain initialization - IPA AD Trust
  - Related: rhbz#1482555 - sysdb index improvements - missing ghost
                            attribute indexing, unneeded objectclass index
                            etc..
  - Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
                            on RHEL clients joined to AD via sssd [RHEL 7]
  - Resolves: rhbz#1527149 - AD provider - AD BUILTIN groups are cached with
                             gidNumber = 0
  - Related: rhbz#1461899 - Loading enterprise principals doesn't work with
                            a primed cache
  - Related: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
                            threads


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-16
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Related: rhbz#1441908 - SELINUX: Use getseuserbyname to get IPA seuser
  - Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
                            on RHEL clients joined to AD via sssd [RHEL 7]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-17
changelog:
  - Resolves: rhbz#1523282 - sssd used wrong search base with wrong AD
                             server


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-18
changelog:
  - Resolves: rhbz#1543348 - sssd_be consumes more memory on RHEL 7.4 systems.
  - Resolves: rhbz#1544943 - sssd goes offline when renewing expired ticket


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.1
changelog:
  - Resolves: rhbz#1570527 - memory management issue in the sssd_nss_ex interface can cause the ns-slapd process on IPA server to crash [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.2
changelog:
  - Resolves: rhbz#1579703 - crash in nss_protocol_fill_netgrent. sssd_nss[19234]: segfault at 80 ip 000055612688c2a0 sp 00007ffddf9b9cd0 error 4 in sssd_nss[55612687e000+39000] [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.4
changelog:
  - Resolves: rhbz#1580281 - Samba can not register sss idmap module because it's using an outdated SMB_IDMAP_INTERFACE_VERSION [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.5
changelog:
  - Resolves: rhbz#1583746 - The SSSD IPA provider allocates information about external groups on a long lived memory context, causing memory growth of the sssd_be process [rhel-7.5.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.0-19.6
changelog:
  - Resolves: rhbz#1594178 - Login with sshkeys stored in ipa not working after update to RHEL-7.5 [rhel-7.5.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.0-19.7
changelog:
  - Resolves: rhbz#1596292 - home dir disappear in sssd cache on the IPA master for AD users [rhel-7.5.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.0-19.8
changelog:
  - Resolves: rhbz#1601360 - SSSD bails out saving desktop profiles in case an invalid profile is found [rhel-7.5.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.2-8
changelog:
  - Resolves: rhbz#1607313 - When sssd is running as non-root user, the sudo pipe is created as sssd:sssd but then the private pipe ownership fails


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.2-10
changelog:
  - Resolves: rhbz#1586127 - Spurious check in the sssd nss memcache can cause the memory cache to be skipped


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-12
changelog:
  - Resolves: rhbz#1610667 - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key
  - Resolves: rhbz#1583360 - The IPA selinux provider can return an error if SELinux is completely disabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.2-13
changelog:
  - Resolves: rhbz#1593756 - sssd needs to require a newer version of
                             libtalloc and libtevent to avoid an issue
                             in GPO processing


author: Michal Židek <mzidek@redhat.com> - 1.16.3-1
changelog:
  - Resolves: rhbz#1645047 - sssd only sets the SELinux login context if it
                             differs from the default [rhel-7.6.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.3-2
changelog:
  - Resolves: Bug 1649784 - SSSD not fetching all sudo rules from
                            AD [rhel-7.6.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.3-4
changelog:
  - Resolves: rhbz#1659083 - SSSD must be cleared/restarted periodically in
              order to retrieve AD users through IPA Trust [rhel-7.6.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.3-5
changelog:
  - Resolves: rhbz#1659507 - SSSD's LDAP authentication provider does not work
                             if ID provider is authenticated with GSSAPI [rhel-7.6.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.2-13.6
changelog:
  - Resolves: rhbz#1683578 - sssd_krb5_locator_plugin introduces delay in
                             cifs.upcall krb5 calls [rhel-7.6.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.2-13.8
changelog:
  - Resolves: rhbz#1690759 - RHEL STIG pointing sssd Packaging issue [rhel-7.6.z]
                           - Part 2.


author: Michal Židek <mzidek@redhat.com> - 1.16.4-12
changelog:
  - Resolves: rhbz#1576524 - RHEL STIG pointing sssd Packaging issue
                           - This was partially fixed by the rebase, but one
                             spec file change was missing.


author: Michal Židek <mzidek@redhat.com> - 1.16.4-14
changelog:
  - Resolves: rhbz#1684979 - The HBAC code requires dereference to be enabled
                             and fails otherwise


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.4-15
changelog:
  - Resolves: rhbz#1685581 - Extend cached_auth_timeout to cover subdomains
                             /trusts


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.4-17
changelog:
  - Resolves: rhbz#1711832 - The files provider does not handle resetOffline
                             properly


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.4-18
changelog:
  - Resolves: rhbz#1710286 - The server error message is not returned if
                             password change fails


author: Michal Židek <mzidek@redhat.com> - 1.16.4-21
changelog:
  - Resolves: rhbz#1714952 - [sssd] RHEL 7.7 Tier 0 Localization
  - Rebuild japanese gmo file explicitly


author: Michal Židek <mzidek@redhat.com> - 1.16.4-21.1
changelog:
  - Resolves: rhbz#1758566 - negative cache does not use values from 'filter_users'
                             config option for known domains [rhel-7.7.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.4-21.2
changelog:
  - Resolves: rhbz#1801207 - id command taking 1+ minute for returning user
                             information [rhel-7.7.z] (


author: Alexey Tikhonov <atikhono@redhat.com> - 1.16.4-21.3
changelog:
  - Resolves: rhbz#1807934 - sssd failover leads to delayed and failed logins
                             [rhel-7.7.z]


author: Michal Židek <mzidek@redhat.com> - 1.16.4-30
changelog:
  - Resolves: rhbz#1530741 - Trusted domain user logins succeed after using
                             ipa trustdomain-disable


author: Michal Židek <mzidek@redhat.com> - 1.16.4-31
changelog:
  - Resolves: rhbz#1746878 - Let IPA client read IPA objects via LDAP and not
                             a extdom plugin when resolving trusted users and
                             groups


author: Michal Židek <mzidek@redhat.com> - 1.16.4-32
changelog:
  - Resolves: rhbz#1530741 - Trusted domain user logins succeed after using ipa
                             trustdomain-disable


author: Michal Židek <mzidek@redhat.com> - 1.16.4-34
changelog:
  - Resolves: rhbz#1768404 - automount on RHEL7 gives the message
                             'lookup(sss): setautomntent: No such file or
                             directory'


author: Michal Židek <mzidek@redhat.com> - 1.16.4-37
changelog:
  - Resolves: rhbz#1784620 - Force LDAPS over 636 with AD Access Provider
  - just bumping the version to fix generated dates in man pages


author: Michal Židek <mzidek@redhat.com> - 1.16.4-37.1
changelog:
  - Resolves: rhbz#1801208 - id command taking 1+ minute for returning user
                             information [rhel-7.8.z]
                           - Also updates spec file to not replace
                             /pam.d/sssd-shadowutils on update


author: Alexey Tikhonov <atikhono@redhat.com> - 1.16.4-37.2
changelog:
  - Resolves: rhbz#1816031 - SSSD is crashing: dbus_watch_handle() is invoked
                             with corrupted 'watch' value [rhel-7.8.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.16.4-37.3
changelog:
  - Resolves: rhbz#1817380 - Removing an IPA sub-group should NOT remove the members
                             from indirect parent that also belong to other subgroups
                             [rhel-7.8.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.16.4-37.4
changelog:
  - Resolves: rhbz#1842861 - sssd boots offline if symlink for /etc/resolv.conf is broken/missing [rhel-7.8.z]
  - Resolves: rhbz#1845009 - [Bug] Reduce logging about flat names [rhel-7.8.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10
changelog:
  - Resolves: rhbz#1804005 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1773409 - sssd is failing to discover other subdomains in the forest if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1551077 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1507683 - GDM password prompt when cert mapped to multiple users and promptusername is False


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.1
changelog:
  - Resolves: rhbz#1854317 - sssd crashes after last update to sssd-common-1.16.4-37.el7_8.1 with servers configured with multiple domains [rhel-7.9.z]
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.2
changelog:
  - Resolves: rhbz#1854317 - sssd crashes after last update to sssd-common-1.16.4-37.el7_8.1 with servers configured with multiple domains [rhel-7.9.z]
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
  - just bumping the version to build for proper target


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.3
changelog:
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
    (Previous attempt to fix this issue was incomplete)


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.4
changelog:
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
    (Previous attempt to fix this issue was incomplete (again))


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.5
changelog:
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
    (Previous attempt to fix this issue was incomplete (again))
  - just bumping the version to build for proper target


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.6
changelog:
  - Resolves: rhbz#1899593 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr() [rhel-7.9.z]
  - Resolves: rhbz#1888409 - sssd component logging is now too generic in syslog/journal [rhel-7.9.z]
  - Resolves: rhbz#1852659 - sssd service is starting even though it is disabled state [rhel-7.9.z]
  - Resolves: rhbz#1893443 - User lookups over the InfoPipe responder fail intermittently [rhel-7.9.z]
  - Resolves: rhbz#1871288 - krb5_child denies ssh users when pki device detected [rhel-7.9.z]
  - Resolves: rhbz#1853703 - Unexpected behavior and issue with filter_users/filter_groups option [rhel-7.9.z]
  - Resolves: rhbz#1756240 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains [rhel-7.9.z]
  - Resolves: rhbz#1851112 - LDAP bind can fail due to unconfigurable DNS server timeouts that inhibit SSSD failover [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.7
changelog:
  - Resolves: rhbz#1875514 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [rhel-7.9.z]
  - Resolves: rhbz#1772513 - SSSD is generating lot of LDAP queries in a very large environment [rhel-7.9.z]
  - Resolves: rhbz#1736845 - [RFE] Backporting certificate matching rules for files, AD and LDAP provider [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.8
changelog:
  - Resolves: rhbz#1910131 - sssd throwing error " Unable to parse name test' [1432158283]: The internal name format cannot be parsed" at debug_level 2 [rhel-7.9.z]
  - Resolves: rhbz#1922244 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0. [rhel-7.9.z]
  - Resolves: rhbz#1935685 - SSSD not detecting subdomain from AD forest (7.9z)
  - Resolves: rhbz#1945552 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-7.9.z]
  - Resolves: rhbz#1839972 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.9
changelog:
  - Resolves: rhbz#1988463 - Missing search index for `originalADgidNumber` [rhel-7.9.z]
  - Resolves: rhbz#1968330 - id lookup is failing intermittently
  - Resolves: rhbz#1964415 - Memory leak in the simple access provider
  - Resolves: rhbz#1985457 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.11
changelog:
  - Resolves: rhbz#1968316 - SSSD: User authentication failing after server reboot.
  - Resolves: rhbz#2000238 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#1984591 - After sssd update to 1.16.5-10.el7_9.8.x86_64 the customer is facing slow connection/authentication (due to discovery of unexpected AD domains)


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.12
changelog:
  - Resolves: rhbz#2006382 - IPA Intermittence fetching groups
  - Resolves: rhbz#2006866 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2031729 - IPA clients fail to resolve override group names.
  - Resolves: rhbz#2032867 - AD Domain in the AD Forest Missing after sssd latest update


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.13
changelog:
  - Resolves: rhbz#2079441 - SSSD update prompts for smartcard pin twice - After update to 7.9 [rhel-7.9.z]
  - Resolves: rhbz#2073352 - Use right sdap_domain in ad_domain_info_send [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.14
changelog:
  - Resolves: rhbz#2097014 - SSSD -> sssd_be and sssd_ifp coredump [rhel-7.9.z]
  - Resolves: rhbz#2107380 - sssd timezone issues sudonotafter [rhel-7.9.z]
  - Resolves: rhbz#2116207 - SSSD starting offline after reboot [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.15
changelog:
  - Resolves: rhbz#2149703 - smartcards: special characters must be escaped when building search filter [rhel-7.9.z]
  - Resolves: rhbz#2149902 - EMBARGOED CVE-2022-4254 sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters [rhel-7.9.z]


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> 1.16.5-10.16
changelog:
  - Resolves: RHEL-16003 - sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-6
changelog:
  - Resolves: rhbz#1819013 - pam_sss reports PAM_CRED_ERR when providing wrong password for an existing IPA user, but this error's description is misleading
  - Resolves: rhbz#1800571 - Multiples Kerberos ticket on RHEL 7.7 after lock and unlock screen


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-7
changelog:
  - Resolves: rhbz#1835813 - sssd boots offline if symlink for /etc/resolv.conf is broken/missing
  - Resolves: rhbz#1837545 - Users must be informed better when internal WATCHDOG terminates process.


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-8
changelog:
  - Resolves: rhbz#1553784 - Document how to prevent invalid selinux context for default home directories in SSSD-AD direct integration.
  - Resolves: rhbz#1836910 - Rhel7.7 server have an issue regarding dyndns update for PTR-records which is done by sssd on active directory DNS servers.
                             It is done in two steps (two different nsupdate messages).


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-1
changelog:
  - rebase to most up2date upstream tarball, remove patches already upstream, fix
    code movements in patches (#928758)
  - fix man-page-day objections (private #948866)
  - fix the build for aarch64 (#926571)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-2
changelog:
  - package spax and scpio separately (#959917)
  - fedora-review fixes, unapplied patch
  - make the spax to be pax alternative (#960007)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-7
changelog:
  - we should provide /etc/rmt symlink for a while (related to #968980)
  - use the ssh as the default remote access method


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-2
changelog:
  - Copy over changes in tests/ioctl_evdev-success.c (from cdd8206a
    "tests: test evdev bitset decoding more thoroughly")
    to tests-m32/ioctl_evdev-success.c and tests-mx32/ioctl_evdev-success.c
  - Copy over changes in tests/ioctl_evdev.c (from 5ee385e2
    "evdev: fix decoding of EVIOCGBIT(0, ...)") to tests-m32/ioctl_evdev.c
    and tests-mx32/ioctl_evdev.c
  - Resolves: #1746478


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-4
changelog:
  - Include upstream patches that fix issues reported by covscan:
    91281fec "v4l2: avoid shifting left a signed number by 31 bit",
    522ad3a0 "syscall.c: avoid infinite loop in subcalls parsing", and
    9446038e "kvm: avoid bogus vcpu_info assignment in vcpu_register".
  - Resolves: #1747524


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-5
changelog:
  - Fix printing stack traces for early syscalls on process attach (#1790052):
    69b2c33a "unwind-libdw: fix initialization of libdwfl cache" and
    8e515c74 "tests: add strace-k-p test".
  - Add commit v5.4~97 "xlat: use unsgined type for mount_flags fallback values"
    (A leftover for #1747524).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-6
changelog:
  - Fix expected alignment for IPC tests (#1795261):
    4377e3a1 "tests: fix expected output for some ipc tests", and
    a75c7c4b "tests: fix -a argument in ipc_msgbuf-Xraw test".


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-7
changelog:
  - Fix incorrect ifname printing buffer size (#2028146):
    e27b0677 "print_ifindex: fix IFNAME_QUOTED_SZ definition".


author: Dmitry V. Levin <ldv@altlinux.org> - 4.8-1
changelog:
  - New upstream release:
    + fixed ERESTARTNOINTR leaking to userspace on ancient kernels (#659382);
    + fixed decoding of *xattr syscalls (#885233);
    + fixed handling of files with 64-bit inode numbers by 32-bit strace (#912790);
    + added aarch64 support (#969858).


author: Jeff Law <ldv@altlinux.org> - 4.8-2
changelog:
  - Don't dereference dropped TCP (#971352).  From
    Jan Stancek.  Merged into patch for 851457.
  - Disable "net" test as it is highly timing dependent
    Merge into patch 851457.
  - Bring forward patches lost after resyncing with Fedora.
    - Patch to avoid strict aliasing warnings
    - Patch to add man page for strace-log-merge (#948577)
    - Patch to improve scheduling fairness (#851457)


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.0-2
changelog:
  - Fixed initialization crash of IMV and IMC particularly
    attestation imv/imc as libstrongswas was not getting initialized.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-1
changelog:
  Resolves: #1049523
  Resolves: #1036846
  Resolves: #1007548
  - Modified spec file significantly to reflect the current state of
    the package, as this rebase enables several major modules: TNC
    client and server (IF-TNCCS), IMC-IMV (IF-M), PT-TLS (RFC 6876),
    SWID IMC/IMV, charon daemon and it related libs and modules,
    tnc-pdp, tnc-ifmap plugins.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-2
changelog:
  Resolves: #1049523
  Resolves: #1036846
  Resolves: #1007548
  - A typo caused a patch not being applied, so fixed that and
    bumping the number number.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.1.1-4
changelog:
  Resolves:#1067119
  - Fixed full hardening for strongswan (full relro and PIE).
    The previous macros had a typo and did not work
    (see bz#1067119).
  - Fixed files permissions for executables and config files to
    correctly reflect their intent.
  - Fixed tnc package description to eliminate rpmlint errors.
  - Fixed pki binary and moved it to /usr/libexece/strongswan as
    others binaries are there too to eliminate rpmlint errors.
  - Fixed systemd service name to "strongimv TNC".
  - Removed the dependency on gmp-devel


author: Avesh Agarwal <avagarwa@redhat.com> - 5.2.0-1
changelog:
  Resolves: #1120371
  - Rebase to new upstream release 5.2.0
  - IMA/TPM based remote attestation
  - Aikgen tool to generate an Attestation Identity Key bound
    to a TPM
  - PT-EAP transport protocol (RFC 7171) for TNC
  - Enabled support for acert for checking X509 attribute certificate
  - Updates local patches
  - Spec file update
  - openac tool replaced with pki --acert


author: ckozak <ckozak@redhat.com> 1.10.13-1
changelog:
  - 1060917: catch exception thrown in firstboot (ckozak@redhat.com)
  - Extract the latest strings (bkearney@redhat.com)
  - 995121: require gnome-icon-theme for calendar icon (alikins@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.14-1
changelog:
  - Use glob for finding entitlement certs to remove. (dgoodwin@redhat.com)
  - Make sure entitlement cert directory exists before we clean it out.
    (dgoodwin@redhat.com)
  - safer default args in AsyncWidgetUpdater (ckozak@redhat.com)
  - use enumerate instead of confusing myself (ckozak@redhat.com)
  - Pull in latest strings from zanata (bkearney@redhat.com)
  - make sure entitlement has a pool before reading it (ckozak@redhat.com)
  - quickly load preferences (ckozak@redhat.com)
  - 1061937: preference changes occur in the background (ckozak@redhat.com)
  - use existing signals (ckozak@redhat.com)
  - simplify preferences window (ckozak@redhat.com)
  - Fix test failure if run on system that is registered. (dgoodwin@redhat.com)
  - 1061393: Don't allow subscription-manager string to be translated
    (ckozak@redhat.com)
  - 1016427: On string was missed from the extraction (bkearney@redhat.com)
  - 1058495: productid yum errors on yum remove (alikins@redhat.com)
  - 1026501: Preserve PKI directories and have rpm own them.
    (dgoodwin@redhat.com)
  - 1058374: Fix crash on exception in managergui._show_buttons
    (ckozak@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.14-2
changelog:
  - updated tito.props to rev release (ckozak@redhat.com)
  - 958016: use rpm %{optflags} and _hardended_build (alikins@redhat.com)
  - 851325: Tweak activation key checkbox to left (alikins@redhat.com)
  - 1044596: Don't match beta product tags for release (alikins@redhat.com)
  - 1060727: Changes to rhsm-debug for sos report (wpoteat@redhat.com)
  - removed other releasers (ckozak@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.14-3
changelog:
  - 906567: Fix translations of "Red Hat" (alikins@redhat.com)
  - 1039914: rhsm-debug updates and fixes (alikins@redhat.com)
  - 1038242: add anaconda.pid check before chroot (alikins@redhat.com)
  - 1030378,1020474: Latest translations from zanata (alikins@redhat.com)
  - 1055664: rhsm-debug now follows more config paths (alikins@redhat.com)
  - 1021069: Add reference to network usage info. (alikins@redhat.com)
  - 1035115: Update product id certs (alikins@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.14-4
changelog:
  - 1030378: Latest strings from zanata. (alikins@redhat.com)
  - 1070737: correct config section for ca_cert_dir (ckozak@redhat.com)
  - Use systemd RPM macros to make life easier. (awood@redhat.com)


author: ckozak <ckozak@redhat.com> 1.10.14-5
changelog:
  - 1070908: Don't count cpus without topo for lpar (alikins@redhat.com)
  - 865702: Dont render exc messages with bogus markup (alikins@redhat.com)
  - 1074568: Use our translations in optparser (ckozak@redhat.com)
  - 1075167: Avoid using injected values in migrate-classic-to-rhsm
    (ckozak@redhat.com)
  - 1020474: Strings are 100% translated again. (alikins@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.2-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - Bump python-rhsm requirement to 1.20.2 (khowell@redhat.com)
  - 1448313: Do not log error, when rhsm_icon.json does not exist
    (jhnidek@redhat.com)
  - 1354667: Better message for proxy/identity cert issue (wpoteat@redhat.com)
  - 1489917: More robust reading of yum plugin file (jhnidek@redhat.com)
  - 1491842: Add man page doc for [rhsm] auto_enable_yum_plugins
    (jhnidek@redhat.com)
  - 1493711: Fix --matches option for the list command. (awood@redhat.com)
  - 1476817: Set network.ipv4_address properly, when DNS misconfigured.
    (jhnidek@redhat.com)
  - 1483746: Force UTF-8 encoding in rhsm-service (jhnidek@redhat.com)
  - rename RepoFile to YumRepoFile (dellweg@atix.de)
  - 1466453: [RFE] rhn-migrate-classic-to-rhsm auto-enable yum plugins
    (jhnidek@redhat.com)
  - D-Bus service for removing entitlements (all/ID/serial num.)
    (jhnidek@redhat.com)
  - 1489917: More robust reading of yum plugin file (jhnidek@redhat.com)
  - 1489877: minor typo in /etc/rhsm/rhsm.conf comment (jhnidek@redhat.com)
  - restructure RepoFile hierarchy (dellweg@atix.de)
  - 1319927: [RFE] sub-man automatically enables yum plugins (jhnidek@redhat.com)
  - Fix polymorphy for RHSMLogHandler (dellweg@atix.de)
  - 1481384: Do not update redhat.repo at RateLimitExceededException
    (jhnidek@redhat.com)
  - 1485008: subman register --type="RHUI" should work (jhnidek@redhat.com)
  - 1481384: Do not update redhat.repo at RateLimitExceededException (#1685)
    (jhnidek@redhat.com)
  - Do not attempt to register if already registered. (awood@redhat.com)
  - Integrate registration service into RegisterCommand. (awood@redhat.com)
  - 1480659: Properly initialize clean repo copy (khowell@redhat.com)
  - D-Bus service for unregistering system (#1680) (jhnidek@redhat.com)
  - Add an entitlement service and use it in the CLI and DBus. (awood@redhat.com)
  - Remove unneeded plugin conduit. (awood@redhat.com)
  - Clean up imports in dbus.base_object (awood@redhat.com)
  - Move certificate persistence into register service itself. (awood@redhat.com)
  - 1480395: Force UTF-8 encoding in daemons (khowell@redhat.com)
  - 1464571: 'sub-man release' prints error for more prod. certs.
    (jhnidek@redhat.com)
  - 1400326: Better error print, when consumer cert is corrupted
    (jhnidek@redhat.com)
  - Reload identity after registering. (awood@redhat.com)
  - Move registration code to a distinct service. (awood@redhat.com)
  - The get_installed_product_status() is now method of InstalledProducts, small
    changes, refactoring. (jhnidek@redhat.com)
  - D-Bus service for listing installed products (jhnidek@redhat.com)
  - 1461003: Deprecate --type option on register command (wpoteat@redhat.com)
  - 1462928: Reset status after connection validation (khowell@redhat.com)
  - 1330036: Better status error message for initial-setup (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.3-1
changelog:
  - Cockpit: Implement modal dialog (khowell@redhat.com)
  - Implement bootstrap-select component (khowell@redhat.com)
  - Port cockpit subscriptions-client to dbus (khowell@redhat.com)
  - Move python-rhsm build into subscription-manager (khowell@redhat.com)
  - 1354667: Add identity cert detection to proxy error message generation
    (wpoteat@redhat.com)
  - 1501889: Enable yum plugins after sub-man subcommand is executed
    (jhnidek@redhat.com)
  - 1477958: Use inotify for checking changes of consumer certs
    (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.5-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - Cockpit - listing of installed products using patternfly-react
    (jhnidek@redhat.com)
  - 1508457: Bump versions in python-rhsm obsoletes (khowell@redhat.com)
  - Implement fallback for settimeout on old m2crypto (khowell@redhat.com)
  - Cockpit: reconcile translated strings (khowell@redhat.com)
  - Cockpit: use translations from root dir (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.6-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - 1514067: Call virt-what using absolute path (jhnidek@redhat.com)
  - 1487688: Load config settings for cockpit plugin (khowell@redhat.com)
  - Added dependencies to cockpit-bridge and cockpit-shell. (jhnidek@redhat.com)
  - 1462456: Flush stdout and stderr on more places (jhnidek@redhat.com)
  - 1491842: fixed typo in man page. (jhnidek@redhat.com)
  - 1508591: Removed python-rhsm from subscription-manager version
    (jhnidek@redhat.com)
  - 1421010: Subman-GUI shows error dialog (wrong proxy settings)
    (jhnidek@redhat.com)
  - 1500106: subscription-manager status --ondate do not ignore date
    (jhnidek@redhat.com)
  - 1506970: Fixed default custom URL in cockpit plugin (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.8-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - Add parameter to D-Bus API to pass locale for localization of errors
    (jhnidek@redhat.com)
  - 1463765: Fix wrong Indic-language translations (khowell@redhat.com)
  - 1487600: Cockpit - Save configuration from register dialog
    (jhnidek@redhat.com)
  - 1464571: Improve multiple product certs errors (khowell@redhat.com)
  - Replace cockpit-subscriptions (khowell@redhat.com)
  - 1507158: Provide Host: in http CONNECT header (jhnidek@redhat.com)
  - 1319927: Remove newline from auto enable message (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.9-1
changelog:
  - Sync zanata translations (khowell@redhat.com)
  - 1510727: Enable starting of subman GUI, when consumer has been deleted
    (jhnidek@redhat.com)
  - 1304056: Fix D-Bus path of com.redhat.RHSM1.Facts (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.10-1
changelog:
  - Update translations from zanata (khowell@redhat.com)
  - 1510024: Handle rhel-alt product tags properly (khowell@redhat.com)
  - 1526622: Do not delete product certificates in protected directory
    (jhnidek@redhat.com)
  - 1527813: subman-gui use new URL of Online Documentation (jhnidek@redhat.com)
  - 1519512: Handle non-UTF8 RPM vendors (khowell@redhat.com)
  - 1526385: Bug fix of autoregistration in subman--cockpit plugin
    (jhnidek@redhat.com)
  - 1527392: Clear credential data in register dialog (jhnidek@redhat.com)
  - 1526385: Fix registration success detection (khowell@redhat.com)
  - 1448313: Do not log error, when rhsmcertd is restarted (jhnidek@redhat.com)
  - 1516439: Cockpit reports error during unregister when candlepin unavailable
    (jhnidek@redhat.com)


author: Vritant Jain <vrjain@redhat.com> 2.0.30-1
changelog:
  - 1333545, 1328609, 1349533, 1349584, 1264470, 1349538, 1349592, 1354653,
    1354655: more migration data for RHEL7.3 (vrjain@redhat.com)


author: Vritant Jain <vrjain@redhat.com> 2.0.31-1
changelog:
  - 1366747: channel-cert-mapping.txt does NOT account for RHN base channel rhel-
    ppc64le-server-7 (vrjain@redhat.com)


author: Vritant Jain <adarshvritant@gmail.com> 2.0.32-1
changelog:
  - 1385446: Rebase subscription-manager-migration-data component to the latest
    upstream branch for RHEL 6.9 (adarshvritant@gmail.com)
  - Added releaser for 6.9 (adarshvritant@gmail.com)


author: Vritant Jain <adarshvritant@gmail.com> 2.0.33-1
changelog:
  - 1385446: Rebase subscription-manager-migration-data component to the latest
    upstream branch for RHEL 6.9 (adarshvritant@gmail.com)


author: Vritant Jain <adarshvritant@gmail.com> 2.0.34-1
changelog:
  - 1286842: rhel-x86_64-server-6-rh-gluster-3-samba-debuginfo channel mapping
    (adarshvritant@gmail.com)


author: Kevin Howell <khowell@redhat.com> 2.0.35-1
changelog:
  - 1427901: Rebase subscription-manager-migration-data component to the latest
    upstream branch for RHEL 7.4 (khowell@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 2.0.38-1
changelog:
  - 1510200: Rebase subscription-manager-migration-data component to the latest
    upstream branch for RHEL 7.5 (csnyder@redhat.com)


author: Joe Orton <jorton@redhat.com> - 1.7.14-13
changelog:
  - fix mod_authz_svn regression with mod_auth_kerb (#1306431)
  - fix "svn diff" property handling (#1378178)
  - fix permissions of /run/svnserve to match tmpfiles (#1496243)


