# changelog

author: Rich Megginson <rmeggins@redhat.com> - 1.1.0-1
changelog:
  - rebase timesync role to latest upstream
    Resolves rhbz#1937938
  - timesync - add timesync_chrony_custom_settings variable for free-form
    local configs
    Resolves rhbz#1938023
  - do not use ignore_errors in timesync role
    Resolves rhbz#1938014
  - support for timesync_max_distance to configure maxdistance/maxdist parameter
    Resolves rhbz#1938016
  - support for ntp xleave, filter, and hw timestamping
    Resolves rhbz#1938020
  - rebase selinux role to latest upstream
    Resolves rhbz#1937938
  - should not reload the SELinux policy if its not changed
    Resolves rhbz#1757869
  - Ability to install custom SELinux module via Ansible
    Resolves rhbz#1848683
  - rebase storage role to latest upstream
    Resolves rhbz#1937938
  - rebase network role to latest upstream
    Resolves rhbz#1937938
  - support for ipv6_disabled to disable ipv6 for address
    Resolves rhbz#1939711
  - rebase postfix role to latest upstream
    Resolves rhbz#1937938
  - rebase metrics role to latest upstream
    Resolves rhbz#1937938
  - rebase sshd role to latest upstream
    Resolves rhbz#1937938
  - rebase remaining roles to latest upstream
    Resolves rhbz#1937938
  - Generate %files dynamically
  - add vpn role
    Resolves rhbz#1943679


author: Rich Megginson <rmeggins@redhat.com> - 1.2.0-1
changelog:
  - rebase roles to latest upstream
    Resolves rhbz#1957876
  - use FQRN in postfix README
    Resolves rhbz#1958963
  - use relayhost in postfix README
    Resolves rhbz#1866544
  - network - Add support for ETHTOOL Ring option
    Resolves rhbz#1959649
  - storage: calltrace observed when set type: partition for storage_pools
    Resolves rhbz#1854187


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.1-1
changelog:
  - fix logging README.html examples' rendering problems
    Resolves rhbz#1962374
  - fix broken internal links in README.md files
    Resolves rhbz#1962976


author: Rich Megginson <rmeggins@redhat.com> - 1.2.2-1
changelog:
  - fix kdump tests_ssh for basic smoke test
    Resolves rhbz#1957876
  - ha_cluster - cannot read preshared key in binary format
    Resolves rhbz#1952620
  - Add hybrid_e2e option to PTP domain
    Resolves rhbz#1957849


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.2-2
changelog:
  - Make spec file available for older versions of OSes.
  - Drop python3-six dependency which was used by lsr_role2collection.py.
  - Drop html files from rpm if the version has no markdown parser.
  - Drop unnecessary python scripts which include python3 only code, e.g.,
    f-strings.
  - auto_maintenance - ability to convert "- ROLENAME" to "- FQCN" in the doc files such as README
  - auto_maintenance - lsr_role2collection.py - Adding encoding="utf-8" to open.
    Resolves rhbz#1957876


author: Rich Megginson <rmeggins@redhat.com> - 1.2.2-3
changelog:
  - Fix HTML rendering of internal links when using pandoc/asciidoc
  - Uses pandoc gfm instead of markdown_github
    Resolves rhbz#1962976


author: Sergei Petrosian <spetrosi@redhat.com> - 1.2.3-3
changelog:
  - Make the ansible_collection_files macro defined in Fedora automatically and
    in RHEL manually consistent - having slash at the end to clean double-slashes


author: Rich Megginson <rmeggins@redhat.com> - 1.3.0-1
changelog:
  - ha_cluster - add pacemaker resources configuration
    Resolves rhbz#1963283
  - ha_cluster - code cleanup
    Resolves rhbz#1970666
  - Postfix RHEL system role README.md missing variables under the "Role Variables" section
    Resolves rhbz#1961858
  - logging README.html examples are rendered incorrectly
    Resolves rhbz#1962374
  - make postfix role idempotent - round 2
    Resolves rhbz#1960375
  - selinux task for semanage says Fedora in name but also runs on RHEL/CentOS 8
    Resolves rhbz#1966681
  - metrics role task to enable logging for targeted hosts not working
    Resolves rhbz#1967335
  - network - Add 'auto_gateway' option
    Resolves rhbz#1897565
  - network - Only show stderr_lines by default
    Resolves rhbz#1970666
  - storage - LVMVDO support
    Resolves rhbz#1882475
  - storage - fix several linter issues
    Resolves rhbz#1970666
  - ssh - Fix variable precedence when invoked through roles
    Resolves rhbz#1966711
  - ssh - Update configuration options list for OpenSSH 8.6
    Resolves rhbz#1970666
  - sshd - Fix variable precedence when invoked through roles
    Resolves rhbz#1966711
  - sshd - Update configuration options list for OpenSSH 8.6
    Resolves rhbz#1970666
  - sshd - support for appending a snippet to configuration file
    Resolves rhbz#1970642
  - timesync - add NTS support
    Resolves rhbz#1970664
  - timesync - rebase to latest
    Resolves rhbz#1970666
  - nbde_client - rebase to latest
    Resolves rhbz#1970666


author: Rich Megginson <rmeggins@redhat.com> - 1.4.1-1
changelog:
  - network - Re-running the network system role results in "changed: true" when nothing has actually changed
    Resolves rhbz#1943384
  - network - Test tests_bond_initscripts.yml failed to create interface
    Resolves rhbz#1918210


author: Rich Megginson <rmeggins@redhat.com> - 1.4.2-1
changelog:
  - storage - relabel doesn't support - Fixed volume relabeling
    Resolves rhbz#1876315 (EL8)
    Resolves rhbz#1982841 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.4.3-1
changelog:
  - crypto_policies - rename 'policy modules' to 'subpolicies'
    Resolves rhbz#1982896 (EL9)
    Resolves rhbz#1982897 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.5.0-1
changelog:
  - ha_cluster - add pacemaker cluster properties configuration
    Resolves rhbz#1982913 (EL8)
    Resolves rhbz#1982906 (EL9)


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.5.1-1
changelog:
  - Error: device becoming unmanaged and pytest not reproducible in tests_integration_pytest.yl
    Resolves rhbz#1985382 (EL9)
    Resolves rhbz#1932699 (EL8)
  - EPEL yum repository configuration for tests
    Rebasing to latest picks up this fix - see rhel7 bz1980439
  - connections: workaround DeprecationWarning for NM.SettingEthtool.set_feature()
    Rebasing to latest picks up this fix


author: Rich Megginson <rmeggins@redhat.com> - 1.6.0-1
changelog:
  - network - Skip tests on RHEL9 that use hostapd
    Resolves rhbz#1945348
  - network - Fix the bond test on DHCP
    Resolves rhbz#1918252
  - storage - Add support for percentage-based volume sizes
    Resolves rhbz#1984583 (EL9)
    Resolves rhbz#1894642 (EL8)
  - storage -storage_test_actual_size != storage_test_requested_size observed with tests_lvm_auto_size_cap.yml
    Resolves rhbz#1986284 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.6.1-1
changelog:
  - network - tests_provider_nm.yml fails with an error: Failure in test 'I can manage a veth interface with NM after I managed it with initscripts.
    Resolves rhbz#1935919
  - network - _initscripts tests fail because "No package network-scripts available."
    Resolves rhbz#1935916
  - network - Test tests_bond_initscripts.yml failed to create interface
    Resolves rhbz#1980870
  - storage - covscan error - DEADCODE - vdopool if create_vdo else parent
    Resolves rhbz#1985571 (EL9)
    Resolves rhbz#1985572 (EL8)
  - network - network: tests_bond_initscripts.yml leaves behind unusable resolv.conf in CI
    Resolves rhbz#1915017


author: Rich Megginson <rmeggins@redhat.com> - 1.6.2-1
changelog:
  - metrics - Grafana dashboard not working after metrics role run unless services manually restarted
    Resolves rhbz#1984150 (EL9)
    Resolves rhbz#1978357 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.6.3-1
changelog:
  - storage - tag tests that use NVME and SCSI
    Resolves rhbz#1989211 (EL9)
    Resolves rhbz#1989638 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.6.4-1
changelog:
  - sshd - support for rhel9 managed hosts
    Resolves rhbz#1989221 (EL9)
    Resolves rhbz#1989638 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.6.6-1
changelog:
  - logging, certificate - Instead of the archive module, use "tar" command for backup.
    Resolves rhbz#1984182 (EL9)
    Resolves rhbz#1987096 (EL8)
  - logging - Add a support for list value to server_host in the elasticsearch output
    Resolves rhbz#1986460 (EL9)
    Resolves rhbz#1986463 (EL8)
  - logging - tests_relp.yml; Can't detect any of the required Python libraries cryptography (>= 1.2.3) or PyOpenSSL (>= 0.6)
    Resolves rhbz#1989962 (EL9)
    Resolves rhbz#1990142 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.6.7-1
changelog:
  - storage - tests_create_lvmvdo_then_remove fails - Module dm-vdo not found
    Resolves rhbz#1991141 (EL8)
    Resolves rhbz#1991062 (EL9)
  - storage - Get syntax errors in tests_lvm_errors.yml
    Resolves rhbz#1990793 (EL8)
    Resolves rhbz#1991142 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.7.0-1
changelog:
  - drop support for Ansible 2.8 - min_ansible_version is now 2.9
    Resolves rhbz#1989197 (EL9)
    Resolves rhbz#1989199 (EL8)
  - sshd - fix rhel6 support - failed to validate: error:Missing Match criteria for all Bad Match condition
    Resolves rhbz#1991598 (EL9)
    Resolves rhbz#1990947 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.7.1-1
changelog:
  - metrics - the bpftrace role does not properly configure bpftrace agent
    Resolves rhbz#1994180 (EL9)
    Resolves rhbz#1993240 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.7.2-1
changelog:
  - logging - Update the certificates copy tasks
    Resolves rhbz#1996777 (EL9)
    Resolves rhbz#1994580 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.7.3-1
changelog:
  - storage - revert the dm-vdo workaround fix for vdo testing
    Resolves rhbz#1978488 (EL9)
    Resolves rhbz#1991141 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.7.3-2
changelog:
  - selinux - tag tests_selinux_disabled.yml with tests::avc
    Resolves rhbz#1996315 (EL9)
    Resolves rhbz#1996317 (EL8)


author: Rich Megginson <rmeggins@redhat.com> - 1.10.0-1
changelog:
  - add cockpit role
    Resolves rhbz#2021661 (EL8)
    Resolves rhbz#2021028 (EL9)
  - add firewall role
    Resolves rhbz#1854988 (EL8)
    Resolves rhbz#2021665 (EL9)
  - firewall - add ability to add-source
    Resolves rhbz#1932678 (EL8)
    Resolves rhbz#2021667 (EL9)
  - firewall - allow user defined zones
    Resolves rhbz#1850768 (EL8)
    Resolves rhbz#2021669 (EL9)
  - firewall - allow specifying the zone
    Resolves rhbz#1850753 (EL8)
    Resolves rhbz#2021670 (EL9)
  - updates for ansible 2.12 support
    Resolves rhbz#2012316 (EL8)
    Resolves rhbz#2012298 (EL9)
  - update community.general to 4.0.1
    Resolves rhbz#2006081 (EL8)
    Resolves rhbz#2006076 (EL9)
  - network - Allow to specify PCI address to configure profiles
    Resolves rhbz#1695634 (EL8)
    Resolves rhbz#1999162 (EL9)
  - network - support wifi Enhanced Open (OWE)
    Resolves rhbz#1993379 (EL8)
    Resolves rhbz#1993377 (EL9)
  - network - support WPA3 Simultaneous Authentication of Equals(SAE)
    Resolves rhbz#1993311 (EL8)
    Resolves rhbz#1993304 (EL9)
  - network - RFE: Support ignoring default gateway retrieved by DHCP/IPv6-RA
    Resolves rhbz#1897565 (EL8)
    Resolves rhbz#1978773 (EL9)
  - network - Update network system role to reflect that network teaming is deprecated in RHEL 9
    Resolves rhbz#1897565 (EL8)
    Resolves rhbz#1999770 (EL9)
  - selinux - fails linit rules role-name and unnamed-task
    Resolves rhbz#1974000 (EL8)
    Resolves rhbz#2021675 (EL9)
  - kernel_settings - ansible_managed | comment BZs:
    Resolves rhbz#2006230 (EL9)
    Resolves rhbz#2006231 (EL8)
    Resolves rhbz#2006233 (EL7)
  - logging - logging role missing quotes for immark module interval value
    Resolves rhbz#2021678 (EL8)
    Resolves rhbz#2021676 (EL9)
  - logging - Add user and password
    Resolves rhbz#2010327 (EL8)
    Resolves rhbz#1990490 (EL9)
  - logging - Performance improvement
    Resolves rhbz#2005727 (EL8)
    Resolves rhbz#2004303 (EL9)
  - nbde_client - add regenerate-all to the dracut command
    Resolves rhbz#2021682 (EL8)
    Resolves rhbz#2021681 (EL9)
  - certificate - Fix certificate permissions with "group" option
    Resolves rhbz#2021683 (EL8)
    Resolves rhbz#2021025 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.11.0-1
changelog:
  - timesync - fix ansible 2.12 issues, service_facts issues
    Resolves rhbz#2012316 (EL8)
    Resolves rhbz#2012298 (EL9)
  - timesync - Failure related to missing ntp/ntpd package/service on RHEL-9 host
    Resolves rhbz#2029463 (EL9)
  - logging - add test case for immark quoting issue
    Resolves rhbz#2021678 (EL8)
    Resolves rhbz#2021676 (EL9)
  - cockpit - use existing cert - cockpit_cert, cockpit_private_key
    Resolves rhbz#2021661 (EL8)
    Resolves rhbz#2021028 (EL9)
  - storage - fix ansible 2.12 issues, service_facts issues; workaround lvm, udev issues in tests
    Resolves rhbz#2012316 (EL8)
    Resolves rhbz#2012298 (EL9)
  - ssh - tests_all_options.yml: "assertion": "'StdinNull yes' in config.content | b64decode ", failure
    Resolves rhbz#2029614 (EL8)
    Resolves rhbz#2029427 (EL9)
  - kdump - support reboot required and reboot ok
    Resolves rhbz#2029605 (EL8)
    Resolves rhbz#2029602 (EL9)
  - metrics - sync with latest ansible-pcp
    Resolves rhbz#2012316 (EL8)
    Resolves rhbz#2012298 (EL9)
  - sshd - should detect FIPS mode and handle tasks correctly in FIPS mode
    Resolves rhbz#1979714 (EL8)
    Resolves rhbz#2029634 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.12.0-1
changelog:
  - vpn - use custom vpn_ipaddr filter to make role work on RHEL 8.6 with ansible-core
    this is covered by "make roles work with ansible-core on all platforms" BZ
  - logging - Logging role "logging_purge_confs" option not properly working
    Resolves rhbz#2040812 (EL8)
    Resolves rhbz#2039106 (EL9)
  - kernel_settings role should use ansible_managed in its configuration file
    Resolves rhbz#2047504 (EL8)
    Resolves rhbz#2047506 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.13.0-1
changelog:
  - storage - RFE: Add support for RAID volumes (lvm-only)
    Resolves rhbz#2016514 (EL8)
    Resolves rhbz#2016518 (EL9)
  - storage - RFE: Add support for cached volumes (lvm-only)
    Resolves rhbz#2016511 (EL8)
    Resolves rhbz#2016517 (EL9)
  - metrics - metrics role can't be re-run if the Grafana admin password has been changed
    Resolves rhbz#1967321 (EL8)
    Resolves rhbz#2041632 (EL9)
  - nbde_client - NBDE client system role does not support servers with static IP addresses
    Resolves rhbz#1985022 (EL8)
    Resolves rhbz#2031555 (EL9)
  - ha_cluster - [RFE] ha_cluster - Support for creating resource constraints (Location, Ordering, etc.)
    Resolves rhbz#2041635 (EL8)
    Resolves rhbz#2041634 (EL9)
  - firewall - ensure zone exists and can be used in subsequent operations
    Resolves rhbz#2042541 (EL8)
    Resolves rhbz#2024775 (EL9)
  - network - RFE: Support Routing Tables in static routes in Network Role
    Resolves rhbz#2031521 (EL8)
    Resolves rhbz#2049798 (EL9)
  - network - Failure to activate connection: nm-manager-error-quark: No suitable device found for this connection
    Resolves rhbz#2034908 (EL8)
    Resolves rhbz#2038957 (EL9)
  - network - Set DNS search setting only for enabled IP protocols
    Resolves rhbz#2041627 (EL8)
    Resolves rhbz#2004899 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.13.1-1
changelog:
  - vpn - template error while templating string: no filter named 'vpn_ipaddr'
    Resolves rhbz#2052103 (EL8)
    Resolves rhbz#2050341 (EL9)
  - kdump - Unable to start service kdump: Job for kdump.service failed because the control process exited with error code.
    Resolves rhbz#2052105 (EL8)
    Resolves rhbz#2050419 (EL9)
  - remove collection dependencies on rhel because we vendor them in


author: Rich Megginson <rmeggins@redhat.com> - 1.14.0-1
changelog:
  - ha_cluster - set permissions for haclient group
    Resolves rhbz#2049747 (EL8)
    Resolves rhbz#2049754 (EL9)
  - network - Add more bonding options to rhel-system-roles.network
    Resolves rhbz#2008931 (EL8)
    Resolves rhbz#2054435 (EL9)
  - certificate - should consistently use ansible_managed in hook scripts
    Resolves rhbz#2054364 (EL8)
    Resolves rhbz#2054368 (EL9)
  - tlog - consistently use ansible_managed in configuration files managed by role
    Resolves rhbz#2054363 (EL8)
    Resolves rhbz#2054367 (EL9)
  - vpn - consistently use ansible_managed in configuration files managed by role
    Resolves rhbz#2054365 (EL8)
    Resolves rhbz#2054369 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.15.0-1
changelog:
  - firewall - ensure target changes take effect immediately
    Resolves rhbz#2057172 (EL8)
    Resolves rhbz#2057164 (EL9)
  - firewall - Firewall RHEL System Role should be able to set default zone
    Resolves rhbz#2022458 (EL8)
    Resolves rhbz#2022461 (EL9)
  - network - tests_802_1x_nm, tests_802_1x_updated_nm fails because of missing hostapd in EPEL
    Resolves rhbz#2053862 (EL8)
    Resolves rhbz#2053861 (EL9)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.15.0-2
changelog:
  - metrics - follow symlinks for the mssql and elasticsearch configuration paths
    Resolves rhbz#2058655 (EL8)
    Resolves rhbz#2058777 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.15.1-1
changelog:
  - kernel_settings error configobj not found on RHEL 8.6 managed hosts
    Resolves rhbz#2058772 (EL8)
    Resolves rhbz#2058756 (EL9)
  - timesync: basic-smoke test failure in timesync/tests_ntp.yml
    Resolves rhbz#2059293 (EL8)
    Resolves rhbz#2058645 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.16.0-1
changelog:
  - network - pytest failed when running with nm providers in the rhel-8.5 beaker machine
    Resolves rhbz#2064396 (EL8)
    Resolves rhbz#2064401 (EL9)
  - network - bond: fix typo in supporting the infiniband ports in active-backup modekernel_settings error configobj not found on RHEL 8.6 managed hosts
    Resolves rhbz#2064388 (EL8)
    Resolves rhbz#2064391 (EL9)
  - network - consistently use ansible_managed in configuration files managed by role
    Resolves rhbz#2057656 (EL8)
    Resolves rhbz#2057657 (EL9)
  - metrics - consistently use ansible_managed in configuration files managed by role
    Resolves rhbz#2057645 (EL8)
    Resolves rhbz#2057647 (EL9)
  - postfix - consistently use ansible_managed in configuration files managed by role
    Resolves rhbz#2057661 (EL8)
    Resolves rhbz#2057662 (EL9)
  - postfix - provide the ability to replace config and reset configuration back to default
    Resolves rhbz#2044657 (EL8)
    Resolves rhbz#2058780 (EL9)
  - new tags required in galaxy.yml for Automation Hub


author: Rich Megginson <rmeggins@redhat.com> - 1.16.1-1
changelog:
  - nbde_client - NBDE client system role does not support servers with static IP addresses
    previous fix did not handle some cases
    Resolves rhbz#1985022 (EL8)
    Resolves rhbz#2031555 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.16.2-1
changelog:
  - nbde_client - NBDE client system role does not support servers with static IP addresses
    previous fix did not handle some other cases
    Resolves rhbz#1985022 (EL8)
    Resolves rhbz#2031555 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.16.3-1
changelog:
  - tlog - Enabling session recording configuration does not work due to RHEL9 SSSD files provider default
    Resolves rhbz#2072749 (EL8)
    Resolves rhbz#2071804 (EL9)


author: Rich Megginson <rmeggins@redhat.com> - 1.17.0-1
changelog:
  - All roles should support running with gather_facts: false
    Resolves: rhbz#2079008 (8.7.0)

