# changelog

author: Ray Strode <rstrode@redhat.com> 3.14.13-20.1
changelog:
  - Ensure motif and related windows get told to supply resize borders
    for CSD decorated windows
  Resolves: #1416874


author: Benjamin Otte <otte@redhat.com> - 3.8.8-6
changelog:
  - Properly resize toplevel when collapsing GtkExpander
  - Add missing man pages
  - Allow remapping all keys
  - Resolves: #982295, #948432, #1090126


author: Matthias Clasen <mclasen@redhat.com> - 3.8.4-5
changelog:
  - Avoid losing -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m32 -march=x86-64 -mtune=generic -mfpmath=sse -fasynchronous-unwind-tables
  - Related: #881175


author: Matthias Clasen <mclasen@redhat.com> - 3.8.4-5
changelog:
  - Avoid losing -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic
  - Related: #881175


author: Milan Crha <mcrha@redhat.com> - 4.8.5-2
changelog:
  - Add patch for RH bug #1255831 (Crash under html_text_get_link_at_offset())
  - Add patch for RH bug #1255826 (Images are not displayed in gtkhtml-editor-test)


author: Kalev Lember <kalevlember@gmail.com> - 2.24.2-1
changelog:
  - Update to 2.24.2
  - Removed mm-common buildrequire which is no longer needed for tarball builds
  - Cleaned up the spec file for modern rpmbuild


author: Matthew Barnes <mbarnes@redhat.com> - 2.0.16-1.fc13
changelog:
  - Update to 2.0.16
  - No need to run libtoolize and autoreconf.
  - Remove language comparison patch (fixed upstream).


author: Miroslav Lichvar <mlichvar@redhat.com> - 5:2.0.9-3
changelog:
  - drop renaming to guile2
  - fix multilib conflicts
  - fix post scriptlet to not remove files on upgrade
  - remove obsolete code from slib trigger
  - fix weekdays in changelog


author: Peter Robinson <pbrobinson@fedoraproject.org> 0.10.2-1
changelog:
  - 0.10.2 release
  - http://ftp.gnome.org/pub/GNOME/sources/gupnp-dlna/0.10/gupnp-dlna-0.10.2.news

   * Wed Apr 10 2013 Peter Robinson <pbrobinson@fedoraproject.org> 0.10.1-1
  - 0.10.1 release
  - http://ftp.gnome.org/pub/GNOME/sources/gupnp-dlna/0.10/gupnp-dlna-0.10.1.news


author: Tim Waugh <twaugh@redhat.com> 5.2.9-5
changelog:
  - Added IEEE 1284 Device IDs for Samsung ML-1450 (bug #844687) and
    Canon ML280 series (bug #848093).


author: Jiri Popelka <jpopelka@redhat.com> 5.2.9-8
changelog:
  - Added IEEE 1284 Device ID for Kyocera FS-1118MFP (bug #782379).
  - Use arch-specific dependency when requiring base package.


author: Tim Waugh <twaugh@redhat.com> - 5.2.9-17
changelog:
  - More fixes for bug #948967:
    - Supply man page for gutenprint-foomaticupdate.
    - Link to cups-genppd(8) man page from cups-genppd.5.2(8).


author: Ondrej Holy <oholy@redhat.com> - 1.22.4-1
changelog:
  - Update to 1.22.4
  - Remove obsolete upstream patches
  - Add translations updates from upstream
  - Resolves: #1174716


author: Ondrej Holy <oholy@redhat.com> - 1.30.3-1
changelog:
  - Update to 1.30.3
  - Disable nfs support (#1387270)
  - Revert desktop database scriplets
  - Resolves: #1386993, #1399343, #1306146, #1259746, #1344317


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-2
changelog:
  - Prevent spawning new daemons if outgoing operation exists (#1632960)
  - CVE-2019-3827: Prevent access if any authentication agent isn't available (#1673887)


author: Michal Luscon <mluscon@redhat.com> 1.5-1
changelog:
  - New upstream version
  - Removed gzip-1.3.9-stderr.patch
  - Removed gzip-1.3.10-zgreppipe.patch
  - Removed gzip-1.3.13-noemptysuffix.patch


author: Petr Stodulka <pstodulk@redhat.com> - 1.5-8
changelog:
  - Gzip overwrite existing files when user choose "no" on yes/no question.
    It's due to wrong dupicit declaration of yesno() function in gzip.h
    which is compiled wrong with -O2 option.
    Resolves: rhbz#1201689


author: Jakub Martisko <jamartis@redhat.com> - 1.5-10
changelog:
  - doc change: missing grep options are now mentioned in the zgrep 
    man pages/help message
    Resolves: #1437002


author: Robin Lee <cheeselee@fedoraproject.org> - 1.4.22-1
changelog:
  - Update to 1.4.22 (CVE-2012-2942, #824544)
  - Use linux2628 build target
  - No separate x86_64 build target for halog
  - halog build honors rpmbuild optflags
  - Specfile cleanup


author: Ryan O'Hara <rohara@redhat.com> - 1.4.23-1
changelog:
  - Update to 1.4.23 (CVE-2013-1912, #947697)
  - Drop supplementary groups after setuid/setgid (#894626)


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-11
changelog:
  - don't use mmap(2) to avoid failures on i386 with 1GB files and larger (#672917)
  - fix package URL (#676962)


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-12
changelog:
  - fix possible buffer overflows, integer overflows (CVE-2011-3630 CVE-2011-3631 CVE-2011-3632)
  - update man page


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-14
changelog:
  - do not allow to hardlink files across filesystems by default (#786719)
    (use -f option to override)


author: Aleš Kozumplik <ales@redhat.com> - 0.5.0-1
changelog:
  - sack: include directive support added (Related:RhBug:1055910) (Jan Silhan)
  - sack: using pool->considered instead of SOLVER_LOCK for excludes (RhBug:1099342) (Jan Silhan)
  - cosmetic: replaced fail_unless with ck_assert_int_eq (Jan Silhan)


author: Aleš Kozumplik <ales@redhat.com> - 0.5.1-1
changelog:
  - pool_split_evr() assert if we hit unexpected data. (Related:RhBug:1141634) (Ales Kozumplik)
  - README: changed references to new repo location (Jan Silhan)
  - iutil-py: removed pyseq_to_packagelist function (Jan Silhan)
  - improved performance of python sequence iteration (RhBug:1109554) (Jan Silhan)
  - reldep: constructor accepts unicode strings (RhBug:1124968) (Jan Silhan)
  - Fix pool_split_evr's handling of EVRs without releases. (Radek Holy)
  - added sha512 support (RhBug:1082658) (Jan Silhan)
  - cosmetic: removed unneeded semicolon (Jan Silhan)
  - goal: does not raise exception on empty selector (Related:RhBug:1127206) (Jan Silhan)


author: Jan Silhan <jsilhan@redhat.com> - 0.5.3-1
changelog:
  - README: made readthedoc documentation official (Jan Silhan)
  - sack: deprecation of create_cmdline_repo (Jan Silhan)
  - does not break Sack.__init__ API from 8ce3ce7 (Jan Silhan)
  - doc: document the new logdir parameter of Sack.__init__. (Radek Holy)
  - New version: 0.5.3 (Jan Silhan)
  - apichange: sack: added optional param logdir (Related:RhBug:1175434) (Jan Silhan)
  - apichange: py: rename: Sack.cache_path -> Sack.cache_dir (Radek Holy)
  - doc: add Sack to the Python API reference manual. (Radek Holy)
  - cosmetic: autopep8 applied on __init__.py (Jan Silhan)
  - query: support multiple flags in filter (RhBug:1173027) (Jan Silhan)
  - packaging: make the spec file compatible with GitHub packaging guideliness. (Radek Holy)
  - New version: 0.5.2 (Michal Luscon)
  - hy_chksum_str() returns NULL in case of incorrect type (Michal Luscon)
  - Fix defects found by coverity scan (Michal Luscon)
  - selector: allow selecting provides with globs (RhBug: 1148353) (Michal Luscon)
  - py: nevra_init() references possibly uninitialized variable. (Ales Kozumplik)
  - package: add weak deps attributes. (Ales Kozumplik)


author: Jan Silhan <jsilhan@redhat.com> - 0.5.3-2
changelog:
  - bumped release to be greater than f21 release
  - Add Peter to Authors (Peter Hjalmarsson)
  - Add support for armv6hl (Peter Hjalmarsson)


author: Michal Luscon <mluscon@redhat.com> 0.5.4-1
changelog:
  - setup tito to bump version in VERSION.cmake (Michal Luscon)
  - initialize to use tito (Michal Luscon)
  - prepare repo for tito build system (Michal Luscon)
  - New version 0.5.4 (Michal Luscon)
  - goal: implement methods for optional installation (RhBug:1167881) (Michal Luscon)
  - setup tito to bump version in VERSION.cmake (Michal Luscon)
  - initialize to use tito (Michal Luscon)
  - prepare repo for tito build system (Michal Luscon)
  - New version 0.5.4 (Michal Luscon)
  - goal: implement methods for optional installation (RhBug:1167881) (Michal Luscon)


author: Michal Luscon <mluscon@redhat.com> 0.5.5-1
changelog:
  - get rid of yum references (Jan Silhan)
  - sack: force recomputing excludes (Jan Silhan)
  - doc: cosmetic: made Sack headline more readable (Jan Silhan)
  - doc: sack: warning about using excludes, includes, disabling and enabling
    repos (Jan Silhan)
  - cosmetic: removed commented code (Jan Silhan)
  - sack: calls reinitiate provides after changing considered map (RhBug:1099342)
    (Jan Silhan)
  - fixed memleak from d8f2ca7 (Jan Silhan)
  - doc: add to CMDLINE_REPO_NAME and SYSTEM_REPO_NAME the Python API reference
    manual. (Radek Holy)
  - doc: add Repo to the Python API reference manual. (Radek Holy)
  - updated load_test_repo() to be able to load non-standard system repo (Michael
    Mraka)
  - python tests for goal.run(verify=True) (Michael Mraka)
  - test for HY_VERIFY flag (Michael Mraka)
  - introduced verify option for goal.run() (Michael Mraka)
  - AUTHORS: fixed name (Michael Mraka)
  - AUTHORS: added 3 Michaels (Jan Silhan)
  - Build for x86_64, correction for C++ (Michal Ruprich)


author: Michal Luscon <mluscon@redhat.com> 0.5.7-1
changelog:
  - spec: add a %{snapshot} macro for easier snapshot building (Radek Holy)
  - doc: sack: deep copy added to warning section (Jan Silhan)
  - doc: sack: warning about multiple Sack usage (Jan Silhan)
  - doc: sack: len(sack) -> method __len__ (Jan Silhan)
  - Package.files returns list of Unicode objects (Jan Silhan)


author: Jan Silhan <jsilhan@redhat.com> 0.5.8-1
changelog:
  - added implicit-function-declaration compile flag (Jan Silhan)
  - subject: Fix compiler warning introduced by previous commit (Colin Walters)
  - python: Verify that nosetest actually ran any tests (Colin Walters)
  - AUTHORS: updated (Jan Silhan)
  - subject: Remove internal header includes from public header (Colin Walters)
  - maintain result map in query (RhBug:1049205) (Jan Silhan)
  - AUTHORS: updated (Jan Silhan)
  - package: Don't assume the same pool in hy_package_cmp() (Matthew Barnes)


author: Jan Silhan <jsilhan@redhat.com> 0.5.8-2
changelog:
  - tito: change vesiontagger to releasetagger (Jan Silhan)
  - don't require python3 in rhel (Jan Silhan)


author: Orion Poplawski <orion@cora.nwra.com> 1.8.12-5
changelog:
  - Use parallel make
  - Limit number of processors to 4 in parallel tests to avoid mpich issue with
    oversubscription


author: Orion Poplawski <orion@cora.nwra.com> - 1.8.12-6
changelog:
  - Add patch to add ppc64le to config.guess (bug #1080122)
  - Add patch to fix long double conversions on ppc64le (bug #1078173)
  - Run autoreconf for patches and to remove rpaths


author: Nalin Dahyabhai <nalin@fedoraproject.org> - 3.1.0-18
changelog:
  - adjust buildroot location (guidelines)
  - disable static libraries (guidelines)
  - tweak default payload attributes (guidelines)


author: Nalin Dahyabhai <nalin@fedoraproject.org> - 3.1.0-19
changelog:
  - fix the release number noted for the previous changelog entry (#225884)
  - remove unapplied "classes" patch (#225884)


author: Nalin Dahyabhai <nalin@fedoraproject.org> - 3.2.1-1
changelog:
  - update to 3.2.1
    - merged all patches or equivalents
    - re-merged hesinfo, so we obsolete it now
    - adds a pkgconfig configuration file for libhesiod
  - correct inconsistent changelog dates, assuming day-of-week is correct
  - add build requirement on libidn-devel
  - package the license


author: Ville Skyttä <ville.skytta@iki.fi> - 1.2.13-2
changelog:
  - Bring back config patch to fix -debuginfo, it hasn't been upstreamed yet.
  - Drop empty TODO from docs.


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.8-1
changelog:
  - New upstream version 1.3.8.
  - Fixes handling of keys which use ri-records, for both reading and
    writing (RHBZ#717583, RHBZ#987463).
  - Remove upstream patch.
  - Rebase dirs patch against new upstream sources.
  - Rebase ruby patch against new upstream sources.
  - Modernize the RPM spec file.
  - Fix .gitignore.


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.7
changelog:
  - Fix: "Argument list too long" when using virt-v2v on Windows guest
    with French copy of Citrix installed
    related: rhbz#1145056


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.8
changelog:
  - Tolerate corruption in some hives
    resolves: rhbz#1423436
  - Switch to using git to manage patches.


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.7-6
changelog:
  - Fix for latest Ruby in Rawhide.  Fixes build failure identified
    by mass rebuild yesterday.
  - Do not ignore error from running autoreconf.


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.12-1
changelog:
  - fix regression of #512275 -- we looked for prelink, but didn't record
    its location properly (#559458)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.9.13-1
changelog:
  - treat unexpected command-line arguments as an error to avoid setting
    incorrect expectations, and warn when a check file doesn't appear to
    contain anything for us to check (#1016706)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.9.13-4
changelog:
  - only BuildRequire: prelink on the arches on which we know it runs (currently
    %{ix86}, x86_64, ppc, ppc64, s390, s390x), so that it can be built on the
    rest (#1061889)


author: Jiri Popelka <jpopelka@redhat.com> - 3.11-3
changelog:
  - remove some rh-specific bits from rh.patch as they are no longer valid (#881913)
  - remove outdated de & pt man pages
  - /usr move: use _bindir macro


author: Jiri Popelka <jpopelka@redhat.com> - 3.13.6-1
changelog:
  - 3.13.6
  - hplip-ipp-accessors.patch merged upstream
  - /etc/cron.daily/hplip_cron -> /usr/share/hplip/hplip_clean.sh


author: Tim Waugh <twaugh@redhat.com> - 3.13.7-2
changelog:
  - Applied patch to avoid unix-process authorization subject when using
    polkit as it is racy (CVE-2013-4325).


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.15.9-2
changelog:
  - 1069619 - Rebase to version 3.15.9 extension - solving bug 1346196 (/usr/lib/cups/filter/hpps uses python -B which is unknown), which is duplicate of bug 1202451


author: Lyude Paul <cpaul@redhat.com> - 1.0.0-7
changelog:
  - Initial port from Fedora to RHEL 7.3
  - Add patch for building with gcc4
  - Call autoreconf before starting build
  Resolves: rhbz#1311004


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1480321


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1479471


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-6
changelog:
  - Resolves: rhbz#1666381 - CVE-2018-12121 http-parser: nodejs: Denial of
                             Service with large HTTP headers [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-7
changelog:
  - Resolves: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                             allowed for spaces inside Content-Length header
                             values [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-8
changelog:
  - Backport needed test fixes
  - Related: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                            allowed for spaces inside Content-Length header
                            values [rhel-7]


author: Sergio Correia <scorreia@redhat.com> - 2.7.1-8.1
changelog:
  - Resolves: CVE-2019-15605 http-parser: nodejs: HTTP request
                             smuggling using malformed Transfer-Encoding header


author: Joe Orton <jorton@redhat.com> - 2.4.6-13
changelog:
  - mod_ssl: sanity-check use of "SSLCompression" (#1036666)
  - mod_proxy_http: fix brigade memory usage (#1040447)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-17
changelog:
  - mod_dav: add security fix for CVE-2013-6438 (#1077907)
  - mod_log_config: add security fix for CVE-2014-0098 (#1077907)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-18
changelog:
  - mod_cgid: add security fix for CVE-2014-0231 (#1120607)
  - mod_proxy: add security fix for CVE-2014-0117 (#1120607)
  - mod_deflate: add security fix for CVE-2014-0118 (#1120607)
  - mod_status: add security fix for CVE-2014-0226 (#1120607)
  - mod_cache: add secutiry fix for CVE-2013-4352 (#1120607)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-30
changelog:
  - core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
  - mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-31
changelog:
  - mod_proxy_fcgi: determine if FCGI_CONN_CLOSE should be enabled
    instead of hardcoding it (#1168050)
  - mod_proxy: support Unix Domain Sockets (#1168081)


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 2.4.6-31.cloudlinux.1
changelog:
  - CAG-373: remove "--enable-suexec-capabilities" and "--with-suexec-syslog" from
    configure options in httpd package to make CageFS work


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-31.1
changelog:
  - core: fix chunk header parsing defect (CVE-2015-3183)
  - core: replace of ap_some_auth_required with ap_some_authn_required
    and ap_force_authn hook (CVE-2015-3185)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-35
changelog:
  - mod_remoteip: correct the trusted proxy match test (#1179306)
  - mod_dav: send complete response when resource is created (#1235383)
  - apachectl: correct the apachectl status man page (#1231924)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-36
changelog:
  - Revert fix for #1162152, it is not needed in RHEL7
  - mod_proxy_ajp: fix settings ProxyPass parameters for AJP backends (#1242416)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-32
changelog:
  - mod_authn_dbd: fix use-after-free bug with postgresql (#1188779)
  - mod_remoteip: correct the trusted proxy match test (#1179306)
  - mod_status: honor remote_ip as documented (#1169081)
  - mod_deflate: fix decompression of files larger than 4GB (#1170214)
  - core: improve error message for inaccessible DocumentRoot (#1170220)
  - ab: try all addresses instead of failing on first one when not available (#1125276)
  - mod_proxy_wstunnel: add support for SSL (#1180745)
  - mod_proxy_wstunnel: load this module by default (#1180745)
  - mod_rewrite: add support for WebSockets (#1180745)
  - mod_rewrite: do not search for directory if a URL will be rewritten (#1210091)
  - mod_ssl: Fix SSL_CLIENT_VERIFY value when optional_no_ca and SSLSessionCache
    are used and SSL session is resumed (#1170206)
  - mod_ssl: fix memory leak on httpd reloads (#1181690)
  - mod_ssl: use SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA (#1118476)
  - mod_cgi: return error code 408 on timeout (#1162152)
  - mod_dav_fs: set default value of DAVLockDB (#1176449)
  - add Documentation= to the httpd.service and htcacheclean.service (#1184118)
  - do not display "bomb" icon for files ending with "core" (#1170215)
  - add missing Reason-Phrase in HTTP response headers (#1162159)
  - fix BuildRequires to require openssl-devel >= 1:1.0.1e-37 (#1160625)
  - apachectl: ignore HTTPD variable from sysconfig (#1214401)
  - apachectl: fix "graceful" documentation (#1214398)
  - apachectl: fix "graceful" behaviour when httpd is not running (#1214430)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-34
changelog:
  - mod_proxy_fcgi: honor Timeout / ProxyTimeout (#1222328)
  - do not show all vhosts twice in httpd -D DUMP_VHOSTS output (#1225820)
  - fix -D[efined] or <Define>[d] variables lifetime accross restarts (#1227219)
  - mod_ssl: do not send NPN extension with not configured (#1226015)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-41
changelog:
  - mod_cache: merge r->err_headers_out into r->headers when the response
    is cached for the first time (#1264989)
  - mod_ssl: Do not send SSL warning when SNI hostname is not found as per
    RFC 6066 (#1298148)
  - mod_proxy_fcgi: Ignore body data from backend for 304 responses (#1263038)
  - fix apache user creation when apache group already exists (#1299889)
  - fix apache user creation when USERGROUPS_ENAB is set to 'no' (#1288757)
  - mod_proxy: fix slow response time for reponses with error status code
    when using ProxyErrorOverride (#1283653)
  - mod_ldap: Respect LDAPConnectionPoolTTL for authn connections (#1300149)
  - mod_ssl: use "localhost" in the dummy SSL cert for long FQDNs (#1240495)
  - rotatelogs: improve support for localtime (#1244545)
  - ab: fix read failure when targeting SSL server (#1255331)
  - mod_log_debug: fix LogMessage example in documentation (#1279465)
  - mod_authz_dbd, mod_authn_dbd, mod_session_dbd, mod_rewrite: Fix lifetime
    of DB lookup entries independently of the selected DB engine (#1287844)
  - mod_ssl: fix hardware crypto support with custom DH parms (#1291865)
  - mod_proxy_fcgi: fix SCRIPT_FILENAME when a balancer is used (#1302797)


author: Joe Orton <jorton@redhat.com> - 2.4.6-45.3
changelog:
  - prefork: fix delay completing graceful restart (#1327624)
  - mod_ldap: fix authz regression, failing to rebind (#1415257)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-55
changelog:
  - Resolves: #1371876 - Apache httpd returns "200 OK" for a request
    exceeding LimitRequestBody when enabling mod_ext_filter


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-56
changelog:
  - Resolves: #1353740 - Backport Apache PR58118 to fix mod_proxy_fcgi
    spamming non-errors: AH01075: Error dispatching request to : (passing
    brigade to output filters)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-58
changelog:
  - Resolves: #1364604 - Upstream Bug 56925 - ErrorDocument directive misbehaves
    with mod_proxy_http and mod_proxy_ajp


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-59
changelog:
  - Resolves: #1378946 - Backport of apache bug 55910: Continuation lines
    are broken during buffer resize


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-60
changelog:
  - Resolves: #1414258 - Crash during restart or at startup in mod_ssl,
    in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-61
changelog:
  - Related: #1414258 - Crash during restart or at startup in mod_ssl,
    in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-62
changelog:
  - Resolves: #1397241 - Backport Apache Bug 53098 - mod_proxy_ajp:
    patch to set worker secret passed to tomcat


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-64
changelog:
  - Resolves: #1442872 - apache user is not created during httpd installation
    when apache group already exist with GID other than 48


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-67.2
changelog:
  - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
    authentication bypass
  - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
  - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
  - Resolves: #1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread
  - Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
    in mod_auth_digest


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-73
changelog:
  - Resolves: #1499253 - ProxyRemote with HTTPS backend sends requests
    with absoluteURI instead of abs_path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-74
changelog:
  - Resolves: #1430640 - "ProxyAddHeaders Off" does not become effective
    when it's defined outside <Proxy> setting


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-75
changelog:
  - Resolves: #1448892 - Cannot override LD_LIBARY_PATH in Apache HTTPD
    using SetEnv or PassEnv. Needs documentation.


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-80.1
changelog:
  - Resolves: #1560609 - httpd: active connections being terminated when httpd
    gets gracefully stopped/restarted, GracefulShutdownTimeout is not being
    honored


author: Lubos Uhliarik <luhliari@redhat.com>
changelog:
  - Resolves: #1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation
    in mod_auth_digest
  - Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control
    bypass due to race condition
  - Resolves: #1696096 - CVE-2019-0220 httpd: URL normalization inconsistency


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-91
changelog:
  - Resolves: #1630886 - scriptlet can fail if hostname is not installed
  - Resolves: #1565465 - CVE-2017-15710 httpd: Out of bound write in
    mod_authnz_ldap when using too small Accept-Language values
  - Resolves: #1568298 - CVE-2018-1301 httpd: Out of bounds access after
    failure in reading the HTTP request
  - Resolves: #1673457 - Apache child process crashes because ScriptAliasMatch
    directive
  - Resolves: #1633152 - mod_session missing apr-util-openssl
  - Resolves: #1649470 - httpd response contains garbage in Content-Type header
  - Resolves: #1724034 - Unexpected OCSP in proxy SSL connection


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
  - Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
    newline in the file name
  - Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
  - Resolves: #1724879 - httpd terminates all SSL connections using an abortive
    shutdown
  - Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
  - Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
    mod_cache_socache can allow a remote attacker to cause a denial of service
  - Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
    mod_session can allow a remote user to modify session data for CGI applications


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-97
changelog:
  - Resolves: #1852350 - httpd/mod_proxy_http/mod_ssl aborted when sending
    a client cert to backend server
  - Resolves: #1785100 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
  - Resolves: #1862499 - Intermittent Segfault in Apache httpd due to pool
    concurrency issues


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.1
changelog:
  - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
    request uri-path containing "unix:"


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.3
changelog:
  - Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
    when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com>
changelog:
  - Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
    malformed requests
  - Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input
  - Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.5
changelog:
  - Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.6
changelog:
  - Resolves: #2101997 - HEAD request with a 404 and custom ErrorPage causes
    corrupt and mixed-up responses


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.7
changelog:
  - Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 2.4.6-99.1.cloudlinux.1
changelog:
  - CVE-2023-38709: Faulty input validation in the core of Apache allows
    malicious or exploitable backend/content generators to split HTTP responses
  - CVE-2024-24795: HTTP Response splitting in multiple modules allows an
    attacker that can inject malicious response headers into backend applications
    to cause an HTTP desynchronization attack


author: Dmitriy Popov <dpopov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els6
changelog:
  - CVE-2022-23943: Fix out-of-bound write in mod_sed
  - CVE-2022-22721: Fix integer overflow which resulted in out-of-bounds write
  - CVE-2022-28615: Fix read beyond bounds in ap_strcmp_match()
  - CVE-2022-31813: Fix possible bypass of IP based authentication
  - CVE-2021-26690: Fix NULL pointer dereference in mod_session
  - CVE-2022-22719: Fix possible process crash due to unnoticed failures in mod_lua
  - CVE-2022-29404: Fix possible DoS due to no default limit on possible input size
    in mod_lua
  - CVE-2022-26377: Fix possible HTTP request smuggling in mod_proxy_ajp
  - CVE-2023-31122: mod_macro: Fix out-of-bounds read vulnerability
    by using own strncmp function
  - CVE-2024-38474: mod_rewrite: server weakness with encoded question marks
    in backreferences
  - CVE-2024-38475: mod_rewrite: server weakness in mod_rewrite when first
    segment of substitution matches filesystem path
  - CVE-2024-38477: mod_proxy: crash resulting in Denial of Service in
    mod_proxy via a malicious request
  - CVE-2024-38476: http: server use exploitable/malicious backend application
    output to run local handlers via internal redirect
  - CVE-2024-39573: mod_rewrite: proxy handler substitution
  - CVE-2024-39884: modules: source code disclosure with handlers configured via AddType.
    Resolving regression introduced by CVE-2024-38476 fix
  - CVE-2024-40725: modules: source code disclosure with handlers configured via AddType.
    Resolving regression introduced by CVE-2024-39884 fix


author: Jai S <jsathyapalan@cloudlinux.com> - 2.4.6-99.1.tuxcare.els8
changelog:
  - mod_sed: use 'memcpy' instead of 'strcpy' when the size of the string has already been computed
  - mod_sed: fix 'x' command processing in mod_sed


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 2.4.6-99.1.tuxcare.els9
changelog:
  - CVE-2024-47252: escape special characters in user-supplied data for mod_ssl
    logging
  - CVE-2025-49812: remove support for TLS upgrade to fix HTTP desynchronisation
    attack vulnerability


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els11
changelog:
  - CVE-2022-36760: mod_proxy_ajp HTTP Request Smuggling — ensure connection
    closure on invalid Transfer-Encoding header


author: Viktor Borzov <vborzov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els12
changelog:
  - CVE-2026-29169: mod_dav_lock: use the right dav_lock_discovery (refresh lock metadata mismatch)
  - CVE-2026-33857: mod_proxy_ajp: fix length checks in AJP msg_get functions
  - CVE-2026-34032: mod_proxy_ajp: fix ajp_msg_get_string buffer checks
  - CVE-2026-34059: mod_proxy_ajp: fix ajp_parse_data message length check
  - CVE-2026-33523: scan outgoing status line for newlines and control characters
  - CVE-2026-33007: mod_authn_socache: validate URL earlier
  - CVE-2026-33006: mod_auth_digest: tighten input validation and use constant-time comparison
  - CVE-2026-24072: mod_rewrite, mod_setenvif: use AP_EXPR_FLAG_RESTRICTED in htaccess context


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els13
changelog:
  - CVE-2026-28780: mod_proxy_ajp: heap-based buffer overflow in
    ajp_msg_check_header() — message size check did not subtract
    AJP_HEADER_LEN, letting a crafted AJP reply write 4 bytes past
    the end of the heap buffer


author: Nikita Ivanov <nivanov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els1
changelog:
  - CVE-2022-23943: Fix out-of-bound write in mod_sed
  - CVE-2022-22721: Fix integer overflow which resulted in out-of-bounds write
  - CVE-2022-28615: Fix read beyond bounds in ap_strcmp_match()
  - CVE-2022-31813: Fix possible bypass of IP based authentication


author: Nikita Ivanov <nivanov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els2
changelog:
  - CVE-2021-26690: Fix NULL pointer dereference in mod_session
  - CVE-2022-22719: Fix possible process crash due to unnoticed failures in mod_lua
  - CVE-2022-29404: Fix possible DoS due to no default limit on possible input size
    in mod_lua
  - CVE-2022-26377: Fix possible HTTP request smuggling in mod_proxy_ajp


author: Dmitriy Popov <dpopov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els4
changelog:
  - CVE-2024-38474: mod_rewrite: server weakness with encoded question marks
    in backreferences
  - CVE-2024-38475: mod_rewrite: server weakness in mod_rewrite when first
    segment of substitution matches filesystem path
  - CVE-2024-38477: mod_proxy: crash resulting in Denial of Service in
    mod_proxy via a malicious request
  - CVE-2024-38476: http: server use exploitable/malicious backend application
    output to run local handlers via internal redirect
  - CVE-2024-39573: mod_rewrite: proxy handler substitution


author: Dmitriy Popov <dpopov@cloudlinux.com> - 2.4.6-99.1.tuxcare.els5
changelog:
  - CVE-2024-39884: modules: source code disclosure with handlers configured via AddType.
    Resolving regression introduced by CVE-2024-38476 fix.
  - CVE-2024-40725: modules: source code disclosure with handlers configured via AddType.
    Resolving regression introduced by CVE-2024-39884 fix.


author: Pavel Alexeev <Pahan@Hubbitus.info> - 2.2.22-5
changelog:
  - Up apr and upr-utils required BR to 1.3 (http://centos.org/modules/newbb/print.php?form=1&topic_id=35915&forum=37&order=ASC&start=0).
  	Do not build for El5 untill this requirement will be met.


author: Pavel Alexeev <Pahan@Hubbitus.info> - 2.4.7.01.1
changelog:
  - Owesome! Httpd 2.4.7 pushed. It shoud not require any hack anymore.
  - Major update to 2.4.7-01.
  - Apache from 2.4 version have modularity structure, so many changes:
  	- Mpm may be build without apache source tree!
  	- Exclude apache sources, turn mpm-itk tarball into regular source0.
  	- So drop all black magic!
  	- Instal it as module, retire separate systemd service files and related stuff.
  	- Rewrite README.Fedora.


author: Pavel Alexeev <Pahan@Hubbitus.info> - 2.4.7.01-5
changelog:
  - Fix build issue on EL7 (rhbz# 1188159). Big thanks to Athmane Madjoudj <athmane@fedoraproject.org> for the work.


author: Pavel Alexeev <Pahan@Hubbitus.info> - 2.4.7.04-1
changelog:
  - Update to version 2.4.7-04 to solve problem https://lists.err.no/pipermail/mpm-itk/2015-September/000925.html. By mail request of Marco Matarazzo.


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-12
changelog:
  - mod_unique_id: replace use of hostname + pid with PRNG output (#976666)
  - apxs: mention -p option in manpage


author: Jan Kaluza <jkaluza@redhat.com> - 1.4.6-2
changelog:
  - initial spec rewrite for scl build
  - fix strict-aliasing gcc warning
  - remove unused SHA384 and SHA512 code
  - update license


author: Kamil Dudka <kdudka@redhat.com> 7.46.0-1
changelog:
  - disable silent builds (suggested by Paul Howarth)
  - use default port numbers when running the upstream test-suite
  - install zsh completion script
  - new upstream release


author: Joe Orton <jorton@redhat.com> - 2.4.25-5
changelog:
  - mod_proxy_fcgi: revert to pre-2.4.23 SCRIPT_FILENAME mangling (#1414037)
  - mod_proxy: fix regression in per-dir ProxyPass (#1417482)


author: Joe Orton <jorton@redhat.com> - 2.4.25-9
changelog:
  - link only httpd, not support/* against -lselinux -lsystemd (#1433474)
  - don't enable SO_REUSEPORT in default configuration (#1432249)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.34-7
changelog:
  - Resolves: #1646937 - Unable to start httpd
  - Resolves: #1638711 - comments should be allowed at the end of Allow from
    statements


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-7.1
changelog:
  - Resolves: #1695428 - CVE-2019-0211 httpd24-httpd: httpd: privilege escalation
    from modules scripts


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-9
changelog:
  - Resolves: #1696140 - CVE-2019-0217 httpd24-httpd: httpd: mod_auth_digest:
    access control bypass due to race condition
  - Resolves: #1696095 - CVE-2019-0220 httpd24-httpd: httpd: URL normalization
    inconsistency
  - Resolves: #1677498 - CVE-2018-17199 httpd24-httpd: httpd: mod_session_cookie
    does not respect expiry time
  - Resolves: #1707636 - fix a regression introduced in r1740928
  - Resolves: #1669213 - `ExtendedStatus Off` directive when using mod_systemd
    causes systemctl to hang
  - Resolves: #1673019 - httpd can not be started with mod_md enabled


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-10
changelog:
  - Resolves: #1745695 - CVE-2019-9511 httpd24-httpd: HTTP/2: large amount of
    data request leads to denial of service
  - Resolves: #1745680 - CVE-2019-9516 httpd24-httpd: HTTP/2: 0-length headers
    leads to denial of service
  - Resolves: #1745683 - CVE-2019-9517 httpd24-httpd: HTTP/2: request for large
    response leads to denial of service


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-11
changelog:
  - Resolves: #1678567 (CVE-2018-17189) - CVE-2018-17189 httpd: mod_http2:
    DoS via slow, unneeded request bodies


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-14
changelog:
  - Resolves: #1743996 (CVE-2019-10097) - CVE-2019-10097 httpd: null-pointer
    dereference in mod_remoteip
  - Resolves: #1747282 - CVE-2019-10092 httpd24-httpd: httpd: limited cross-site
    scripting in mod_proxy error page


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-16
changelog:
  - remove bundled mod_md module
  - Resolves: #1788976 - RFE: updated collection for httpd 2.4
  - Resolves: #1743959 (CVE-2019-10098) - CVE-2019-10098 httpd: mod_rewrite 
    potential open redirect


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-19
changelog:
  - Resolves: #1823836 - Backport of SessionExpiryUpdateInterval directive
  - Resolves: #1600579 - mod_proxy_hcheck Doesn't perform checks in VirtualHost
  - Resolves: #1809494 - Backport Apache Bug 53098 - mod_proxy_ajp: patch to set
    worker secret passed to tomcat
  - Resolves: #1828812 - httpd response contains garbage in Content-Type header


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-20
changelog:
  - Resolves: #1869069 - CVE-2020-9490 httpd24-httpd: httpd: Push diary crash
    on specifically crafted HTTP/2 header


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-21
changelog:
  - Resolves: #1637891 - RHSCL httpd : mod_proxy should allow to specify
    Proxy-Authorization in ProxyRemote directive


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-22
changelog:
  - Resolves: #1869076 - CVE-2020-11984 httpd24-httpd: httpd: mod_proxy_uswgi
    buffer overflow
  - Resolves: #1607737 - TCP healthchecks failing falsely / not actually checking
  - Resolves: #1869078 - CVE-2020-11993 httpd24-httpd: httpd: mod_http2 concurrent
    pool usage


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.27-7
changelog:
  - Related: #1487164 - apache user is not created during httpd
    installation when apache group already exist with GID other than 48


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.34-5
changelog:
  - Resolves: #1640722 - mod_md is missing in httpd24-httpd
  - Resolves: #1635838 - CVE-2018-11763 httpd24-httpd: httpd:
    DoS for HTTP/2 connections by continuous SETTINGS


author: John Dennis <jdennis@redhat.com> - 0.10.0-2
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply revised ECP pending patches
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.10.0-3
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply revised ECP pending patches,
    fix patch to pickup change in configure script that causes
    HAVE_ECP to be defined
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.11.0-1
changelog:
  - Upgrade to upstream 0.11.0 release.
  - Includes ECP support, see NEWS for all changes.
  - Update mellon_create_metadata.sh to match internally generated metadata,
    includes AssertionConsumerService for postResponse, artifactResponse &
    paosResponse.
  - Add lasso 2.5.0 version dependency
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.11.0-2
changelog:
  - Resolves: bug #1296286
    mod_auth_mellon emits CRITICAL warning message in Apache log when doing ECP
  - Resolves: bug #1324536
    Installing mod_auth_mellon causes working Kerberos authentication
    to start failing
  - Add ECP.rst documentation file that was erroneously omitted


author: John Dennis <jdennis@redhat.com> - 0.11.0-4
changelog:
  - Resolves: rhbz#1414021 - Incorrect Content-Type header in ECP PAOS
    Rebuilding due to missing comment in Changelog


author: John Dennis <jdennis@redhat.com> - 0.13.1-1
changelog:
  - Resolves: rhbz#1481332 Upgrade to current upstream 0.13.1
  - Adds the following upstream bug fixes on top of 0.13.1:
    * ee97812 Add Mellon User Guide
    * daa5d1e If no IdP's are defined explicitly log that fact
    * c291232 Make MellonUser case-insensitive.
    * 2c2e19d Fix incorrect error check for many `lasso_*`-functions.
    * 5c5ed1d Fix segmentation fault with POST field without a value.
    * 4c924d9 Fix some log message typos
    * 93faba4 Update log msg for Invalid Destination and Invalid Audience to
      show both the expected and received values.
  - Add new mellon user guide to installed docdir


author: Luboš Uhliarik <luhliari@redhat.com> - 0.13.1-2
changelog:
  - Resolves: #1514391 - [RFE] Include mod_auth_mellon for RHSCL httpd24
  - Merged with RHEL-7.5 branch, SCLized spec


author: Lubos Uhliarik <luhliari@redhat.com> - 0.14.0-2
changelog:
  - Resolves: #1568475 - mod_auth_mellon: tmpfiles.d drop-in wrong location
  - Resolves: #1568837 - ownership test fail


author: Lubos Uhliarik <luhliari@redhat.com> - 0.14.0-3
changelog:
  - Resolves: #1692459 - CVE-2019-3878 httpd24-mod_auth_mellon: mod_auth_mellon:
    authentication bypass in ECP flow