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-1
changelog:
  - RHEL 7.4 erratum
    - Resolves: rhbz#1360687 - rebase to 1.8.19p2
    - Resolves: rhbz#1123526 - performance improvement
    - Resolves: rhbz#1308789 - add MAIL and NOMAIL tags
    - Resolves: rhbz#1348504 - sudo now parses sudoers with sudoers locale
    - Resolves: rhbz#1374417 - "sudo -l command" indicated that the command 
      was runnable even if denied by sudoers when using LDAP or SSSD backend.
    - Resolves: rhbz#1387303 - add ignore_iolog_errors option
    - Resolves: rhbz#1389360 - wrong log file group ownership
    - Resolves: rhbz#1389735 - add iolog_group, iolog_mode, iolog_user options
    - Resolves: rhbz#1397169 - maxseq and ignore_iolog_errors options
    - Resolves: rhbz#1403051 - add support for querying netgroups directly via LDAP
    - Resolves: rhbz#1410086 - race condition while creating /var/log/sudo-io dir
    - Resolves: rhbz#1413160 - add ignore_unknown_defaults flag
    - Resolves: rhbz#1254772 - ability to export sudoers in json format
    - Resolves: rhbz#1417187 - wrong reference to config file in systax error message
    - Resolves: rhbz#1424575 - visudo was not printing severity of error/warning message


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-2
changelog:
  - RHEL 7.4 erratum
  - Fixes coverity scan issues created by our patches: 
    - fixed resource leaks and a compiler warning in digest backport patch
    - removed needless code from cmnd_no_wait patch causing clang warning
    - format of the last changelog message causes problems to rhpkg push,
      so don't use that as a commit message 
    Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-3
changelog:
  - RHEL 7.4 eratum
  - Fixes semicolon typo in digest backport patch from the previous build
    Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-4
changelog:
  - RHEL 7.4 erratum
  - fixed cmnd_no_wait patch
  - backported iolog_flush sudoers default
    Resolves: rhbz#1369856
    Resolves: rhbz#1425853


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
  - RHEL 7.4 erratum
  - added doc patch about sudo lookup issue
    Resolves: rhbz#1293306
  - added test suite patch
    Resolves: rhbz#1360687
  - fixed use after free fqdn problem
    Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
  - RHEL 7.4 erratum
  - added patch to fix output truncation (in some cases) when log_output
    option is enabled
    Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
  - RHEL 7.4 erratum
  - Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
    Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
  - RHEL 7.4 erratum
  - removed patch for output truncation (1454571) which introduced regression
    Resolves: rhbz#1360687


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-12
changelog:
  - RHEL 7.5 erratum
  - Fixed exit codes for `sudo -l -U <user>`
  - Fixed truncated output when log_output is enabled
  - Updated use_pty and IO logging manpage

    Resolves: rhbz#1458696
    Resolves: rhbz#1454571
    Resolves: rhbz#1490358

  - Fixed second pass LDAP filter expression in the sudoers ldap backend
    - inclomplete patch for rhbz#1485397


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-13
changelog:
  - RHEL 7.5 erratum
  - Fixed sudo -l checking results whether user should be authenticated
  - Enabled LDAP filter patch
  - Fixed double free in sssd

    Resolves: rhbz#1505409
    Resolves: rhbz#1511850
    Resolves: rhbz#1518104


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.2
changelog:
  - RHEL 7.9.Z ERRATUM
  - defaults use_pty plus SELinux ROLE in user specification breaks terminal
    Resolves: rhbz#1972820


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.3
changelog:
  - RHEL 7.9.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
    Resolves: rhbz#2161222


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 1.8.23-10.3.tuxcare.els3
changelog:
  - CVE-2025-32462: fix privilege escalation vulnerability by restricting
    unauthorized users from gaining elevated system privileges via the Sudo host
    option


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 1.8.23-10.0.1.3.tuxcare.els2
changelog:
  - CVE-2021-23239: fix potential directory existence info leak in sudoedit
  - CVE-2023-28486: escape control characters in log messages
  - CVE-2023-28487: escape control characters in sudoreplay output


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-1
changelog:
  - RHEL-7.6 erratum
    Resolves: rhbz#1547974 - Rebase sudo to latest stable upstream version (1.8.23)
    Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets
    Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
    Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
    Resolves: rhbz#1548380 - RFE: Create flag to filter to sudo -l output
    Resolves: rhbz#1510002 - Ensure that the command input (stdin) eating behaviour of Default log_input is documented
    Resolves: rhbz#1596032 - Why does sudo package depend on vim-minimal?


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-2
changelog:
  - RHEL-7.6 erratum
    Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
    Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
    Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
  - RHEL-7.7 erratum
    Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
    Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-5
changelog:
  - RHEL-7.8 erratum
    Resolves: rhbz#1711997 sudo is super slow when /etc/security/limits.conf contains many entries


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-6
changelog:
  - RHEL-7.8 erratum
    Resolves: rhbz#1647678 sudo access denied with pam_access and pts terminal configurations


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.3
changelog:
  RHEL 7.9.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161222


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-11
changelog:
  - Fixed incorrect login shell path construction in sesh
    (thanks fkrska@redhat.com for the patch)
    Resolves: rhbz#1065418


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-12
changelog:
  - RHEL 7.1 erratum
    - don't retry authentication when ctrl-c pressed
    - fix double-quote processing in Defaults options
    - handle the "(none)" hostname correctly
    - SSSD: fix sudoUser netgroup specification filtering
    - SSSD: list correct user when -U <user> -l specified
    - SSSD: show rule names on long listing (-ll)
    - fix infinite loop when duplicate entries are specified on the
      sudoers nsswitch.conf line
    Resolves: rhbz#1084488
    Resolves: rhbz#1088464
    Resolves: rhbz#1088825
    Resolves: rhbz#1092499
    Resolves: rhbz#1093099
    Resolves: rhbz#1096813
    Resolves: rhbz#1147497
    Resolves: rhbz#1147557


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-14
changelog:
  - RHEL 7.2 erratum
    - backported command digest specification
    - fixed CVE-2014-9680 sudo: unsafe handling of TZ environment variable
    - fixed typos in sudoers.ldap man page
    - fixed handling of double-quoted sudoOption values in ldap, sssd sources
    - fixed numeric uid specification support in ldap source
    - fixed authentication flag logic in ldap source
    - added the systemctl command to the SERVICES alias in the default sudoers file
    Resolves: rhbz#1144446
    Resolves: rhbz#1235570
    Resolves: rhbz#1138259
    Resolves: rhbz#1183818
    Resolves: rhbz#1233607
    Resolves: rhbz#1144419
    Resolves: rhbz#1135539
    Resolves: rhbz#1215400


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-15
changelog:
  - RHEL 7.2 erratum
    - fixed compilation of testing binaries during make check
    - added legacy group processing patch
    - replaced buggy base64 decoder with a public domain implementation
    Resolves: rhbz#1254621
    Resolves: rhbz#1183818
    Resolves: rhbz#1247591


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-18
changelog:
  - RHEL 7.3 erratum
    - removed requiretty flag from the default sudoers policy
    - backported pam_service and pam_login_service defaults options
    - implemented netgroup_tuple defaults option for changing netgroup
      processing semantics
    - fixed user matching logic in the LDAP nss backend
    - don't allow visudo to accept an invalid sudoers file
    - fixed a bug causing that non-root users can list privileges of
      other users
    - modified digest check documentation to mention the raciness of
      the checking mechanism
    Resolves: rhbz#1196451
    Resolves: rhbz#1247230
    Resolves: rhbz#1334331
    Resolves: rhbz#1334360
    Resolves: rhbz#1261998
    Resolves: rhbz#1313364
    Resolves: rhbz#1312486
    Resolves: rhbz#1268958
    Resolves: rhbz#1335039
    Resolves: rhbz#1335042
    Resolves: rhbz#1335045
    Resolves: rhbz#1273243
    Resolves: rhbz#1299883


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-19
changelog:
  - RHEL 7.3 erratum
    - removed INPUTRC from env_keep to prevent a potential info leak
    Resolves: rhbz#1340700


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p7-22
changelog:
  - Fixes CVE-2017-1000367 sudo: Privilege escalation in via improper get_process_ttyname() parsing [rhel-7.3.z]
    Resolves: rhbz#1455401


author: Richard W.M. Jones <rjones@redhat.com> - 4.1.1-2
changelog:
  - Add upstream patch to ignore ghost non-regular files.
  - This fixes builds on Fedora 20 because the filesystem package has
    been changed so /var/lock and /var/run are marked as ghost.


author: Richard W.M. Jones <rjones@redhat.com> - 4.1.3-1
changelog:
  - New upstream version 4.1.3.
  - Remove patch which is now upstream.
  - Add examples directory to documentation.


author: Richard W.M. Jones <rjones@redhat.com> - 5.1.9-1.4
changelog:
  - Completely remove dependency on prelink/execstack (RHBZ#1093261).
  - Rebuild for aarch64 and ppc64le (1125690).


author: mpluskal@suse.com
changelog:
  - Update to 0.6.0
    * Full support to Kubernetes, even when saving events to a trace
      file
    * semget system event
    * access system event
    * Automatically build sysdig-probe for boot2docker releases
    * Properly filter process table serialization in a trace file
      when a process filter is used
    * Some csysdig actions now ask the user for confirmation
    * various bugfixes
    * drop GH_496_fix.patch


author: aspiers@suse.com
changelog:
  - Fix whitespace issues in .spec and .changes files
  - Remove duplicate %{_datadir} directory from %files


author: aspiers@suse.com
changelog:
  - Fix .spec file bug which was causing Frankenstein kernel modules:
    https://github.com/draios/sysdig/issues/496#issuecomment-165929462


author: mpluskal@suse.com
changelog:
  - Update to 0.7.1
    * Fix sysdig-probe compilation for kernel < 3.4.0
    * Fix compilation on OSX
  - Changes for 0.7.0
    * Fix sysdig-probe for kernel 4.4
    * Fix a remotely possible deadlock during ioctl calls
    * Fix Kubernetes support when data returned from the API server
      is particularly big
    * Minor bugfixes
    * Spectrogram views in csysdig: spectro_all (System call latency
      spectrogram) and spectro_file (File I/O latency spectrogram)
    * Ability to authenticate to a Kubernetes API server using a
      certificate, via -K <file_name> or --k8s-api-cert=<file_name>.
      Can also be specified via the environment variable
      SYSDIG_K8S_API_CERT
    * Ability to sort columns in csysdig views using the keyboard
    * --filter-proclist: apply the filter to the process table
    * -M: add the possibility to stop collecting after X seconds
      evt.latency.quantized: 10-base log of the delta between an
      exit event and the correspondent enter event evt.latency.human:
      delta between an exit event and the correspondent enter event,
      as a human readable string (e.g. 10.3ms)


author: mpluskal@suse.com
changelog:
  - Update to 0.8.0
    * Bug fixes
      + Better terminal mouse handling for csysdig
      + Minor bugfixes
    * New and updated features
      + rkt support (when running sysdig in a container, bind
      mounting the rkt directory is necessary, e.g. -v
      /var/lib/rkt:/host/var/lib/rkt:ro for Docker)
      + chroot event
      + container.type: the container type, e.g. docker or rkt
      + Prebuild sysdig-probe for Debian kernels


author: mpluskal@suse.com
changelog:
  - Update to 0.9.0
    * Mesos and Marathon support:
    + csysdig views: Mesos Tasks, Mesos Frameworks, Marathon Apps,
      arathon Groups
    + -m sysdig/csysdig parameter to specify URLs for Mesos Master
      Marathon API
    + -pm sysdig parameter to get a Mesos-friendly event output
    + Filter fields: mesos.task.name, mesos.task.id,
      mesos.task.label, mesos.task.labels, mesos.framework.name,
      mesos.framework.id, marathon.app.name, marathon.app.id,
      marathon.app.label, marathon.app.labels, marathon.group.name,
      marathon.group.id
    * icontains filter comparison operator: case-insensitive string
      comparison
    * Support for SSL based authentication and bearer token
      authentication against the Kubernetes API server. Previously,
      SSL was just supported for CA verification. See the updated
      documentation for -K
    * New actions on csysdig views: lsof and renice
    * New network filter fields that support a CIDR notation
      (e.g. 127.0.0.1/24): fd.net, fd.cnet, fd.snet, fd.lnet, fd.rnet


author: mpluskal@suse.com
changelog:
  - Update to version 0.10.0:
    * setsid event
    * proc.sid filter field: the session id of the process
      generating the event
    * proc.sname filter field: the name of the current process
      session leader
    * --force-term-compat command line option: try to configure
      simple terminal
    * settings (xterm-1002) that work better with terminals like
      putty
    * Many minor bugfixes
    * builds with gcc6 (boo#985121)
  - Use pkgconfig() style dependencies
  - Build with lua-5.1 as builds fail with lua-5.2 and later


author: mpluskal@suse.com
changelog:
  - Update to version 0.11.0:
    * Support for tracers. A way to add user level events to sysdig
      stream. Seeannouncement blog post.
    * New csysdig views: Traces List, Traces Summary, Traces
      Spectogram
    * New evtin.* and span.* filters startswith operand for strings,
      ex: fd.name startswith /etc
    * evt.is_open_{read,write} fields, true or false if an event is
      an open() in read or write
    * Improved performances of Kubernetes metadata parsing.
    * Bug fixes for IPv6
  - Add sysdig-do-not-use-private-jq-api.patch to allow building
    with system JQ


author: mpluskal@suse.com
changelog:
  - Use current macros for KMP building
    * drop sysdig-kmp-preamble
  - Use exclusivearch instead of excluding architectures


author: mpluskal@suse.com
changelog:
  - Update to version 0.12.1:
    * Compilation issues when using non-bundled OpenSSL #672
    * Compilation issues under S390 architecture
    * Various issues on k8s parsing
    * Stale thread info when parsing processes within containers #665
    * Avoid getting cwd from driver, causes issues on Kernel 4.8
  - Changes for version 0.12.0:
    * New filters container.mount.* to match container mount points
    * New filter container.privileged to match containers running in
      privileged mode
    * Support latest kubernetes features: k8s.deployment.* and
      k8s.rs.* filters are now available
    * Added glob operator for strings, works as classic shell glob
      path matcher
    * Added pmatch operator
    * Add less package on docker image
  - Drop upstreamed sysdig-do-not-use-private-jq-api.patch
  - Enable building on s390x


author: mpluskal@suse.com
changelog:
  - Update to version 0.13.0 (boo#1017181):
    * Ability to open concatenated capture files
    * evtin.* fields can be used also for displaying now
    * Fix driver for Kernel 4.9
    * Fix on IPv4 mapped IPv6 parsing
    * Fix memory leak #694
    * Fix issue #687 about connecting to an K8s API server via HTTPS


author: Michael Schwendt <mschwendt@fedoraproject.org> - 4.05-2
changelog:
  - Remove old Obsoletes/Provides for syslinux-devel as such a subpkg
    was introduced with 3.83-2 (#756733).


author: Peter Jones <pjones@redhat.com> - 4.05-4
changelog:
  - Fix build problem from kernel-headers' removeal of ext2_fs.h
    (fix backported from as-yet-unreleased upstream version.)


author: Peter Jones <pjones@redhat.com> - 4.05-12
changelog:
  - Toolchain changes between when this originally got built and 4.05-9 means
    4.05-9 - 4.05-11 don't actually work.
    Related: rhbz#1085434


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-8
changelog:
  - resolves: #846699
    renamed nfsiostat to nfsiostat-sysstat, as nfsiostat is also provided
    by the nfs-utils package
  - resolves: #1224882
    fixed bug when pidstat could run out of pre-allocated space for PIDs
  - resolves: #1258990
    added support for more CPUs
  - resolves: #1267972
    fixed bug when iostat didn't display the full device name if it's too long
  - resolves: #1328490
    fixed bug, when sadc could forward SIGINIT to init process and couse reboot


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-9
changelog:
  - related: #846699
    do the renaming of nfsiostat properly, with patch
  - resolves: #1332662
    added tapestat utility for monitoring tape drives


author: Michal Sekletár <msekleta@redhat.com> - 10.1.5-18
changelog:
  - add -f flag to force fdatasync() after sa file update (#1662094)
  - don't call filesystem count functions when we are not collecting fs statistics (#1670060)
  - skip autofs when gathering filesystem statistics (#1670060)
  - fix use of incorrect preposition in sar man page (#1624410)
  - fix CPU usage reporting (#1618688)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 10.1.5-20.tuxcare.els1
changelog:
  - CVE-2022-39377: check an overflow and exit if it be
  - CVE-2023-33204: fix possible buffer overflow in an incomplete fix for
    CVE-2022-39377


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-1
changelog:
  - resolves: #863791
    updated to 10.1.2
  - resolves: #850333
    migrated to the new systemd-rpm macros
  - cleaned .spec file


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-2
changelog:
  - added new -y option to iostat command to skip first since boot report if
    displaying multiple reports


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-5
changelog:
  - resolves: #1100365
    fixed issue when sa data files weren't correctly overwritten in some cases
  - resolves: #1097294
    count with xz compressed files as well in sa2 script
  - resolves: #1097292
    fix file mode of sysstat cron file
  - resolves: #1128569
    added workaround for dyn-tick kernel feature which makes /proc/stat file
    unreliable under certain circumstances
  - resolves: #1110852
    added better explanation of HISTORY setting to sysstat(5) man page
  - resolves: #1102610
    added possibility to set compress method in /etc/sysconfig/sysstat file


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-6
changelog:
  - resolves: #1146081
    fixed issue when cifsiostat and nfsiostat were reporting incorrect statistics
    on a single CPU machines


author: Tim Waugh <twaugh@redhat.com> 1.4.1-17
changelog:
  - Applied upstream patch to fix job retrieval (bug #1119227).
  - Applied upstream patch to fix Gdk.color traceback (bug #1112334).


author: Nils Philippsen <nils@redhat.com> - 1.3.4-1
changelog:
  - don't ask libuser to create a home directory over an existing one (#908852,
    patch by Miloslav Trmač)
  - correct check if SELinux is enabled


author: Lukas Nykryn <lnykryn@redhat.com> - 219-25
changelog:
  - units: increase watchdog timeout to 3min for all our services (#1267707)
  - core: bump net.unix.max_dgram_qlen really early during boot (#1267707)
  - core: fix priority ordering in notify-handling (#1267707)
  - tests: fix personality tests on ppc64 and aarch64 (#1361049)
  - systemctl: consider service running only when it is in active or reloading state (#3874) (#1362461)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-26
changelog:
  - install: do not crash when processing empty (masked) unit file (#1159308)
  - Revert "install: fix disable via unit file path" (#1348208)
  - systemctl: allow disable on the unit file path, but warn about it (#3806) (#1348208)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-27
changelog:
  - tmpfiles: enforce ordering when executing lines (#1365870)
  - Introduce bus_unit_check_load_state() helper (#1256858)
  - core: use bus_unit_check_load_state() in transaction_add_job_and_dependencies() (#1256858)
  - udev/path_id: correct segmentation fault due to missing NULL check (#1365556)
  - rules: load sg driver also when scsi_target appears (#45) (#1322773)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-29
changelog:
  - fix gcc warnings about uninitialized variables (#1318994)
  - journalctl: rework code that checks whether we have access to /var/log/journal (#1318994)
  - journalctl: Improve boot ID lookup (#1318994)
  - journalctl: only have a single exit path from main() (#1318994)
  - journalctl: free all command line argument objects (#1318994)
  - journalctl: rename boot_id_t to BootId (#1318994)
  - util: introduce CMSG_FOREACH() macro and make use of it everywhere (#1318994)
  - journald: don't employ inner loop for reading from incoming sockets (#1318994)
  - journald: fix count of object meta fields (#1318994)
  - journal-cat: return a correct error, not -1 (#1318994)
  - journalctl: introduce short options for --since and --until (#1318994)
  - journal: s/Envalid/Invalid/ (#1318994)
  - journald: dispatch SIGTERM/SIGINT with a low priority (#1318994)
  - lz4: fix size check which had no chance of working on big-endian (#1318994)
  - journal: normalize priority of logging sources (#1318994)
  - Fix miscalculated buffer size and uses of size-unlimited sprintf() function. (#1318994)
  - journal: Drop monotonicity check when appending to journal file (#1318994)
  - journalctl: unify how we free boot id lists a bit (#1318994)
  - journalctl: don't trust the per-field entry tables when looking for boot IDs (#1318994)
  - units: remove udev control socket when systemd stops the socket unit (#49) (#1370133)
  - logind: don't assert if the slice is missing (#1371437)
  - core: enable transient unit support for slice units (#1370299)
  - sd-bus: bump message queue size (#1371205)
  - install: fix disable when /etc/systemd/system is a symlink (#1285996)
  - rules: add NVMe rules (#3136) (#1274651)
  - rules: introduce disk/by-id (model_serial) symlinks for NVMe drives (#3974) (#1274651)
  - rules: fix for possible whitespace in the "model" attribute (#1274651)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30
changelog:
  - systemctl,pid1: do not warn about missing install info with "preset" (#1373950)
  - systemctl/core: ignore masked units in preset-all (#1375097)
  - shared/install: handle dangling aliases as an explicit case, report nicely (#1375097)
  - shared/install: ignore unit symlinks when doing preset-all (#1375097)
  - 40-redhat.rules: don't hoplug memory on s390x (#1370161)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.1
changelog:
  - If the notification message length is 0, ignore the message (#4237) (#1381573)
  - systemctl: suppress errors with "show" for nonexistent units and properties (#1380686)
  - 40-redhat.rules: disable auto-online of hot-plugged memory on IBM z Systems (#1381123)
  - pid1: don't return any error in manager_dispatch_notify_fd() (#4240) (#1381573)
  - pid1: process zero-length notification messages again (#1381573)
  - pid1: more informative error message for ignored notifications (#1381573)