  - firewall - Firewall system role Ansible deprecation warning related to "include"
    Resolves: rhbz#2078650 (8.7.0)

  - ha_cluster - ha_cluster - support advanced corosync configuration
    Resolves: rhbz#2065339 (8.7.0)

  - ha_cluster - ha_cluster - support SBD fencing
    Resolves: rhbz#2066868 (8.7.0)

  - ha_cluster - ha_cluster - add support for configuring bundle resources
    Resolves: rhbz#2073518 (8.7.0)

  - kernel_settings - kernel_settings error configobj not found on RHEL 8.6 managed hosts
    Resolves: rhbz#2060378 (8.7.0)

  - logging - logging tests fail during cleanup if no cloud-init on system
    Resolves: rhbz#2058807 (8.7.0)

  - logging - Logging - RFE - support template, severity and facility options
    Resolves: rhbz#2075116 (8.7.0)

  - metrics - Metrics role, with "metrics_from_mssql" option does not configure /var/lib/pcp/pmdas/mssql/mssql.conf on first run
    Resolves: rhbz#2060377 (8.7.0)

  - metrics - metrics - consistently use ansible_managed in configuration files managed by role
    Resolves: rhbz#2065215 (8.7.0)

  - metrics - [RFE] add an option to the metrics role to enable postfix metric collection
    Resolves: rhbz#2079114 (8.7.0)

  - nbde_client - NBDE client system role does not support servers with static IP addresses
    Resolves: rhbz#2071011 (8.7.0)

  - network - [RFE] Extend rhel-system-roles.network feature set to support routing rules
    Resolves: rhbz#1996731 (8.7.0)

  - network - bond: fix typo in supporting the infiniband ports in active-backup mode
    Resolves: rhbz#2064067 (8.7.0)

  - network - pytest failed when running with nm providers in the rhel-8.5 beaker machine
    Resolves: rhbz#2065217 (8.7.0)

  - network - network - consistently use ansible_managed in configuration files managed by role
    Resolves: rhbz#2065670 (8.7.0)

  - postfix - postfix - consistently use ansible_managed in configuration files managed by role
    Resolves: rhbz#2065216 (8.7.0)

  - postfix - Postfix RHEL System Role should provide the ability to replace config and reset configuration back to default
    Resolves: rhbz#2065218 (8.7.0)

  - sshd - FIPS mode detection in SSHD role is wrong
    Resolves: rhbz#2075338 (8.7.0)

  - storage - RFE storage Less verbosity by default
    Resolves: rhbz#2056480 (8.7.0)

  - timesync - timesync: basic-smoke test failure in timesync/tests_ntp.yml
    Resolves: rhbz#2060379 (8.7.0)

  - tlog - Tlog role - Enabling session recording configuration does not work due to RHEL9 SSSD files provider default
    Resolves: rhbz#2072749 (8.7.0)


author: Rich Megginson <rmeggins@redhat.com> - 1.18.0-1
changelog:
  - firewall - [Improvement] Allow System Role to reset to default Firewalld Settings
    Resolves: rhbz#2043009 (8.7.0)

  - metrics - [RFE] add an option to the metrics role to enable postfix metric collection
    Resolves: rhbz#2079114 (8.7.0)

  - network - Rework the infiniband support
    Resolves: rhbz#2086869 (8.7.0)

  - sshd - recurse into tests and examples sub-directories when replacing string in files
    the sshd role latest version added sub-directories under tests that need
    role name replacement - so just use find

  - sshd - sshd system role should not assume that RHEL 9 /etc/ssh/sshd_config has "Include > /etc/ssh/sshd_config.d/*.conf"
    Resolves: rhbz#2086934 (8.7.0)

  - sshd - sshd system role should be able to optionally manage /etc/ssh/sshd_config on RHEL 9
    Resolves: rhbz#2086935 (8.7.0)

  - storage - storage role cannot set mount_options for volumes
    Resolves: rhbz#2083378 (8.7.0)


author: Rich Megginson <rmeggins@redhat.com> - 1.19.0-1
changelog:
  - storage - support for creating and managing LVM thin pools/LVs
    Resolves: rhbz#2066876 (8.7.0)

  - firewall - Update Ansible syntax in Firewall system role README.md file examples
    Resolves: rhbz#2081839 (8.7.0)

  - storage role raid_level "striped" is not supported
    Resolves: rhbz#2083426 (8.7.0)

  - network: the controller device is not completely cleaned up in the bond tests.
    Resolves: rhbz#2089868 (8.7.0)

  - firewall - state no longer required for masquerade and ICMP block inversion
    Resolves: rhbz#2093437 (8.7.0)

  - ha_cluster - Move tasks that set up CI environment to roles tasks/ dir
    Resolves: rhbz#2093500 (8.7.0)


author: Rich Megginson <rmeggins@redhat.com> - 1.19.1-1
changelog:
  - storage - fix coverity scan issue in blivet.py
    Resolves: rhbz#2066876 (8.7.0)

  - logging - fix gather_facts/set_vars issue
    Resolves: rhbz#2079008 (8.7.0)

  - ha_cluster - Move tasks that set up CI environment to roles tasks/ dir
    Resolves: rhbz#2093500 (8.7.0)

  - sshd - fix tests issue with rhel9 hosts


author: Rich Megginson <rmeggins@redhat.com> - 1.19.3-1
changelog:
  - min_ansible_version is string instead of float

  - fix storage test failures

  - support for ansible-core 2.13

  - firewall - forward_port should accept list of string or list of dict
    Resolves: rhbz#2101607

  - firewall - support add/modify/delete services
    Resolves: rhbz#2100297

  - metrics - document minimum supported redis version required by rhel-system-roles
    Resolves: rhbz#2100285

  - metrics - restart pmie, pmlogger if changed, do not wait for handler
    Resolves: rhbz#2100298

  - network - Support managing the network through nmstate schema
    Resolves: rhbz#2100979

  - storage - support for adding/removing disks to/from storage pools
    Resolves: rhbz#2066880

  - storage - support for attaching cache volumes to existing volumes
    Resolves: rhbz#2066881


author: Rich Megginson <rmeggins@redhat.com> - 1.20.0-1
changelog:
  - Resolves:rhbz#2115159 : cockpit - Add customization of port
  - Resolves:rhbz#2100939 : firewall - RFE: firewall-system-role: add ability to add interface to zone by PCI device ID
  - Resolves:rhbz#2115160 : firewall - support for firewall_config - gather firewall facts
  - Resolves:rhbz#2112143 : logging - [RFE] Support startmsg.regex and endmsg.regex in the files inputs
  - Resolves:rhbz#2115162 : selinux - Added setting of seuser and selevel for completeness
  - Resolves:rhbz#2115161 : nbde_client - Sets proper spacing for parameter rd.neednet=1
  - Resolves:rhbz#2115884 : network - fix IPRouteUtils.get_route_tables_mapping() to accept any whitespace sequence
  - Resolves:rhbz#2109997 : ssh sshd - ssh, sshd: RSAMinSize parameter definition is missing
  - Resolves:rhbz#2082391 : storage - [RHEL8] [WARNING]: The loop variable 'storage_test_volume' is already in use. You should set the `loop_var` value in the `loop_control` option for the task to something else to avoid variable collisions and unexpected behavior.


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.2.network
changelog:
  - Resolves:rhbz#2134201 : network - [RFE] Support setting the metric of the default route for initscripts provider
  - Resolves:rhbz#2133856 : network - [RFE] Support the DNS priority
  - Resolves:rhbz#2129620 : network - Support looking up named route table in routing rule
  - includes ha_cluster, vpn - README.md had headings that were too long causing problems
    for md to adoc to html conversion on el8
  - includes changing network role to support ansible-core 2.14
  - includes community.general 6.0.1
  - adds back network bondtests patch - bond tests still failing in beaker


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.3.ssh_sshd_selinux_timesync
changelog:
  - Resolves:rhbz#2143385 : selinux - add support for the 'local' parameter
  - Resolves:rhbz#2143401 : sshd,ssh,timesync - Unexpected templating type error - expected str instance, int found
  - Resolves:rhbz#2130921 : ssh,sshd - Sync on final OpenSSH option name RequiredRSASize in ssh and sshd roles [rhel-8.7] [rhel-8.8.0]


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.5
changelog:
  - Resolves:rhbz#2137667 : cockpit - [RFE] convert cockpit role to use firewall, selinux role, and certificate role
  - Resolves:rhbz#2130362 : logging - [RFE] convert logging role to use firewall, selinux role, and certificate role
  - Resolves:rhbz#2133532 : metrics - [RFE] convert metrics role to use firewall and selinux role
  - Resolves:rhbz#2133931 : nbde_server - [RFE] convert nbde_server role to use firewall and selinux role
  - Resolves:rhbz#2130332 : postfix - [RFE] convert postfix role to use firewall and selinux role
  - Resolves:rhbz#2119600 : vpn - Add parameters shared_key_content, ike, esp, type, leftid, rightid
  - Resolves:rhbz#2130345 : vpn - [RFE] convert vpn role to use firewall and selinux role


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.6
changelog:
  - Resolves:rhbz#2133931 : nbde_server - [RFE] convert nbde_server role to use firewall and selinux role
    previous fix was not complete - needed additional fixes - ansible-lint 6.x fixes


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.7
changelog:
  - Resolves:rhbz#2126960 : nbde_client - must handle clevis-luks-askpass and clevis-luks-askpass@ systemd unit names


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.8
changelog:
  - Resolves:rhbz#2130362 : logging - [RFE] convert logging role to use firewall, selinux role, and certificate role
    fix tests - tests_relp now uses logging_purge_confs


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.9
changelog:
  - Resolves:rhbz#2144876 : ad_integration - [RFE] new role to support AD integration, join to AD domain


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.10
changelog:
  - Resolves:rhbz#2130019 : ha_cluster - [RFE] convert ha_cluster role to use firewall, selinux and certificate role
  - Resolves:rhbz#2143458 : network - Support cloned MAC address
  - Resolves:rhbz#2066864 : podman - [RFE] role for managing podman containers and systemd


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.11
changelog:
  - Resolves:rhbz#2130362 : logging - [RFE] convert logging role to use firewall, selinux role, and certificate role
    fix basic-smoke-test failures


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.13
changelog:
  - Resolves:rhbz#2151355 : storage - [RHEL8] disks_needed need to be set for the raid test cases
  - Resolves:rhbz#2154143 : storage - [RHEL8] tests_create_thinp_then_remove_scsi_generated.yml failed at "assertion": "(storage_test_expected_size|int - storage_test_actual_size.bytes)|abs / storage_test_expected_size|int < 0.01"
  - Resolves:rhbz#2151342 : storage - [RHEL9]  ansible.parsing.yaml.objects.AnsibleUnicode object' has no attribute 'bytes'
  - Resolves:rhbz#2151351 : storage - [RHEL9 system role]  storage role vdo tests failed about  "VDO deduplication is off but it should not"


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.14
changelog:
  - Resolves:rhbz#2143814 : ha_cluster - Allow quorum device configuration
  - Resolves:rhbz#2153081 : ha_cluster - Allow enabled SBD on disabled cluster
  - Resolves:rhbz#2127497 : ha_cluster - use no_log in tasks looping over pot. secret parameters
  - community.general 6.2.0
  - replace community.general with namespace.name for rhc role


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.15
changelog:
  - Resolves:rhbz#2162788 : network - role should support running tests with ANSIBLE_GATHERING=explicit
  - Resolves:rhbz#2149683 : Synchronize automation-related changes from Fedora spec file
  - Fix ansible-test issues in several roles
  - Fix nbde_server tang test failure


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.16
changelog:
  - Resolves:rhbz#2165176 : journald - New role - journald - manage systemd-journald
  - Resolves:rhbz#2159972 : nbde_client - nbde_client_clevis fails with a traceback and prints sensitive data
  - Resolves:rhbz#2164879 : selinux - managing modules is not idempotent
  - fix storage tests_swap and tests_misc - swap size < 128GB on EL7
  - fix podman general-meta issue
  - ha_cluster non-x86_64 tests issue
  - certificate non-x86_64 tests issue


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.18
changelog:
  - Resolves:rhbz#2144877 : rhc - new role for subscription management/registration/insights
  - ad_integration - fix issue with using the network role to configure DNS


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-0.19
changelog:
  - Resolves:rhbz#2144877 : rhc - new role for subscription management/registration/insights
  - vendor in modules required by rhc role
  - Resolves:rhbz#2167941 : ha_cluster - Fix stonith watchdog timeout


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-1
changelog:
  - Resolves:rhbz#2168733 : network - RedHat Role rhel-system-roles.network should route traffic via correct bond


author: Rich Megginson <rmeggins@redhat.com> - 1.21.0-2
changelog:
  - Resolves:rhbz#2144877 : rhc - new role for subscription management/registration/insights
  - remove role until https://bugzilla.redhat.com/show_bug.cgi?id=2171829 is fixed


author: Rich Megginson <rmeggins@redhat.com> - 1.21.1-1
changelog:
  - Resolves:rhbz#2144877 : rhc - new role for subscription management/registration/insights
  - includes the fix for tests_proxy.yml selinux and some test refactoring


author: Sergei Petrosian <spetrosi@redhat.com> - 1.21.1-2
changelog:
  - Resolves: rhbz#2185002 : Remove doc fragments from vendored modules
  - Build collection artifact in the same directory on Fedora and RHEL


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.3
changelog:
  - fix issues in some tests with ANSIBLE_GATHERING=explicit
  - add testing for fingerprints in config files
  - fix podman jinja 2.7 issue
  - sshd - skip firewall testing if not supported


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.6
changelog:
  - Resolves:rhbz#2186910 : fingerprint in config files managed by roles
  - Resolves:rhbz#2190478 : ha_cluster - Add possibility to load SBD watchdog kernel modules
  - Resolves:rhbz#2190483 : ha_cluster - support for resource and operation defaults
  - Resolves:rhbz#2151371 : postgresql - [RFE] system role for PostgreSQL management
  - Resolves:rhbz#2179016 : rhc - [RFE] New role for Red Hat subscription management, insights management [rhel-8.9.0]
  - Resolves:rhbz#2190480 : ha_cluster - use pcs to setup qdevice certificates if available
  - Resolves:rhbz#2186198 : spec: Remove doc fragments from vendored modules
  - Resolves:rhbz#2190500 : roles should support running with gather_facts: false
  - Resolves:rhbz#2175326 : use ansible-galaxy collection build/install instead of tar
  - Resolves:rhbz#2186908 : rhc - RHC system role: activation key registration fails if system is already registered
  - Resolves:rhbz#2190499 : selinux - failing test - sshd/tests_firewall_selinux.yml - No package matching 'firewalld' found available, installed or updated


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.7
changelog:
  - remove upstream only docs from README.md files
  - python3-setuptools is now required for release_collection.py
  - fix ruamel issue described at https://github.com/linux-system-roles/auto-maintenance/pull/272
  - Resolves:rhbz#2209441 : rhc - system role does not apply Insights tags
  - Resolves:rhbz#2191702 : tlog - use the proxy provider - the files provider is deprecated in sssd
  - Resolves:rhbz#2190500 : roles should support running with gather_facts: false
  - READMEs for all roles contain only downstream applicable docs
  - All roles/tests now work with ansible-core 2.15
  - Fix some roles to work with remove-cloud-init


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.8
changelog:
  - Resolves:rhbz#2181661 : storage - [RFE] user-specified mount point owner and permissions
  - Resolves:rhbz#2193057 : storage - Cannot set chunk size for RAID: Unsupported parameters for (blivet) module: pools.raid_chunk_size
  - Resolves:rhbz#2211247 : storage - Failed to commit changes to disk: Failed to format device: Input/output error


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.9
changelog:
  - Resolves:rhbz#2211273 : network - Support configuring auto-dns setting
  - Resolves:rhbz#2211778 : rhc - implement rhc_proxy.scheme
  - Resolves:rhbz#2141961 : storage - RFE for the storage system role to support configuring the stripe size for RAID LVM volumes
  - Resolves:rhbz#2211271 : selinux - use restorecon -T 0 on supported platforms
  - Resolves:rhbz#2211247 : storage - Failed to commit changes to disk: Failed to format device: Input/output error


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.11
changelog:
  - Resolves:rhbz#2211272 : kdump - support auto_reset_crashkernel, dracut_args, deprecate /etc/sysconfig/kdump


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.13
changelog:
  - Resolves:rhbz#2216759 : ssh - add ssh_backup option with default true
  - Resolves:rhbz#2216521 : firewall - Don't install python(3)-firewall it's a dependency of firewalld


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.14
changelog:
  - Resolves:rhbz#2218899 : storage - [RHEL8] Unexpected behavior when creating ext4 filesystem with invalid parameter


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.15
changelog:
  - Resolves:rhbz#2218204 : certificate - add mode parameter to change permissions for cert files
  - Resolves:rhbz#2218595 : network - Support no-aaaa DNS option


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.16
changelog:
  - Resolves:rhbz#2220963 : podman - allow container networking configuration
  - Resolves:rhbz#2220961 : podman - support for healthchecks and healthcheck actions
  - Resolves:rhbz#2220962 : podman - support quadlet units
  - Resolves:rhbz#2224388 : systemd - system role for managing systemd units
  - Resolves:rhbz#2223036 : ALL - facts being gathered unnecessarily
  - Resolves:rhbz#2186057 : certificate - rhel-system-roles.certificate does not re-issue after updating key_size
  - Resolves:rhbz#2222433 : firewall - Check mode fails when creating new firewall service
  - Resolves:rhbz#2222809 : firewall - should have option to disable conflicting services
  - Resolves:rhbz#2222808 : firewall - when firewalld.service is masked, firewall role fails
  - Resolves:rhbz#2224094 : storage - RAID volume pre cleanup - remove existing data from member disks as needed before creation


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.19
changelog:
  - Resolves RHEL-866 : podman - use getsubids to look for subuid, subgid for IdM support
  - Resolves RHEL-858 : podman - allow to not pull images, continue if image pull fails
  - Resolves:rhbz#2224648 : firewall - fix: reload on resetting to defaults
  - Resolves:rhbz#2226077 : podman - Podman system role:  Unable to use podman_registries_conf to set unqualified-search-registries
  - Resolves RHEL-918 : firewall - Ansible RHEL firewall system role not idempotent when configuring the interface using the role in rhel9
  - Resolves RHEL-907 : kdump - use failure_action instead of default on EL9 and later
  - Resolves RHEL-899 : firewall - Check mode fails with replacing previous rules
  - Resolves:rhbz#2227823 : rhc - baseurl in rhsm.conf is empty when rhc_baseurl is not specified