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-5
changelog:
  - MODLS-388: destroy_lve symbol lookup bug fixed
  - MODLS-389: starter lock mechanism changed to fcntl
  - MODLS-384: Conflict with ea-apache24 added to mod_lsapi spec
  - MODLS-379: /usr/selector and ea-php locations for lsphp added into csf rules
  - MODLS-374: Cache of spawn_info_t structure sent on every lsphp starting for domain" into mod_lsapi-1.0.criu


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-9
changelog:
  - MODLS-394: starter mutex switched to PTHREAD mech to avoid deadlocks on MPM Event
  - MODLS-340: Corrected CRIU functions
  - MODLS-405: DocRoot special value is added to lsapi_phprc option


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-10
changelog:
  - MODLS-368: Add mod_lsapi handler to EA4 PHP handlers
  - MODLS-399: Fetch litespeed sources over https for beta
  - MODLS-408: Add PHP71 handler
  - MODLS-391: Buffer temporary file completely before passing it to backend PHP process


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-11
changelog:
  - MODLS-401: Add dynamic tuning of lsapi_backend_children parameter
  - MODLS-410: Priority of php_value from httpd.conf lowered to PERDIR


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-12
changelog:
  - MODLS-419: Make script for switching lsapi from old mechanism(--enable-global, --enable-domain) to new mechanism(lsapi via web-interface of cPanel)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-13
changelog:
  - MODLS-423: php_value htaccess flag value changed
  - MODLS-422: Add ability to disable lsapi while it is enabled globally EA3
  - MODLS-424: uninstall does not work properly


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-14
changelog:
  - MODLS-430: Add lsphp handlers to users Plesk panel correctly
  - MODLS-431: lsapi_output_buffering option added
  - MODLS-414: env var for lsphp log prefix added
  - MODLS-417: Backend log changed to own file on EA4
  - MODLS-368: Removed suphp detection
  - Changed method of suphp detection


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-15
changelog:
  - MODLS-436: Add force option to switch_mod_lsapi --setup
  - MODLS-429: switch_mod_lsapi --build-native-lsphp is not executed randomly after upcp on EA3
  - MODLS-433: New mechanism lsapi and web-interface of cPanel. Proposed by cPanel team


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-16
changelog:
  - MODLS-403: Check for Cloudlinux added to liblsapi
  - MODLS-434: Handler value was dropped after update
  - MODLS-435: Conflict with mpm_itk added to EA4 mod_lsapi
  - MODLS-433: New mechanism lsapi and web-interface of cPanel
  - Added /opt/cloudlinux as safe path
  - Fix httpd24 CL7 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-17
changelog:
  - MODLS-443: Hotfix: add setup-light command for cleaning all garbage in htaccess wich bring by previous versions
  - MODLS-442: Configure uninstall/update mod_lsapi with Plesk panel
  - MODLS-440: looking for user.ini in home dir
  - MODLS-400: DA script changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-20
changelog:
  - MODLS-445: CRIU messaging changed
  - MODLS-456: Added handlers for php 7.2 for cPanel EA4 and Plesk


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-21
changelog:
  - MODLS-452: Fix destroying of starter mutex on worker and event MPMs
  - MODLS-457: PWD var added into safe environment as cwd of backend process
  - MODLS-464: Max size of response header package fixed
  - MODLS-463: Add application/x-httpd-ea-php72___lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp and application/x-httpd-ea-php72-lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp
  - MODLS-460: Add ability to set lsapi_backend_children manually


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-22
changelog:
  - MODLS-466: lsapi_backend_semtimedwait option switched on by default
  - MODLS-466: lsapi-cache service improved
  - MODLS-466: lsapi-cache service for CL6 implemented
  - MODLS-468: criu messaging changed
  - MODLS-476: Add corresponding to criu messages into sulsphp_log
  - MODLS-475: Cleanup criu images on dump error
  - AAP-189: ea-apache24-mod_suphp-0.7.2-21 package installation flush php handlers to suphp
  - MODLS-470: Reset all criu images on update criu-lve and alt-phpXY


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-23
changelog:
  - MODLS-479: Make correct output of the totBytesRead and bodyLen values
  - MODLS-478: Prefix lsapi errors with timestamps
  - MODLS-472: unlimit core file size when BACKEND_COREDUMP on


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-24
changelog:
  - MODLS-483: Fix premature mutex destroying on MPM Event
  - MODLS-482: Refactor CRIU patch for PHP
  - MODLS-472: unlimit core file size on CL6


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-25
changelog:
  - MODLS-494: implement ~/mod_lsapi_reset_me flag for removing all CRUI images for all domains of user
  - dependency from alt-libxml2 removed from ea-apache24-mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-29
changelog:
  - MODLS-538: Alignment issue fixed
  - MODLS-531: Added check if criu images exist on restore request
  - MODLS-532: lsapi_disable_reject_mode option is added
  - MODLS-528: reopen sulsphp_log to exclude too big FD number for criu
  - MODLS-520: Added new lsapi_avoid_zombies config
  - MODLS-491: Avoid worker's child to accept the connection
  - MODLS-491: Avoid reading/writing stale data from/to the lsphp socket
  - MODLS-527: starter logic is improved
  - MODLS-525: httpd criu dumper permissions changed
  - MODLS-519: Option to disable PWD var added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-30

changelog:
  - MODLS-551: statistics for Plesk via API only; structure reinvented for EA4
  - MODLS-549: Added dump configs lsapi_criu, lsapi_with_connection_pool, lsapi_per_user
  - MODLS-549: mod_lsapi stat for EA4 (v.1)
  - MODLS-441: http_keep_http200 option added
  - MODLS-533: Hook for Plesk update added
  - MODLS-548: Suppress unrelevant warning messages on Apache restart


changelog:
  - switch_mod_lsapi --stat option added
  - MODLS-560: Installation of mod_lsapi package on DA added

author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-31


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-32
changelog:
  - MODLS-574: Started logics improvement
  - MODLS-573: add support alt-php7.3 for mod_lsapi (plesk) and ea-apache24-mod_lsapi
  - MODLS-565: lsapi_poll_timeout default-value 300


author:
  Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-33

changelog:
  - MODLS-590: Fixed stack overflow lscapi_do_request
  - MODLS-582: Update Copyright for mod_lsapi project
  - MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
  - MODLS-584: semtimedwait improvement
  - MODLS-580: stat support added for DA without mod_lsapi rpm
  - MODLS-481: fix stuck when bodyLen is wrong
  - MODLS-579: Remove LVE support from cpanel mod_lsapi
  - Fix exception in case if there are no liblsapi installed
  - MODLS-576: added absolute path for service util


author:
  Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-34

changelog:
  - MODLS-608: removed non-ascii symbol in copyright
  - MODLS-606: Fix lsapi_poll_timeout functionality
  - MODLS-600: fix mod_lsapi removal sets handler to none
  - MODLS-571: add support for httpd24-mod_lsapi usage statistics
  - MODLS-598: Fix permissions on config files
  - MODLS-587, MODLS-594: selector usage statistics added
  - MODLS-588: cpanel_mod_lsapi: put all of liblsapi's files into /opt/cpanel/ea-liblsapi/


author: Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-35
changelog:
  - Fixed statistics exceptions flow
  - MODLS-615: ea-apache24-mod_lsapi epoch bumped
  - MODLS-615: liblsapi confilct with ea-liblsapi added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-36
changelog:
  - MODLS-618: liblsapi vs ea-liblsapi conflict fixed
  - MODLS-619: Requires tag added for python related pkgs


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-37
changelog:
  - MODLS-616: Ensure existence of directory for lsapi sockets in /var/run
  - MODLS-621: Add a configuration option (lsapi_use_req_hostname) that controls how virtualhost name is picked
  - AAP-253: spec and cmake files redesigned for new httpd24 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-38
changelog:
  - MODLS-577: Log changed for errors produced by http filter
  - AAP-243: Sentry: create a mechanism to save errors from mod_lsapi
  - MODLS-644: added ea-php73 lsapi handler
  - Added troubleshooting link into log for rejected request


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-39

changelog:
  - MODLS-638: Clearing of systemd cgroup for lsphp added
  - MODLS-638: MODLS-481 reverted
  - MODLS-641: Build scripts redesigned
  - MODLS-654: CMakeCache deleted on make clean
  - AAP-243: Disable lsapi_sentry by default
  - MODLS-653: DA spec file added
  - MODLS-655: fix unexpected statistics output


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-40
changelog:
  - MODLS-661: Make possibility criu work on CL7h
  - MODLS-638: During graceful restart lsphp process are killed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-42
changelog:
  - MODLS-679: fixed race condition is dump req info
  - MODLS-674: liblsapi receive response header interface redesigned
  - MODLS-670: ElasticAPM support redesigned
  - MODLS-665: added sulsphp_log logfile location directive
  - MODLS-656: unifying form of errors for sentry


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kozhekin <skozhekin@cloudlinux.com> 1.1-44
changelog:
  - MODLS-691: Elastic APM dump request info fixed
  - MODLS-689: Support for lsapi_backend_pgrp_max_reqs and lsapi_backend_pgrp_max_crashes added
  - MODLS-530: benchmark script added
  - MODLS-684: Fix Plesk tests (issue with handlers on both platforms)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-45
changelog:
  - MODLS-692: connection pool mode updated
  - MODLS-702: Apache restart added to mod_lsapi update
  - MODLS-703: rpm -q from mod_lsapi_stat removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-46
changelog:
  - MODLS-723: proper request body length for 2G+ files
  - MODLS-722: clean shutdown support for LSAPI 7.6 added
  - MODLS-708: da_mod_lsapi installation added into da_cb_install script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-47
changelog:
  - MODLS-727: Removed /var/cpanel/conf/apache/main usage as it was removed in cPanel
  - alt-php74 support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author: Timur Averianov <taverianov@cloudlinux.com> 1.1-81
changelog:
  - CLOS-3184: Fix installation error on CL7+Plesk, leading to Apache service not starting; improve future upgrade reliability for other configurations


author:
  Timur Averianov <taverianov@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.1-86

changelog:
  - MAXWS-785: Fix backend termination script hanging in the background when there were too many processes
  - CLOS-3499: Update package to be compatible with CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.1-87

changelog:
  - CLOS-3355: Set the docroot and domain information in the env before spawning lsphp
  - CLOS-3574: Use LSPHPRC instead of PHPRC if ea-php is version 8.4 and higher
  - CLOS-3646: Support RLIMITs


author: Nika Keshelava <nkeshelava@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-93
changelog:
  - CLOS-1655: Add CRIU support for CL9 and CL10
  - CLOS-4290: Minor fixes in request parsing and configuration scripts


author: Leonid Kanter <lkanter@cloudlinux.com> - 0.7.2-1
changelog:
  - update to with-setid-mode="owner"
  - handle update of packages built with --with-setid-mode="owner" (dkasyanov@)


author: Lubos Uhliarik <luhliari@redhat.com> - 1.7.1-8
changelog:
  - Resolves: #1745692 - CVE-2019-9513 httpd24-nghttp2: HTTP/2: flood using
    PRIORITY frames resulting in excessive resource consumption
  - Resolves: # 1744825 - CVE-2019-9511 httpd24-nghttp2: HTTP/2: large
    amount of data request leads to denial of service


author: Caolán McNamara <caolanm@redhat.com> - 1.3.2-6
changelog:
  - Resolves: rhbz#573516 have hunspell require hunspell-en to ensure
    at least one dictionary exists


author: Jay Fenlason <fenlason@redhat.com> - 1.7-1.1
changelog:
  - Remove build dependencies on libXNVCtrl-devel and w3m because RHEL
    does not have them (w3m is available on x86_64, but not s390).
    Resolves: rhbz978752


author: Jay Fenlason <fenlason@redhat.com> - 1.7-1.2
changelog:
  - Split out lstopo into a -gui subpackage, so the hwloc base package
    does not pull in all of X.
    Resolves: rhbz910165


author: Don Zickus <dzickus@redhat.com> - 1.7-4
changelog:
  - Fix dangling symlink for hwloc-ls manpage
    Resolves: rhbz1081236
    Add desktop entry for lstopo
    Resolves: rhbz1229313


author: Michal Schmidt <mschmidt@redhat.com> - 1.11.8-4
changelog:
  - Rebase to 1.11.8.
  - Deal with rpaths using the method from Packaging Guidelines.
  - BuildRequire rdma-core-devel on s390(x).
  - Fix scriptlets related to hwloc-dump-hwdata.service.
  - Configure with /run as runstatedir.
  - Spec file cleanup.
  - Related: rhbz1482585


author: Tomas Hozza <thozza@redhat.com> - 0-0.20.20130826git
changelog:
  - Build daemons only for x86_64 architecture (#1010220)
  - Bump release to 20 to prevent RHEL6 -> RHEL7 update path issues


author: Tomas Hozza <thozza@redhat.com> - 0-0.21.20130826git
changelog:
  - Use 'hypervkvpd' directory in libexec for KVP daemon scripts (#1010280)
  - daemons are now WantedBy multi-user.target instead of basic.target (#1010284)


author: Matej Muzila <mmuzila@redhat.com> - 0-0.25.20141008git
changelog:
  - Daemons updated to the last git snapshot
  - Use kernel-headers instead of kernel-devel to build
  - Added Hyper-V fcopy daemon as hypervfcopyd subpackage


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.26.20150402git
changelog:
  - 2015-04-02 git snapshot
  - VSS: skip all readonly-mounted filesystems (#1160584)
  - VSS: support partitions mounted several times (#1169724)


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.30.20161211git
changelog:
  - Use '-gt' instead of '>' to do the right comparison (#1414822)
  - hyperv-tools subpackage added (#1378710)
  - Update to upstream v4.9 (#1406397)


author: 2018 Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.33.20180415git
changelog:
  - Update to upstream v4.17-rc1, drop no longer needed bondvf.sh script
  - Fix KVP with SR-IOV (#1567022)


author: Caolán McNamara <caolanm@redhat.com> - 2.8.3-4
changelog:
  - Resolves: rhbz#813481 x86_64 valgrind spews, see rhbz#813780
  - Related: rhbz#813481 dump valgrind failure log


author: Jaromir Capik <jcapik@redhat.com> - 3.1.0-5
changelog:
  - Introducing man pages for binaries in the eepromer subpackage
  - Introducing -r switch in the i2cset help


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.1.0-11
changelog:
  - 1071397 - Load i2c-dev module when i2cdetect is executed
  - 1195285 - Ship modprobe.d files in /usr/lib/modprobe.d


author: Doug Ledford <dledford@redhat.com> - 1.0.5-2
changelog:
  - Don't install the address file or config file, the config file isn't
    strictly needed and defaults will be used if it isn't installed, but
    with the address file we specifically need to build one based upon
    the machine where the program is installed, a default file is not only
    not helpful, but it messes up the daemon.
  - Related: bz700285


author: Doug Ledford <dledford@redhat.com> - 1.0.5-3
changelog:
  - Until the next upstream release, the pid file is in a wonky location.
    Make the init script know about that location so we can stop properly.
  - Resolves: bz808599


author: Michal Schmidt <mschmidt@redhat.com> - 1.0.10-0.1.20150717git825da3ccd2
changelog:
  - Update to pre-release git snapshot of 1.0.10.
  - Adds libibacmp shared library.
  - Rebase coverity patch.
  - Minor spec file cleanup.
  - Resolves: bz1169952


author: Michal Schmidt <mschmidt@redhat.com> - 1.0.10-0.3.20150717git825da3ccd2
changelog:
  - Put libibacmp.so in the main package, it's needed at runtime.
  - No need to run ldconfig, the .so is not in the linker path.
  - Filter the plugin from RPM provides.
  - Related: bz1169952


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.4-1
changelog:
  - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built with $RPM_OPT_FLAGS
  - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing: ibus: visible 
    password entry flaw [fedora-all]
    Thanks czchen for the GitHub pull request 39.
  - Added translations: fr_FR, ja_JP, ko_KR
  - Adopt cmake-fedora-1.2.0


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.4-7
changelog:
  - Target "translation" is built separately with all, 
    in order to tame multiple job make.
  - Resolves Bug 1013977 - ibus-chewing needs to have ibus write-cache --system in %post and %postun
  - Resolves Bug 1027031 - CVE-2013-4509 ibus-chewing: ibus: visible password entry flaw [rhel-7.0]
  - Resolves Bug 1028911 - [zh_TW]'Chinese<->English' switch does not work when clicking on the Chewing menu list.
  - Resolves Bug 1045868 - ibus-chewing *again* not built with $RPM_OPT_FLAGS
  - Option "Sync between caps lock and IM":
    + Default of  is changed to "disable",  because the previous default
      "keyboard" cause bug 1028911 for GNOME Shell.
    + Now Sync from "input method" can control Caps LED in GNOME shell.
  - Translation added: de_DE, es_ES, it_IT, pt_BR, uk_UA
  - Set environment IBUS_CHEWING_LOGFILE for ibus-chewing log.


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.4-9
changelog:
  - Resolves Bug 1119963 - Slow focus change with ibus-chewing
  - Resolves Bug 1062133 - ibus-chewing may not handle key event after focus change
  - Resolves Bug 1073797 - Cannot identify input mode for Chinese IME (ibus-chewing)


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.2-1
changelog:
  - Fixed GitHub issue #7: highlighted text be cut after switch back to pure ibus
    by merging pull request #24 from buganini
  - Fixed GitHub issue #20: Shift key will send duplicated strings
    by merging pull request #22 from buganini
  - Fixed GitHub issue #21: somethings wrong with cmake
  - Fixed GitHub issue #25: Weird symbol when input with somethings highlighted
    by merging pull request #26 from buganini
  - Fixed GitHub issue #27: Local path committed into tree
  - Fixed: Bug 713033 -  [zh_TW] ibus-chewing problem
  - Fixed: Bug 745371 -  ibus-chewing: mode confusion In Temporary English mode and Chinese mode later on
  - Fixed: Google Issue 1172: [ibus-chewing] move elf file to standard directory.
  - Fixed: Google Issue 1426: ibus-chewing-1.3.10 installs directory /gconf to root filesystem
  - Fixed: Google Issue 1428: ibus-chewing-1.3.10 fails to save it's settings
  - Fixed: Google Issue 1481: Some characters are missing when a long string in preedit buffer.
  - Fixed: Google Issue 1490: Cannot change INSTAL prefix for ibus-chewing-1.4.0


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.3-1
changelog:
  - Fixed GitHub issue #30: Rework decorate_preedit
    by merging pull request #30 from buganini
  - Fixed GitHub issue #31: Properly refresh property
    by merging pull request #31 from buganini


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-6
changelog:
  - Resolves: #1051389, #1051391, #1051408, #1051397, #1051398, #1051415,
                Updated ibus-HEAD.patch for upstream
  - Resolves: #1050813
    Deleted notify-python in Requires


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-12
changelog:
  - Resolves: #1183909 - programs using "PreeditType: OverTheSpot" is stalled
  - Resolves: #1191825 - gtk2's immodules.cache won't be updated in some cases


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-1
changelog:
  - Bumped to 1.5.3
  - Deleted ibus-xx-g-s-disable-preedit.patch as EOL.
  - Deleted ibus-gjs as EOL.
  - Removed imsettings-gnome, im-chooser, libgnomekbd dependencies.


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-3
changelog:
  - Remove have_bridge_hotkey and need_pygobject3 macros which does no
    longer make sense after F17
  - Add ibus-hangul-dconf-prefix.patch
  - Fix bug 909509 - Hangul Keybaord doesn't be changed in IBusHangul Setup


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-7
changelog:
  - Invoke ibus-setup-hangul with the absolute path.
  - Fix bug 1012732 - Click ibus hangul setup on gnome-shell top bar's
    ibus -> No Response


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-10
changelog:
  - Add ibus-hangul-hangul-toggle.patch
  - Fix bug 1071351 - Cannot switch English input mode and Hangul
    (Korean) input mode by Hangul key


author: Daiki Ueno <dueno@redhat.com> - 1.5.18-6
changelog:
  - add ibus-kkc-16th-candidate.patch (Closes: #1251882)
  - add ibus-kkc-page-settings.patch (Closes: #1251891)
  - add ibus-kkc-ignore-annotations.patch (Closes: #1251896)


author: Peng Wu <pwu@redhat.com> - 1.6.91-4
changelog:
  - Resolves: rhbz#1068338, rhbz#1068448
  - Add patch ibus-libpinyin-update-gnome-shell-indicatior.patch
  - Add patch ibus-libpinyin-drop-xdg-depends.patch


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-3
changelog:
  - Add ibus-m17n-fix-mtext-config.patch
  - Fix bug 836397 - [abrt] ibus-m17n-1.3.3-11.fc17: mtext_data: Process
    /usr/libexec/ibus-setup-m17n was killed by signal 11 (SIGSEGV)


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-4
changelog:
  - Add ibus-m17n-translit-layout.patch
  - Fix bug 847495 - For non-US keyboard layout Ibus-m17n adds English
    (US) to the list of input methods and other input methods use US
    layout
  - Require eekboard-service instead of eekboard
  - Fix bug 847500 - Don't install Eekboard by default in the desktop spin


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-6
changelog:
  - Add ibus-m17n-desktop-file.patch
    Fix bug 860955 - ibus-m17n setup is not enabled in
    gnome-control-center region, .desktop file is missing


author: Daiki Ueno <deno@redhat.com> - 1.3.4-8
changelog:
  - Update ibus-m17n-HEAD.patch to the latest upstream master
  - Remove unnecessary and not upstreamable patches
  - Use gtk3 always
  - Fix bug 912592 - ibus-m17n should use default keyboard in most cases


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-9
changelog:
  - Update ibus-m17n-xkb-options.patch to set XKB option for Inscript2
  - Fix bug 957993 - ibus-m17n doesn't automatically map Alt_R to AltGr
    when Inscript2 maps are used


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-10
changelog:
  - Add ibus-m17n-fix-data-location.patch
  - Fix bug 962144 [abrt] ibus-m17n-1.3.4-9.fc19:
    setup_dialog_load_config: Process /usr/libexec/ibus-setup-m17n was
    killed by signal 11 (SIGSEGV)


author: Jay Fenlason <fenlason@redhat.com> 1.5.7-8
changelog:
  - Add the -output patch to have programs use /var/cache/ibutils
    instead of /tmp
    Resolves: bz958569


author: Doug Ledford <dledford@redhat.com> - 1.5.7-12
changelog:
  - Change ExclusiveArch to ExcludeArch instead so we don't have
    the same problem again in the future
  - Update to the git repo tarball that we shipped in rhel6.6
  - Related: bz1123998


author: Ville Skyttä <ville.skytta@iki.fi> - 1.3.1-5
changelog:
  - Resolves: rhbz#875496
  - Build with $RPM_LD_FLAGS and %{_smp_mflags}.
  - Run unit tests during build.


author: Jiri Vanek <jvanek@redhat.com> 1.3.2-0
changelog:
  - Updated to latest ustream release of 1.3 branch - 1.3.2
   - Security Updates
    - CVE-2013-1927, RH884705: fixed gifar vulnerability
    - CVE-2013-1926, RH916774: Class-loader incorrectly shared for applets with same relative-path.
   - Common
    - Added new option in itw-settings which allows users to set JVM arguments when plugin is initialized.
   - NetX
    - PR580: http://www.horaoficial.cl/ loads improperly
   - Plugin
     PR1260: IcedTea-Web should not rely on GTK
     PR1157: Applets can hang browser after fatal exception
  - Removed upstreamed patch to remove GTK dependency
    - icedtea-web-pr1260-remove-gtk-dep.patch


author: Jiri Vanek <jvanek@redhat.com> 1.4-0
changelog:
  - Updated to 1.4
  - See announcement for detail
   - http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-May/023195.html
  - commented out check - some junit4  incompatibility


author: Jiri Vanek <jvanek@redhat.com> 1.4-1
changelog:
  - Adapted to latest openjdk changes
  - added build requires for autoconf and automake
  - minor clean up


author: Jiri Vanek <jvanek@redhat.com> 1.4.1-0
changelog:
  - updated to 1.4.1
  - add icedtea-web man page (resolves 948443)
  - removed upstreamed  patch1 b25-appContextFix.patch
  - removed upstreamed  patch2 rhino-pac-permissions.patch
  - make check enabled again
  - should be build for non-standart archs !-)
  - removed unused multilib arches (yupii!)
  - Resolves: rhbz#1009820


author: Jiri Vanek <jvanek@redhat.com> 1.5-2
changelog:
  - add not yet upstreamed DE localisation of 1.5
   - patch0 DElocalizationforIcedTea-Web1.5-0001.patch
  - autoreconf gog  -vfi, see RH1077898
  - ./configure changed to %configure
  - Resolves: rhbz#1077287


author: Jiri Vanek <jvanek@redhat.com> 1.6.0-1
changelog:
  - update to upstream 1.6
  - made to use jdk8 (rh1184970)
  - it will be necessary for 1.6.1 anyway (rh1233687)
  - Resolves: rhbz#1217153


author: Jiri Vanek <jvanek@redhat.com> 1.6.1-1
changelog:
  - updated to upstream release 1.6.1
  - metadata xml files enhanced for javaws
  - forced to use jdk8 by default
  - Resolves: rhbz#1217153


author: Jiri Vanek <jvanek@redhat.com> 1.6.1-4
changelog:
  - added and and applied patch2 fileLogInitializationError-1.6.patch to prevent 
  consequences 1268909
  - Resolves: rhbz#1217153


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. 
  set -e 
     _pompart="need" 
     _jarpart="tobe" 
  _filelist=".mfiles" 
  install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.6.2-4.el7.x86_64/usr/share/maven-fragments 
  for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
      if [ -f /builddir/build/BUILDROOT/icedtea-web-1.6.2-4.el7.x86_64$_dir/$_jarpart ]; then 
  	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.6.2-4.el7.x86_64$_dir/$_jarpart" 
      fi 
  done 
  python -m /usr/share/java-utils/maven_depmap   \
            -p "/usr" -n "" \
            /builddir/build/BUILDROOT/icedtea-web-1.6.2-4.el7.x86_64/usr/share/maven-fragments/icedtea-web \
            /builddir/build/BUILDROOT/icedtea-web-1.6.2-4.el7.x86_64/usr/share/maven-poms/$_pompart \
          >> ${_filelist} 
  sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.6.2-4.el7.x86_64::' ${_filelist} 
  sort -u -o ${_filelist} ${_filelist} 


  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-3
changelog:
  - added --family to make it part of javas alternatives alignment
  - java-javaver-openjdk collected into preffered_java 
  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. 
  set -e 
     _pompart="need" 
     _jarpart="tobe" 
  _filelist=".mfiles" 
  install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.x86_64/usr/share/maven-fragments 
  for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
      if [ -f /builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.x86_64$_dir/$_jarpart ]; then 
  	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.x86_64$_dir/$_jarpart" 
      fi 
  done 
  python -m /usr/share/java-utils/maven_depmap   \
            -p "/usr" -n "" \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.x86_64/usr/share/maven-fragments/icedtea-web \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.x86_64/usr/share/maven-poms/$_pompart \
          >> ${_filelist} 
  sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.7.1-1.el7.x86_64::' ${_filelist} 
  sort -u -o ${_filelist} ${_filelist} 


  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.7-1
changelog:
  - updated to itw 1.7 and sync from fedora
  - added forgotten slaves of itweb-settings policyeditor
  - Own %{_datadir}/%{name} dir
  - Mark non-English man pages with %lang
  - Install COPYING as %license
  - last three by Ville Skytta <ville.skytta@iki.fi> via 1481270
  - for sake of rpms added patch0, bashCompDirHardcodedAgain.patch to hardcode bashcompletion dir
  - removed maven macros in favour of manual handling (bug)
  - Resolves: rhbz#1475411


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. 
  set -e 
     _pompart="need" 
     _jarpart="tobe" 
  _filelist=".mfiles" 
  install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64/usr/share/maven-fragments 
  for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
      if [ -f /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64$_dir/$_jarpart ]; then 
  	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64$_dir/$_jarpart" 
      fi 
  done 
  python -m /usr/share/java-utils/maven_depmap   \
            -p "/usr" -n "" \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64/usr/share/maven-fragments/icedtea-web \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64/usr/share/maven-poms/$_pompart \
          >> ${_filelist} 
  sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64::' ${_filelist} 
  sort -u -o ${_filelist} ${_filelist} 


  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.7.2-16
changelog:
  - added patch1, patch4 and patch11 to fix CVE-2019-10182
  - added patch2 to fix CVE-2019-10181
  - added patch3 and patch33 to fix CVE-2019-10185
  - Resolves: rhbz#1724958 
  - Resolves: rhbz#1725928 
  - Resolves: rhbz#1724989


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. 
  set -e 
     _pompart="need" 
     _jarpart="tobe" 
  _filelist=".mfiles" 
  install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-fragments 
  for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
      if [ -f /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64$_dir/$_jarpart ]; then 
  	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64$_dir/$_jarpart" 
      fi 
  done 
  python -m /usr/share/java-utils/maven_depmap   \
            -p "/usr" -n "" \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-fragments/icedtea-web \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-poms/$_pompart \
          >> ${_filelist} 
  sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64::' ${_filelist} 
  sort -u -o ${_filelist} ${_filelist} 


  - Resolves: rhbz#1299537


author: Martin Gieseking <martin.gieseking@uos.de> 0.30.0-1
changelog:
  - updated to release 0.30.0
  - dropped patch as it has been applied upstream
  - removed old buildroot stuff


author: Richard W.M. Jones <rjones@redhat.com> - 0.31.3-1
changelog:
  - Rebase to upstream version 0.31.3.
  - This version includes multiple security fixes
    CVE-2017-5208, CVE-2017-5333, CVE-2017-5332, CVE-2017-6009,
    CVE-2017-6010, CVE-2017-6011
    resolves: rhbz#1430610


author: Eike Rathke <erack@redhat.com> - 50.1.2-6
changelog:
  - Resolves: rhbz#966141 various flaws in Layout Engine font processing
  - Resolves: rhbz#966077 aarch64 support for icu-config.sh wrapper


author: Mike FABIAN <mfabian@redhat.com> - 50.2-1
changelog:
  - Update to 50.2 maintenance release including support for new Japanese era Reiwa (令和).
  - Resolves: rhbz#1677092


author: Mike FABIAN <mfabian@redhat.com> - 50.2-2
changelog:
  - Fix rpmdiff failure: File /usr/src/debug/icu/source/i18n/unicode/selfmt.h
    relaxed permissions from 0644 to 0755 on all architectures
  - Related: rhbz#1677092


author: Mike FABIAN <mfabian@redhat.com> - 50.2-4
changelog:
  - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch
  - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch
  - Resolves: rhbz#1808235


author: Rex Dieter <rdieter@fedoraproject.org> - 1.0.2-2
changelog:
  - libIlmThread missing -pthread linkage (#661115)
  - %install: INSTALL="install -p"
  - -devel: tighten dep using %?_isa


author: Rex Dieter <rdieter@fedoraproject.org> - 1.0.3-3
changelog:
  - IlmBase.pc: +Requires.private: gl glu
  - -devel: drop hard-coded libGL/pkgconfig deps, let rpm autodetect now


author: Akira TAGOH <tagoh@redhat.com> - 1.6.2-1
changelog:
  - New upstream release.
  - the spec file cleanup.
  - Correct License field
  - Add Provides: bundled(egglib) to im-chooser-common since
    it actually contains things in libimchooseui.so.0


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release.
    - Add a link to the log file in the error dialog (#950488)
    - Fix a crash issue (#859624)


author: Akira TAGOH <tagoh@redhat.com> - 1.6.4-6
changelog:
  - Bring up gnome-control-center region if current desktop is GNOME.
  - Hide application from menu. (#1657016)


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.0-1
changelog:
  - New upstream release
  - Remove libtool files
  - Run ldconfig after un/installation to update *.so files
  - Add -devel subpackage to handle include files and examples


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.1-1
changelog:
  - New upstream release
  - Adjusted docbook xsl path to match the correct stylesheet
  - Remove only *.la files, considering there aren't any *.a files


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-10
changelog:
  - Fix a regression imsettings can't detect GNOME running caused by GNOME rebase. (#1533772)
  - Fix unbound variable issue (#1533050)


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-11
changelog:
  - Don't set environment variables on GNOME. (#1673284)
  - Fix another unbound variable issue (#1533050)


author: Doug Ledford <dledford@redhat.com> - 1.5.5-1.el6
changelog:
  - Update and rebuild against latest opensm (which was needed for latest
    ibutils, which was needed for licensing issues resolved in new upstream
    tarball, which was needed for pkgwrangler review)
  - Related: bz555835


author: Doug Ledford <dledford@redhat.com> - 1.5.8-1.el6
changelog:
  - Update to latest upstream version
  - Make build work on i686 arch
  - Modify perfquery to be able to loop through all HCAs in a single host
  - Resolves: bz593767
  - Related: bz725016


author: Doug Ledford <dledford@redhat.com> - 1.5.12-1
changelog:
  - Update to latest upstream release
  - Initial Fedora import
  - Add devel and devel static packages (review item)
  - Make etc file config(noreplace) (review item)
  - Remove no longer support scripts (review item)


author: Doug Ledford <dledford@redhat.com> - 1.6.2-1
changelog:
  - Update to latest upstream release (resolves bz998816)
  - Revive all_hcas patch (otherwise would be a regression)
  - Fix ibnodes -h output (another regression, bz1054545)
  - Resolves: bz998816, bz1054545


author: Michal Schmidt <mschmidt@redhat.com> - 1.6.5-1
changelog:
  - Update to latest upstream release. Adds rdma-ndd daemon.
  - Rebase patches, cherry-pick fixes from upstream git.
  - Enable build on s390(x).
  - Fixed bogus changelog dates.
  - Add Conflicts with old rdma. It needs to be aware of rdma-ndd.
  - Resolves: bz1169968


author: Honggang Li <honli@redhat.com> - 1.6.7-1
changelog:
  - Rebase to latest upstream release 1.6.7.
  - Remove patches merged into upstream release.
  - Remove sub-package rdma-ndd as it merged into rdma-core.
  - Resolves: bz1382809


author: Jay Fenlason <fenlason@redhat.com> - 1.13-2
changelog:
  - Use macros for lib and include directories, and include dist tag in
    release field.
  - Corrected License field.
  - Corrected Requires lines for libuuid.
  - Add Exclusive-arch x86_64
    Related: rhbz570274


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Include the -execstack patch to get libinfinipath.so correctly
    labeled as not executing the stack.
    Resolves: rhbz612936


author: Jay Fenlason <fenlason@redhat.com> 3.1-1
changelog:
  - Upgrade to new upstream version.
  - add the -edata patch to handle the type-change of the edata sypmbol
    from 'A' to 'D'.


author: jay Fenlason <fenlason@redhat.com> 3.1-2.r364.1140_open
changelog:
  - Pull in upstream patch to close
    Resolves: rhbz907730 - [RHEL-7.0] libpsm_infinipath.so: undefined reference to knem_open_device


author: Jay Fenlason <fenlason@redhat.com> 3.1-3.r364.1140_open
changelog:
  - Fix the path to the udev file to close
    Resolves: rhbz1034508 - [RHEL-7.0] /dev/ipath* permissions are wrong


author: Jay Fenlason <fenlason@redhat.com> -3.2-2_ga8c3e3e_open.2
changelog:
  - Update the -build patch and this spec file so the library is built
    with the standard optimization and security flags.
    Resolves: rhbz1070814


author: Honggang Li <honli@redhat.com> - 3.3-22_g4abbc60_open.1
changelog:
  - Rebase to latest upstream release.
  - Link against system libuuid library.
  - Spec file cleanup.
  - Related: bz1272022


author: Lukas Nykryn <lnykryn@redhat.com> - 9.49.7-1
changelog:
  - readonly-root: Add /var/log/audit/audit.log to rwtab (#1026815)
  - brandot: fix posssible segfault (#1024922)


author: Václav Pavlín <vpavlin@redhat.com> - 9.49.8-1
changelog:
  - service: suggest using systemctl if unknown action is used (#1029350)
  - rename_device: remove comments and trailing whitespaces (#1027945)
  - readonly-root: restore selinux context after bind mount (#1029342)


author: Václav Pavlín <vpavlin@redhat.com> - 9.49.11-1
changelog:
  - Revert: provide KVM guest count and limit info message (#1014731)
  - add C implementation of reverted patch


author: Lukas Nykryn <lnykryn@redhat.com> - 9.49.12-1
changelog:
  - use iw instead of iwconfig and friends (#915343)
  - don't care about rc.local anymore (#1034156)
  - udev-kvm-check: simplify reading of threshold (#1031568)
  - brandbot: read only first line (#1031490)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.13-1
changelog:
  - delete IPX support
  - update ifup/ifdown NetworkManager interaction (#1036701, #1061810)
  - set shmmax and shmall defaults to match rhel6 values (#1056547)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.14-1
changelog:
  - update ifup/ifdown NetworkManager interaction (#1036701, #1061810)
  - service: fix action matching
  - service: add condrestart to allowed commands (#1069222)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.18-1
changelog:
  - is_available_wait: properly propage return value from is_available
  - man: update sys-unconfig.8
  - rename_devices: comments need to have a blank before them
  - add example ifcfg files
  - network-functions: improve bonding_masters grep
  - ifup: if we were unable to determine DEVICE always call nmcli up
  - ifup-tunnel: call ifup-ipv6 in the end
  - ifup: also set multicast_snooping after the bridge is up
  - ifup-eth: some options for bridge can be applied after the bridge is up
  - custom naming for VLAN devices
  - ifup-wireless: add support for wowlan
  - vi.po: fix parentheses
  - network-functions: ETHTOOL_DELAY introduction patch
  - ipcalc: -c allow netmask
  - ipcalc: parse prefix more safely
  - use pie and relro by default
  - sys-unconfig: use poweroff instead of halt
  - ifup-aliases: improve duplicate address detection
  - network-functions: handle BONDING_OPTS better
  - fedora-readonly: fix prefix detection (#1059749)
  - network: tell nm to wake the slaves
  - bridging: add possibility to set prio and ageing
  - network: add support for team devices
  - inittab: fix path and mention set-default
  - fedora-domainname: DefaultDependencies=no