author: Michal Sekletar <msekleta@redhat.com> - 219-30.5
changelog:
  - on update from systemd version 219-21 and older generate udev rules that preserve old network interface names on VMware VMs (#1391944)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-30.7
changelog:
  - load-fragment: fix parsing values in bytes and prevent returning -ERANGE incorrectly (#1396277)
  - core: fix assertion check (#1396312)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-47
changelog:
  - cryptsetup-generator: use after free (#1477757)
  - manager: fix connecting to bus when dbus is actually around (#7205) (#1465737)
  - journal-remote: make --url option support arbitrary url (#1505385)
  - journald: make maximum size of stream log lines configurable and bump it to 48K (#6838) (#1442262)
  - service: serialize information about currently executing command (#1404657,#1471230)
  - tests: add new test for issue #518 (#1404657,)
  - tests: in RHEL-7 we don't have python3 by default (#1404657,)
  - service: attempt to execute next main command only for oneshot services (#6619) (#1404657,)
  - timedatectl: stop using xstrftime (#1503942)
  - Add support to read lz4 compressed journals (rhbz#1431687)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-48
changelog:
  - journald: never block when sending messages on NOTIFY_SOCKET socket (#1511565)
  - journal: restore watchdog support (#1511565)
  - cgroup resource property setting ignored if einval (rhbz#1302305)
  - fileio: add new helper call read_line() as bounded getline() replacement (#1503106)
  - def: add new constant LONG_LINE_MAX (#1503106)
  - fileio: rework read_one_line_file() on top of read_line() (#1503106)
  - cgroup-util: replace one use of fgets() by read_line() (#1503106)
  - conf-parse: remove 4K line length limit (#1503106)
  - test-conf-parser: add tests for config parser (#1503106)
  - fileio: use _cleanup_ for FILE unlocking (#1503106)
  - test-fileio: also test read_line() with actual files (#1503106)
  - fileio: return 0 from read_one_line_file on success (#1503106)
  - man: fix description of --force in halt(8) (#7392) (#1515130)
  - journal: return better error for empty files (#1465759)
  - journalctl: continue operation, even if we run into an invalid file (#1465759)
  - journal: remove error check that never happens (#1465759)
  - sd-journal: various clean-ups and modernizations (#1465759)
  - journalctl: when we fail to open a journal file, print why (#1465759)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-50
changelog:
  - core: fix the reversed sanity check when setting StartupBlockIOWeight over dbus (#1302305)
  - shared/dropin: ignore ENAMETOOLONG when checking drop-in directories (#7525) (#1489095)
  - enable display manager only on systemd installation (#1464893)
  - remove unnecessary dependency on dracut (#1466676)
  - substitute PACKAGE_STRING with the actual package NVR (#1453153)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-52
changelog:
  - cryptsetup: when unlocking always put path to the object into Id (#1511043)
  - cryptsetup: use more descriptive name for the variable and drop redundant function (#1511043)
  - cryptsetup-generator: do not bind to the decrypted device unit (#6538) (#1511043)
  - introduce naming based on phys_port_name for nfp via udev rule (#1516283)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-54
changelog:
  - automount: ack automount requests even when already mounted (#1535135)
  - udev: net_id add support for platform bus (ACPI, mostly arm64) devices (#1529633)
  - journald-native: Fix typo in MANDLOCK message (#1501017)
  - process-util: make our freeze() routine do something useful (#1540941)
  - dbus: propagate errors from bus_init_system() and bus_init_api() (#1541061)
  - bus-util.c: fix TasksMax= property assignment (#1537147)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-55
changelog:
  - sparse: avoid clash with __bitwise and __force from 4.10 linux/types.h (#5061) (#1447937)
  - core: Let two more booleans survive a daemon-reload (#1542391)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-57
changelog:
  - sd-journal: properly handle inotify queue overflow (#1540538)
  - sd-journal: make sure it's safe to call sd_journal_process() before the first sd_journal_wait() (#1540538)
  - journalctl: Periodically call sd_journal_process in journalctl (#1540538)
  - sd-journal: when picking up a new file, compare inode/device info with previous open file by same name (#1540538)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-57.1
changelog:
  - umount: always use MNT_FORCE in umount_all() (#7213) (#1571098)
  - core: Implement timeout based umount/remount limit (#1571098)
  - core: Implement sync_with_progress() (#1571098)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-58
changelog:
  - tmpfiles: don't skip cleanup of read-only root owned files if TMPFILES_AGE_ALL is set (#1533638)
  - timer: we already got the trigger before, no need to call UNIT_TRIGGER again (#1549119)
  - doc: fix links to binfmt_misc kernel documentation (#1572244)
  - man/udevadm: remove superfluous --version from subcommand (#1553076)
  - man/udevadm: correctly show the short version of --exit (#1552712)
  - core/timer: downgrade message about random time addition (#5229) (#1587906)
  - fd-util: add new acquire_data_fd() API helper (#1446095)
  - systemd-analyze: make dump work for large # of units (#1446095)
  - use max. message size allowed by DBus spec (#8936) (#1446095)
  - cryptsetup: support LUKS2 on-disk format (#1573838)
  - units: don't put udev to its own mount namespace with slave propagation (#1432211)
  - rules: disable support for Lenovo IR cameras (#1540418)
  - core: make sure "systemctl reload-or-try-restart is actually a noop if a unit is not running (#1191920)
  - core: fix confusing logging of instantaneous jobs (#1506256)
  - core: correct return value from reload methods (#1506256)
  - core: always try harder to get unit status message format string (#1506256)
  - core: unit_get_status_message_format() never returns NULL (#1506256)
  - core: try harder to get job completion messages too (#1506256)
  - core: remove generic job completion messages from unit vtables (#1506256)
  - core: do not log done failed-condition jobs as if unit started (#1506256)
  - core: log completion of remaining job types (#1506256)
  - core: adjust job completion message log levels (#1506256)
  - mount: add new LazyUnmount= setting for mount units, mapping to umount(8)'s "-l" switch (#3827) (#1497264)
  - rules: Add MODEL_ID for NVMe device (#7037) (#1397264)
  - umount: always use MNT_FORCE in umount_all() (#7213) (#1571098)
  - core: Implement timeout based umount/remount limit (#1571098)
  - core: Implement sync_with_progress() (#1571098)
  - journal: forward messages from /dev/log unmodified to syslog.socket (#1409659)
  - tmpfiles: use safe_glob() (#1436004)
  - core: delay adding target dependencies until all units are loaded and aliases resolved (#8381) (#1368856)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-59
changelog:
  - man: correct the meaning of TimeoutStopSec= (#1305509)
  - rules: mark hotplugged memory as movable (#1563532)
  - udev: add ID_INPUT_SWITCH for devices with switch capability (#5057) (#1597240)
  - rules: disable support for Dell IR cameras (#1591316)
  - rpm: fix 
  if [ $1 -eq 1 ] ; then 
                  systemctl preset \--global  >/dev/null 2>&1 || : 
  fi 
  () macro. (#1582383)
  - rpm: remove confusing --user before --global (#1582383)
  - automount: handle state changes of the corresponding mount unit correctly (#1596241)
  - man: document that SIGCONT always follows SIGTERM (#1601794)
  - rules: add udev rule that automatically offline HW attached to ACPI container (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-60
changelog:
  - Revert "rules: mark hotplugged memory as movable" (#1614686)
  - rules: implement new memory hotplug policy (#1614686)
  - Revert "rules: add udev rule that automatically offline HW attached to ACPI container" (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1619743)
  - cryptsetup-generator: don't return error if target directory already exists (#1619743)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1619743)
  - Make sure the mount units pulled by 'RequiresMountsFor=' are loaded (if they exist) (#1619743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.2
changelog:
  - journald: do not store the iovec entry for process commandline on stack (#1657788)
  - journald: set a limit on the number of fields (1k) (#1657792)
  - journal-remote: set a limit on the number of fields in a message (#1657792)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.4
changelog:
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667870)
  - Allocate temporary strings to hold dbus paths on the heap (#1667870)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.6
changelog:
  - Revert "bus: when dumping string property values escape the chars we use as end-of-line and end-of-item marks" (#1643172)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-63
changelog:
  - dhcp6: make sure we have enough space for the DHCP6 option header (CVE-2018-15688)
  - journald: do not store the iovec entry for process commandline on stack (#1657788)
  - journald: set a limit on the number of fields (1k) (#1657792)
  - journal-remote: set a limit on the number of fields in a message (#1657792)
  - journald: free cmdline buffers owned by iovec (#1666646)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-64
changelog:
  - detect-virt: do not try to read all of /proc/cpuinfo (#1631531)
  - core: disable the effect of Restart= if there's a stop job pending for a service (#6581) (#1626382)
  - networkd: respect DHCP UseRoutes option (#1663365)
  - networkd: fix dhcp4 link without routes not being considered ready (#8728) (#1663365)
  - networkd: dont crash when mtu changes (#6594) (#1663365)
  - tmpfiles: "e" takes globs (#1641764)
  - tmpfiles: 'e' is supposed to operate on directory only (#1641764)
  - tmpfiles: 'e' is supposed to accept shell-style globs (#1641764)
  - bus-message: do not crash on message with a string of zero length (#1643396)
  - Revert "bus: when dumping string property values escape the chars we use as end-of-line and end-of-item marks" (#1643172)
  - set automount state to waiting when the mount is stopped (#1651257)
  - core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
  - shorten hostname before checking for trailing dot (#1631625)
  - journald: fixed assertion failure when system journal rotation fails (#9893) (#1619543)
  - local-addresses: handle gracefully if routes lack an RTA_OIF attribute (#1627750)
  - rules: fix memory hotplug rule so systemd-detect-virt does not run too often (#1666612)
  - 6647 - use path_startswith("/dev") in cryptsetup (#6732) (#1664695)
  - core: mount-setup: handle non-existing mountpoints gracefully (#1585411)
  - units/rescue.service.in: fix announcement message (#1660422)
  - systemctl: Allow 'edit' and 'cat' on unloaded units (#1649518)
  - main: improve RLIMIT_NOFILE handling (#5795) (#1585913)
  - shared/sleep-config: exclude zram devices from hibernation candidates (#1609816)
  - journalctl: allow --file/--directory with --boot or --list-boots (#1463678)
  - journalct: allow --boot=0 to DTRT with --file/--directory (#1463678)
  - journal-remote: show error message if output file name does not end with .journal (bz#1267552)
  - artificially serialize building of .policy files (#1272485)
  - cryptsetup: add support for sector-size= option (#9936) (#1571801)
  - cryptsetup: do not define arg_sector_size if libgcrypt is v1.x (#9990) (#1571801)
  - journal: fix syslog_parse_identifier() (#1657794)
  - journal: do not remove multiple spaces after identifier in syslog message (#1657794)
  - tmpfiles: change ownership of symlinks too (#1620110)
  - tmpfiles: fix check for figuring out whether to call chmod() (#1620110)
  - shared/install: allow "enable" on linked unit files (#1628575)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-65
changelog:
  - backport fd_is_fs_type (#1663143)
  - backport chase_symlinks (#1663143)
  - fs-util: add new CHASE_SAFE flag to chase_symlinks() (#1663143)
  - fs-util: add new chase_symlinks() flag CHASE_OPEN (#1663143)
  - sd-dameon: also sent ucred when our UID differs from EUID (#1663143)
  - notify: add new --uid= command (#1663143)
  - core: be stricter when handling PID files and MAINPID sd_notify() messages (#1663143)
  - journald: respect KeepFree= as well as MaxUse= values (#1361893)
  - shutdown: in_container was used before its definition (#1693716)
  - core: Fix edge case when processing /proc/self/mountinfo (#1691511)
  - sd-bus: deal with cookie overruns (#1693559)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667871)
  - Allocate temporary strings to hold dbus paths on the heap (#1667871)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1667871)
  - udev: check if the spawned PID didn't exit after reaping unexpected PID (#1697909)
  - udev: call poll() again after killing the spawned process (#1697909)
  - udev: check age against both timeouts to prevent integer wraparound (#1697909)
  - avoid possible hang if our child process hangs (#1697909)
  - missing: when adding syscall replacements, use different names (#1694605)
  - include sys/sysmacros.h in more places (#1694605)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-66
changelog:
  - sd-bus: unify three code-paths which free struct bus_container (#1643394)
  - hashmap: don't use mempool (#1609349)
  - man: be more explicit about thread safety of sd_journal (#1609349)
  - selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to audit (#1240730)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-67.1
changelog:
  - return error value on failure (#1729226)
  - revert local changes made during backport of the test (#1729226)
  - core/timer: Prevent timer looping when unit cannot start (#1729230)
  - core: add a "Requires=" dependency between units and the slices they are located in (#1729228)
  - core: rerun GC logic for a unit that loses a reference (#1729228)
  - pid1: rename unit_check_gc to unit_may_gc (#1729228)
  - pid1: include the source unit in UnitRef (#1729228)
  - pid1: fix collection of cycles of units which reference one another (#1729228)
  - pid1: free basic unit information at the very end, before freeing the unit (#1729228)
  - pid1: properly remove references to the unit from gc queue during final cleanup (#1729228)
  - service: relax PID file symlink chain checks a bit (#8133) (#1729414)
  - path-util: fix more path_is_mount e792e890f fallout (#1279231)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-67.4
changelog:
  - core: when restarting services, don't close fds (#1798162)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1798162)
  - tests: add basic journal test (#1798162)
  - tests: add regression test for `systemctl restart systemd-journald` (#1798162)
  - tests: add test that journald keeps fds over termination by signal (#1798162)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-70
changelog:
  - udev-rules: Add rule for /dev/kfd (#1659516)
  - core: exclude .slice units from "systemctl isolate" (#1745199)
  - udev/scsi_id: fix incorrect page length when get device identification VPD page (#1635945)
  - core: when determining whether a process exit status is clean, consider whether it is a command or a daemon (#1560417)
  - units: add Wants=initrd-cleanup.service to initrd-switch-root.target (#4345) (#1560417)
  - units: make sure initrd-cleanup.service terminates before switching to rootfs (#1560417)
  - core: tiny tweak for cgroup trimming during manager_free() (#1630378)
  - process: an empty environment block should be returned as such (#1685648)
  - core: make sure initrd-switch-root command survives PID1's killing spree (#4730) (#1754053)
  - systemctl: always avoid being killed when doing switch-root (#1754053)
  - units: drop KillMode= from initrd-switch-root.service (#1754053)
  - systemctl: ignore SIGTERM after switch root (#1754053)
  - units: restore Before dependencies for systemd-vconsole-setup.service (#1754053)
  - core: reduce the number of stalled PIDs from the watched processes list when possible (#1501796)
  - timedate: use gmtime_r() and localtime_r() (#1694605)
  - sd-bus: stop using the result of an assignment as an operand of && (#1694605)
  - journal-upload: add asserts that snprintf does not return an error (#1694605)
  - analyze: actually select longest activated-time of services (#1694605)
  - pid1: remove unnecessary error reassignment (#1694605)
  - core: drop unnecessary condition (#1694605)
  - import: drop unnecessary condition (#1694605)
  - journal-verify: add comment and silence LGTM warning (#1694605)
  - journal: drop redundant condition (#1694605)
  - lldp: set correct state for processing (#1694605)
  - sd-bus: fix implicit downcast of bitfield reported by LGTM (#1694605)
  - tree-wide: use 'signed int' instead of 'int' for bit field variables (#1694605)
  - machinectl: check correct FD for a return value (#1694605)
  - shared/install: avoid overwriting 'r' counter with a partial result (#1694605)
  - systemctl: set_put() can't return (-)EEXIST (#1694605)
  - systemctl: remove dead check (#1694605)
  - journal-gateway: explicitly declare local variables (#1694605)
  - journal-gateway: use localStorage["cursor"] only when it has valid value (#1694605)
  - lgtm: ignore files dropped in upstream (#1694605)
  - lgtm: suppress several constant comparisons (#1694605)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-71
changelog:
  - core: add a new unit_needs_console() call (#1524359)
  - core: rework how we count the n_on_console counter (#1524359)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-72
changelog:
  - service: introduce protocol error type (#1733998)
  - service: fix main processes exit behavior for type notify services (#1733998)
  - service: go through stop_post on failure (#4770) (#1733998)
  - Call getgroups() to know size of supplementary groups array to allocate (#1743230256 KB)
  - udev: introduce CONST key name (#1748051)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.2
changelog:
  - core: when restarting services, don't close fds (#1803802)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1803802)
  - tests: add basic journal test (#1803802)
  - tests: add regression test for `systemctl restart systemd-journald` (#1803802)
  - tests: add test that journald keeps fds over termination by signal (#1803802)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.4
changelog:
  - mount: don't propagate errors from mount_setup_unit() further up (#1809159)
  - mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1809159)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.5
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1810576)
  - core: rework StopWhenUnneeded= logic (#1810576)
  - fix the fix for #1691511 (#1809159)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.6
changelog:
  - sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1817504)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1820073)
  - sd-journal: remove the dead code and actually fix #14695 (#1820073)
  - swap: adjust swap.c in a similar way to what we just did to mount.c (#1821261)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1821261)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-74
changelog:
  - sd-bus: bump message queue size again (#1770158)
  - unit: fix potential use of cgroup_path after free() when freeing unit (#1760149)
  - add test for ExecStopPost (#1733998)
  - core: when restarting services, don't close fds (#1757704)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1757704)
  - tests: add basic journal test (#1757704)
  - tests: add regression test for `systemctl restart systemd-journald` (#1757704)
  - tests: add test that journald keeps fds over termination by signal (#1757704)
  - nss-util: silence warning about deprecated RES_USE_INET6 (#1799002)
  - journal: do not trigger assertion when journal_file_close() get NULL (#1786046)
  - mount: don't propagate errors from mount_setup_unit() further up (#1804757)
  - mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1804757)
  - fix the fix for #1691511 (#1804757)
  - v3: Properly parsing SCSI Hyperv devices (#8509) (#1809053)
  - Consider smb3 as remote filesystem (#1811700)
  - mount: don't add Requires for tmp.mount (#1813270)
  - sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1769928)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1812889)
  - sd-journal: remove the dead code and actually fix #14695 (#1812889)
  - swap: adjust swap.c in a similar way to what we just did to mount.c (#1749621)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749621)
  - core: add a new unit file setting CollectMode= for tweaking the GC logic (#1817576)
  - run: add "-G" as shortcut for "--property=CollectMode=inactive-or-failed" (#1817576)
  - core: clarify that the CollectMode bus property is constant (#1817576)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1814028)
  - logind: check PolicyKit before allowing VT switch (#1797672)
  - timer: don't use persietent file timestamps from the future (#6823) (#1769923)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766477)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798503)
  - journal-remote: split-mode=host, remove port from journal filename (#1244691)
  - core: downgrade log message about inability to propagate cgroup release message (#1679934)
  - units: move Before deps for quota services to remote-fs.target (#5627) (#1693374)
  - set kptr_restrict=1 (#1689344)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
  - core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
  - core: coldplug possible nop_job (#1829754)
  - core: make sure to restore the control command id, too (#1828953)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.1
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793527)
  - device: don't emit PropetiesChanged needlessly (#1793527)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.2
changelog:
  - core: don't update unit description if it is already set to the same value (#1793527)
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1793527)
  - core: fix unnecessary fallback to the rescue mode caused by initrd-switch-root.service's exit status judgment error (#1825232)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.4
changelog:
  - test: add a test/reproducer for BZ#1989245 (#1989245)
  - strv: fix buffer size calculation in strv_join_quoted() (#1989245)
  - install: refactor find_symlinks() and don't search for symlinks recursively (#1828758)


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 219-78.9.tuxcare.els1
changelog:
  - Moved tuxcare patches from 219-78.7.tuxcare.els1
  - CVE-2023-26604: use only less as a pager and restrict its functionality
    (e.g stop running external shell) unless environment variable
    SYSTEMD_PAGERSECURE is defined


author: Frank Ch. Eigler <fche@redhat.com> - 2.6-3
changelog:
  - Added probinson's patch BZ1141919 for enabling more ppc64/aarch64 facilities,
    with some staplog.c followup


author: Frank Ch. Eigler <fche@redhat.com> - 2.6-6
changelog:
  - rhbz1164373 (fix ppc64 kprobes via KERNEL_RELOC_SYMBOL)
  - rhbz1119335 (document STAP_FIPS_OVERRIDE in staprun.8)
  - rhbz1127591 (ppc64 hcall_* tracepoint blacklisting)


author: Frank Ch. Eigler <fche@redhat.com> - 2.7-2
changelog:
  - Upstream release, incl. rhel6.7 post-release xmltohtml patch
  - pre-rebase-rebase for aarch64 mass-rebuild


author: Frank Ch. Eigler <fche@redhat.com> - 2.8-3
changelog:
  - rhbz1237098: handle symbol-table vs. linkage-name mismatches better
  - some runtime robustification fixes backported from upstream


author: Frank Ch. Eigler <fche@redhat.com> - 3.0-3
changelog:
  - rhbz1346112 delay tls cert creation
  - rhbz1269062 null elevator
  - rhbz1337416 'count' tapset variable - autocast/@defined


author: David Smith <dsmith@redhat.com> - 3.1-3
changelog:
  - Added patches for:
  - rhbz1425568 task_dentry_path() fix
  - rhbz1431263 arm64 hardware breakpoint crash fix
  - rhbz1430828 replace task_exe_file() with current_exe_file()
  - rhbz1436845 adapt stapdyn to the dyninst 9.3.1 library search model
  - rhbz1433391 workaround parser issue in nfs_proc.stp
  - rhbz1428120 update lookup_bad_addr()


author: Frank Ch. Eigler <fche@redhat.com> - 3.2-3
changelog:
  - rhbz1506230 (netif_receive_skb_internal probing)
  - rhbz1490862 (f2fs tracepoint header workarounds)


author: Frank Ch. Eigler <fche@redhat.com> - 3.3-2
changelog:
  - Enable BPF build (rhbz1544689, rhbz1311586) (x86-64 only)
  - Fix vfs.add_to_page_cache probe (rhbz1547238)
  - Fix foreach_limit.exp compilability (rhbz1591267)


author: Serhei Makarov <smakarov@redhat.com> - 3.3-3
changelog:
  - Add BPF left-operand fix (rhbz1560044) (x86-64 only)
  - Add stap.1 note on missing stapbpf.8 (rhbz1560044)
  - Fix RHEL-ALT build (rhbz1544689)


author: gil cattaneo <puntogil@libero.it> 0:1.2.1-1
changelog:
  - Upgraded to 1.2.1
  - remove ant-nodeps reference
  - changed group in javadoc sub package (from Development/Documentation in Documentation)
  - add maven metadata
  - add manual
  - Adapt to current guidelines.


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb46-4
changelog:
  - Properly detect errors when writing backup files. (Closes: #80) (#81)
  - Read number of backup files to keep from file
  - config: defend on '/etc/target/backup' directory
  - config: backup when current config is different from recent backup copy
  - config: rename key 'kept_backups' as 'max_backup_files'
  - backup: global option to tune max no. of backup conf files


author: Andy Grover <agrover@redhat.com> - 2.1.fb31-1
changelog:
  - New upstream version
  - Move service handling to python-rtslib
  - Remove old packaging bits: clean, buildroot, defattr


author: Petr Machata <pmachata@redhat.com> - 4.1-2.20130314
changelog:
  - Fix mfence patch.  Since the __TBB_full_memory_fence macro was
    function-call-like, it stole () intended for function invocation.


author: Petr Machata <pmachata@redhat.com> - 4.1-6.20130314
changelog:
  - Drop ExclusiveArch altogether. TBB has a fallback code that works
    irrespective of the architecture.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.5.13-5
changelog:
  - Fixed fork, enabled threading (by notifier-thread-fork-fix patch)
    Resolves: rhbz#869315
  - Rebuild to fix systemtap on aarch64
    Resolves: rhbz#1238479


author: Michal Sekletar <msekleta@redhat.com> - 14:4.5.1-3
changelog:
  - add support for nano second timestamps (#1151406)
  - fix cdp dissector, allow zero-length data frames (#1231246)


author: Martin Sehnoutka <msehnout@redhat.com> - 14:4.9.0-1
changelog:
  - New upstream version 4.9.0. Resolves: #1422473
  - Add legacy -P switch with warning. Related to #1422473 and #1292056


author: Martin Sehnoutka <msehnout@redhat.com> - 14:4.9.0-4
changelog:
  - Drop downstream patch (drop root privileges)
  - Add libcap-ng as a new build dependency
  - Related: #1262283


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Resolves: #1664648 - tcpdump post creates user and groups unconditionally, raising alerts in corporate environment


author: Jaromír Končický <jkoncick@redhat.com> - 6.18.01-4
changelog:
  - Fix regression in default $status value in case of lists/pipelines
    (Changed 'anyerror' variable to 'tcsh_posix_status' with opposite meaning)
    Resolves: #1025703


author: Jaromír Končický <jkoncick@redhat.com> - 6.18.01-5
changelog:
  - Readded reverse-history-handling-in-loops patch which was created for
    tcsh version 6.17.00 in RHEL 6.4 to fix bug #814069
    Resolves: #1035235


author: David Kaspar <dkaspar@redhat.com> - 6.18.01-8
changelog:
  - Upstream's $anyerror variable re-introduced. (#1123854)
  - Fix for hang inside the 'wait' built-in of tcsh added. (#1181682)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.18.01-9
changelog:
  - 'if statement' parsing fixed when the space is missing after ')'. (#1273892)
  - Quote backslashes properly to preserve them in `...` expressions. (#1319816)
  - Fix for tcsh being interruptible while waiting for child process. (#1269370)
  - Fix of memory leak when using the 'source' built-in command.      (#1273513)
  - Print error message on stderr (instead of stdout).                (#1273498)
  - Use GLIBC's malloc instead of builtin malloc.                     (#1315713)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.18.01-12
changelog:
  - Fix another regression in tcsh-6.18.01-quote-backslashes-properly.patch
    Related: #1334751

  - Fix regression in tcsh-6.18.01-use-stderr-upon-error.patch
    Related: #1273498


author: Fridolin Pokorny <fpokorny@redhat.com> 6.18.00-7
changelog:
  - File locking patch modified to reflect HIST_MERGE flag (#879371)
  - Drop tcsh-6.18.00-sigint-while-waiting-for-child.patch, accepted by upstream
  - Add tcsh-6.18.00-history-merge.patch to merge histlist properly (#919452)
  - Add tcsh-6.18.00-history-savehist.patch to store history with length
    $savehist, not only $history.


author: Fridolin Pokorny <fpokorny@redhat.com> 6.18.01-1
changelog:
  - Update to tcsh-6.18.01
  - Removed tcsh-6.18.00-history-savehist.patch, not accepted by upstream
    http://mx.gw.com/pipermail/tcsh-bugs/2013-March/000824.html


author: Brian Pepple <bpepple@fedoraproject.org> - 1:5.14.1-1
changelog:
  - Update to 5.14.1.
  - Drop defattr. No longer needed.
  - Drop ignore gnome keyring patch. Fixed upstream.


author: Debarshi Ray <rishi@fedoraproject.org> - 1:5.14.1-5
changelog:
  - Add %check to run the upstream test suite on each build (Red Hat #1000705)
  - Resort to using chrpath for removing rpaths instead of hacking libtool


author: Martin Sehnoutka <msehnout@redhat.com> - 1:0.17-60
changelog:
  - Introduce new -i switch
  - ip addresses will be logged into utmp instead of hostname
  - Resolves: #1323094


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-63
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - additional info added to manpage


author: Michal Ruprich - 1:0.17-64
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - more clear formulation of man page note - previous note was a bit ambiguous


author: Than Ngo <than@redhat.com> - 2:2012-34.20130427_r30134
changelog:
  - Resolves: bz#1064453, add missing texlive-metapost and groff.enc
    Resolves: bz#948532, add missing manpages for pdfxmltex, xmltex
    Resolves: bz#1213886, tex4ht-bin requires latex
    Resolves: bz#1217556, port for poppler-0.26.5
    Resolves: bz#1035679, scriptlet errors when installing texlive packages
    Resolves: bz#1184987, add texlive-titling


author: Jan Synáček <jsynacek@redhat.com> - 5.2-12
changelog:
  - remove unnecessary installation dependency on xinetd(#1136866)
  - improve systemd unit files(#1167777)


author: willb <willb@redhat> - 0.9.1-5
changelog:
  - fixed extension library linking when an older thrift package is not
    already installed
  - fixed extension library dependencies in Makefile


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: Jan Grulich <jgrulich@redhat.com> - 1.3.1-1
changelog:
  - Drop unecessary patches
  - Re-base to 1.3.1 (bug #1199453)
  - Re-build against re-based xserver (bug #1194898)
  - Check the return value from XShmAttach (bug #1072733)
  - Add missing part of xserver114.patch (bug #1140603)
  - Keep pointer in sync (bug #1100661)
  - Make input device class global (bug #1119640)
  - Add IPv6 support (bug #1162722)
  - Set initial mode as prefered (bug #1181287)
  - Do not mention that display number is required in the file name (bug #1195266)
  - Enable Xinerama extension (bug #1199437)
  - Specify full path for runuser command (bug #1208817)


author: Jan Grulich <jgrulich@redhat.com> - 1.3.1-6
changelog:
  - Do not fail to bind a network socket
    Resolves: bz#1332575
  - Do not die when port is already taken
    Resolves: bz#1322155


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-1
changelog:
  - Update to 1.7.1
    Resolves: bz#1388620
    Resolves: bz#1343899
    Resolves: bz#1410164
    Resolves: bz#1415547
    Resolves: bz#1418945
    Resolves: bz#1416290
    Resolves: bz#1342956
  - Fix shared memory leakage
    Resolves: bz#1358090
  - Added systemd unit file for xvnc
    Resolves: bz#1393971


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-2
changelog:
  - Be more restrictive with shared memory mode bits
    Resolves: bz#1152552
    Limit max username/password size in SSecurityPlain [CVE-2017-7394]
    Resolves: bz#1438737
    Fix crash from integer overflow in SMsgReader::readClientCutText [CVE-2017-7395]
    Resolves: bz#1438742


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-3
changelog:
  - Delete underlying ssecurity in SSecurityVeNCrypt [CCVE-2017-7392]
    Resolves: bz#1439127
    Prevent double free by crafted fences [CVE-2017-7393]
    Resolves: bz#1439134


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-14
changelog:
  - Fix rendering on big endian system
    Resolves: bz#1618777

    Do not automatically kill sessions
    Resolves: bz#1646889


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-20
changelog:
  - Fix stack buffer overflow in CMsgReader::readSetCursor
    Resolves: bz#1791773

  - Fix heap buffer overflow in DecodeManager::decodeRect
    Resolves: bz#1791768

  - Fix heap buffer overflow in TightDecoder::FilterGradient
    Resolves: bz#1791763

  - Fix heap-based buffer overflow triggered from CopyRectDecoder
    Resolves: bz#1791747

  - Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
    Resolves: bz#1791759

  - Add option to fallback to empty port when the specified one is taken
    Resolves: bz#1791996


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-23
changelog:
  - Rebuild for xorg-x11-server CVEs
    Resolves: CVE-2022-4283 (bz#2154267)
    Resolves: CVE-2022-46340 (bz#2154261)
    Resolves: CVE-2022-46341 (bz#2154264)
    Resolves: CVE-2022-46342 (bz#2154262)
    Resolves: CVE-2022-46343 (bz#2154265)
    Resolves: CVE-2022-46344 (bz#2154266)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.5.13-5
changelog:
  - Enabled threading
    Resolves: rhbz#676880
  - Fixed crash if there are no fonts installed (by no-fonts-fix patch)
    Resolves: rhbz#1218943


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.12.1-12
changelog:
  - Allow unprivileged users to subscribe to indications
    Resolves: #1049313
  - Remove packages which are part of the minimum build environment from BR 
    Resolves: #1049651
  - Fix Pegasus malforms EmbeddedInstances in upcalls
    Resolves: #1038013


author: Stephen Gallagher <sgallagh@redhat.com> - 2:2.12.1-15
changelog:
  - Generate SSL certificates with x509v3 and CA:FALSE
  - Automatically import self-signed certificates into local trust-store
  - Move SSL certificate generation into the systemd service file
  - Resolves: #1041555


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-1
changelog:
  - Fix packaging of tmpfiles
    Resolves: #1180993
  - Add install Platform_LINUX_XSCALE_GNU.h, Linkage.h and CIMListener.h to -devel
    because of lmiwbem (CIMListener class), add symlink to libpeglistener.so.1
    Resolves: #1120701
  - Update to upstream version 2.14.1
    Resolves: #1097187, #1039050, #1007386
  - Fix sending of SNMPv3 traps
    Resolves: #1218954