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.20
changelog:
  - Resolves:rhbz#2140880 : firewall - missing module in linux-system-roles.firewall to create an ipset


author: Rich Megginson <rmeggins@redhat.com> - 1.22.0-1
changelog:
  - Resolves:rhbz#2233183 : ad_integration - red hat "rhel system role" ad_integration leaks credentials when in check_mode
  - Resolves:rhbz#2232391 : kdump - role: "Write new authorized_keys if needed" task idempotency issues
  - Resolves:rhbz#2232392 : kdump - system role fails if kdump_ssh_user doesn't have a .ssh/authorized_keys file in home directory
  - Resolves RHEL-1398 : kdump - fix: ensure .ssh directory exists for kdump_ssh_user on kdump_ssh_server
  - Resolves RHEL-1500 : kdump - fix: Ensure authorized_keys management works with multiple hosts
  - Resolves:rhbz#2224648 : firewall - fix: reload on resetting to defaults
  - Resolves RHEL-1496 : firewall - fix: files: overwrite firewalld.conf on previous replaced
  - Resolves RHEL-1498 : storage - fix: use stat.pw_name, stat.gr_name instead of owner, group
    sshd README remove upstream only docs
    first RC for 1.22.0 rhel 8.9 and 9.3
    fix firewall reload test gather facts


author: Sergei Petrosian <spetrosi@redhat.com> - 1.23.0-1
changelog:
  - Resolves: RHEL-5345 spec - Remove with_html, instead use built-in .README.html
  - Resolves: RHEL-5985 ansible-sshd - Manage SSH certificates
  - rhbz#2224648: Remove ad_integration patch and use the latest ad_integration
    version instead. Vendor community-general.ini_files for
  - RHEL-1119: ad_integration: Support for dynamic DNS Updates
  - Change link to open new issue in galaxy.yml from deprecated BZ to Jira


author: Sergei Petrosian <spetrosi@redhat.com> - 1.23.0-2
changelog:
  - RHEL-1119: ad_integration: Support for dynamic DNS Updates
    Update to a new version with fixed tests


author: Rich Megginson <rmeggins@redhat.com> - 1.23.0-2.1
changelog:
  - Resolves: RHEL-15872 :  - RHEL for Edge support in system roles
    except for nbde_client, rhc, metrics
  - Resolves: RHEL-17667 : ad_integration - feat: Add sssd custom settings
  - Resolves: RHEL-16542 : fapolicyd - feat: Import code for fapolicyd system role
  - Resolves: RHEL-14090 : ha_cluster - [RFE] HA Cluster system role should be able to enable Resilient Storage repository
  - Resolves: RHEL-4624 : ha_cluster - [FutureFeature] Allow ha_cluster role to configure fencing topology
  - Resolves: RHEL-3264 : ha_cluster - [FutureFeature] Allow ha_cluster role to configure all qdevice options
  - Resolves: RHEL-3354 : kdump - fix: retry read of kexec_crash_size
  - Resolves: RHEL-15933 : logging - feat: Add support for the global config option preserveFQDN with a new logg…
  - Resolves: RHEL-15440 : logging - feat: Add support for general queue and general action parameters
  - Resolves: RHEL-15038 : logging - fix: check that logging_max_message_size is set, not rsyslog_max_message_size
  - Resolves: RHEL-16501 : network - Ansible RHEL network system role issue with ipv6.routing-rules the prefix length for 'from' cannot be zero"
  - Resolves: RHEL-15871 : selinux - fix: Use `ignore_selinux_state` module option
  - Resolves: RHEL-16213 : storage - feat: Support for creating volumes without a FS


author: Rich Megginson <rmeggins@redhat.com> - 1.23.0-2.2
changelog:
  - Resolves: RHEL-15872 : RHEL for Edge support in system roles
    vpn - fixed issue with test cleanup


author: Rich Megginson <rmeggins@redhat.com> - 1.23.0-2.3
changelog:
  - Resolves: RHEL-17874 : ha_cluster - high-availability firewall service is not added on qdevice node


author: Rich Megginson <rmeggins@redhat.com> - 1.23.0-2.4
changelog:
  - Resolves: RHEL-15872 : RHEL for Edge support in system roles
    updated several roles with ostree improvements
    metrics role support for ostree
  - Resolves: RHEL-16542 : fapolicyd - feat: Import code for fapolicyd system role
    several role improvements
  - Resolves: RHEL-4684 : ha_cluster - fix: set sbd.service timeout based on SBD_START_DELAY
  - Resolves: RHEL-19047 : logging - fix: avoid conf of RatelimitBurst when RatelimitInterval is zero
  - Resolves: RHEL-18170 : metrics - [RFE] Metrics system role support for configuring PMIE webhooks
  - Resolves: RHEL-19242 : podman - fix: add no_log: true for tasks that can log secret data
  - Resolves: RHEL-18963 : postgresql - feat: enable using postgresql 16
  - Resolves: RHEL-16977 : rhc - rhc: support RHEL 7 managed nodes
  - Resolves: RHEL-19042 : selinux - fix: no longer use "item" as a loop variable
  - Resolves: RHEL-19044 : selinux - fix: Print an error message when module to be created doesn't exist
  - Resolves: RHEL-14022 : storage - Basic support for creating shared logical volumes


author: Rich Megginson <rmeggins@redhat.com> - 1.23.0-2.7
changelog:
  - Add ExcludeArch i686 to fix build issues with ansible-core
  - Resolves: RHEL-21946 : keylime_server - won't detect registrar start failure


author: Rich Megginson <rmeggins@redhat.com> - 1.23.0-2.9
changelog:
  - Resolves: RHEL-21383 : ad_integration - feat: add ad_integration_preserve_authselect_profile
  - Resolves: RHEL-21134 : ad_integration - feat: Add SSSD parameters support
  - Resolves: RHEL-21123 : journald - feat: Add support for ForwardToSyslog
  - Resolves: RHEL-22310 : podman - fix: cast secret data to string in order to allow JSON valued strings
  - Resolves: RHEL-21402 : podman - fix: name of volume quadlet service should be basename-volume.service
  - Resolves: RHEL-21400 : postgresql - PostgreSQL system role: unable to install PostgreSQL version 15 on RHEL 9
  - Resolves: RHEL-16975 : rhc - rhc: new rhc_insights.ansible_host parameter


author: Rich Megginson <rmeggins@redhat.com> - 1.23.0-2.10
changelog:
  - Resolves: RHEL-14022 : storage - Basic support for creating shared logical volumes
    GFS2 support in blivet is enabled


author: Rich Megginson <rmeggins@redhat.com> - 1.23.0-2.11
changelog:
  - Resolves: RHEL-21400 : postgresql - PostgreSQL system role: unable to install PostgreSQL version 15 on RHEL 9
  - Resolves: RHEL-23309 : storage - tests_lvm_auto_size_cap_nvme_generated failed at "Assert expected size is actual size"


author: Rich Megginson <rmeggins@redhat.com> - 1.23.0-3
changelog:
  - Resolves: RHEL-58465 :  - package rhel-system-roles.noarch does not provide docs for ansible-doc [rhel-8.10.z]
  - Resolves: RHEL-58494 : ad_integration - fix: Sets domain name lower case in realmd.conf section header [rhel-8.10.z]
  - Resolves: RHEL-58917 : bootloader - bootloader role tests do not work on ostree [rhel-8.10.z]
  - Resolves: RHEL-45711 : bootloader - fix: Set user.cfg path to /boot/grub2/ on EL 9 UEFI [rhel-8]
  - Resolves: RHEL-58515 : cockpit - cockpit install all wildcard match does not work in newer el9 [rhel-8.10.z]
  - Resolves: RHEL-58485 : logging - RFE - system-roles - logging: Add truncate options for local file inputs [rhel-8.10.z]
  - Resolves: RHEL-58481 : logging - redhat.rhel_system_roles.logging role fails to process logging_outputs: of type: "custom" [rhel-8.10.z]
  - Resolves: RHEL-58477 : logging - [RFE] Add the umask settings or enable a variable in linux-system-roles.logging [rhel-8.10.z]
  - Resolves: RHEL-37550 : logging - Setup imuxsock using rhel-system-roles.logging causing an error EL8
  - Resolves: RHEL-58519 : nbde_client - feat: Allow initrd configuration to be skipped [rhel-8.10.z]
  - Resolves: RHEL-58525 : podman - fix: proper cleanup for networks; ensure cleanup of resources [rhel-8.10.z]
  - Resolves: RHEL-58511 : podman - fix: grab name of network to remove from quadlet file [rhel-8.10.z]
  - Resolves: RHEL-58507 : podman - Create podman secret when skip_existing=True and it does not exist [rhel-8.10.z]
  - Resolves: RHEL-58503 : podman - fix: do not use become for changing hostdir ownership, and expose subuid/subgid info [rhel-8.10.z]
  - Resolves: RHEL-58498 : podman - fix: use correct user for cancel linger file name [rhel-8.10.z]
  - Resolves: RHEL-58460 : podman - redhat.rhel_system_roles.podman fails to configure and run containers with podman rootless using different username and groupname. [rhel-8.10.z]
  - Resolves: RHEL-58473 : sshd - second SSHD service broken [rhel-8.10.z]
  - Resolves: RHEL-58469 : storage - rhel-system-role.storage is not idempotent [rhel-8.10.z]
  - Resolves: RHEL-58489 : timesync - System Roles: No module documentation [rhel-8.10.z]


author: Rich Megginson <rmeggins@redhat.com> - 1.23.0-4
changelog:
  - Resolves: RHEL-58460 : podman - redhat.rhel_system_roles.podman fails to configure and run containers with podman rootless using different username and groupname. [rhel-9.4.z]
  - fix issue with podman error removing kube specs on 8.8 and 9.2 managed nodes - covered by tests_basic.yml
  - https://github.com/linux-system-roles/podman/pull/186
  - fix issue with missing grubby testing on el8 ostree
  - https://github.com/linux-system-roles/podman/pull/187
  - fix issue with podman not working on 8.8/9.2
  - https://github.com/linux-system-roles/podman/pull/188


author: Bastien Nocera <bnocera@redhat.com> - 3.4.2-5
changelog:
  + rhythmbox-3.4.2-5
  - Remove LIRC plugin
  - Fix 2 build warnings
  - Remove BRs for removed visualiser plugin


author: Bastien Nocera <bnocera@redhat.com> - 3.4.2-7
changelog:
  + rhythmbox-3.4.2-7
  - Fix warnings in art search when playing a radio
  - Fix initial import never finishing
  - Fix multimedia keys integration in GNOME


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-20
changelog:
  - Add --path query option (#1940895)
  - Macroize find-debuginfo script location (#2019540)
  - Validate and require subkey binding sigs on PGP pubkeys (#1958480)
  - Fixes CVE-2021-3521


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
changelog:
  - Fix spurious %transfiletriggerpostun execution (#2023693)
  - Skip recorded symlinks in --setperms (#1900662)


author: Florian Festi <ffesti@redhat.com> - 4.14.3-31
changelog:
  - Backport file handling code from rpm-4.19 to fix CVE-2021-35937,
    CVE-2021-35938 and CVE-2021-35939


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - adjust for rpmdb index name change
  - drop unnecessary vendor-macro patch for real
  - add ISA-dependencies among rpm subpackages
  - make lzma and sqlite deps conditional and disabled by default for now


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - rpm 4.5.90-0.git8424.1 (alpha snapshot)
  - adjust to build against Berkeley DB 4.5.20 from compat-db for now
  - add posttrans to clean up db environment mismatch after upgrade
  - forward-port devel autodeps patch


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - 4.5.90-0.git8426.5
  - flip back to external bdb
  - fix tab vs spaces complaints from rpmlint
  - add dep for lzma and require unzip instead of zip in build (#310694)
  - add pkgconfig dependency to rpm-devel
  - drop ISA-dependencies for initial introduction
  - new snapshot from upstream for documentation fixes


author: Florian Festi <ffesti@redhat.com>
changelog:
  - 4.5.90-0.git8426.10
  - rpm-4.5.90-posttrans.patch
  - use header from rpmdb in posttrans to make anaconda happy


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - 4.5.90-0.git8461.1
  - new snapshot from upstream
  - fixes #68290, #455972, #446202, #453364, #456708, #456103, #456321, #456913,
    - partial fix for #457360


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - add support for noarch subpackages
  - fix segfault in case of insufficient disk space detected (#460146)


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - fix parsing of boolean expressions in spec (#456103)
    (unbreaks pam, jpilot and maybe other builds)


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - create directory structure for rpmbuild prior to build if it doesn't exist (#455387)
  - create _topdir if it doesn't exist when installing SRPM
  - don't generate broken cpio in case of hardlink pointing on softlink,
    thanks to pixel@mandriva.com


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - add hack to support extracting gstreamer plugin provides (#438225)
  - fix another macro argument handling regression (#461180)


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to official 4.5.90 alpha tarball 
  - a big pile of misc bugfixes + translation updates
  - isa-macro generation fix for ppc (#464754)
  - avoid pulling in pile of perl dependencies for an unused script
  - handle both "invalid argument" and clear env version mismatch on posttrans


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to 4.6.0-rc1 
  - fixes #465586, #466597, #465409, #216221, #466503, #466009, #463447...
  - avoid using %configure macro for now, it has unwanted side-effects on rpm


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - Make noarch sub-packages actually work
  - Fix defaultdocdir logic in installplatform to avoid hardwiring mandir


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to 4.6.0-rc2
  - fixes #471820, #473167, #469355, #468319, #472507, #247374, #426672, #444661
  - enable automatic generation of pkg-config and libtool dependencies #465377


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-0.rc4.2
changelog:
  - change platform sharedstatedir to something more sensible (#185862)
  - add rpmdb_foo links to db utils for documentation compatibility


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-0.rc4.3
changelog:
  - extract mimehandler provides from .desktop files
  - preliminaries for extracting font provides (not enabled yet)
  - dont classify font metrics data as fonts
  - only run script dep extraction once per file, duh


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-1
changelog:
  - update to 4.6.0 final
  - revert libmagic looking into compressed files for now, breaks ooffice build


author: Jindrich Novy <jnovy@redhat.com> - 4.6.0-4
changelog:
  - inherit group tag from the main package (#470714)
  - ignore BuildArch tags for anyarch actions (#442105)
  - don't check package BuildRequires when doing --rmsource (#452477)
  - don't fail because of missing sources when only spec removal
    is requested (#472427)


author: Jindrich Novy <jnovy@redhat.com> - 4.6.0-5
changelog:
  - remove two offending hunks from anyarch patch causing that
    RPMTAG_BUILDARCHS isn't written to SRPMs


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-7
changelog:
  - loosen up restrictions on dependency names (#455119)
  - handle inter-dependent pkg-config files for requires too (#473814)
  - error/warn on elf binaries in noarch package in build


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-0.beta1.9
changelog:
  - fix recorded file state of otherwise skipped files (#492947)
  - compress ChangeLog, drop old CHANGES file (#492440)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-1
changelog:
  - update to 4.7.0 final (http://rpm.org/wiki/Releases/4.7.0)
  - fixes #494049, #495429
  - dont permit test-suite failure anymore


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-2
changelog:
  - file classification tweaks for text files (#494817)
    - disable libmagic text token checks, it's way too error-prone
    - consistently classify all text as such and include description


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-3
changelog:
  - couple of merge-review fixes (#226377)
    - eliminate bogus leftover rpm:rpm rpmdb ownership
    - unescaped macro in changelog
  - fix find-lang --with-kde with KDE3 (#466009)
  - switch back to default file digest algorithm


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-4
changelog:
  - split cron-job into a sub-package to avoid silly deps on core rpm (#500722)
  - rpm requires coreutils but not in %post
  - build with libcap and libacl
  - fix pgp pubkey signature tag parsing


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-5
changelog:
  - don't mess up problem altNEVR in python ts.check() (#501068)
  - fix hardlink size calculation on build (#503020)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-8
changelog:
  - updated OSGi dependency extractor (#506471)
  - fix segfault in symlink fingerprinting (#505777)
  - fix invalid memory access causing bogus file dependency errors (#506323)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-5
changelog:
  - fix duplicate dependency filtering on build (#490378)
  - permit absolute paths in file lists again (#521760)
  - use permissions 444 for all .debug files (#522194)
  - add support for optional bugurl tag (#512774)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-6
changelog:
  - use relative paths within db environment (related to #507309, #507309...)
  - remove db environment on close in chrooted operation (related to above)
  - initialize rpmlib earlier in rpm2cpio (#523260)
  - fix file dependency tag extension formatting (#523282)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-7
changelog:
  - fix build with BDB 4.8.x by removing XA "support" from BDB backend 
  - perl dep extractor heredoc parsing improvements (#524929)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-8
changelog:
  - support multiple python implementations in brp-python-bytecompile (#531117)
  - make disk space problem reporting a bit saner (#517418)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.2-2
changelog:
  - missing error exit code from signing password checking (#496754)
  - dont fail build on unrecognized data files (#532489)
  - dont try to parse subkeys and secret keys (#436812)
  - fix chmod test on selinux, breaking %{_fixperms} macro (#543035)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-0.beta1.1
changelog:
  - update to 4.8.0-beta1 (http://rpm.org/wiki/Releases/4.8.0)
  - rpm-build conflicts with current ocaml-runtime


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-0.beta1.2
changelog:
  - fix noise from python bytecompile on non-python packages (#539635)
  - make all our -devel [build]requires isa-specific
  - trim out superfluous -devel dependencies from rpm-devel


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-3
changelog:
  - fix segfault on failed url retrieval
  - fix verification error code depending on verbosity level
  - if anything in testsuite fails, dump out the log


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-8
changelog:
  - more fixes to postscript provides extractor (#562228)
  - avoid accessing unrelated mount points in disk space checking (#547548)
  - fix disk space checking with erasures present in transaction (#561160)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-11
changelog:
  - support single PPD providing driver for devices (#568351)
  - merge the psdriver patch pile into one
  - preserve empty lines in spec prep section (#573339)
  - teach python bindings about RPMTRANS_FLAG_NOCONTEXTS (related to #573111)
  - dont own localized man directories through find_lang (#569536)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-15
changelog:
  - handle non-existent dependency sets correctly in python (#593553)
  - make find-lang look in all locale dirs (#584866)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-16
changelog:
  - adjust to new pkg-config behavior wrt private dependencies (#596433)
  - rpm-build now requires pkgconfig >= 0.24


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-1
changelog:
  - update to 4.8.1 (http://rpm.org/wiki/Releases/4.8.1)
  - drop no longer needed patches
  - fix source url pointing to testing directory


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-2
changelog:
  - fix a potential getOutputFrom() error from font provide extraction
  - debug-friendlier message to aid finding other similar cases (#565223)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-5
changelog:
  - create gdb index on debuginfo generation (#617166)
  - rpm-build now requires /usr/bin/gdb-add-index for consistent index creation
  - include COPYING in -apidocs for licensing guidelines compliance


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.1-7
changelog:
  - bunch of spec tweaks, cleanups + corrections:
    - shorten rpm-build filelist a bit with glob use, reorder for saner grouping
    - missing isa in popt version dependency
    - only add rpmdb_foo symlinks for actually relevant db_* utils
    - drop no longer necessary file-devel dependency from rpm-devel
    - drop sqlite backend build-conditional
    - preliminaries for moving from db4 to libdb
  - use gnupg2 for signing as that's more likely to be installed by default


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.beta1.1
changelog:
  - rpm 4.9.0-beta1 (http://rpm.org/wiki/Releases/4.9.0)
    - drop no longer needed patches
    - adjust requires + buildrequires to match current needs
    - adjust rpmdb index ghosts to match the new release
    - split librpmbuild and librpmsign to a separate rpm-build-libs package
    - split rpmsign to its own package to allow signing without all the build goo
    - build-conditionalize plugins, disabled for now
    - gstreamer and printer dependency generation moving out
    - handle .so symlink dependencies with fileattrs
    - use gnupg2 for signing as that's what typically installed by default


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.beta1.3
changelog:
  - avoid division by zero in rpmdb size calculation (#671056)
  - fix secondary index iteration returing duplicate at end (#671149)
  - fix rebuilddb creating duplicate indexes for first header


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.beta1.5
changelog:
  - dont try to remove environment files if private env used (related to #671200)
  - unbreak mono dependency extraction (#673663)
  - complain instead of silent abort if cwd is not readable (#672576)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.rc1.1
changelog:
  - update to 4.9.0-rc1
  - drop upstream patches
  - nss packaging has changed, buildrequire nss-softokn-freebl-devel


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-0.rc1.4
changelog:
  - spec cosmetics clean up extra whitespace + group more logically
  - wipe out BDB environment at boot via tmpfiles.d


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-5
changelog:
  - verify some properties of replaced and wrong-colored files (#528383)
  - only list packages that would be generated on spec query (#693338)
  - preferred color packages should be erased last (#680261)
  - fix leaks when freeing a populated transaction set
  - take file state into account for file dependencies


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-8
changelog:
  - add dwarf-4 support to debugedit (#707677)
  - generate build-id symlinks for all filenames sharing a build-id (#641377)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.0-9
changelog:
  - fix crash if prep or changelog section in spec is empty (#706959)
  - fix crash on macro which undefines itself
  - fix script dependency generation with file 5.07 string changes (#712251)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.1.2-3
changelog:
  - adjust db util prefix & dependency due to #749293
  - warn but dont fail the build if STABS encountered by debugedit (#725378)


author: Kay Sievers <kay@redhat.com> - 4.9.1.2-8
changelog:
  - add temporary rpmlib patch to support filesystem transition
    https://fedoraproject.org/wiki/Features/UsrMove