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.25-1
changelog:
  - network: tell NM to reload its configuration during start
  - bonding: warn if the ifup for slave device failed
  - brandbot: move to /usr/libexec/initscripts
  - sysctl.conf: drop SHMALL and SHMMAX, they have sane default values in kernel
  - rename_device: allow non-channel nics for s390x machines
  - network-functions: fix check in install_bonding_driver
  - ifup-aliases: don't return with error when arping fails
  - network-functions: fix change_resolv_conf after grep update
  - clarify daemon() usage message
  - ifup: don't call NM for loopback
  - ifup: add missing quotes


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.26-1
changelog:
  - import-state: don't run restorecon when it does not exist
  - network-functions: reeplace iwconfig with iw
  - fedora-readonly: use --make-slave with --bind mounts


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.31-1
changelog:
  - ipv6: wait for all global IPv6 addresses to leave the "tentative" state
  - source_config: tell NetworkManger to load ifcfg file even for NM_CONTROLLED=no
  - ifup-aliases: inherit ARPCHECK from parent device
  - rhel-dmesg: don't start in containers
  - ifup-eth: fix typo in error message (#1038776)
  - sysctl.conf: steal comments about /usr,/etc,... from fedora's sysctl.conf
  - rwtab: /var/lib/nfs needs to copy the files
  - functions: improve killing loops
  - ipcalc: detect invalid mask
  - ifup: set valid_lft and preferred_lft to forever for static ip
  - service: use systemd mangle for given service
  - ifup-post: check resolve.conf also with DNS2
  - ifdown-post: remove resolv.conf only in specific cases
  - spec: ghost /var/log/dmesg
  - network-functions: is_available_wait should wait even in the case that is_available returns 2
  - autorelabel: turn quota off before relabeling
  - autorelabel: call dracut-initramfs-restore before forced reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.38-1
changelog:
  - ifdown-eth: we need to flush global scope as well
  - killproc/status: add missing '-b <binary>' option
  - specfile: mark 'rwtab' and 'statetab' as config files
  - spec: we need newer lvm
  - rwtab: add /var/lib/systemd/timers
  - ifup-eth: remove quote marks
  - 9.70-sync: Move everything to github
  - 9.70-sync: rwtab updated
  - 9.70-sync: service file updated
  - 9.70-sync: syconfig.txt updated
  - 9.70-sync: systemd/rhel-import-state updated
  - 9.70-sync: sysconfig/network-scripts/* updated - part 2
  - 9.70-sync: sysconfig/network-scripts/* updated - part 1
  - 9.70-sync: rc.d/init.d/network updated
  - 9.70-sync: rc.d/init.d/netconsole updated
  - 9.70-sync: rc.d/init.d/functions updated
  - 9.70-sync: ipv6-6to4.howto example updated
  - 9.70-sync: examples/networking/ifcfg-bridge updated
  - network: load NetworkManager connection via dbus
  - network: check for running NetworkManager via dbus


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.39-1
changelog:
  - sysconfig.txt: mention previously introduced NO_DHCP_HOSTNAME option
  - DHCP_FQDN and DHCP_SEND_HOSTNAME introduced
  - re-add missing $HOSTNAME initialization
  - ifup: add support for VLAN_EGRESS_PRIORITY_MAP
  - rhel-autorelabel: synchronize cached writes before reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.40-1
changelog:
  - require 'redhat-release' instead of /etc/system-release & conflict with older versions
  - ifup-post: always update 'nameserver' & 'search' entries in /etc/resolv.conf
  - systemd/system: symlinks for initscripts' services removed
  - *.old extension added to list of ignored files
  - ifup-eth: wait for STP to complete setup on bridge if $DELAY is not set
  - init.d/functions: convert2sec() function added
  - init.d/functions: is_true() & is_false() extended by ON/OFF support
  - usleep(1) calls replaced with sleep(1) calls
  - network-scripts: DBus calls forwarded to /dev/null
  - network-scripts: firewall-cmd replaced with DBus calls
  - ARPUDATE option introduced


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.41-1
changelog:
  - ifdown-post: fix logical error in commit 5d61564
  - network-functions: use POSIX forwarding instead of bash-ism


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.42-1
changelog:
  - rhel-autorelabel: set UEFI boot order (BootNext) same as BootCurrent
  - network-functions: use tr to upper case strings rather than awk
  - sysconfig/readonly-root: Clarify the usage of readonly-root
  - network-functions: add error messages for bonding installation
  - sysctl.conf.s390: drop SHMALL and SHMMAX
  - network.service: 'reload' removed
  - rhel-readonly.service: target name for random seed fixed
  - init.d/functions: fix sourcing for ksh


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.45-1
changelog:
  - network: parsing of /proc/mounts returned (bug #1572659)
  - netconsole: LSB header added (bug #1508489)
  - ifdown-eth: no longer needed 'pidof -x dhclient' condition removed (bug #1559384)


author: Jan Macku <jamacku@redhat.com> - 9.49.48-1
changelog:
  - network: don't fail with IFDOWN_ON_SHUTDOWN (bug #1693977)
  - Configure autorelabel service to output to journal and to console if set (bug #1634661)
  - Fix changelog typo


author: Jan Macku <jamacku@redhat.com> - 9.49.49-1
changelog:
  - ifup-eth: Check that device name is set (bug #1741830)
  - Add option for IPv6 GRE tunnel (bug #1691552)


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 9.49.53-2.cloudlinux.4
changelog:
  - CLKRN-796: added needed dependency for scriptlets
  - CLKRN-785: improved parsing vmcore-dmesg.txt by cloudlinux-collect-panic-info script
  - CLKRN-786: deleted all debug output to prevent crontab email notifications


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 9.49.53-2.cloudlinux.6
changelog:
  - CLKRN-901: added client_id & system_id to the sent info on our KPR by rtulchii
  - CLKRN-914: redirect error output to /dev/null by rtulchii
  - CLKRN-880: organized return codes by rtulchii


author: Parag Nemade <pnemade AT redhat DOT com>- 1.3.13-4
changelog:
  - Resolves:rh#799568 - iok crashed while selecting 'xkb-Malayalam (enhanced Inscript with Rupee Sign)'


author: Andrew Price <anprice@redhat.com> - 0.0-1.20130117git26d4e95
changelog:
  - Further improve the versioning
  - Preserve timestamp on man page
  - Remove BuildRoot, the clean and defattr sections and don't clean buildroot
  - Install to DESTDIR
  - Update Source and add a comment on how the tarball was generated
  - Use _smp_mflags in build
  - Thanks to Eduardo Echeverria for reviewing the package


author: Andrew Price <anprice@redhat.com> - 1.0-4
changelog:
  - Fix a label overflow in plot_io
    Resolves: rhbz#1004820
  - Add bounds checking in find_step
    Resolves: rhbz#1004882
  - Fix processing of trace filenames containing spaces
    Resolves: rhbz#1004865


author: Andrew Price <anprice@redhat.com> - 1.0-6
changelog:
  - Add Requires: librsvg2-tools to enable video generation
  - Merge trace dumping functions into one
  - Check program exit code properly
  - Fix up directory trace processing
    Resolves: rhbz#1004865


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-20
changelog:
  - trustdomain-find with pkey-only fails (#1068611)
  - Invalid credential cache in trust-add (#1069182)
  - ipa-replica-install prints unexpected error (#1069722)
  - Too big font in input fields in details facet in Firefox (#1069720)
  - trust-add for POSIX AD does not fetch trustdomains (#1070925)
  - Misleading trust-add error message in some cases (#1070926)
  - Access is not rejected for disabled domain (#1070924)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-22
changelog:
  - ipa-replica-install never checks for 7389 port (#1075165)
  - Non-terminated string may be passed to LDAP search (#1075091)
  - ipa-sam may fail to translate group SID into GID (#1073829)
  - Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-26
changelog:
  - When IdM server trusts multiple AD forests, IPA client returns invalid group
    membership info (#1079498)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-28
changelog:
  - ipa-client-automount fails with incompatibility error when installed against
    older IPA server (#1083108)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-28.1
changelog:
  - Server installation fails using external signed certificates with
    "IndexError: list index out of range" (#1130031)
  - Add rhino to BuildRequires to fix Web UI build error


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-4
changelog:
  - Update Requires on pki-ca to 10.1.2-4 (#1129558)
  - build: increase java stack size for all arches
  - Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
  - Fix dns zonemgr validation regression (#1056202)
  - Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
  - Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
    (#886645)
  - Add bind-dyndb-ldap working dir to IPA specfile
  - Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
    (#886645)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - Deadlock in schema compat plugin (#1161131)
  - ipactl stop should stop dirsrv last (#1161129)
  - Upgrade 3.3.5 to 4.1 failed (#1161128)
  - CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-5
changelog:
  - Update slapi-nis dependency to pull 0.54-2 (#891984)
  - ipa-restore: Don't crash if AD trust is not installed (#951581)
  - Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
  - Trust setting not restored for CA cert with ipa-restore command (#1159011)
  - ipa-server-install fails when restarting named (#1162340)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-6
changelog:
  - Fix: DNS installer adds invalid zonemgr email (#1056202)
  - ipaplatform: Use the dirsrv service, not target (#951581)
  - Fix: DNS policy upgrade raises asertion error (#1161128)
  - Fix upgrade referint plugin (#1161128)
  - Upgrade: fix trusts objectclass violationi (#1161128)
  - group-add doesn't accept gid parameter (#1149124)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-7
changelog:
  - ipa-csreplica-manage connect fails (#1157735)
  - error message which is not understandable when IDNA2003 characters are
    present in --zonemgr (#1163849)
  - Fix warning message should not contain CLI commands (#1114013)
  - Renewing the CA signing certificate does not extend its validity period end
    (#1163498)
  - RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
    httpd (#1159330)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-8
changelog:
  - Improve otptoken help messages (#919228)
  - Ensure users exist when assigning tokens to them (#919228)
  - Enable QR code display by default in otptoken-add (#919228)
  - Show warning instead of error if CA did not start (#1158410)
  - CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
  - Traceback when adding zone with long name (#1164859)
  - Backup & Restore mechanism (#951581)
  - ignoring user attributes in migrate-ds does not work if uppercase characters
    are returned by ldap (#1159816)
  - Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
  - Failure when installing on dual stacked system with external ca (#1128380)
  - ipa-server should keep backup of CS.cfg (#1059135)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - webui: use domain name instead of domain SID in idrange adder dialog
    (#891984)
  - webui: normalize idview tab labels (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-9
changelog:
  - schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
    build fails (#1167196)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - "ipa trust-add ... " cmd says : (Trust status: Established and verified)
    while in the logs we see "WERR_ACCESS_DENIED" during verification step.
    (#1144121)
  - POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
    (#1156466)
  - Add support/hooks for a one-time password system like SecureID in IPA
    (#919228)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - ID Views: Support migration from the sync solution to the trust solution
    (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-6
changelog:
  - Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
    - DNSSEC: fix forward zone forwarders checks
  - Resolves: #1250190 idrange is not added for sub domain
    - trusts: format Kerberos principal properly when fetching trust topology
  - Resolves: #1252334 User life cycle: missing ability to provision a stage user
    from a preserved user
    - Add user-stage command
  - Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
    start.
    - spec file: Add Requires(post) on selinux-policy
  - Resolves: #1254304 Changing vault encryption attributes
    - Change internal rsa_(public|private)_key variable names
    - Added support for changing vault encryption.
  - Resolves: #1256715 Executing user-del --preserve twice removes the user
    pernamently
    - improve the usability of `ipa user-del --preserve` command


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-7
changelog:
  - Resolves: #1256840 [webui] majority of required fields is no longer marked as
    required
    - fix missing information in object metadata
  - Resolves: #1256842 [webui] no option to choose trust type when creating a
    trust
    - webui: add option to establish bidirectional trust
  - Resolves: #1256853 Clear text passwords in KRA install log
    - Removed clear text passwords from KRA install log.
  - Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
    discouraged
    - vault: change default vault type to symmetric
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: prevent rename (modrdn)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-8
changelog:
  - Resolves: #1254689 Storing big file as a secret in vault raises traceback
    - vault: Limit size of data stored in vault
  - Resolves: #1255880 ipactl status should distinguish between different
    pki-tomcat services
    - ipactl: Do not start/stop/restart single service multiple times


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-9
changelog:
  - Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
    tracked
    - cert renewal: Include KRA users in Dogtag LDAP update
    - cert renewal: Automatically update KRA agent PEM file
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: remove 'rename' option
  - Resolves: #1257968 kinit stop working after ipa-restore
    - Backup: back up the hosts file
  - Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
    - DNSSEC: remove "DNSSEC is experimental" warnings
  - Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
    - Installer: do not modify /etc/hosts before user agreement
  - Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
    zone
    - DNSSEC: backup and restore opendnssec zone list file
    - DNSSEC: remove ccache and keytab of ipa-ods-exporter
    - DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
    - DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
    - DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
      key master
    - DNSSEC: Fix key metadata export
    - DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
  - Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
    - Using LDAPI to setup CA and KRA agents.
  - Resolves: #1259848 server closes connection and refuses commands after
    deleting user that is still logged in
    - ldap: Make ldap2 connection management thread-safe again
  - Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
    'ra_certprofile' while ipa-ca-install
    - load RA backend plugins during standalone CA install on CA-less IPA master


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-10
changelog:
  - Resolves: #1260663 crash of ipa-dnskeysync-replica component during
    ipa-restore
    - IPA Restore: allows to specify files that should be removed
  - Resolves: #1261806 Installing ipa-server package breaks httpd
    - Handle timeout error in ipa-httpd-kdcproxy
  - Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
    - Server Upgrade: backup CS.cfg when dogtag is turned off


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-11
changelog:
  - Resolves: #1258965 ipa vault: set owner of vault container
    - baseldap: make subtree deletion optional in LDAPDelete
    - vault: add vault container commands
    - vault: set owner to current user on container creation
    - vault: update access control
    - vault: add permissions and administrator privilege
    - install: support KRA update
  - Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
    - config: allow user/host attributes with tagging options
  - Resolves: #1262315 Unable to establish winsync replication
    - winsync: Add inetUser objectclass to the passsync sysaccount


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-12
changelog:
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
    - winsync-migrate: Convert entity names to posix friendly strings
    - winsync-migrate: Properly handle collisions in the names of external groups
  - Resolves: #1261074 Adjust Firefox configuration to new extension signing
    policy
    - webui: use manual Firefox configuration for Firefox >= 40
  - Resolves: #1263337 IPA Restore failed with installed KRA
    - ipa-backup: Add mechanism to store empty directory structure
  - Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
    and private key in world readable file [rhel-7.2]
    - install: fix KRA agent PEM file permissions
  - Resolves: #1265086 Mark IdM API Browser as experimental
    - WebUI: add API browser is experimental warning
  - Resolves: #1265277 Fix kdcproxy user creation
    - install: create kdcproxy user during server install
    - platform: add option to create home directory when adding user
    - install: fix kdcproxy user home directory
  - Resolves: #1265559 GSS failure after ipa-restore
    - destroy httpd ccache after stopping the service


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-13
changelog:
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
    - Fix an integer underflow bug in libotp
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - install: always export KRA agent PEM file
    - vault: select a server with KRA for vault operations
  - Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
    - do not overwrite files with local users/groups when restoring authconfig
  - Renamed patch 1011 to 0138, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-14
changelog:
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - upgrade: make sure ldap2 is connected in export_kra_agent_pem
  - Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
    external CA
    - schema: do not derive ipaVaultPublicKey from ipaPublicKey


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15
changelog:
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - vault: fix private service vault creation


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.5
changelog:
  - Resolves: #1298097 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
    "yum update ipa* sssd"
    - Set minimal required version for openssl


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.6
changelog:
  - Resolves: #1298103 ipa-server-upgrade fails if certmonger is not running
    - always start certmonger during IPA server configuration upgrade


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.7
changelog:
  - Resolves: #1304333 In IPA-AD trust environment some secondary IPA based Posix
    groups are missing
    - ipa-kdb: map_groups() consider all results


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.8
changelog:
  - Resolves: #1303052 install fails when locale is "fr_FR.UTF-8"
    - Do not decode HTTP reason phrase from Dogtag
  - Resolves: #1303059 --setup-dns and other options is forgotten for using an
    external PKI
    - installer: Propagate option values from components instead of copying them.
    - installer: Fix logic of reading option values from cache.
  - Resolves: #1309362 User should be notified for wrong password in password
    reset page
    - Fixed login error message box in LoginScreen page
  - Resolves: #1309382 issues with migration from RHEL 6 self-signed to RHEL 7 CA
    IPA setup
    - ipa-ca-install: print more specific errors when CA is already installed
    - cert renewal: import all external CA certs on IPA CA cert renewal
    - CA install: explicitly set dogtag_version to 10
    - fix standalone installation of externally signed CA on IPA master
    - replica install: validate DS and HTTP server certificates


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.9
changelog:
  - Resolves: #1311468 shared certificateProfiles container is missing on a
    freshly installed RHEL7.2 system
    - upgrade: unconditional import of certificate profiles into LDAP
  - Resolves: #1311470 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - upgrade: fix config of sidgen and extdom plugins
    - trusts: use ipaNTTrustPartner attribute to detect trust entries
    - Warn user if trust is broken
    - fix upgrade: wait for proper DS socket after DS restart
  - Resolves: #1311502 [RFE] compat tree: show AD members of IPA groups
    - slapi-nis: update configuration to allow external members of IPA groups


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.10
changelog:
  - Resolves: #1311470 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - Insure the admin_conn is disconnected on stop
    - Fix connections to DS during installation
  - Renamed patch 1011 to 0196, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.11
changelog:
  - Resolves: #1311470 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - Fix broken trust warnings


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.12
changelog:
  - Resolves: #1309382 issues with migration from RHEL 6 self-signed to RHEL 7 CA
    IPA setup
    - replica install: improvements in the handling of CA-related IPA config
      entries


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.13
changelog:
  - Resolves: #1324060 Installers fail when there are multiple versions of the
    same certificate
    - certdb: never use the -r option of certutil


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.15
changelog:
  - Related: #1327197 Crash during IPA upgrade due to slapd
    - spec file: update minimum required version of slapi-nis


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.16
changelog:
  - Resolves: #1337820 URI details missing and OCSP-URI details are incorrectly
    displayed when certificate generated using IPA on RHEL 7.2up2.
    - Prevent replica install from overwriting cert profiles
    - Detect and repair incorrect caIPAserviceCert config


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.17
changelog:
  - Resolves: #1339304 CA installed on replica is always marked as renewal master
    - replica install: do not set CA renewal master flag


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.18
changelog:
  - Resolves: #1350305 Multiple clients cannot join domain simultaneously:
    /var/run/httpd/ipa/clientcaches race condition?
    - mod_auth_gssapi: enable unique credential caches names
  - Related: #1347175 Multiple clients cannot join domain simultaneously:
    /var/run/httpd/ipa/clientcaches race condition?


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.19
changelog:
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.1
changelog:
  - Resolves: #1283882 IPA certificate auto renewal fail with "Invalid
    Credential"
    - cert renewal: make renewal of ipaCert atomic
  - Resolves: #1283883 ipa upgrade causes vault internal error
    - install: export KRA agent PEM file in ipa-kra-install
  - Resolves: #1283884 ipa-kra-install: fails to apply updates
    - suppress errors arising from adding existing LDAP entries during KRA
      install
  - Resolves: #1283890 installer options are not validated at the beginning of
    installation
    - install: fix command line option validation
  - Resolves: #1283915 Caching of ipaconfig does not work in framework
    - fix caching in get_ipa_config
  - Resolves: #1284025 sshd_config change on ipa-client-install can prevent sshd
    from starting up
    - client install: do not corrupt OpenSSH config with Match sections
  - Resolves: #1284052 IPA DNS Zone/DNS Forward Zone details missing after
    upgrade from RHEL 7.0 to RHEL 7.2
    - upgrade: fix migration of old dns forward zones
  - Resolves: #1284803 Default CA ACL rule is not created during
    ipa-replica-install
    - TLS and Dogtag HTTPS request logging improvements
    - Avoid race condition caused by profile delete and recreate
    - Do not erroneously reinit NSS in Dogtag interface
    - Add profiles and default CA ACL on migration
  - Resolves: #1284811 ipa-cacert-manage renew fails on nonexistent ldap
    connection
    - ipa-cacert-renew: Fix connection to ldap.
  - Resolves: #1284813 ipa-otptoken-import fails on nonexistent ldap connection
    - ipa-otptoken-import: Fix connection to ldap.


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.2
changelog:
  - Resolves: #1283890 installer options are not validated at the beginning of
    installation
    - Fix incorrectly rebased patch 0144
  - Resolves: #1284803 Default CA ACL rule is not created during
    ipa-replica-install
    - disconnect ldap2 backend after adding default CA ACL profiles
    - do not disconnect when using existing connection to check default CA ACLs


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15.3
changelog:
  - Resolves: #1284052 IPA DNS Zone/DNS Forward Zone details missing after
    upgrade from RHEL 7.0 to RHEL 7.2
    - Fix upgrade of forwardzones when zone is in realmdomains


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2.1
changelog:
  - Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
  - Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
  - Related: #1356134 'kinit -E' does not work for IPA user


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-3
changelog:
  - Resolves: #1296140 Remove redhat-access-plugin-ipa support
    - Obsolete and conflict redhat-access-plugin-ipa
  - Resolves: #1351119 Multiple issues while uninstalling ipa-server
    - server uninstall fails to remove krb principals
  - Resolves: #1351758 ipa commands not showing expected error messages
    - frontend: copy command arguments to output params on client
    - Show full error message for selinuxusermap-add-hostgroup
  - Resolves: #1352883 Traceback on adding default automember group and hostgroup
    set
    - allow 'value' output param in commands without primary key
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - schema: Fix subtopic -> topic mapping
  - Resolves: #1354348 ipa trustconfig-show throws internal error.
    - allow 'value' output param in commands without primary key
  - Resolves: #1354381 ipa trust-add with raw option gives internal error.
    - trust-add: handle `--all/--raw` options properly
  - Resolves: #1354493 Replica install fails with old IPA master
    - DNS install: Ensure that DNS servers container exists
  - Resolves: #1354628 ipa hostgroup-add-member does not return error message
    when adding itself as member
    - frontend: copy command arguments to output params on client
  - Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
    - messages: specify message type for ResultFormattingError
  - Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
    secret key
    - expose `--secret` option in radiusproxy-* commands
    - prevent search for RADIUS proxy servers by secret
  - Resolves: #1356099 Bug in the ipapwd plugin
    - Heap corruption in ipapwd plugin
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
  - Resolves: #1356964 Renaming a user removes all of his principal aliases
    - Preserve user principal aliases during rename operation


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-4
changelog:
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - harden the check for trust namespace overlap in new principals
  - Resolves: #1351142 CLI is not using session cookies for communication with
    IPA API
    - Fix session cookies
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - help: Add dnsserver commands to help topic 'dns'
  - Resolves: #1354406 host-del updatedns options complains about missing ptr
    record for host
    - Host-del: fix behavior of --updatedns and PTR records
  - Resolves: #1355718 ipa-replica-manage man page example output differs actual
    command output
    - Minor fix in ipa-replica-manage MAN page
  - Resolves: #1358229 Traceback message should be fixed, seen while editing
    winsync migrated user information in Default trust view.
    - baseldap: Fix MidairCollision instantiation during entry modification
  - Resolves: #1358849 CA replica install logs to wrong log file
    - unite log file name of ipa-ca-install
  - Resolves: #1359130 ipa-server-install command fails to install IPA server.
    - DNS Locations: fix update-system-records unpacking error
  - Resolves: #1359237 AVC on dirsrv config caused by IPA installer
    - Use copy when replacing files to keep SELinux context
  - Resolves: #1359692 ipa-client-install join fail with traceback against
    RHEL-6.8 ipa-server
    - compat: fix ping call
  - Resolves: #1359738 ipa-replica-install --domain=<IPA primary domain> option
    does not work
    - replica-install: Fix --domain
  - Resolves: #1360778 Vault commands are available in CLI even when the server
    does not support them
    - Revert "Enable vault-* commands on client"
    - client: fix hiding of commands which lack server support
  - Related: #1281704 Rebase to softhsm 2.1.0
    - Remove the workaround for softhsm bug #1293340
  - Related: #1298288 [RFE] Improve performance in large environments.
    - Create indexes for krbCanonicalName attribute


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-5
changelog:
  - Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
    - Do not initialize API in ipa-client-automount uninstall
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - idrange: fix unassigned global variable
  - Resolves: #1360792 Migrating users doesn't update krbCanonicalName
    - re-set canonical principal name on migrated users
  - Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
    and 'bool' objects
    - Fix ipa hbactest output
  - Resolves: #1362260 ipa vault-mod no longer allows defining salt
    - vault: add missing salt option to vault_mod
  - Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
    public key
    - vault: Catch correct exception in decrypt
  - Resolves: #1362537 ipa-server-install fails to create symlink from
    /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
    - Correct path to HTTPD's systemd service directory
  - Resolves: #1363756 Increase length of passwords generated by installer
    - Increase default length of auto generated passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-6
changelog:
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
    - Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
  - Resolves: #1341249 Subsequent external CA installation fails
    - install: fix external CA cert validation
  - Resolves: #1353831 ipa-server-install fails in container because of
    hostnamectl set-hostname
    - server-install: Fix --hostname option to always override api.env values
    - install: Call hostnamectl set-hostname only if --hostname option is used
  - Resolves: #1356091 ipa-cacert-manage --help and man differ
    - Improvements for the ipa-cacert-manage man and help
  - Resolves: #1360631 ipa-backup is not keeping the
    /etc/tmpfiles.d/dirsrv-<instance>.conf
    - ipa-backup: backup /etc/tmpfiles.d/dirsrv-<instance>.conf
  - Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
    file is needed
    - Update ipa-replica-install documentation
  - Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
    not rpm-require it
    - client: RPM require initscripts to get *-domainname.service
  - Resolves: #1364197 caacl: error when instantiating rules with service
    principals
    - caacl: fix regression in rule instantiation
  - Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
    - parameters: move the `confirm` kwarg to Param
  - Resolves: #1364464 Topology graph: ca and domain adders shows question marks
    instead of plus icon
    - Fix unicode characters in ca and domain adders
  - Resolves: #1365083 Incomplete output returned for command ipa vault-add
    - client: add missing output params to client-side commands
  - Resolves: #1365526 build fails during "make check"
    - ipa-kdb: Fix unit test after packaging changes in krb5


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-7
changelog:
  - Resolves: #1361119 UPN-based search for AD users does not match an entry in
    slapi-nis map cache
    - support multiple uid values in schema compatibility tree


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-8
changelog:
  - Resolves: #1298288 [RFE] Improve performance in large environments.
    - cert: speed up cert-find
  - Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
    authentication
    - service: add flag to allow S4U2Self
    - Add 'trusted to auth as user' checkbox
    - Added new authentication method
  - Resolves: #1353881 ipa-replica-install suggests about
    non-existent --force-ntpd option
    - Don't show --force-ntpd option in replica install
  - Resolves: #1354441 DNS forwarder check is too strict: unable to add
    sub-domain to already-broken domain
    - DNS: allow to add forward zone to already broken sub-domain
  - Resolves: #1356146 performance regression in CLI help
    - schema: Speed up schema cache
    - frontend: Change doc, summary, topic and NO_CLI to class properties
    - schema: Introduce schema cache format
    - schema: Generate bits for help load them on request
    - help: Do not create instances to get information about commands and topics
    - schema cache: Do not reset ServerInfo dirty flag
    - schema cache: Do not read fingerprint and format from cache
    - Access data for help separately
    - frontent: Add summary class property to CommandOverride
    - schema cache: Read server info only once
    - schema cache: Store API schema cache in memory
    - client: Do not create instance just to check isinstance
    - schema cache: Read schema instead of rewriting it when SchemaUpToDate
  - Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
    - server install: do not prompt for cert file PIN repeatedly
  - Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
    cache directory: [Errno 13] Permission denied: '/home/test_user'
    - schema: Speed up schema cache
  - Resolves: #1366604 `cert-find` crashes on invalid certificate data
    - cert: do not crash on invalid data in cert-find
  - Resolves: #1366612 Middle replica uninstallation in line topology works
    without '--ignore-topology-disconnect'
    - Fail on topology disconnect/last role removal
  - Resolves: #1366626 caacl-add-service: incorrect error message when service
    does not exists
    - Fix ipa-caalc-add-service error message
  - Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
    does not happen to run during dnf upgrade
    - DNS server upgrade: do not fail when DNS server did not respond
  - Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
    with CA
    - Add warning about only one existing CA server
    - Set servers list as default facet in topology facet group
  - Resolves: #1367773 thin client ignores locale change
    - schema check: Check current client language against cached one


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-9
changelog:
  - Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
    - Fix ipa-server-install in pure IPv6 environment
  - Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
    reachable via the forest root
    - trust: make sure ID range is created for the child domain even if it exists
    - ipa-kdb: simplify trusted domain parent search
  - Resolves: #1335567 Update Warning in IdM Web UI API browser
    - WebUI: add API browser is tech preview warning
  - Resolves: #1348560 Mulitple domain Active Directory Trust conflict
    - ipaserver/dcerpc: reformat to make the code closer to pep8
    - trust: automatically resolve DNS trust conflicts for triangle trusts
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)
  - Resolves: #1353936 custodia.conf and server.keys file is world-readable.
    - Remove Custodia server keys from LDAP
    - Secure permissions of Custodia server.keys
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
    - custodia: include known CA certs in the PKCS#12 file for Dogtag
    - custodia: force reconnect before retrieving CA certs from LDAP
  - Resolves: #1362333 ipa vault container owner cannot add vault
    - Fix: container owner should be able to add vault
  - Resolves: #1365546 External trust with root domain is transitive
    - trust: make sure external trust topology is correctly rendered
  - Resolves: #1365572 IPA server broken after upgrade
    - Require pki-core-10.3.3-7
  - Resolves: #1367864 Server assumes latest version of command instead of
    version 1 for old / 3rd party clients
    - rpcserver: assume version 1 for unversioned command calls
    - rpcserver: fix crash in XML-RPC system commands
  - Resolves: #1367773 thin client ignores locale change
    - schema cache: Fallback to 'en_us' when locale is not available
  - Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
    - Fail on topology disconnect/last role removal
  - Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
    - otptoken, permission: Convert custom type parameters on server
  - Resolves: #1369414 ipa server-del fails with Python stack trace
    - Handled empty hostname in server-del command
  - Resolves: #1369761 ipa-server must depend on a version of httpd that support
    mod_proxy with UDS
    - Require httpd 2.4.6-31 with mod_proxy Unix socket support
  - Resolves: #1370512 Received ACIError instead of DuplicatedError in
    stageuser_tests
    - Raise DuplicatedEnrty error when user exists in delete_container
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add missing param values to cert-find output
  - Renamed patch 1011 to 0100, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-10
changelog:
  - Resolves: #1355753 adding two way non transitive(external) trust displays
    internal error on the console
    - Always fetch forest info from root DCs when establishing two-way trust
    - factor out `populate_remote_domain` method into module-level function
    - Always fetch forest info from root DCs when establishing one-way trust
  - Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
    after `ipa-replica-install`
    - Track lightweight CAs on replica installation
  - Resolves: #1357488 ipa command stuck forever on higher versioned client with
    lower versioned server
    - compat: Save server's API version in for pre-schema servers
    - compat: Fix ping command call
    - schema cache: Store and check info for pre-schema servers
  - Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
    - Fix man page ipa-replica-manage: remove duplicate -c option
      from --no-lookup
  - Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
    when revoking certificate
    - cert: include CA name in cert command output
    - WebUI add support for sub-CAs while revoking certificates
  - Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
    - Add support for additional options taken from table facet
    - WebUI: Fix showing certificates issued by sub-CA
  - Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
    internactively
    - dns: normalize record type read interactively in dnsrecord_add
    - dns: prompt for missing record parts in CLI
    - dns: fix crash in interactive mode against old servers
  - Resolves: #1370519 Certificate revocation in service-del and host-del isn't
    aware of Sub CAs
    - cert: fix cert-find --certificate when the cert is not in LDAP
    - Make host/service cert revocation aware of lightweight CAs
  - Resolves: #1371901 Use OAEP padding with custodia
    - Use RSA-OAEP instead of RSA PKCS#1 v1.5
  - Resolves: #1371915 When establishing external two-way trust, forest root
    Administrator account is used to fetch domain info
    - do not use trusted forest name to construct domain admin principal
  - Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
    certificate request
    - Fix CA ACL Check on SubjectAltNames
  - Resolves: #1373272 CLI always sends default command version
    - cli: use full name when executing a command
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix ipa-certupdate for CA-less installation
  - Resolves: #1373540 client-install with IPv6 address fails on link-local
    address (always)
    - Fix parse errors with link-local addresses


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-11
changelog:
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix regression introduced in ipa-certupdate


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-12
changelog:
  - Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
  - Resolves: #1375269 ipa trust-fetch-domains throws internal error


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-13
changelog:
  - Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
    - Keep NSS trust flags of existing certificates
  - Resolves: #1360813 ipa-server-certinstall does not update all certificate
    stores and doesn't set proper trust permissions
    - Add cert checks in ipa-server-certinstall
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add revocation reason back to cert-find output
  - Resolves: #1375133 WinSync users who have First.Last casing creates users who
    can have their password set
    - ipa passwd: use correct normalizer for user principals
  - Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
    - Properly handle LDAP socket closures in ipa-otpd
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Make httpd publish its CA certificate on DL1


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14
changelog:
  - Resolves: #1378353 Replica install fails with old IPA master sometimes during
    replication process
    - spec file: bump minimal required version of 389-ds-base
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Fix missing file that fails DL1 replica installation
  - Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
    - WebUI: services without canonical name are shown correctly
  - Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
    - trustdomain-del: fix the way how subdomain is searched


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - password policy: Add explicit default password policy for hosts and
      services
  - Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
    certprofile-mod
    - certprofile-mod: correctly authorise config update


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - ipa-kdb: search for password policies globally
  - Renamed patches 1011 and 1012 to 0146 and 0145, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.2
changelog:
  - Resolves: #1401953 ipa-ca-install on promoted replica hangs on creating a
    temporary CA admin
    - replication: ensure bind DN group check interval is set on replica config
    - add missing attribute to ipaca replica during CA topology update
  - Resolves: #1404169 IPA upgrade of replica without DNS fails during restart of
    named-pkcs11
    - bindinstance: use data in named.conf to determine configuration status
  - Resolves: #1404171 Creation of replica for disconnected environment is
    failing with CA issuance errors; Need good steps.
    - gracefully handle setting replica bind dn group on old masters


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.3
changelog:
  - Resolves: #1404338 Check IdM Topology for broken record caused by replication
    conflict before upgrading it
    - Check for conflict entries before raising domain level


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.4
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - ipa-kdb: search for password policies globally
  - Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.5
changelog:
  - Resolves: #1410760 ipa-ca-install fails on replica when IPA Master is
    installed without CA
    - Set up DS TLS on replica in CA-less topology
  - Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
    ca-del, ca-disable and ca-enable commands
    - ca: correctly authorise ca-del, ca-enable and ca-disable
  - Resolves: #1416481 IPA replica install fails with dirsrv errors.
    - Do not configure PKI ajp redirection to use "::1"


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.6
changelog:
  - Resolves: #1416488 replication race condition prevents IPA to install
    - wait_for_entry: use only DN as parameter
    - Wait until HTTPS principal entry is replicated to replica
    - Use proper logging for error messages


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.7
changelog:
  - Resolves: #1429872 ipa-replica-install fails promotecustodia.create_replica
    with cert errors (untrusted)
    - added ssl verification using IPA trust anchor
  - Resolves: #1430674 batch param compatibility is incorrect
    - compat: fix `Any` params in `batch` and `dnsrecord`
  - Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-12.el7
changelog:
  - Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
    - python2-ipalib: add missing python dependency
    - installer service: fix typo in service entry
    - upgrade: add missing suffix to http instance
  - Resolves: #1444791 Update man page of ipa-kra-install 
    - ipa-kra-install manpage: document domain-level 1
  - Resolves: #1441493 ipa cert-show raises stack traces when
    --certificate-out=/tmp 
    - cert-show: writable files does not mean dirs 
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - Bump version of ipa.conf file
  - Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
    - Turn on NSSOCSP check in mod_nss conf
  - Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
    template on
    - renew agent: respect CA renewal master setting
    - server upgrade: always fix certmonger tracking request
    - cainstance: use correct profile for lightweight CA certificates
    - renew agent: allow reusing existing certs
    - renew agent: always export CSR on IPA CA certificate renewal
    - renew agent: get rid of virtual profiles
    - ipa-cacert-manage: add --external-ca-type
  - Resolves: #1441593 error adding authenticator indicators to host 
    - Fixing adding authenticator indicators to host
  - Resolves: #1449525 Set directory ownership in spec file 
    - Added plugins directory to ipaclient subpackages
    - ipaclient: fix missing RPM ownership
  - Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
    - otptoken-add-yubikey: When --digits not provided use default value


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-13.el7
changelog:
  - Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
    error observed during ipa upgrade with latest package. 
    - ipa-server-install: fix uninstall
  - Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
    replica 
    - ca install: merge duplicated code for DM password
    - installutils: add DM password validator
    - ca, kra install: validate DM password