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-2
changelog:
  - Remove files created in %check
    Resolves: #1232341
  - Fix setupSDK in -devel
    Resolves: #1127399
  - Add snmp tests to the -test rpm and enable them, configure snmptrapd
    in test setup phase
    Related: #1218954


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-1
changelog:
  - Resolves: rhbz#1287928 Rebase to tomcat 7.0.69
  - Resolves: rhbz#1327326 rpm -V tomcat fails on /var/log/tomcat/catalina.out
  - Resolves: rhbz#1277197 tomcat user has non-existing default shell set
  - Resolves: rhbz#1240279 The command tomcat-digest doesn't work with RHEL 7
  - Resolves: rhbz#1229476 Tomcat startup ONLY options
  - Resolves: rhbz#1133070 Need to include full implementation of tomcat-juli.jar and tomcat-juli-adapters.jar
  - Resolves: rhbz#1201409 Fix the broken tomcat-jsvc service unit
  - Resolves: rhbz#1221896 tomcat.service loads /etc/sysconfig/tomcat without shell expansion
  - Resolves: rhbz#1208402 Mark web.xml in tomcat-admin-webapps as config file


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-2
changelog:
  - Rebase Resolves: rhbz#1311622 Getting NoSuchElementException while handling attributes with empty string value in tomcat
  - Rebase Resolves: rhbz#1320853 Add HSTS support
  - Rebase Resolves: rhbz#1293292 CVE-2014-7810 tomcat: Tomcat/JBossWeb: security manager bypass via EL expressions
  - Rebase Resolves: rhbz#1347144 CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet
  - Rebase Resolves: rhbz#1347139 CVE-2015-5346 tomcat: Session fixation
  - Rebase Resolves: rhbz#1347136 CVE-2015-5345 tomcat: directory disclosure
  - Rebase Resolves: rhbz#1347129 CVE-2015-5174 tomcat: URL Normalization issue
  - Rebase Resolves: rhbz#1347146 CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()
  - Rebase Resolves: rhbz#1347142 CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms
  - Rebase Resolves: rhbz#1347133 CVE-2015-5351 tomcat: CSRF token leak


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-4
changelog:
  - Resolves: rhbz#1350438 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-9
changelog:
  - Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368122


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-11
changelog:
  - Resolves: rhbz#1413591 CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing
  - Resolves: rhbz#1402662 CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.69-12
changelog:
  - Resolves: rhbz#1441487 CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object
  - Resolves: rhbz#1441480 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used
  - Resolves: rhbz#1459746 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-2
changelog:
  - Resolves: rhbz#1459747 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
  - Resolves: rhbz#1441481 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-3
changelog:
  - Resolves: rhbz#1498343 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws
  - Resolves: rhbz#1495655 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning
  - Resolves: rhbz#1470597 CVE-2017-5647 Add follow up revision


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-5
changelog:
  - Resolves: rhbz#1485453 man page uid and gid mismatch for service accounts
  - Resolves: rhbz#1505762 Problem to start tomcat with a user whose group has a name different to the user


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-9
changelog:
  - Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
  - Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
  - Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
  - Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
  - Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
  - Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
  - Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
  - Resolves: rhbz#1455483 Add support for characters "<" and ">" to the possible whitelist values


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-12
changelog:
  - Resolves: rhbz#1367492 harden package permissions
  - Resolves: rhbz#1523112 tomcat systemd does not cope with - in service names
  - Resolves: rhbz#1629162 tomcat-dbcp.jar is missing from tomcat package
  - Resolves: rhbz#1822453 Tomcat parses a request having an absolute URI path incorrectly and returns 404 Not Found
  - Resolves: rhbz#1795645 connection leak with StatementCache, SlowQueryReport or StatementDecoratorInterceptor
  - Resolves: CVE-2019-17563 tomcat: session fixation when using FORM authentication


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
  - Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
  - Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
  - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
  - Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-3
changelog:
  - Resolves: rhbz#1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws
  - Resolves: rhbz#1495654 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning
  - Resolves: rhbz#1470596 CVE-2017-5647 Add follow up revision


author: Matthew Harmsen <mharmsen@redhat.com> - 6.0.0-1
changelog:
  - Bugzilla Bug #702716 - rhcs80 cannot do client auth with pkiconsole
    (ok with 7.3) (jmagne)
  - Require "jss >= 4.2.6-17" as a build and runtime requirement
  - Bump version 2.1.1 --> 6.0.0 (to better coincide with tomcat6)


author: Matthew Harmsen <mharmsen@redhat.com> 6.0.2-1
changelog:
  - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . (mharmsen)
  - Bugzilla Bug #699809 - Convert CS to use systemd (alee)


author: Matthew Harmsen <mharmsen@redhat.com> 7.0.0-3
changelog:
  - PKI TRAC Ticket #283 - Dogtag 10: Integrate Tomcat 6 'tomcatjss.jar' and
    Tomcat 7 'tomcat7jss.jar' in Fedora 18 tomcatjss package


author: Christina Fu <cfu@redhat.com> - 7.1.0-5
changelog:
  - Bugzilla Bug #1058366 NullPointerException in tomcatjss searching
    for attribute "clientauth" (cfu)
  - Bugzilla Bug #871171 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 (cfu)


author: Christina Fu <cfu@redhat.com> 7.1.0-6
changelog:
  - Bugzilla Bug #1198450 - Support for Tomcat 8 (edewata)
  - Eclipse support - 2 patches(alee)
  - Add nuxwdog support (alee)


author: Christina Fu <cfu@redhat.com> 7.1.1-1
changelog:
  - Bugzilla Bug #1058366 NullPointerException in tomcatjss searching
    for attribute "clientauth" (cfu)
  - Bugzilla Bug #871171 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 (cfu)
  - Bumped revision to 7.1.1


author: Endi Sukma Dewata <edewata@redhat.com> 7.1.2-2
changelog:
  - Bugzilla Bug #1344804 - Build failure on RHEL 7.3
    (patch for Bugzilla Bug #1245786 - Build failure on F23 was backported to
     RHEL 7 to coincide with Apache Tomcat version change to 7.0.68+)


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.0-1
changelog:
  - tomcatjss Pagure Issue #6 - Rebase tomcatjss to 7.2.0 in Fedora 25+ (mharmsen)
  - Bugzilla Bug #1394416 - Rebase tomcatjss to 7.2.0 in RHEL 7.4 (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.0-2
changelog:
  - Changed build so that it did not package and depend upon the specfile being
    included inside the tarball


author: Matthew Harmsen <mharmsen@redhat.com> - 7.2.1-3
changelog:
  - Bugzilla Bug #1394416 - Rebase tomcatjss to 7.2.x in RHEL 7.4 (mharmsen)
  - ## 'tomcatjss-support-for-event-API.patch' resolves the following issues
    - tomcatjss Pagure Issue #4 - Support for Event API (edewata)


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.1-7
changelog:
  - Updated jss build and runtime dependencies
  - Bugzilla Bug #1597180 - Tomcatjss: Add support for TLS_*_SHA384 ciphers
    [rhel-7.5.z] (cfu)


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.1-7
changelog:
  - Updated jss build and runtime dependencies
  - Bugzilla Bug #1596769 - Tomcatjss: Add support for TLS_*_SHA384
    ciphers (cfu)


author: Jack Magne <jmagne@redhat.com> 7.2.1-8
changelog:
  - Bugzilla Bug #1632618 - CC: tomcatjss: unable to enable OCSP checking
    from peer AIA extension [rhel-7.6.z] (jmagne)


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-1
changelog:
  - Update to 3.14.3
  - Re-add opensubtitles plugin, as it doesn't depend on PyXDG anymore
  Resolves: #1174589


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-4
changelog:
  - Remove Python3 plugins, they're mostly accessory plugins,
    and RHEL 7.2 only support Python2 for now
  Resolves: #1259643


author: Ray Strode <rstrode@redhat.com> 3.14.3-5
changelog:
  - Add more goo to the compat desktop file to prevent them
    from exposing in control-center
  Related: #1259292


author: John Kacur <jkacur@redhat.com> - 2.2.1-2
changelog:
  - Various fixes for problems discovered by rpmlint
  - Update the address of FSF in various files
  - Install documentation and non-script python files at mode 644


author: John Kacur <jkacur@redhat.com> - 2.2.1-8
changelog:
  - Remove patches from tar file, and apply them explicitly in the spec file
  - trace-split-Do-not-allow-spliting-of-latency-tracers.patch
  Resolves: rhbz#1198942


author: John Kacur <jkacur@redhat.com> - 2.2.2-1
changelog:
  - Update to trace-cmd-v2.2.2 which includes the following fixes
  - trace-input: Init kbuf back to NULL after free kbuf
  - kernelshark: Use ull annotation for 64bit numbers
  Resolves: rhbz#1219847


author: Pravin Satpute <psatpute@redhat.com> 3.0.9-42
changelog:
  - Resolves: rh#1125703 ttmkfdir fails to build on arch: ppc64le (Generic build failure)
  - Patch from Peter Robinson <pbrobinson@redhat.com>


author: John Kacur <jkacur@redhat.com> - 0.11-3
changelog:
  - spec: Mark configuration files with %config (998984)
  - spec: Document the real location of the source in a comment (998987)
  - CLI: fix ps_show_thread call with bad args count (1000025)


author: John Kacur <jkacxur@redhat.com> - 0.11.1-4
changelog:
  - tuna: Do polkit auth for GUI BZ:919212,974027 (996885)
  - tuna: Auto Correction for config file errors (1015062)
  - Rebased to 0.11.1 upstream
  Resolves: rhbz#996885
  Resolves: rhbz#1015062


author: John Kacur <jkacur@redhat.com> - 0.11.1-6
changelog:
  - tuna-modified-sysctl-settings-in-example.conf (1031582)
  - CLI-fix-traceback-where-enter-p-policy-without-prio (1035794)
  Resolves: rhbz#1035794


author: John Kacur <jkacur@redhat.com> - 0.11.1-10
changelog:
  - dropped the git housekeeping patch, not relevant here
  - docs-Remove-stray-a.patch
  - CLI-Introduce-nohz_full-N-entity.patch
  - tuna-config-Fix-pygtk-import.patch
  - tuna-Make-isolate-include-operations-affect-proc-irq.patch
  - tuna-Decide-whether-to-isolate-a-thread-based-on-PF_.patch
  - tuna-Fix-race-in-is_hardirq_handler.patch
  - CLI-Do-not-show-column-headers-when-not-outputting-t.patch
  - Correct-a-typo-in-the-net.ipv4.ipfrag_time-help-stri.patch
  Resolves: rhbz#1234963


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.10.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1546598
    - script: show stderr output in the log
    - realtime-virtual-host: script.sh: add error checking
    - man: improved tuned-profiles-cpu-partitioning.7
    - bootloader: check if grub2_cfg_file_name is None in _remove_grub2_tuning()
    - plugin_scheduler: whitelist/blacklist processed also for thread names
    - bootloader: patch all GRUB2 config files
    - profiles: added mssql profile
    - tuned-adm: print log excerpt when changing profile
    - cpu-partitioning: use no_balance_cores instead of no_rebalance_cores
    - sysctl: support assignment modifiers as other plugins do
    - oracle: fixed ip_local_port_range parity warning
      resolves: rhbz#1527219
    - Fix verifying cpumask on systems with more than 32 cores
      resolves: rhbz#1528368
    - oracle: updated the profile to be in sync with KCS 39188
      resolves: rhbz#1447323


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.10.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1546598
    - IRQ affinity handled by scheduler plugin
      resolves: rhbz#1590937


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.10.0-3
changelog:
  - realtime-virtual-guest/host: start/stop rt-entsk daemon on
    initialization/shutdown
    resolves: rhbz#1616043


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1643654
    - disable KSM only once, re-enable it only on full rollback
      resolves: rhbz#1622239
    - functions: reworked setup_kvm_mod_low_latency to count with kernel changes
      resolves: rhbz#1649408
    - updated virtual-host profile
      resolves: rhbz#1569375
    - added log message for unsupported parameters in plugin_net
      resolves: rhbz#1533852
    - added range feature for cpu exclusion
      resolves: rhbz#1533908
    - make a copy of devices when verifying tuning
      resolves: rhbz#1592743
    - fixed disk plugin/plugout problem
      resolves: rhbz#1595156
    - fixed unit configuration reading
      resolves: rhbz#1613379
    - reload profile configuration on SIGHUP
      resolves: rhbz#1631744
    - use built-in functionality to apply system sysctl
      resolves: rhbz#1663412


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1643654
    - used dmidecode only on x86 architectures
      resolves: rhbz#1688371
    - recommend: fixed to work without tuned daemon running
      resolves: rhbz#1687397


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-7
changelog:
  - plugin_sysctl: fixed traceback when assignments modifiers ('<', '>')
    are used with sysctl and the current sysctl value is the same as
    the new value
    Resolves: rhbz#1739418


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-9
changelog:
  - Fixed SIGHUP handling
    Resolves: rhbz#1702724
  - Tune irqbalance service
    Resolves: rhbz#1720042
  - Added netcat requirement
    Resolves: rhbz#1746436
  - sysctl: made reapply_sysctl ignore configs from /usr
    Resolves: rhbz#1776149
  - profiles: define variables before use
    Resolves: rhbz#1781664


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-10
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1852253


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-5.1
changelog:
  - plugin_sysctl: fixed traceback when assignments modifiers ('<', '>')
    are used with sysctl and the current sysctl value is the same as
    the new value
    Resolves: rhbz#1739563


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.0-1
changelog:
  - new-release
    resolves: rhbz#1155052
    - add support for ethtool -C to tuned network plugin
      resolves: rhbz#1152539
    - add support for ethtool -K to tuned network plugin
      resolves: rhbz#1152541
    - add support for calculation of values for the kernel command line
      resolves: rhbz#1191595
    - no error output if there is no hdparm installed
      resolves: rhbz#1191775
    - do not run hdparm on hotplug events if there is no hdparm tuning
      resolves: rhbz#1193682
    - add oracle tuned profile
      resolves: rhbz#1196298
    - fix bash completions for tuned-adm
      resolves: rhbz#1207668
    - add glob support to tuned sysfs plugin
      resolves: rhbz#1212831
    - add tuned-adm verify subcommand
      resolves: rhbz#1212836
    - do not install tuned kernel command line to rescue kernels
      resolves: rhbz#1223864
    - add variables support
      resolves: rhbz#1225124
    - add built-in support for unit conversion into tuned
      resolves: rhbz#1225135
    - fixed vm.max_map_count setting in sap-netweaver profile
      resolves: rhbz#1228562
    - create tuned profile for RHEL-RT
      resolves: rhbz#1228801
    - plugin_scheduler: added support for runtime tuning of processes
      resolves: rhbz#1148546
    - add support for changing elevators on xvd* devices (Amazon EC2)
      resolves: rhbz#1170152
    - add workaround to be run after systemd-sysctl
      resolves: rhbz#1189263
    - do not change settings of transparent hugepages if set in kernel cmdline
      resolves: rhbz#1189868
    - add tuned profiles for RHEL-NFV
      resolves: rhbz#1228803
    - plugin_bootloader: apply $tuned_params to existing kernels
      resolves: rhbz#1233004
    - add support for no daemon mode
      resolves: rhbz#1068663


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-1
changelog:
  - new-release
    related: rhbz#1155052
    - plugin_scheduler: work with nohz_full
      resolves: rhbz#1247184
    - fixed realtime-virtual-guest/host profiles packaged twice
      resolves: rhbz#1249028
    - fixed requirements of realtime and nfv profiles
    - fixed tuned-gui not starting
    - various other minor fixes
    - defuzzified gtk-3.8 patch


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-4.1
changelog:
  - fixed various verification issues (by verification-fixes patch)
    resolves: rhbz#1282565
  - realtime profile now sets cpumask of unbound workqueues
    (by realtime-set-unbound-workqueues patch)
    resolves: rhbz#1282566
  - fixed lapic_timer_adv_ns cache in realtime-virtual-host profile
    (by lapic-timer-adv-ns-cache-fix patch)
    resolves: rhbz#1282567
  - fixed find-lapictscdeadline-optimal-fix in realtime-virtual-host profile
    (by find-lapictscdeadline-optimal-fix patch)
    resolves: rhbz#1282592
  - removed nohz_full from the realtime profile (by realtime-remove-nohz-full
    patch)
    resolves: rhbz#1282570


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-4.2
changelog:
  - fixed race in modprobe in realtime-virtual-host profile and extended
    stop action to have hint why it is called
    resolves: rhbz#1298204


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-4.4
changelog:
  - fixed traceback by always stripping assignment modifiers even if not used
    (by assignment-modifiers-strip-fix patch)
    resolves: rhbz#1363682
  - added workaround for embedded slashes in device names
    (by embedded-slashes-in-device-name-fix patch)
    related: rhbz#1363682


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-4.5
changelog:
  - realtime: disabled timer migration
    resolves: rhbz#1360800
  - realtime-virtual-host/guest: added rcu_nocbs kernel boot parameter
    resolves: rhbz#1334479


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-5
changelog:
  - fixed various verification issues (by verification-fixes patch)
    resolves: rhbz#1252153
  - realtime profile now sets cpumask of unbound workqueues
    (by realtime-set-unbound-workqueues patch)
    resolves: rhbz#1259043
  - fixed lapic_timer_adv_ns cache in realtime-virtual-host profile
    (by lapic-timer-adv-ns-cache-fix patch)
    resolves: rhbz#1259452
  - fixed find-lapictscdeadline-optimal-fix in realtime-virtual-host profile
    (by find-lapictscdeadline-optimal-fix patch)
    resolves: rhbz#1267284
  - removed nohz_full from the realtime profile (by realtime-remove-nohz-full
    patch)
    resolves: rhbz#1274486


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-6
changelog:
  - fixed race in modprobe in realtime-virtual-host profile and extended
    stop action to have hint why it is called
    resolves: rhbz#1292117


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.7.0-1
changelog:
  - new-release
    - rebase tuned to latest upstream
      resolves: rhbz#1289048
    - gui: fixed save profile
      resolves: rhbz#1242491
    - tuned-adm: added --ignore-missing parameter
      resolves: rhbz#1243807
    - plugin_vm: added transparent_hugepage alias
      resolves: rhbz#1249610
    - plugins: added modules plugin
      resolves: rhbz#1249618
    - plugin_cpu: do not show error if cpupower or x86_energy_perf_policy are
      missing
      resolves: rhbz#1254417
    - tuned-adm: fixed restart attempt if tuned is not running
      resolves: rhbz#1258755
    - nfv: avoided race condition by using synchronous mode
      resolves: rhbz#1259039
    - realtime: added check for isolcpus sanity
      resolves: rhbz#1264128
    - pm_qos: fixed exception if PM_QoS is not available
      resolves: rhbz#1296137
    - plugin_sysctl: reapply system sysctl after Tuned sysctl are applied
      resolves: rhbz#1302953
    - atomic: increase number of inotify watches
      resolves: rhbz#1322001
    - realtime-virtual-host/guest: added rcu_nocbs kernel boot parameter
      resolves: rhbz#1334479
    - realtime: fixed kernel.sched_rt_runtime_us to be -1
      resolves: rhbz#1346715
    - tuned-adm: fixed detection of no_daemon mode
      resolves: rhbz#1351536
    - plugin_base: correctly strip assignment modifiers even if not used
      resolves: rhbz#1353142
    - plugin_disk: try to workaround embedded '/' in device names
      related: rhbz#1353142
    - sap-hana: explicitly setting kernel.numa_balancing = 0 for better performance
      resolves: rhbz#1355768
    - libexec: fixed listdir and isdir in defirqaffinity.py
      resolves: rhbz#1252160
    - plugin_cpu: save and restore only intel pstate attributes that were changed
      resolves: rhbz#1252156
    - functions: fixed sysfs save to work with options
      resolves: rhbz#1251507
    - functions: fixed restore_logs_syncing to preserve SELinux context on rsyslog.conf
      resolves: rhbz#1268901
    - spec: correctly remove tuned footprint from /etc/default/grub
      resolves: rhbz#1268845
    - gui: fixed creation of new profile
      resolves: rhbz#1274609


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.7.1-1
changelog:
  - - new-release
    - rebase tuned to latest upstream
      resolves: rhbz#1289048
    - gui: fixed traceback caused by DBus paths copy&paste error
      related: rhbz#1356369
    - tuned-adm: fixed traceback of 'tuned-adm list' if daemon is not running
      resolves: rhbz#1358857


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-1
changelog:
  - new release
    - rebase tuned to latest upstream
      resolves: rhbz#1388454
    - cpu-partitioning: enabled timer migration
      resolves: rhbz#1408308
    - cpu-partitioning: disabled kvmclock sync and ple
      resolves: rhbz#1395855
    - spec: muted error if there is no selinux support
      resolves: rhbz#1404214
    - units: implemented instance priority
      resolves: rhbz#1246172
    - bootloader: added support for initrd overlays
      resolves: rhbz#1414098
    - cpu-partitioning: set CPUAffinity early in initrd image
      resolves: rhbz#1394965
    - cpu-partitioning: set workqueue affinity early
      resolves: rhbz#1395899
    - scsi_host: fixed probing of ALPM, missing ALPM logged as info
      resolves: rhbz#1416712
    - added new profile cpu-partitioning
      resolves: rhbz#1359956
    - bootloader: improved inheritance
      resolves: rhbz#1274464
    - units: mplemented udev-based regexp device matching
      resolves: rhbz#1251240
    - units: introduced pre_script, post_script
      resolves: rhbz#1246176
    - realtime-virtual-host: accommodate new ktimersoftd thread
      resolves: rhbz#1332563
    - defirqaffinity: fixed traceback due to syntax error
      resolves: rhbz#1369791
    - variables: support inheritance of variables
      resolves: rhbz#1433496
    - scheduler: added support for cores isolation
      resolves: rhbz#1403309
    - tuned-profiles-nfv splitted to host/guest and dropped unneeded dependency
      resolves: rhbz#1413111
    - desktop: fixed typo in profile summary
      resolves: rhbz#1421238
    - with systemd don't do full rollback on shutdown / reboot
      resolves: rhbz#1421286
    - builtin functions: added virt_check function and support to include
      resolves: rhbz#1426654
    - cpulist_present: explicitly sorted present CPUs
      resolves: rhbz#1432240
    - plugin_scheduler: fixed initialization
      resolves: rhbz#1433496
    - log errors when applying a profile fails
      resolves: rhbz#1434360


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-2
changelog:
  - respin
    related: rhbz#1388454
  - systemd: added support for older systemd CPUAffinity syntax
    resolves: rhbz#1441791
  - scheduler: added workarounds for low level exceptions from
    python-linux-procfs
    resolves: rhbz#1441792
  - bootloader: workaround for adding tuned_initrd to new kernels on restart
    resolves: rhbz#1441797
  - cpu-partitioning: use tuna for cores isolation
    related: rhbz#1403309


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.9.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1467576
    - added recommend.d functionality
      resolves: rhbz#1459146
    - recommend: added support for matching of processes
      resolves: rhbz#1461838
    - cpu-partitioning: used tuned instead of tuna for cores isolation
      resolves: rhbz#1442229
    - bootloader: splitted string for removal from cmdline
      resolves: rhbz#1461279
    - network-latency: added skew_tick=1 kernel command line parameter
      resolves: rhbz#1451073
    - bootloader: accepted only certain values for initrd_remove_dir
      resolves: rhbz#1455161
    - increased udev monitor buffer size, made it configurable
      resolves: rhbz#1442306
    - bootloader: don't add nonexistent overlay image to grub.cfg
      resolves: rhbz#1454340
    - plugin_cpu: don't log error in execute() if EPB is not supported
      resolves: rhbz#1443182
    - sap-hana: fixed description of the sap-hana profiles
      resolves: rhbz#1482005
    - plugin_systemd: on full_rollback notify about need of initrd regeneration
      resolves: rhbz#1469258
    - don't log errors about missing files on verify with ignore_missing set
      resolves: rhbz#1451435
    - plugin_scheduler: improved logging
      resolves: rhbz#1474961
    - improved checking if we are rebooting or not
      resolves: rhbz#1475571
    - started dbus exports after a profile is applied
      resolves: rhbz#1443142
    - sap-hana: changed force_latency to 70
      resolves: rhbz#1501252
    - plugin_video: added support for the 'dpm' power method
    - list available profiles on 'tuned-adm profile'


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.9.0-0.2.rc2
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1467576
    - fixed expansion of the variables in the 'devices' section
      related: rhbz#1490399
    - cpu-partitioning: add no_rebalance_cores= option
      resolves: rhbz#1497182


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 0.1-1
changelog:
  - Initial release: cloudlinux-default tuned profile for CloudLinux 7
  - AL-1741: IO scheduler configuration: set deadline for rotational devices and
             noop for SSD disks
  - AL-1888: disable tcache/tswap OpenVZ subsystems
  - AL-1889: increase nr_requests value to 1024


author: Konstantin Vaskovtsov <derkonstantin@cloudlinux.com> 0.1-10
changelog:
  - CAG-862: Add another profile: cloudlinux-latency-performance with min_perf_pct=100 and force_latency=1


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 0.1-1.el7
changelog:
  - Initial release: cloudlinux-default tuned profile for CloudLinux 7
  - AL-1741: IO scheduler configuration: set deadline for rotational devices and
  -            noop for SSD disks
  - AL-1888: disable tcache/tswap OpenVZ subsystems
  - AL-1889: increase nr_requests value to 1024


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 0.1-2
changelog:
  - AL-1900: disable hugepages
  - Add OpenVZ OOM adjustments
  - OOM adjustments: Kill php, lsphp, Phusion Passenger overrun workers first


author: Anatholy Scryabin <ascryabin@cloudlinux.com> 0.1-3
changelog:
  - AL2020: add OpenVZ OOM adjustments
  - CLDEPLOY-42: Fixes for pci, tuned in vzlve/cldeploy inside openvz container


author: Anton Volkov <avolkov@cloudlinux.com> - 0.1-6
changelog:
  - LU-578: add vfs_cache_min_ratio=0 to tuned profile
  - LU-485 Tune kernel.pid_max to 1048576 with CL tuned profile
  - LU-406 CL6: Don't disable tuned-profile upon pkg deletion if it was not cloudlinux-*
  - LU-381 Prevent overwriting current active profile for CL6


author: Anton Volkov <avolkov@cloudlinux.com> - 0.1-6.el7
changelog:
  - LU-578: add vfs_cache_min_ratio=0 to tuned profile
  - LU-485 Tune kernel.pid_max to 1048576 with CL tuned profile
  - LU-381 Set cloudlinux profiles for CL7+ only


author: Konstantin Vaskovtsov <derkonstantin@cloudlinux.com>, Stas Django <pythonpowerd@gmail.com> 0.1-8
changelog:
  - LU-578: add vfs_cache_min_ratio=0 to tuned profile
  - LU-381 Set cloudlinux profiles for CL7+ only
  - LU-485 Tune kernel.pid_max to 1048576 with CL tuned profile
  - LU-406 CL6: Don't disable tuned-profile upon pkg deletion if it was not cloudlinux-*
  - LU-381 Prevent overwriting current active profile for CL6


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1.prerelease
changelog:
  - Rebase to prerelease version of tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07. 
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a.
    - Mongolia no longer observes DST. (BZ #1425214)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1414829)


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018. 
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds. 
    - Includes two patches to deal with build issues.


author: Patsy Franklin <pfrankli@redhat.com> - 2018b-1
changelog:
  - Rebase to tzdata-2018b
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Irish standard time is in the summer now, not the winter.
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d
    - DST for Asia/Gaza and Asia/Hebron has changed from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-2
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.
      However, we are continuing to provide the "rearguard" format
      for data which does not use negative DST offsets to provide
      better compatibility with existing tools.  We intend to transition
      to the "vanguard" data implementation in the future.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018e-4
changelog:
  - Brazil moved the start of DST from the first Sunday in November
    to the third Sunday in November.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018f-1
changelog:
  - Europe/Volgograd will change from UTC+3 to UTC+4 on October 28,2018.
  - Add patch to remove use of 25:00.
  - Drop previous change to DST in Brazil.  The government rescinded the
    change.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-3
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
  - Rebase to tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2021d-1
changelog:
  - Rebase to tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not -03-26.
    - zdump -v now outputs better failure information
    - fixes for code that reads corrupted TZif data


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
  - Rebase to tzdata-2022d
    - Palestine's DST transition will be on October 29, 2022,
      not October 28, 2022.
    - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2025b-1.tuxcare.els1
changelog:
  - Upgrade to tzdata-2025b
    - New zone for Aysén Region in Chile which moves from -04/-03 to -03.
    - Paraguay adopted permanent -03 starting spring 2024.
    - Improve pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
  - Include leap-seconds.list in tzdata install.


author: Tomas Bzatek <tbzatek@redhat.com> - 2.1.2-2.el7
changelog:
  - Fix crash when loop-deleting non-loop device (#1036076)
  - Fix some thread safety issues (#1036099)
  - Fix lingering mount after CD-ROM drive is ejected (#835120)
  - Fix some uninitializes variables (#1056580)


author: Tomas Hozza <thozza@redhat.com> - 1.4.20-20
changelog:
  - Install tmpfiles configuration into /usr/lib/tmpfiles.d (#1180995)
  - Fix root key management to comply to RFC5011 (#1180267)


author: Tomas Hozza <thozza@redhat.com> - 1.4.20-26
changelog:
  - Added Conficts on redhat-release packages without unbound-anchor.timer in presets (Related #1215645)


author: Petr Menšík <pemensik@redhat.com> - 1.6.6-1
changelog:
  - Rebase to 1.6.6
  - Enable RFC 8145 Trust Anchor Signaling to help the root zone get keytag statistics
  - Enable ipsecmod support


author: Martin Osvald <mosvald@redhat.com> - 1.6.6-2
changelog:
  - Do not search for DNSSEC info when domain-insecure is set
    for stub zone (#1678550)
  - Remove KSK-2010 from configuration files - it has been revoked (#1665503)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.6.6-4
changelog:
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839172 (CVE-2020-12662), rhbz#1840258 (CVE-2020-12663)


author: Nikita Maliutin <nmaliutin@cloudlinux.com> - 1.6.6-5.tuxcare.els1
changelog:
  - CVE-2023-50387: enhanced DNS resolver performance and stability by optimizing
    the handling of DNSSEC responses, reducing the potential for resource exhaustion


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1.6.6-5.tuxcare.els3
changelog:
  - CVE-2023-50868: avoid availabiluty of the remote attackers to cause a
    denial of service using DNSSEC


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1.6.6-5.tuxcare.els4
changelog:
  - CVE-2024-8508: limit number of name compression calculations per packet to
    prevent denial of service attacks.


author: Viktor Borzov <vborzov@cloudlinux.com> - 1.6.6-5.tuxcare.els6
changelog:
  - CVE-2026-42960: fix cache poisoning while following delegation
  - CVE-2026-42959: fix crash during DNSSEC validation of malicious content
  - CVE-2026-41292: limit incoming EDNS options to prevent DoS


author: Tom Lane <tgl@redhat.com> 2.3.1-1
changelog:
  - Update to version 2.3.1.  The main externally-visible change is that the
    GUI programs are not part of the unixODBC tarball anymore, so they are no
    longer in this package, and the unixODBC-kde sub-RPM has disappeared.
    There is a separate package unixODBC-gui-qt that now provides those programs.


author: Fedora Release Engineering <rel-eng@lists.fedoraproject.org>
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild

  - Fix minor manpage spelling mistake
    Resolves: #675454


author: Tom Callaway <spot@fedoraproject.org> - 6.0-9
changelog:
  - Apply changes to match.c to sync with recmatch from util.c (from zip 3.0)
    This also resolves the license issue in that file.