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.1.2-13
changelog:
  - fix memory corruption on rpmdb size estimation (#766260)
  - fix couple of memleaks in python bindings (#782147)
  - fix regression in verify output formatting (#797964)
  - dont process spec include in false branch of if (#782970)
  - only warn on missing excluded files on build (#745629)
  - dont free up file info sets on test transactions


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.90-0.git11505.5
changelog:
  - add temporary fake library provides to get around deltarpm "bootstrap"
    dependency (yes its dirty)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.90-0.git11519.1
changelog:
  - newer git snapshot to keep patch-count down
  - fixes CVE-2012-0060, CVE-2012-0061 and CVE-2012-0815
  - fix obsoletes in installing set getting matched on provides (#810077)


author: Panu Matilainen <pmatilai@redhat.com> - 4.9.90-0.git11536.1
changelog:
  - newer git snapshot (#809402, #808750)
  - adjust posttrans script wrt bdb string change (#803866, #805613)


author: Panu Matilainen <pmatilai@redhat.com> - 4.10.90-0.git11989.1
changelog:
  - update to 4.11 (http://rpm.org/wiki/Releases/4.11.0) post-alpha snapshot
  - drop/adjust patches as necessary


author: Panu Matilainen <pmatilai@redhat.com> - 4.10.90-0.git11989.3
changelog:
  - package /usr/lib/rpm/macros.d directory (related to #846679)
  - fixup a bunch of old incorrect dates in spec changelog


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.0-0.beta1.2
changelog:
  - armv7hl and armv7hnl should not have -mthumb (#901901)
  - fix duplicate directory ownership between rpm and rpm-build (#894201)
  - fix regression on paths shared between a real file/dir and a ghost


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.1-7
changelog:
  - fix build-time double-free on file capability processing (#956190)
  - fix relocation related regression on file sanity check (#1001553)
  - fix segfault on empty -p <lua> scriptlet body (#1004062)
  - fix source url, once again


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.1-11
changelog:
  - generate kmod(module.ko) provides for kernel (#1025513)
  - dont override CONFIG_SITE if already set (related to #962837)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.2-0.rc1.1
changelog:
  - update to 4.11.2-rc1 (http://rpm.org/wiki/Releases/4.11.2)
  - drop upstreamed patches, adjust others as needed
  - handle python egg-info's version munging in file lists


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.2-3
changelog:
  - dont eat newlines on parametrized macro invocations (#1045723)
  - fully reset file actions between rpmtsRun() calls (#1076552)
  - fix build and sign module initialization in python3 (#1064758)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.2-6
changelog:
  - build with -fsanitize=address and -fsanitize=undefined for now
  - add spec build conditional for sanitizer build


author: Tom Callaway <spot@fedoraproject.org> - 4.11.2-10
changelog:
  - remove _isa from all BuildRequires (bz 554854)
    See: https://fedoraproject.org/wiki/Packaging:Guidelines#BuildRequires_and_.25.7B_isa.7D


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.90-0.git12844.1
changelog:
  - Update to rpm 4.12-alpha ((http://rpm.org/wiki/Releases/4.12.0)
  - Drop/adjust patches as appropriate
  - New sub-package(s) for plugins


author: Panu Matilainen <pmatilai@redhat.com> - 4.12.0-0.beta1.1
changelog:
  - Update to 4.12.0-beta1 (http://rpm.org/wiki/Releases/4.12.0)
  - Fixes #1122004, #1111349, #1117912, #1123722
  - Drop upstreamed patches


author: Panu Matilainen <pmatilai@redhat.com> - 4.12.0.1-1
changelog:
  - Update to rpm-4.12.0.1 final (http://rpm.org/wiki/Releases/4.12.0.1)
  - Temporary workaround payload size mismatch issue in rpm2cpio (#1142949)


author: Panu Matilainen <pmatilai@redhat.com> - 4.12.0.1-3
changelog:
  - Skip ghost files in payload (#1156497)
  - Fix size and archice size tag generation on big-endian systems


author: Lubos Kardos <lkardos@redhat.com> - 4.12.0.1-5
changelog:
  - Add check against malicious CPIO file name size (#1168715)
  - Fixes CVE-2014-8118
  - Fix race condidition where unchecked data is exposed in the file system
    (#1039811)
  - Fixes CVE-2013-6435


author: Lubos Kardos <lkardos@redhat.com> 4.12.0-11
changelog:
  - Pass _find_debuginfo_opts -g to eu-strip for executables (#1186563)
  - add_minidebug is not ran when strip_g is set (#1186563)


author: Lubos Kardos <lkardos@redhat.com> - 4.12.90-5
changelog:
  - If globbing of a filename fails, try use the filename without globbing.
    (#1246743)
  - Modify rpmIsGlob() to be more precise and compatible with glob().
    (#1246743)


author: Lubos Kardos <lkardos@redhat.com> - 4.13-0.rc1.6
changelog:
  - If %_wrong_version_format_terminate_build is 1 then terminate build in case
    that version format is wrong i. e. epoch is not unsigned integer or version
    contains more separators (":", "-"). %_wrong_version_format_terminate_build
    is 1 by deafault (#1265700)


author: Lubos Kardos <lkardos@redhat.com> - 4.13-0.rc1.7
changelog:
  - Fix reading a memory right after the end of an allocated area (#1260248)
  - Add support for various types of dependencies to rpmdeps tool (#1247092)
  - fix %autopatch when patch do not exist (#1244172)


author: Lubos Kardos <lkardos@rpm.org> - 4.13.0-0.rc1.13
changelog:
  - Add possibility to disable file triggers
  - Fix unwanted multiple execution of filetriggers in dnf (#1282115)


author: Lubos Kardos <lkardos@redhat.com> - 4.13.0-0.rc1.20
changelog:
  - Revert using %configure, it causes problems
  - Temporary set %_gnu macro explictly, just for one build (#1303265)


author: Florian Festi <ffesti@rpm.org> - 4.13.0-0.rc1.24
changelog:
  - Also block idle and sleep in the systemd-inhibit plugin (#1297984)
  - Add support for MIPS release 6
  - Add mips32 mips64 mipsel and mipseb macros (#1285116)


author: Lubos Kardos <lkardos@redhat.com> 4.13.0-0.rc1.31
changelog:
  - Enable --no-backup-if-mismatch by default in %patch macro (#884755)
  - Add %{_default_patch_flags} to %__patch which is used in %autosetup
  - Use fuzz settings for %autopatch/%autosetup


author: Lubos Kardos <lkardos@redhat.com> 4.13.0-0.rc1.33
changelog:
  - Fix sigsegv in stringFormat() (#1316903)
  - Fix reading rpmtd behind its size in formatValue() (#1316896)


author: Igor Gnatenko <ignatenko@redhat.com> - 4.13.0-0.rc1.41
changelog:
  - Add %{?system_python_abi}
  - rpm-python -> python2-rpm && rpm-python3 -> python3-rpm with providing old names
  - Fixes and cleanups


author: Thierry Vignaud <tvignaud@redhat.com> - 4.13.0-2
changelog:
  - Fix package name references in python sub-packages to match reality
  - Re-enable test-suite now that it works again


author: Panu Matilainen <pmatilai@redhat.com> - 4.13.0-11
changelog:
  - Fix malformed packages being generated around 4GB boundary (#1405570)
  - Resurrect debuginfo GDB index generation (#1410907)


author: Mark Wielaard <mjw@redhat.com> - 4.13.0.1-13
changelog:
  - Add tests fix for sed file build-id regexp matching.
  - Add fix for build-ids in non-executable ELF files (#1433837).


author: Panu Matilainen <pmatilai@redhat.com> - 4.13.0.1-17
changelog:
  - Work around missing python[23] during build dependency parse
  - Include ISA in the new python library version dependencies too


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-19
changelog:
  - Minisymtab should only be added for executables or shared libraries.
  - Add find-debuginfo.sh -n (debugedit --no-recompute-build-id) option.


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-25
changelog:
  - Add support for debugsource and debuginfo subpackages
    - find-debuginfo-untangle-unique-build-options.patch
    - debugsrc-and-sub-debuginfo-packages.patch


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-28
changelog:
  - Add debugedit-prefix.patch.
  - Add find-debuginfo-filter-built-ins.patch.
  - Add find-debuginfo-dwz-multi.patch.
  - Add find-debuginfo-and-macro-docs.patch.


author: Mark Wielaard <mjw@fedoraproject.org> - 4.13.0.1-29
changelog:
  - Track patches using https://pagure.io/rpm-fedora
  - Use file list to explicitly set mode for build-id dirs/files
    (#1452893, #1458839)


author: Miro Hrončok <mhroncok@redhat.com> - 4.13.90-0.git14000.4
changelog:
  - Add platform-python bytecompilation patch: platform-python-bytecompile.patch
  - Add platform python deps generator patch: platform-python-abi.patch
  - Add a platform-python subpackage and remove system python related declarations
  - Build rpm without platform_python for bytecompilation
    (https://fedoraproject.org/wiki/Changes/Platform_Python_Stack)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.0-0.rc1.1
changelog:
  - Rebase to rpm 4.14.0-rc1 (http://rpm.org/wiki/Releases/4.14.0)
  - Re-enable SHA256 header digest generation (see #1480407)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.0-0.rc1.2
changelog:
  - Actually honor with/without libimaevm option
  - ima-evm-utils-devel >= 1.0 is required for rpm >= 4.14.0


author: Tomas Orsava <torsava@redhat.com> - 4.14.1-5
changelog:
  - Add envvar that will be present during RPM build,
    Part of a Fedora Change for F28: "Avoid /usr/bin/python in RPM build"
    https://fedoraproject.org/wiki/Changes/Avoid_usr_bin_python_in_RPM_Build


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.1-6
changelog:
  - Avoid unnecessary macro helper dependency on /usr/bin/python (#1538657)
  - Fix release of previous changelog entry


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-0.rc2.1
changelog:
  - Update to rpm 4.14.2-rc2
  - Fixes a regression in rpmlog error handling (#1597274)
  - Fixes several resource leaks found by covscan (#1602681)
  - Fixes DISTTAG not getting copied to source rpms (#1596193)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-1
changelog:
  - Buildrequire audit-libs-devel to actually enable the feature (#1607612)
  - Update to rpm 4.14.2 final (http://rpm.org/wiki/Releases/4.14.2)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-7
changelog:
  - Move python-macro-helper to main package where the macros are (#1651926)
  - Document --noverify in the man page (#1646458)
  - Handle unsupported digests the same as disabled ones (#1652529)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-11
changelog:
  - Revised patch for Py3 string data as surrogate-escaped utf-8 (#1631292)
  - Add a .decode() method to returned Py3 strings for compatibility


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-14
changelog:
  - Verify packages before signing (#1646388)
  - Make rpmsign exist values more consistent with our other tools


author: Florian Festi <ffesti@redhat.com> - 4.14.2-16
changelog:
  - Sort list of hard linked files in find-debuginfo.sh (#1421272)
  - Correct rpm -ql exit value when optional -p is omitted (#1680610)
  - Show list of files only once when use rpm -ql and multiple rpm files (#1689898)


author: Florian Festi <ffesti@redhat.com> - 4.14.2-23
changelog:
  - Use --dpbath only with full path (#1696408)
  - Fix memory leaks (#1714657)
  - Remove capabilities instead of setting empty caps via. --setcaps (#1700920)
  - Fix bash warning from solution for #1689810


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-27
changelog:
  - Support generating build-id's from compressed ELF files (#1650074)
  - Compress annobit notes in find-debuginfo (#1719837)


author: Florian Festi <ffesti@redhat.com> - 4.14.2-31
changelog:
  - Parallelize /usr/lib/rpm/brp-strip-static-archive (#1691824)
  - Parallelize /usr/lib/rpm/check-buildroot (#1704354)


author: Florian Festi <ffesti@redhat.com> - 4.14.3-5
changelog:
  - Don't error out when replacing an invalid signature (#1874062)
  - Raise an expection when erasing a package fails in Python (#1872623)
  - Fix builds on NFS filesystems (#1840728)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-12
changelog:
  - Bump up the limit of signature header to 64MB (#1918777)
  - Add fapolicyd plugin (#1923167)
  - Unblock signals in forked scriptlets (#1913765)
  - Fix ambiguous diagnostics output on file triggers (#1883338)
  - Ensure ELF files get stripped when debuginfo is disabled (#1634084)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-13
changelog:
  - Fix minor issues found by COVSCAN in fapolicyd plugin
  - Actually honor libarchive bcond at configure time (#1902887)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-15
changelog:
  - Add out-of-bounds checks to hdrblobInit() (#1929445)
  - Fixes CVE-2021-20266
  - Fix regression in brp-strip causing kmods to lose SecureBoot sig (#1967291)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-16
changelog:
  - Add support for read-only sqlite rpmdb (#1938928)
  - Drop compat .decode() method from returned Py3 strings (#1840142)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-32
changelog:
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63069)
  - Fix IMA signature lengths assumed constant (RHEL-39896)
  - Fix root relocation regression (RHEL-49494)
  - Report unsafe symlinks during installation as a specific case (RHEL-39897)
  - Don't segfault on missing priority tag (RHEL-39894)


author: Jarod Wilson <jarod@redhat.com> - 5-4
changelog:
  - Make hooks more resilient to missing info
  - Error out with a useful message when necessary info isn't there
  - Resolves: rhbz#1627122


author: Colin Walters <walters@verbum.org> - 2022.10.90.g4abaf4b4-4
changelog:
  - Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
    https://github.com/coreos/rpm-ostree/commit/4abaf4b4
    Resolves: rhbz#2118774


author: Colin Walters <walters@verbum.org> - 2022.10.94.g89f58028-2
changelog:
  - Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
    https://github.com/coreos/rpm-ostree/commit/89f58028f0bea5b6fa59bdb3506078e09957ec00
  - Resolves: rhbz#2122289
  - Resolves: rhbz#2122299


author: Colin Walters <walters@verbum.org> - 2022.10.97.gade6df33-2
changelog:
  - Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
    https://github.com/coreos/rpm-ostree/commit/ac182cb920f84946bb155e9cf061db7f5f26e917
  - Resolves: rhbz#2122289


author: Colin Walters <walters@verbum.org> - 2022.10.112.g3d0ac35b-3
changelog:
  - Cherry pick
    https://github.com/coreos/rpm-ostree/pull/4311/commits/a0f1275dfbd835b704355d095e610ac1f1254f25
    Resolves: rhbz#2170579


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2022.10.117.g52714b51-2
changelog:
  - Backport fb97c48f3 & eae7e1d8
    https://github.com/coreos/rpm-ostree/commit/fb97c48f3cd070c1ad559f3f43f86ad6548f6b02
    https://github.com/coreos/rpm-ostree/commit/eae7e1d8d692b5ce6d3d6eef29abbd7512ae4682
    Resolves: rhbz#2229804


author: Thomas Woerner <twoerner@redhat.com> - 8.10-7
changelog:
  - removed fakeroot requirement and all qa_robot scripts (RHBZ#1615605)
  - Fixed missing build requires for python3-devel


author: Michal Domonkos <mdomonko@redhat.com> - 8.10-8
changelog:
  - spectool: ignore query string in URL (RHBZ#1826299)
  - Fix TypeError in rpmdev-rmdevelrpms and rpmdev-checksig (RHBZ#1851499)


author: Todd Zullinger <tmz@pobox.com> - 1.10-9
changelog:
  - Update UsrLibBinaryException config to include .build-id
  - Ignore useless-provides on debuginfo provides (bz1489096)


author: Thomas Woerner <twoerner@redhat.com> - 1.10.13.1
changelog:
  - Fix unit test: use platform-python, py.test-3, no flake8 (RHBZ#1576803)
  - Update of ValidShells (RHBZ#1633698)
  - Remove Python2 paths from TagsCheck.py (RHBZ#1633698)
  - Enable bash-competion scripts (RHBZ#1577890)


author: Liming Sun <lsun@mellanox.com> - 2.0.2-1
changelog:
  - Remove unnecessary dependency in .spec and use make_build
  - Add package build for debian/ubuntu
  - Fix some format in the man page
  - Add check for syslog headers


author: Liming Sun <lsun@mellanox.com> - 2.0.3-1
changelog:
  - Enable pci device during probing
  - Map the pci resource0 file instead of /dev/mem
  - Add copyright header in bootstrap.sh
  - Add 'Requires' tag check in the rpm .spec for kernel-modules-extra
  - Fix the 'rshim --version' output


author: Liming Sun <lsun@mellanox.com> - 2.0.4-1
changelog:
  - Update .spec file according to review comments
  - Fix the 'KillMode' in rshim.service
  - Support process termination by SIGTERM
  - Fix some compiling warnings and configure issue for FreeBSD
  - Fix a read()/write() issue in rshim_pcie.c caused by optimization


author: Dean Nelson <dnelson@redhat.com> - 2.0.4-4
changelog:
  - Expose gating.yaml file in order to enable manual CI gating for rshim
    in RHEL-8.4, by bumping release and doing a Brew build.
  - Partially resolves: rhbz#1912248


author: Dean Nelson <dnelson@redhat.com> - 2.0.5-1
changelog:
  - Update user-space rshim driver source to version 2.0.5.
  - Modify rshim.spec accordingly.
  - Resolves: rhbz#1950425


author: Dean Nelson <dnelson@redhat.com> - 2.0.5-2
changelog:
  - Add sysconfig/rshim file and update rshim.service to source it.
  - jbastian made the first cut of this patch, which needed to be
    modified due to the update to 2.0.5. And I chose to go with
    %autosetup to handle Patch0, instead of sticking with %setup.
  - Resolves: rhbz#1946349


author: Dean Nelson <dnelson@redhat.com> - 2.0.8-1
changelog:
  - Update user-space rshim driver source to version 2.0.8
  - Modify rshim.spec accordingly
  - Resolves: rhbz#2196852


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-9
changelog:
  - Add deleteStateOnFileMove imfile module option
    resolves: rhbz#1909639
  - Add inotify_rm_watch() inotify API call when object needs to be destroyed
    resolves: rhbz#2052403


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-10
changelog:
  - openssl: Correct gnutlsPriorityString (custom ciphers) behaviour
  - Fix error handling in gtlsRecordRecv that can cause 100 percent CPU usage
    resolves: rhbz#2046158
  - Address CVE-2022-24903, Heap-based overflow in TCP syslog server
    resolves: rhbz#2081401


author: Attila Lakatos <alaktos@redhat.com> - 8.2102.0-13
changelog:
  - Make rsyslog-relp require librelp>= 1.9.0
    resolves: rhbz#2029352
  - Reorder logrotate parameters to work with POSIXLY_CORRECT env var
    resolves: rhbz#2070496


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-14
changelog:
  - Fix wrong type conversion in cstrLen()
    resolves: rhbz#2157804
  - imjournal: by default retrieves _PID from journal as PID number
    resolves: rhbz#2176398
  - Systemd service file hardening
    resolves: rhbz#2176404


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-15
changelog:
  - omelasticsearch: make compatible with elasticsearch>=8
  - add new action specific parameter esversion.major
    resolves: rhbz#2192955


author: Radovan Sroka <rsroka@redhat.com> - 8.32.0-1
changelog:
  - initial clean build with plugins from rhel7
  - removed plugins:
    - libdbi
    - omruleset
    - pmrfc3164sd
  - imported from fedora26


author: Marek Tamaskovic <mtamasko@redhat.com> - 8.35.0-1
changelog:
  - rebase to 8.35
  - rebased patches from 8.32 to 8.35
    - fixed imjournal-duplicates
    - fixed imjournal-default-tag
    - fixed service patch
    - fixed in upstream deserialize-property-name


author: Jiri Vymazal <jvymazal@redhat.com> - 8.35.0-1
changelog:
  - spec file cleanup
  - enabled kafka and hiredis modules
    resolves: rhbz#1542497
    resolves: rhbz#1542504
  - renamed patch fixing imjournal duplicating messages
    resolves: rhbz#1544394


author: Jiri Vymazal <jvymazal@redhat.com> - 8.36.0-1
changelog:
  - rebase to 8.36
  - removed hiredis module
  - removed omudpspoof module
    resolves: rhbz#1593762
  - finished converting config to new-style syntax


author: Jiri Vymazal <jvymazal@redhat.com> - 8.36.0-1
changelog:
  - changed PID file name to follow upstream
  - removed config option to disable stdlog as it is now
    disabled by default


author: Jiri Vymazal <jvymazal@redhat.com> - 8.36.0-3
changelog:
  - dropped json_nonoverwrite patch as there is no reason for
    keeping it
  - renumbered rest of patches
  - added release number to AC_INIT to have it in package error logs