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-14.el7
changelog:
  - Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to 
    handle PKINIT certificates/anchors
    - certdb: add named trust flag constants
    - certdb, certs: make trust flags argument mandatory
    - certdb: use custom object for trust flags
    - install: trust IPA CA for PKINIT
    - client install: fix client PKINIT configuration
    - install: introduce generic Kerberos Augeas lens
    - server install: fix KDC PKINIT configuration
    - ipapython.ipautil.run: Add option to set umask before executing command
    - certs: do not export keys world-readable in install_key_from_p12
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
    - replica install: respect --pkinit-cert-file
    - cacert manage: support PKINIT
    - server certinstall: support PKINIT
  - Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
    option
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
  - Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
    decommissioned
    - ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname 
  - Resolves: #1451712 KRA installation fails on server that was originally
    installed as CA-less
    - ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
  - Resolves: #1441499 ipa cert-show does not raise error if no file name
    specified
    - ca/cert-show: check certificate_out in options
  - Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
    - Remove pkinit-anonymous command
  - Resolves: #1449523 Provide an API command to retrieve PKINIT status
    in the FreeIPA topology
    - Allow for multivalued server attributes
    - Refactor the role/attribute member reporting code
    - Add an attribute reporting client PKINIT-capable servers
    - Add the list of PKINIT servers as a virtual attribute to global config
    - Add `pkinit-status` command
    - test_serverroles: Get rid of MockLDAP and use ldap2 instead
  - Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
    - Fix rare race condition with missing ccache file
  - Resolves: #1455045 Simple service uninstallers must be able to handle
    missing service files gracefully
    - only stop/disable simple service if it is installed
  - Resolves: #1455541 after upgrade login from web ui breaks
    - krb5: make sure KDC certificate is readable
  - Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
    command "ipa cert-request --add" after upgrade
    - Change python-cryptography to python2-cryptography


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-15.el7
changelog:
  - Resolves: #1442233 IPA client commands fail when pointing to replica 
    - httpinstance: wait until the service entry is replicated
  - Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
    not indexed
    - Fix index definition for ipaAnchorUUID
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Avoid possible endless recursion in RPC call
    - rpc: preparations for recursion fix
    - rpc: avoid possible recursion in create_connection
  - Resolves: #1446087 services entries missing krbCanonicalName attribute.
    - Changing cert-find to do not use only primary key to search in LDAP.
  - Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
    - ipa-kdb: reload certificate mapping rules periodically
  - Resolves: #1455541 after upgrade login from web ui breaks
    - kdc.key should not be visible to all 
  - Resolves: #1435606 Add pkinit_indicator option to KDC configuration
    - ipa-kdb: add pkinit authentication indicator in case of a successful
      certauth
  - Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
    issuance when ipa-ca records are not resolvable
    - Turn off OCSP check
  - Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
    server_del - TypeError: 'NoneType' object is not iterable
    - fix incorrect suffix handling in topology checks


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-16.el7
changelog:
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Only warn when specified server IP addresses don't match intf
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Bump version of python-gssapi
  - Resolves: #1457942 certauth: use canonical principal for lookups
    - ipa-kdb: use canonical principal in certauth plugin
  - Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
    breaking older clients
    - Add code to be able to set default kinit lifetime
    - Revert setting sessionMaxAge for old clients


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-17.el7
changelog:
  - Resolve: #1455946 Provide a tooling automating the configuration 
    of Smart Card authentication on a FreeIPA master
    - server certinstall: update KDC master entry
    - pkinit manage: introduce ipa-pkinit-manage
    - server upgrade: do not enable PKINIT by default
    - Extend the advice printing code by some useful abstractions
    - Prepare advise plugin for smart card auth configuration
  - Resolve: #1461053 allow to modify list of UPNs of a trusted forest
    - trust-mod: allow modifying list of UPNs of a trusted forest
    - WebUI: add support for changing trust UPN suffixes


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-18.el7
changelog:
  - Resolves: #1449189 ipa-kra-install timeouts on replica
    - kra: promote: Get ticket before calling custodia


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash() 
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces 
    - Fix local IP address validation 
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1470125 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469978 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 4.5.0-21.el7.cloudlinux
changelog:
  - Remove freeipa-3.3.3-cloudlinux-branding.patch
  - Add cloudlinux to ipaplatform
  - Replaced an images for rebrandig to cloudlinux


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1
changelog:
  - Resolves: #1473272 Provide a tooling automating the configuration
    of Smart Card authentication on a FreeIPA master
    - smart-card advises: configure systemwide NSS DB also on master
    - smart-card advises: add steps to store smart card signing CA cert
    - Allow to pass in multiple CA cert paths to the smart card advises
    - add a class that tracks the indentation in the generated advises
    - delegate the indentation handling in advises to dedicated class
    - advise: add an infrastructure for formatting Bash compound statements
    - delegate formatting of compound Bash statements to dedicated classes
    - Fix indentation of statements in Smart card advises
    - Use the compound statement formatting API for configuring PKINIT
    - smart card advises: use a wrapper around Bash `for` loops
    - smart card advise: use password when changing trust flags on HTTP cert
    - smart-card-advises: ensure that krb5-pkinit is installed on client
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile 
    (new installs only)
    - Add CommonNameToSANDefault to default cert profile
  - Resolves: #1475664 NULL LDAP context in call to ldap_search_ext_s
    during search in cn=ad,cn=trusts,dc=example,dc=com
    - NULL LDAP context in call to ldap_search_ext_s during search


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.1
changelog:
  - Resolves: #1477046 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Restore old version of caIPAserviceCert for upgrade only


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2
changelog:
  - Resolves: #1486794 - [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic
    key for host
      - Always check peer has keys before connecting
  - Resolves: #1489300 - Unable to set ca renewal master on replica
      - Fix ipa config-mod --ca-renewal-master
  - Resolves: #1489815 - TypeError in renew_ca_cert prevents from swiching
    back to self-signed CA
      - Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
  - Resolves: #1489817 - ipa-server-upgrade failes with "This entry already exists"
      - Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
  - Resolves: #1490331 - FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
      - Adds whoami DS plugin in case that plugin is missing
  - Resolves: #1491545 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
      - Fixing how sssd.conf is updated when promoting a client to replica
  - Resolves: #1492616 - ipa-otptoken-import - XML file is missing PBKDF2
    parameters!
      - ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
  - Resolves: #1493153 - Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
      - Backport 4-5: Fix ipa-server-upgrade with server cert tracking


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2.2
changelog:
  - Resolves: #1493410 ipa-server-upgrade timeouts on wait_for_open ports
    expecting IPA services listening on IPv6 ports
      - Make sure upgrade also checks for IPv6 stack
      - control logging of host_port_open from caller
      - log progress of wait_for_open_ports
  - Resolves: #1493411 ipa help command returns traceback when no cache
    is present
      - Store help in Schema before writing to disk
      - Disable pylint in get_help function because of type confusion.


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-22.el7
changelog:
  - Resolves: #1506528 In case full PKINIT configuration is failing during
    server/replica install the error message should be more meaningful.
      - Less confusing message for PKINIT configuration during install
  - Resolves: #1506526 Use X509v3 Basic Constraints "CA:TRUE" instead of
    "CA:FALSE" IPA CA CSR
      - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1506913 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
      - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1506525 server-del doesn't remove dns-server configuration
    from ldap
      - server.py: Removes dns-server configuration from ldap


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.7
changelog:
  - Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
    with cert errors (untrusted)
    - added ssl verification using IPA trust anchor
  - Resolves: #1428472 batch param compatibility is incorrect
    - compat: fix `Any` params in `batch` and `dnsrecord`
  - Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-1.el7
changelog:
  - Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
  - Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
    hostname
  - Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
    attribute
  - Resolves: #1321652 ipa-server-install fails when using external certificates
    that encapsulate RDN components in double quotes
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1340880 ipa-server-install: improve prompt on interactive
    installation
  - Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
    incomplete entries
  - Resolves: #1356104 cert-show command does not display Subject Alternative
    Names
  - Resolves: #1357511 Traceback message seen when ipa is provided with invalid
    configuration file name
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
  - Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
    config-mod --enable-migration=TRUE
  - Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
  - Resolves: #1371927 Implement ca-enable/disable commands.
  - Resolves: #1372202 Add Users into User Group editors fails to show Full names
  - Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
    check box in the UI
  - Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
    message
  - Resolves: #1375905 "Normal" group type in the UI is confusing
  - Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
  - Resolves: #1376630 IDM admin password gets written to
    /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
  - Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
    match other options
  - Resolves: #1378461 IPA Allows Password Reuse with History value defined when
    admin resets the password.
  - Resolves: #1379029 conncheck failing intermittently during single step
    replica installs
  - Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
  - Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
  - Resolves: #1392778 Update man page for ipa-adtrust-install by
    removing --no-msdcs option
  - Resolves: #1392858 Rebase to FreeIPA 4.5+
    - Rebase to 4.5.0
  - Resolves: #1399133 Delete option shouldn't be available for hosts applied to
    view.
  - Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
    should contain full trust chain
  - Resolves: #1400416 RFE: Provide option to take backup of IPA server before
    uninstalling IPA server
  - Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
  - Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
    not on details page
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
  - Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
    non-FQDN name of IPA server is first in /etc/hosts
  - Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
    nsupdate
  - Resolves: #1413742 Backport request for bug/issue Change IP address
    validation errors to warnings
  - Resolves: #1415652 IPA replica install log shows password in plain text
  - Resolves: #1427897 different behavior regarding system wide certs in master
    and replica.
  - Resolves: #1430314 The ipa-managed-entries command failed, exception:
    AttributeError: ldap2


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-2.el7
changelog:
  - Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
    - Remove csrgen
  - Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
    - Add options to allow ticket caching


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-3.el7
changelog:
  - Resolves: #800545 [RFE] Support SUDO command rename
    - Reworked the renaming mechanism
    - Allow renaming of the sudorule objects
  - Resolves: #872671 IPA WebUI login for AD Trusted User fails
    - WebUI: check principals in lowercase
    - WebUI: add method for disabling item in user dropdown menu
    - WebUI: Add support for login for AD users
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
    - IPA certauth plugin
    - ipa-kdb: do not depend on certauth_plugin.h
    - spec file: bump krb5-devel BuildRequires for certauth
  - Resolves: #1264370 RFE: disable last successful authentication by default in
    ipa.
    - Set "KDC:Disable Last Success" by default
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
    - configure: fix --disable-server with certauth plugin
    - rpcserver.login_x509: Actually return reply from __call__ method
    - spec file: Bump requires to make Certificate Login in WebUI work
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - extdom: do reverse search for domain separator
    - extdom: improve cert request
  - Resolves: #1430363 [RFE] HBAC rule names command rename
    - Reworked the renaming mechanism
    - Allow renaming of the HBAC rule objects
  - Resolves: #1433082 systemctl daemon-reload needs to be called after
    httpd.service.d/ipa.conf is manipulated
    - tasks: run `systemctl daemon-reload` after httpd.service.d updates
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Use Custodia 0.3.1 features
  - Resolves: #1434384 RPC client should use HTTP persistent connection
    - Use connection keep-alive
    - Add debug logging for keep-alive
    - Increase Apache HTTPD's default keep alive timeout
  - Resolves: #1434729 man ipa-cacert-manage install needs clarification
    - man ipa-cacert-manage install needs clarification
  - Resolves: #1434910 replica install against IPA v3 master fails with ACIError
    - Fixing replica install: fix ldap connection in domlvl 0
  - Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
    used during typing Directory Manager password
    - ipapython.ipautil.nolog_replace: Do not replace empty value
  - Resolves: #1435397 ipa-replica-install can't install replica file produced by
    ipa-replica-prepare on 4.5
    - replica prepare: fix wrong IPA CA nickname in replica file
  - Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
    KRA is not installed
    - WebUI: Fix showing vault in selfservice view
  - Resolves: #1435718 As a ID user I cannot call a command with --rights option
    - ldap2: use LDAP whoami operation to retrieve bind DN for current connection
  - Resolves: #1436319 "Truncated search results" pop-up appears in user details
    in WebUI
    - WebUI: Add support for suppressing warnings
    - WebUI: suppress truncation warning in select widget
  - Resolves: #1436333 Uninstall fails with No such file or directory:
    '/var/run/ipa/services.list'
    - Create temporaty directories at the begining of uninstall
  - Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
    fails
    - WebUI: Allow to add certs to certmapping with CERT LINES around
  - Resolves: #1436338 CLI doesn't work after ipa-restore
    - Backup ipa-specific httpd unit-file
    - Backup CA cert from kerberos folder
  - Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
    separation
    - Bump samba version for FIPS and priv. separation
  - Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
    ipa vault commands
    - Avoid growing FILE ccaches unnecessarily
    - Handle failed authentication via cookie
    - Work around issues fetching session data
    - Prevent churn on ccaches
  - Resolves: #1436657 Add workaround for pki_pin for FIPS
    - Generate PIN for PKI to help Dogtag in FIPS
  - Resolves: #1436714 [vault] cache KRA transport cert
    - Simplify KRA transport cert cache
  - Resolves: #1436723 cert-find does not find all certificates without
    sizelimit=0
    - cert: do not limit internal searches in cert-find
  - Resolves: #1436724 Renewal of IPA RA fails on replica
    - dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
  - Resolves: #1436753 Master tree fails to install
    - httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
      available


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-4.el7
changelog:
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Require correct custodia version


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-5.el7
changelog:
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1393726 Enumerate all available request type options in ipa
    cert-request help
    - Hide request_type doc string in cert-request help
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - spec file: bump libsss_nss_idmap-devel BuildRequires
    - server: make sure we test for sss_nss_getlistbycert
  - Resolves: #1437378 ipa-adtrust-install produced an error and failed on
    starting smb when hostname is not FQDN
    - adtrust: make sure that runtime hostname result is consistent with the
      configuration
  - Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
    keytab
    - Always check and create anonymous principal during KDC install
    - Remove duplicate functionality in upgrade
  - Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
    principal for PKINIT
    - Upgrade: configure PKINIT after adding anonymous principal
    - Remove unused variable from failed anonymous PKINIT handling
    - Split out anonymous PKINIT test to a separate method
    - Ensure KDC is propery configured after upgrade
  - Resolves: #1437951 Remove pkinit-related options from server/replica-install
    on DL0
    - Fix the order of cert-files check
    - Don't allow setting pkinit-related options on DL0
    - replica-prepare man: remove pkinit option refs
    - Remove redundant option check for cert files
  - Resolves: #1438490 CA-less installation fails on publishing CA certificate
    - Get correct CA cert nickname in CA-less
    - Remove publish_ca_cert() method from NSSDatabase
  - Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
    - IPA-KDB: use relative path in ipa-certmap config snippet
  - Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
    - Allow erasing ipaDomainResolutionOrder attribute


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-6.el7
changelog:
  - Resolves: #1382053 Need to have validation for idrange names
    - idrange-add: properly handle empty --dom-name option
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - dsinstance: reconnect ldap2 after DS is restarted by certmonger
    - httpinstance: avoid httpd restart during certificate request
    - dsinstance, httpinstance: consolidate certificate request code
    - install: request service certs after host keytab is set up
    - renew agent: revert to host keytab authentication
    - renew agent, restart scripts: connect to LDAP after kinit
  - Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
    domain entry
    - ipa-sam: create the gidNumber attribute in the trusted domain entry
    - Upgrade: add gidnumber to trusted domain entry
  - Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
    Incorrect client security database password
    - Add pki_pin only when needed
  - Resolves: #1438348 Console output message while adding trust should be
    mapped with texts changed in Samba.
    - ipaserver/dcerpc: unify error processing
  - Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
    'Credentials': Missing credentials for cross-forest communication
    - trust: always use oddjobd helper for fetching trust information
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - WebUI: cert login: Configure name of parameter used to pass username
  - Resolves: #1437879 [copr] Replica install failing
    - Create system users for FreeIPA services during package installation
  - Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
    - Fix s4u2self with adtrust


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-7.el7
changelog:
  - Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
    WebUI is slow to display user details page
    - cert: defer cert-find result post-processing
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - server-install: No double Kerberos install
  - Resolves: #1437502 ipa-replica-install fails with requirement to
    use --force-join that is a client install option.
    - Add the force-join option to replica install
    - replicainstall: better client install exception handling
  - Resolves: #1437953 Server CA-less impossible option check
    - server-install: remove broken no-pkinit check
  - Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
    - Add debug log in case cookie retrieval went wrong
  - Resolves: #1441548 ipa server install fails with --external-ca option
    - ext. CA: correctly write the cert chain
  - Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
    spawn
    - Fix CA-less to CA-full upgrade
  - Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
    libsss_nss_idmap to every binary in IPA
    - configure: fix AC_CHECK_LIB usage
  - Resolves: #1442815 Replica install fails during migration from older IPA
    master
    - Fix RA cert import during DL0 replication
  - Related: #1442004 Building IdM/FreeIPA internally on all architectures -
    filtering unsupported packages
    - Build all subpackages on all architectures


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-8.el7
changelog:
  - Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
    - Fix CAInstance.import_ra_cert for empty passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-9.el7
changelog:
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - spec file: bump krb5 Requires for certauth fixes
  - Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
    is used
    - separate function to set ipaConfigString values on service entry
    - Allow for configuration of all three PKINIT variants when deploying KDC
    - API for retrieval of master's PKINIT status and publishing it in LDAP
    - Use only anonymous PKINIT to fetch armor ccache
    - Stop requesting anonymous keytab and purge all references of it
    - Use local anchor when armoring password requests
    - Upgrade: configure local/full PKINIT depending on the master status
    - Do not test anonymous PKINIT after install/upgrade
  - Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
    update_tdo_gidnumber: ERROR Default SMB Group not found
    - upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
      installed
  - Resolves: #1442932 ipa restore fails to restore IPA user
    - restore: restart/reload gssproxy after restore
  - Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
    - Fix CA/server cert validation in FIPS
  - Resolves: #1444947 Deadlock between topology and schema-compat plugins
    - compat-manage: behave the same for all users
    - Move the compat plugin setup at the end of install
    - compat: ignore cn=topology,cn=ipa,cn=etc subtree
  - Resolves: #1445358 ipa vault-add raises TypeError
    - vault: piped input for ipa vault-add fails
  - Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
    - Vault: Explicitly default to 3DES CBC
  - Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
    - automount install: fix checking of SSSD functionality on uninstall
  - Resolves: #1446137 pki_client_database_password is shown in
    ipaserver-install.log
    - Hide PKI Client database password in log file


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-1.el7
changelog:
  - Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
    buildroot
  - Resolves: #1470177 - Rebase IPA to latest 4.5.x version
  - Resolves: #1398594 ipa topologysuffix-verify should only warn about 
    maximum number of replication agreements. 
  - Resolves: #1404236 Web UI: Change "Host Based" and "Role Based" 
    to "Host-Based" and "Role-Based" 
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install
    setup fails when dirsrv is not running
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr 
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI 
    accepts negative values
  - Resolves: #1458169 --force-join option is not mentioned in 
    ipa-replica-install man page 
  - Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case 
  - Resolves: #1478322 user-show command fails when sizelimit is configured 
    to number <= number of entity which is user member of 
  - Resolves: #1496775 Enterprise principals should be able to trigger
    a refresh of the trusted domain data in the KDC
  - Resolves: #1502533 Changing cert-find to go through the proxy 
    instead of using the port 8080
  - Resolves: #1502663 pkinit-status command fails after an upgrade from
    a pre-4.5 IPA
  - Resolves: #1498168 Error when trying to modify a PTR record
  - Resolves: #1457876 ipa-backup fails silently
  - Resolves: #1493531 In case full PKINIT configuration is failing during 
    server/replica install the error message should be more meaningful.
  - Resolves: #1449985 Suggest CA installation command in KRA installation
    warning


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.4-2.el7
changelog:
  - Resolves: #1461177 ipa-otptoken-import  - XML file is missing PBKDF2
    parameters!
  - Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
    search in cn=ad, cn=trusts,dc=example,dc=com
  - Resolves: #1467887 iommu platform support for ipxe
  - Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic key for
    host
  - Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
    4.5
  - Resolves: #1480102 ipa-server-upgrade failes with "This entry already
    exists"
  - Resolves: #1482802 Unable to set ca renewal master on replica
  - Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
  - Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
  - Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
    to self-signed CA
  - Resolves: #1469246 Replica install fails to configure IPA-specific
    temporary files/directories
  - Resolves: #1469480 bind package is not automatically updated during
    ipa-server upgrade process
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
    installs only)
  - Resolves: #1477703 IPA upgrade fails for latest ipa package


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-3.el7
changelog:
  - Drop workaround for building on AArch64 (#1482244)
  - Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-4.el7
changelog:
  - Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
    - ldap: limit the retro changelog to dns subtree
  - Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
    of "CA:FALSE" IPA CA CSR
    - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1493145 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
    - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
    - ds: ignore time skew during initial replication step
    - ipa-replica-manage: implicitly ignore initial time skew in force-sync 
  - Resolves: #1500218 Replica installation at domain-level 0 fails against
    upgraded ipa-server
    - Fix ipa-replica-conncheck when called with --principal
  - Resolves: #1506188 server-del doesn't remove dns-server configuration
    from ldap


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.5.4-5.el7
changelog:
  - Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
  - Resolves: #1378892 host-find slowness caused by missing host attributes in index


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-7.el7
changelog:
  - Resolves: #1421869 Unable to re-add broken AD trust - Unexpected Information received
    - adtrust: filter out subdomains when defining our topology to AD
  - Resolves: #1486286 IPA failing to authenticate via password+OTP on RHEL7.4 with fips enabled
    - Don't allow OTP or RADIUS in FIPS mode
  - Resolves: #1494226 IPA User Details not being displayed in WebUI
    - Fix cert-find for CA-less installations
  - Resolves: #1498387 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
    - 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
  - Resolves: #1503022 ipa-getkeytab man page should have more details about consequences of krb5 key renewal
    - ipa-getkeytab man page: add more details about the -r option
  - Resolves: #1509288 IPA trust-add internal error (expected security.dom_sid got None)
    - ipaserver/plugins/trust.py; fix some indenting issues
    - trust: detect and error out when non-AD trust with IPA domain name exists
    - ipaserver/plugins/trust.py: pep8 compliance
  - Resolves: #1511019 ipa-restore broken with python2
    - Fix ipa-restore (python2)
  - Resolves: #1511607 ipa-backup does not backup Custodia keys and files
    - Backup ipa-custodia conf and keys
  - Resolves: #1512482 kra install fails after ipa cert renewed
    - Don't use admin cert during KRA installation
    - Prevent set_directive from clobbering other keys
    - pep8: reduce line lengths in CAInstance.__enable_crl_publish
    - installutils: refactor set_directive
    - Add tests for installutils.set_directive
    - Add safe DirectiveSetter context manager
    - Old pylint doesn't support bad python3 option
  - Resolves: #1514163 CA less IPA install with external certificates fails on RHEL 7 in FIPS mode
    - Fix ca less IPA install on fips mode


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-8.el7
changelog:
  - Resolves: #1477531 Incorrect attribute level rights (ipaallowedtoperform) of service object
    - WebUI: make keytab tables on service and host pages writable
  - Resolves: #1529444 ObjectclassViolation seen while adding idview with domain-resolution-order option
    - Idviews: fix objectclass violation on idview-add
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr
    - Fixing the cert-request comparing whole email address case-sensitively.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-9.el7
changelog:
  - Resolves: #1458169 --force-join option is not mentioned in ipa-replica-install man page
    - Add --force-join into ipa-replica-install manpage
  - Resolves: #1457876 ipa-backup fails silently
    - Changed ownership of ldiffile to DS_USER
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install setup fails when dirsrv is not running
    - Checks if Dir Server is installed and running before IPA installation
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI accepts negative values
    - WebUI: Add positive number validator
    - WebUI: change validator of page size settings
    - WebUI: fix jslint error


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-11.el7
changelog:
  - Resolves: #1565519 Clarify the need to restart services in ipa-server-certinstall(1)
    - Add a notice to restart ipa services after certs are installed
  - Resolves: #1564390 OTP and Radius Authentication does not work in FIPS mode
    - Fix OTP validation in FIPS mode
    - Increase the default token key size
    - Revert "Don't allow OTP or RADIUS in FIPS mode"
    - Log errors from NSS during FIPS OTP key import
  - Resolves: #1565520 ipa client pointing to replica shows KDC has no support for encryption type
    - ipa-replica-install: make sure that certmonger picks the right master
  - Resolves: #1565605 DNS records updated with all IPAddresses of an interface when IPA server/replica try to install with Specific IP address of that interface
    - replica-install: pass --ip-address to client install


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.2
changelog:
  - Resolves: #1477703 IPA upgrade fails for latest ipa package
      - Restore old version of caIPAserviceCert for upgrade only


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2
changelog:
  - Resolves: #1477178 - [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic
    key for host
      - Always check peer has keys before connecting
  - Resolves: #1482802 - Unable to set ca renewal master on replica
      - Fix ipa config-mod --ca-renewal-master
  - Resolves: #1486283 - TypeError in renew_ca_cert prevents from swiching
    back to self-signed CA
      - Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
  - Resolves: #1480102 - ipa-server-upgrade failes with "This entry already exists"
      - Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
  - Resolves: #1484826 - FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
      - Adds whoami DS plugin in case that plugin is missing
  - Resolves: #1478251 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
      - Fixing how sssd.conf is updated when promoting a client to replica
  - Resolves: #1461177 - ipa-otptoken-import - XML file is missing PBKDF2
    parameters!
      - ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
  - Resolves: #1484428 - Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
      - Backport 4-5: Fix ipa-server-upgrade with server cert tracking


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2.2
changelog:
  - Resolves: #1477367 ipa-server-upgrade timeouts on wait_for_open ports
    expecting IPA services listening on IPv6 ports
      - Make sure upgrade also checks for IPv6 stack
      - control logging of host_port_open from caller
      - log progress of wait_for_open_ports
  - Resolves: #1477243 ipa help command returns traceback when no cache
    is present
      - Store help in Schema before writing to disk
      - Disable pylint in get_help function because of type confusion.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.2
changelog:
  - Resolves: #1565633 nsds5ReplicaReleaseTimeout should be set by default
    - Add nsds5ReplicaReleaseTimeout to replica config
    - Fix upgrade (update_replica_config) in single master mode
  - Resolves: #1577108 Improve Custodia client and key distribution handling
    - Use single Custodia instance in installers
  - Resolves: #1577805 4.5.0 -> 4.5.4 upgrade breaks in ipa-server-upgrade: No such file or directory: '/var/lib/pki/pki-tomcat/conf/ca/CS.cfg'
    - Don't try to backup CS.cfg during upgrade if CA is not configured


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-1.el7
changelog:
  - Resolves: #1561581  Rebase IPA to latest 4.6.x version
  - Resolves: #1234219 [WebUI] Error message could be better while adding idrange with untrusted domain name.
  - Resolves: #1274488 ipa-client-install should use previously entered username when performing setup validation
  - Resolves: #1289487 Priority field missing in Password Policy detail tab
  - Resolves: #1339129 ipa vault-archive overwrites an existing value without warning
  - Resolves: #1368345 Replace ERROR: cannot connect to 'http://localhost:8888/ipa/json': [Errno 111] Connection refused with 'IPA is not configured on this system'
  - Resolves: #1424735 While performing ipa-server-upgrade, sssd goes offline and stalls the upgrade process
  - Resolves: #1427105 RFE - Option to add custom OID or display name in IPA Cert
  - Resolves: #1434924 ipa-restore fails when umask is set to 0027
  - Resolves: #1441262 ipa group-del gives ipa: ERROR: Insufficient access: but still deletes group
  - Resolves: #1452081 Suggest user to install libyubikey package instead of traceback
  - Resolves: #1458183 Users can delete their last active OTP token
  - Resolves: #1478366 Crash noticed during IPA upgrade process due to ipa package
  - Resolves: #1480502 ipa server uninstall with -v option displays "IOError: [Errno 9] Bad file descriptor Logged from file ipautil.py, line 442"
  - Resolves: #1481936 Limit number of times the DNS response for the ipa-server A and AAAA records are done during uninstallation.
  - Resolves: #1483139 ipa-restore command doesn't exit with failure if wrong directory manager's password is provided
  - Resolves: #1485429 domain resolution order field in Identity->ID Views->Settings tab missing in WebUI
  - Resolves: #1485851 ipa param-find: command displays internal error
  - Resolves: #1494198 ipa-replica-manage re-initialize TypeError: 'NoneType' object does not support item assignment
  - Resolves: #1504565 API schema generated by server doesn't follow language requested by client.
  - Resolves: #1505925 kdc segfault in openldap libs when ipa-server is installed and custom pkinit is configured
  - Resolves: #1506709 ipa trust-add - Filter out overlapping namespace domains automatically
  - Resolves: #1513041 ipa-restore does not enable/start oddjobd
  - Resolves: #1515314 ipa-replica-install fails with PIN error [ CA-less environment ]
  - Resolves: #1515374 Custodia keys are not removed on uninstall
  - Resolves: #1518932 The Issuer DN field in IPA is not updating properly
  - Resolves: #1519723 admins group is not including all permissions of Role "User Administrator"
  - Resolves: #1527020 nsslapd-sasl-max-buffer-size is hardcoded to '2097152' during install even if another value was provided in an LDIF ( --dirsrv-config-file )
  - Resolves: #1534726 IPA 'Generate OTP' option in web gui does not show OTP code when no reverse zone is managed
  - Resolves: #1547641 ipa: Please log something after restarting the KDC
  - Resolves: #1547995 CRL url on replicas gets incorrectly redirected
  - Resolves: #1549187 IdM servers:/usr/share/ipa/html/ca.crt does not include the complete chain
  - Resolves: #1553594 ldappasswd cause the IPA embedded Directory server to SIGSEGV
  - Resolves: #1568748 Allow hosts to delete their own services
  - Resolves: #1576133 Radius Proxy OTP Auth in IPA is not failing over to the second server in a radius-proxy
  - Resolves: #1577108 Improve Custodia client and key distribution handling


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-2.el7
changelog:
  - Resolves: #1594142 SRV lookup doesn't correctly sort results
    - Sort and shuffle SRV record by priority and weight
  - Resolves: #1594141 Replication races in DogtagInstance.setup_admin
    - Fix replication races in Dogtag admin code
    - Use common replication wait timeout of 5min
    - Improve and fix timeout bug in wait_for_entry()
  - Resolves: #1591824 Installation of replica against a specific master
    - Always set ca_host when installing replica
  - Resolves: #1591647 Increase WSGI worker process count
    - Increase WSGI process count to 5 on 64bit
  - Resolves: #1394034 Custom SELinux User Map order is changed after updating IPA
    - Use replace instead of add to set new default ipaSELinuxUserMapOrder
  - Resolves: #1381535 ipa config-mod returns "Configured size limit exceeded"
    - ipaserver config plugin: Increase search records minimum limit


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.4-3.el7
changelog:
  - Resolves: #1603514 Replica install fails with "Certificate issuance failed (CA_REJECTED)" - ACIError


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-4.el7
changelog:
  - Resolves: #1600525 ipa-client-install --uninstall fails to uninstall client.
    - ipa client uninstall: clean the state store when restoring hostname
  - Resolves: #1598117 client uninstall fails when installed using non-existing hostname
    - ipa client uninstall: clean the state store when restoring hostname
  - Resolves: #1596168 ipa help topics displays 'ipa: ERROR: an internal error has occurred'
    - Fix regression: Handle unicode where str is expected
  - Resolves: #1591824 Installation of replica against a specific master
    - Query for server role IPA master
    - Only create DNS SRV records for ready server
    - Delay enabling services until end of installer
    - replicainstall: DS SSL replica install pick right certmonger host
    - Fix CA topology warning
    - Fix race condition in get_locations_records()
    - Fix DNSSEC install regression
    - Handle races in replica config
  - Resolves: #1591647 Increase WSGI worker process count
    - Use 4 WSGI workers on 64bit systems
  - Resolves: #1565633 nsds5ReplicaReleaseTimeout should be set by default.
    - Tune DS replication settings
  - Resolves: #1607616 Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
    - Removing filesystem encoding check
  - Resolves: #1598044  plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
    - Removing filesystem encoding check


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-5.el7
changelog:
  - Resolves: #1607616 Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
    - Removing filesystem encoding check
  - Resolves: #1598044  plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
    - Removing filesystem encoding check


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-6.el7
changelog:
  - Resolves: #1590647 ldapmodify userPassword reflects on krblastpwdchange on RHEL6 but not RHEL7
    - In IPA 4.4 when updating userpassword with ldapmodify does not update krbPasswordExpiration nor krbLastPwdChange
  - Resolves: #1600074 ipa-server-upgrade displays 'DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated'
    - Re-open the ldif file to prevent error message
  - Resolves: #1608783 ipa trust-add fails in FIPS mode.
    - Move fips_enabled to a common library to share across different plugins
    - ipasam: do not use RC4 in FIPS mode


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-7.el7
changelog:
  - Resolves: #1609882 ipaserver/plugins/cert.py: Add reason to raise of errors.NotFound
    - ipaserver/plugins/cert.py: Added reason to raise of errors.NotFound
  - Resolves: #1598662 Replica installation fails with connection refused error
    - Do not set ca_host when --setup-ca is used
  - Resolves: #1577108 Improve Custodia client and key distribution handling
    - Fix KRA replica installation from CA master
  - Resolves: #1515314 ipa-replica-install fails with PIN error [ CA-less environment ]
    - Fix ipa-replica-install when key not protected by PIN
  - Resolves: #1480502 ipa server uninstall with -v option displays "IOError: [Errno 9] Bad file descriptor Logged from file ipautil.py, line 442"
    - uninstall -v: remove Tracebacks
  - Resolves: #1368345 Replace ERROR: cannot connect to 'http://localhost:8888/ipa/json': [Errno 111] Connection refused with 'IPA is not configured on this system'
    - ipa commands: print 'IPA is not configured' when ipa is not setup
    - Disable message about log in ipa-backup if IPA is not configured
  - Resolves: #1591824 Installation of replica against a specific master
    - Do not set ca_host when --setup-ca is used
  - Resolves: #1594141 Replication races in DogtagInstance.setup_admin
    - Catch ACIError instead of invalid credentials
  - Resolves: #1623112  ipa-replica-install defines nsds5replicabinddngroup before the group contains the DN of the replication manager
    - DS replication settings: fix regression with <3.3 master
  - Resolves: #1623113 Replica install: certmonger sometimes fails
    - Wait for client certificates
    - Auto-retry failed certmonger requests


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-8.el7
changelog:
  - Resolves #1508498 Authn/TOTP defined users periodically prompt for just password credentials to access resources
    - Clear next field when returnining list elements in queue.c
    - Add cmocka unit tests for ipa otpd queue code
  - Resolves #1622168 ipa-otpd: fix potential double-free and infinite loop in queue code
    - Clear next field when returnining list elements in queue.c
    - Add cmocka unit tests for ipa otpd queue code
  - Resolves #1603444 ipa-server-install script is failing when using the "--no-dnssec-validation" parameter combined with the "--forwarder"
    - ipa-server-install: do not perform forwarder validation with --no-dnssec-validation


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-9.el7
changelog:
  - Resolves: #1624755 Re-installing replica on the same system displays 'WARNING: cannot check if port 443 is already configured'
    - ipa-replica-install: properly use the file store
  - Resolves: #1623486 PKINIT configuration did not succeed message is received during Replica-install
    - ipa-replica-install: fix pkinit setup
  - Related: #1624289 AVC denials noticed during test execution for SUB-CA test-suite in FIPS mode
    - Update minimum selinux-policy to 3.13.1-224


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7
changelog:
  - Resolves: 1630361 PKINIT fails in FIPS mode
    - Ensure that public cert and CA bundle are readable
    - Always make ipa.p11-kit world-readable
    - Make /etc/httpd/alias world readable & executable
    - Fix permission of public files in upgrader


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7_6.2
changelog:
  - Resolves: 1659492 searching for ipa users by certificate fails
    - ipaldap.py: fix method creating a ldap filter for IPACertificate
    - ipatests: add xmlrpc test for user|host-find --certificate
  - Resolves: 1659509 IPA Upgrade failed with "unable to convert the attribute u'cACertificate;binary'"
    - ipa upgrade: handle double-encoded certificates
    - ipatests: add upgrade test for double-encoded cacert
    - ipatests: fix TestUpgrade::test_double_encoded_cacert
  - Resolves: 1659500 'ipa vault-retrieve' is failing with "ipa: ERROR: an internal error has occurred"
    - Add a shared-vault-retrieve test
    - Add a "Find enabled services" ACI in 20-aci.update so that all users can find IPA servers and services. ACI suggested by Christian Heimes.
  - Resolves: 1659511 ipa-pkinit-manage reports a switch from local pkinit to full pkinit configuration was successful although it was not.
    - ipatest: add test for ipa-pkinit-manage enable|disable
    - PKINIT: fix ipa-pkinit-manage enable|disable
  - Resolves: 1659499 automember-rebuild crashes
    - Find orphan automember rules
  - Resolves: 1660389 ipa-replica-install fails migrating RHEL 6 to 7
    - replication: check remote ds version before editing attributes


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7_6.3
changelog:
  - Resolves: 1672343 pki spawn fails for IPA replica install from RHEL6 IPA master
    - Update mod_nss cipher list so there is overlap with a 4.x master
  - Resolves: 1672342 Fix compile issue with new 389-ds
    - ipa-sidgen: make internal fetch_attr helper really internal
  - Resolves: 1672176 host_del and host_disable fails, ra.find() search for every certificates instead of the host's certificate by subject
    - Add workaround for slow host/service del
    - Optimize cert remove case
  - Resolves: 1672238 The ipa-replica-install command failed, exception: ValidationError: invalid 'dnszoneidnsname': only master zones can contain record
    - replica installation: add master record only if in managed zone
    - ipatests: add test for replica in forward zone


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7_6.6
changelog:
  - Resolves: 1716882 - ERROR: invalid 'PKINIT enabled server': all masters must have IPA master role enabled
    - Consider configured servers as valid


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-1.el7
changelog:
  - Resolves: 1677197 Rebase IPA to latest 4.6.x version
  - Resolves: 1690037[RFE] Add utility to promote CA replica to CRL master
  - Resolves: 1689585 Cannot install ipa-server on rhel7.7
  - Resolves: 1672184 Fix compile issue with new 389-ds
  - Resolves: 1672180 pki spawn fails for IPA replica install from RHEL6 IPA master
  - Resolves: 1669012 host_del and host_disable fails, ra.find() search for every certificates instead of the host's certificate by subject
  - Resolves: 1658701 ipa-replica-install fails migrating RHEL 6 to 7
  - Resolves: 1651834 searching for ipa users by certificate fails
  - Resolves: 1644874 IPA Upgrade failed with "unable to convert the attribute u'cACertificate;binary'"
  - Resolves: 1638545 ipa-advise command points to old URL's.
  - Resolves: 1637717 RFE: Validation and better error messages when novajoin fails because of SSL errors
  - Resolves: 1599939 'ipa vault-retrieve' is failing with "ipa: ERROR: an internal error has occurred"
  - Resolves: 1593454 In IPA WebUI, a warning appears in the background(warning message behind the dialog box).
  - Resolves: 1586268 [RFE] Red Hat Identity Manager IP SANs
  - Resolves: 1579037 Adding 3rd Party CAs to IPA results in SmartCard preparation script failure
  - Resolves: 1577967 Users with user creation/modification privileges fail to add the "--radius-username" option when creating users
  - Resolves: 1572674 ipa-cacert-manage cannot import PKCS#7 files
  - Resolves: 1562422 [RFE] Allow IPA Services to Start After the IPA Backup Has Completed
  - Resolves: 1562396 IPA numeric username breaks sudo and getent
  - Resolves: 1533228 The ipa-replica-install command failed, exception: ValidationError: invalid 'dnszoneidnsname': only master zones can contain records
  - Resolves: 1497334 ipa-server-install should prevent installations with single label domains
  - Resolves: 1493541 ipa-pkinit-manage reports a switch from local pkinit to full pkinit configuration was successful although it was not.
  - Resolves: 1485217 [RFE] Warn or adjust umask if it is too restrictive to break installation
  - Resolves: 1428690 ipa-backup does not create log file at /var/log/
  - Resolves: 1408439 ipa idoverrideuser-find view --anchor fails to return output
  - Resolves: 1390757 automember-rebuild crashes
  - Resolves: 1376024 During one step replica install the command accepts both OTP and Admin password simultaneously
  - Resolves: 1245626 ipa-client-install modifies /etc/openldap/ldap.conf in a way which is unhandy for openldap-clients