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-15
changelog:
  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
    Resolves: #1196134 #1196122 #1196126 #1196130


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-16
changelog:
  - Added patch for build option "-Werror=format-security"
  - Added support of non-unicode non-latin charset
  - Fix print of non-ascii filenames
  - Fix troubles with symlinks for archives with many files
    Resolves: rhbz#1276746, rhbz#1286165, rhbz#1276744


author: Jakub Martisko <jamartis@redhat.com> - 6.0-19
changelog:
  - rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
  - make linking flags configurable from the specc file
  - set linking flags to use relro hardening
    Related: #1531116


author: Jakub Martisko <jamartis@redhat.com> - 6.0-23
changelog:
  - Disable the zipbomb detection patches
  - There were too many false positives for now, will reenable this later with an option to opt-out
  - Resolves: rhbz#2020318


author: Jakub Martisko <jamartis@redhat.com> - 6.0-24
changelog:
  - Reenable the zipbomb detection patches
  - Add environment variable that disables the zipbomb detection
  - Resolves: rhbz#2020318


author: Richard Hughes <rhughes@redhat.com> - 0.9.19-1
changelog:
  - New upstream release
  - Add a Documentation tag to the service file
  - Add support for Logitech Unifying devices
  - Do not continue to poll if /proc/timer_stats is not readable
  - Fix device matching for recent kernels
  - Resolves: #848521


author: Richard Hughes <rhughes@redhat.com> - 0.9.20-1
changelog:
  - New upstream release
  - Factor out the Logitech Unifying support to support other devices
  - Fix batteries which report current energy but full charge
  - Fix several small memory leaks


author: Richard Hughes <rhughes@redhat.com> - 0.9.20-7
changelog:
  - Mark the devel-docs subpackage as noarch to silence a rpmdiff false positive.
  - Resolves: #1070661


author: Thomas Haller <thaller@redhat.com> 1.2.7-3
changelog:
  - Add manual page for usb_modeswitch_dispatcher and fix errors in
    manual page of usb_modeswitch (rhbz#948451, rhbz#884203).


author: Karel Zak <kzak@redhat.com> 2.23.2-23
changelog:
  - fix #1225235 - blockdev --report fails on loop and pmem devices
  - fix #1225053 - [RFE] backport fstrim -a and unit file
  - fix #1131523 - mount does not appear to be correctly documented for default mount options
  - fix #1147526 - Incorrect message printed when su is killed
  - fix #1165702 - make login(1) insensitive to SIGXFSZ and huge lastlog
  - fix #1184558 - logger silently changes facility from kern to user
  - fix #1198243 - blkid does not recognize xfs external log device
  - fix #1208081 - lsblk does not list dm-multipath and partitioned devices
  - fix #1209594 - RHEL7: unshare: add --propagation, use MS_PRIVATE by default
  - fix #1229436 - Remove patch that disables User Namespaces
  - fix #1116100 - Add -Z SELInux option to nsenter


author: Karel Zak <kzak@redhat.com> 2.23.2-29
changelog:
  - fix #1029385 - lack of non-ascii support
  - fix #1092520 - util-linux - PIE and RELRO check
  - fix #1153770 - backport lsipc
  - fix #1248003 - mount only parses <param>=<value> lines from fstab fs_spec field available from blkid block device
  - fix #1271850 - mount -a doesn't catch a typo in /etc/fstab and a typo in /etc/fstab can make a system not reboot properly
  - fix #1281839 - [RFE]Bind mounts should be handled gracefully by the operating system
  - fix #1290689 - util-linux: /bin/login does not retry getpwnam_r with larger buffers, leading to login failure
  - fix #1296366 - Bash completion for more(1) handles file names with spaces incorrectly
  - fix #1296521 - RHEL7: update audit event in hwclock
  - fix #1298384 - RFE: add SCHED_DEADLINE support to chrt
  - fix #1304246 - fdisk 'f' subcommand updates partition ranges wrongly
  - fix #1304426 - [rfe] /bin/su should be improved to reduce stack use
  - fix #1326615 - util-linux/lscpu: Fix model and model name on Power Systems
  - fix #1327886 - Backport blkdiscard's "-z" flag to RHEL
  - fix #1332084 - [RFE] Inclusion of lsns command in util-linux Package
  - fix #1335671 - extra quotes around UUID confuses findfs in RHEL (but not in Fedora)
  - fix #1344222 - logger port option in help is misleading
  - fix #1344482 - util-linux fails valid_pmbr() size checks if device is > 2.14TB, Device label type: dos instead of gpt
  - fix #587393 - [RFE] Make sure util-linux is ready for writable overlays


author: Karel Zak <kzak@redhat.com> 2.23.2-32
changelog:
  - improve patch for chrt(1) deadline support #1298384
  - fix #1007734 - blkid shows devices as /dev/block/$MAJOR:$MINOR
  - fix #1349536 - Extended partition loop in MBR partition table leads to DOS


author: Karel Zak <kzak@redhat.com> 2.23.2-36
changelog:
  - fix #1344102 - fdisk does not handle 4kN devices correctly in 'Blocks' calculation
  - fix #1344720 - when fdisk detects gpt table, expected menu items seem to be missing in the 'm' output
  - fix #1323916 - logger unnecessarily splits messages sent via stdin into 1024 byte chunks
  - fix #1344726 - [RFE] fdisk: output UID from gpt in fdisk when detecting that a gpt partition table is present
  - fix #1362662 - fdisk -l fails/stops on first passive/not ready device, works on RHEL6
  - fix #1369436 - losetup man page incorrect syntax for Setup loop device
  - fix #1392656 - [LLNL 7.4 Bug] fix buffer overflows in util-linux with upstream patch
  - fix #1370959 - [FJ7.3 Bug]: man 8 umount is wrong.
  - fix #1357746 - mount -av" report NFS "successfully mounted" but it is not.
  - fix #1417722 - umount -a results in selinux being reported as Disabled
  - fix #1402825 - RHEL7: "sfdisk -s" can't list the disk size
  - fix #1403973 - /usr/bin/more crash on repeat search on failed regex match
  - fix #1403971 - /usr/bin/more crash in end_it due to double free
  - fix #1358095 - ipcs shows wrong gid information
  - fix #1358097 - ipcs shows strange status message in ja locale
  - fix #1378100 - fix swapon discard option parsing
  - fix #1416467 - [RFE] Add support for posix_fallocate(3) call in fallocate(1) utility
  - fix #1358755 - Backport request for zramctl on util-linux v2.23.2
  - fix #1392661 - [LLNL 7.4 Bug] add zfs patches to util-linux
  - fix #1360764 - SMT: "Threads Per Core" will automatically change when odd or even number of vcpu are enabled online.
  - fix #1397709 - [7.4 FEAT] Refresh code for lscpu to support s390x cpu topology
  - fix #1402183 - [HPE 7.3 Bug] fdisk -l does not list non-BTT NVDIMM devices


author: Karel Zak <kzak@redhat.com> 2.23.2-41
changelog:
  - fix #1451704 - IMSM RAID on 4k disks not assembled on boot
  - force gettext messages refresh (for #1358097 bugfix)


author: Karel Zak <kzak@redhat.com> 2.23.2-43.el7_4.1
changelog:
  - fix #1499760 - gvfs-udisks2-volume-monitor generates huge amount of audit log with access denied messages


author: Karel Zak <kzak@redhat.com> 2.23.2-44
changelog:
  - fix #1478002 - systemd read-only container produces errors
  - fix #1499760 - gvfs-udisks2-volume-monitor generates huge amount of audit log with access denied messages
  - fix #1498462 - agetty not parsing /etc/os-release correctly when processing /etc/issue
  - fix #1490984 - Please update fdisk's manual page
  - fix #1487031 - [GSS][RFE]The Ceph disk type is unknown then we run the command "fdisk -l"
  - fix #1468646 - lscpu output missing Hypervisor
  - fix #1455398 - flock --timeout=0 doesn't work on RHEL7
  - fix #1336432 - journald: SYSLOG_IDENTIFIER is invalid when running logger
  - fix #1427500 - util-linux: script does not retry on EINTR when logging command output
  - fix #1336432 - journald: SYSLOG_IDENTIFIER is invalid when running logger
  - fix #1296233 - login(1) writes 0.0.0.0 IP address to wtmp when executed with "-h <ipv4-mapping-to-ipv6>" hostname


author: Karel Zak <kzak@redhat.com> 2.23.2-45
changelog:
  - fix #1501953 - blkid shows wrong return code on failure with ambivalent results
  - fix #1486777 - wipefs printing duplicate gpt clear messages
  - fix #1454652 - fix test suite


author: Karel Zak <kzak@redhat.com> 2.23.2-49
changelog:
  - fix #1520906 - make hostname in login(1) prompt optional
  - fix #1521163 - [RFE] blkid can identify magic number and UUID of VDO volume


author: Karel Zak <kzak@redhat.com> 2.23.2-54
changelog:
  - fix #1581611 - lslogins never shows lock passwords as PWD-LOCK
  - fix #1579439 - RHEL 7.5 - lscpu shows wrong sockets, threads on max config (32TB) POWER8 machine (util-linux)
  - fix #1566674 - [RFE] Add warnings that have to be acknowledged to the -l flag in umount or remove the option
  - fix #1566390 - [RHEL-7.5] losetup can not detach all loop devices
  - fix #1562125 - "setarch ppc<*>" fails with "Unrecognized architecture"
  - fix #1528567 - [RFE] Provide 'dig-holes' functionality for fallocate
  - fix #1528959 - rbind creates duplicate entries in /proc/mounts
  - fix #1538721 - mount man page says sync option has no effect for ext4
  - fix #1252764 - icrnl is not set when autologin is used
  - fix #1561200 - [RFE] - sulogin: improve support for locked root account
  - fix #1566432 - [RHEL-7.5] losetup: /dev/loop1: failed to set up loop device


author: Karel Zak <kzak@redhat.com> 2.23.2-59
changelog:
  - fix #1618711 - exec option in mount unable to override the implicit noexec in user option
  - fix #1616264 - Login to emergency shell failed


author: Karel Zak <kzak@redhat.com> 2.23.2-59.el7_6.1
changelog:
  - fix #1664752 - Bull (Atos) server lands up in invalid stty settings on the serial console after boot preventing login


author: Karel Zak <kzak@redhat.com> 2.23.2-61
changelog:
  - #1203378 - Cannot use swapon with fallocated XFS swapfile
  - #1632944 - blkid/lsblk does not recognize exfat filesystem without a label
  - #1633657 - mount -a always tries to mount CIFS share subdir despite being already mounted
  - #1639465 - Bad formatting in agetty.8 man page
  - #1667942 - libsmartcols: scols_print_table_to_string() doesn't work
  - #1678451 - Unable to mount to a directory that matches a dm device under /dev


author: Karel Zak <kzak@redhat.com> 2.23.2-62
changelog:
  - fix #1734545 - blkid_get_dev() leak file descriptor to underlying block device
  - fix #1712768 - lsmem segfaults on ppc64 wih -o
  - fix #1690102 - setarch(8) does not check error return values properly.
  - fix #1734261 - lscpu not showing Physical socket, chips information


author: Karel Zak <kzak@redhat.com> 2.23.2-64
changelog:
  - fix #1788896 - Internal testsuite: libmount tests failed
  - fix #1802240 - systemd-udev segmentation fault in crc32() at lib/crc32.c (libblkid)
  - fix #1816183 - "mount -a" should ignore already mounted bind mounts.
  - fix #1747710 - please backport the "uid=forget" and "gid=forget" UDF mount options to libmount
  - fix #1784579 - RHEL-7: col struct char_str c_column field should be of unsigned type and/or larger than 16 bit


author: Karel Zak <kzak@redhat.com> 2.23.2-65
changelog:
  - fix #1826719 - mount -a tries to mount already mounted cifs shares when we cannot query up to root dir
  - fix #1745657 - mismatch between spec file and uuidd runtime directory


author: Karel Zak <kzak@redhat.com> 2.23.2-65.el7_9.1
changelog:
  - fix #1905956 - RHEL-7: chrt regression: unwanted 'nice' value reset on sched_setattr() [rhel-7.9.z]
  - fix #1905954 - RHEL-7: chrt regression: unexpected default scheduler [rhel-7.9.z]
  - fix #1883013 - RHEL-7: chrt command does not support the -R option [rhel-7.9.z]


author: Rex Dieter <rdieter@fedoraproject.org> 2007e-13
changelog:
  - _with_system_libc_client option (el6+) 
  - tight deps via %?_isa
  - drop extraneous Requires(post,postun): xinetd


author: Mark Wielaard <mjw@redhat.com> - 3.10.0-8
changelog:
  - Add valgrind-3.10-s390-spechelper.patch. (#1190169)
  - Add valgrind-3.10.1-aarch64-syscalls.patch. (#1188622)
  - Add accept4 to valgrind-3.10.1-aarch64-syscalls.patch. (#1190660)
  - Add valgrind-3.10.1-ppc64-accept4.patch. (#1190660)
  - Add valgrind-3.10.1-send-recv-mmsg.patch. (#1192103)
  - Add mount and umount2 to valgrind-3.10.1-aarch64-syscalls.patch. (#1193796)


author: Mark Wielaard <mjw@redhat.com> - 3.10.0-1
changelog:
  - Update to 3.10.0 final.
  - Don't run dwz or generate minisymtab.
  - Remove valgrind-3.9.0-s390x-ld-supp.patch fixed upstream.
  - Add valgrind-openmpi for ppc64le.


author: Mark Wielaard <mjw@redhat.com> - 3.10.0-2
changelog:
  - Fix ppc32 multilib handling on ppc64[be].
  - Drop ppc64 secondary for ppc32 primary support.
  - Except for armv7hl we don't support any other arm[32] arch.


author: Mark Wielaard <mjw@redhat.com> - 3.10.0-4
changelog:
  - Add valgrind-3.10.0-aarch64-times.patch
  - Add valgrind-3.10.0-aarch64-getsetsid.patch
  - Add valgrind-3.10.0-aarch64-dmb-sy.patch


author: Mark Wielaard <mjw@redhat.com> - 3.10.0-5
changelog:
  - Merge valgrind-3.10.0-aarch64-times.patch
    and valgrind-3.10.0-aarch64-getsetsid.patch
    into valgrind-3.10.0-aarch64-syscalls.patch
    add fdatasync, msync, pread64, setreuid, setregid,
    mknodat, fchdir, chroot, fchownat, fchmod and fchown.
  - Add valgrind-3.10.0-aarch64-frint.patch
  - Add valgrind-3.10.0-fcvtmu.patch
  - Add valgrind-3.10.0-aarch64-fcvta.patch


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-20
changelog:
  - Rebase to fedora 3.11.0
    (#1316512 #1306844 #1305962 #1298888 #1296318 #1271754 #1265566 #1265557)


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-21
changelog:
  - Add valgrind-3.11.0-deduppoolalloc.patch (#1328347)
  - Add valgrind-3.11.0-ppc-bcd-addsub.patch (#1331738)
  - Add valgrind-3.11.0-ppc64-vgdb-vr-regs.patch (#1331774)


author: Mark Wielaard <mjw@redhat.com> - 3.12.0-8
changelog:
  - Add valgrind-3.12.0-powerpc-register-pair.patch (#1437030)
  - Add valgrind-3.12.0-ppc64-isa-3_00.patch (#1437032)


author: Karsten Hopp <karsten@redhat.com> 7.4.5-1
changelog:
  - patchlevel 5
  - when closing a window fails ":bwipe" may hang
  - "vaB" while 'virtualedit' is set selects the wrong area


author: Karsten Hopp <karsten@redhat.com> 7.4.009-1
changelog:
  - patchlevel 009
    mkdir("foo/bar/", "p") gives an error message
    creating a preview window on startup messes up the screen
    new regexp engine can't be interrupted
    too easy to write a file was not decrypted (yet)


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-2
changelog:
  - 1383902 - CPU spikes to 100% and timeouts observed in strace when opening yaml extensions using vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-3
changelog:
  - 1267826 - Include c++11 syntax highlighting in vim
  - 1319760 - [RFE] Vim should support blowfish2, plus ensure that RHEL6 encrypted files can be opened in RHEL7


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-1
changelog:
  - 1563419 - Vim in RHEL 7 is older than VIM in RHEL 6 (Rebase)
  - 1377316 - [RFE] make _remote_ vim doing the right decisions about 'set background'


author: Marek Kasik <mkasik@redhat.com> - 3.8.2-8
changelog:
  - Allow to customize desktop size for RDP protocol
  - Add available translations for new strings
  - Resolves: #862389


author: Marek Kasik <mkasik@redhat.com> - 3.8.2-9
changelog:
  - Use FreeRDP API in RDP plugin
  - Request RDP certificate verification if needed
  - Add available translations for new strings
  - Resolves: #1091765


author: Marek Kasik <mkasik@redhat.com> - 3.14.3-1
changelog:
  - Update to 3.14.3
  - Add translations update from translation team
  - Add translation fix from upstream
  - Remove unused patches
  - Resolves: #1174568


author: Giuseppe Scrivano <gscrivan@redhat.com> - 1.1.0-2
changelog:
  - Use libosinfo for improved OS metadata (rhbz#1055588)
  - Add "ich9-intel-hda" to the sound device list (rhbz#1140937)


author: Giuseppe Scrivano <gscrivan@redhat.com> - 1.1.0-4
changelog:
  - show disk info for guest with disk type volume (rhbz#1146869)
  - depend on dconf and dbus-x11 (rhbz#1146982)
  - OVMF support (rhbz#1111986)
  - depend on gnome-icon-theme (rhbz#1146612)


author: Giuseppe Scrivano <gscrivan@redhat.com> - 1.1.0-5
changelog:
  - Fix delete for disk type='volume'. (rhbz#1146869)
  - Handle correctly a SPICE auth error. (rhbz#1152981)


author: Giuseppe Scrivano <gscrivan@redhat.com> - 1.1.0-7
changelog:
  - Install virt-xml (rhbz#1159401)
  - Quit immediately if the wrong id is passed to -show* functions (rhbz#1164691)
  - Add virtio26 alias to --os-variant (rhbz#1162800)
  - do not show MAC address when not set (rhbz#1164123)


author: Giuseppe Scrivano <gscrivan@redhat.com> - 0.10.0-19
changelog:
  - Not propose to install from CD/DVD in RHEL7 (bz #1072610)
  - Disable add filesystem passthrough for RHEL7 qemu (bz #1077172)


author: Giuseppe Scrivano <gscrivan@redhat.com> - 1.1.0-1
changelog:
  - Rebase to 1.1.0 (bz #1055588)
  - The rebase also fixes these bugs:
      rhbz#1138190, rhbz#1130105, rhbz#1130077, rhbz#1122059,
      rhbz#1098040, rhbz#1093762, rhbz#1092786, rhbz#1091666,
      rhbz#1091331, rhbz#1087689, rhbz#1083461, rhbz#1048054,
      rhbz#1047875, rhbz#1047874, rhbz#1047725, rhbz#1027576,
      rhbz#948525, rhbz#607735


author: Giuseppe Scrivano <gscrivan@redhat.com> - 1.2.0-3
changelog:
  - Fix --show-host-summary (rhbz#1220322)
  - Fix listing of VMs on hosts with old libvirt (rhbz#1219629)
  - Fix delete of VMs which have disks with type volume (rhbz#1219427)
  - Fix USB Redirection type shortcut key (rhbz#1172108)
  - Show correctly the start mode for running network interfaces (rhbz#1154480)


author: Pavel Hrdina <phrdina@redhat.com> - 1.2.0-4
changelog:
  - man: virt-xml: Fix example (rhbz#1222983)
  - create: verify HYPER-V support after customization (rhbz#1185253)


author: Pavel Hrdina <phrdina@redhat.com> - 1.2.1-1
changelog:
  - rebased to latest upstream version 1.2.1 (rhbz#1197254)
  - clone: do not use a '/' separator when using a disk file under / (rhbz#1210564)
  - spec: we don't need to depend on qemu-kvm (rhbz#1046651)
  - doc: make --sparse documentation in man page consistent (rhbz#1210572)


author: Pavel Hrdina <phrdina@redhat.com> - 1.2.1-3
changelog:
  - Fix adding iscsi pools (bz 1231558) (rhbz#1235987)
  - virt-xml: refactor the handling of --define and --update (rhbz#1192875)
  - virtinst.cpu: fix copy host cpu definition (rhbz#1240938)
  - refactor detection of guest type capabilities (rhbz#1215692)
  - capabilities: detect ACPI and APIC capabilites properly (rhbz#1215692)
  - virtinst.support: enable hv_time support since qemu-kvm (rhbz#1083537)


author: Pavel Hrdina <phrdina@redhat.com> - 1.2.1-4
changelog:
  - virtManager/create: update capsinfo sooner in set_conn_state (rhbz#1244566)
  - support: enable hv_time since qemu-kvm 1.5.3 from RHEL (rhbz#1083537)


author: Pavel Hrdina <phrdina@redhat.com> - 1.2.1-5
changelog:
  - details: don't display error if machine is missing in XML (rhbz#1238981)
  - hostdev: add an address element for USB host devs if necessary (rhbz#1230611)
  - virtinst: fix two undefined variable warnings (rhbz#1230611)
  - Revert "create: customize: Hide bus=virtio-scsi" (rhbz#1206097)
  - scsi-storage: unify SCSI storage code and logic (rhbz#1206097)
  - virt-install: report an error for pxe install without network (rhbz#1250382)
  - addstorage: remove _check_ideal_path (rhbz#1232599)


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.8-2
changelog:
  - New upstream version 1.0.8.
  - Requires tiny change to ocaml-libvirt, hence dep bump.
  - Clean up the spec file.
  - Remove explicit BR ocaml-camomile (not used AFAIK).