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-1
changelog:
  - rebase to 8.37.0
    resolves: rhbz#1613880
    resolves: rhbz#1564054
    resolves: rhbz#1598218
    - dropped invalid statefile patch - upstreamed
    - dropped imjournal duplicates patch - upstreamed
    resolves: rhbz#1544394
  - renumbered default tag patch and fitted onto rebased version


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-5
changelog:
  - rebuild for rebased dependencies
  - dependency cleanup and sorted sub-packages in spec
    resolves: rhbz#1613880


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-10
changelog:
  RHEL 8.1.0 ERRATUM
  - added option for imfile endmsg.regex
    resolves: rhbz#1627941
  - added patch enhancing imfile rotation detection
    resolves: rhbz#1674471
  - added patch fixing msgOffset datatype preventing crash on
    message with too long other fields
    resolves: rhbz#1677037
  - added patch introducing "preservecase" option for imudp/imtcp
    resolves: rhbz#1614181


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-11
changelog:
  RHEL 8.1.0 ERRATUM
  - fixed memory leak in imjournal by proper cursor releasing
    resolves: rhbz#1716867


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-12
changelog:
  RHEL 8.1.0 ERRATUM
  - edited imjournal memleak patch to not cause double-free crash
    resolves: rhbz#1729995
  - added patch calling journald API only when there are no
    preceeding errors
    resolves: rhbz#1722165
  - added patch fixing imrelp module when invoked with old syntax
    resolves: rhbz#1724218


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-13
changelog:
  RHEL 8.1.0 ERRATUM
  - added patch enabling stricter TLS certs checking conforming to
    common criteria requirements
    resolves: rhbz#1733244


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-1
changelog:
  RHEL 8.2.0 ERRATUM
  - rebased to 8.1911.0 upstream version, removed, previously
    upstreamed patches
    resolves: rhbz#1740683
    resolves: rhbz#1659383
    resolves: rhbz#1746876
    resolves: rhbz#1676559
    resolves: rhbz#1692072
    resolves: rhbz#1692073
    resolves: rhbz#1692074
    resolves: rhbz#1699242
    resolves: rhbz#1738213
    resolves: rhbz#1744691
    resolves: rhbz#1755218
    resolves: rhbz#1768321
    resolves: rhbz#1768324
  - added patch fixing imfile stefiles naming
    resolves: rhbz#1763757


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-3
changelog:
  RHEL 8.2.0 ERRATUM
  - added patch reverting rejecting expired certs by default
    resolves: rhbz#1782353
  - added patch silencing false errors on config.enabled statement
    resolves: rhbz#1659383


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-5
changelog:
  RHEL 8.3.0 ERRATUM
  - added qpid-proton as another source and enabled omamqp1 module
    in a separate sub-package with it statically linked
    resolves: rhbz#1713427
  - extended config.enabled patch to cover rest of the cases
    resolves: rhbz#1659383
  - added patch making json serialization thread-safe
    resolves: rhbz#1789675
  - added another patch for imfile state-files id
    resolves: rhbz#1793569
  - fixed typo in commend-out part of default rsyslog.conf


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-6
changelog:
  RHEL 8.3.0 ERRATUM
  - added patch preventing imfile crash when selinux blocks symlink
    access
    resolves: rhbz#1843994
  - fixed config-enabled patch
    resolves: rhbz#1659383


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-2
changelog:
  RHEL 8.5.0 ERRATUM
  - rebase to 8.2102.0
    resolves: rhbz#1932795
  - Enable openssl
    resolves: rhbz#1891458
  - EKU check for client cert on server side
    resolves: rhbz#1783348
  - Use GNUTLS_SHUT_WR when ending TLS connections
    resolves: rhbz#1880434
  - Use librelp with openssl enabled
    resolves: rhbz#1795607
  - Close dir when fsync=on
    resolves: rhbz#1960536


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-3
changelog:
  - Priority field must have valid length
    resolves: rhbz#1866877
  - Allocate more memory on too large groups
    resolves: rhbz#1944718


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-5
changelog:
  - Do not exit when user/group can not be found
    resolves: rhbz#1984489
  - Remove abortOnIDResolution fail


author: John Kacur <jkacur@redhat.com> - 2.4-3
changelog:
  - Add error checking in hackbench to connect and getsockname
  - Fix compile warnings in hackbench because of comparison of different signs
  - Fix compile warnings in hackbench because of warnings about fall through
  Resolves: rhbz#bz2115064


author: Leah Leshchinsky <lleshchi@redhat.com> - 2.4-4
changelog:
  - hwlatdetect: Convert to fstrings
  - hwlatdetect: Update to integer division
  - hwlatdetect: Fix incorrect comment about test duration
  Resolves: rhbz#2121152


author: John Kacur <jkacur@redhat.com> - 2.6-2
changelog:
  - oslat: Fix conversion to nanoseconds for 1us bucket
  - oslat: correct spelling of Mhz to MHz
  Resolves: RHEL-23908


author: Stephen Gallagher <sgallagh@redhat.com> - 0.11-15
changelog:
  - Temporarily disable -Werror=format-security to unbreak the build
  - Build with verbose command-line visible in the logs
  - Resolves: rhbz#1424270


author: John Kacur <jkacur@redhat.com> - 5.14.0-3
changelog:
  - Fix exit status when returning from calls to usage()
  Resolves: rhbz#2161423
  jiraProject == RHELPLAN-145250


author: John Kacur <jkacur@redhat.com> - 5.14.0-6
changelog:
  - Forward port the tests directory for ci testing
  Resolves: rhbz#2196611
  jiraProject == RHELPLAN-156801


author: John Kacur <jkacur@redhat.com> - 6.6.0-1
changelog:
  Update to rtla in linux-6.6.0
  - Add patch to use SYS_gettid and add -lpthread to the Makefile
  Resolves: RHEL-10081


author: Jun Aruga <jaruga@redhat.com> - 2.5.5-105
changelog:
  - Use ffi_closure_alloc to avoid segmentation fault by libffi on aarch64.
    Resolves: rhbz#1727832
  - Properly support %prerelease in %gemspec_ macros.
    Related: rhbz#1688758
  - Fix rdoc gzipped javascript pages are not the same across multilib.
    Resolves: rhbz#1719647


author: Pavel Valena <pvalena@redhat.com> - 2.5.9-107
changelog:
  - Update to Ruby 2.5.9.
    * Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed
    Resolves: rhbz#1757844
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
    contains leading zero
    Resolves: rhbz#1950308


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-108
changelog:
  - Fix command injection vulnerability in RDoc.
    Resolves: CVE-2021-31799
  - Fix StartTLS stripping vulnerability in Net::IMAP
    Resolves: CVE-2021-32066
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    Resolves: CVE-2021-31810


author: Jun Aruga <jaruga@redhat.com> - 2.5.9-110
changelog:
  - Fix FTBFS due to an incompatible load directive.
  - Fix a fiddle import test on an optimized glibc on Power 9.
  - Fix by adding length limit option for methods that parses date strings.
    Resolves: CVE-2021-41817
  - CGI::Cookie.parse no longer decodes cookie names to prevent spoofing security
    prefixes in cookie names.
    Resolves: CVE-2021-41819


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-111
changelog:
  - Fix HTTP response splitting in CGI.
    Resolves: CVE-2021-33621
  - Fix Buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739
  - Fix ReDoS vulnerability in URI.
    Resolves: CVE-2023-28755
  - Fix ReDoS vulnerability in Time.
    Resolves: CVE-2023-28756


author: Toru Hoshina <hoshina@best.com>
changelog:
  - Modified SPEC in order to install libruby.a so that it should be used by
    another ruby entention.
  - 2nd release.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/12/2000 CVS).
  - Added manuals and FAQs.
  - Split into ruby, ruby-devel, ruby-tcltk, ruby-docs, irb.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/20/2000 CVS).
  - Removed ruby-list.23190.patch(included into ruby_cvs.patch).
  - Added ruby-dev.10054.patch.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/22/2000 CVS).
  - Removed ruby-dev.10054.patch(included into ruby_cvs.patch).


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.6.
  - removed ruby-dev.10123.patch(included into ruby-1.4.6).
  - Added ruby_cvs.2000082901.patch(upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Updated to upstream version 1.6.1.
  - Removed ruby_cvs.2000082901.patch and added ruby_cvs.2000092718.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000092718.patch and added ruby_cvs.2000100218.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100218.patch and added ruby_cvs.2000100313.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100313.patch and added ruby_cvs.2000100313.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100313.patch and added ruby_cvs.2000101117.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000101117.patch and added ruby_cvs.2000101901.patch
    (upgraded ruby to latest cvs version).
  - Added ruby-dev.11262.patch.
  - Added ruby-dev.11265.patch.


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000101901.patch, added ruby_cvs.2000121413.patch
    (upgraded ruby to latest cvs version).
  - Removed ruby-dev.11262.patch, ruby-dev.11265.patch,
    and ruby-dev.11268.patch (included into above patch).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000121413.patch, added ruby_cvs.2000122019.patch
    (upgraded ruby to latest cvs version).
  - new package: libruby


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000122019.patch, added ruby_cvs.2000122215.patch
    (upgraded ruby to latest cvs version, 1.6.2-preview4).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Applied patch: upgraded to cvs version (2001-01-15):
    fixed minor bugs(e.g. ruby makes extention librares too large...).


author: akira yamada <akira@vinelinux.org>
changelog:
  - fixed bad group for libruby.
  - Applied patch: upgraded to cvs version (2001-02-08):
    fixed minor bugs.


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.6.4-2
changelog:
  - Remove Japanese description and summaries; they belong in specspo and
    break rpm
  - Clean up specfile
  - Mark language specific files (README.jp) as such
  - bzip2 sources
  - rename the libruby package to ruby-libs for consistency
  - Exclude ia64 (doesn't build - the code doesn't seem to be 64-bit clean
    [has been excluded on alpha forever])


author: Akira TAGOH <tagoh@redhat.com> 1.6.6-1
changelog:
  - New upstream release.
  - Applied bug fix patches:
    - ruby-1.6.6-501-ruby-mode.patch: ruby-talk#30479: disables font-lock
      coloring.
    - ruby-1.6.6-100.patch: ruby-talk#30203: Ruby 1.6.6 bug and fix
                            ruby-list#33047: regex bug
                            PR#230: problem with -d in 1.6.6
  - Added ruby-mode and ruby-mode-xemacs packages.
  - Ruby works fine for ia64. so re-enable to build with ia64.
    (probably it should be worked for alpha)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-1
changelog:
  - New upstream release.
  - ruby-1.6.6-100.patch, ruby-1.6.6-501-ruby-mode.patch:
    removed. these patches no longer should be needed.
  - ruby-1.6.7-500-marshal-proc.patch: applied a fix patch.
    (ruby-dev#16178: Marshal::dump should call Proc#call.)
  - ruby-1.6.7-501-class-var.patch: applied a fix patch.
    (ruby-talk#35157: class vars broken in 1.6.7)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-2
changelog:
  - ruby-man-1.4.6-jp.tar.bz2: removed.
  - ruby-refm-rdp-1.4.7-ja-html.tar.bz2: uses it instead of.
  - ruby-1.6.7-500-marshal-proc.patch, ruby-1.6.7-501-class-var.patch:
    removed.
  - ruby-1.6.7-100.patch: applied a bug fix patch.
    (ruby-dev#16274: patch for 'wm state')
    (PR#206ja: SEGV handle EXIT)
  - ruby-1.6.7-101.patch: applied a bug fix patch.
    (ruby-list#34313: singleton should not be Marshal.dump'ed)
    (ruby-dev#16411: block local var)
  - ruby-1.6.7-102.patch: applied a bug fix patch.
    (handling multibyte chars is partially broken)
  - ruby-1.6.7-103.patch: applied a bug fix patch.
    (ruby-dev#16462: preserve reference for GC, but link should be cut)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-10
changelog:
  - moved sitedir to /usr/lib/ruby/site_ruby again according as our perl and
    python.
  - ruby-1.6.7-resolv1.patch, ruby-1.6.7-resolv2.patch: applied to fix 'Too many
    open files - "/etc/resolv.conf"' issue. (Bug#64830)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-11
changelog:
  - use %configure macro instead of configure script.
  - use the latest config.{sub,guess}.
  - get archname from rbconfig.rb for %dir
  - applied some patches from Debian:
    - 801_extmk.rb-shellwords.patch: use Shellwords
    - 801_mkmf.rb-shellwords.patch: mkmf.rb creates bad Makefile. the Makefile
      links libruby.a to the target.
    - 803_sample-fix-shbang.patch: all sample codes should be
      s|/usr/local/bin|/usr/bin|g
    - 804_parse.y-new-bison.patch: fix syntax warning.
    - 805_uri-bugfix.patch: uri.rb could not handle correctly broken mailto-uri.
  - add ExcludeArch x86_64 temporarily to fix Bug#74581. Right now ruby can't be
    built on x86_64.


author: Elliot Lee <sopwith@redhat.com> 1.6.7-13
changelog:
  - Remove ExcludeArch: x86_64
  - Fix x86_64 ruby with long2int.patch (ruby was assuming that sizeof(long)
    == sizeof(int). The patch does not fix the source of the problem, just
    makes it a non-issue.)
  - _smp_mflags


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-1
changelog:
  - New upstream release.
  - removed some patches. it's no longer needed.
    - ruby-1.6.7-100.patch
    - ruby-1.6.7-101.patch
    - ruby-1.6.7-102.patch
    - ruby-1.6.7-103.patch
    - 801_extmk.rb-shellwords.patch
    - 801_mkmf.rb-shellwords.patch
    - 804_parse.y-new-bison.patch
    - 805_uri-bugfix.patch
    - ruby-1.6.6-900_XXX_strtod.patch
    - ruby-1.6.7-sux0rs.patch
    - ruby-1.6.7-libobj.patch


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-2
changelog:
  - ruby-1.6.8-require.patch: applied to fix the search bug in require.
  - don't apply long2int patch to s390 and s390x. it doesn't work.


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-7
changelog:
  - fix the gcc warnings. (#82192)
  - ruby-1.6.8-fix-x86_64.patch: correct a patch.
    NOTE: DON'T USE THIS PATCH FOR BIG ENDIAN ARCHITECTURE.
  - ruby-1.6.7-long2int.patch: removed.


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-9
changelog:
  - ruby-1.6.8-castnode.patch: handling the nodes with correct cast.
    use this patch now instead of ruby-1.6.8-fix-x86_64.patch.


author: Akira TAGOH <tagoh@redhat.com> 1.8.1-1
changelog:
  - New upstream release.
  - don't use any optimization for ia64 to avoid the build failure.
  - ruby-1.8.1-ia64-stack-limit.patch: applied to fix SystemStackError when the optimization is disabled.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.1-9
changelog:
  - ruby-1.8.1-cgi-dos.patch: security fix [CAN-2004-0983]
  - ruby-1.8.1-cgi_session_perms.patch: security fix [CAN-2004-0755]


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-1
changelog:
  - New upstream release.
  - ruby-1.8.1-ia64-stack-limit.patch: removed - it's no longer needed.
  - ruby-1.8.1-cgi_session_perms.patch: likewise.
  - ruby-1.8.1-cgi-dos.patch: likewise.
  - generated Ruby interactive documentation - senarated package.
    it's now provided as ri package. (#141806)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-7
changelog:
  - ruby-1.8.2-deadcode.patch: removed the dead code from the source. (#146108)
  - make sure that all documentation files in ruby-docs are the world-
    readable. (#147279)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-9
changelog:
  - ruby-1.8.2-xmlrpc-CAN-2005-1992.patch: fixed the arbitrary command execution
    on XMLRPC server. (#161096)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-1
changelog:
  - New upstream release.
  - Build-Requires xorg-x11-devel instead of XFree86-devel.
  - ruby-multilib.patch: applied for only 64-bit archs.
  - ruby-1.8.2-xmlrpc-CAN-2005-1992.patch: removed. it has already been in upstream.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-3
changelog:
  - fixed the wrong file list. the external library for tcl/tk was included
    in ruby-libs unexpectedly.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-4
changelog:
  - moved the documents from ruby-libs to ruby-docs, which contains the arch
    specific thing and to be multilib support. (#168826)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-0.4.preview2
changelog:
  - updates to 1.8.4-preview2.
  - renamed the packages to ruby-* (#175765)
    - irb  -> ruby-irb
    - rdoc -> ruby-rdoc
    - ri   -> ruby-ri
  - added tcl-devel and tk-devel into BuildRequires.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-1
changelog:
  - New upstream release.
    - fixed a missing return statement. (#140833)
    - fixed an use of uninitialized variable. (#144890)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-3
changelog:
  - ruby-1.8.4-no-eaccess.patch: backported from ruby CVS to avoid conflict
    between newer glibc. (#179835)


author: Akira TAGOH <tagoh@redhat.com>
changelog:
  - ruby-rubyprefix.patch: moved all arch-independent modules under /usr/lib/ruby
    and keep arch-dependent modules under /usr/lib64/ruby for 64bit archs.
    so 'rubylibdir', 'sitelibdir' and 'sitedir' in Config::CONFIG points to
    the kind of /usr/lib/ruby now. (#184199)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-6
changelog:
  - ruby-deprecated-search-path.patch: added the deprecated installation paths
    to the search path for the backward compatibility.
  - added a Provides: ruby(abi) to ruby-libs.
  - ruby-1.8.4-64bit-pack.patch: backport patch from upstream to fix unpack("l")
    not working on 64bit arch and integer overflow on template "w". (#189350)
  - updated License tag to be more comfortable, and with a pointer to get more
    details, like Python package does. (#179933)
  - clean up.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-7
changelog:
  - exclude ppc64 to make ruby-mode package. right now emacs.ppc64 isn't provided
    and buildsys became much stricter.
  - ruby-deprecated-sitelib-search-path.patch: applied to add more search path
    for backward compatiblity.
  - added byacc to BuildReq. (#194161)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-11
changelog:
  - security fixes [CVE-2006-3694]
    - ruby-1.8.4-fix-insecure-dir-operation.patch:
    - ruby-1.8.4-fix-insecure-regexp-modification.patch: fixed the insecure
      operations in the certain safe-level restrictions. (#199538)
    - ruby-1.8.4-fix-alias-safe-level.patch: fixed to not bypass the certain
      safe-level restrictions. (#199543)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-1
changelog:
  - New upstream release.
  - removed the unnecessary patches:
    - ruby-1.8.4-no-eaccess.patch
    - ruby-1.8.4-64bit-pack.patch
    - ruby-1.8.4-fix-insecure-dir-operation.patch
    - ruby-1.8.4-fix-insecure-regexp-modification.patch
    - ruby-1.8.4-fix-alias-safe-level.patch
  - build with --enable-pthread except on ppc.
  - ruby-1.8.5-hash-memory-leak.patch: backported from CVS to fix a memory leak
    on Hash. [ruby-talk:211233]


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-4
changelog:
  - security fix release.
  - ruby-1.8.5-cgi-CVE-2006-5467.patch: fix a CGI multipart parsing bug that
    causes the denial of service. (#212396)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.36-3
changelog:
  - ruby-r12567.patch: backport patch from upstream svn to get rid of
    the unnecessary declarations. (#245446)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.110-1
changelog:
  - New upstream release.
    - ruby-r12567.patch: removed.
  - ruby-1.8.6-CVE-2007-5162.patch: security fix for Net::HTTP that is
    insufficient verification of SSL certificate.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.110-2
changelog:
  - Enable pthread support for ppc too. (#201452)
  - Fix unexpected dependencies appears in ruby-libs. (#253325)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.111-1
changelog:
  - New upstream release.
  - ruby-1.8.6.111-CVE-2007-5162.patch: Update a bit with backporting the changes
     at trunk to enable the fix without any modifications on the users' scripts.
     Note that Net::HTTP#enable_post_connection_check isn't available anymore.
     If you want to disable this post-check, you should give OpenSSL::SSL::VERIFY_NONE
     to Net::HTTP#verify_mode= instead of.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.111-3
changelog:
  - Clean up the spec file.
  - Remove ruby-man-1.4.6 stuff. this is entirely the out-dated document.
    this could be replaced by ri.
  - Disable the static library building.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.114-1
changelog:
  - Security fix for CVE-2008-1145.
  - Improve a spec file. (#226381)
    - Correct License tag.
    - Fix a timestamp issue.
    - Own a arch-specific directory.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.230-1
changelog:
  - New upstream release.
  - Security fixes. (#452295)
    - CVE-2008-1891: WEBrick CGI source disclosure.
    - CVE-2008-2662: Integer overflow in rb_str_buf_append().
    - CVE-2008-2663: Integer overflow in rb_ary_store().
    - CVE-2008-2664: Unsafe use of alloca in rb_str_format().
    - CVE-2008-2725: Integer overflow in rb_ary_splice().
    - CVE-2008-2726: Integer overflow in rb_ary_splice().
  - ruby-1.8.6.111-CVE-2007-5162.patch: removed.
  - Build ruby-mode package for all archtectures.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.230-3
changelog:
  - Backported from upstream SVN to fix a segfault issue. (#452825)
  - Backported from upstream SVN to fix an integer overflow in rb_ary_fill.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.287-1
changelog:
  - New upstream release.
  - Security fixes.
    - CVE-2008-3655: Ruby does not properly restrict access to critical
                     variables and methods at various safe levels.
    - CVE-2008-3656: DoS vulnerability in WEBrick.
    - CVE-2008-3657: Lack of taintness check in dl.
    - CVE-2008-1447: DNS spoofing vulnerability in resolv.rb.
    - CVE-2008-3443: Memory allocation failure in Ruby regex engine.
  - Remove the unnecessary backported patches.