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-2.el7
changelog:
  - Resolves: 1691334 New defect found in ipa-4.6.5-1.el7
    - Coverity: fix issue in ipa_extdom_extop.c
  - Resolves: 1666843 ipa-replica-manage force-sync --from keeps prompting "No status yet"
    - ipa-replica-manage: fix force-sync
  - Resolves: 1594245 [RFE] sysadm_r should be included in default SELinux user map order
    - Add sysadm_r to default SELinux user map order
  - Resolves: 1527215 RFE: ipa client should setup openldap for GSSAPI
    - RFE: ipa client should setup openldap for GSSAPI
  - Resolves: 1518939 RFE: Extend IPA to support unadvertised replicas
    - Unify and simplify LDAP service discovery
    - Use api.env.container_masters
    - Consolidate container_masters queries
    - Add hidden replica feature
    - ipatests: Exercise hidden replica feature
    - Simplify and improve tests
    - Implement server-state --state=enabled/hidden
    - Consider hidden servers as role provider
    - Improve config-show to show hidden servers
    - More test fixes
    - Don't allow to hide last server for a role
    - Synchronize hidden state from IPA master role
    - Test replica installation from hidden replica
    - Add design draft
    - Don't fail if config-show does not return servers
  - Resolves: 1517886 double ca acl provoke console error.
    - Add uniqueness constraint on CA ACL name
  - Resolves: 1498110 Using --auto-reverse and --allow-zone-overlap does not skip zone overlap check
    - Extend CALessBase::installer_server to accept extra_args
    - Skip zone overlap check with auto-reverse
  - Resolves: 1496963 [RFE] Provide an option to include FQDN in IDM topology graph
    - Web UI (topology graph): Show FQDN for nodes if they have no common DNS zone
  - Resolves: 1345975 [RFE] Support One-Way Trust authenticated by trust secret
    - Replace hard-coded paths with path constants
    - Support Samba 4.9
    - Add design page for one-way trust to AD with shared secret
    - trust: allow trust agents to read POSIX identities of trust
    - trusts: add support for one-way shared secret trust
    - upgrade: upgrade existing trust agreements to new layout
    - upgrade: add trust upgrade to actual upgrade code
  - Resolves: 1690191 [RFE] Offline Certificate Renewal System
    - Extract ca_renewal cert update subroutine
    - cainstance: add function to determine ca_renewal nickname
    - constants: add ca_renewal container
    - Add ipa-cert-fix tool
    - ipa-cert-fix: add man page
    - ipa-cert-fix: use customary exit statuses
  - Resolves: 1631826 Create a warning that SSSD needs restart after idrange-mod
    - Show a notification that sssd needs restarting after idrange-mod


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-3.el7
changelog:
  - Resolves: 1694623 ipa-kra-install failing with invalid 'role_servrole': must be Unicode text error
    - ipa-setup-kra: fix python2 parameter
  - Resolves: 1694596 ipa-server-upgrade fails with ConversionError: invalid 'cn': must be Unicode text
    - ipa-server-upgrade: fix add_systemd_user_hbac


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-4.el7
changelog:
  - Resolves: 1686302 ipa trust fetch-domains, server parameter ignored
    - oddjob: allow to pass options to trust-fetch-domains
  - Resolves: 1695481 ipa trust-add failing with CIFS server communication error
    - adtrust: define Guests mapping after creating cifs/ principal
    - net groupmap: force using empty config when mapping Guests


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-5.el7
changelog:
  - Resolves: 1697242 Communication with oddjob helper fails
    - Bypass D-BUS interface definition deficiences for trust-fetch-domains


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-7.el7
changelog:
  - Resolves: 1704227 - Wrong logic in ipactl restart leads to start instead of restart pki-tomcatd
    - ipactl restart: fix wrong logic when checking service list


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-8.el7
changelog:
  - Resolves: 1702651 - Command ipa conole is broken
    - ipa console: catch proper exception when history file can not be open
  - Resolves: 1704796 - Wrong CA replication topology created with two replicas
    - replica install: acknowledge ca_host override
  - Resolves: 1708873 - Unable to upgrade ipa data: IPA version error: data needs to be upgraded (expected version '4.7.90.pre1-3.fc30', current version '4.7.2-8.fc30')
    - upgrade: adtrust - catch empty result when retrieving list of trusts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-9.el7
changelog:
  - Resolves: 1712794 - ERROR: invalid 'PKINIT enabled server': all masters must have IPA master role enabled
    - Consider configured servers as valid


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-10.el7
changelog:
  - Resolves: 1723473 - ipa upgrade fails with trust entry already exists
    - adtrust upgrade: fix wrong primary principal name


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7
changelog:
  - Resolves: 1723473 - ipa upgrade fails with trust entry already exists
    - adtrust upgrade: fix wrong primary principal name, part 2
  - Resolves: 1686302 - ipa trust fetch-domains, server parameter ignored
    - trust-fetch-domains: make sure we use right KDC when --server is specified


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-11.el7
changelog:
  - Resolves: 1651834 searching for ipa users by certificate fails
    - ipaldap.py: fix method creating a ldap filter for IPACertificate
    - ipatests: add xmlrpc test for user|host-find --certificate
  - Resolves: 1644874 IPA Upgrade failed with "unable to convert the attribute u'cACertificate;binary'"
    - ipa upgrade: handle double-encoded certificates
    - ipatests: add upgrade test for double-encoded cacert
    - ipatests: fix TestUpgrade::test_double_encoded_cacert
  - Resolves: 1599939 'ipa vault-retrieve' is failing with "ipa: ERROR: an internal error has occurred"
    - Add a shared-vault-retrieve test
    - Add a "Find enabled services" ACI in 20-aci.update so that all users can find IPA servers and services. ACI suggested by Christian Heimes.
  - Resolves: 1493541 ipa-pkinit-manage reports a switch from local pkinit to full pkinit configuration was successful although it was not.
    - ipatest: add test for ipa-pkinit-manage enable|disable
    - PKINIT: fix ipa-pkinit-manage enable|disable
  - Resolves: 1390757 automember-rebuild crashes
    - Find orphan automember rules
  - Resolves: 1658701 ipa-replica-install fails migrating RHEL 6 to 7
    - replication: check remote ds version before editing attributes


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-12.el7
changelog:
  - Resolves: 1672180 pki spawn fails for IPA replica install from RHEL6 IPA master
    - Update mod_nss cipher list so there is overlap with a 4.x master
  - Resolves: 1672184 Fix compile issue with new 389-ds
    - ipa-sidgen: make internal fetch_attr helper really internal
  - Resolves: 1669012 host_del and host_disable fails, ra.find() search for every certificates instead of the host's certificate by subject
    - Add workaround for slow host/service del
    - Optimize cert remove case
  - Resolves: 1533228 The ipa-replica-install command failed, exception: ValidationError: invalid 'dnszoneidnsname': only master zones can contain record
    - replica installation: add master record only if in managed zone
    - ipatests: add test for replica in forward zone


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-1.el7
changelog:
  - Resolves: 1733075 - Rebase IPA to latest 4.6.x version
  - Resolves: 1512952 - cert renewal is failing when ipa ca cert is renewed from self-signed > external ca > self-sign
  - Resolves: 1544470 - cn=cacert could show expired certificate
  - Resolves: 1581583 - Error message should be more useful while ipa-backup fails for insufficient space
  - Resolves: 1632351 - remove "last init status" from ipa-replica-manage list <node> if it's None.
  - Resolves: 1691939 - False error is shown when options are added to an existing sudo rule using 'sudooption'
  - Resolves: 1695685 - IPA Web UI is slow to display user details page
  - Resolves: 1702426 - ipa-server-common expected file permissions in package don't match runtime permissions
  - Resolves: 1711172 - Removing TLSv1.0, TLSv1.1 from nss.conf
  - Resolves: 1714076 - Issue with adding multiple RHEL 7 IPA replica to RHEL 6 IPA master
  - Resolves: 1714921 - x509.Name -> ipapython.dn.DN does not handle multi-valued RDNs
  - Resolves: 1720952 - Cannot modify TTL with ipa dnsrecord-mod --ttl alone on command line
  - Resolves: 1721550 - Staged user is not being recognized if the user entry doesn't have an objectClass "posixaccount"
  - Resolves: 1727304 - Restrict cipher lists used by openssl connections
  - Resolves: 1733209 - ipa-client-automount needs option to specify domain
  - Resolves: 1733265 - IPA webgui incorrectly display number of entries in ID views


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.6-3.el7
changelog:
  - Resolves: 1717008 - User incorrectly added to negative cache when backend is reconnecting to IPA service / timed out: error code 32 'No such object'


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.6-4.el7
changelog:
  - Resolves: 1744926 - rebuild against Samba 4.10 to solve undefined symbol: DEBUGLEVEL_CLASS
  - Backport patches to compile against Samba 4.10
  - Fix Python 2 compatibility in adtrustinstance


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-5.el7
changelog:
  - Resolves: #1749788 - ipa host-find --pkey-only includes SSH keys in output
    - Don't return SSH keys with ipa host-find --pkey-only
  - Resolves: #1745108 - Bug 1497334 invalidating single-label domains introduces regression of usage for customers
    - check for single-label domains only during server install
  - Resolves: #1583950 - IPA: IDM drops all custom attributes when moving account from preserved to stage
    - user-stage: transfer all attributes from preserved to stage user
    - xmlrpc test: add test for preserved > stage user


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-6.el7
changelog:
  - Resolves: #1752005 - Keyrings should not be used in containerized environment
    - Don't configure KEYRING ccache in containers
  - Resolves: #1751951 - When master's IP address does not resolve to its name, ipa-replica-install fails
    - Add container environment check to replicainstall
  - Resolves: #1750700 - when migrating trusted domain object structure, add default access control definitions, if they were missing in old trust objects
    - add default access control when migrating trust objects
    - adtrust: add default read_keys permission for TDO objects
    - Disable deprecated-lambda check in adtrust upgrade code


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-7.el7
changelog:
  - Resolves: #1754494 - ipa-replica-install does not enforce --server option
    - replica install: enforce --server arg
  - Resolves: #1729638 - ipa_kdb: assertion failure from NULL lcontext pointer to ldap_get_values_len()
    - Fix segfault in ipadb_parse_ldap_entry()
    - Log INFO message when LDAP connection fails on startup
    - Fix NULL pointer dereference in maybe_require_preauth()
  - Resolves: #1636765 - ipa-restore set wrong file permissions and ownership for /var/log/dirsrv/slapd- directory
    - ipa-restore: Restore ownership and perms on 389-ds log directory


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-8.el7
changelog:
  - Resolves: #1755223 - Sub-CA key replication failure
    - Handle missing LWCA certificate or chain
    - Fix CustodiaClient ccache handling
    - CustodiaClient: use ldapi when ldap_uri not specified
    - CustodiaClient: fix IPASecStore config on ipa-4-7
    - Bump krb5 min version


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-9.el7
changelog:
  - Resolves: #1762317 - ipa-backup command is failing on rhel-7.8
    -  ipa-backup: fix python2 issue with os.mkdir


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-10.el7
changelog:
  - Resolves: #1728123 - EMBARGOED CVE-2019-10195 ipa: FreeIPA: batch API logging user passwords to /var/log/httpd/error_log [rhel-7]
    - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
  - Resolves: #1773550 - IPA upgrade fails for latest ipa package when adtrust is installed
    - Do not run trust upgrade code if master lacks Samba bindings
  - Resolves: #1767302 - EMBARGOED CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf() [rhel-7.8]
    - Make sure to have storage space for tag


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-11.el7
changelog:
  - Resolves: #1778777 - After upgrade AD Trust Agents were removed from LDAP
    - trust upgrade: ensure that host is member of adtrust agents


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-12.el7
changelog:
  - Resolves: #1754902 - Running ipa-server-install fails when RHEL 7.7 packages are installed on RHEL 7.6
  - Resolves: #1404770 - ID Views: do not allow custom Views for the masters
    - idviews: prevent applying to a master
  - Resolves: #1801791 - Compatibility Schema difference in functionality for systems following RHEL 7.5 -> 7.6 upgrade path as opposed to new RHEL 7.6 systems
    - install/updates: move external members past schema compat update
  - Resolves: #1795890 - ipa-pkinit-manage enable fails on replica if it doesn't host the CA
    - pkinit setup: fix regression on master install
    - pkinit enable: use local dogtag only if host has CA
  - Resolves: #1788907 - Renewed certs are not picked up by IPA CAs
    - Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
  - Resolves: #1780548 - Man page ipa-cacert-manage does not display correctly on RHEL
    - ipa-cacert-manage man page: fix indentation
  - Resolves: #1782587 - add "systemctl restart sssd" to warning message when adding trust agents to replicas
    - adtrust.py: mention restarting sssd when adding trust agents
  - Resolves: #1771356 - Default client configuration breaks ssh in FIPS mode
    - Use default ssh host key algorithms
  - Resolves: #1755535 - ipa-advise on a RHEL7 IdM server is not able to generate a configuration script for a RHEL8 IdM client
    - smartcard: make the ipa-advise script compatible with authselect/authconfig
  - Resolves: #1758406 - KRA authentication fails when IPA CA has custom Subject DN
    - upgrade: fix ipakra people entry 'description' attribute
    - krainstance: set correct issuer DN in uid=ipakra entry
  - Resolves: #1756568 - ipa-server-certinstall man page does not match built-in help
    - ipa-server-certinstall manpage: add missing options
  - Resolves: #1206690 - UPG not being enforced properly
    - ipa user_add: do not check group if UPG is disabled
  - Resolves: #1811982 - CVE-2018-14042 ipa: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip.
  - Resolves: #1811978 - CVE-2018-14040 ipa: bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
  - Resolves: #1811972 - CVE-2016-10735 ipa: bootstrap: XSS in the data-target attribute
  - Resolves: #1811969 -CVE-2018-20676 ipa: bootstrap: XSS in the tooltip data-viewport attribute
  - Resolves: #1811966 - CVE-2018-20677 ipa: bootstrap: XSS in the affix configuration target property
  - Resolves: #1811962 - CVE-2019-8331 ipa: bootstrap: XSS in the tooltip or popover data-template attribute
    - Web UI: Upgrade Bootstrap version 3.3.7 -> 3.4.1
  - Resolves: #1769791 - Invisible part of notification area in Web UI intercepts clicks of some page elements
    - WebUI: Fix notification area layout
  - Resolves: #1545755 - ipa-replica-prepare should not update pki admin password
    - Fix indentation levels
    - ipa-pwd-extop: use SLAPI_BIND_TARGET_SDN
    - ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
    - Don't save password history on non-Kerberos accounts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-1.el7
changelog:
  - Resolves: #1819725 - Rebase IPA to latest 4.6.x version
  - Resolves: #1817927 - host-add --password logs cleartext userpassword to Apache error log
  - Resolves: #1817923 - IPA upgrade is failing with error "Failed to get request: bus, object_path and dbus_interface must not be None."
  - Resolves: #1817922 - covscan memory leaks report
  - Resolves: #1817919 - Enable compat tree to provide information about AD users and groups on trust agents
  - Resolves: #1817918 - Secure tomcat AJP connector
  - Resolves: #1817886 - ipa group-add-member: prevent adding IPA objects as external members
  - Resolves: #1788718 - ipa-server-install incorrectly setting slew mode (-x) when setting up ntpd


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-2.el7
changelog:
  - Resolves: #1802408 CVE-2020-1722 ipa: No password length restriction leads to denial of service
    - Add interactive prompt for the LDAP bind password to ipa-getkeytab
    - CVE-2020-1722: prevent use of too long passwords


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7
changelog:
  - Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp
    -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.4
changelog:
  - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
    - wgi/plugins.py: ignore empty plugin directories
  - Resolves: #1895197 improve IPA PKI susbsystem detection by other means than a directory presence, use pki-server subsystem-find
    - Improve PKI subsystem detection
    - ipatests: add test for PKI subsystem detection
    - ipatest: fix test_upgrade.py::TestUpgrade::()::test_kra_detection
  - Resolves: #1892793 Authentication and login times are over several seconds due to unindexed ipaExternalMember
    - Add more indices
  - Resolves: #1884819 IdM Web UI shows users as disabled
    - fix cert-find errors in CA-less deployment
  - Resolves: #1863619 CA-less install does not set required permissions on KDC certificate
    - CAless installation: set the perms on KDC cert file
    - ipatests: check KDC cert permissions in CA less install
  - Resolves: #1859248 CVE-2020-11023 ipa: jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
    - WebUI: Fix jQuery DOM manipulation issues
  - Resolves: #1846349 cannot issue certs with multiple IP addresses corresponding to different hosts
    - fix iPAddress cert issuance for >1 host/service


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.5
changelog:
  - Resolves: #1931405 krb5kdc crash - Segmentation fault in ldap_first_entry().
    - ipa-kdb: fix compiler warnings
    - ipa-kdb: add missing prototypes
    - ipa-kdb: reformat ipa_kdb_certauth
    - ipa-kdb: mark test functions as static
    - ipa-kdb: do not use OpenLDAP functions with NULL LDAP context
  - Resolves: #1835741 krb5kdc crashing on ipa server
  - Resolves: #1929372 krb5kdc is crashing intermittently on IPA server.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.7
changelog:
  - Resolves: #1956550 - IPA server installation fails when cert contains non-ASCII character
    - CA less installation: non ASCII chars in CA subject
    - ipatests: use non-ascii chars in CA-less install
  - Resolves: #1974328 - Revise PKINIT upgrade code
    - Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.9
changelog:
  - Resolves: #2000261 - extdom: LDAP_INVALID_SYNTAX returned instead of LDAP_NO_SUCH_OBJECT
    - extdom: return LDAP_NO_SUCH_OBJECT if domains differ


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.10
changelog:
  - Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server 
    - Fix cert_request for KDC cert
  - Resolves: 2021444 - CVE-2020-25719 ipa: samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
    - SMB: switch IPA domain controller role


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.11
changelog:
  - Resolves: 2082272 - [RFE] Require confirmation to change "Default host group" in IdM automember rules
    - WebUI: Add confirmation dialog for changing default user/host group


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.12
changelog:
  - Resolves: 2084223 - 'ipa idview-show idviewname' & IPA WebUI takes longer time to return the results
    - idviews: use cached ipaOriginalUid value when resolving ID override
  - Resolves: 2124369 - OTP token sync always returns OK even with random numbers
    - ipa otptoken-sync: return error when sync fails
    - ipatests: add negative test for otptoken-sync
    - ipatests: python2 does not support f-strings
    - Fix otptoken_sync plugin


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.13
changelog:
  - Resolves: 2148249 - ipa-client-install does not maintain server affinity during installation
    - Defer creating the final krb5.conf on clients
    - Move client certificate request after krb5.conf is created
    - server install: remove error log about missing bkup file


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.14
changelog:
  - Resolves: 2180919 [rhel-7] Sequence processing failures for group_add using server context
    - ipaserver: deepcopy objectclasses list from IPA config


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-3.el7
changelog:
  - Resolves: #1834385 Man page syntax issue detected by rpminspect
    - Man pages: fix syntax issues
  - Resolves: #1829787 ipa service-del deletes the required principal when specified in lower/upper case
    - Make check_required_principal() case-insensitive
  - Resolves: #1825829 ipa-advise on a RHEL7 IdM server generate a configuration script for client having hardcoded python3
    - ipa-advise: fallback to /usr/libexec/platform-python if python3 not found
  - Resolves: #1812020 CVE-2015-9251 ipa: js-jquery: Cross-site scripting via cross-domain ajax requests
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1
  - Resolves: #1713487 CVE-2019-11358 ipa: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-4.el7
changelog:
  - Resolves: #1842950 ipa-adtrust-install fails when replica is offline
    - ipa-adtrust-install: avoid failure when replica is offline
  - Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
    - WebUI: Apply jQuery patch to fix htmlPrefilter issue


author: Michal Ruprich <mruprich@redhat.com> - 3.1.7-1
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding latest version before including iperf3 in RHEL-7


author: Michal Ruprich - 3.1.7-2
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding requires to spec file for devel package


author: Boris Ranto <branto@redhat.com> - 0:1.8.15-7
changelog:
  - New release (0:1.8.15-7)
  - ID:437 - sel: Fix "sel time set <time>"
  - ID 408 - fix sel list last X listing


author: Josef Ridky <jridky@redhat.com> - 0:1.8.18-3
changelog:
  - Fix issues with warning: dereferencing type-punned pointer 
    will break strict-aliasing rules from RPMDiff


author: Pavel Cahyna <pcahyna@redhat.com> - 0:1.8.18-10
changelog:
  - Protect against negative values to memmove that caused
    "ipmitool sol activate" to crash against an IBM DataPower appliance
    (#1951480) and IP-131 Dayton blades in a SGI ICE-X (#2025519)
    Cherry-picked from upstream PR#78.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.18-11
changelog:
  - Add upstream ipmievd patch to check received msg id against expectation
    Fixes problem where SEL response is not recognized correctly
    when SEL request times out
    Resolves: rhbz#2224569


author: Petr Šabata <contyk@redhat.com> - 3.10.0-6
changelog:
  - Fix lnstat -i (#1024426)
  - Support IPv6 peer addresses (#1017228)
  - Add the replace command to bridge fdb (#1024697)
  - Document link type vlan (#979326)


author: Pavel Šimerda <psimerda@redhat.com> - 3.10.0-19
changelog:
  - Resolves: #1081081 - lnstat man page references iproute-doc when it should
    reference iproute-<ver>


author: Phil Sutter - 3.10.0-47
changelog:
  - Related: #1215006 - backport current version of the ss command
  - Related: #1219280 - backport: iproute2: vti6 support


author: Phil Sutter - 3.10.0-48
changelog:
  - Related: #1215006 - backport current version of the ss command
  - Resolves: #1247315 - Fix limitation in iproute/ss regarding dual-stack sockets


author: Phil Sutter - 3.10.0-49
changelog:
  - Resolves: bz#1241486 - backport: tc: fq scheduler
  - Related: #1215006 - backport current version of the ss command


author: Phil Sutter - 3.10.0-50
changelog:
  - Resolves: #1244851 - vti tunnel does not work
  - Resolves: #1155116 - iproute2: implement "-d" option for "ip mon"


author: Phil Sutter - 3.10.0-51
changelog:
  - Resolves: bz#1251451 - can't change the remote/local address of tunnel
    interface to "any" in ipip mode
  - Related: #1213869 - [6wind 7.2 Feat]: backport: iproute2: various netns
    features
  - Related: #1215006 - [RFE] backport current version of the ss command
  - Resolves: #1251070 - Fix multiple programming errors in iproute package
  - Related: #1198456 - backport: dynamic precision, human readable, and IEC
    output to ip stats
  - Related: #1210402 - [6wind 7.2 Feat]: backport: vxlan: unable to configure
    UDP checksums
  - Related: #1213869 - [6wind 7.2 Feat]: backport: iproute2: various netns
    features


author: Phil Sutter - 3.10.0-52
changelog:
  - Resolves: #1254095 - bridge: Add master device name to bridge fdb show
  - Resolves: #1255316 - tc does not allow to attach pfifo_fast qdisc
  - Related: #1251070 - Fix multiple programming errors in iproute package


author: Phil Sutter - 3.10.0-53
changelog:
  - Related: #1212026 - [6wind 7.2 Feat]: backport: ipxfrm: unable to configure
    SPD hash table - reverted this backport due to unmet dependencies


author: Phil Sutter <psutter@redhat.com> [3.10.0-65.el7]
changelog:
  - man: ip, ip-link: Fix ip option location (Phil Sutter) [1251186]
  - ip: enable configuring multicast group autojoin (Phil Sutter) [1333513]
  - ss: Fix accidental state filter override (Phil Sutter) [1318005]
  - ss: Drop silly assignment (Phil Sutter) [1318005]
  - ss: Fix wrong filter behaviour (Phil Sutter) [1318005]


author: Phil Sutter <psutter@redhat.com> [3.10.0-66.el7]
changelog:
  - ip-link: Support printing VF trust setting (Phil Sutter) [1302119]
  - iplink: Support VF Trust (Phil Sutter) [1302119]
  - add new IFLA_VF_TRUST netlink attribute (Phil Sutter) [1302119]
  - ipaddress: Allow listing addresses by type (Phil Sutter) [1341343]
  - man ip-link: Small example of 'ip link show master' (Phil Sutter) [1341343]
  - ip link: Show devices by type (Phil Sutter) [1341343]
  - ip link: Allow to filter devices by master dev (Phil Sutter) [1341343]


author: Phil Sutter <psutter@redhat.com> [3.10.0-67.el7]
changelog:
  - geneve: fix IPv6 remote address reporting (Phil Sutter) [1339178]
  - geneve: add support to set flow label (Phil Sutter) [1339178]
  - geneve: Add support for configuring UDP checksums. (Phil Sutter) [1339178]
  - geneve: add support for lwt tunnel creation and dst port selection (Phil Sutter) [1339178]
  - geneve: add support for IPv6 link partners (Phil Sutter) [1339178]
  - iplink_geneve: add tos configuration at link creation (Phil Sutter) [1339178]
  - iplink_geneve: add ttl configuration at link creation (Phil Sutter) [1339178]
  - iproute2: update ip-link.8 for geneve tunnels (Phil Sutter) [1339178]
  - iproute2: GENEVE support (Phil Sutter) [1339178]
  - man: ip-address, ip-link: Document 'type' quirk (Phil Sutter) [1341343]
  - man: ip-link.8: Fix 'ip link delete' description (Phil Sutter) [1341343]


author: Phil Sutter <psutter@redhat.com> [3.10.0-68.el7]
changelog:
  - devlink: add manpage for shared buffer (Phil Sutter) [1342515]
  - devlink: implement shared buffer occupancy control (Phil Sutter) [1342515]
  - devlink: implement shared buffer support (Phil Sutter) [1342515]
  - devlink: allow to parse both devlink and port handle in the same time (Phil Sutter) [1342515]
  - devlink: introduce dump filtering function (Phil Sutter) [1342515]
  - devlink: split dl_argv_parse_put to parse and put parts (Phil Sutter) [1342515]
  - devlink: introduce helper to print out nice names (ifnames) (Phil Sutter) [1342515]
  - devlink: introduce pr_out_port_handle helper (Phil Sutter) [1342515]
  - list: add list_add_tail helper (Phil Sutter) [1342515]
  - list: add list_for_each_entry_reverse macro (Phil Sutter) [1342515]
  - devlink: fix "devlink port" help message (Phil Sutter) [1342515]
  - devlink: ignore build result (Phil Sutter) [1342515]
  - add devlink tool (Phil Sutter) [1342515]
  - include: add linked list implementation from kernel (Phil Sutter) [1342515]
  - configure: cleanup (Phil Sutter) [1342515]
  - configure: Check for libmnl (Phil Sutter) [1342515]
  - configure: Add check for the doc tools (Phil Sutter) [1342515]
  - add if_macsec header (Davide Caratti) [1300765]
  - RH-INTERNAL: update kernel headers to v4.6.0 (Davide Caratti) [1300765]
  - utils: fix hex digits parsing in hexstring_a2n() (Davide Caratti) [1300765]
  - ip: add MACsec support (Davide Caratti) [1300765]
  - utils: provide get_hex to read a hex digit from a char (Davide Caratti) [1300765]
  - utils: add get_be{16, 32, 64}, use them where possible (Davide Caratti) [1300765]
  - utils: make hexstring_a2n provide the number of hex digits parsed (Davide Caratti) [1300765]
  - lib/ll_addr: improve ll_addr_n2a() a bit (Davide Caratti) [1300765]
  - iproute2: arpd: use ll_addr_a2n and ll_addr_n2a (Davide Caratti) [1300765]
  - iproute2: utils: change hexstring_n2a and hexstring_a2n to do not work with ":" (Davide Caratti) [1300765]


author: Phil Sutter <psutter@redhat.com> [3.10.0-69.el7]
changelog:
  - ip-address.8: Document autojoin flag (Phil Sutter) [1333513]
  - ip-link.8: Fix font choices (Phil Sutter) [1269528]
  - ip-link: fix man page warnings (Phil Sutter) [1269528]
  - vxlan: fix help and man text (Phil Sutter) [1269528]
  - ip-link: fix unterminated string in manpage (Phil Sutter) [1269528]
  - ip-link.8: Add slave type option descriptions (Phil Sutter) [1269528]
  - ip-link.8: Place 'ip link set' warning more prominently (Phil Sutter) [1269528]
  - ip-link.8: Extend type list in synopsis (Phil Sutter) [1269528]
  - man ip-link: Remove extra GROUP explanation (Phil Sutter) [1269528]
  - man ip-link: Add short description about 'group' (Phil Sutter) [1269528]
  - man ip-link: Add deleting links by group (Phil Sutter) [1269528]
  - iplink: bond_slave: Add missing help functions (Phil Sutter) [1269528]
  - iplink: List valid 'type' argument in ip link help text (Phil Sutter) [1269528]
  - ip link: Add group in usage() for 'ip link delete' (Phil Sutter) [1269528]
  - iproute: constify rtattr_cmp (Phil Sutter) [1348133]
  - ip route: restore route entries in correct order (Phil Sutter) [1348133]


author: Phil Sutter <psutter@redhat.com> [3.10.0-70.el7]
changelog:
  - man: ip-link: Document query_rss option (Phil Sutter) [1264146]
  - Document VF link state control in the ip-link man page (Phil Sutter) [1264146]
  - ipneigh: List all nud states in help output (Phil Sutter) [1276661]
  - iproute2: ip-route.8.in: Add expires option for ip route (Phil Sutter) [1357020]
  - ip route: timeout for routes has to be set in seconds (Phil Sutter) [1357020]
  - route: allow routes to be configured with expire values (Phil Sutter) [1357020]


author: Phil Sutter <psutter@redhat.com> [3.10.0-71.el7]
changelog:
  - ip: add paren to silence warning (Phil Sutter) [1340914]
  - Fix MAC address length check (Jakub Sitnicki) [1253767 1271580]
  - iplink: Check address length via netlink (Jakub Sitnicki) [1253767 1271580]
  - iplink: Add missing variable initialization (Jakub Sitnicki) [1253767 1271580]
  - ip link: Fix crash on older kernels when show VF dev (Jakub Sitnicki) [1340914]
  - ip link: Remove unnecessary device checking (Jakub Sitnicki) [1340914]
  - ip: check for missing dev arg when doing VF rate (Jakub Sitnicki) [1340914]
  - Add support to configure SR-IOV VF minimum and maximum Tx rate through ip tool (Jakub Sitnicki) [1340914]


author: Phil Sutter <psutter@redhat.com> [3.10.0-72.el7]
changelog:
  - macsec: cipher and icvlen can be set separately (Davide Caratti) [1354408]
  - ip {link,address}: add 'macsec' item to TYPE list (Davide Caratti) [1354702]
  - man: macsec: fix macsec related typos (Davide Caratti) [1354702 1354319]
  - Revert "Allow specifying bridge port STP state by name rather than number." (Phil Sutter) [1288042]
  - Revert "fix ip -force -batch to continue on errors" (Phil Sutter) [1288042]
  - Revert "ip: fix exit code for addrlabel" (Phil Sutter) [1288042]
  - Revert "link dump filter" (Phil Sutter) [1288042]
  - Revert "ip: return correct exit code on route failure" (Phil Sutter) [1288042]
  - Revert "ip: fix exit code for rule failures" (Phil Sutter) [1288042]
  - man: ip-link: Drop fou and gue related documentation (Phil Sutter) [1013584]
  - man: ip-link, ip-address: Drop references to ipvlan (Phil Sutter) [1013584]
  - doc, man: ip-rule: Remove incorrect statement about rule 0 (Phil Sutter) [1362561]


author: Phil Sutter <psutter@redhat.com> [3.10.0-73.el7]
changelog:
  - ip-link: add missing {min,max}_tx_rate to help text (Phil Sutter) [1340914]
  - man: ip-link.8: Document missing geneve options (Phil Sutter) [1339178]
  - iproute.spec: Fix for missing cbq.8 man page (Phil Sutter) [1362551]


author: Phil Sutter <psutter@redhat.com> [3.10.0-75.el7]
changelog:
  - ip: vfinfo: remove code duplication for IFLA_VF_RSS_QUERY_EN (Timothy Redaelli) [1264149]
  - ipaddress: Print IFLA_VF_QUERY_RSS_EN setting (Timothy Redaelli) [1264149]
  - ipaddress: Simplify vf_info parsing (Timothy Redaelli) [1264149]
  - ip-route: Prevent some double spaces in output (Timothy Redaelli) [1374446]
  - ip-route man: add usage and description for lwtunnel encap attributes (Phil Sutter) [1329730]
  - lwtunnel: implement support for ip6 encap (Phil Sutter) [1329730]
  - lwtunnel: fix argument parsing (Phil Sutter) [1329730]
  - lwtunnel: Add encapsulation support to ip route (Phil Sutter) [1329730]
  - libnetlink: introduce rta_nest and u8, u16, u64 helpers for nesting within rtattr (Phil Sutter) [1329730]
  - utils: add missing return value (Phil Sutter) [1329730]
  - remove unnecessary extern (Phil Sutter) [1329730]
  - ss: Add support for SCTP protocol (Phil Sutter) [1063934]
  - include: Add linux/sctp.h (Phil Sutter) [1063934]
  - update inet_diag.h header (Phil Sutter) [1063934]
  - macsec: fix byte ordering on input/display of 'sci' (Davide Caratti) [1355629]
  - macsec: fix input of 'port', improve documentation of 'address' (Davide Caratti) [1355629]
  - misc/ss: tcp cwnd should be unsigned (Davide Caratti) [1375215]


author: Phil Sutter <psutter@redhat.com> [3.10.0-76.el7]
changelog:
  - iplink: add missing link type (Phil Sutter) [1374493]
  - man: ip-link: Remove bits about proxy_arp and proxy_arp_wifi (Phil Sutter) [1374360]
  - iplink: bridge_slave: add support for IFLA_BRPORT_FAST_LEAVE (Phil Sutter) [1374360]
  - iplink: bridge_slave: add support for IFLA_BRPORT_MULTICAST_ROUTER (Phil Sutter) [1374360]
  - macsec: fix input range of 'icvlen' parameter (Phil Sutter) [1373121]


author: Phil Sutter <psutter@redhat.com> [3.10.0-77.el7]
changelog:
  - change of rtnetlink to use RTN_F_OFFLOAD (Phil Sutter) [1417289]
  - bridge: add support for the multicast flood flag (Phil Sutter) [1417289]
  - RH-INTERNAL: Update kernel headers to v4.10.0 (Phil Sutter) [1417289]
  - bridge: man: fix STP LISTENING description (Phil Sutter) [1417289]
  - bridge: man: fix BPUD typo (Phil Sutter) [1417289]
  - bridge: man: fix "brige" typo (Phil Sutter) [1417289]
  - bridge: vlan: fix a few "fdb" typos in vlan doc (Phil Sutter) [1417289]
  - bridge: vlan: add support to filter by vlan id (Phil Sutter) [1417289]
  - bridge: mdb: add support to filter by vlan id (Phil Sutter) [1417289]
  - bridge: fdb: add support to filter by vlan id (Phil Sutter) [1417289]
  - bridge: code cleanup (Phil Sutter) [1417289]
  - bridge: mdb: add support for extended router port information (Phil Sutter) [1417289]
  - bridge: mdb: add support for offloaded mdb entries (Phil Sutter) [1417289]
  - bridge: mdb: add user-space support for extended attributes (Phil Sutter) [1417289]
  - iplink: bridge: remove unnecessary returns (Phil Sutter) [1417289]
  - bridge: add support for dynamic fdb entries (Phil Sutter) [1417289]
  - iplink: bridge_slave: export read-only values (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_STARTUP_QUERY_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERY_RESPONSE_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERY_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERIER_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_MEMBERSHIP_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_LAST_MEMBER_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_STARTUP_QUERY_CNT (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_LAST_MEMBER_CNT (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_HASH_MAX (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_HASH_ELASTICITY (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERIER (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERY_USE_IFADDR (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_SNOOPING (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_ROUTER (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_VLAN_DEFAULT_PVID (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_GROUP_ADDR (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_GROUP_FWD_MASK (Phil Sutter) [1417289]
  - iplink: bridge: export read-only timers (Phil Sutter) [1417289]
  - iplink: bridge: export root_(port|path_cost), topology_change and change_detected (Phil Sutter) [1417289]
  - iplink: bridge: export bridge_id and designated_root (Phil Sutter) [1417289]
  - bridge: support for static fdb entries (Phil Sutter) [1417289]
  - bridge.8: minor formatting cleanup (Phil Sutter) [1417289]
  - bridge.8: document fdb replace command (Phil Sutter) [1417289]
  - bridge: fdb: minor syntax fix in help text (Phil Sutter) [1417289]
  - bridge: add calls to fflush in fdb and mdb print functions (Phil Sutter) [1417289]
  - ip, bridge: document -timestamp option (Phil Sutter) [1417289]
  - bridge: add batch command support (Phil Sutter) [1417289]
  - iplink: Add support for IFLA_BR_VLAN_PROTOCOL attribute (Phil Sutter) [1417289]
  - iplink: add support for IFLA_BR_VLAN_FILTERING attribute (Phil Sutter) [1417289]
  - bridge: mdb: add deleted when monitoring delmdb event (Phil Sutter) [1417289]
  - bridge: mdb: add support for vlans (Phil Sutter) [1417289]
  - ip link: proto_down config and display. (Phil Sutter) [1417289]
  - bridge: mdb: add support for router add/del notifications monitoring (Phil Sutter) [1417289]
  - ip: fix all the checkpatch warnings (Phil Sutter) [1417289]
  - iproute2: ipa: show switch id (Phil Sutter) [1417289]
  - ip: return correct exit code on route failure (Phil Sutter) [1417289]
  - iproute2: unify naming for entries offloaded to hardware (Phil Sutter) [1417289]
  - route: label externally offloaded routes (Phil Sutter) [1417289]
  - fix ip -force -batch to continue on errors (Phil Sutter) [1417289]
  - bridge link: add support to specify master (Phil Sutter) [1417289]
  - Allow specifying bridge port STP state by name rather than number. (Phil Sutter) [1417289]
  - iproute2: bridge vlan show new option to print ranges (Phil Sutter) [1417289]
  - iproute2: bridge: support vlan range adds (Phil Sutter) [1417289]
  - bridge/link: add learning_sync policy flag (Phil Sutter) [1417289]
  - bridge link: add option 'self' (Phil Sutter) [1417289]
  - bridge/fdb: add flag/indication for FDB entry synced from offload device (Phil Sutter) [1417289]
  - bridge/fdb: fix statistics output spacing (Phil Sutter) [1417289]
  - iproute2 bridge: bring to above par with brctl show macs (Phil Sutter) [1417289]
  - link dump filter (Phil Sutter) [1417289]
  - bridge: Make filter_index match in signedness (Phil Sutter) [1417289]
  - bridge: Add learning and flood support (Phil Sutter) [1417289]
  - iproute2: ipa: show port id (Phil Sutter) [1417289]
  - bridge: fix reporting of IPv6 addresses (Phil Sutter) [1417289]
  - iplink: bridge_slave: add support for IFLA_BRPORT_PROXYARP_WIFI (Phil Sutter) [1374360]
  - iplink: bridge_slave: add support for IFLA_BRPORT_PROXYARP (Phil Sutter) [1374360]
  - Revert "man: ip-link: Remove bits about proxy_arp and proxy_arp_wifi" (Phil Sutter) [1374360]