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.8-6
changelog:
  - Include processcsv.py script and man page, but on RHEL only
    (RHBZ#665817, RHBZ#912020)
  - Clear executable stack flag on PPC, PPC64 (RHBZ#605124).


author: Marc-André Lureau <marcandre.lureau@redhat.com> 0.6.0-1
changelog:
  - Rebase to 0.6.0.
    Resolves: rhbz#1109400
    Resolves: rhbz#921332 rhbz#1020669 rhbz#1021350 rhbz#1022426
    Resolves: rhbz#1023253 rhbz#1024204 rhbz#1024312 rhbz#1032967 rhbz#1063237
    Resolves: rhbz#1063239 rhbz#1096718 rhbz#1096721 rhbz#1109731
  - Remove "Pass CAD" RHEL-only patch
    Resolves: rhbz#923072
  - Fix broken 'release-cursor' accel when not specified in --hotkeys
    Resolves: rhbz#1032869
  - Should use a USB icon instead of a generic settings icon
    Resolves: rhbz#921406
  - remote-viewer should add introduction for new added functions into man page and help info.
    Resolves: rhbz#970825
  - ctrl-[+-0] zoom in/out/native keyboard shortcuts don't work in fullscreen (with mouse over the control bar)
    Resolves: rhbz#989407
  - No box pop out when input a wrong password and retry connection for vnc guest
    Resolves: rhbz#1007306
  - Menu item "Automatically resize" could be disabled if there is no spice vdagent connection
    Resolves: rhbz#1007666
  - Remote-Viewer: Zoom Out Behavior Is Not Consistent
    Resolves: rhbz#1022404
  - If "ctrl alt" key combination is set as the one for releasing window, the window is not released.
    Resolves: rhbz#1032869
  - virt-viewer --direct fails to connect to remote guest configured with listen="0.0.0.0"
    Resolves: rhbz#1079211
  - Unnecessary warning info show when using virt-viewer -k to launch a spice guest
    Resolves: rhbz#1107519
  - Need to update virt-viewer man page
    Resolves: rhbz#921341


author: Jonathon Jongsma <jjongsma@redhat.com> - 0.6.0-2
changelog:
  - add buildid to configure
  - Bump gtk2 dependency to match requirement in 0.6.0
    Related: rhbz#1109400
  - Improve documentation of --attach command line option
    Resolves: rhbz#999291


author: Marc-Andre Lureau <marcandre.lureau@redhat.com> - 0.6.0-3
changelog:
  - Fix zoom-{in, out} accelerators. Resolves: rhbz#989407
  - Fix man page spelling. Resolves: rhbz#970825


author: Christophe Fergeau <cfergeau@redhat.com> 0.6.0-5
changelog:
  - Allow to pass usernames in ovirt URIs
    Resolves: rhbz#1061826
  - Add support for oVirt foreign menu - this allows to change the ISO image
    used by an oVirt VM from remote-viewer GUI
    Resolves: rhbz#1127156
  - Don't attempt to connect to localhost displays with qemu+tcp:// libvirt
    connections
    Resolves: rhbz#1108523
  - Provide more details in error dialog when a disconnection occurs
    Resolves: rhbz#1115986
  - Fix harmless Coverity warning
    Resolves: rhbz#885108


author: Fabiano Fidêncio <fidencio@redhat.com> 0.6.0-6
changelog:
  - Report disconnection error details
    Related: rhbz#1115986
  - Add support to use numpad accelerators for zoom-in, zoom-out and
    zoom-reset
    Resolves: rhbz#921326
  - Do not show duplicated menu items
    Related: rhbz#921326


author: Fabiano Fidêncio <fidencio@redhat.com> 0.6.0-7
changelog:
  - Revert "Add support to use numpad accelerators for zoom-in, zoom-out
    and zoom-reset
    Related: rhbz#921326
  - Update virt-viewer man page for Update virt-viewer man page for oVirt
    connection support and fullscreen monitor mapping
    Resolves: rhbz#1142769
  - Improve error message if input wrong username or password for a tcp
    connection
    Resolves: rhbz#1142742
  - Unset app 'fullscreen' when leaving fullscreen
    Resolves: rhbz#1146997
  - Don't use fallback ca-file when launching vv-file
    Resolves: rhbz#1127762
  - Force displays to update geometry when agent connects
    Related: rhbz#1032971


author: Fabiano Fidêncio <fidencio@redhat.com> 0.6.0-8
changelog:
  - Adapt auth_cancelled to the downstream code
    Related: rhbz#1142742
  - ovirt: Allow to remove CD images
    Resolves: rhbz#1145126
  - Create windows on demand, not at startup
    Resolves: rhbz#1032939
  - Use socat instead of nc if possible
    Resolves: rhbz#1030487
  - spice: do not open in fullscreen with CONTROLLER_AUTO_DISPLAY_RES
    Resolves: rhbz#1149352


author: Fabiano Fidêncio <fidencio@redhat.com> 0.6.0-9
changelog:
  - Set initial window size to display desktop size and make the default
    window size a bit more useful
    Resolves: rhbz#1152981
  - Force display_show_hint() when the display is se
    Resolves: rhbz#1152468
  - Fix bug with initial placement of fullscreen windows
    Related: rhbz#1129477
  - Don't disable "send key" menu when display isn't ready
    Related: rhbz#1152468
  - VirtViewerDisplayVnc: set 'session' property
    Resolves: rhbz#1152815


author: Fabiano Fidêncio <fidencio@redhat.com> 0.6.0.11
changelog:
  - Fix crash when connecting to a guest through VNC and typing a wrong
    password
    Resolves: rhbz#1159731


author: Fabiano Fidêncio <fidencio@redhat.com> 0.6.0.12
changelog:
  - Show a debug message instead of an error message when trying to
    connect to a non-existent guest using ovirt
    Resolves: rhbz#1168495


author: Fabiano Fidêncio <fidencio@redhat.com> 2.0-1
changelog:
  - Rebase to 2.0
    Resolves: rhbz#1181288
  - virt-viewer cannot connect to spice VM when libvirt uses tcp port
    with sasl encryption
    Resolves: rhbz#1167354
  - virt-viewer will core dump with -r option via ssh when destroying
    the guest
    Resolves: rhbz#1163647
  - virt-viewer cannot set zoom level in command line for vnc guest
    Resolves: rhbz#1170071
  - launching virt-viewer using --attach makes it crashes
    Resolves: rhbz#1196552
  - --attach doesn't work with SELinux
    Resolves: rhbz#1141228


author: Jonathon Jongsma <jjongsma@redhat.com> - 2.0-2
changelog:
  - Add 'admin' key to [ovirt] .vv file section
    Resolves: rhbz#1210248
  - Shortcuts missing from "Send key" menu when started using plugin
    Resolves: rhbz#1230602
  - Add minimum version check to rhev spice-client
    Resolves: rhbz#1223469


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.0-4
changelog:
  - set keepAlive on libvirt connection
    Resolves: rhbz#1164052
  - Rebase to 2.0: Add a missing bug
    Resolves: rhbz#1228759


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.0-5
changelog:
  - Allow to resize window to any size
    Resolves: rhbz#1242509
  - Upate virt-viewer-events.c to match libvirt-glib's event file
    Resolves: rhbz#1243228


author: Victor Toso <victortoso@redhat.com> - 2.0-6.1
changelog:
  - Utilize SSO to authenticate against oVirt engine for foreign menu support
    Resolves: rhbz#1344635


author: Pavel Grunt <pgrunt@redhat.com> - 2.0-6.2
changelog:
  - Adjust timer to refresh ovirt foreign menu
    Resolves: rhbz#1353627
  - Fix crash when disabling the last display
    Resolves: rhbz#1354283


author: Richard W.M. Jones <rjones@redhat.com> - 1.13-2
changelog:
  - Include two upstream patches for detecting Xen and Linux VServer better
    (RHBZ#973663).
  - Modernize the spec file.


author: Richard W.M. Jones <rjones@redhat.com> - 1.13-3
changelog:
  - Suppress warning message on Amazon EC2:
    "grep: /proc/xen/capabilities: No such file or directory"


author: Richard W.M. Jones <rjones@redhat.com> - 1.13-7
changelog:
  - Add support for detecting POWER KVM and LPAR
    resolves: rhbz#1147876
  - Detect RHEV/oVirt
    resolves: rhbz#1249438
  - Detect ACPI boot aarch64 guest
    resolves: rhbz#1275349
  - Fix typo in manual page
    resolves: rhbz#1099289


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-2
changelog:
  - Rebase to Fedora Rawhide / upstream version.
  - Include upstream patches since 1.18 was released.
    resolves: rhbz#1476878


author: Radek Novacek <rnovacek@redhat.com> 0.11-5
changelog:
  - Limit systemd service shutdown to 5 seconds
  - Fix error in domain sorting
  - Satellite: use proper hypervisor type in VM name
  - Resolves: rhbz#1161434, rhbz#1168111, rhbz#1168122


author: Radek Novacek <rnovacek@redhat.com> 0.14-2
changelog:
  - Support asynchronous API in candlepin
  - Nicely order keys in debug report
  - Retry sending data multiple times
  - Resolves: rhbz#1240728, rhbz#1243697


author: Radek Novacek <rnovacek@redhat.com> 0.14-3
changelog:
  - Put uuid before guests in print mode for better readibility
  - Fix decoding saved association in fake mode
  - Stop the main loop when fatal error occurs
  - Deprecate -b option and VIRTWHO_BACKGROUND env var
  - Support hypervisor_id=hostname in remote libvirt
  - Fix host uuid filtering
  - Resolves: rhbz#1243683, rhbz#1167238, rhbz#1247066, rhbz#1247031, rhbz#1246409, rhbz#1246951, rhbz#1247922, rhbz#1247922, rhbz#1248425


author: Radek Novacek <rnovacek@redhat.com> 0.14-4
changelog:
  - Readd support for hypervisorType guest attribute
  - hyperv: add proxy support
  - Set active attribute to 1 when guest is suspended
  - hyperv: consider Quiesce EnabledState as paused state
  - Remove -b option completely
  - Fake: fix non-hypervisor reporting
  - Resolves: rhbz#1248360


author: Radek Novacek <rnovacek@redhat.com> 0.14-5
changelog:
  - Use systemd notify for service status updates
  - Add template configuration file
  - Allow single quotes and spaces in config lists
  - Fail if no owner or env is set in SAM mode
  - Clear obsolete reports before sending them
  - Resolves: rhbz#1243341, rhbz#1250159, rhbz#1254840


author: Radek Novacek <rnovacek@redhat.com> 0.14-6
changelog:
  - virt: don't enqueue error reports when no error occurs
  - Config: show warning when unapplicable option is used
  - fake: check if fake data are correct
  - Resolves: rhbz#1257073


author: Radek Novacek <rnovacek@redhat.com> 0.14-8
changelog:
  - Fix logging of fatal errors
  - Change systemd unit type to notify
  - Warn about usage of env and owner in non-remote libvirt mode
  - Fix proxy support in ESX and Hyper-V modes
  - Resolves: rhbz#1254843, rhbz#1243341, rhbz#1250782


author: Radek Novacek <rnovacek@redhat.com> 0.14-9
changelog:
  - Check config option
  - Another attempt on hyperv proxy support
  - Resolves: rhbz#1254843, rhbz#1250782


author: Radek Novacek <rnovacek@redhat.com> 0.17-2
changelog:
  - Support prefix in the rhevm url
  - Raise exception when status code is not 200 in rhevm
  - Support new api for socket count in rhevm-4.0
  - SAM: handle connection interruption in ping method
  - ESX: skip cert verification when downloading vim file
  - Add python-setuptools requirement
  - Resolves: rhbz#1337407, rhbz#1337757, rhbz#1337758, rhbz#1338596, rhbz#1339419


author: Radek Novacek <rnovacek@redhat.com> 0.17-3
changelog:
  - Don't show error when requests are too old
  - esx: fix using of connection timeout
  - rhevm: fix urls not ending with slash
  - xen: fix support for multiple hosts
  - Add placeholders for xen config to /etc/sysconfig/virt-who template
  - Handle errors when checking job status
  - Allow quoted config values
  - Resolves: rhbz#1263512, rhbz#1311632, rhbz#1342364, rhbz#1346548, rhbz#1346577


author: Radek Novacek <rnovacek@redhat.com> 0.17-4
changelog:
  - Use sha256 instead of md5 for internal object hashing
  - sat5: create and use hypervisor-base channel for new system registration
  - Resolves: rhbz#1245035


author: Radek Novacek <rnovacek@redhat.com> - 0.17-7
changelog:
  - esx: don't add dot to hostname when there is no domain
  - config: fix unquoting list of options
  - print: show hypervisor facts in print mode
  - virt: don't show failures when backend is being terminated
  - sat5: don't send unchanged reports
  - Resolves: rhbz#1339863, rhbz#1359640, rhbz#1359653, rhbz#1359571


author: Radek Novacek <rnovacek@redhat.com> - 0.17-8
changelog:
  - esx: filter out guests with empty uuid property
  - xen: use active waiting to prevent thread lockups
  - xen: don't allow starting without owner/env
  - subscriptionmanager: handle waiting job state
  - Resolves: rhbz#1362351


author: Radek Novacek <rnovacek@redhat.com> - 0.17-10
changelog:
  - Better connection failure handling
  - xen: support hostname and hwuuid hypervisor_id options
  - xen: remove duplicated entries from the log
  - setup.py fixes
  - Make the spec compatible with RHEL-6
  - Resolves: rhbz#1339863


author: Chris Snyder <csnyder@redhat.com> - 0.17-11
changelog:
  - esx: don't report guests with empty uuids
  - Make sure to obey the interval setting
  - Resolves: rhbz#1405620
  - Resolves: rhbz#1405618


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.15-1
changelog:
  - Update spec for renamed README.md. (dgoodwin@redhat.com)
  - Moves fakevirt._decode() to util.decode() (csnyder@redhat.com)
  - Adds the report.config.name to log message when refusing to send a report due
    to lack of change (csnyder@redhat.com)
  - VirtWho: Clears list of reports on reload (csnyder@redhat.com)
  - Revises change detection tests to account for changes in master
    (csnyder@redhat.com)
  - Libvirtd: Sends a report on start up, and on events (csnyder@redhat.com)
  - Removes trailing line at the end of the file (csnyder@redhat.com)
  - Test_Esx: Test Oneshot to ensure it queues a report (csnyder@redhat.com)
  - Esx: only queue data if the version has changed (csnyder@redhat.com)
  - Test_VirtWho:Patches manager.Manager.fromOptions, removes unnecessary mocks
    (csnyder@redhat.com)
  - Removes unhelpful debug log message (csnyder@redhat.com)
  - Fix spacing, remove unused imports (csnyder@redhat.com)
  - Test_VirtWho: Adds test to show same report will not be sent twice
    (csnyder@redhat.com)
  - VirtWho: Adds basic change detection using report hashs (csnyder@redhat.com)
  - Adds hash property to config (csnyder@redhat.com)
  - Adds hash property to DomainListReport and HypervisorGuestAssociationReport
    (csnyder@redhat.com)
  - Hypervisor: Adds getHash class method (csnyder@redhat.com)
  - Limits interval settings (wpoteat@redhat.com)
  - Retry sending data to subscription manager multiple times before dropping
    (rnovacek@redhat.com)
  - SubscriptionManager: nicely order keys in debug report (rnovacek@redhat.com)
  - Fix serialization of guest list in print mode (rnovacek@redhat.com)
  - Do not exit oneshot mode if any job exists (rnovacek@redhat.com)
  - SubscriptionManager: check if report result has failedUpdate item
    (rnovacek@redhat.com)
  - SubscriptionManager: minor logging fixes (rnovacek@redhat.com)
  - SubscriptionManager: add env var to disable asynchronous reporting
    (rnovacek@redhat.com)
  - Check jobs status in increasing interval (rnovacek@redhat.com)
  - Esx: report host even if it doesn't have any guests (rnovacek@redhat.com)
  - Hypervisors reported by hyperv now include hostname. (csnyder@redhat.com)
  - Removes completed jobs. (csnyder@redhat.com)
  - Fix output format in print mode (rnovacek@redhat.com)
  - Fix using empty list as default parameter value (rnovacek@redhat.com)
  - satellite: support new hypervisor format (rnovacek@redhat.com)
  - Fix tests failures (rnovacek@redhat.com)
  - Removes timeouts for jobs. All jobs in the list are now executed just before
    a new report is sent. (csnyder@redhat.com)
  - The virtwho loop now blocks on the report queue with a one second timeout
    (csnyder@redhat.com)
  - Removes unnecessary imports and queue (csnyder@redhat.com)
  - Rewrite readme to markdown syntax (rnovacek@redhat.com)
  - CI: install unittest2 from pypi (rnovacek@redhat.com)
  - CI: add -y option to add-apt-repository (rnovacek@redhat.com)
  - CI: another attempt on cloud archive for libvirt (rnovacek@redhat.com)
  - CI: try to install newer version of libvirt from cloud archive
    (rnovacek@redhat.com)
  - CI: add libvirt-dev dependency (rnovacek@redhat.com)
  - CI: install libvirt-python via pip (rnovacek@redhat.com)
  - CI: another attempt without site-packages (rnovacek@redhat.com)
  - CI: install python-rhsm dependencies (rnovacek@redhat.com)
  - Adds support for facts in Hypervisor profile. (csnyder@redhat.com)
  - Adds count of unchanged mappings to the info logged for the result of an
    async job (csnyder@redhat.com)
  - Adds tests for jobs in virtwho, removes unnecessary tests for managerprocess.
    (csnyder@redhat.com)
  - Changes to ensure backwards compatibility with python-rhsm
    (csnyder@redhat.com)
  - Fixes RhevM.getHostGuestMapping() as suggested by rnovacek
    (csnyder@redhat.com)
  - Adds layer to hypervisorId. Removes completed TODO (csnyder@redhat.com)
  - Moves all functionality of managerprocess into virtwho. (csnyder@redhat.com)
  - CI: use python with system side packages enabled (rnovacek@redhat.com)
  - CI: install m2crypto using apt instead of pip (rnovacek@redhat.com)
  - CI: install python-libvirt using apt instead of pip (rnovacek@redhat.com)
  - Add requirements.txt and .travis.yml for the CI (rnovacek@redhat.com)
  - Adds tests to verify the hostGuestAssociation is generated correctly.
    (csnyder@redhat.com)
  - Updates libvirtd and tests to add host name to hypervisor profile
    (csnyder@redhat.com)
  - Updates managerprocess with better logging and changes for the new tests.~~
    (csnyder@redhat.com)
  - Updates to use the new hypervisor class (csnyder@redhat.com)
  - print mode: format debug message about found hypervisors
    (rnovacek@redhat.com)
  - Removing uncesasary comments (csnyder@redhat.com)
  - Removes unused dictionary of jobs and associated methods.
    (csnyder@redhat.com)
  - Fixes tests data to include "status" key. (csnyder@redhat.com)
  - Updates tests to make use of new Hypervisor class. (csnyder@redhat.com)
  - Host name is now included in the hypervisor profile using the new Hypervisor
    class (csnyder@redhat.com)
  - Adds new Hypervisor class. (csnyder@redhat.com)
  - Adds new test for the updates to subscriptionmanager.py (csnyder@redhat.com)
  - Updates fakevirt to make use of virt.Guest classes (csnyder@redhat.com)
  - Changes to ensure proper execution post-merge (csnyder@redhat.com)
  - Removing more unnecessary prints (csnyder@redhat.com)
  - Fixes oneshot mode for work with new managerprocess (csnyder@redhat.com)
  - Cleaning up unneeded prints and adding more useful debug log messages
    (csnyder@redhat.com)
  - Adds async job status polling for use with the new report API
    (csnyder@redhat.com)
  - This (along with python-rhsm/csnyder/new_report_api ee38f15, allows
    communication with new report api (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.19-1
changelog:
  - 1415497: Support rhev4 auto detection and usage (pcreech@redhat.com)
  - 1388577: Adding UTF-8 support (pcreech@redhat.com)
  - 1410000: Include org_id in hv base channel (pcreech@redhat.com)
  - 1400431: Fix AttributeError where val is missing (pcreech@redhat.com)
  - 1405967: Filter host via glob or regex (pcreech@redhat.com)
  - Adds --password option to virt-who-pasword (tstrachota@redhat.com)
  - 1392390 Fix default interval handling (pcreech@redhat.com)
  - BZ1405967  Add filter_hosts_regex, and exclude_hosts_regex to allow filtering
    large numbers of hosts easily (chris@chrisprocter.co.uk)
  - 1369107: Only load files with .conf extension (pcreech@redhat.com)
  - 1383436: Obey the interval setting (csnyder@redhat.com)
  - 1299643: Update virt-who-config man page to include NO_PROXY
    (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-2
changelog:
  - 1437229: Fix syntax error in exception handling (pcreech@redhat.com)
  - Update the spec file for builds on more downstream platforms
    (csnyder@redhat.com)
  - 1437228: Handle utf-8 within Xmlrpc transport (pcreech@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-3
changelog:
  - Do not join threads not started, fix up fake backend (csnyder@redhat.com)
  - 1439317: Ensure reports are still sent despite duplicate configurations
    (csnyder@redhat.com)
  - 1436811: Send reports on the interval per destination (csnyder@redhat.com)
  - 1436517: Set Version header for version detect (pcreech@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-4
changelog:
  - 1436517: Fix api base detection for rhevm version 3 and 4
    (csnyder@redhat.com)
  - 1442337: Send updates immediately the first run (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.19-5
changelog:
  - 1448267: Fix polling behavior for oneshot, CTRL-C, 429 responses
    (csnyder@redhat.com)
  - 1450747: Continue running destination threads on internal failure
    (csnyder@redhat.com)
  - 1444718: Log name of config when duplicate reports are retrieved
    (csnyder@redhat.com)
  - 1447264: Keep running on InvalidPasswordFormat given other valid configs
    (csnyder@redhat.com)
  - 1369107: Update docs and log messages to show the *.conf requirement
    (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.20-1
changelog:
  - 1389729: Add missing xml section for test (fran@caosdigital.com)
  - 1389729: virt-who incorrectly reports 'name' instead of 'hostname' for RHEV
    hosts (fran@caosdigital.com)
  - 1450747: Continue running destination threads on internal failure
    (csnyder@redhat.com)
  - 1444718: Log name of config when duplicate reports are retrieved
    (csnyder@redhat.com)
  - 1447264: Keep running on InvalidPasswordFormat given other valid configs
    (csnyder@redhat.com)
  - 1448267: Fix polling behavior for oneshot, CTRL-C, 429 responses
    (csnyder@redhat.com)
  - 1369107: Update docs and log messages to show the *.conf requirement
    (csnyder@redhat.com)
  - 1436517: Fix api base detection for rhevm version 3 and 4
    (csnyder@redhat.com)
  - 1442337: Send updates immediately the first run (csnyder@redhat.com)
  - Do not join threads not started, fix up fake backend (csnyder@redhat.com)
  - 1439317: Ensure reports are still sent despite duplicate configurations
    (csnyder@redhat.com)
  - DestinationThreads now send all reports (csnyder@redhat.com)
  - Adds IntervalThread base class and refactors Virt classes
    (csnyder@redhat.com)
  - Remove reference to nonexistant method _set_option (csnyder@redhat.com)
  - Update ConfigManager to produce destination and source mappings.
    (csnyder@redhat.com)
  - Implemements a threadsafe datastore (csnyder@redhat.com)
  - Move from using processes to threads (csnyder@redhat.com)
  - 1436517: Set Version header for version detect (pcreech@redhat.com)
  - 1403640: Fix syntax error in exception handling (pcreech@redhat.com)
  - Update the spec file for builds on more downstream platforms
    (csnyder@redhat.com)
  - Add releaser for rhel-7.4 (khowell@redhat.com)
  - 1391512: Handle utf-8 within Xmlrpc transport (pcreech@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.20.2-1
changelog:
  - 1458184: better reading of environment variables (jhnidek@redhat.com)
  - 1401867: Enable logging of rhsm module to rhsm.log (jhnidek@redhat.com)
  - 1404117: Check parameter consistency and refactoring (jhnidek@redhat.com)
  - Adds a patch number to virt-who versioning (csnyder@redhat.com)
  - 1401420: xen supports only uuid/hostname as hypervisor_id
    (jhnidek@redhat.com)
  - 1458674: Update use of result data to match the new async api
    (csnyder@redhat.com)
  - 1452436: virt-who prints host-to-quest mapping everytime (jhnidek@redhat.com)
  - 1357761: Do not check passwords to be in latin1 encoding (jhnidek@redhat.com)
  - 1457101: Continue running despite malformed configs (csnyder@redhat.com)
  - 1409984: Retry initial report retrieval on connection timeout
    (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.21.0-1
changelog:
  - Update hypervisorCheckInAsync test for new config sections
    (csnyder@redhat.com)
  - Update Config Refactor with changes from master (csnyder@redhat.com)
  - Removed usage of old Config (not unit tests) (jhnidek@redhat.com)
  - Further clean up of unit tests (jhnidek@redhat.com)
  - Create Xen Config Subclass (jhnidek@redhat.com)
  - Create Rhevm Config Subclass (jhnidek@redhat.com)
  - Create VDSM config subclass (wpoteat@redhat.com)
  - Clean up ConfigSection Unit tests (jhnidek@redhat.com)
  - Adds FakeVirtConfigSection (csnyder@redhat.com)
  - Configuration subclass for hyperv (wpoteat@redhat.com)
  - Implement EsxConfigSection (khowell@redhat.com)
  - Libvirtd ConfigSection Subclass (jhnidek@redhat.com)
  - Adds EffectiveConfig, ConfigSection (csnyder@redhat.com)
  - Adds warning message for deprecated env vars (csnyder@redhat.com)
  - 1503700: Updates to the job polling frequency (csnyder@redhat.com)
  - 1502821: Remove undocumented, broken env var "VIRTWHO_DISABLE_ASYNC"
    (csnyder@redhat.com)
  - 1466015: Warn of deprecation of command line options in next release
    (wpoteat@redhat.com)
  - remove non-existant variable fake_is_hypervisor (adarshvritant@gmail.com)
  - 1485865: Do not replace /etc/virt-who.conf on rpm upgrade
    (csnyder@redhat.com)
  - Utilize the owner from the first report seen, if we do not know the owner
    (csnyder@redhat.com)
  - Updates based on review (use str.format) (csnyder@redhat.com)
  - Fix example fake config in man docs (adarshvritant@gmail.com)
  - Add m2crypto dependency (adarshvritant@gmail.com)
  - 1211435: Don't send host-to-geust mapping, when env, owner are wrong
    (jhnidek@redhat.com)
  - 1408556: Log which owner updated mappings are being sent to
    (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.21.1-1
changelog:
  - 1511308: Only ESX supports: exclude_host_parents and filter_host_parents.
    (jhnidek@redhat.com)
  - 1509596: Use qemu+ssh transport if not provided (libvirt)
    (csnyder@redhat.com)
  - 1511308: Xen and Hyper-V do not support some filter options
    (jhnidek@redhat.com)
  - 1510760: Ensure virt-who exits properly (w/ no good conf)
    (csnyder@redhat.com)
  - 1509606: Remove duplicate output of validation messages (csnyder@redhat.com)
  - 1509597: Fix issue with cli consistancy check for vdsm (csnyder@redhat.com)
  - 1509595: Only expect owner on HostGuestAssociationReports
    (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.21.2-1
changelog:
  - 1510310: Ensure that owner and env are required where necessary
    (csnyder@redhat.com)
  - 1512778: ESX should require username, password, and server values
    (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.21.4-1
changelog:
  - 1353119: Add JSON-RPC support for VDSM (khowell@redhat.com)
  - 1509597: Enable to use virt-who with VDSM again (jhnidek@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.1-1
changelog:
  - 1780467: Validate rhevm password when unicode is not allowed
    (wpoteat@redhat.com)
  - 1751441: Add command line path parameter (piotr.kliczewski@gmail.com)
  - 1762780: fix bug, when reporter_id is empty; ENT-1706 (jhnidek@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.3-1
changelog:
  - 1775535: config option to override api version (piotr.kliczewski@gmail.com)
  - Update releasers for new version (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.4-1
changelog:
  - 1806572: virt-who using V3 APIs for communication with RHEVM which is
    deprecated (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.6-1
changelog:
  - 1806572: RHEVM should only use version 4 (wpoteat@redhat.com)
  - Update to tests to match changes in Subscription Manager (jhnidek@redhat.com)


author: Jiri Skala <jskala@redhat.com> - 3.0.1-1
changelog:
  - update to latest upstream 3.0.1
  - fixes #851441 - Introduce new systemd-rpm macros in vsftpd spec file
  - fixes #845980 - vsftpd seccomp filter is too strict


author: Martin Osvald <mosvald@rehat.com> - 3.0.2-10
changelog:
  - Resolves: #1058704 - vsftpd does not support DHE cipher suites
  - Resolves: #1058712 - vsftpd does not support ECDHE cipher suites
  - Resolves: #1198259 - The vsftpd hangs in a SIGCHLD handler when the pam_exec.so is used in pam.d configuration


author: Martin Sehnoutka <msehnout@redhat.com> - 3.0.2-20
changelog:
  - Resolves: #1147551 - Missing isolate_* options, incorrect default values of
    max_clients, max_per_ip in man vsftpd.conf


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.0.2-22
changelog:
  - Resolves: #1432054 - secure ftp stopped working with default TLS settings in the new vsftpd package


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-23
changelog:
  - Redefine VSFTP_COMMAND_FD to 1
  - Resolves: rhbz#1443055
  - Document the relationship of text_userdb_names and chroot_local_user
  - Resolves: rhbz#1508021
  - Document allow_writeable_chroot in the man page
  - Resolves: rhbz#1508022
  - Improve documentation of ascii_* options
  - Resolves: rhbz#1517227
  - Add new filename generation algorithm for STOU command
  - Resolves: rhbz#1479237