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.383-4
changelog:
  - Use bison to regenerate parse.c to keep the original format of error
    messages (bug 530275 comment 4)


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.383-5
changelog:
  - Change mkmf.rb to use LIBRUBYARG_SHARED so that have_library() works
    without libruby-static.a (bug 428384)
  - And move libruby-static.a to -static subpackage


author: Jeroen van Meeuwen <j.van.meeuwen@ogd.nl> - 1.8.6.388-8
changelog:
  - Backport openssl/digest functions providing digest and hexdigest functions
    directly in OpenSSL::Digest.methods
  - Make sure that Red Hat people version their changelog entries
  - This is actually release #1, but now needs to be release #7


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-2
changelog:
  - tcltk: Give up using potentially unmaintained ruby_1_8_6 branch
    and instead completely replace with ruby_1_8 branch head
    (at this time, using rev 27738)
    (seems to fix 560053, 590503)
  - Fix Japanese encoding strings under ruby-tcltk/ext/tk/sample/


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-3
changelog:
  - ruby-1.8.x-null-class-must-be-Qnil.patch (bug 530407)
  - Recreate some patches using upstream svn when available, and
    add some comments for patches


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-4
changelog:
  - Patch36 (ruby-1.8.x-RHASH_SIZE-rb_hash_lookup-def.patch)
    also backport rb_hash_lookup definition (bug 592936)


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-5
changelog:
  - Retry for bug 559158, Simplify the OpenSSL::Digest class
    pull more change commits from ruby_1_8 branch


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.249-3
changelog:
  - Integrated Jim Meyering's feedback and changes in to:
  - remove trailing blanks
  - placate rpmlint
  - ruby_* definitions: do not use trailing slashes in directory names
  - _normalized_cpu: simplify definition


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.299-1
changelog:
  - integrate more of jmeyering's and mtaska's feedback
  - removed emacs bits that are now shipped with the emacs package
  - various patch and spec cleanup
  - rebased to ruby 1.8.7 patch 299, removed patches no longer needed:
     ruby-1.8.7-openssl-1.0.patch, ruby-1.8.7-rb_gc_guard_ptr-optimization.patch


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.299-2
changelog:
  - readded bits to pull tk package from upstream source branch
  - removed unecessary .tk.old dir
  - renamed macros which may cause confusion, removed unused ones


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.299-3
changelog:
  - updated packaged based on feedback (from mtasaka)
  - added comments to all patches / sources
  - obsoleted ruby-mode, as it's now provided by the emacs package itself
  - readded missing documentation
  - various small compatability/regression fixes


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.7.299-4
changelog:
  - Cleanup spec file
  - Make -irb, -rdoc subpackage noarch
  - Make dependencies between arch-dependent subpackages isa specific
  - Improve sample documentation gathering


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.7.302-1
changelog:
  - Update to 1.8.7.302
  - CVE-2010-0541 (bug 587731) is fixed in this version
  - Update ext/tk to the latest head


author: Mamoru Tasaka <mtasaka@fedoraproject.org> - 1.8.7.352-1
changelog:
  - Update to 1.8.7 p352
  - CVE-2011-2686 is fixed in this version (bug 722415)
  - Update ext/tk to the latest git
  - Remove duplicate path entry (bug 718695)


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.0-2
changelog:
  - Install RubyGems outside of Ruby directory structure.
  - RubyGems has not its own -devel subpackage.
  - Enhanced macros.ruby and macros.rubygems.
  - All tests are green now (bkabrda).


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.0-4
changelog:
  - Bundled gems moved into dedicated directories and subpackages.
  - Create and own RubyGems directories for binary extensions.
  - Fix build with GCC 4.7.


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.0-5
changelog:
  - Initial release of Ruby 1.9.3.
  - Add rubygems dependency on io-console for user interactions.
  - Gems license clarification.


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.9.3.286-19
changelog:
  - Update to 1.9.3 p286
  - Don't create files when NUL-containing path name is passed
    (bug 865940, CVE-2012-4522)


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.9.3.327-21
changelog:
  - Update to 1.9.3.327
  - Fix Hash-flooding DoS vulnerability on MurmurHash function
    (CVE-2012-5371)


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.9.3.374-27
changelog:
  - Update to 1.9.3 p374
  - Fix provided variables in pkgconfig (bug 789532:
    Vít Ondruch <vondruch@redhat.com>)


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-0.1.r39387
changelog:
  - Upgrade to Ruby 2.0.0 (r39387).
  - Introduce %gem_install macro.
  - Build against libdb instead of libdb4 (rhbz#894022).
  - Move native extensions from exts to ruby directory.
  - Enable most of the PPC test suite.
  - Change ruby(abi) -> ruby(release).
  - Rename ruby executable to ruby-mri, to be prepared for RubyPick.
  - Add ruby(runtime_executable) virtual provide, which is later used
    by RubyPick.
  - RDoc now depends on JSON.
  - Try to make -doc subpackage noarch again, since the new RDoc should resolve
    the arch dependent issues (https://github.com/rdoc/rdoc/issues/71).
  - Enable SystemTap support.
  - Add TapSet for Ruby.
  - Split Psych into rubygem-psych subpackage.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-1
changelog:
  - Update to Ruby 2.0.0-p0.
  - Change %{ruby_extdir} to %{ruby_extdir_mri} in preparation for better
    JRuby support.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-3
changelog:
  - Avoid "method redefined;" warnings due to modified operating_system.rb.
  - Fix strange paths created during build of binary gems.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-7
changelog:
  - Macro definition moved into macros.ruby and macros.rubygems files.
  - Added filtering macros.
  - Filter automatically generated provides of private libraries (rhbz#947408).


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.195-8
changelog:
  - Update to Ruby 2.0.0-p195 (rhbz#917374).
  - Fix object taint bypassing in DL and Fiddle (CVE-2013-2065).
  - Fix build against OpenSSL with enabled ECC curves.
  - Add aarch64 support (rhbz#926463).


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-9
changelog:
  - Update to Ruby 2.0.0-p247 (rhbz#979605).
  - Fix CVE-2013-4073.
  - Fix for wrong makefiles created by mkmf (rhbz#921650).
  - Add support for ABRT autoloading.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-13
changelog:
  - Fixes multilib conlicts of .gemspec files.
  - Make symlinks for psych gem to ruby stdlib dirs (rhbz#979133).
  - Use system-wide cert.pem.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-14
changelog:
  - Add forgotten psych.rb link into rubygem-psych to fix "private method `load'
    called for Psych:Moduler" error (rhbz#979133).


author: Vít Ondruch <vondruch@redhat.com> - 2.1.0-17
changelog:
  - Upgrade to Ruby 2.1.0.
  - Move RPM macros into /usr/lib/rpm/macros.d directory.
  - Allow MD5 in OpenSSL for tests.


author: Vít Ondruch <vondruch@redhat.com> - 2.1.0-18
changelog:
  - Don't generate documentation on unexpected places.
  - Detect if rubygems are running under rpmbuild and install gem binary
    extensions into appropriate place.
  - Add support for ppc64le arch (rhbz#1053263).
  - Re-enable some test cases, which are passing now with Kernel 3.12.8+.
  - Backport fix for floating point issues on i686.


author: Vít Ondruch <vondruch@redhat.com> - 2.1.1-20
changelog:
  - Remove useless exclude (rhbz#1065897).
  - Extract load macro into external file and include it.
  - Kill bundled certificates.


author: Vít Ondruch <vondruch@redhat.com> - 2.1.4-24
changelog:
  - Update to Ruby 2.1.4.
  - Include only vendor directories, not their content (rhbz#1114071).
  - Fix "invalid regex" warning for non-rubygem packages (rhbz#1154067).
  - Use load macro introduced in RPM 4.12.


author: Vít Ondruch <vondruch@redhat.com> - 2.2.0-1
changelog:
  - Upgrade to Ruby 2.2.0.
  - Explicitly list RubyGems directories to avoid accidentaly packaged content.
  - Split test-unit and power_assert gems into separate sub-packages.
  - Drop libdb dependency in favor of gdbm.


author: Vít Ondruch <vondruch@redhat.com> - 2.2.2-40
changelog:
  - Fix upgrade path (rubygem-io-console's version was recently bumped in F21
    and makes the higher release to win).


author: Vít Ondruch <vondruch@redhat.com> - 2.3.0-50
changelog:
  - Upgrade to Ruby 2.3.0.
  - Move gemified net-telnet into subpackage.
  - Add did_you_mean subpackage.
  - Add virtual provides for CCAN copylibs.
  - Use weak dependencies.


author: Vít Ondruch <vondruch@redhat.com> - 2.3.1-59
changelog:
  - Continue to use OpenSSL 1.0 for the moment.
  - Add gemspec_add_dep and gemspec_remove_dep macros.
  - Harden package.


author: Vít Ondruch <vondruch@redhat.com> - 2.4.0-70
changelog:
  - Upgrade to Ruby 2.4.0.
  - Move gemified xmlrpc into subpackage.
  - Move gemified openssl into subpackage.
  - Tk is removed from stdlib.
  - Extend 'gem_' macros for pre-release version support.


author: Vít Ondruch <vondruch@redhat.com> - 2.4.1-83
changelog:
  - Fix "IOError: stream closed" errors affecting Puma.
  - Temporary disable checksec on PPC64LE (rhbz#1479302).


author: Vít Ondruch <vondruch@redhat.com> - 2.5.0-89
changelog:
  - Drop obsolete ldconfig scriptlets.
  - Add GMP dependency.
  - Use 'with' operator in RPM dependency generator.
  - Add conflicts RPM generator.
  - Fix thread_safe test suite segfaults.
  - Fix invalid licenses.


author: Pavel Valena <pvalena@redhat.com> - 2.5.0-89
changelog:
  - Fix: Multiple vulnerabilities in RubyGems
    https://bugzilla.redhat.com/show_bug.cgi?id=1547431
    https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/


author: Florian Weimer <fweimer@redhat.com> - 2.5.0-89
changelog:
  - Rebuild with new LDFLAGS from redhat-rpm-config
  - Use --with-setjmp-type=setjmp on aarch64 to work around gcc issue (#1545239)


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-92
changelog:
  - Conflict requirement needs to generate dependency.
  - Stop using --with-setjmp-type=setjmp on aarch64 (rhbz#1545239).


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-97
changelog:
  - Fix TLS 1.3 issues.
    * ruby-2.6.0-fix-test-failure-with-TLS-1.3.patch
    * ruby-2.6.0-net-http-net-ftp-fix-session-resumption-with-TLS-1.3.patch
    Related: rhbz#1616213


author: Jun Aruga <jaruga@redhat.com> - 2.5.1-99
changelog:
  - Fix generated rdoc template issues.
    * ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch
    Resolves: rhbz#1612026


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-99
changelog:
  - Additional OpenSSL 1.1.1 fixes.
    * ruby-2.6.0-fix-test-failure-with-TLS-1.3-maint.patch
    * ruby-2.6.0-config-support-include-directive.patch
    * ruby-2.6.0-use-larger-keys-for-SSL-tests.patch
    Related: rhbz#1616213


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-100
changelog:
  - Properly harden package using -fstack-protector-strong.
    * ruby-2.6.0-configure-fstack-protector-strong.patch
    Resolves: rhbz#1624168


author: Vít Ondruch <vondruch@redhat.com> - 2.5.5-104
changelog:
  - Update to Ruby 2.5.5.
    * Remove Patch25: ruby-2.6.0-Update-for-tzdata-2018f.patch; subsumed
    * Remove Patch11: ruby-2.6.0-Try-to-update-cert.patch; subsumed
    * Remove Patch19: ruby-2.6.0-net-http-net-ftp-fix-session-resumption-with
        -TLS-1.3.patch; subsumed
    Resolves: rhbz#1688758
  - Don't ship .stp files when SystemTap support is disabled.
    Related: rhbz#1657915
  - Fix CovScan issues.
    Resolves: rhbz#1628592


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-112
changelog:
  - Fix ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755.
    (CVE-2023-36617)
    Resolves: RHEL-5614
  - Fix Buffer overread vulnerability in StringIO.
    (CVE-2024-27280)
    Resolves: RHEL-34125
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    (CVE-2024-27281)
    Resolves: RHEL-34117
  - Fix Arbitrary memory address read vulnerability with Regex search.
    (CVE-2024-27282)
    Resolves: RHEL-33867
  - Fix REXML DoS parsing an XML with many `<`s in an attribute value.
    (CVE-2024-35176)
    Resolves: RHEL-37877


author: Vít Ondruch <vondruch@redhat.com> - 2.5.9-114
changelog:
  - Fix integer overflow in search_in_range function in regexec.c (CVE-2019-19012).
    Resolves: RHEL-87505


author: Jun Aruga <jaruga@redhat.com> - 2.6.3-105
changelog:
  - Update to Ruby 2.6.3 by merging Fedora master branch (commit: 1cc2a49)
    * Properly generate "ruby(rubygems)" versioned dependencies.
    * Extract composition of dependecy strings into helper.
    * Loosen RDoc dependency.
    * Upstream fix adding -C flag instead of changing directory for gem build.
    * Remove obsolete Group tag
    * Fix ".include =" support in openssl.cnf.
    * Link IRB back to StdLib.
    * Link IRB files instead of directories.
    * Exclude irb.rb from ruby-libs.
    Resolves: rhbz#1672575


author: Jun Aruga <jaruga@redhat.com> - 2.6.3-106
changelog:
  - Use ffi_closure_alloc to avoid segmentation fault by libffi on aarch64.
    Resolves: rhbz#1727832
  - Properly support %prerelease in %gemspec_ macros.
    Related: rhbz#1672575


author: Jarek Prokop <jprokop@redhat.com> - 2.6.7-107
changelog:
  - Upgrade to Ruby 2.6.7.
    Resolves: rhbz#1757846
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given an address
    containing leading zero
    Resolves: rhbz#1950307
  - Fix: Rubygem-bundler: Don't use insecure tmp directory as home
    allows for execution of malicious code.
    Resolves: CVE-2019-3881


author: Jun Aruga <jaruga@redhat.com> - 2.6.9-108
changelog:
  - Upgrade to Ruby 2.6.9.
  - Skip JIT tests in RHEL 8.
  - Fix the issues required to start the "make test-bundler" itself.
  - Fix Bundler dependency confusion.
    Resolves: CVE-2020-36327


author: Vít Ondruch <vondruch@redhat.com> - 2.6.10-109
changelog:
  - Upgrade to Ruby 2.6.10.
    Resolves: rhbz#2088415
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739
  - Fix FTBFS due to an incompatible load directive.
  - Fix a fiddle import test on an optimized glibc on Power 9.


author: Jun Aruga <jaruga@redhat.com> - 2.7.1-132
changelog:
  - Update to Ruby 2.7.1 by merging Fedora master branch (commit: 2981648)
    * Skip unstable tests on s390x.
    * Skip JIT tests in RHEL 8.
    Resolves: rhbz#1817135


author: Vít Ondruch <vondruch@redhat.com> - 2.7.1-133
changelog:
  - Fix `require` behavior allowing to load libraries multiple times.
    Resolves: rhbz#1842989
  - Add ruby-default-gems dependency on irb.


author: Pavel Valena <pvalena@redhat.com> - 2.7.3-136
changelog:
  - Upgrade to Ruby 2.7.3.
    Resolves: rhbz#1947938
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
    contains leading zero
    Resolves: rhbz#1944227


author: Jun Aruga <jaruga@redhat.com> - 2.7.4-137
changelog:
  - Upgrade to Ruby 2.7.4.
  - Fix command injection vulnerability in RDoc.
    Resolves: CVE-2021-31799
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    Resolves: CVE-2021-31810
  - Fix StartTLS stripping vulnerability in Net::IMAP.
    Resolves: CVE-2021-32066
  - Upgrade to Bundler 2.2.24.
    Resolves: CVE-2020-36327


author: Jarek Prokop <jprokop@redhat.com> - 2.7.6-138
changelog:
  - Upgrade to Ruby 2.7.6.
    Resolves: rhbz#2096345
  - Fix FTBFS due to an incompatible load directive.
    Related: rhbz#2096345
  - Fix a fiddle import test on an optimized glibc on Power 9.
    Related: rhbz#2096345
  - Fix regular Expression Denial of Service Vulnerability of Date Parsing Methods.
    Resolves: CVE-2021-41817
  - Fix cookie prefix spoofing in CGI::Cookie.parse.
    Resolves: CVE-2021-41819
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739


author: Jarek Prokop <jprokop@redhat.com> - 2.7.8-139
changelog:
  - Upgrade to Ruby 2.7.8.
    Resolves: rhbz#2189465
  - Fix HTTP response splitting in CGI.
    Resolves: CVE-2021-33621
  - Fix ReDoS vulnerability in URI.
    Resolves: CVE-2023-28755
  - Fix ReDoS vulnerability in Time.
    Resolves: CVE-2023-28756


author: Jarek Prokop <jprokop@redhat.com> - 3.0.1-138
changelog:
  - Upgrade to Ruby 3.0.1 by merging Fedora rawhide branch (commit: 6b2ff68).
    * Add missing `rubygem-` prefix for bundled provide of 'connection_pool'.
    * Pass ldflags to gem install via CONFIGURE_ARGS
    * Remove IRB dependency from rubygem-rdoc.
    * Fix flaky excon test suite.
    * Properly support DWARF5 debug information.
        Related: rhbz#1920533
    * Bundle OpenSSL into StdLib.
    * Fix SEGFAULT in rubygem-shoulda-matchers test suite.
    * Provide `gem.build_complete` file for binary gems.
    * Re-enable test suite.
    * ruby-default-gems have to depend on rubygem(io-console) due to reline.
    * Fix SEGFAULT preventing rubygem-unicode to build on armv7hl.
    * Add support for reworked RubyGems plugins.
    * Use proper path for plugin wrappers.
    * Extract RSS and REXML into separate subpackages, because they were moved from
       default gems to bundled gems.
    * Drop Net::Telnet and XMLRPC packages, because they were dropped from Ruby.
    Resolves: rhbz#1938942
  - Fix FTBFS due to an incompatible load directive.


author: Jarek Prokop <jprokop@redhat.com> - 3.0.2-139
changelog:
  - Upgrade to Ruby 3.0.2.
    Related: rhbz#1938942
  - Fix command injection vulnerability in RDoc. (CVE-2021-31799)
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    (CVE-2021-31810)
  - Fix StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)
  - Fix dependencies of gems with explicit source installed from a
    different source. (CVE-2020-36327)
  - Pass ldflags to gem install via CONFIGURE_ARGS.
    The same comment on the changelog 3.0.1-138 was wrong.