author: Phil Sutter <psutter@redhat.com> [3.10.0-78.el7]
changelog:
  - ip-address: Support filtering by slave type, too (Phil Sutter) [1375434]
  - tc: don't accept qdisc 'handle' greater than ffff (Davide Caratti) [1375393]
  - macsec: show usage even if the module is not available (Timothy Redaelli) [1367071]
  - libgenl: introduce genl_init_handle (Timothy Redaelli) [1367071]
  - tc: flower: Fix parsing ip address (Phil Sutter) [1422629]
  - tc: flower: support masked ICMP code and type match (Phil Sutter) [1422629]
  - tc: flower: provide generic masked u8 print helper (Phil Sutter) [1422629]
  - tc: flower: provide generic masked u8 parser helper (Phil Sutter) [1422629]
  - tc: flower: Update documentation to indicate ARP takes IPv4 prefixes (Phil Sutter) [1422629]
  - tc: flower: use correct type when calling flower_icmp_attr_type (Phil Sutter) [1422629]
  - f_flower: don't set TCA_FLOWER_KEY_ETH_TYPE for "protocol all" (Phil Sutter) [1422629]
  - tc: flower: Refactor matching flags to be more user friendly (Phil Sutter) [1422629]
  - tc: flower: Support matching ARP (Phil Sutter) [1422629]
  - kernel headers update (Phil Sutter) [1422629]
  - tc: flower: Fix incorrect error msg about eth type (Phil Sutter) [1422629]
  - tc: flower: Add missing err check when parsing flower options (Phil Sutter) [1422629]
  - tc: flower: Fix flower output for src and dst ports (Phil Sutter) [1422629]
  - tc: flower: Update dest UDP port documentation (Phil Sutter) [1422629]
  - tc: flower: support matching flags (Phil Sutter) [1422629]
  - tc/cls_flower: Add to the usage encapsulation dest UDP port (Phil Sutter) [1422629]
  - tc: flower: Allow *_mac options to accept a mask (Phil Sutter) [1422629]
  - tc: flower: document that *_ip parameters take a PREFIX as an argument. (Phil Sutter) [1422629]
  - tc: flower: Fix typo and style in flower man page (Phil Sutter) [1422629]
  - tc/cls_flower: Add dest UDP port to tunnel params (Phil Sutter) [1422629]
  - tc: flower: support matching on ICMP type and code (Phil Sutter) [1422629]
  - tc: flower: introduce enum flower_endpoint (Phil Sutter) [1422629]
  - tc: flower: make use of flower_port_attr_type() safe and silent (Phil Sutter) [1422629]
  - tc: flower: correct name of ip_proto parameter to flower_parse_port() (Phil Sutter) [1422629]
  - tc: flower: document SCTP ip_proto (Phil Sutter) [1422629]
  - tc: flower: remove references to eth_type in manpage (Phil Sutter) [1422629]
  - tc/cls_flower: Classify packet in ip tunnels (Phil Sutter) [1422629]
  - libnetlink: Introduce rta_getattr_be*() (Phil Sutter) [1422629]
  - tc: flower: Support matching on SCTP ports (Phil Sutter) [1422629]
  - tc: flower: Fix usage message (Phil Sutter) [1422629]
  - tc: flower checkpatch cleanups (Phil Sutter) [1422629]
  - tc: flower: Introduce vlan support (Phil Sutter) [1422629]
  - tc: flower: Add skip_{hw|sw} support (Phil Sutter) [1422629]
  - utils: add get_be{16, 32, 64}, use them where possible (Phil Sutter) [1422629]
  - lib/utils: introduce rt_addr_n2a_rta() (Phil Sutter) [1422629]
  - utils: make rt_addr_n2a() non-reentrant by default (Phil Sutter) [1422629]
  - make format_host non-reentrant by default (Phil Sutter) [1422629]
  - tc: flower no need to specify the ethertype (Phil Sutter) [1422629]
  - ip6tunnel: print local/remote addresses like iptunnel does (Phil Sutter) [1422629]
  - tc: ship filter man pages and refer to them in tc.8 (Phil Sutter) [1422629]
  - tc: add a man page for flower filter (Phil Sutter) [1422629]
  - tc: improve filter help texts a bit (Phil Sutter) [1422629]
  - tc: add support for Flower classifier (Phil Sutter) [1422629]
  - ip: make -resolve addr to print names rather than addresses (Phil Sutter) [1422629]


author: Phil Sutter <psutter@redhat.com> [3.10.0-80.el7]
changelog:
  - tc: m_xt: Drop needless parentheses from #if checks (Phil Sutter) [1326726]
  - tc: m_xt: Fix segfault with iptables-1.6.0 (Phil Sutter) [1326726]
  - m_xt: whitespace cleanup (Phil Sutter) [1326726]
  - tc: m_xt: Introduce get_xtables_target_opts() (Phil Sutter) [1326726]
  - tc: m_xt: Simplify argc adjusting in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of iargc variable in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of rargc in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Drop unused variable fw in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of one indentation level in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Fix indenting (Phil Sutter) [1326726]
  - tc: m_xt: Fix segfault when adding multiple actions at once (Phil Sutter) [1326726]
  - tc: m_xt: Prevent segfault with standard targets (Phil Sutter) [1326726]
  - man: update doc after support of ESN and anti-replay window (Phil Sutter) [1425059]
  - xfrm: add support of ESN and anti-replay window (Phil Sutter) [1425059]


author: Phil Sutter <psutter@redhat.com> [3.10.0-81.el7]
changelog:
  - man: ip-link: Specify min/max values for bridge slave priority and cost (Phil Sutter) [1374360]
  - man: ip-link.8: document bridge options (Phil Sutter) [1373869]


author: Ivan Vecera <ivecera@redhat.com> [3.10.0-84.el7]
changelog:
  - tc: Add support for the matchall traffic classifier. (Ivan Vecera) [1435624]
  - tc: man: Add man entry for the matchall classifier. (Ivan Vecera) [1435624]
  - tc: add missing limits.h header (Ivan Vecera) [1435624]
  - tc: man: matchall: Fix example indentation (Ivan Vecera) [1435624]
  - tc: matchall: Print skip flags when dumping a filter (Ivan Vecera) [1435624]
  - tc, clsact: add clsact frontend (Ivan Vecera) [1435624]


author: Eric Garver <egarver@redhat.com> [3.10.0-86.el7]
changelog:
  - Revert "ip-route man: add usage and description for lwtunnel encap attributes" (Eric Garver) [1459975]
  - Revert "lwtunnel: implement support for ip6 encap" (Eric Garver) [1459975]
  - Revert "lwtunnel: fix argument parsing" (Eric Garver) [1459975]
  - Revert "lwtunnel: Add encapsulation support to ip route" (Eric Garver) [1459975]


author: Sabrina Dubroca <sdubroca@redhat.com> [3.10.0-87.el7]
changelog:
  - devlink: Add e-switch support (Sabrina Dubroca) [1459772]
  - devlink: whitespace cleanup (Sabrina Dubroca) [1459772]
  - devlink: Convert conditional in dl_argv_handle_port() to switch() (Sabrina Dubroca) [1459772]
  - devlink: write usage help messages to stderr (Sabrina Dubroca) [1459772]
  - devlink: Add usage help for eswitch subcommand (Sabrina Dubroca) [1459772]
  - devlink: Call dl_free in early exit case (Sabrina Dubroca) [1459772]


author: Phil Sutter <psutter@redhat.com> [4.11.0-9.el7]
changelog:
  - lib/libnetlink: update rtnl_talk to support malloc buff at run time (Hangbin Liu) [1380803]
  - lib/libnetlink: re malloc buff if size is not enough (Hangbin Liu) [1380803]
  - iplink: double the buffer size also in iplink_get() (Hangbin Liu) [1380803]
  - iplink: check for message truncation in iplink_get() (Hangbin Liu) [1380803]
  - iproute: Add support for extended ack to rtnl_talk (Hangbin Liu) [1380803]
  - libnetlink: drop unused parameter to rtnl_dump_done (Hangbin Liu) [1380803]
  - netlink: Change rtnl_dump_done to always show error (Hangbin Liu) [1380803]


author: Phil Sutter <psutter@redhat.com> [4.11.0-10.el7]
changelog:
  - tc: flower: add support for matching on ip tos and ttl (Kamal Heib) [1456539]
  - iplink: Update usage in help message (Kamal Heib) [1456539]
  - tc: flower: add support for tcp flags (Kamal Heib) [1456539]
  - devlink: Add option to set and show eswitch encapsulation support (Kamal Heib) [1456539]
  - pedit: Introduce ipv6 support (Kamal Heib) [1456539]
  - pedit: Check for extended capability in protocol parser (Kamal Heib) [1456539]
  - pedit: Do not allow using retain for too big fields (Kamal Heib) [1456539]
  - pedit: Fix a typo in warning (Kamal Heib) [1456539]
  - tc: Reflect HW offload status (Kamal Heib) [1456539]
  - devlink: Add support for pipeline debug (dpipe) (Kamal Heib) [1456539]
  - devlink: Change netlink attribute validation (Kamal Heib) [1456539]
  - Update linux headers (Phil Sutter) [1456539]


author: Phil Sutter <psutter@redhat.com> [4.11.0-11.el7]
changelog:
  - ss: add AF_VSOCK support (Stefano Brivio) [1472759]
  - ss: allow AF_FAMILY constants >32 (Stefano Brivio) [1472759]
  - uapi: add include linux/vm_sockets_diag.h (Stefano Brivio) [1472759]
  - iproute: build more easily on Android (Phil Sutter) [1472759]


author: Phil Sutter <psutter@redhat.com> [4.11.0-12.el7]
changelog:
  - man: tc-csum.8: Fix inconsistency in example description (Phil Sutter) [1417162]
  - link_gre6: Detect invalid encaplimit values (Phil Sutter) [1459600]


author: Phil Sutter <psutter@redhat.com> [4.11.0-14.el7_6.1]
changelog:
  - ip-route: Fix nexthop encap parsing (Phil Sutter) [1679996]
  - man: ip-route.8: Document nexthop limit (Phil Sutter) [1679996]
  - ip-route: Fix segfault with many nexthops (Phil Sutter) [1679996]
  - iproute: Abort if nexthop cannot be parsed (Phil Sutter) [1679996]


author: Phil Sutter <psutter@redhat.com> [4.11.0-5.el7]
changelog:
  - ip neigh: allow flush FAILED neighbour entry (Matteo Croce) [1469945]
  - tc: fix typo in manpage (Phil Sutter) [1417162]
  - link_gre6: really support encaplimit option (Phil Sutter) [1459600]
  - tc: m_xt: Prevent a segfault in libipt (Phil Sutter) [1465599]


author: Phil Sutter <psutter@redhat.com> [4.11.0-6.el7]
changelog:
  - link_gre6: Fix for changing tclass/flowlabel (Phil Sutter) [1487486]
  - utils: return default family when rtm_family is not RTNL_FAMILY_IPMR/IP6MR (Stefano Brivio) [1475762]
  - netns: avoid directory traversal (Phil Sutter) [1468529]
  - Disable -fexceptions CFLAG passed by build system (Phil Sutter) [1418715]


author: Phil Sutter <psutter@redhat.com> [4.11.0-15.el7]
changelog:
  - tc/act_tunnel_key: Enable setup of tos and ttl (Phil Sutter) [1641909]
  - tc/flower: Add match on encapsulating tos/ttl (Phil Sutter) [1641909]
  - Update kernel headers (Phil Sutter)
  - tc: include stdint.h explicitly for UINT16_MAX (Phil Sutter) [1641909]
  - tc: m_tunnel_key: Allow key-less tunnels (Phil Sutter) [1658506]
  - tc: m_tunnel_key: reformat the usage text (Phil Sutter) [1658506]


author: Phil Sutter <psutter@redhat.com> [4.11.0-16.el7]
changelog:
  - ip-route: Fix nexthop encap parsing (Phil Sutter) [1624656]
  - man: ip-route.8: Document nexthop limit (Phil Sutter) [1624656]
  - ip-route: Fix segfault with many nexthops (Phil Sutter) [1624656]
  - iproute: Abort if nexthop cannot be parsed (Phil Sutter) [1624656]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-19.el7]
changelog:
  - rdma: add infrastructure for RDMA tool (Andrea Claudi) [1642479 1641914]
  - rdma: Add MR resource tracking information (Andrea Claudi) [1642479 1641914]
  - json_writer: add new json handlers (null, float with format, lluint, hu) (Andrea Claudi) [1642479 1641914]
  - lib: make resolve_hosts variable common (Andrea Claudi) [1642479 1641914]
  - utils: Move BIT macro to common header (Andrea Claudi) [1642479 1641914]
  - tc: flower: Add support for QinQ (Andrea Claudi) [1642347]
  - man: tc-vlan.8: Fix for incorrect example (Andrea Claudi) [1593630]
  - man: ip-route.8: ssthresh parameter is NUMBER (Andrea Claudi) [1593628]
  - devlink: Add param command support (Andrea Claudi) [1644731]
  - devlink: Update man pages and add resource man (Andrea Claudi) [1644731]
  - devlink: Add support for hot reload (Andrea Claudi) [1644731]
  - devlink: Add support for devlink resource abstraction (Andrea Claudi) [1644731]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-21.el7]
changelog:
  - Check user supplied interface name lengths (Andrea Claudi) [1465646]
  - tc: flower: No need to cache indev arg (Andrea Claudi) [1465646]
  - ip{6, }tunnel: Avoid copying user-supplied interface name around (Andrea Claudi) [1465646]
  - utils: strlcpy() and strlcat() don't clobber dst (Andrea Claudi) [1465646]
  - lnstat_util: Make sure buffer is NUL-terminated (Andrea Claudi) [1465646]
  - tc_util: No need to terminate an snprintf'ed buffer (Andrea Claudi) [1465646]
  - ipxfrm: Replace STRBUF_CAT macro with strlcat() (Andrea Claudi) [1465646]
  - Convert harmful calls to strncpy() to strlcpy() (Andrea Claudi) [1465646]
  - Convert the obvious cases to strlcpy() (Andrea Claudi) [1465646]
  - utils: Implement strlcpy() and strlcat() (Andrea Claudi) [1465646]
  - lib/libnetlink: Don't pass NULL parameter to memcpy() (Andrea Claudi) [1465646]
  - lib/fs: Fix and simplify make_path() (Andrea Claudi) [1465646]
  - lib/bpf: Check return value of write() (Andrea Claudi) [1465646]
  - netem/maketable: Check return value of fscanf() (Andrea Claudi) [1465646]
  - ss: Make sure scanned index value to unix_state_map is sane (Andrea Claudi) [1465646]
  - ss: Make struct tcpstat fields 'timer' and 'timeout' unsigned (Andrea Claudi) [1465646]
  - lib/ll_map: Choose size of new cache items at run-time (Andrea Claudi) [1465646]
  - tc/m_xt: Fix for potential string buffer overflows (Andrea Claudi) [1465646]
  - lnstat_util: Simplify alloc_and_open() a bit (Andrea Claudi) [1465646]
  - lib/inet_proto: Review inet_proto_{a2n,n2a}() (Andrea Claudi) [1465646]
  - lib/fs: Fix format string in find_fs_mount() (Andrea Claudi) [1465646]
  - ipntable: Avoid memory allocation for filter.name (Andrea Claudi) [1465646]
  - tipc/bearer: Prevent NULL pointer dereference (Andrea Claudi) [1465646]
  - tc/tc_filter: Make sure filter name is not empty (Andrea Claudi) [1465646]
  - tc/q_netem: Don't dereference possibly NULL pointer (Andrea Claudi) [1465646]
  - ifstat, nstat: Check fdopen() return value (Andrea Claudi) [1465646]
  - lib/bpf: Don't leak fp in bpf_find_mntpt() (Andrea Claudi) [1465646]
  - devlink: Check return code of strslashrsplit() (Andrea Claudi) [1465646]
  - iplink_vrf: Complain if main table is not found (Andrea Claudi) [1465646]
  - iproute: Check mark value input (Andrea Claudi) [1465646]
  - tc/q_multiq: Don't pass garbage in TCA_OPTIONS (Andrea Claudi) [1465646]
  - netem/maketable: Check return value of fstat() (Andrea Claudi) [1465646]
  - ss: Use C99 initializer in netlink_show_one() (Andrea Claudi) [1465646]
  - ipmaddr: Avoid accessing uninitialized data (Andrea Claudi) [1465646]
  - iplink_can: Prevent overstepping array bounds (Andrea Claudi) [1465646]
  - ipaddress: Avoid accessing uninitialized variable lcl (Andrea Claudi) [1465646]
  - tc/m_gact: Drop dead code (Andrea Claudi) [1465646]
  - ss: Drop useless assignment (Andrea Claudi) [1465646]
  - ss: Skip useless check in parse_hostcond() (Andrea Claudi) [1465646]
  - lib/rt_names: Drop dead code in rtnl_rttable_n2a() (Andrea Claudi) [1465646]
  - iproute: Fix for missing 'Oifs:' display (Andrea Claudi) [1465646]
  - ipntable: No need to check and assign to parms_rta (Andrea Claudi) [1465646]
  - devlink: No need for this self-assignment (Andrea Claudi) [1465646]
  - tipc/bearer: Fix resource leak in error path (Andrea Claudi) [1465646]
  - ss: Fix potential memleak in unix_stats_print() (Andrea Claudi) [1465646]
  - ifstat: Fix memleak in dump_kern_db() for json output (Andrea Claudi) [1465646]
  - ifstat: Fix memleak in error case (Andrea Claudi) [1465646]
  - ipvrf: Fix error path of vrf_switch() (Andrea Claudi) [1465646]
  - tc/em_ipset: Don't leak sockfd on error path (Andrea Claudi) [1465646]
  - ss: Don't leak fd in tcp_show_netlink_file() (Andrea Claudi) [1465646]
  - iproute_lwtunnel: csum_mode value checking was ineffective (Andrea Claudi) [1465646]
  - iproute_lwtunnel: Argument to strerror must be positive (Andrea Claudi) [1465646]
  - tipc/node: Fix socket fd check in cmd_node_get_addr() (Andrea Claudi) [1465646]
  - ifcfg: Quote left-hand side of [ ] expression (Andrea Claudi) [1465646]
  - examples: Some shell fixes to cbq.init (Andrea Claudi) [1465646]
  - ip-address: Use correct max attribute value in print_vf_stats64() (Andrea Claudi) [1679749]
  - ss: enclose IPv6 address in brackets (Andrea Claudi) [1588122]
  - tc: f_flower: Add support for matching first frag packets (Andrea Claudi) [1559814]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-23.el7]
changelog:
  - tc_util: Silence spurious compiler warning (Andrea Claudi) [1714660]
  - gre6: add collect metadata support (Andrea Claudi) [1714660]
  - tc: m_tunnel_key: add csum/nocsum option (Andrea Claudi) [1714660]
  - m_mirred: don't bail if the control action is missing (Andrea Claudi) [1714660]
  - tc: fix parsing of the control action (Andrea Claudi) [1714660]
  - tc: util: Don't call NEXT_ARG_FWD() in __parse_action_control() (Andrea Claudi) [1714660]
  - tc: don't print error message on miss when parsing action with default (Andrea Claudi) [1714660]
  - tc: gact: fix control action parsing (Andrea Claudi) [1714660]
  - tc/actions: introduce support for goto chain action (Andrea Claudi) [1714660]
  - tc: actions: add helpers to parse and print control actions (Andrea Claudi) [1714660]
  - tc_filter: add support for chain index (Andrea Claudi) [1714660]
  - gre/gre6: allow clearing {,i,o}{key,seq,csum} flags (Andrea Claudi) [1714660]
  - man: ip link: document GRE tunnels (Andrea Claudi) [1714660]
  - ip/tunnel: Use tnl_parse_key() to parse tunnel key (Andrea Claudi) [1714660]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-25.el7]
changelog:
  - tc: implement ingress/egress block index attributes for qdiscs (Andrea Claudi) [1721291]
  - tc: introduce support for block-handle for filter operations (Andrea Claudi) [1721291]
  - tc_filter: resolve device name before parsing filter (Andrea Claudi) [1721291]
  - tc: introduce tc_qdisc_block_exists helper (Andrea Claudi) [1721291]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-27.el7]
changelog:
  - ss: fix NULL pointer access when parsing unix sockets with oldformat (Andrea Claudi) [1795891]
  - tc_util: Add support for showing TCA_STATS_BASIC_HW statistics (Andrea Claudi) [1637437]
  - Update kernel headers (Andrea Claudi) [1637437]
  - uapi: update bpf headers (Andrea Claudi) [1637437]
  - Update kernel headers (Andrea Claudi) [1637437]
  - man: Clarify idleslope calculation for tc-cbs (Andrea Claudi) [1557461]
  - man: Add initial manpage for tc-cbs(8) (Andrea Claudi) [1557461]
  - tc: Add support for the CBS qdisc (Andrea Claudi) [1557461]
  - nstat: print useful error messages in abort() cases (Andrea Claudi) [1792908]


author: Jakub Čajka <jcajka@redhat.com> - 2.4.2-1
changelog:
  - Resolves: #1088562 - [7.1 FEAT] iprutils package update - ppc64
  - Resolves: #1044679 - iprutils should use systemd
  - Resolves: #1092519 - iprutils - PIE and RELRO check


author: Jakub Čajka <jcajka@redhat.com> - 2.4.8-1
changelog:
  - Resolves: #1182038 - [7.2 FEAT] iprutils package update - ppc64/ppc64le
  - Resolves: #1183460 - RHEL7.1 BE: iprutils: Set known zeroed after format


author: Sinny Kumari <skumari@redhat.com> - 2.4.11.1-1
changelog:
  - Resolves: #1274367 - [7.3 FEAT] iprutils package update
  - Resolves: #1297921 - IPR: Raid migration fails to kick while executing through command line


author: Sinny Kumari <skumari@redhat.com> - 2.4.12.1-1
changelog:
  - Resolves: #1364131 - Integrate various important bug fixes for iprutils in
    RHEL7.3 by updating iprutils to 2.4.12


author: Sinny Kumari <skumari@redhat.com> - 2.4.16.1-1
changelog:
  - Resolves: #1587834 - vpdupdate takes over an hour on system with 104 drive
  - Resolves: #1521052 - iprutils package update for POWER
  - Resolves: #1547891 - iprconfig unable to Download microcode on all applicable devices
  - Resolves: #1576013 - iprconfig tools shows wrong error message, while creating raid using RI SSDs and normal SSDs


author: Mathieu Bridon <bochecha@fedoraproject.org> - 6.11-1
changelog:
  - New upstream release.
  - Removed our patch, it has been integrated upstream. As such, we also don't
    need to re-run autoreconf any more.


author: Mathieu Bridon <bochecha@fedoraproject.org> - 6.14-1
changelog:
  - New upstream release.
  - Fix scriptlets, ldconfig is needed for the libs subpackage, not the main one.


author: Thomas Woerner <twoerner@redhat.com> - 6.19-5
changelog:
  - New service sub package to provide the ipset service (RHBZ#1136257)
    Service and start-stop script from F-24
  - Fixed ipset package summary (RHBZ#1195171)
    Spec file derived from F-24


author: Thomas Woerner <twoerner@redhat.com> - 6.19-6
changelog:
  - Use /etc/sysconfig/ipset-config in service as EnvironmentFile (RHBZ#1136257)
  - Use /etc/sysconfig/ipset for data as in RHEL-6 (RHBZ#1136257)
  - No save on reload, but legacy save action (RHBZ#1136257)


author: Thomas Woerner <twoerner@redhat.com> - 6.29-1
changelog:
  - Rebase to 6.29 (RHBZ#1351299)
  - Fixes:
    - Backport ipset capability to run in namespaces (RHBZ#1226051)
    - Fix service save with empty ipset list and existing ipset save file
      (RHBZ#1377621)
    - Fix internal error at printing to output buffer (RHBZ#1395865)


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-1
changelog:
  - Rebase to 6.38 (RHBZ#1557600):
    - hash:ipmac type support added to ipset, userspace part (Tomasz Chilinski)
  - Refactor /etc/sysconfig/ipset.start-stop
  - Fixes:
    - IPSet Service Monolithic Operation (RHBZ#1440741)
    - "systemctl start ipset" doesn't handle existing ipset's having counters
      (RHBZ#1502212)


author: Stefano Brivio <sbrivio@redhat.com> - 7.1-1
changelog:
  - Rebase to 7.1 (RHBZ#1649080):
    - Add compatibility support for strscpy()
    - Correct the manpage about the sort option
    - Add missing functions to libipset.map
    - configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
    - Implement sorting for hash types in the ipset tool
    - Fix to list/save into file specified by option (reported by Isaac Good)
    - Introduction of new commands and protocol version 7, updated kernel include files
    - Add compatibility support for async in pernet_operations
    - Use more robust awk patterns to check for backward compatibility
    - Prepare the ipset tool to handle multiple protocol version
    - Fix warning message handlin
    - Correct to test null valued entry in hash:net6,port,net6 test
    - Library reworked to support embedding ipset completely
    - Add compatibility to support kvcalloc()
    - Validate string type attributes in attr2data() (Stefano Brivio)
    - manpage: Add comment about matching on destination MAC address (Stefano Brivio)
      (RHBZ#1649079)
    - Add compatibility to support is_zero_ether_addr()
    - Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649073)
    - Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649073)
    - Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649073)
    - tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio) 
  - Fixes:
    - Fix all shellcheck warnings in init script (RHBZ#1649073)
    - Make error reporting consistent, introduce different severities (RHBZ#1649877)
    - While restoring, on invalid entries, remove them and retry (RHBZ#1650297)
    - Fix covscan SC2166 warning in init script (RHBZ#1649073)
    - Hardcode triggerin, triggerun versions for ipset-service (RHBZ#1646666)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-9
changelog:
  - fixed missing system hang at shutdown if root device is network based
    (RHBZ#1007934)
  - Fixed iptables-save man page completely wrong (RHBZ#1054871)
  - Fixed missing reload action for iptables service (RHBZ#1066007)
  - Fixed regressions from RHEL-6 iptables services (RHBZ#1067670)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-14
changelog:
  - Add cgroup support (RHBZ#1058660)
  - Add wait seonds support for commands (RHBZ#1156411)
  - Add dhcpv6-client in default IPv6 firewall rules (RHBZ#1169036)
  - Add message for init script error returns (RHBZ#1200415)
  - Use flock for wait option (RHBZ#1202435)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
  - Fix important coverity findings: missing include for flock and use bash for
    init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
  - Fixed init script not to fail on missing restorecon (RHBZ#1246380)
  - Adapted man page snipplet for TRACE to use proper logging backend names
    (RHBZ#1261238)
  - Warn about use of DROP in nat table (RHBZ#1298879)
  - Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
  - Add support for --wait options to restore commands (RHBZ#1438597)
  - Do not set changed flag for rule check operations with module targets
    (RHBZ#1438597)
  - Add version option to restore commands (RHBZ#1438597)


author: Phil Sutter - 1.4.21-18.2
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1491963)
  - Don't restart services upon upgrade (RHBZ#1491961)


author: Phil Sutter - 1.4.21-20
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1486803)
  - Don't restart services upon upgrade (RHBZ#1380141)


author: Phil Sutter - 1.4.21-24.1
changelog:
  - Fix for stopping iptables and ip6tables at the same time (RHBZ#1563168)
  - Propagate errors on service stop (RHBZ#1563168)
  - Avoid overwriting parent's return code (RHBZ#1563168)


author: Phil Sutter - 1.4.21-25
changelog:
  - Fix for stopping iptables and ip6tables at the same time (RHBZ#1560012)
  - Propagate errors on service stop (RHBZ#1560012)


author: Phil Sutter - 1.4.21-27
changelog:
  - libxt_tcpmss: Detect invalid ranges (RHBZ#1128510)
  - ip(6)tables-save/restore: Exit if invalid option was given (RHBZ#1465078)
  - ip(6)tables-save/restore: Require value to -W option (RHBZ#1465078)
  - ip(6)tables-save/restore: Don't accept -W without -w (RHBZ#1465078)
  - Ignore security table when setting policies (RHBZ#1494012)
  - Fix spec file changing SRPM content (RHBZ#1531290)


author: Phil Sutter - 1.4.21-29
changelog:
  - Do not attempt to unload any modules when stopping the firewall (RHBZ#1520534)
  - Fix for covscan warnings (RHBZ#1525980)


author: Phil Sutter <psutter@redhat.com> - 1.4.21-31
changelog:
  - Fix iptables-restore with empty comment in rule (RHBZ#1668475)
  - Fix parsing and printing of -m ipvs --vproto option (RHBZ#1679726)
  - Fix for wrong location of devgroup definition file (RHBZ#1657075)
  - Fix for non-numeric devgroup name output (RHBZ#1657075)
  - Reject negative realm values (RHBZ#1657075)


author: Phil Sutter <psutter@redhat.com> - 1.4.21-34
changelog:
  - Fix iptables-restore for rules with '-' and 't' in comments (RHBZ#1749700)
  - Make services start before network-pre.target is reached (RHBZ#1736765)


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-6
changelog:
  - fix 1283773 - segfault in rate_add_rate

    Jun 17 2014 Alejandro Pérez  <aeperezt@fedoraproject.org>
    fix 1109768 bad configuration logrotate
    Mar 02 2014 Alejandro Pérez  <aeperezt@fedoraproject.org>
    fix bug 1020552 - rpm report /var/lock/ipraf-ng is missing
    added missing file iptraf-nf-tmpfiles.conf
    Dec 03 2013 Nikola Pajkovsky <npajkovs@redhat.com>
    Fedora start using -Werror=format-security and iptraf-ng had some
    parts where error compilation was trigged.
    202b2e7b27a1 Makefile: add -Werror=format-security
    Resolved: #1037133


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-7
changelog:
  - Fixes error in patch Patch03 - this fixes 1283773 and 1539081
    1501821 - Upstream moved to https://github.com/iptraf-ng/iptraf-ng/
    1020552, 1372679 - fix missing /var/lock/iptraf-ng file
    Add BuildRequires:  gcc to spec file.
    1109768 - bad configuration logrotate


author: Jan Synáček <jsynacek@redhat.com> - 20121125-2
changelog:
  - Comment patches and cleanup
  - Update ifaddrs patch
  - Call usage() before limiting capabilities
  - Correct ifaddrs patch
  - Drop corr_type patch (gcc 4.4 build hack)
  - Fix missing end tags in sgml documentation


author: Jan Synáček <jsynacek@redhat.com> - 20121207-1
changelog:
  - Update to iputils-s20121207 (#884983) - fixes a ping segfault introduced
    by the previous update
  - Update ninfod-minor patch
  - Renumber patches
  - Fix -F switch (flowlabel patch)


author: Jan Synáček <jsynacek@redhat.com> - 20121221-7
changelog:
  - ping returns odd results with options inet6 in resolv.conf (#1210331)
  - count of "back" is not correct in tracepath (#1208372)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-7
changelog:
  - ping hung when it cannot receive echo reply (#1362463)
  - arping documentation inconsistency (#1351704)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-9
changelog:
  - IPv4 vs IPv6 inconsistency on return value of ping (#1362388)
  - ping6 does not use device specified with -I parameter (#1371824, #1424965)
  - double cap_free call in ping_common.c (#1410114)
  - ping assumes EACCESS errors are due to broadcast addresses (#1387315)
  - ping -t with multicast address without effect on ppc64 (#1373333)
  - arping -c <n> does not exit when the device is deleted (#1387542)


author: Matthias Saou <http://freshrpms.net/> 1.26-2
changelog:
  - Backport the init script from RHEL6, which contains lots of changes to make
    it behave simlarly to the iptables init script (#593276).


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.6-5
changelog:
  - Fixed irqbalance web adresses in spec (bz1060810)
  - Default hintpolicy adjusted (bz1060814)
  - Missing autogen.sh call fixed


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.7-2
changelog:
  - fixed unused variable revealed by covscan
  - fixed ignored pid argument (#1155632)
  - warning when irqbalance started under non-root (#1155799)
  - more robust signal handling (#1158937)
  - fixed hostname in manpage (#1162251)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.8.15-8
changelog:
  - Fixed crash that can occur if term is resized during irssi init
    (init-resize-crash-fix patch)
    Resolves: rhbz#796457


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-11
changelog:
  - iscsi boot related fixes
    make sure iscsid gets started if there are any boot sessions running
    add reload target to fix double session problem when restarting from NM
    don't rely on session list passed from initrd, never got fully implemented
    remove patches related to running iscsid from initrd, possible to revisit later


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-16
changelog:
  - fix iscsiuio socket activation
  - have systemd start socket units on iscsiadm use, if not already listening


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-19
changelog:
  - 1007388 fixes for iscsiadm to support qla4xxx
  - refresh boot session info patches to final version from upstream,
    fixes context issues with later patches
  - 1006156, 1006161 Add/Update entries in chap table through Open-iSCSI
  - 948134 extend support to set additional parameters for network configuration
  - 1049710 update open-iscsi to support host statistics
  - 1043019 iscsiuio fix for arp cache flush issue
  - 1059332 Fix broken discovery sessions over iser
  - 1017393 split out iscsiuio into a seperate sub-package


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-20
changelog:
  - 1049710 host0 being treated as an invalid in the host stats command
  - 1015563 revert change to return code when calling login_portal for sessions
    that already exist, as it impacts users scripting around iscsiadm


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-21
changelog:
  - 1069825
  - boot session handling improvements
  - Fix iscsi-mark-root for changed iscsiadm output
  - Make sure iscsiuio is running for boot session recovery when using the
    bnx2i transport by forcing iscsiuio.service start
  - Make NM dispatch triggered re-check for autostart sessions async
  - Accept exit code 21, no records, from iscsiadm as success in
    iscsi.service


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-22
changelog:
  - 1081798 retry login on host not found error
  - 1111925 ignore iscsiadm return in iscsi.service
  - 1126524 make sure systemd order against remote mounts is correct
  - 963039 add discovery as a valid mode in iscsiadm.8
  - sync with upstream


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-24
changelog:
  - 1040343 segfault from unexpected netlink event during discovery
  - inhibit strict aliasing optimizations in iscsiuio, rpmdiff error


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-29
changelog:
  - 1166713 1187792 add missing ExecStart, only newer systemd lets that be optional for oneshot services


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-32
changelog:
  - 1235684 apply safe_logout setting to flashnode sessions as well
    but only when logging out by session id, not by flashnode index


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-34
changelog:
  - 1322000 ensure TCP abort on session failure to prevent data corruption with link flap
  - 1294964, 1265073, 1213569 iscsiuio update, fix small ARP table issue
  - 1309488 remove broken sysfs cache code to speed up login of many sessions
  - 1330348 sync with upstream Open-iSCSI for minor fixes


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-6
changelog:
  - 1507945 force start iscsiuio for boot session recovery with qedi
  - 1457359 start systemd socket listeners, otherwise if iscsid is started
    directly iscsiuio doesn't activate as expected


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-12
changelog:
  - 1389071 handle newer ISCSI_ERR_NOP_TIMEDOUT code from the kernel
  - 1624670 Login negotiation failed due to CHAP_N values do not match
            (rec update race condition)


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-17
changelog:
  - 1518367 boot from iSCSI not establishing all sessions persistently
  - 1667965 A manual restart of iscsi.service modifies records node.startup value


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-18
changelog:
  - 1809945 backport new CHAP modes for FIPS environments (SHA1 and SHA256 only, no SHA3 in OpenSSL-1.0.2)


author: Than Ngo <than@redhat.com> - 3.2-94
changelog:
  - Resolves: bz#1060370
    update patch to handle all cases by recursing through fmtmsg
    instead of vfmtmsg directly which depends on va_list type.


author: Chris Leech <cleech@redhat.com> - 0.93-4
changelog:
  - set hardened build flag, required for long running processes (isnsd)
  - patch makefile to actually use LDFLAGS


author: Brian C. Lane <bcl@redhat.com> 1.0.9-1
changelog:
  - Add python-isomd5sum package with python bindings
  - Add callback and interrupt support to the python library
  - Add RPM_OPT_FLAGS to CFLAGS and update makefile to use CFLAGS from environment


author: Brian C. Lane <bcl@redhat.com> 1.0.10-1
changelog:
  - Fix for gcc type-punned and sizeof pointer warnings. (bcl)
  - Add exit code 2 for user abort (#907600) (bcl)
  - Cleanup TABs and update Copyrights (bcl)
  - Standardize *FLAGS in Makefile (ryan)


author: Tatyana Nikolova <tatyana.e.nikolova@intel.com> - 1.0.3rc1
changelog:
  - Adding iwpmd.conf file to enable changing the size
    of the netlink socket receive buffer
  - Including a fix for failing to send netlink messages


author: Tatyana Nikolova <tatyana.e.nikolova@intel.com> - 1.0.3
changelog:
  - Fix for the init script to enable the service to start automatically
    after boot on SLES11 SP4
  - Releasing libiwpm-1.0.3 to be included in OFED-3.18-1


author: Dave Anderson <anderson@redhat.com> - 01.00.00.2113-1
changelog:
  - Copied upstream v01.00.00.2113.tar.gz into ixpdimm_sw-01.00.00.2113.tar.gz
    and did an rhpkg new-sources to replace the mismatched checksum version 
    included in the Fedora src.rpm
  - Resolves: rhbz#1270993


author: Eric Sandeen <sandeen@redhat.com> - 01.00.00.2111-1
changelog:
  - Downgrade to v01.00.00.2113 to satisfy existing RHEL7 deps
  - Add explicit inter-package dependencies
  - Resolves: rhbz#1270993


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-18
changelog:
  - CVE-2011-4516, CVE-2011-4517 jasper: heap buffer overflow flaws
    lead to arbitrary code execution (CERT VU#887409) (#765660)
  - Fixed problems found by static analysis of code (#761440)
  - spec file modernized


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-26.1
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171210)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-26.2
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173568)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173568)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-26.3
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183673)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183681)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-27
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171211)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-28
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173569)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173569)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-29
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183674)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183682)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-30
changelog:
  - Multiple security fixes (fixed by thoger):
    CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089
    CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692
    CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262
    CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391
    CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583
    CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
  - Fix implicit declaration warning caused by security fixes above


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-59.1.10.3
changelog:
  - updated to icedtea6 1.10.3
  - http://blog.fuseyism.com/index.php/2011/07/21/icedtea6-1103-released/


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-60.1.10.4
changelog:
  - updated to icedtea6 1.10.4
  - Security fixes
    - S7000600, CVE-2011-3547: InputStream skip() information leak
    - S7019773, CVE-2011-3548: mutable static AWTKeyStroke.ctor
    - S7023640, CVE-2011-3551: Java2D TransformHelper integer overflow
    - S7032417, CVE-2011-3552: excessive default UDP socket limit under SecurityManager
    - S7046823, CVE-2011-3544: missing SecurityManager checks in scripting engine
    - S7055902, CVE-2011-3521: IIOP deserialization code execution
    - S7057857, CVE-2011-3554: insufficient pack200 JAR files uncompress error checks
    - S7064341, CVE-2011-3389: HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
    - S7070134, CVE-2011-3558: HotSpot crashes with sigsegv from PorterStemmer
    - S7077466, CVE-2011-3556: RMI DGC server remote code execution
    - S7083012, CVE-2011-3557: RMI registry privileged code execution
    - S7096936, CVE-2011-3560: missing checkSetFactory calls in HttpsURLConnection
  - Bug fixes
    - RH727195 : Japanese font mappings are broken
  - Backports
    - S6826104, RH730015: Getting a NullPointer exception when clicked on Application & Toolkit Modal dialog
  - Zero/Shark
    - PR690: Shark fails to JIT using hs20.
    - PR696: Zero fails to handle fast_aldc and fast_aldc_w in hs20.