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-25
changelog:
  - Add config option log_die allowing to pass error messages to syslog
  - Add config option bind_retries allowing to change the max number
  - of attempts to find a listening port for the PASV/EPSV command
  - Resolves: rhbz#1318198


author: Artem Egorenkov <aegorenk@redhat.com> - 3.0.2-29
changelog:
  - Enable support for wide-character strings in logs
  - Replace unprintables with HEX code, not question marks
  - Resolves: rhbz#1922809


author: Kir Kolyshkin <kir@openvz.org> - 4.4-1
changelog:
  - New functionality:
  -- vztmpl-dl script to aid in template downloading/updating
  -- nameserver/searchdomain auto-propagation from the host (#2301)
  -- vzctl start: do fsck for ploop, add --skip-fsck (#2615)
  -- add --stop-timeout/STOP_TIMEOUT option (#2621)
  -- vzmigrate: use remote VZ_PRIVATE and VE_ROOT (#2523)
  -- Introduce vz-postinstall script (set sysctl.conf, disable selinux)
  -- vzmigrate: add -f, ability to ignore some checks (#2643)
  -- distscripts: update for newer Arch Linux (#2617)
  -- etc/vz.conf: set default OS template to centos-6-x86
  -- etc/vz.conf: comment out NEIGHBOUR_DEVS by default
  - Fixes:
  -- vzmigrate: fix check for IPs when there are none (#2620)
  -- Deny "unlimited" value for DISKSPACE/DISKINODES
  -- scripts/vps-netns_dev_add: rework config action (#2637)
  -- vzctl convert: fix final renames (#2638)
  -- vzctl convert: rename old private back if failed (#2638)
  -- vzctl convert: fix new directory mode to be 0700 not 0600
  -- scripts/vps-rst: make VE_VETH_DEVS optional (#2659)
  -- fix compilation on arches without support for VZ (RH #971821)
  -- vzlist -j: fix to work on RHEL5 kernel (#2661)
  -- fix exec to really enter into pidns on upstream kernel (#2658)
  -- debian-add_ip.sh: ignore comments when looking for venet0 (#2674)
  -- destroydir(): don't return -1
  -- create.c: fix warnings compiling w/o ploop
  -- build fix for automake < 1.10.2
  - Improvements:
  -- vzmigrate: check ipv6 module on dest (#2555)
  -- Remove check for ploop size (let ploop decide)
  -- vzmigrate: improve invalid cmdline handling
  -- [build] configure: set localstatedir to w/o prefix (#2637#c2)
  - Documentation:
  -- add vztmpl-dl(8)
  -- vzctl(8), vz.conf(5), ctid.conf(5): "inherit" for nameserver/searchdomain
  -- vzctl(8): describe new options --skip-fsck, --stop-timeout
  -- vzmigrate(8): describe new option -f/--nodeps
  -- vzmigrate(8): remove duplicate --live option description
  -- vzmigrate --help: simplify synopsys


author: Kir Kolyshkin <kir@openvz.org> - 4.5-1
changelog:
  - New functionality:
  -- vztmpl-dl: add --upload-all, --ignore-errors
  -- vztmpl-dl: add --list-remote, --list-local
  -- vztmpl-dl: do not check GPG signatures by default
  -- vztmpl-dl: add --gpg-check and --update options
  -- vz-postinstall: enable iptables for bridges (#2641)
  -- vz-postinstall: be verbose about what we do
  -- vzmigrate: support for VE_PRIVATE being a symlink (#2694)
  - Fixes:
  -- ndsend: fix option field in sending packets (#2709)
  -- libvzchown: link to -ldl (#2705)
  -- vps_create(): save LOCAL_UID/GID=0 if !userns for upstream CT
  -- vzctl.spec: run vz-postinstall on a fresh install only
  -- vz-postinstall: do not change rp_filter sysctl
  -- vzmigrate: remove a bashism
  -- vzctl create: fix running postcreate action wrt --ostemplate path/tmpl
  -- vzctl create: use proper version of basename()
  -- vzdaemon_stop(): don't return error if stopped already
  -- read_resolv_conf(): fix potential buffer overflow
  -- vzctl_env_switch_snapshot: fix leak on error path
  -- vzctl_env_convert_ploop(): check chmod return code
  - Improvements:
  -- veth: improve veth random MAC generation (#2695)
  -- vzctl start: always mount /dev/pts for upstream CT
  -- vzmigrate: add / to paths for rsync (#2686)
  -- load_ploop_lib(): load .so.1, try .so too (for ploop-1.9)
  -- scripts: use VPSCONFDIR instead of PKGCONFDIR/conf
  -- vzctl.spec: add /var/lib/vz as a symlink to /vz
  -- vzctl.spec: don't mark symlink as %dir
  -- vzctl.spec: remove a bunch of defines
  -- vzctl.spec: use /var/lib not /var/lib
  -- vzctl.spec: quote rpm macros
  -- vzctl.spec: remove extra slashes
  - Documentation:
  -- vztmpl-dl: improve usage
  -- vztmpl-dl(8): describe new options


author: Kir Kolyshkin <kir@openvz.org> - 4.5.1-1
changelog:
  - Fixes:
  -- Fix loading older (<1.9) ploop library (#2719)
  -- Fix installing rpm for people using /var/lib/vz (#2722)


author: Kir Kolyshkin <kir@openvz.org> - 4.6-1
changelog:
  - New functionality:
  -- Add iolimit and iopslimit (need kernel >= 042stab084.2)
  -- Add optional VM_OVERCOMMIT/--vm_overcommit parameter
  -- In VSwap mode, set some secondary UBCs if unset:
  --- lockedpages=oomguarpages=ram
  --- vmguarpages=ram+swap
  --- privvmpages=(ram+swap)*vm_overcommit (if set)
  -- vzoversell: add
  -- vztmpl-dl: add --list-orphans
  -- vztmpl-dl: add --quiet/--no-quiet
  -- vzubc: don't show unlimited ubcs by default; add -v to show
  -- vzlist: add new fields (vm_overcommit, iolimit, iopslimit)
  - Fixes:
  -- Fix quota on ploop for RHEL5 CT
  -- vzctl console: hack to force redraw on reattach
  -- set_ublimit(): don't set unknown UBs to unlim (#2760)
  -- init.d/vzeventd: set reboot_event (#2764)
  -- arch.conf: add POST_CREATE (#2371)
  -- configure: fix libdir for Debian/Ubuntu case
  -- ct_env_create_real(): fix build for IA64
  -- vzctl create, vzctl exec: do skip fsck
  -- init.d/vz-gentoo: fix setting default for NET_MODULES and PLOOP_MODULES
  -- init.d/vz-redhat: don't reset cpulimits for all CTs
  - Improvements:
  -- Add a way to not modify sysctl.conf on installation (#2375)
  -- vzctl set --reset_ub: only allow for running CT
  -- init.d/vzeventd-redhat: switch to strict bash
  -- vz-postinstall: don't add bridge params to sysctl.conf
  -- vzlist: skip mounted status check if not needed
  -- vzubc: print errors to stderr
  -- vzctl start: don't start CT if /proc mount failed
  -- vzevent-stop: check for suspend/chkpnt
  -- init.d/vz*: unset io limits before stopping CT
  -- [build] setver.sh: add build_id, use getopt
  -- assorted minor code improvements
  - Documentation:
  -- vzctl(8), ctid.conf(5): document vm_overcommit
  -- vzctl(8): fix per-CT action script prefix
  -- vz.conf(5): LOGFILE don't have a default
  -- man: don't hardcode configurable paths
  -- vzlist(8): fix a subsection reference
  -- vzlist(8): fix indentation


author: Kir Kolyshkin <kir@openvz.org> - 4.6.1-1
changelog:
  - Fixes:
  -- vzctl set: require swap to be set for VSwap
  -- fill_vswap_ub(): fix a potential segfault
  -- ndsend: clear reserved2 field (#2804)
  -- vzubc: fix to work in old mawk (#2793)
  -- vzlist: fix bogus CTIDs in list (#2830)
  -- vzctl start: don't fail if VE_ROOT does not exist (#2807)


author: Kir Kolyshkin <kir@openvz.org> - 4.7-1
changelog:
  - New functionality and important changes:
  -- Disable conntrack for VE0 by default (#2755)
  -- vzctl set --diskspace: add --offline-resize (#2281)
  -- vzctl create: use ploop by default
  -- vzctl create, vzctl convert: honor diskinodes for ploop (#2898)
  -- vzctl create: add --diskinodes
  -- vzctl set: new option --netfilter to replace --iptables
  -- vzmigrate: support for copying CT dump file
  -- vzmigrate: introduce/use vzfsync for ploop (to shorten CT freeze time)
  -- bash-completion: CTIDs on ploop for compact
  -- vzctl create: honor MOUNT_OPTS
  -- vzctl console: add set_console dist script (#2865)
  -- vzctl snapshot-switch: add --skip_arpdetect option
  -- vzctl snapshot-switch: add --skip-resume, --skip-config
  -- vzctl set --diskinodes, DISKINODES: allow suffixes (KMG)
  -- vzpid: new option "-p" to show in-container PID(s)
  -- etc/vz.conf: add SKIP_ARPDETECT example
  -- etc/vz.conf: use ploop by default
  -- etc/vz.conf: use vswap config by default
  -- etc/vz.conf: merge IP6TABLES to IPTABLES_MODULES
  - Fixes:
  -- vzctl destroy: fix locking (#2814)
  -- debian-add_ip.sh: setup loopback device at least (#2859)
  -- vzctl start --wait: fix for non-standard Debian 7
  -- postcreate.sh: add Fedora 20+
  -- postcreate.sh: set file caps for suse 13.1+
  -- vzmigrate: fix ploop for diff VE_PRIVATE case (#2875)
  -- vzmigrate: hide ploop getdev output
  -- vzctl status, snapshot-list: don't mess with stdout even when verbose
  -- vzlist: don't spoil output with ploop messages
  -- logger.c: fix wrt ploop logging
  -- etc/network/if-up.d/vzifup-post: fix for Debian Wheezy (#2914)
  -- hooks_ct.c: bind-mount root to itself (fix for kernel v3.11+)
  -- hooks_ct: mount /proc and /sys before umounting old root
  -- bash_completion: replace exit with return
  -- bash_completion.d: add --quiet to vzctl
  -- vzmigrate: call vzctl status with --quiet
  -- vzcptcheck: fix program name in usage
  - Improvements:
  -- add_reach_runlevel_mark(): improve error messages
  -- set(): don't ignore fail from fill_vswap_ub()
  -- vzctl restore: warn in CPT_SET_LOCKFD2 not supported
  -- config.c: add SKIP_ARPDETECT to ignored list
  -- vzmigrate: lock CT locally
  -- vzmigrate --live: check for running CT earlier
  -- destroy_dump(): don't log "Removing" if no dump
  -- etc/conf/*sample: tune DISKINODES for ploop diskspace/diskinodes ratio
  -- etc/conf/ve-unlimited.conf-sample: remove
  -- hooks_ct: remove non-working devpts mount
  -- hooks_ct: mount devtmpfs in CT
  -- ct_chroot(): do not change a set of CT0's mounts
  -- parse_netif_str(): improve NETIF= param parsing
  -- setup_hardlink_dir(): show error if mkdir() failed
  - Documentation:
  -- vzctl(8): document MAX_VEID (#2784)
  -- vzctl --help: fix convert synopsys
  - Build system:
  -- setver.sh: rework buildid
  -- setver.sh: make it work on fresh git source
  -- autogen.sh, setver.sh: fix build from screwed git repo
  -- vzctl.spec: require bridge-utils (as we use brctl)


author: Kir Kolyshkin <kir@openvz.org> - 4.7.2-1
changelog:
  - vzlist: don't complain about missing ploop-lib (#2952)
  - setup_console: don't execute on older kernels (#2961)
  - clean_hardlink_dir(): note unlink/rmdir errors
  - vzctl(8): fix a typo


author: Kir Kolyshkin <kir@openvz.org> - 4.8-1
changelog:
  - New functionality and important changes:
  -- vzctl set: add NUMA --nodemask (sponsored by FastVPS)
  -- vzmigrate: speed up by using se ploop copy with feedback if available
  -- vzmigrate: speed up by reusing ssh connection
  -- init.d/vz: show CT stop status
  -- init.d/vz: implement parallel CT start (#2954, #2084)
  -- init.d/vz, vz.conf: use/expose VE_PARALLEL
  -- vzctl start,restore: add --skip-remount
  -- vzctl snapshot-switch: add --must-restore
  -- vzmigrate: ability to run ploop copy with timestamps
  - Fixes:
  -- vzctl.spec: disable VE0 conntracks only if unused (#2755)
  -- vzmigrate: fix for --snapshot (#2907)
  -- vzmigrate: don't run vzfsync if there is no need (#3055)
  -- vzmigrate: undo_lock if check_cpt_props failed
  -- vzmigrate: don't exit 1 on success
  -- vzlist: fix showing DISABLED (#3029)
  -- vzlist: fix cpulimit rounding (#3063)
  -- redhat-set_hostname.sh: fix for F15+/RHEL7 (#3051)
  -- vzctl compact: use built-in PATH (#2990)
  -- postcreate.sh: fix caps for suexec
  - Improvements:
  -- debian-add_ip.sh: support for Ubuntu 14.04
  -- postcreate.sh: add RHEL7/CentOS7 support
  -- vzctl create --diskinodes: check for max ploop size
  -- vzctl set --ostemplate: require --save (#2909)
  -- vzmigrate: don't specify default cipher
  -- vzmigrate: use getopt for option parsing
  -- vzmigrate: detect "can't lock CT" error
  -- vzmigrate: don't use rsync --delete-excluded
  -- cpumask: allow for up to 4096 CPUs
  -- vz_setcpu(): don't ignore errors from set_cpu*
  -- fixed a few memory leaks and non-closed fds reported by Coverity
  -- compare_osrelease(): fix for 3.x kernels
  -- parse_{chkpnt,restore}_opt: don't print error twice
  -- parse*opt(): add/improve extra args check
  -- vzctl create: improve "no ploop" error message
  - Documentation:
  -- vznnc(8): add
  -- vzctl --help: fix iolimit
  -- vzctl(8): document set --ostemplate (#2909)
  -- vzctl(8): add --nodemask, --must-restore, --skip-remount
  -- vzctl(8): improve --netfilter
  -- vz.conf(5): document VE_PARALLEL
  -- vzmigrate(8), vzmigrate --help: document --ssh-mux
  - Build system:
  -- setver.sh: check for ./configure to run autogen
  -- setver.sh: abort if autogen.sh/configure fails


author: Kir Kolyshkin <kir@openvz.org> - 4.9-1
changelog:
  - New functionality and important changes:
  -- vzmigrate: check CPU caps for suspended CT
  -- suse-{add,del}_ip.sh: support for IP mask
  -- vz.conf: allow list of interfaces in NEIGHBOUR_DEVS (#1289, #3192)
  -- Introduce funtoo-set_hostname (#3097)
  -- vz-postinstall: add a way to disable stock distro kernels from repos
  -- vzctl set --devnodes|--devices: made cumulative, fix
  -- vzctl set --devnodes: remove devices from CT
  -- vzctl start/resume: load kernel modules needed for CT
  -- vzctl create: disallow VE_PRIVATE be a mount point (#3166)
  -- vzevent: try to run a script for all known events
  -- vzctl restore|resume: add --skip-fsck
  - Fixes:
  -- redhat-add_ip.sh: support for Fedora 21 and RHEL/CentOS 7.1 (#3169)
  -- vzctl snapshot-delete: ignore ploop 'no guid found'
  -- suse-add_ip.sh: fix for venet routing in SUSE 13.2
  -- osrelease.conf: add suse 13.2
  -- vzctl chkpnt: workaround for ENOSPC
  -- ct_enter(): enter mnt namespace last (#3038)
  -- vzmigrate: fix for vzfsync if VE_PRIVATE differs (#3170)
  -- init.d/vz-gentoo: fix a typo
  -- vzctl.spec: fix iptables checking for RHEL5 (#2755)
  -- vzmigrate: use DUMPDIR for CT dump (#3054)
  -- vzmigrate: don't hardcode /vz/lock, use LOCKDIR (#2976)
  -- vzmigrate: use C locale (#3049)
  -- vzlist: fix cpuunits rounding (#3120)
  -- snapshot-switch --must-restore: fix restoring config
  -- fs_create: lock private
  -- vps_create: minor fixes to cleanup logic
  -- make_dir_mode(): ignore EEXIST from mkdir()
  -- vzlist -j: output valid JSON for no CTs
  -- init.d/vz-redhat: fix exit codes according to LSB (#3195)
  - Improvements:
  -- vzmigrate: random ports for ploop copy (#3052)
  -- vzctl start: close extra fds later (#3091)
  -- vzctl start: mkdir /proc in CT if needed (#3091)
  -- vzctl create: fix an error message
  -- vzctl.spec: require recent RHEL6 kernel (#3094)
  -- init.d/vz*: load pio_kaio
  -- suse-add_ip.sh: fix a warning
  -- suse-del_ip.sh: remove venet routes
  -- init.d/vz-redhat: fix a bashism (#3148)
  -- vzctl delete: do rm config/dump even if failed to rm VE_PRIVATE
  -- dists/scripts/{funtoo,gentoo}*: remove env var doc
  -- debian-add_ip.sh: silent an error
  -- vzeventd: ignore non-existent event scripts
  - Documentation:
  -- vzeventd(8): document new behavior
  -- vzcptcheck(8): describe caps check w/o CTID
  -- vz.conf(5): describe new NEIGHBOUR_DEV syntax


author: Kir Kolyshkin <kir@openvz.org> - 4.9.1-1
changelog:
  - create_hardlink_dir(): fix wrong owner/perms case (#3222)
  - vzctl.spec: drop the "Conflicts: vzkernel" (#3219)


author: Kir Kolyshkin <kir@openvz.org> - 4.9.2-1
changelog:
  - store_devnodes: fix NULL deref (#3228)
  - vps-create.sh: use stat -f instead of df
  - vzctl.spec: require attr package


author: Kalev Lember <kalevlember@gmail.com> - 2.0.2-2
changelog:
  - Remove glib-compile-schemas scriptlets: the schemas are no longer installed
  - Add ldconfig calls to the libwebkit2gtk subpackage
  - Remove rpath from MiniBrowser
  - Re-enable full debuginfo (#861452)


author: Tomas Popela <tpopela@redhat.com> - 2.0.4-6
changelog:
  - Enable higher compression for output rpms
  - Resolves: rhbz#1039590
  - Avoid video player to set system volume to 100%
  - Resolves: rhbz#1029783


author: Tomas Popela <tpopela@redhat.com> - 2.4.9-2
changelog:
  - Compile with -fno-strict-aliasing
  - Resolves: rhbz#1174556
  - Update translations
  - Resolves: rhbz#1223643


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-1
changelog:
  - Update to 2.20.4
  - Resolves: rhbz#1576544
  - WebKitWebProcess crashes when a11y is active
  - Resolves: rhbz#1591638


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-2
changelog:
  - webkitgtk4: Crash on Google login page when a11y is active
  - Resolves: rhbz#1503624
  - Revert patch causing rendering glitches


author: Tomas Popela <tpopela@redhat.com> - 2.20.5-1
changelog:
  - Update to 2.20.5 - technically it was not necessary as the only difference
    between 2.20.4 and .5 was the revert of one change, that we already reverted
    while building 2.20.4. But it's better to stay with upstream.
  - Update the labels patch with the version that was pushed upstream.
  - Resolves: rhbz#1576544


author: Tomas Hozza <thozza@redhat.com> 1.14-3
changelog:
  - Added libuuid-devel to BuildRequires to use libuuid functions
    in "src/warc.c" functions (#865421)


author: Tomas Hozza <thozza@redhat.com> - 1.14-5
changelog:
  - Added BuildRequires: perl-podlators for pod2man
  - Patched manpage to silent new Tex errors
  - Resolves: (#914571)


author: Tomas Hozza <thozza@redhat.com> - 1.14-6
changelog:
  - add missing options accept-regex and reject-regex to man page
  - fix errors in texi2pod introduced in Perl-5.18


author: Tomas Hozza <thozza@redhat.com> - 1.14-8
changelog:
  - Fix deadcode and possible use of NULL in vprintf (#913153)
  - Add documentation for --regex-type and --preserve-permissions
  - Fix --preserve-permissions to work as documented (and expected)
  - Fix bug when authenticating using user:password@url syntax (#912358)
  - Document and fix --backups option


author: Tomas Hozza <thozza@redhat.com> - 1.14-12
changelog:
  - Fix wget to include Host header on CONNECT as required by HTTP 1.1 (#1203384)
  - Run internal test suite during build (#1295846)
  - Fix -nv being documented as synonym for two options (#1147572)


author: Tomas Hozza <thozza@redhat.com> - 1.14-15
changelog:
  - Added TLSv1_1 and TLSv1_2 as secure-protocol values to help (#1439811)
  - Fixed synchronization in randomly failing unit test Test-proxied-https-auth (#1448440)


author: Peter Hatina <phatina@redhat.com> - 1.10.3-20
changelog:
  - add master secret extension decoding in TLS extension
  - add encrypt-then-mac extension decoding in TLS extension
  - Resolves: #1222901


author: Peter Hatina <phatina@redhat.com> - 1.10.14-4
changelog:
  - Security patches
  - Resolves: CVE-2015-6243
              CVE-2015-6244
              CVE-2015-6245
              CVE-2015-6246
              CVE-2015-6248


author: Peter Hatina <phatina@redhat.com> - 1.10.14-7
changelog:
  - Rebase some tvbuff API from upstream to 1.10.14
  - Fixes crash when tvb_length_remaining() is used
  - Related: CVE-2015-6244


author: Peter Hatina <phatina@redhat.com> - 1.10.3-8
changelog:
  - remove last data source due to HTTP dissector, which was
    spewing too much output
  - Related: #1011339


author: Peter Hatina <phatina@redhat.com> - 1.10.3-9
changelog:
  - security patches
  - Resolves: CVE-2014-2281
              CVE-2014-2282
              CVE-2014-2283
              CVE-2014-2299


author: Peter Hatina <phatina@redhat.com> - 1.10.3-11
changelog:
  - security patches
  - Resolves: CVE-2014-6421
              CVE-2014-6423
              CVE-2014-6424
              CVE-2014-6425
              CVE-2014-6426
              CVE-2014-6427
              CVE-2014-6428
              CVE-2014-6429


author: <danw@redhat.com> - 1:2.0-15
changelog:
  - Add domain_match config option from upstream (rh #1178263)
  - Include peer certificate in EAP events for use by clients


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5
changelog:
  - macsec: Fix segmentation fault in case macsec.ko is not loaded (rh #1440646)
  - nl80211: Fix race condition in detecting MAC change (rh #1447073)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-7
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
    CVE-2017-13087, CVE-2017-13088)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-10
changelog:
  - Fix memory leak when macsec MKA/PSK is used (rh #1500442)
  - Fix authentication failure when the MAC is updated externally (rh #1490885)
  - Let the kernel discard EAPOL if packet type is PACKET_OTHERHOST (rh #1434434)
  - Don't restart wpa_supplicant.service on package upgrade (rh #1505404)
  - Don't own a directory in /run/ (rh #1507919)


author: Parag Nemade <paragn AT fedoraproject DOT org> - 3.3.12ga11-5
changelog:
  - Remove vendor tag from desktop file as per https://fedorahosted.org/fesco/ticket/1077
  - Cleanup spec as per recently changed packaging guidelines


author: Samantha N. Bueno <sbueno[at]redhat.com> - 3.3.12ga12-1
changelog:
  - updated to 3.3.12ga12
  - fixes CVE-2012-5662 (#889373, #924228)
  - add support for aarch64 to build system (#926737)


author: Thomas Moschny <thomas.moschny@gmx.de> - 0.3.8-2
changelog:
  - Specfile cleanups as suggested in the review.
  - Remove unneeded BR on pkgconfig.
  - Remove unneeded chrpath call.


author: Debarshi Ray <rishi@fedoraproject.org> - 1:2.8.8-19
changelog:
  - Use XDG_CONFIG_HOME instead of home for config files
    (http://sourceforge.net/p/xchat/bugs/1506/)
  - Use name and generic name correctly in desktop file
    (http://sourceforge.net/p/xchat/bugs/1397/)


author: Kalev Lember <kalev@smartlink.ee> - 3.1.1-1
changelog:
  - Update to 3.1.1
  - Dropped CVE-2009-1885 patch.
  - Use dos2unix -k instead of unrecognized option -U
  - Removed the multilib conflict workaround as Xerces_autoconf_config.hpp
    no longer contains the conflicting XERCES_SIZEOF_LONG define.


author: Eric Sandeen <sandeen@redhat.com> 3.1.3-2
changelog:
  - Preserve xattrs on multi-part stream restores (#1034014)
  - Prevent segfault on multi-part stream restores (#1034015)


author: Eric Sandeen <sandeen@redhat.com> 3.1.7-1
changelog:
  - Rebase to build against current RHEL7 xfsprogs headers
  - Fix race condition between lseek() and read()/write() (#1086532)


author: Pavel Reichl <preichl@redhat.com> - 3.1.7-4
changelog:
  - Batch fixing several issues
  - xfsrestore: Files from the backup go to orphanage dir because of xfsdump
  -      issue, Related: RHEL-10529
  - xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x,
  -      Related: RHEL-14912


author: Eric Sandeen <sandeen@redhat.com> 3.2.0-0.6.alpha2
changelog:
  - xfs_metadump: Require -F if proper SB magic is not found (#1040921)
  - xfs_repair: fix bad block pointer found in large directories (#1034157)
  - libxfs: Don't mark single-map blockmaps as discontiguous (#1033480)
  - libxfs: Clear stale buffer errors on write (1033480)


author: Eric Sandeen <sandeen@redhat.com> 3.2.0-0.7.alpha2
changelog:
  - xfs_metadump: Really add xfs_metadump -F option (#1040921)
  - xfs_check: Remove xfs_check manpage, xfs_check is deprecated (#1029458)


author: Eric Sandeen <sandeen@redhat.com> 3.2.0-0.8.alpha2
changelog:
  - mkfs.xfs fix default log size for small filesystems (#1034003)
  - xfs_copy: partial fixups for CRC filesystems (#1043570)
  - xfs_logprint: Don't error out after split items lose context (#1043591)


author: Eric Sandeen <sandeen@redhat.com> 3.2.1-1
changelog:
  - New upstream release (#1119940)
  - xfs_copy: fix data corruption of target (#1105170)
  - mkfs.xfs: handle mkfs of file on 4k block device (#1101236)
  - xfs_copy: don't exit with error code on success (#1100376)


author: Eric Sandeen <sandeen@redhat.com> 3.2.1-2
changelog:
  - xfs_quota: fix segfault when reporting on nonexistant path (#1077826)
  - xfs_quota: fix reporting on symlinked paths (#1077841)


author: Eric Sandeen <sandeen@redhat.com> 3.2.1-6
changelog:
  - xfs_repair: fix maximum block offset test (#1173146)
  - xfs_copy: fix assert failure on 4k sector devices (#1162414)
  - xfs_quota: man page updates (#175133, #1175627)


author: Eric Sandeen <sandeen@redhat.com> 3.2.2-1
changelog:
  - Update to upstream v3.2.2, plus fixes from v3.2.3 (#1223991)
  - repair: fix unnecessary secondary scan if only last sb is corrupt (#1201238)
  - repair: check ino alignment value to avoid mod by zero (#1223444)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-1
changelog:
  - Rebase to upstream v4.5.0 (#1309498)
  - mkfs: default to CRC enabled filesystems
  - mkfs: default to ftype enabled filesystems
  - mkfs.xfs.8: Clarify mkfs vs. mount block size limits. (#1263535)
  - xfs_copy: fix copy of hard 4k devices (#1231841)
  - xfs_quota: use Q_XGETNEXTQUOTA for faster repquota (#1164652)
  - xfs_fsr: more fixes for extent swaps with selinux (#1083833)
  - xfs_copy: Allow UUID changes on V5 filesystems (#1072283)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-3
changelog:
  - mkfs.xfs: disable finobt by default, disable sparse inodes entirely (#1345961)
  - Fix header files for compatibility (#1340553)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-4
changelog:
  - xfs_db: Fix multi-inode-record chunks in 4.5.0 (#1346927)
  - xfs_repair: Fix special inode handling in 4.5.0 (#1347698)
  - xfs_repair: Fix quota inode handling in 4.5.0 (#1347719)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-8
changelog:
  - revert loff_t to off64_t change to preserve xfs.h behavior (#1366291)
  - accomodate lack of ustat() on some arches (#1373605)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-13
changelog:
  - mkfs.xfs: clarify ftype defaults in manpage (#1488124)
  - mkfs.xfs: allow specification of 0 data stripe width (#1444166)
  - mkfs.xfs: Don't stagger AG for a single disk (#1492552)
  - xfs_db: xfs_db-update-buffer-size-when-new-type-is-set (#1458670)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-16
changelog:
  - xfs_db: fix the source command when passed as -c option (#1510279)
  - xfs_metadump: allow much larger extent counts (#1502927)
  - xfs_db: fix crash when field list selector has garbage (#1532271)
  - mkfs.xfs, others: don't stat non-block devices on startup (#1573974)
  - Update project URLs throughout the pkg, code and docs (#1550798)


author: Ville Skyttä <ville.skytta at iki.fi> - 1.0-20020801.1
changelog:
  - Major spec file rewrite (#226559), most visible changes:
  - Various XML cataloguing improvements.
  - Register to SGML catalogs in addition to XML.
  - Install to %{_datadir}/xml per the FHS.
  - Sync with Fedora packaging guidelines.
  - Silence post-install scriptlet.