author: Jarek Prokop <jprokop@redhat.com> - 3.0.2-140
changelog:
  - Fix rubygem-irb upgrade not working due to directory -> symlink conversion.
    Resolves: rhbz#2010949


author: Jarek Prokop <jprokop@redhat.com> - 3.0.4-141
changelog:
  - Upgrade to Ruby 3.0.4.
    Resolves: rhbz#2109431
    Resolves: rhbz#2110981
  - Fix double free in Regexp compilation.
    Resolves: CVE-2022-28738
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739


author: Jarek Prokop <jprokop@redhat.com> - 3.0.4-141
changelog:
  - Upgrade to Ruby 3.0.4.
    Resolves: rhbz#2096346
    Resolves: rhbz#2000056
  - Fix double free in Regexp compilation.
    Resolves: CVE-2022-28738
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739


author: Jun Aruga <jaruga@redhat.com> - 3.0.7-142
changelog:
  - Upgrade to Ruby 3.0.7.
    Resolves: RHEL-36189
  - Fix HTTP response splitting in CGI.
    Resolves: RHEL-36193
  - Fix ReDoS vulnerability in URI.
    Resolves: RHEL-36196
  - Fix ReDoS vulnerability in Time.
    Resolves: RHEL-36205
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-36198
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-36200
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-36203


author: Jarek Prokop <jprokop@redhat.com> - 3.1.4-142
changelog:
  - Upgrade to Ruby 3.1.4.
    Resolves: RHEL-28565
  - Fix HTTP response splitting in CGI.
    Resolves: RHEL-28564
  - Fix ReDos vulnerability in URI.
    Resolves: RHEL-28567
    Resolves: RHEL-28576
  - Fix ReDos vulnerability in Time.
    Resolves: RHEL-28566
  - Make RDoc soft dependency in IRB.
    Resolves: RHEL-28569


author: Jarek Prokop <jprokop@redhat.com> - 3.1.4-142
changelog:
  - Upgrade to Ruby 3.1.4.
    Resolves: RHEL-5584
  - Fix HTTP response splitting in CGI.
    Resolves: CVE-2021-33621
  - Fix ReDos vulnerability in URI.
    Resolves: CVE-2023-28755
    Resolves: CVE-2023-36617
  - Fix ReDos vulnerability in Time.
    Resolves: CVE-2023-28756
  - Make RDoc soft dependency in IRB.
    Resolves: RHEL-5615


author: Jun Aruga <jaruga@redhat.com> - 3.1.5-143
changelog:
  - Upgrade to Ruby 3.1.5.
    Resolves: RHEL-35748
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-35749
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-35750
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-35751


author: Jarek Prokop <jprokop@redhat.com> - 3.1.7-145
changelog:
  - Upgrade to Ruby 3.1.7.
    Resolves: RHEL-55408
  - Fix DoS vulnerability in REXML. (CVE-2024-39908)
    Resolves: RHEL-57051
  - Fix DoS vulnerability in REXML. (CVE-2024-43398)
    Resolves: RHEL-56002


author: Jarek Prokop <jprokop@redhat.com> - 3.3.1-2
changelog:
  - Upgrade to Ruby 3.3.1.
    Resolves: RHEL-37446
  - Fix buffer overread vulnerability in StringIO.
    (CVE-2024-27280)
    Resolves: RHEL-37448
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    (CVE-2024-27281)
    Resolves: RHEL-37449
  - Fix Arbitrary memory address read vulnerability with Regex search.
    (CVE-2024-27282)
    Resolves: RHEL-37447


author: Jarek Prokop <jprokop@redhat.com> - 3.3.5-3
changelog:
  - Upgrade to Ruby 3.3.5
    Resolves: RHEL-55409
  - Fix DoS vulnerability in rexml.
    (CVE-2024-39908)
    (CVE-2024-41946)
    (CVE-2024-43398)
    Resolves: RHEL-57049
    Resolves: RHEL-57054
    Resolves: RHEL-57069
  - Fix REXML DoS when parsing an XML having many specific characters such as
    whitespace character, >] and ]>.
    (CVE-2024-41123)
    Resolves: RHEL-52783


author: Jarek Prokop <jprokop@redhat.com> - 3.3.8-4
changelog:
  - Upgrade to Ruby 3.3.8.
    Resolves: RHEL-68632
  - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186)
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
  - Fix userinfo leakage in URI#join, URI#merge and URI#+. (CVE-2025-27221)


author: Jun Aruga <jaruga@redhat.com> - 0.5.2-1
changelog:
  - New upstream release 0.5.2 by merging Fedora master branch (commit: cc15309)
    Resolves: rhbz#1672575


author: Jun Aruga <jaruga@redhat.com> - 0.5.3-1
changelog:
  - New upstream release 0.5.3 by merging Fedora master branch (commit: 674d475)
    Resolves: rhbz#1817135


author: Jarek Prokop <jprokop@redhat.com> 0.5.3-2
changelog:
  - Update by merging Fedora rawhide branch (commit: 81e2cc9)
  - Fix Mysql2::Result test for Ruby 3.1.
  - Remove gem_make.out and mkmf.log files from the binary RPM package.
  - Fix test assertion for mariadb-connector-c.
    Related: rhbz#2063772


author: Jun Aruga <jaruga@redhat.com> - 1.1.4-1
changelog:
  - Update to pg 1.1.4 by merging Fedora master branch (commit: 397796e)
    * BuildRequires: s/postgresql-devel/libpq-devel/
    * Add marking lines at the start and end of the setup.log
    Resolves: rhbz#1672575


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.0.0-55.rc5.dev.git2abd837
changelog:
  - Resolves: #1665770 - rootfs: umount all procfs and sysfs with --no-pivot
  - Resolves: CVE-2019-5736


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-68.rc92
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-73.rc95
changelog:
  - fix podman run --pid=host command causes OCI permission error
  - rc95 fixes CVE-2021-30465
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.10-1
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.1.10
  - require container-selinux >= 2.224.0 for dmz feature
  - Related: Jira:RHEL-2110


author: Lokesh Mandvekar <lsm5@redhat.com> - 0.0.8-1.git4155b68
changelog:
  - Resolves: rhbz#1277245 - bump to 0.0.8
  - Resolves: rhbz#1302363 - criu is a runtime dep
  - Resolves: rhbz#1302348 - libseccomp-golang is bundled in Godeps
  - manpages included


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.0.0-1.rc2
changelog:
  - Resolves: #1412239 - *CVE-2016-9962* - set init processes as non-dumpable,
  runc patch from Michael Crosby <crosbymichael@gmail.com>


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.0.0-9.1.gitf8ce01d
changelog:
  - Resolves: #1447078 - change default root path
  - add commit e800860 from runc @projectatomic/change-root-path


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1.0.0-24.rc4.dev.gitc6e4a1e.1
changelog:
  - rebase to c6e4a1ebeb1a72b529c6f1b6ee2b1ae5b868b14f
  - https://github.com/opencontainers/runc/pull/1651


author: Dan Walsh <dwalsh@redhat.com> - 2:1.0.0-40.rc5.dev.gitad0f525
changelog:
  - Remove sysclt handling, not needed in RHEL8
  - Make sure package built with seccomp flags
  - Remove rectty
  - Add completions


author: Dan Walsh <dwalsh@redhat.name> - 2:1.0.0-46.dev.gitb4e2ecb
changelog:
  - Add patch https://github.com/opencontainers/runc/pull/1807 to allow
  - runc and podman to work with sd_notify


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0.3-6
changelog:
  - Fix every podman run invocation generates two "Couldn't stat device
    /dev/char/10:200: No such file or directory" lines in the journal
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.3-3
changelog:
  - fix "Error: runc: exec failed: unable to start container process:
    open /dev/pts/0: operation not permitted: OCI permission denied"
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.12-1
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.1.12
  - fixes CVE-2024-21626
  - Resolves: RHEL-23587


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-0
changelog:
  - resolves: rhbz#2222894 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-1
changelog:
  - related: rhbz#2190417 - Update to version 4.18.6
  - resolves: rhbz#2232564 - Fix the rpc dsgetinfo command


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.3-1
changelog:
  - resolves: RHEL-16483 - Update to version 4.19.3
  - resolves: RHEL-11361
              - Fix CVE-2023-3961 CVE-2023-4091 CVE-2023-42669
  - resolves: RHEL-2228  - Logging Format Enhancement
  - resolves: RHEL-1965  - Fix smbget issues with DFS shares
  - resolves: RHEL-2108  - Fix force user/group issues with 'allow trusted domains = yes'
  - resolves: RHEL-17122 - Fix memory corruption in libnss_winbind


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-2
changelog:
  - Fix error in PREIN scriptlet in rpm package samba-common
  - related: RHEL-16483 - Update to version 4.19.4


author: John H Terpstra <jht@samba.anu.edu.au>
changelog:
  - Many optimisations (some suggested by Manoj Kasichainula <manojk@io.com>
  - Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb
  - Compounded make line
  - Updated smb.init restart mechanism
  - Use compound mkdir -p line instead of individual calls to mkdir
  - Fixed smb.conf file path for log files
  - Fixed smb.conf file path for incoming smb print spool directory
  - Added a number of options to smb.conf file
  - Added smbadduser command (missed from all previous RPMs) - Doooh!
  - Added smbuser file and smb.conf file updates for username map


author: Erik Troan <ewt@redhat.com>
changelog:
  - made the %postun script a tad less agressive; no reason to remove
    the logs or lock file (after all, if the lock file is still there,
    samba is still running)
  - the %postun and %preun should only exectute if this is the final
    removal
  - migrated %triggerpostun from Red Hat's samba package to work around
    packaging problems in some Red Hat samba releases


author: Bill Nottingham <notting@redhat.com>
changelog:
  - add a mount.smb to make smb mounting a little easier.
  - smb filesystems apparently don't work on alpha. Oops.


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.0.5
  - fix mount.smb - smbmount options changed again.........
  - fix postun. oops.
  - update some stuff from the samba team's spec file.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - use cp rather than mv to preserve /etc/services perms (#4938 et al).
  - use mktemp to generate /etc/tmp.XXXXXX file name.
  - add prereqs on sed/mktemp/killall (need to move killall to /bin).
  - fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7")


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix yp_get_default_domain in autoconf
  - only link against readline for smbclient
  - fix log rotation (#9909)


author: Than Ngo <than@redhat.de>
changelog:
  - add initdir macro to handle the initscript directory
  - add a new macro to handle /etc/pam.d/system-auth


author: Bill Nottingham <notting@redhat.com>
changelog:
  - move initscript back
  - remove 'Using Samba' book from %doc 
  - move stuff to /etc/samba (#13708)
  - default configuration tweaks (#13704)
  - some logrotate tweaks


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix swat only_from line (#18726, others)
  - fix attempt to write outside buildroot on install (#17943)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - set a default CA certificate path in smb.conf (#19010)
  - require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file


author: Bill Nottingham <notting@redhat.com>
changelog:
  - i18n-ize initscript
  - add a sysconfig file for daemon options (#23550)
  - clarify smbpasswd man page (#23370)
  - build with LFS support (#22388)
  - avoid extraneous pam error messages (#10666)
  - add Urban Widmark's bug fixes for smbmount (#19623)
  - fix setgid directory modes (#11911)
  - split swat into subpackage (#19706)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak the PAM code some more to try to do a setcred() after initgroups()
  - pull in all of the optflags on i386 and sparc
  - don't explicitly enable Kerberos support -- it's only used for password
    checking, and if PAM is enabled it's a no-op anyway


author: Helge Deller <hdeller@redhat.de>
changelog:
  - updated to samba 2.2.0
  - moved codepages to %{_datadir}/samba/codepages
  - use all available CPUs for building rpm packages
  - use %{_xxx} defines at most places in spec-file
  - "License:" replaces "Copyright:"
  - dropped excludearch sparc
  - de-activated japanese patches 100 and 200 for now 
    (they need to be fixed and tested wth 2.2.0)
  - separated swat.desktop file from spec-file and added
    german translations
  - moved /etc/sysconfig/samba to a separate source-file
  - use htmlview instead of direct call to netscape in 
    swat.desktop-file


author: Helge Deller <hdeller@redhat.de>
changelog:
  - build as 2.2.0-1 release
  - skip the documentation-directories docbook, manpages and yodldocs
  - don't include *.sgml documentation in package
  - moved codepage-directory to /usr/share/samba/codepages
  - make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - (these changes are from the non-head version)
  - Don't include /usr/sbin/samba, it's the same as the initscript
  - unset TMPDIR, as samba can't write into a TMPDIR owned
    by root (#41193)
  - Add pidfile: lines for smbd and nmbd and a config: line
    in the initscript  (#15343)
  - don't use make -j
  - explicitly include /usr/share/samba, not just the files in it


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Use /var/cache/samba instead of /var/lock/samba 
  - Remove "domain controller" keyword from smb.conf, it's 
    deprecated (from #13704)
  - Sync some examples with smb.conf.default
  - Fix password synchronization (#16987)


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Don't include smbpasswd in samba, it's in samba-common (#51598)
  - Add a disabled "obey pam restrictions" statement - it's not
    active, as we use encrypted passwords, but if the admin turns
    encrypted passwords off the choice is available. (#31351)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-3
changelog:
  - Add "--with-utmp" to configure options (#55372)
  - Include winbind, pam_smbpass.so, rpcclient and smbcacls
  - start using /var/cache/samba, we need to keep state and there is
    more than just locks involved


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-5
changelog:
  - Teach smbadduser about "getent passwd" 
  - Fix more pid-file references
  - Add (conditional) winbindd startup to the initscript, configured in
    /etc/sysconfig/samba


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-6
changelog:
  - Move winbind files to samba-common. Add separate initscript for
    winbind 
  - Fixes for winbind - protect global variables with mutex, use
    more secure getenv


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.3a-3
changelog:
  - include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o
    (patch posted to samba-list by Ilia Chipitsine)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.5-7
changelog:
  - Enable VFS support and compile the "recycling" module (#69796)
  - more selective includes of the examples dir


author: Jay Fenlason <fenlason@redhat.com> 2.2.7a-3
changelog:
  - edited spec file to put .so files in the correct directories
    on 64-bit platforms that have 32-bit compatability issues
    (sparc64, x86_64, etc).  This fixes bugzilla #83782.
  - Added samba-2.2.7a-error.patch from twaugh.  This fixes
    bugzilla #82454.


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.7a-4
changelog:
  - relink libnss_wins.so with SHLD="%{__cc} -lnsl" to force libnss_wins.so to
    link with libnsl, avoiding unresolved symbol errors on functions in libnsl


author: Jay Fenlason <fenlason@redhat.com> 2.2.8-0
changelog:
  - Upgrade to 2.2.8
  - removed commented out patches.
  - removed old patches and .md5 files from the repository.
  - remove duplicate /sbin/chkconfig --del winbind which causes
    warnings when removing samba.
  - Fixed minor bug in smbprint that causes it to fail when called with
    more than 10 parameters: the accounting file (and spool directory
    derived from it) were being set wrong due to missing {}.  This closes
    bug #86473.
  - updated smb.conf patch, includes new defaults to close bug #84822.


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-1
changelog:
  - upgrade to 2.2.8a
  - remove old .md5 files
  - add "pid directory = /var/run" to the smb.conf file.  Fixes #88495
  - Patch from jra@dp.samba.org to fix a delete-on-close regression


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-2
changelog:
  - add libsmbclient.so for gnome-vfs-extras
  - Edit specfile to specify /var/run for pid files
  - Move /tmp/.winbindd/socket to /var/run/winbindd/socket


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-3beta3
changelog:
  - Merge from 3.0.0-2beta3.3E
  - (Correct log file names (#100981).)
  - (Fix pidfile directory in samab.log)
  - (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file)
  - (Move libsmbclient to the -common package (#99449))


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-15
changelog:
  - New 3.0.0 final release
  - merge nmbd-netbiosname and testparm patches from 3E branch
  - updated the -logfiles patch to work against 3.0.0
  - updated the pie patch
  - update the VERSION file during build
  - use make -j if avaliable
  - merge the winbindd_privileged change from 3E
  - merge the "rm /usr/lib" patch that allows Samba to build on 64-bit
    platforms despite the broken Makefile


author: Felipe Alfaro Solana <felipe_alfaro@linuxmail.org> 3.0.1-1
changelog:
  - Update to 3.0.1
  - Removed testparm patch as it's already merged
  - Removed Samba.7* man pages
  - Fixed .buildroot patch
  - Fixed .pie patch
  - Added new /usr/bin/tdbdump file


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-3rc2
changelog:
  - add %dir entries for %{_libdir}/samba and %{_libdir}/samba/charset
  - Upgrade to new upstream version
  - build mount.cifs for the new cifs filesystem in the 2.6 kernel.


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-5
changelog:
  - New upstream version: 3.0.2 final includes security fix for #114995
    (CAN-2004-0082)
  - Edit postun script for the -common package to restart winbind when
    appropriate.  Fixes bugzilla #114051.


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Change all requires lines to list an explicit epoch.  Closes #102715
  - Add an explicit Epoch so that %{epoch} is defined.


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-1.pre1
changelog:
  - New upstream version.
  - Updated -pie and -logfiles patches for 3.0.3pre1
  - add krb5-devel to buildrequires, fixes #116560
  - Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run
    "service smb status".  This fixes #116559


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-2.pre2
changelog:
  - New upstream version  
  - Updated configure line to remove --with-fhs and to explicitly set all
    the directories that --with-fhs was setting.  We were overriding most of
    them anyway.  This closes #118598


author: jay Fenlason <fenlason@redhat.com> 3.0.3-3.rc1
changelog:
  - New upstream version
  - updated spec file to make libsmbclient.so executable.  This closes
    bugzilla #121356


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-5
changelog:
  - Patch to allow password changes from machines patched with
    Microsoft hotfix MS04-011.
  - Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302
    and https://bugzilla.samba.org/show_bug.cgi?id=1309


author: Jay Fenlason <fenlason@redhat.com> 3.0.5.0pre1.0
changelog:
  - New upstream version
  - use % { SOURCE1 } instead of a hardcoded path
  - include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org)
    https://bugzilla.samba.org/show_bug.cgi?id=1315
    to make winbindd work against Windows versions that do not have
    128 bit encryption enabled.
  - Moved %{_bindir}/net to the -common package, so that folks who just
    want to use winbind, etc don't have to install -client in order to
    "net join" their domain.
  - New upstream version obsoletes the patches added in 3.0.3-5
  - Remove smbgetrc.5 man page, since we don't ship smbget.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-0.pre1.1
changelog:
  - Backport base64_decode patche to close CAN-2004-0500
  - Backport hash patch to close CAN-2004-0686
  - use_authtok patch from Nalin Dahyabhai <nalin@redhat.com>
  - smbclient-kerberos patch from Alexander Larsson <alexl@redhat.com>
  - passwd patch uses "*" instead of "x" for "hashed" passwords for
    accounts created by winbind.  "x" means "password is in /etc/shadow" to
    brain-damaged pam_unix module.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-2
changelog:
  - Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a
    security fix.
  - Include the 3.0.4-backport patch from the 3E branch.  This restores
    some of the 3.0.5pre1 and 3.0.5rc1 functionality.


author: Jason Vas Dias <jvdias@redhat.com> 3.0.5-3
changelog:
  - Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination
  - resulted in executables getting corrupt stacks, causing smbmnt to
  - get a SIGBUS in the mount() call (bug 127420).


author: Jay Fenlason <fenlason@redhat.com> 3.0.6-3
changelog:
  - New upstream version.
  - Include post 3.0.6 patch from "Gerald (Jerry) Carter" <jerry@samba.org>
    to fix a duplicate in the LDAP schema.
  - Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com)
    to allow correct timestamp handling on 64-bit platforms and fix #126109.
  - reenable the -pie patch.  Samba is too widely used, and too vulnerable
    to potential security holes to disable an important security feature
    like -pie.  The correct fix is to have the toolchain not create broken
    executables when programs compiled -pie are stripped.
  - Remove obsolete patches.
  - Modify this spec file to put libsmbclient.{a,so} in the right place on
    x86_64 machines.