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-60.1.10.4
changelog:
  - omajid have added Patch6 as (probably temporally) solution for S7103224 for buildability on newest glibc libraries.


author: Deepak Bhole <dbhole@redhat.com> - 1:1.6.0.0-1.64.1.11.12
changelog:
  - Removed the temporary libffi-compat-5 requirement
  - Updated BR to java6-1.6.0-devel
  - Build with OpenJDK6 specifically


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-1.66.1.13.0
changelog:
  - updated to icedtea 1.13
  - updated to openjdk-6-src-b28-04_oct_2013
  - added --disable-lcms2 configure switch to fix tck
  - removed upstreamed patch7,java-1.6.0-openjdk-jstack.patch
  - removed patch100: 8000791-regression-fix.patch
  - added patch7 1.13_fixes.patch to fix 1.13 build issues
  - adapted patch0 java-1.6.0-openjdk-optflags.patch
  - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
  - removed useless runtests parts
  - included also java.security.old files
  - added:
     - Patch103 type_hsx23_patch3.patch
     - Patch104 type_hsx23_patch4.patch
   -to fix zero type error
   -aplied everywhere, as should go upstream
  - Resolves: rhbz#1018679


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-3.1.13.0
changelog:
  - updated to icedtea 1.13.1
   - http://blog.fuseyism.com/index.php/2014/01/23/security-icedtea-1-12-8-1-13-1-for-openjdk-6-released/
  - updated to jdk6, b30,  21_jan_2014
   - https://openjdk6.java.net/OpenJDK6-B30-Changes.html
  - adapted patch7 1.13_fixes.patch
  - pre 2011 changelog moved to (till now  wrong) pre-2009-spec-changelog (rh1043611)
  - added --disable-system-lcms to configure options to pass build
  - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
  - removed upstreamed  patch103 type_hsx23_patch3.patch
  - Resolves: rhbz#1053279


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.3
changelog:
  - updated to icedtea 1.13.3
  - updated to openjdk-6-src-b31-15_apr_2014
  - renmoved upstreamed patch7, 1.13_fixes.patch
  - renmoved upstreamed patch9, 1051245.patch
  - Resolves: rhbz#1099563


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.4
changelog:
  - moved to  icedteaver 1.13.4
  - moved to openjdkver b32 and openjdkdate 15_jul_2014
  - added upstreamed patch patch9 rh1115580-unsyncHashMap.patch
  - Resolves: rhbz#1115869


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.33-1.13.5.0
changelog:
  - Update to IcedTea 1.13.5
  - Remove upstreamed patches.
  - Regenerate add-final-location-rpaths patch against new release.
  - Change versioning to match java-1.7.0-openjdk so revisions work.
  - Use xz for tarballs to reduce file size.
  - No need to explicitly disable system LCMS any more (bug fixed upstream).
  - Add icedteasnapshot to setup lines so they work with pre-release tarballs.
  - Resolves: rhbz#1148901


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0
changelog:
  - Update to IcedTea 1.13.6
  - Remove upstream patch type_hsx23_patch4.patch.
  - Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.
  - Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.
  - Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.
  - Add US_export_policy.jar and local_policy.jar to packages.
  - Resolves: rhbz#1180292


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0.1
changelog:
  - Update to latest 1.13.6 release candidate tarball
  - Fixes a number of issues found with b34:
  - * OJ51, PR2187: Sync patch for 4873188 with 7 version
  - * OJ52, PR2185: Application of 6786276 introduces compatibility issue
  - * OJ53, PR2181: strict-aliasing warnings issued on PPC32
  - * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport
  - * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: "Bad address"
  - * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine
  - Resolves: rhbz#1180292


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.4
changelog:
  - moved to  icedteaver 1.13.4
  - moved to openjdkver b32 and openjdkdate 15_jul_2014
  - added upstreamed patch patch9 rh1115580-unsyncHashMap.patch
  - Resolves: rhbz#1115870
  - forwardported from rhel 6.6, patch10, add-final-location-rpaths.patch (rh1059925)
   - Work when capabilities are set on the binary
   - Include hardcoded install path as well as $ORIGIN in RPATH
   - Don't Expect LD_LIBRARY_PATH to be set in the launcher


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.33-1.13.5.0
changelog:
  - Update to IcedTea 1.13.5
  - Remove upstreamed patches.
  - Regenerate add-final-location-rpaths patch against new release.
  - Change versioning to match java-1.7.0-openjdk so revisions work.
  - Use xz for tarballs to reduce file size.
  - No need to explicitly disable system LCMS any more (bug fixed upstream).
  - Add icedteasnapshot to setup lines so they work with pre-release tarballs.
  - Resolves: rhbz#1148902


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0
changelog:
  - Update to IcedTea 1.13.6
  - Remove upstream patch type_hsx23_patch4.patch.
  - Regenerate add-final-location-rpaths patch against new release.
  - Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.
  - Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.
  - Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.
  - Add US_export_policy.jar and local_policy.jar to packages.
  - Resolves: rhbz#1180293


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.1
changelog:
  - Update to latest 1.13.6 release candidate tarball
  - Fixes a number of issues found with b34:
  - * OJ51, PR2187: Sync patch for 4873188 with 7 version
  - * OJ52, PR2185: Application of 6786276 introduces compatibility issue
  - * OJ53, PR2181: strict-aliasing warnings issued on PPC32
  - * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport
  - * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: "Bad address"
  - * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine
  - Regenerate add-final-location-rpaths patch against new release.
  - Resolves: rhbz#1180293


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.35-1.13.7.0
changelog:
  - Update to IcedTea 1.13.7
  - Regenerate add-final-location-rpaths patch so as to be less disruptive.
  - Resolves: rhbz#1209067


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.36-1.13.8.0
changelog:
  - Update to IcedTea 1.13.8
  - Update no_pr2125.patch to work against new version.
  - Resolves: rhbz#1235153


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.2
changelog:
  - Update with new IcedTea & b37 tarballs, including Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.3
changelog:
  - Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.4
changelog:
  - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression.
  - Resolves: rhbz#1271929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.35-1.13.7.0
changelog:
  - Update to IcedTea 1.13.7
  - Regenerate add-final-location-rpaths patch so as to be less disruptive.
  - Add ExcludeArch directive for RH1209326
  - Resolves: rhbz#1209068


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.36-1.13.8.0
changelog:
  - Update to IcedTea 1.13.8
  - Update no_pr2125.patch to work against new version.
  - Resolves: rhbz#1235154


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.2
changelog:
  - Update with newer tarball, including 6763122 fix for TCK regression.
  - Use release + 1 to avoid having a lower version than the 6.7 version.
  - Resolves: rhbz#1271931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.3
changelog:
  - Update with new IcedTea & b37 tarballs, including Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.4
changelog:
  - Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.5
changelog:
  - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression.
  - Resolves: rhbz#1271931


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.0
changelog:
  - Update to IcedTea 1.13.12 & OpenJDK 6 b40.
  - Separate SystemTap option from bootstrap options.
  - Depend on mailcap for /etc/mime.types (PR2800)
  - Use configure macro and disable long-running JTreg & SystemTap tests from make check
  - Remove redundant patch-ecj target invocation for bootstrap build.
  - Add check section to run the new tests introduced in 1.13.12.
  - Fix context for rpath patch following PR3140.
  - Add RHEL version of b40 tarball.
  - Require mailcap at build time as well, so configure finds /etc/mime.types
  - Resolves: rhbz#1350046


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.1
changelog:
  - Separate bootstrap option as it should not be tied to the JDK used.
  - Enable bootstrapping on JIT architectures going forward.
  - Temporarily enable bootstrapping on all architectures to work around RH1334465/PR2956.
  - Resolves: rhbz#1350046


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.3
changelog:
  - Non-JIT architectures have not been bootstrapping, due to RPM reading commented macros
  - Resolves: rhbz#1350046


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.1
changelog:
  - Update to IcedTea 1.13.12 & OpenJDK 6 b40.
  - Separate SystemTap option from bootstrap options.
  - Depend on mailcap for /etc/mime.types (PR2800)
  - Use configure macro and disable long-running JTreg & SystemTap tests from make check
  - Remove redundant patch-ecj target invocation for bootstrap build.
  - Add check section to run the new tests introduced in 1.13.12.
  - Fix context for rpath patch following PR3140.
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.2
changelog:
  - Require mailcap at build time as well, so configure finds /etc/mime.types
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.3
changelog:
  - Separate bootstrap option as it should not be tied to the JDK used.
  - Enable bootstrapping on JIT architectures going forward.
  - Temporarily enable bootstrapping on all architectures to work around RH1334465/PR2956.
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.5
changelog:
  - Non-JIT architectures have not been bootstrapping, due to RPM reading commented macros
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.8
changelog:
  - Set install directories in configure so that @prefix@ is substituted correctly in tapset
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.9
changelog:
  - Require a JDK with RH1334465/PR2956 fixed and turn off bootstrapping for Zero architectures.
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Update to IcedTea 1.13.13 & OpenJDK 6 b41.
  - Fix context for rpath patch following PR3213.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.91-2.6.2.1
changelog:
  - Bump to 2.6.2 and u91b00.
  - Disable system LCMS 2 for now until security of it can be verified.
  - Drop patches for PR2560/RH1245855 as now applied upstream.
  - Sync minor changes from RHEL 6 spec file.
  - Resolves: rhbz#1271923


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.0
changelog:
  - Bump to 2.6.4 and u95b00.
  - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it.
  - Drop 8072932or8074489 patch as applied upstream in u91b01.
  - Add MD5 checksums for last two version of the java.security file.
  - Resolves: rhbz#1295768


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.0
changelog:
  - Bump to 2.6.5 and u99b00.
  - Correct check for fsg.sh in tarball creation script
  - Resolves: rhbz#1320658


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.101-2.6.6.0
changelog:
  - Bump to 2.6.6 and u101b00.
  - Drop AArch64 patch (PR2914) included in 2.6.6
  - Drop a leading zero from the priority as the update version is now three digits
  - Update PR2809 patch to apply against 2.6.6.
  - Resolves: rhbz#1325427


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.0
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (PR2938 (ttable_match_7) and PR2939 (fontpath)) applied upstream.
  - Resolves: rhbz#1350041


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.1
changelog:
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350041


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.1
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (PR2938, PR2939, PR3012, PR3013 and PR1437) applied upstream.
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.2
changelog:
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.3
changelog:
  - Add additional changes to 8162344 to fix issues which only show up on a full build.
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.4
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Use readlink rather than a wildcard to resolve the system JDK directory
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.5
changelog:
  - Change to disable RC4 did not add MD5 checksum of previous java.security file from 2016/01
  - Resolves: rhbz#1350042


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.111-2.6.7.6
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.7
changelog:
  - Rebuild java-1.7.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372747)
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.0
changelog:
  - Bump to 2.6.8 and u121b00.
  - Drop patches (S7081817, S8140344, S8145017 and S8162344) applied upstream.
  - Update md5sum list with checksum for the new java.security file.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.0
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Update md5sum list with checksum for the new java.security file.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.0
changelog:
  - Bump to 2.6.10 and u141b00.
  - Adjust RH1022017 following application of 8173783
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Update md5sum list with checksum for the new java.security file.
  - Bump to u141b01 to include S8043723 fix for s390.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.1
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Update md5sum list with checksum for the new java.security file.
  - Add blacklisted.certs to installation file list.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.2
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Update jstack tapset to handle AArch64
  - Handle unsupported architectures by calling the error function rather than a parse failure
  - ABS_JAVA_HOME_DIR is no longer used in the updated tapsets
  - Resolves: rhbz#1373986


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.3
changelog:
  - Backport "8173783: IllegalArgumentException: jdk.tls.namedGroups"
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1422738


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.1
changelog:
  - Bump to 2.6.10 and u141b00.
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Update md5sum list with checksum for the new java.security file.
  - Drop 8173783 backport which is now applied upstream.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.3
changelog:
  - Add support for using RSAandMGF1 with the SHA hash algorithms in the PKCS11 provider 
  - Resolves: rhbz#1273760


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.4
changelog:
  - Fix merge error with "native2ascii changes file permissions of input file"
  - Resolves: rhbz#1446700


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.141-2.6.10.5
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - aligned with this change, applied repackReproduciblePolycies.sh
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.151-2.6.11.1
changelog:
  - Bump to 2.6.11 and u151b00.
  - Update java-access-bridge-security.patch to apply against 2.6.11.
  - Drop 7177216 merge fix which is applied upstream.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Fix missing return statement in hotspot/src/cpu/aarch64/vm/c1_LIRAssembler_aarch64.cpp.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Fix missing return statement in hotspot/src/os_cpu/linux_aarch64/vm/os_linux_aarch64.cpp
  - Temporarily add -Wno-error=return-type so we can catch them all.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Extend pr3393-rh1273760.patch so Token.getMechanismInfo can handle CK_MECHANISM
  - Fix missing return statement in hotspot/src/cpu/aarch64/vm/vm_version_aarch64.cpp
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Update to new tarball with AArch64 return value fixes, dropping local patch.
  - Drop -Wno-error=return-type now they appear to be fixed.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Spoke too soon... fix missing return statement in src/os_cpu/linux_zero/vm/os_linux_zero.cpp (non-LP64 only)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.2
changelog:
  - Rebuild with RPM optimisation flags disabled due to issues on x86 multilib
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.0
changelog:
  - Bump to 2.6.14 and u181b00.
  - Drop 8197981 Zero 32-bit patch now applied upstream.
  - Update RC4 patch (8076221/PR2809) to apply after 8175075 (disable 3DES)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.1
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add missing ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.3
changelog:
  - Bump release number to an unused one as rhel-7.5-z-java-unsafe-candidate wrongly using .el7
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.5
changelog:
  - added depndence on latest c-j-c who do not have the incorrect jre-abrt handling
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.10
changelog:
  - jsa files changed to 444 to pass rpm verification
  - Add reg-ex for filtering private libraries' provides/requires.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.10
changelog:
  - Cleanup RH1566890 patch and differentiate from java-1.8.0-openjdk version.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.191-2.6.15.0
changelog:
  - Bump to 2.6.15 and u191b00.
  - Drop PR3608/RH1566890/CVE-2018-3639 patch now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.16.1
changelog:
  - Bump to 2.6.16 and u201b00.
  - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.17pre01.0
changelog:
  - Bump to 2.6.17pre01.
  - Add support for icedtea_snapshot so we can build pre-releases.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.0
changelog:
  - Bump to 2.6.17.
  - Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after 8211883
  - Regenerate pr3393-rh1273760-support_rsaandmgf1_with_sha_in_pkcs11.patch against current sources
  - Resolves: rhbz#1661577


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Produce debug symbols for libpulse-java.so
  - Set IT_CFLAGS=-g so that debug symbols for the pulse audio
  - native library are being produced. This is needed to fix
  - rpmdiff errors of missing .debug_info in pulse-java.so.debug.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.2
changelog:
  - Synchronise Requires with java-1.8.0-openjdk
  - Replace liblcms.so and libsctp.so in _privatelibs with libjavalcms.so and libjavasctp.so
  - Add libjavagtk.so and libmawt.so to _privatelibs
  - Remove duplicate fontconfig build requirement
  - Remove unneeded Requires for fontconfig, lcms2 and libjpeg (all dynamically linked against)
  - Add _isa to NSS requirements
  - Move policytool desktop file and man page to java-1.7.0-openjdk where the binary is
  - Resolves: rhbz#1608957


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.231-2.6.19.0
changelog:
  - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
  - Fix fsg.sh to fail if patching fails.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.0
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.1
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Drop JDK-8226318/RH1738637 which is now included upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.261-2.6.22.1
changelog:
  - Add release notes from IcedTea.
  - Mark license files with appropriate macro.
  - Resolves: rhbz#1810557


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.3.2.fel7
changelog:
  - added and applied patch121, FixPPC64StackOverflow.patch
  - all redundant ppc64 strings replaced by power64 macro
  - Resolves:rhbz#1018680


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.3.3.fel7
changelog:
  - just bumped release, need to confirm, that   patch121, FixPPC64StackOverflow.patch
    really works
  - Resolves:rhbz#1018680


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.3.4.fel7
changelog:
  - Removed obsoletes for java-1.6.0-openjdk* ,  until decided its presence in el7
  - Resolves:rhbz#1018680


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.4.0.el7
changelog:
  - updated to security icedtea 2.4.4
   - icedtea_version set to 2.4.4
   - updatever bumped to       51
   - release reset to 0
  - sync with fedora
   - added and applied patch411 1029588.patch (rh 1029588)
   - added aand applied patch410, 1015432 (rh 1015432)
   - and so removed patch121 FixPPC64StackOverflow.patch
  - added patch412 zero-x32.diff to try to fix zero builds build
  - Resolves: rhbz#1053280


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.5.0.el7
changelog:
  - updated to icedtea 2.4.5 + sync with f21
   - http://blog.fuseyism.com/index.php/2014/01/29/icedtea-2-4-5-released/
  - removed buildRequires: pulseaudio >= 0.9.11, as not neccessary
   -  but kept libs-devel)
  - removed upstreamed or unwonted patches (thanx to gnu_andrew to pointing them out)
   - patch410 1015432.patch (upstreamed)
   - patch411 1029588.patch
   - patch412 zero-x32.diff
   - patch104 java-1.7.0-ppc-zero-jdk.patch
   - patch105 java-1.7.0-ppc-zero-hotspot.patch
  - patch402 gstackbounds.patch and patch403 PStack-808293.patch applied always
   (again thanx to gnu_andrew)
  - merged other gnu_andrew's changes
   - FT2_CFLAGS and FT2_LIBS hardoced values replaced by correct pkg-config calls 
   - buildver bumbed to 31
  - added build requires  nss-devel
  - removed build requires mercurial
  - added JRE_RELEASE_VERSION and ALT_PARALLEL_COMPILE_JOBS into make call
  - Related: rhbz1038092


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.55-2.4.7.0.el7
changelog:
  - bumped to future icedtea-forest 2.4.7
  - updatever set to 55, buildver se to 13, release reset to 0
  - removed upstreamed patch402 gstackbounds.patch
  - removed Requires: rhino, BuildRequires is enough
  - ppc64 repalced by power64 macro
  - patch111 applied as dry-run (6.6 forward port)
  - nss enabled, but notused as default (6.6 forward port)
  - Resolves: rhbz#1099565


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1.7.0.55-2.4.7.2
changelog:
  - Remove NSS patches. Issues with PKCS11 provider mean it shouldn't be enabled.
  - Always setup nss.cfg and depend on nss-devel at build-time to do so.
  - This allows users who wish to use PKCS11+NSS to just add it to java.security.
  - Patches to PKCS11 provider will be included upstream in 2.4.8 (ETA July 2014)
  - Resolves: rhbz#1099565


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.65-2.5.1.2
changelog:
  - added and applied fix for samrtcard io patch405, pr1864_smartcardIO.patch
  - Resolves: rhbz#1115876


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.65-2.5.3.1
changelog:
  - Bump to 2.5.3 for latest security fixes.
  - Remove obsolete patches.
  - Add hsbootstrap option to pre-build HotSpot when required.
  - Resolves: rhbz#1148893


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.0
changelog:
  - Bump to 2.5.4 using OpenJDK 7u75 b13.
  - Bump AArch64 port to 2.6.0pre17.
  - Remove AArch64-specific patches, following rebase on 2.6.x.
  - Fix abrt_friendly_hs_log_jdk7.patch to apply again.
  - Resolves: rhbz#1180297


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.1
changelog:
  - Fix elliptic curve list as part of fsg.sh
  - Enable abrt_friendly_hs_log_jdk7.patch on all archs
  - Resolves: rhbz#1180297


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.5
changelog:
  - Fix hsbootstrap option on ppc64le where JDK_TO_BUILD_WITH is changed.
  - Print uname to feedback to upstream OpenJDK.
  - Resolves: rhbz#1191652


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.5.0
changelog:
  - Bump to 2.5.5 using OpenJDK 7u79 b14.
  - Update OpenJDK tarball creation comments
  - Remove test case for RH1191652 now fix has been verified.
  - Drop AArch64 version of RH1191652 HotSpot patch as included upstream.
  - Resolves: rhbz#1209072


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.0
changelog:
  - Bump to 2.6.0 and u80b32.
  - Drop upstreamed patches and separate AArch64 HotSpot.
  - Add dependencies on pcsc-lite-devel (PR2496) and lksctp-tools-devel (PR2446)
  - Only run -Xshare:dump on JIT archs other than power64 as port lacks support
  - Update remove-intree-libraries script to cover LCMS and PCSC headers and SunEC.
  - Resolves: rhbz#1235158


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.0
changelog:
  - Add GConf2-devel dependency for native proxy fallback support.
  - Remove libxslt dependency pulled in from IcedTea builds.
  - Reduce redhat-lsb dependency to redhat-lsb-core (lsb_release)
  - Resolves: rhbz#1235158


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.1
changelog:
  - Pass SYSTEM_GSETTINGS="true" to the OpenJDK build to explicitly enable the GSettings API.
  - Resolves: rhbz#1235158


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.91-2.6.2.0
changelog:
  - Bump to 2.6.2 and u91b00.
  - Disable system LCMS 2 for now until security of it can be verified.
  - Sync minor changes from RHEL 6 spec file.
  - Resolves: rhbz#1271921


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-0.b14
changelog:
  - Add additional fix to Zero patch to properly handle result on 64-bit big-endian
  - Resolves: rhbz#1325422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-0.b14
changelog:
  - Update to u92b14.
  - Remove upstreamed patches for AArch64 byte behaviour and template issue.
  - Remove upstreamed patches for Zero build failures 8087120 & 8143855.
  - Replace 8132051 Zero fix with version upstreamed as 8154210 in 8u112.
  - Add upstreamed patch 6961123 from u102 to fix application name in GNOME Shell.
  - Add upstreamed patches 8044762 & 8049226 from u112 to fix JDI issues.
  - Regenerate java-1.8.0-openjdk-rh1191652-root.patch against u92
  - Replace PR2974/RH1343832 patch with u92 version used in IcedTea 3.
  - Resolves: rhbz#1350036


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-0.b13
changelog:
  - Update to u101b13.
  - Backport REPOS option in generate_source_tarball.sh
  - Drop a leading zero from the priority as the update version is now three digits
  - Resolves: rhbz#1350036


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-2.b13
changelog:
  - Add missing hunk from 8147771, missed due to inclusion of unneeded 8138811
  - Resolves: rhbz#1350036


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-3.b13
changelog:
  - Replace bad 8159244 patch from upstream 8u with fresh backport from OpenJDK 9.
  - Resolves: rhbz#1350036


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-4.b13
changelog:
  - Add upstream patch for S8157306, documented & applied on all archs with conditional in patch
  - Resolves: rhbz#1365620


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-5.b15
changelog:
  - Update to aarch64-jdk8u101-b15.
  - Rebase SystemTap tarball on IcedTea 3.1.0 versions so as to avoid patching.
  - Drop additional hunk for 8147771 which is now applied upstream.
  - Resolves: rhbz#1368440


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
  - Update to aarch64-jdk8u102-b14.
  - Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
  - Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
  - Move 8158260 to 8u112 section following its backport to 8u.
  - Resolves: rhbz#1368440


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-1.b14
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1368440


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
  - Update to aarch64-jdk8u111-b14.
  - Add latest md5sum for java.security file due to jar signing property addition.
  - Drop S8157306 and the CORBA typo fix, both of which appear upstream in u111.
  - Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b15
changelog:
  - Update to aarch64-jdk8u111-b15, with AArch64 fix for S8160591.
  - Swap java.security md5sum for 7.2.z version with ECC patch.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-9.b15
changelog:
  - Update to aarch64-jdk8u101-b15.
  - Rebase SystemTap tarball on IcedTea 3.1.0 versions so as to avoid patching.
  - Drop additional hunk for 8147771 which is now applied upstream.
  - Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
  - Update to aarch64-jdk8u102-b14.
  - Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
  - Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
  - Move 8158260 to 8u112 section following its backport to 8u.
  - Resolves: rhbz#1359857


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - @prefix@ in tapsetfiles substitued by prefix as necessary to work with systemtap3 (rhbz1371005)
  - Resolves: rhbz#1295754


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-3.b14
changelog:
  - Rebuild java-1.8.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372750)
  - Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-4.b14
changelog:
  - Runtime native library requirements need to match the architecture of the JDK
  - Resolves: rhbz#1375224


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
  - Update to aarch64-jdk8u111-b14.
  - Add latest md5sum for java.security file due to jar signing property addition.
  - Drop S8157306 and the CORBA typo fix, both of which appear upstream in u111.
  - Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
  - Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-3.b15
changelog:
  - Add MD5 checksum from RHEL 7.2 security update so the 7.3 one overwrites it.
  - Resolves: rhbz#1382736


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Update to aarch64-jdk8u111-b18, synced with upstream u111, S8170873 and new AArch64 fixes
  - Replace our correct version of 8159244 with the amendment to the 8u version from 8160122.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Use java-1.7.0-openjdk to bootstrap on RHEL to allow us to use main build target
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.112-0.b16
changelog:
  - Update to aarch64-jdk8u112-b16.
  - Drop upstreamed patches for 8044762, 8049226, 8154210, 8158260 and 8160122.
  - Re-generate size_t and key size (RH1163501) patches against u112.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-0.b13
changelog:
  - Update to aarch64-jdk8u121-b13.
  - Add MD5 checksum for the new java.security file (EC < 224, DSA < 1024 restricted)
  - Update PR1834/RH1022017 fix to reduce curves reported by SSL to apply against u121.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-1.b13
changelog:
  - Add backports from 8u131 and 8u152 ahead of April CPU.
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-1.b11
changelog:
  - Update to aarch64-jdk8u131-b11.
  - Drop upstreamed patches for 8147910, 8161993, 8170888 and 8173783.
  - Update generate_source_tarball.sh to remove patch remnants.
  - Cleanup tarball creation documentation to avoid duplication.
  - Add MD5 checksum for the new java.security file (MD5 disabled for JAR signing)
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-2.b13
changelog:
  - Backport "S8153711: [REDO] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command"
  - Resolves: rhbz#1442162


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-3.b12
changelog:
  - Update to aarch64-jdk8u131-b12 and aarch64-shenandoah-jdk8u131-b12 for AArch64 8168699 fix
  - Resolves: rhbz#1449258


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-9.b14
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Update jstack tapset to handle AArch64
  - Resolves: rhbz#1373848


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-10.b14
changelog:
  - Move unprocessed nss.cfg to nss.cfg.in and add missing substitution to create nss.cfg for install
  - Resolves: rhbz#1429774


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-1.b11
changelog:
  - Update to aarch64-jdk8u131-b11 and aarch64-shenandoah-jdk8u131-b11.
  - Drop upstreamed patches for 8147910, 8161993, 8170888 and 8173783.
  - Update generate_source_tarball.sh to remove patch remnants.
  - Cleanup Shenandoah tarball referencing and document how to create it.
  - Add MD5 checksum for the new java.security file (MD5 disabled for JAR signing)
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-2.b11
changelog:
  - Update tapset tarball to include the better error handling in PR3348
  - http://icedtea.classpath.org/hg/icedtea8/rev/14fc67a5d5a3
  - Resolves: rhbz#1438514


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-4.b11
changelog:
  - Rename SystemTap tapset tarball to avoid conflicts with previous version.
  - Resolves: rhbz#1438514


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-6.b12
changelog:
  - Update to aarch64-jdk8u131-b12 and aarch64-shenandoah-jdk8u131-b12 for AArch64 8168699 fix
  - Resolves: rhbz#1443417


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-4.b12
changelog:
  - Add backports from 8u152 (8179084/RH1455694, 8181419/RH1463144, 8175887) ahead of July CPU.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-0.b15
changelog:
  - Update to aarch64-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Add MD5 checksum for the new java.security file (SHA1 disabled for server-side certificates in jdkCA)
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b16
changelog:
  - Update to aarch64-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-8.b12
changelog:
  - Restore cacerts symlink as some broken apps hardcode the path (see RH1448802)
  - Resolves: rhbz#1319875


author: Zhengyu Gu <zgu@redhat.com> - 1:1.8.0.131-10.b12
changelog:
  - Added 8181055-pr3394-rh1448880.patch to fix a corner case of previous change
  - Resolves: rhbz#1448880


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-11.b12
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b15
changelog:
  - Update to aarch64-jdk8u141-b15 and aarch64-shenandoah-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-2.b16
changelog:
  - Update to aarch64-jdk8u141-b16 and aarch64-shenandoah-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-0.b01
changelog:
  - Update to aarch64-jdk8u144-b01 and aarch64-shenandoah-jdk8u144-b01.
  - Exclude 8175887 from Shenandoah builds as it has been included in that repo.
  - Resolves: rhbz#1481947


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Update to aarch64-jdk8u151-b12 and aarch64-shenandoah-jdk8u151-b12.
  - Update location of OpenJDK zlib system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 8179084 and RH1367357 (part of 8183028).
  - Update RH1191652 (root) and PR2842 to accomodate 8151841 (GCC 6 support).
  - Update PR2964/RH1337583 to accomodate 8171319 (keytool warning output)
  - Update RH1163501 to accomodate 8181048 (crypto refactoring)
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Switch AArch64 to using java-1.8.0-openjdk to bootstrap until RH1482244 is fixed in bootstrap
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Add 8075484/PR3473/RH1490713 which is listed as being in 8u151 but not supplied by Oracle.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Update SystemTap tapsets to version in IcedTea 3.6.0pre02 to fix RH1492139.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Correct fix to RH1191652 root patch so existing COMMON_CCXXFLAGS_JDK is not lost.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - 8188030 is not yet upstream, so it should be listed under upstreamable fixes.
  - 8181055, 8181419, 8145913, 8168318, 8170328 & 8181810 all now in 8u162.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - repack policies adapted to new counts and paths
  - note that also c-j-c is needed to make this apply in next update
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Reverting to java-1.7.0-openjdk on AArch64 as rhel-7.4-z-java-unsafe-candidate using wrong suffix.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-5.b12
changelog:
  - Backport "8180048: Interned string and symbol table leak memory during parallel unlinking" (gnu_andrew)
  - Resolves: rhbz#1515212


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Update to aarch64-jdk8u161-b12 and aarch64-shenandoah-jdk8u161-b12 (mbalao)
  - Drop upstreamed patches for 8075484 (RH1490713), 8153711 (RH1284948),
    8162384 (RH1358661), 8164293 (RH1459641), 8173941, 8175813 (RH1448880),
    8175887 and 8180048 (RH1449870).(mbalao)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Switch bootstrap back to java-1.7.0-openjdk on all architectures, depending on RH1482244 fix
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Replace tarballs with version including AArch64 fix for 8174962 (S8194686)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b13
changelog:
  - Update to b13 including Zero fix for 8174962 (S8194739) and restoring tzdata2017c update
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-5.b13
changelog:
  - Update to aarch64-jdk8u151-b13 and aarch64-shenandoah-jdk8u151-b13.
  - Drop upstreamed patch for 8075484.
  - Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
  - Update to aarch64-jdk8u152-b16 and aarch64-shenandoah-jdk8u152-b16.
  - Update 8145913/PR3466/RH1498309 patch following upstream addition of 8152172 (AES for PPC)
  - Add new file cmsalpha.c to %{name}-remove-intree-libraries.sh
  - Remove upstreamed patches for 8153711/PR3313/RH1284948, 8162384/PR3122/RH1358661, 8173941/PR3226,
  -    8175813/PR3394/RH1448880, 8175887/PR3415, 8146086/PR3439/RH1478402, 8180048/PR3411/RH1449870 and
  -    8164293/PR3412/RH1459641
  - Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
  - Update to tzdata2017c (8190258/PR3499) to resolve TCK failure due to mismatch with system version.
  - Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
  - Backport 8191137 and add updates to the translations (8191840 in OpenJDK 7)
  - Resolves: rhbz#1512647


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.161-1.b12
changelog:
  - Update to aarch64-jdk8u161-b12 and aarch64-shenandoah-jdk8u161-b12 (mbalao)
  - Drop upstreamed patches for 8075484 (RH1490713), 8153711 (RH1284948),
    8162384 (RH1358661), 8164293 (RH1459641), 8173941, 8175813 (RH1448880),
    8175887 and 8180048 (RH1449870).(mbalao)
  - drop more of usptreamed patches 565,566,567,568
    ( 8184673-pr3475-rh1487266.patch  8191840-pr3503-rh1512647.patch  8191137-pr3503-rh1512647.patch 8190258-pr3499-tzdata2017c.patch)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-0.b12
changelog:
  - Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
  - Remove upstreamed patches for 8181055/PR3394/RH1448880,
  -  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
  -  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
  -  8181810/PR3466/RH1498319.
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Cleanup from previous commit.
  - Remove unused upstream patch 8167200.hotspotAarch64.patch.
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-7.b10
changelog:
  - Bump release number to be greater than RHEL 7.6 package to allow build with .el7 suffix
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-4.b11
changelog:
  - Read jssecacerts file prior to trying either cacerts file (system or local) (PR3575)
  - Resolves: rhbz#1593737


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-0.b03
changelog:
  - Update to aarch64-jdk8u181-b03 and aarch64-shenandoah-jdk8u181-b03.
  - Remove AArch64 patch for PR3458/RH1540242 as applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-1.b04
changelog:
  - Mark bugs that have been pushed to 8u upstream and are scheduled for a release.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-2.b04
changelog:
  - Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-7.b13
changelog:
  - Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13.
  - Remove 8187577/PR3578 now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
  - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
  - Update to aarch64-shenandoah-jdk8u181-b15.
  - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
  - Move buildver to where it should be in the OpenJDK version.
  - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
  - Update pr3539-rh1548475.patch to apply after 8187045.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
  - Update to aarch64-shenandoah-jdk8u181-b16.
  - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b10.
  - Drop 8146115/PR3508/RH1463098 applied upstream.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
  - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
  - Update to aarch64-shenandoah-jdk8u181-b15.
  - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
  - Move buildver to where it should be in the OpenJDK version.
  - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
  - Update pr3539-rh1548475.patch to apply after 8187045.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
  - Update to aarch64-shenandoah-jdk8u181-b16.
  - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
  - Resolves: rhbz#1633822