author: Peter Hutterer <peter.hutterer@redhat.com> - 2.7-3
changelog:
  - Rebuild with fixed xkbcomp, re-create the right directory listing (not
    that anyone actually uses it)


author: Alexander Kurtakov <akurtako@redhat.com> 1:3.1.3-5
changelog:
  - Remove javax.xml.bind from osgi imports - it's part of the JVM now.
  - Drop the ws-jaxme dependency for the same reason.


author: Michael Schwendt <mschwendt@fedoraproject.org> - 1.2.19-3
changelog:
  - Fix duplicate documentation (#1001250)
  - Turn on verbose build output via V=1 make
  - Use %?_isa in explicit package deps
  - Fix base package Group tag to "System Environment/Libraries"
  - Remove %defattr


author: Simo Sorce <simo@redhat.com> - 1.2.20-1
changelog:
  - New upstrema version with memleaks, crl checks and other fixes
  - enable make check during build
  - drop ecdsa patch as it has been included upstream


author: Tomas Halman <thalman@redhat.com> - 1.2.20-8
changelog:
  - xmlsec1 fails to validate XML signatures made using ECDSA algorithm in FIPS mode
  - Resolves: RHEL-3337


author: Hans de Goede <hdegoede@redhat.com> 7.7.1-1
changelog:
  - Update to latest git, this is the equivalent of 7.7.1 + fixes for use
    with xserver-1.19 (rhbz#1325613)
  - Rebuild against xserver-1.19


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-3
changelog:
  - Git snapshot of the day to bring in various DPMS and other fixes
  - Update gpu-tools to 1.9
  - Xserver 1.17 ABI rebuild


author: Marc-Andre Lureau <mlureau@redhat.com> 0.1.1-12
changelog:
  - Try to fallback to previous working configuration if
    drmModeSetCrtc() failed.
    Resolves: rhbz#1127552


author: Marc-Andre Lureau <marcandre.lureau@redhat.com> - 0.1.1-16
changelog:
  - Fix glitches when restarting X server
    Resolves: rhbz#1102175
  - Fix restarting X server
    Resolves: rhbz#1185807


author: Christophe Fergeau <cfergeau@redhat.com> 0.1.1-17
changelog:
  - Fix freeze in xfig when entering space character
    Resolves: rhbz#1221909
  - Fix memory leak
    Resolves: rhbz#1222038
  - Fix cursor leak causing a crash when running RHEL6 anaconda in a VM
    Resolves: rhbz#1222040


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-2
changelog:
  - Add Pressure2K option for backwards-compatibility with applications that
    hardcode the previous pressure range (#1457024)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-3
changelog:
  - Fix hang after unplugging a device (#1496650)
  - Correct device flags for some Cintiqs and Intuos pros (#1496659)


author: Peter Hutterer <peter.hutterer@redhat.com> 1:7.5-14
changelog:
  - mkfontscale 1.1.0
  - mkfontdir 1.0.7
  - bdftopcf 1.0.4
  - Document mkfontscale's -u/-U in the man page (#948841)


author: Jerome Glisse <jglisse@redhat.com> 0.5.0-2.20130401git81aadb8
changelog:
  - Silence rpmlint warning about ldconfig
  - Only install libglamor.so in devel package.
  - Adding COPYING and README as doc


author: Jerome Glisse <jglisse@redhat.com> 0.5.0-3.20130401git81aadb8
changelog:
  - Remove comment rather than investigating Xorg mess as running ldconfig can't be harmfull.
  - Fix devel package dependency.


author: Hans de Goede <hdegoede@redhat.com> - 7.7-10
changelog:
  - fontsproto-2.1.3
  - videoproto-2.3.2
  - xextproto-7.3.0
  - xproto-7.0.26
  - Cherry pick some unreleased fixes from upstream git


author: Adam Jackson <ajax@redhat.com> 1.15.0-23
changelog:
  - Drop vestigial xwayland patch series
  - Sync with RHEL6.6:
    - Fix GrabPointer to not wrongly succeed on redirected windows
    - Enable PAM
    - Xephyr fixes for hardware cursor, 8bpp emulation, and initial size
    - Xorg fixes for X -configure and mixed pci/fbdev setups
    - Remove invalid bug checks
    - Emit DeviceChanged after grab deactivation 
  - Rediff some things to match the above
  - Inflate Release to be ahead of RHEL 6.6


author: Olivier Fourdan <ofourdan@redhat.com> 1.17.1-0.4
changelog:
  - Add a new command line option "--auto-display" to xvfb-run to take
    advantage of the XServer's "-displayfd" option to get the display
    number directly from Xfvb


author: Adam Jackson <ajax@redhat.com> 1.17.2-8
changelog:
  - Add 32->24bpp downconversion and tile-based double buffering to the
    shadow framebuffer support in modesetting


author: Adam Jackson <ajax@redhat.com> - 1.20.4-11
changelog:
  - Fix a crash when moving an animated cursor between screens
  - Be case-insentive when matching extension names to enable or disable


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.4-12
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872389), CVE-2020-14346 (#1872393),
    CVE-2020-14361 (#1872400), CVE-2020-14362 (#1872407)
  - Temporarily revert fixes from 1.20.4-11 build for delivery of CVE fixes


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-17
changelog:
  - CVE fix for: CVE-2021-4008 (#2030161), CVE-2021-4009 (#2030171),
    CVE-2021-4010 (#2030176), CVE-2021-4011 (#2030180)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-18
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2109031, rhbz#2109033


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.4-20
changelog:
  - CVE fix for: CVE-2022-4283 (#2151800), CVE-2022-46340 (#2151775),
    CVE-2022-46341 (#2151780), CVE-2022-46342 (#2151787),
    CVE-2022-46343 (#2151790), CVE-2022-46344 (#2151797)


author: José Expósito <jexposit@redhat.com> - 1.20.4-25
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18416
    Resolves: https://issues.redhat.com/browse/RHEL-18428


author: José Expósito <jexposit@redhat.com> - 1.20.4-26
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21205
    Resolves: https://issues.redhat.com/browse/RHEL-20578
    Resolves: https://issues.redhat.com/browse/RHEL-20426
    Resolves: https://issues.redhat.com/browse/RHEL-20437
    Resolves: https://issues.redhat.com/browse/RHEL-21192
    Resolves: https://issues.redhat.com/browse/RHEL-21201


author: José Expósito <jexposit@redhat.com> - 1.20.4-28
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
    Resolves: https://issues.redhat.com/browse/RHEL-31003
    Resolves: https://issues.redhat.com/browse/RHEL-30989
    Resolves: https://issues.redhat.com/browse/RHEL-30973
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: Kevin Fenzi <kevin@scrye.com> 1.3.2-7
changelog:
  - Add patch to not switch tty's, so systemd-logind works right with startx. 
  - Partially Fixes bug #806491


author: Hans de Goede <hdegoede@redhat.com> - 1.3.2-14
changelog:
  - Xclients: only try to start gnome classic session if installed
  - Resolves: rhbz#1078948
  - startx: Only specify vt argument automatically when run from a vt
  - Resolves: rhbz#1083188


author: Hans de Goede <hdegoede@redhat.com> - 1.3.4-1
changelog:
  - xinit 1.3.4
  - Drop xorg-x11-xinit-1.3.2-systemd-logind.patch (included upstream in 1.3.4)
  - Add patches from Fedora to fix automatically finding a free display-number
  - Resolves: rhbz#1194894


author: Peter Hutterer <peter.hutterer@redhat.com> 7.7-4
changelog:
  - xkbcomp: Fix generation of XKB directory listing, missing reset on file
    handler caused parse errors and incomplete directory listings


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-13
changelog:
  - Fix remote code execution vulnerability
  - Resolves: CVE-2021-21344
  - Resolves: CVE-2021-21345
  - Resolves: CVE-2021-21346
  - Resolves: CVE-2021-21347
  - Resolves: CVE-2021-21350


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-15
changelog:
  - Fix remote code execution vulnerabilities
  - Resolves: CVE-2021-39139
  - Resolves: CVE-2021-39140
  - Resolves: CVE-2021-39141
  - Resolves: CVE-2021-39144
  - Resolves: CVE-2021-39145
  - Resolves: CVE-2021-39146
  - Resolves: CVE-2021-39147
  - Resolves: CVE-2021-39148
  - Resolves: CVE-2021-39149
  - Resolves: CVE-2021-39150
  - Resolves: CVE-2021-39151
  - Resolves: CVE-2021-39152
  - Resolves: CVE-2021-39153
  - Resolves: CVE-2021-39154


author: Nicolas Chauvet <kwizart@gmail.com> - 1.42-2
changelog:
  - Fix for UsrMove - rfbz#2360
  - Fix Conflict with ipset - rfbz#2201
  - Add Requires ipset >= 6.11 - rfbz#2226


author: Serey Fokin <sfokin@cloudlinux.com> - 24.8.0.1.cloudlinux
changelog:
  - set general.useragent.vendor to 'CloudLinux'
  - set browser.startup.homepage to 'http://www.cloudlinux.com'
  - set startup.homepage_override_url to 'http://www.cloudlinux.com'
  - set startup.homepage_welcome_url to 'http://www.cloudlinux.com'


author: Sergey Fokin <sfokin@cloudlinux.com> - 31.2.0-1.cloudlinux
changelog:
  - set general.useragent.vendor to 'CloudLinux'
    set browser.startup.homepage to 'http://www.cloudlinux.com'
    set startup.homepage_override_url to 'http://www.cloudlinux.com'
    set startup.homepage_welcome_url to 'http://www.cloudlinux.com'


author: Pavel Raiskup <praiskup@redhat.com> - 5.1.2-5alpha
changelog:
  - fix manual page inconsistencies with help output (private #948533)
  - enable/fix the 'xzgrep -h' (private #850898)


author: Honza Horak <hhorak@redhat.com> - 2.31-4
changelog:
  - Remove systemd-units and systemd-sysv requirements
  - Clean-up SysV init conversion code
  - Clean-up systemd preset macros compatibility code
  - Remove fedora-releated stuff for maps upgrading


author: Matej Mužila <mmuzila@redhat.com> - 2.31-9
changelog:
  - Do not update NIS map when master's version is older
  - Open correct _temporary_ db with tokyocabinet
  - Resolves #1305137, #1331882


author: James Antill <james.antill@redhat.com> - 3.4.3-116
changelog:
  - Fix traceback on removing doc dirs.
  - Resolves: rhbz#1062959
  - Tweak docs for groups info, showing yum remove results.
  - Resolves: rhbz#833087


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-119
changelog:
  - Don't create lockdir directories.
  - Resolves: rhbz#1130939
  - Mask st_mode to fix verifying permissions for ghost files.
  - Resolves: rhbz#1113395
  - Check /usr for writability before running a transaction.
  - Resolves: rhbz#1097383
  - Make --setopt handle spaces properly.
  - Resolves: rhbz#1095161
  - Fix traceback when the history dir is empty.
  - Resolves: rhbz#1095157
  - Test for lvm binary before using.
  - Resolves: rhbz#1047793


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-121
changelog:
  - Fix variable substitution.
  - Resolves: bug#1102585
  - Fix history searching for [abc] character lists failures.
  - Resolves: bug#1096147
  - Fix update-minimal command in the man page.
  - Resolves: bug#1087911


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-126
changelog:
  - Fix update-minimal traceback and ignoring updates.
  - Resolves: bug#1192239
  - Expect KB as well as MB in disk requirements message from rpm.
  - Resolves: bug#1212514
  - Make sure epoch is a string while checking for running kernel.
  - Resolves: bug#1212506
  - Fix tsInfo.conditionals in deselect() when the package is not yet in the transaction.
  - Resolves: bug#1168385
  - Replace 'upgrade-minimal' with documented 'update-minimal' in yum-cron.conf files.
  - Resolves: bug#1182096
  - Add query_install_excludes conf./docs and use it for list/info/search/provides.
  - Resolves: bug#1212519
  - Don't traceback on xml parsing.
  - Resolves: bug#1063177
  - Fix casing of 'yum grouplist' headers.
  - Resolves: bug#1211384
  - Show advisory even if package arch changed.
  - Resolves: bug#1193871
  - Add fssnap_abort_on_errors config option and improve detecting if lvm is installed.
  - Resolves: bug#1047793
  - Fix default for fssnap_automatic_keep in the man page and dad logging for automatic fssnap events.
  - Resolves: bug#1145485
  - yum manpage: move 'history info' description to its proper place.
  - Resolves: bug#1168120
  - Add missing documentation from yum-security manpage.
  - Resolves: bug#1182075
  - Add links to knowledge base articles for http errors 404 and 403 and curl error 60.
  - Resolves: bug#1199976
  - Resolves: bug#1200312
  - Resolves: bug#1200338
  - API v2.7: missing_requires, pretty_output_update, promptYN fix, confList.
  - Resolves: bug#1188960


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-129
changelog:
  - Fix UnboundLocalError in deselect().
  - Related: bug#1168385
  - Update the URL of kcs article.
  - Related: bug#1200338


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-130
changelog:
  - Fix fssnap_automatic_devices and fssnap_automatic_percentage in yum.conf manpage.
  - Resolves: bug#1244119


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-143
changelog:
  - Add lazy:packages caching option.
  - Resolves: bug#1337105
  - Install comps.rng on the system.
  - Resolves: bug#1348995
  - Typo fixes.
  - Resolves: bug#1339168
  - yum-cron: replace 'localhost' with system_name value in email_from.
  - Resolves: bug#1330670


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-145
changelog:
  - yum-cron: properly replace 'localhost' with system_name value in email_from.
  - Related: bug#1330670


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-146
changelog:
  - Fix count of applicable security updates.
  - Related: bug#1292160
  - Update the docs for compare_providers_priority.
  - Related: bug#1186690


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-154
changelog:
  - Add payload_gpgcheck option.
  - Resolves: bug#1343690
  - Add hint about rm -rf for yum clean all.
  - Resolves: bug#1357083
  - Have "yum check" ignore self conflicts.
  - Resolves: bug#1370134
  - Detect installed virtual provide in install().
  - Resolves: bug#1352585
  - Fix reget problems with simple md filenames.
  - Resolves: bug#1397829


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-155
changelog:
  - Don't pollute stderr in FIPS mode.
  - Resolves: bug#1287610
  - Don't require enabled repos for URL installs.
  - Resolves: bug#1175315
  - installonlypkgs: add "installonlypkg(kernel)
  - Resolves: bug#1358492
  - Manpage fixes.
  - Resolves: bug#1386597
  - Resolves: bug#1411575


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-156
changelog:
  - Preload shared libs that we may dlopen().
  - Resolves: bug#1458841
  - Update payload_gpgcheck documentation.
  - Resolves: bug#1451817
  - Make exactarchlist support wildcards and add docs.
  - Resolves: bug#1361609
  - Add usercache config option.
  - Resolves: bug#1432319


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-159
changelog:
  - Retry on gpgkey timeout from MirrorManager
  - Resolves: bug#1520454
  - docs: baseurl: clarify multiple URLs
  - Resolves: bug#1509831
  - updateinfo: preload pkgSack
  - Resolves: bug#1528608
  - update(): honor multilib_policy for obsoletes
  - Resolves: bug#1477574
  - Print a disk usage summary on "yum clean all" and clarify docs
  - Resolves: bug#1481220
  - depsolve: filter out conflicting provider
  - Resolves: bug#1480065
  - Change 'size' option to 'maxsize' in yum.logrotate
  - Resolves: bug#1506890


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-162
changelog:
  - downloadonly: unlink .tmp files on ctrl-c
  - Resolves: bug#1410234
  - Fix calculation of uncleaned disk space after "yum clean all"
  - Resolves: bug#1645173
  - Speed up depsolving in Anaconda for large transactions
  - Resolves: bug#1600383


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-164
changelog:
  - Do not reinstall local installonly packages
  - Resolves: bug#1689025
  - Fix traceback when every provider conflicts with requiring package
  - Resolves: bug#1713649
  - Gracefully handle empty RPM error list during transaction test
  - Resolves: bug#1690376
  - Gracefully handle self-conflicts during reinstall
  - Resolves: bug#1564747
  - yumRepo: migrate more prints to logging
  - Resolves: bug#1510495


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-166
changelog:
  - docs: yum command argument is not optional
  - Resolves: bug#1573154
  - updateinfo: suggest command for --verbose if bad duplicate
  - Resolves: bug#1645618


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.4.3-168
changelog:
  - Fix typo sig_typ -> sig_type
  - Resolves: bug#1778763
  - Check for revoked subkeys before checking the signature
  - Resolves: bug#1778784


author: Stephen Herr <sherr@redhat.com> 2.0.1-5
changelog:
  - Related: #1115516 - don't encode proxy url if not set (mzazrivec@redhat.com)
  - Related: #1115516 - encode proxy url when passing it to urlgrabber
    (mzazrivec@redhat.com)
  - Resolves: #1115516 - correctly initialize proxy settings for URLGrabber
    (mzazrivec@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.0.1-7
changelog:
  - Resolves: #1423007 - request failed: error reading the headers
    (CVE-2016-8743) (pstudeni@redhat.com)


author: Gennadii Altukhov <galt@redhat.com> 2.0.1-8
changelog:
  - Resolves: #1398406 - update repo options from rhnplugin.conf even in
    cacheonly mode (michael.mraka@redhat.com)
  - Resolves: #1391867 - pass retry_no_cache option to urlgrabber
    (michael.mraka@redhat.com)
  - Resolves: #1361185 - use yum's lock to prevent concurent yum & rhn_check
    actions (michael.mraka@redhat.com)


author: Milan Zazrivec <mzazrivec@redhat.com> 1.9.4-1
changelog:
  - Update .po and .pot files for yum-rhn-plugin.
  - New translations from Transifex for yum-rhn-plugin.
  - Download translations from Transifex for yum-rhn-plugin.


author: Stephen Herr <sherr@redhat.com> 1.10.1-1
changelog:
  - 947639 - Make timeout of yum-rhn-plugin calls through rhn-client-tools
    configurable
  - Bumping package versions for 1.9
  - Purging %changelog entries preceding Spacewalk 1.0, in active packages.


author: Tomas Kasparek <tkasparek@redhat.com> 1.10.3-1
changelog:
  - rebranding RHN Proxy to Red Hat Proxy in client stuff
  - rebranding RHN Satellite to Red Hat Satellite in client stuff


author: Tomas Kasparek <tkasparek@redhat.com> 2.0.1-6.1
changelog:
  - Resolves: #1426704 - request failed: error reading the headers
    (CVE-2016-8743) (pstudeni@redhat.com)


author: Zdenek Pavlas <zpavlas@redhat.com> - 1.1.31-15
changelog:
  - Update to latest HEAD
  - debuginfo-install: handle YumBaseError
  - fs-snapshot: "dmsetup -o" workaround.  BZ 954358, BZ 949569
  - tmprepo: avoid spaces in repoid. BZ 965806
  - repoquery: add cachedir locking. BZ 969776
  - Fix a bug in Modified/Upgraded/Downgraded output. BZ 819502


author: Zdenek Pavlas <zpavlas@redhat.com> - 1.1.31-16
changelog:
  - Update to latest HEAD
  - Fix pacakge => package typos
  - docs: Add missing man page short descriptions
  - docs: Escape dashes in command-line options
  - docs: Add missing man pages for all yum-utils
  - Add --show-duplicates to repoquery manpage. BZ 975565
  - yum-complete-transaction: unlock yum.pid. BZ 984119
  - sanitize repoquery --repofrompath. BZ 988140
  - yum changelog: implicit since=all. BZ 961782
  - repoquery: retry doLock() BZ 988223
  - repoquery: add --installroot option. BZ 988429


author: James Antill <james.antill@redhat.com> - 1.1.31-18
changelog:
  - Disable puppetverify plugin for el7. BZ 1002876.
  - reposync: fix a copy-paste error. BZ 994514
  - repo-rss: non-ASCII fix, sorting.
  - Add --nogroups and --noplugins options to verifytree.


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-26
changelog:
  - yum-post-transaction-actions: allow colons in command part.
  - Resolves: bug#1134989
  - reposync: show urls for all repos when using -u option.
  - Resolves: bug#1133125
  - yum-config-manager: fix --save when --setopt contains wildcards.
  - Resolves: bug#1129590
  - post-transaction-actions: fix filename matching.
  - Resolves: bug#1127782
  - reposync: add missing switches to the manpage.
  - Resolves: bug#1121714
  - yumdownloader: print depsolving errors instead of ignoring them.
  - Resolves: bug#1113391
  - yumdownloader: make --destdir less of a hack.
  - Resolves: bug#1104995
  - needs-restarting: multiple fixes.
  - Resolves: bug#1095150


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-27
changelog:
  - reposync: preserve directory structure.
  - Resolves: bug#1139032
  - reposync: check for existing packages when using -u option.
  - Resolves: bug#1140864


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-30
changelog:
  - yum-config-manager: update config file specified using -c option.
  - Resolves: bug#1075708
  - yum-config-manager: require \* syntax to disable all repos.
  - Resolves: bug#1151154
  - Add plugin for overlayfs issue workaround.
  - Resolves: bug#1213602


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-32
changelog:
  - ovl plugin: change copy-up strategy, execute when root fs is mounted OverlayFS, add logging.
  - Related: bug#1213602


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-36
changelog:
  - yum-config-manager: document syntax for enabling/disabling all repos.
  - Resolves: bug#1245117
  - verifytree: use current url of comps schema.
  - Resolves: bug#1296282


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-37
changelog:
  - needs-restarting: add option for reboot hint.
  - Resolves: bug#1192946
  - needs-restarting: add option to list services.
  - Resolves: bug#1335587
  - reposync: add --download-metadata to the man page.
  - Resolves: bug#1329649
  - debuginfo-install: also respect provides when testing for installonly.
  - Related: bug#1293707


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-40
changelog:
  - needs-restarting: rework reboothint logic.
  - Related: bug#1192946
  - needs-restarting: rebase patch for 1335587.
  - Related: bug#1335587


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-41
changelog:
  - yum-config-manager: only select exact matches from --setopt.
  - Resolves: bug#1403015
  - yum-plugin-verify: set exit status to 1 in case of problems.
  - Resolves: bug#1406891


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-43
changelog:
  - yumdownloader: fix crash on broken srpm metadata.
  - Resolves: bug#1458098
  - package-cleanup: don't remove required dupes.
  - Resolves: bug#1455318
  - fastestmirror: move the logic before MD retrieval.
  - Resolves: bug#1428210
  - yum-debug-dump: improve repo failure handling.
  - Resolves: bug#1445751


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-44
changelog:
  - Add pre-transaction-actions plugin.
  - Resolves: bug#1470647
  - yum-builddep: add --define option.
  - Resolves: bug#1437636
  - verifytree: handle no @core group gracefully.
  - Resolves: bug#1349433
  - verifytree: fix handling of missing comps.
  - Resolves: bug#1333353


author: Michal Domonkos <mdomonko@redhat.com> - 1.1.31-47
changelog:
  - repotrack: add --repofrompath option
  - Resolves: bug#1506205
  - reposync: check for .. in remote paths
  - Resolves: bug#1552328


author: Michal Domonkos <mdomonko@redhat.com> - 1.1.31-50
changelog:
  - yum-config-manager: additional fixes for --add-repo
  - Related: bug#1493489
  - repotrack: print error instead of traceback on unavailable --repofrompath
  - Related: bug#1506205
  - versionlock: note default value of show_hint in man page
  - Related: bug#1497351


author: Michal Domonkos <mdomonko@redhat.com> - 1.1.31-53
changelog:
  - repotrack: fix --repofrompath for non-root users
  - Related: bug#1659588
  - repotrack: copy local packages
  - Related: bug#1463723
  - needs-restarting: clarify exit code in help and man page
  - Related: bug#1630197


author: Kalev Lember <kalevlember@gmail.com> - 3.4.0-1
changelog:
  - Update to 3.4.0
  - Don't run autoreconf and intltoolize in the spec file; the tarball should be
    good enough


author: Thomas Spura <tomspur@fedoraproject.org> - 4.0.5-3
changelog:
  - Cherry-pick patch for protocol downgrade attack (#1221666, CVE-2014-9721)
  - Remove Obsoletes:zeromq-utils
  - Remove %defattr


author: Peter Schiffer <pschiffe@redhat.com> - 1.2.7-7
changelog:
  - resolves: #844791
    rank Z_BLOCK flush below Z_PARTIAL_FLUSH only when last flush was Z_BLOCK
  - done some minor .spec file cleanup


author: Peter Schiffer <pschiffe@redhat.com> - 1.2.7-8
changelog:
  - related: #832545
    reverted changes for this bug, static libraries shouldn't be compiled with
    -fPIC flag


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.7-21
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: James Antill <james@fedoraproject.org> - 5.0.2-7
changelog:
  - Remove unneeded build require on tetex.
  - Resolves: rhbz#1037828
  - Depend on hostname package instead of /bin/hostname.


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-9
changelog:
  - signal safety when updating global state in execshfunc() (#1163823)
  - make the wait built-in work for already exited processes (#1162198)
  - replace an incorrect comment in /etc/zshenv (#1164312)
  - optimize matching of multiple * in wildcards (#1130418)
  - use heap rather than stack allocation for variable length arrays (#1165118)
  - shell emulation doc addition (#1147545)
  - suppress a warning about closing an already closed file descriptor (#1131191)


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-14.el7_2.1
changelog:
  - signal-handling related fixes collected from upstream (#1198671)
  - queue signals while processing a job exit (#1291782)
  - fix malloc() signal leak in lexsave() (#1267912)


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-30
changelog:
  - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
  - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
  - fix stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)
  - avoid crash when copying empty hash table (CVE-2018-7549)
  - fix buffer overrun in xsymlinks (CVE-2017-18206)
  - fix NULL dereference in cd (CVE-2017-18205)
  - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)
  - fix buffer overflow for very long fds in >& fd syntax (CVE-2014-10071)


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-34
changelog:
  - make the chaselinks option work again (#1729997)
  - fix off-by-one error in buffer allocation to avoid stack smashing (#1722486)


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-7.el7_1.2
changelog:
  - fix SIGSEGV of the syntax check in ksh emulation mode (#1222867)
  - make the wait built-in work for already exited processes (#1162198)
  - optimize matching of multiple * in wildcards (#1130418)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.5.1-2
changelog:
  - Disable amd64 assembly on non-intel architectures (#2035802):
    this should avoid the issue where an executable stack is created.