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b13-0
changelog:
  - Note why PR1834/RH1022017 is not suitable to go upstream in its current form.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b13-0
changelog:
  - Fix jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_jdk.patch paths to pass git apply
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b13-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b13.
  - Update tarball generation script in preparation for PR3667/RH1656676 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b14.
  - Adjust JDK-8073139/PR1758/RH1191652 to apply following 8155627 backport.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-1
changelog:
  - Add 8131048 & 8164920 (PR3574/RH1498936) to provide a CRC32 intrinsic for PPC64.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-0
changelog:
  - Update to aarch64-shenandoah-jdk8u192-b12.
  - Remove patches included upstream
    - JDK-8031668/PR2842
    - JDK-8148351/PR2842
    - JDK-6260348/PR3066
    - JDK-8061305/PR3335/RH1423421
    - JDK-8188030/PR3459/RH1484079
    - JDK-8205104/PR3539/RH1548475
    - JDK-8185723/PR3553
    - JDK-8186461/PR3557
    - JDK-8201509/PR3579
    - JDK-8075942/PR3602
    - JDK-8203182/PR3603
    - JDK-8206406/PR3610/RH1597825
    - JDK-8206425
    - JDK-8036003
    - JDK-8201495/PR2415
    - JDK-8150954/PR2866/RH1176206
  - Re-generate patches (mostly due to upstream build changes)
    - JDK-8073139/PR1758/RH1191652
    - JDK-8143245/PR3548 (due to JDK-8202600)
    - JDK-8197429/PR3546/RH1536622 (due to JDK-8189170)
    - JDK-8199936/PR3533
    - JDK-8199936/PR3591
    - JDK-8207057/PR3613
    - JDK-8210761/RH1632174 (due to JDK-8207402)
    - PR3559 (due to JDK-8185723/JDK-8186461/JDK-8201509)
    - PR3593 (due to JDK-8081202)
    - RH1566890/CVE-2018-3639 (due to JDK-8189170)
    - RH1649664 (due to JDK-8196516)
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-0
changelog:
  - Add port of 8189170 to AArch64 which is missing from upstream 8u version.
  - Resolves: rhbz#1661577


author: Jiri Vanek jvanek@redhat.com - 1:1.8.0.201.b09-2
changelog:
  - Replaced pcsc-lite-devel (which is in optional channel) with pcsc-lite-libs.
  - added rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch to make jdk work with pcsc


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.201.b09-3
changelog:
  - Update patch for RH1566890.
    - Renamed rh1566890_speculative_store_bypass_so_added_more_per_task_speculation_control_CVE_2018_3639 to
      rh1566890-CVE_2018_3639-speculative_store_bypass.patch
    - Added dependent patch,
      rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b13-0
changelog:
  - Update to aarch64-shenandoah-jdk8u201-b13.
  - Drop JDK-8160748 & JDK-8189170 AArch64 patches now applied upstream.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.202.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u202-b08.
  - Remove patches included upstream
    - JDK-8211387/PR3559
    - JDK-8207057/PR3613
    - JDK-8165852/PR3468
    - JDK-8073139/PR1758/RH1191652
    - JDK-8044235
    - JDK-8172850/RH1640127
    - JDK-8209639/RH1640127
    - JDK-8131048/PR3574/RH1498936
    - JDK-8164920/PR3574/RH1498936
  - Re-generate patches
    - JDK-8210647/RH1632174
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-0
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b02.
  - Remove patches included upstream
    - JDK-8197429/PR3546/RH153662{2,3}
    - JDK-8184309/PR3596
    - JDK-8210647/RH1632174
  - Re-generate patches
    - JDK-8203030
  - Add casts to resolve s390 ambiguity in calls to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-1
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b02.
  - Remove patches included upstream
    - JDK-8197429/PR3546/RH153662{2,3}
    - JDK-8184309/PR3596
    - JDK-8210647/RH1632174
    - JDK-8029661/PR3642/RH1477159
  - Re-generate patches
    - JDK-8203030
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-1
changelog:
  - Add missing part of JDK-8213419 for AArch64 removing duplicate uabs definitions
  - Yet another cast to resolve s390 ambiguity in call to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b01.
  - Refactor PR2888 after inclusion of 8129988 upstream. Now includes PR3575.
  - Drop 8171000, 8197546 & PR3634 as applied upstream.
  - Adjust 8214206 fix for S390 as BinaryMagnitudeSeq moved to shenandoahNumberSeq.cpp
  - Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b02-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b02.
  - Drop 8064786/PR3599 & 8210416/RH1632174 as applied upstream (8064786 silently in 8176100).
  - Resolves: rhbz#1705328


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
  - Don't perform a bootcycle build for the debug variant build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Provide Javadoc debug subpackages for now, but populate them from the normal build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Use normal_suffix for Javadoc zip filename to copy, as there is is no debug version.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b04.
  - Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b08-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b08.
  - Adjust PR3083/RH134640 to apply after JDK-8182999
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b04-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b04.
  - Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
  - Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b01.
  - Switch to EA mode.
  - Drop JDK-8210761/RH1632174 as now upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05.
  - Drop upstreamed patch JDK-8141570/PR3548.
  - Adjust context of JDK-8143245/PR3548 to apply against upstream JDK-8141570.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05-shenandoah-merge-2019-09-09.
  - Update version logic to handle -shenandoah* tag suffix.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b09.
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-1
changelog:
  - Remove CVE-2018-3639 mitigation due to performance regression and
      OpenJDK position on speculative execution vulnerabilities.
      https://mail.openjdk.java.net/pipermail/vuln-announce/2019-July/000002.html
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b01-0.1.ea
changelog:
  - Revert SSBD removal for now, until appropriate messaging has been decided.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b05.
  - Attempt to fix Shenandoah formatting failures on S390, introduced by JDK-8232102.
  - Revise b05 snapshot to include JDK-8236178.
  - Add additional Shenandoah formatting fixes revealed by successful -Wno-error=format run
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b07.
  - Switch to GA mode for final release.
  - Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b08.
  - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-3
changelog:
  - Mark net.properties as a config file (based on Fedora patch by James Cassell)
  - Resolves: rhbz#1710928


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-4
changelog:
  - Update generate_source_tarball.sh script to use the PR3756 patch and retain the secp256k1 curve.
  - Regenerate source tarball using the updated script and add the -'4curve' suffix.
  - Resolves: rhbz#1746874


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-5
changelog:
  - Replace JDK-8231991 backport with upstream version and include JDK-8234107 fixup.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b08.
  - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions.
  - Fix paths in jdk8231991-mouse_wheel_focus.patch after git apply --stat complaints.
  - Resolves: rhbz#1785753


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.20-8.b26
changelog:
  - Add patches for PPC zero build.
  - Fixes stack overflow problem. See RHBZ#1015432.
  - Fixes missing memory barrier in Atomic::xchg*
  - Fixes missing PPC32/PPC64 defines for Zero builds on power.
  - Resolves: rhbz#1125260


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.20-9.b26
changelog:
  - Add hotspot compiler flag -fno-tree-vectorize which fixes the segfault in
    the bytecode verifier on ppc/ppc64.
  - Resolves: rhbz#1125260


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.20-10.b26
changelog:
  - Remove LIBDIR and funny definition of _libdir.
  - Fix rpmlint warnings about macros in comments.
  - Resolves: rhbz#1125260


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.25-3.b17
changelog:
  - added patch12,removeSunEcProvider-RH1154143
  - xdump excluded from ppc64le (rh1156151)
  - Add check for src.zip completeness. See RH1130490 (by sgehwolf@redhat.com)
  - Resolves: rhbz#1125260


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b01.
  - Switch to EA mode.
  - Adjust JDK-8199936/PR3533 patch following JDK-8227397 configure change
  - Remove local copies of JDK-8231991 & JDK-8234107 as replaced by upstream versions.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b03.
  - Adjust PR2974/RH1337583 & PR3083/RH1346460 following context changes in JDK-8230978
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b06-0.1.ea
changelog:
  - Sync SystemTap & desktop files with upstream IcedTea release 3.15.0, removing previous workarounds
  - Sync stapinstall handling with RHEL 8 implementation
  - Need to support noarch for creating source RPMs for non-scratch builds.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b07.
  - Require tzdata 2020a so system tzdata matches resource updates in b07
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b09.
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.4.ea
changelog:
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.5.ea
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Introduce jfr_arches for architectures which support JFR.
  - Introduce sa_arches for architectures which support the serviceability agent.
  - Introduce share_arches for architectures which support class sharing (-Xshare:dump).
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-1
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u265-b01.
  - Update release notes for 8u265 release.
  - Resolves: rhbz#1860456


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.265.b01-1
changelog:
  - ASSEMBLY_EXCEPTION LICENSE THIRD_PARTY_README moved to fully versioned dirs
  - Resolves: rhbz#1861222


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b05.
  - Fix context in JDK-8186464/RH1433262 patch, following JDK-8078334 @randomness tag addition.
  - Add additional s390 size_t case in g1ConcurrentMarkObjArrayProcessor.cpp introduced by JDK-8057003
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b05-shenandoah-merge-2020-08-28.
  - Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.2.ea
changelog:
  - Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b06.
  - Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Delay tzdata 2020b dependency until tzdata update has shipped.
  - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.275.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u275-b01 (GA)
  - Update release notes for 8u275.
  - Resolves: rhbz#1895062


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b01 (EA)
  - Update release notes for 8u282-b01.
  - Switch to EA mode.
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Remove PR3601, covered upstream by JDK-8062808.
  - Remove upstreamed JDK-8197981/PR3548, JDK-8062808/PR3548, JDK-8254177 & JDK-8215727.
  - Resolves: rhbz#1903903


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
  - Added patch600: rh1750419-redhat_alt_java.patch
  - Replaced alt-java placeholder with real patched alt-java
  - Removed patch529: rh1566890-CVE_2018_3639-speculative_store_bypass.patch
  - Removed patch531: rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Both surpassed by new patch
  - Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
  - Extend RH1750419 alt-java fix to include external debuginfo, following JDK-8252395 in 8u282-b01
  - Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b02 (EA)
  - Update release notes for 8u282-b02.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b03 (EA)
  - Update release notes for 8u282-b03.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b04 (EA)
  - Update release notes for 8u282-b04.
  - Remove upstreamed patch PR3519
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b05 (EA)
  - Update release notes for 8u282-b05 and make some minor corrections.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b06 (EA)
  - Update release notes for 8u282-b06.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b07 (EA)
  - Update release notes for 8u282-b07.
  - Fix placement issue in release notes, caught by comparing with vanilla version.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b08 (GA)
  - Update release notes for 8u282-b08.
  - This tarball is embargoed until 2021-01-19 @ 1pm PT.
  - Resolves: rhbz#1908963


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b03 (EA)
  - Update release notes for 8u292-b03.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b04 (EA)
  - Update release notes for 8u292-b04.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05 (EA)
  - Update release notes for 8u292-b05.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.1.ea
changelog:
  - Re-organise S/390 patches for upstream submission, separating 8u upstream from Shenandoah fixes.
  - Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
  - Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
  - Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813 in 8u.
  - Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are accurate.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b06 (EA)
  - Update release notes for 8u292-b06.
  - Require tzdata 2020f due to JDK-8259048
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b07 (EA)
  - Update release notes for 8u292-b07.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b08-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b08 (EA)
  - Update release notes for 8u292-b08.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b09 (EA)
  - Update release notes for 8u292-b09.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b10 (GA)
  - Update release notes for 8u292-b10.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1938201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b01 (EA)
  - Update release notes for 8u302-b01.
  - Switch to EA mode.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b02 (EA)
  - Update release notes for 8u302-b02.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03 (EA)
  - Update release notes for 8u302-b03.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
  - Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b04 (EA)
  - Update release notes for 8u302-b04.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b05 (EA)
  - Update release notes for 8u302-b05.
  - Remove JDK-8266929/RH1960024 as now upstream.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b06 (EA)
  - Update release notes for 8u302-b06.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
  - Update release notes for 8u302-b07.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b08 (EA)
  - Update release notes for 8u302-b08.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Fix configure script to use ppc64le, not ppc64.
  - Add ppc64le support to LIBJSOUND_CFLAGS.
  - Add a jvm.cfg for ppc64le
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Print contents of spec.gmk to see what is being passed to the HotSpot build.
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Set OPENJDK_TARGET_CPU_LEGACY to ppc64 so as not to mess up HotSpot build.
  - Add -DABI_ELFv2 to CFLAGS on ppc64le to match OpenJDK 7.
  - Print contents of hotspot-spec.gmk
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Override ppc64le as ppc64 only in hotspot-spec.gmk so as not to disrupt JDK build.
  - Add property test case from java-1.7.0-openjdk build.
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-6.b13
changelog:
  - Adjust ppc64le HotSpot patch for OpenJDK 8.
  - Enable AArch64 configure/JDK patch on all archs to minimise patching issues.
  - Adjust ppc64le patches to apply after the enableAArch64 patch.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b01 (EA)
  - Update release notes for 8u312-b01.
  - Switch to EA mode.
  - Remove "-clean" suffix as no 8u312 builds are unclean.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b02 (EA)
  - Update release notes for 8u312-b02.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b03 (EA)
  - Update release notes for 8u312-b03.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b04 (EA)
  - Update release notes for 8u312-b04.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05 (EA)
  - Update release notes for 8u312-b05.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
  - Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
  - Resolves: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.3.ea
changelog:
  - Add patch to improve performance of common separators in Scanner.useLocale
  - Move alt-java patch to correct section.
  - Resolves: rhbz#1862929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b07 (EA)
  - Update release notes for 8u312-b07.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b04 (EA)
  - Update release notes for 8u322-b04.
  - Require tzdata 2021c as of JDK-8274407.
  - Switch to EA mode.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2022809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-1
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Require tzdata 2021e as of JDK-8275766.
  - Update tarball generation script to use git following shenandoah-jdk8u's move to github
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b01 (EA)
  - Update release notes for shenandoah-8u332-b01.
  - Switch to EA mode.
  - Related: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b06 (EA)
  - Update release notes for shenandoah-8u332-b06.
  - Resolves: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-1
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-04-19 @ 1pm PT.
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-1
changelog:
  - Update to shenandoah-jdk8u342-b07
  - Update release notes for shenandoah-8u342-b07.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Remove redundant "REPOS" variable from tarball script
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Rebase JDK-8186464 patch so it applies after JDK-8190753
  - Resolves: rhbz#2106502


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-1
changelog:
  - Update to shenandoah-jdk8u345-b01 (GA)
  - Update release notes for 8u345-b01.
  - Resolves: rhbz#2112383


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Add test to ensure timezones can be translated
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.1.ea
changelog:
  - Update to shenandoah-jdk8u362-b07 (EA)
  - Update release notes for shenandoah-8u362-b07.
  - Switch to EA mode for 8u362 pre-release builds.
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150191


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Fix broken links and missing release notes in older releases.
  - Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
    - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
    - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
    - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-1
changelog:
  - Update to shenandoah-jdk8u372-b07 (GA)
  - Update release notes for shenandoah-8u372-b07.
  - Require tzdata 2023c due to inclusion of JDK-8305113 in 8u372-b07
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Include JDK-8271199 backport early ahead of 8u382 (RH2175317)
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2159458


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b01 (EA)
  - Update release notes for shenandoah-8u382-b01.
  - Switch to EA mode.
  - Remove JDK-8271199 patch which is now upstream.
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b04-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b04 (EA)
  - Update release notes for shenandoah-8u382-b04.
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u372-b05 (GA)
  - Update release notes for shenandoah-8u372-b05.
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u382-b05 (GA)
  - Update release notes for shenandoah-8u382-b05.
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-11319


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - Update to shenandoah-jdk8u392-b08 (GA)
  - Update release notes for shenandoah-8u392-b08.
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Regenerate PR2462 patch following JDK-8315135
  - Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12212
  - Resolves: RHEL-13574
  - Resolves: RHEL-13575
  - Resolves: RHEL-13576
  - Resolves: RHEL-11319
  - Resolves: RHEL-13577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-3
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19630


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b01 (EA)
  - Update release notes for shenandoah-8u402-b01.
  - Switch to EA mode.
  - Sync NEWS with vanilla branch version.
  - Related: RHEL-17914


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b06 (GA)
  - Update release notes for shenandoah-8u402-b06.
  - Drop local copy of JDK-8312489 which is now included upstream
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-17914
  - Resolves: RHEL-20965


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u412-b01 (EA)
  - Update release notes for shenandoah-8u412-b01.
  - Switch to EA mode.
  - Related: RHEL-30926


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Invoke xz in multi-threaded mode
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Remove -T0 argument from systemtap tar invocation
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Turn off xz multi-threading on i686 as it fails with an out of memory error
  - Normalise whitespace
  - Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
  - generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
  - generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
  - generate_source_tarball.sh: Adapt version logic to work with 8u
  - generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - Move maintenance scripts to a scripts subdirectory
  - icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
  - jconsole.desktop.in: Restored by running icedtea_sync.sh
  - policytool.desktop.in: Likewise.
  - Restore IcedTea sources correctly in spec file
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Handle an existing checkout
  - generate_source_tarball.sh: Sync indentation with java-21-openjdk version
  - generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.1.ea
changelog:
  - Update to shenandoah-jdk8u412-b07 (EA)
  - Update release notes for shenandoah-8u412-b07.
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Resolves: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-1
changelog:
  - Update to shenandoah-jdk8u412-b08 (GA)
  - Update release notes for shenandoah-8u412-b08.
  - Complete release note for Certainly roots
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Related: RHEL-30926


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 1:1.8.0.402.b06-1.tuxcare.els1
changelog:
  - Upgrade to shenandoah-jdk8u402-b06. That fixes following CVEs:
  - CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler
  - CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution
  - CVE-2024-20921: Range check loop optimization issue
  - CVE-2024-20926: Arbitrary Java code execution in Nashorn
  - CVE-2024-20945: Logging of digital signature private keys
  - CVE-2024-20952: RSA padding issue and timing side-channel attack against TLS
  - Remove JDK-8312489 patch which is already in the sources


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1:1.8.0.412.b08-1.tuxcare.els1
changelog:
  - Upgrade to shenandoah-jdk8u412-b08. That fixes the following CVEs:
  - CVE-2024-21011: Denial of service due to long Exception message logging
  - CVE-2024-21085: Pack200 excessive memory allocation
  - CVE-2024-21068: Integer overflow in C1 compiler address generation
  - CVE-2024-21094: Unauthorized data modification due to C2 compilation failure
    with "Exceeded _node_regs array"


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1:1.8.0.422.b05-1.tuxcare.els1
changelog:
  - Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u422-b05. That fixes following CVEs:
  - CVE-2024-21131: UTF8 size overflow
  - CVE-2024-21138: Infinite loop vunlerability in SymbolTable
  - CVE-2024-21140: Int overflow/underflow in Range Check Elimination (RCE)
  - CVE-2024-21144: Invalid header validation leads to Pack200 excessive loading time
  - CVE-2024-21145: Out-of-bounds access in MaskFill
  - CVE-2024-21147: Out-of-bounds array index in Range Check Elimination (RCE)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-27.b13
changelog:
  - updated to security u45
  - minor sync with 7.2
   - generate_source_tarball.sh
   - adapted java-1.8.0-openjdk-s390-java-opts.patch and java-1.8.0-openjdk-size_t.patch
   - reworked (synced) zero patches (removed 103,11 added 204, 400-403)
   - family of 5XX patches renamed to 6XX
   - added upstreamed patch 501 and 505
   - included removeSunEcProvider-RH1154143.patch
  - returned java (jre only) provides
  - repacked policies (source20)
  - removed duplicated NVR provides
  - added automated test for priority (length7)
  - Resolves: RHBZ#1209076


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-7.b13
changelog:
  - Re-add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Remove ppc64le test case now fix has been verified.
  - Resolves: rhbz#1194378


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> 1:1.8.0.452.b09-1.tuxcare.els1
changelog:
  - Upgrade openjdk-shenandoah-jdk8u-shenandoah-jdk8u452-b09. That fixes the following CVE:
    CVE-2025-21587, CVE-2025-30691 and CVE-2025-30698


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 1:1.8.0.462.b08-1.tuxcare.els1
changelog:
  - Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08 (GA). That fixes following CVEs:
  - CVE-2025-30749: better Glyph drawing
  - CVE-2025-30754: enhance TLS protocol support
  - CVE-2025-30761: improve scripting supports
  - CVE-2025-50106: glyph out-of-memory access and crash


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1:1.8.0.482.b03-1.tuxcare.els1
changelog:
  - Update to openjdk-shenandoah-jdk8u-shenandoah-jdk8u482-b03.
  - CVE-2026-21945: Security component vulnerability allowing unauthenticated
    attacker with network access to cause hang or crash (DoS).


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1:1.8.0.492.b09-1.tuxcare.els1
changelog:
  - Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u492-b09 (GA). That
    fixes following CVEs:
  - CVE-2026-22003: hotspot DoS via sandboxed Java Web Start/applets with
    untrusted code (resource exhaustion)
  - CVE-2026-22007: Security component, local high-complexity low-impact
    info disclosure
  - CVE-2026-22013: JGSS, remote (user-interaction) high-confidentiality
    info disclosure
  - CVE-2026-22016: JAXP, remote unauth high-confidentiality info disclosure
  - CVE-2026-22018: Libraries, remote high-complexity DoS (low impact)
  - CVE-2026-22021: JSSE/HTTPS, remote unauth DoS (low impact)
  - CVE-2026-34268: Security component, local high-complexity low-impact
    info disclosure
  - CVE-2026-34282: Networking, remote unauth DoS (high availability impact)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-0.b16
changelog:
  - July 2015 security update to u51b16.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Add patches for RH issues fixed in IcedTea 2.x and/or the upcoming u60.
  - Use 'openjdk' as directory prefix to allow patch interchange with IcedTea.
  - Re-generate EC disablement patch following CPU DH changes.
  - Resolves: rhbz#1235162


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-1.b16
changelog:
  - Add md5sum for January 2015 java.security update so it gets updated this time.
  - Resolves: rhbz#1235162


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-0.b17
changelog:
  - October 2015 security update to u65b17.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Update RH1191652 patch to build against current AArch64 tree.
  - Use appropriate source ID to avoid unpacking both tarballs on AArch64.
  - Add MD5 checksums for java.security from 8u51 and 8u60 RPMs.
  - Resolves: rhbz#1257656


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-36.b13
changelog:
  - Correctly fix system timezone data issue by depending on correct tzdata version.
  - Remove reference to tz.properties which is no longer used.
  - Resolves: rhbz#1212571


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-0.b16
changelog:
  - July 2015 security update to u51b16.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Add patches for RH issues fixed in IcedTea 2.x and/or the upcoming u60.
  - Use 'openjdk' as directory prefix to allow patch interchange with IcedTea.
  - Re-generate EC disablement patch following CPU DH changes.
  - Resolves: rhbz#1235163


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-1.b16
changelog:
  - Re-introduce handling of java.security updates, with new md5sum of Jan 2015 version.
  - Resolves: rhbz#1235163


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-0.b17
changelog:
  - October 2015 security update to u65b17.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Update RH1191652 patch to build against current AArch64 tree.
  - Use appropriate source ID to avoid unpacking both tarballs on AArch64.
  - Add MD5 checksums for java.security from 8u51 and 8u60 RPMs.
  - Resolves: rhbz#1257657


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-4.b17
changelog:
  - moved to integration forest 
  - sync with fedora (all but extracted luas and family)
  - Resolves: rhbz#1295753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-0.b15
changelog:
  - January 2016 security update to u71b15.
  - Improve verbosity and helpfulness of tarball generation script.
  - Remove RH1290936 workaround as RHEL does not have the hardened flags nor ARM32.
  - Update patch documentation using version originally written for Fedora.
  - Drop prelink requirement as we no longer use execstack.
  - Drop ifdefbugfix patch as this is fixed upstream.
  - Provide optional boostrap build and turn it off by default.
  - Turn off additional CFLAGS/LDFLAGS on AArch64 as bootstrapping failed.
  - Add patch for size_t formatting on s390 as size_t != intptr_t there.
  - Resolves: rhbz#1295753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Restore upstream version of system LCMS patch removed by 'sync with Fedora'
  - Add patch to turn off strict overflow on IndicRearrangementProcessor{,2}.cpp
  - Resolves: rhbz#1295753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-0.b03
changelog:
  - Update to u77b03.
  - Drop 8146566 which is applied upstream.
  - Replace s390 Java options patch with general version from IcedTea.
  - Apply s390 patches unconditionally to avoid arch-specific patch failures.
  - Remove fragment of s390 size_t patch that unnecessarily removes a cast, breaking ppc64le.
  - Remove aarch64-specific suffix as update/build version are now the same as for other archs.
  - Only use z format specifier on s390, not s390x.
  - Adjust tarball generation script to allow ecc_impl.h to be included.
  - Correct spelling mistakes in tarball generation script.
  - Synchronise minor changes from Fedora.
  - Use a simple backport for PR2462/8074839.
  - Don't backport the crc check for pack.gz. It's not tested well upstream.
  - Resolves: rhbz#1320664


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-0.b03
changelog:
  - Remove what remains of the SunEC sources in the remove-intree-libraries script.
  - Resolves: rhbz#1320664


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-0.b14
changelog:
  - Enable a full bootstrap on JIT archs. Full build held back by Zero archs anyway.
  - Resolves: rhbz#1325422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-0.b14
changelog:
  - Add 8132051 port to Zero.
  - Turn on bootstrap build for all to ensure we are now good to go.
  - Resolves: rhbz#1325422


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.22-6
changelog:
  - Add patch, JDK-8210416-RHBZ-1624122-fdlibm-opt-fix.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, JDK-8210425-RHBZ-1624122-sharedRuntimeTrig-opt-fix.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, JDK-8210647-RHBZ-1624122-libsaproc-opt-fix.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, JDK-8210703-RHBZ-1624122-vmStructs-opt-fix.patch, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - No longer filter -O flags from C flags coming from
    redhat-rpm-config.
  - Resolves: RHBZ#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-5
changelog:
  - Add patch, RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch,
    so as to disable dsin/dcos math intrinsics on aarch64. Work-around for
    JDK-8210461.
  - Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-6
changelog:
  - Add patch, RHBZ-1630996-JDK-8210858-workaround-disable-aarch64-intrinsic-log.patch,
    so as to disable log math intrinsic on aarch64. Work-around for
    JDK-8210858
  - Resolves: rhbz#1570856


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.28-8
changelog:
  - removed version less provides
  - javadocdir moved to arched dir as it is no longer noarch
  - Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-9
changelog:
  - Rework changes from 1:11.0.ea.22-6. RHBZ#1632174 supercedes
    RHBZ-1624122.
  - Add patch, JDK-8210416-RHBZ-1632174-fdlibm-opt-fix.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, JDK-8210425-RHBZ-1632174-sharedRuntimeTrig-opt-fix.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, JDK-8210647-RHBZ-1632174-libsaproc-opt-fix.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, JDK-8210761-RHBZ-1632174-libjsig-opt-fix.patch, so as to
    optimize compilation of libjsig.
  - Add patch, JDK-8210703-RHBZ-1632174-vmStructs-opt-fix.patch, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - Reinstate filtering of opt flags coming from redhat-rpm-config.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.0.28-1
changelog:
  - Identify as GA version and no longer as early access (EA).
  - JDK 11 has been released for GA on 2018-09-25.


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-5
changelog:
  - Redefined linux -> __linux__ and __x86_64 -> __x86_64__ in RH1750419 patch
  - Resolves: rhbz#1901695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-5
changelog:
  - Introduced ssbd_arches to denote architectures with SSBD mitigation (currently only x86_64)
  - Introduced nm-based check to verify alt-java on ssbd_arches is patched, and no other alt-java or java binaries are patched
  - RH1750419 patch amended to emit a warning on architectures where alt-java is the same as java
  - Resolves: rhbz#1901695


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.1-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+1
  - Update release notes to 11.0.10.0+1
  - Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly.
  - Still use 11.0.x rather than 11.0.x.0 for file naming, as the trailing zero is omitted from tags.
  - Revert configure and built_doc_archive hacks to build 11.0.9.1 from 11.0.9.0 sources, and synced with Fedora version.
  - Cleanup debug package descriptions and version number placement.
  - Switch to EA mode for 11.0.10 pre-release builds.
  - Drop JDK-8222286 & JDK-8254177 as applied upstream
  - Explicitly request bundled Harfbuzz (too risky to change this so late in the RHEL 7 lifecycle)
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.2-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+2
  - Update release notes to 11.0.10.0+2
  - Update tarball generation script to use PR3818 which handles JDK-8171279 changes
  - Drop JDK-8250861 as applied upstream.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.2-0.0.ea
changelog:
  - Completely revert hacks from previous release, using buildver in configure and tzdata 2020b
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.5-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+5
  - Update release notes to 11.0.10.0+5
  - Drop JDK-8222527 as applied upstream.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.8-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+8
  - Update release notes to 11.0.10.0+8 and add missing JDK-8245051 from b04.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-0
changelog:
  - Update to jdk-11.0.10.0+9
  - Update release notes to 11.0.10.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-01-19 @ 1pm PT.
  - Resolves: rhbz#1908970


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.0.ea
changelog:
  - Update to jdk-11.0.11.0+2
  - Update release notes to 11.0.11.0+2
  - Remove local backport of JDK-8258836 which is now available upstream.
  - Resolves: rhbz#1938082


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.1.ea
changelog:
  - Perform static library build on a separate source tree with bundled image libraries
  - Make static library build optional
  - Based on initial work by Severin Gehwolf
  - Resolves: rhbz#1930527


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.1.ea
changelog:
  - Debug builds need to find their documentation from the release build.
  - RHEL 7 builds still include a doc package for debug builds, though debug builds do not build docs.
  - Resolves: rhbz#1930527


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:11.0.11.0.3-0.1.ea
changelog:
  - Fix issue where CheckVendor.java test erroneously passes when it should fail.
  - Add proper quoting so '&' is not treated as a special character by the shell.
  - Resolves: rhbz#1938082


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.9-0
changelog:
  - Update to jdk-11.0.11.0+9
  - Update release notes to 11.0.11.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1940228


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.1-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+1
  - Update release notes to 11.0.12.0+1
  - Switch to EA mode for 11.0.12 pre-release builds.
  - Update ECC patch following JDK-8226374 (bug ID yet to be confirmed)
  - Remove local JDK-8187450 backport as now included upstream.
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.4-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+4
  - Update release notes to 11.0.12.0+4
  - Correct bug ID JDK-8264846 to intended ID of JDK-8264848
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.6-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+6
  - Update release notes to 11.0.12.0+6
  - Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-0
changelog:
  - Update to jdk-11.0.12.0+7
  - Update release notes to 11.0.12.0+7
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-3
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Related: rhbz#1999936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.13.0+1
  - Update release notes to 11.0.13.0+1
  - Update tarball generation script to use git following OpenJDK 11u's move to github
  - Switch to EA mode for 11.0.13 pre-release builds.
  - Remove non-Free test from source tarball.
  - Related: rhbz#1999936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-1
changelog:
  - Update to jdk-11.0.12.0+8
  - Update release notes to 11.0.12.0+8
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2012332


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Replaced hardcoded 11 by featurever where appropriate
  - Fixed comment of `for slowdebug` to correct `any debug`
  - Related: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.14.0+8
  - Update release notes to 11.0.14.0+8
  - Switch to EA mode for 11.0.14 pre-release builds.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Rename blacklisted.certs to blocked.certs following JDK-8253866
  - Resolves: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-1
changelog:
  - Update to jdk-11.0.14.0+9
  - Update release notes to 11.0.14.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-01-18 @ 1pm PT.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.15.0+1
  - Update release notes to 11.0.15.0+1
  - Switch to EA mode for 11.0.15 pre-release builds.
  - Related: rhbz#2047531


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-1
changelog:
  - Update to jdk-11.0.15.0+9
  - Update release notes to 11.0.15.0+9
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-2
changelog:
  - Remove security items from release notes that were only in 17u and N/A for 11u
  - Related: rhbz#2073422


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Add additional patch during tarball generation to align tests with ECC changes
  - Related: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Update to jdk-11.0.16+8
  - Update release notes to 11.0.16+8
  - Use same tarball naming style as java-17-openjdk and java-latest-openjdk
  - Drop JDK-8284920 patch now upstreamed
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-1
changelog:
  - Update to jdk-11.0.16.1+1
  - Update release notes to 11.0.16.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119512


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.17+1
  - Update release notes to 11.0.17+1
  - Switch to EA mode for 11.0.17 pre-release builds.
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Include Aleksey's patch for JDK-8291053 to try and get HarfBuzz to build again
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Try to build using system HarfBuzz to avoid build failures with 4.4.1 & gcc 4.8.5
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-1
changelog:
  - Update to jdk-11.0.17+8 (GA)
  - Update release notes to 11.0.17+8
  - Switch to GA mode for release
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - Remove unneeded JDK-8291053 patch as we no longer build in-tree HarfBuzz
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.18+1
  - Update release notes to 11.0.18+1
  - Switch to EA mode for 11.0.18 pre-release builds.
  - Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e
  - Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.2.ea
changelog:
  - Update to jdk-11.0.18+9
  - Update release notes to 11.0.18+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-1
changelog:
  - Update to jdk-11.0.18+10 (GA)
  - Update release notes to 11.0.18+10
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
  - Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-1
changelog:
  - Update to jdk-11.0.19.0+7
  - Update release notes to 11.0.19.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Rebase RH1750419 alt-java patch against 11.0.19+6
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-9
changelog:
  - Rework changes from 1:11.0.ea.22-6. RHBZ#1632174 supercedes
    RHBZ-1624122.
  - Add patch, jdk8210416-rh1632174-compile_fdlibm_with_o2_ffp_contract_off_on_gcc_clang_arches.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, jdk8210425-rh1632174-sharedRuntimeTrig_sharedRuntimeTrans_compiled_without_optimization.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, jdk8210647-rh1632174-libsaproc_is_being_compiled_without_optimization.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, jdk8210761-rh1632174-libjsig_is_being_compiled_without_optimization.patch, so as to
    optimize compilation of libjsig.
  - Add patch, jdk8210703-rh1632174-vmStructs_cpp_no_longer_compiled_with_o0, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - Reinstate filtering of opt flags coming from redhat-rpm-config.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.1.13-3
changelog:
  - Use upstream's version of Aarch64 intrinsics disable patch:
    - Removed:
      RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch
      RHBZ-1630996-JDK-8210858-workaround-disable-aarch64-intrinsic-log.patch
    - Superceded by:
      jdk8211105-aarch64-disable_cos_sin_and_log_intrinsics.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.1.13-4
changelog:
  - Update to shenandoah-jdk-11.0.1+13-20190101
  - Update tarball generation script in preparation for PR3681/RH1656677 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Fix remove-intree-libraries.sh to not exit early and skip SunEC handling.
  - Fix PR1983 SunEC patch so that ecc_impl.h is patched rather than added
  - Add missing RH1022017 patch to reduce curves reported by SSL to those we support.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-0
changelog:
  - Update to shenandoah-jdk-11.0.2+7 (January 2019 CPU)
  - Make tagsuffix optional and comment it out while unused.
  - Drop JDK-8211105/RH1628612/RH1630996 applied upstream.
  - Drop JDK-8209639/RH1640127 applied upstream.
  - Re-generate JDK-8210416/RH1632174 following JDK-8209786
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.20+1 (EA)
  - Update release notes to 11.0.20+1
  - Switch to EA mode
  - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 11.0.20+1
  - Add missing Swing release note
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
changelog:
  - Update to jdk-11.0.20.0+8 (GA)
  - Update release notes to 11.0.20.0+8
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
  - Update to jdk-11.0.20.1+1 (GA)
  - Update release notes to 11.0.20.1+1
  - Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
  - Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Synchronise runtime and buildtime tzdata requirements
  - Update README.md to match the version in later RHEL releases
  - Resolves: rhbz#2236229


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.21.0.9-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-11320


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-1
changelog:
  - Update to jdk-11.0.21+9 (GA)
  - Update release notes to 11.0.21+9
  - Remove system crypto policy patch which doesn't belong on RHEL 7 with no system policies
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Apply all patches using -p1
  - Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12217
  - Resolves: RHEL-12910
  - Resolves: RHEL-12913
  - Resolves: RHEL-11320
  - Resolves: RHEL-13227
  - Resolves: RHEL-13217


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19642


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.6-0.1.ea
changelog:
  - Update to jdk-11.0.22+6 (EA)
  - Update release notes to 11.0.22+6
  - Switch to EA mode
  - Drop local copy of JDK-8312489 which is now included upstream
  - Resolves: RHEL-21031


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
changelog:
  - Update to jdk-11.0.22+7 (GA)
  - Update release notes to 11.0.22+7
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-20966


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.23+1 (EA)
  - Update release notes to 11.0.23+1
  - Switch to EA mode
  - Speed up PPC build by removing ppc64le --with-jobs=1 workaround


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-1
changelog:
  - Update to jdk-11.0.23+9 (GA)
  - Update release notes to 11.0.23+9
  - Switch to GA mode for release
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-30914


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-2
changelog:
  - Fix 11.0.22 release date in NEWS
  - Restore ppc64le --with-jobs=1 workaround to avoid flaky ppc builds


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.3.6-0
changelog:
  - Update to shenandoah-jdk-11.0.3+6 (April 2019 EA)
  - Drop JDK-8210416/RH1632174 applied upstream.
  - Drop JDK-8210425/RH1632174 applied upstream.
  - Drop JDK-8210647/RH1632174 applied upstream.
  - Drop JDK-8210761/RH1632174 applied upstream.
  - Drop JDK-8210703/RH1632174 applied upstream.
  - Add cast to resolve s390 ambiguity in call to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.1.13-8
changelog:
  - Fix remove-intree-libraries.sh to not exit early and skip SunEC handling.
  - Fix PR1983 SunEC patch so that ecc_impl.h is patched rather than added
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-4
changelog:
  - Replace pcsc-lite-devel with pcsc-lite-libs so deps can be resolved without optional repository
  - Add JDK-8009550/RH910107 patch so OpenJDK checks for libpcsclite.so.1 (in pcsc-lite-libs)
  - Add missing ISA to cups-libs requirement
  - Remove duplicate lksctp-tools requirement
  - Resolves: rhbz#1684617


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.3.6-1
changelog:
  - Update to shenandoah-jdk-11.0.3+6 (April 2019 EA)
  - Drop JDK-8210416/RH1632174 applied upstream.
  - Drop JDK-8210425/RH1632174 applied upstream.
  - Drop JDK-8210647/RH1632174 applied upstream.
  - Drop JDK-8210761/RH1632174 applied upstream.
  - Drop JDK-8210703/RH1632174 applied upstream.
  - Resolves: rhbz#1677516


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.4.11-0
changelog:
  - Update to shenandoah-jdk-11.0.4+11 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.1-0.0.ea
changelog:
  - Update to shenandoah-jdk-11.0.5+1 (EA)
  - Switch to EA mode for 11.0.5 pre-release builds.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.10-0
changelog:
  - Update to shenandoah-jdk-11.0.5+10 (GA)
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.1-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.6+1 (EA)
  - Switch to EA mode for 11.0.6 pre-release builds.
  - Add support for jfr binary.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-0
changelog:
  - Update to shenandoah-jdk-11.0.6+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-3
changelog:
  - Add JDK-8237396 backport to resolve Shenandoah TCK breakage in traversal mode.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.7.10-0
changelog:
  - Update to shenandoah-jdk-11.0.7+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