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-3
changelog:
  - Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808
    This obsoletes the 3.0.6-schema patch.
  - Update BuildRequires line to include openldap-devel openssl-devel
    and cups-devel


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-4
changelog:
  - Update docs section to not carryover the docs/manpages directory
    This moved many files from /usr/share/doc/samba-3.0.7/docs/* to
    /usr/share/doc/samba-3.0.7/*
  - Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu)
    to correctly create libsmbclient.so.0 and to use %_initrddir instead
    of rolling our own.  This closes #132642
  - Add patch to default "use sendfile" to no, since sendfile appears to
    be broken
  - Add patch from Volker Lendecke <vl@samba.org> to help make
    ldapsam_compat work again.
  - Add patch from "Vince Brimhall" <vbrimhall@novell.com> for ldapsam_compat
    These two patches close bugzilla #132169


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies
    smbmnt to work with 32-bit uids.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.2
changelog:
  - Re-enable the x_fclose patch that was accidentally disabled
    in 3.0.8-0.pre1.1.  This closes #135832
  - include Nalin's -fqdn and -salt patches.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.3
changelog:
  - disable the -salt patch, because it causes undefined references in
    libsmbclient that prevent gnome-vfs from building.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-2
changelog:
  - New upstream version fixes CAN-2004-0930.  This obsoletes the
    disable-sendfile, salt, signing-shortkey and fqdn patches.
  - Add my <fenlason@redhat.com> ugly non-ascii-domain patch.
  - Updated the pie patch for 3.0.8.
  - Updated the logfiles patch for 3.0.8.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3
changelog:
  - Include the corrected docs tarball, and use it instead of the
    obsolete docs from the upstream 3.0.8 tarball.
  - Update the logfiles patch to work with the updated docs.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3.1
changelog:
  - Rescue the install.mount.smbfs patch from Juanjo Villaplana
    (villapla@si.uji.es) to prevent building the srpm from trashing your
    installed /usr/bin/smbmount


author: Than Ngo <than@redhat.com> 3.0.8-4
changelog:
  - fix unresolved symbols in libsmbclient which caused applications
    such as KDE's konqueror to fail when accessing smb:// URLs. #139894


author: Jay Fenlason <fenlason@redhat.com> 3.0.9-2
changelog:
  - New upstream release.  This obsoletes the -secret patch.
    Include my changetrustpw patch to make "net ads changetrustpw" stop
    aborting.  This closes #134694
  - Remove obsolete triggers for ancient samba versions.
  - Move /var/log/samba to the -common rpm.  This closes #76628
  - Remove the hack needed to get around the bad docs files in the
    3.0.8 tarball.
  - Change the comment in winbind.init to point at the correct pidfile.
    This closes #76641


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-2
changelog:
  - New upstream release that closes CAN-2004-1154  bz#142544
  - Include the -64bit patch from Nalin.  This closes bz#142873
  - Update the -logfiles patch to work with 3.0.10
  - Create /var/run/winbindd and make it part of the -common rpm to close
    bz#142242


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-4
changelog:
  - Update the -man patch to fix ntlm_auth.1 too.
  - Move pam_smbpass.so to the -common package, so both the 32
    and 64-bit versions will be installed on multiarch platforms.
    This closes bz#143617
  - Added new -delim patch to fix mount.cifs so it can accept
    passwords with commas in them (via environment or credentials
    file) to close bz#144198


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-3
changelog:
  - add -gcc4 patch to compile with gcc 4.
  - remove the now obsolete -smbclient-kerberos.patch
  - Include four upstream patches from
    http://samba.org/~jerry/patches/post-3.0.11/
    (Slightly modified the winbind_find_dc_v2 patch to apply easily with
    rpmbuild).


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-4
changelog:
  - Use the updated filter-requires-samba.sh file, so we don't accidentally
    pick up a dependency on perl(Crypt::SmbHash)


author: Jay Fenlason <fenlason@redhat.com> 3.0.13-2
changelog:
  - New upstream release
  - add my -quoting patch, to fix swat with strings that contain
    html meta-characters, and to use correct quote characters in
    lists, closing bz#134310
  - include the upstream winbindd_2k3sp1 patch
  - include the -smbclient patch.
  - include the -hang patch from upstream.


author: Jay Fenlason <fenlason@redhat.com> 3.0.14a-2
changelog:
  - New upstream release.
  - the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1,
    winbind_find_dc_v2 patches are now obsolete.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20-2
changelog:
  - New upstream release
    Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3,
      -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1
    This obsoletes the -pie and -delim patches
    the -warning and -gcc4 patches are obsolete too
    The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1
    Also, the -quoting patch was implemented differently upstream
    There is now a umount.cifs executable and manpage
    We run autogen.sh as part of the build phase
    The testprns command is now gone
    libsmbclient now has a man page
  - Include -bug106483 patch to close
    bz#106483 smbclient: -N negates the provided password, despite documentation
  - Added the -warnings patch to quiet some compiler warnings.
  - Removed many obsolete patches from CVS.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20b-2
changelog:
  - turn on -DLDAP_DEPRECATED to allow access to ldap functions that have
    been depricated in 2.3.11, but which don't have well-documented
    replacements (ldap_simple_bind_s(), for example).
  - Upgrade to 3.0.20b, which includes all the previous upstream patches.
  - Updated the -warnings patch for 3.0.20a.
  - Include  --with-shared-modules=idmap_ad,idmap_rid to close
    bz#156810 --with-shared-modules=idmap_ad,idmap_rid
  - Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close
    bz#170259 pam_stack is deprecated


author: Jay Fenlason <fenlason@redhat.com> 3.0.21b-2
changelog:
  - New upstream version.
  - Since the rawhide kernel has dropped support for smbfs, remove smbmount
    and smbumount.  Users should use mount.cifs instead.
  - Upgrade to 3.0.21b


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-0.RC3
changelog:
  - New upstream RC release.
  - Update the -logfiles, and -passwd patches for
    3.0.23rc3
  - Include the change to smb.init from Bastien Nocera <bnocera@redhat.com>)
    to close
    bz#182560 Wrong retval for initscript when smbd is dead
  - Update this spec file to build with 3.0.23rc3
  - Remove the -install.mount.smbfs patch, since we don't install
    mount.smbfs any more.


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-2
changelog:
  - New upstream release.
  - Use modified filter-requires-samba.sh from packaging/RHEL/setup/
    to get rid of bogus dependency on perl(Unicode::MapUTF8)
  - Update the -logfiles and -smb.conf patches to work with 3.0.23


author: Jay Fenlason <fenlason@redhat.com> 3.0.23a-3
changelog:
  - Fix the -logfiles patch to close
    bz#199607 Samba compiled with wrong log path.
    bz#199206 smb.conf has incorrect log file path


author: Simo Sorce <ssorce@redhat.com> 3.0.24-2.fc7
changelog:
  - New upstream release
  - Fix packaging issue wrt idmap modules used only by smbd
  - Addedd Vista Patchset for compatibility with Windows Vista
  - Change default of "msdfs root", it seem to cause problems with
    some applications and it has been proposed to change it for
    3.0.25 upstream


author: Simo Sorce <ssorce@redhat.com> 3.0.24-3.fc7
changelog:
  - Directories reorg, tdb files must go to /var/lib, not
    to /var/cache, add migration script in %post common
  - Split out libsmbclient, devel and doc packages
  - Remove libmsrpc.[h|so] for now as they are not really usable
  - Remove kill -HUP from rotate, samba use -HUP for other things
    noit to reopen logs


author: Simo Sorce <ssorce@redhat.com> 3.0.24-5.fc7
changelog:
  - actually use the correct samba.pamd file not the old samba.pamd.stack file
  - fix logifles and use upstream convention of log.* instead of our old *.log
    Winbindd creates its own log.* files anyway so we will be more consistent
  - install our own (enhanced) default smb.conf file
  - Fix pam_winbind acct_mgmt PAM result code (prevented local users from
    logging in). Fixed by Guenther.
  - move some files from samba to samba-common as they are used with winbindd
    as well


author: Simo Sorce <ssorce@redhat.com> 3.0.24-6.fc7
changelog:
  - do not put comments inline on smb.conf options, they may be read
    as part of the value (for example log files names)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-7.fc7
changelog:
  - make winbindd start earlier in the init process, at the same time
    ypbind is usually started as well
  - add a sepoarate init script for nmbd called nmb, we need to be able
    to restart nmbd without dropping al smbd connections unnecessarily


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - remove patch for bug 106483 as it introduces a new bug that prevents
    the use of a credentials file with the smbclient tar command
  - move the samba private dir from being the same as the config dir
    (/etc/samba) to /var/lib/samba/private


author: Simo Sorce <ssorce@redhat.com> 3.0.24-9.fc7
changelog:
  - integrate most of merge review proposed changes (bug #226387)
  - remove libsmbclient-devel-static and simply stop shipping the
    static version of smbclient as it seem this is deprecated and
    actively discouraged


author: Simo Sorce <ssorce@redhat.com> 3.0.24-10.fc7
changelog:
  - set passdb backend = tdbsam as default in smb.conf
  - remove samba-docs dependency from swat, that was a mistake
  - put back COPYING and other files in samba-common
  - put examples in samba not in samba-docs
  - leave only stuff under docs/ in samba-doc


author: Guenther Deschner <gdeschner@redhat.com> 3.0.24-11.fc7
changelog:
  - enable PAM and NSS dlopen checks during build
  - fix unresolved symbols in libnss_wins.so (bug #198230)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-12.fc7
changelog:
  - fixes in smb.conf
  - advice in smb.conf to put scripts in /var/lib/samba/scripts
  - create /var/lib/samba/scripts so that selinux can be happy
  - fix Vista problems with msdfs errors


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - fixes in the spec file
  - moved to 3.0.25rc1
  - addedd patches (merged upstream so they will be removed in 3.0.25rc2)


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - update to 3.0.25a as it contains many fixes
  - add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut.


author: Simo Sorce <ssorce@redhat.com> 3.2.0-0.pre1.fc9
changelog:
  - New major relase, minor switched from 0 to 2
  - License change, the code is now GPLv3+
  - Numerous improvements and bugfixes included
  - package libsmbsharemodes too
  - remove smbldap-tools as they are already packaged separately in Fedora
  - Fix bug 245506


author: Simo Sorce <ssorce@redhat.com> - 3.2.0-0.pre1.3
changelog:
  - Try to fix GCC 4.3 build
  - Add --with-dnsupdate flag and also make sure other flags are required just to
    be sure the features are included without relying on autodetection to be
    successful


author: Guenther Deschner <gdeschner@redhat.com> - 3.3.0-0.25
changelog:
  - Update to 3.3.0 final
  - Add upstream fix for ldap connections to AD (Bug #6073)
  - Remove bogus perl dependencies (resolves: #473051)


author: Simo Sorce <ssorce@redhat.com> - 3.3.1-0.29
changelog:
  - Make the talloc and ldb packages optionsl and disable their build within
    the samba3 package, they are now built as part of the samba4 package
    until they will both be released as independent packages.


author: Simo Sorce <ssorce@redhat.com> - 3.3.2-0.33
changelog:
  - Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the
    configuration
  - Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on
    startup, causing your own machine not to show up in the network for 5 minutes
    if it was the only client in that workgroup (fix committed upstream)


author: Guenther Deschner <gdeschner@redhat.com> - 3.4.0-0.41
changelog:
  - Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX)
  - Specify required talloc and tdb version for BuildRequires


author: Simo Sorce <ssorce@redhat.com> - 3.4.2-47
changelog:
  - Spec file cleanup
  - Fix sources upstream location
  - Remove conditionals to build talloc and tdb, now they are completely indepent
    packages in Fedora
  - Add defattr() where missing
  - Turn all tabs into 4 spaces
  - Remove unused migration script
  - Split winbind-clients out of main winbind package to avoid multilib to include
    huge packages for no good reason


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.3-60
changelog:
  - Update to 3.5.3
  - Make sure nmb and smb initscripts return LSB compliant return codes
  - Fix winbind over ipv6


author: Andreas Schneider <asn@redhat.com> - 2:3.6.5-88
changelog:
  - Move tmpfiles.d config to common package as it is needed for smbd and
    winbind.
  - Make sure tmpfiles get created after installation.


author: Ville Skyttä <ville.skytta@iki.fi> - 2:3.6.6-92
changelog:
  - Call ldconfig at libwbclient and -winbind-clients post(un)install time.
  - Fix empty localization files, use %find_lang to find and %lang-mark them.
  - Escape macros in %changelog.
  - Fix source tarball URL.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.0-154.rc3
changelog:
  - Update to 4.0.0rc3.
  - resolves: #805562 - Unable to share print queues.
  - resolves: #863388 - Unable to reload smbd configuration with systemctl.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.0-160.rc3
changelog:
  - resolves: #867893 - Move /var/log/samba to samba-common package for
                        winbind which requires it.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.2-1
changelog:
  - Update to Samba 4.0.2.
  - Fixes CVE-2013-0213.
  - Fixes CVE-2013-0214.
  - resolves: #906002
  - resolves: #905700
  - resolves: #905704
  - Fix conn->share_access which is reset between user switches.
  - resolves: #903806
  - Add missing example and make sure we don't introduce perl dependencies.
  - resolves: #639470


author: Andreas Schneider <asn@redhat.com> - 2:4.0.3-1
changelog:
  - Update to Samba 4.0.3.
  - resolves: #907544 - Add unowned directory /usr/lib64/samba.
  - resolves: #906517 - Fix pidl code generation with gcc 4.8.
  - resolves: #908353 - Fix passdb backend ldapsam as module.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.4-3
changelog:
  - resolves: #919405 - Fix and improve large_readx handling for broken clients.
  - resolves: #924525 - Don't use waf caching.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.5-1
changelog:
  - Update to Samba 4.0.5.
  - Add UPN enumeration to passdb internal API (bso #9779).
  - resolves: #928947 - samba-doc is obsolete now.
  - resolves: #948606 - LogRotate should be optional, and not a hard "Requires".


author: Andreas Schneider <asn@redhat.com> - 2:4.0.7-2
changelog:
  - resolves: #972692 - Build with PIE and full RELRO.
  - resolves: #884169 - Add explicit dependencies suggested by rpmdiff.
  - resolves: #981033 - Local user's krb5cc deleted by winbind.
  - resolves: #984331 - Fix samba-common tmpfiles configuration file in wrong
                        directory.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.2
changelog:
  - resolves: #985985 - Fix file conflict between samba and wine.
  - resolves: #985107 - Add support for new default location for Kerberos
                        credential caches.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.7
changelog:
  - related: #985609 - Update to Samba 4.1.0rc3.
  - resolves: #1005422 - Add support for KEYRING ccache type in pam_winbindd.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.8
changelog:
  - related: #985609 - Update to Samba 4.1.0rc4.
  - resolves: #1010722 - Split out a samba-winbind-modules package.


author: Andreas Schneider <asn@redhat.com> - 4.1.0-2
changelog:
  - resolves: #1018856 - Fix installation of pam_winbind after upgrade.
  - related: #1010722 - Split out a samba-winbind-modules package.
  - related: #985609


author: Andreas Schneider <asn@redhat.com> - 4.1.0-4
changelog:
  - related: #884169 - Add direct dependency to samba-libs in the
                       glusterfs package.
  - resolves: #996567 - Fix userPrincipalName composition.
  - related: #884169 - Fix memset call with zero length in in ntdb.


author: Andreas Schneider <asn@redhat.com> - 4.1.3-1
changelog:
  - Update to Samba 4.1.3.
  - resolves: #1039454 - CVE-2013-4408.
  - resolves: #1039500 - CVE-2012-6150.


author: Andreas Schneider <asn@redhat.com> - 4.2.0-0.3.rc2
changelog:
  - resolves: #1174412 - Build VFS Ceph module.
  - resolves: #1169067 - Move libsamba-cluster-support.so to samba-libs package.
  - resolves: #1016122 - Move smbpasswd to samba-common package.


author: Michael Adam <madam@redhat.com> - 4.2.0-0.2.rc3
changelog:
  - Improve dependencies of vfs-glusterfs and vfs-cephfs.
  - Remove unused python_libdir.
  - Fix malformed changelog entries.


author: Andreas Schneider <asn@redhat.com> - 4.2.0-2
changelog:
  - Fix the AD build.
  - Create samba-client-libs subpackage.
  - Fix multiarch issues by splitting the samba-common package.


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-5
changelog:
  - Require samba-common-tools in samba package
  - Require samba-common-tools in samba-client package
  - resolves: #1215631 - /usr/bin/net moved to samba-common-tools but the package is not required by samba


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-7
changelog:
  - Fix LSASD daemon
  - resolves: #1217346 - FreeIPA trusts to AD broken due to Samba 4.2 failure to run LSARPC pipe externally


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-8
changelog:
  - Fixes: #1219832: Samba 4.2 broke FreeIPA trusts to AD
  - Remove usage of deprecated API from gnutls


author: Andreas Schneider <asn@redhat.com> - 4.2.2-1
changelog:
  - resolves: #1227911 - Enable tar support for smbclient
  - resolves: #1234908 - Own the /var/lib/samba directory
  - Enable hardened build


author: Guenther Deschner <gdeschner@redhat.com> - 4.3.3-0
changelog:
  - Update to Samba 4.3.3
  - resolves: #1292069
  - CVE-2015-3223 Remote DoS in Samba (AD) LDAP server
  - CVE-2015-5252 Insufficient symlink verification in smbd
  - CVE-2015-5296 Samba client requesting encryption vulnerable to
                  downgrade attack
  - CVE-2015-5299 Missing access control check in shadow copy code
  - CVE-2015-7540 DoS to AD-DC due to insufficient checking of asn1
                  memory allocation


author: Guenther Deschner <gdeschner@redhat.com> - 4.4.0-0.7.rc4
changelog:
  - Update to Samba 4.4.0rc4
  - resolves: #1315942 - CVE-2015-7560 Incorrect ACL get/set allowed on symlink path


author: Guenther Deschner <gdeschner@redhat.com> - 4.4.2-1
changelog:
  - Update to Samba 4.4.2, fix badlock security bug
  - resolves: #1326453 - CVE-2015-5370
  - resolves: #1326453 - CVE-2016-2110
  - resolves: #1326453 - CVE-2016-2111
  - resolves: #1326453 - CVE-2016-2112
  - resolves: #1326453 - CVE-2016-2113
  - resolves: #1326453 - CVE-2016-2114
  - resolves: #1326453 - CVE-2016-2115
  - resolves: #1326453 - CVE-2016-2118


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.0-3
changelog:
  - auth/credentials: Always set the the realm if we set the principal from the ccache
  - resolves: #1430761 - credentials_crb5: use gss_acquire_cred for client-side GSSAPI use case


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.0-4
changelog:
  - Export arcfour_crypt_blob to Python as samba.crypto.arcfour_encrypt
  - Makes possible to run trust to AD in FreeIPA in FIPS mode


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-0.5.rc1
changelog:
  - Convert more rpc modules to python3
  - Explicitly specify Python artifacts in the spec to be able to catch unpackaged ones
  - Split 'make test' Python code into separate python2-samba-test/python3-samba-test sub-packages
  - Remove embedded python2-dns version, require python{2,3}-dns instead


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-0.6.rc1
changelog:
  - Use Python 2 explicitly for samba-tool and other Python-based tools
  - Install samba.service as it is required for the AD DC case


author: Guenther Deschner <gdeschner@redhat.com> - 4.7.0-12
changelog:
  - Update to Samba 4.7.0
  - resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-13
changelog:
  - Move /usr/lib{64,}/samba/libdsdb-garbage-collect-tombstones-samba4.so to samba-dc-libs
  - Rebuild in rawhide against new krb5 1.16 and docbook-xml


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-18
changelog:
  - Force samba-dc to use the same libldb version as LDB modules compiled
  - resolves: #1507420 - LDB / Samba module version mismatch


author: Guenther Deschner <gdeschner@redhat.com> - 4.8.0-7
changelog:
  - resolves: #1554754, #1554756 - Security fixes for CVE-2018-1050 CVE-2018-1057
  - resolves: #1555112 - Update to Samba 4.8.0


author: Petr Viktorin <pviktori@redhat.com> - 4.8.3-2
changelog:
  - Use %{__python2}, not "python", as the Python2 interpreter
  - Add workaround to allow building with Python 2
  - Change unversioned python macros to python2
  - Disable gluster temporarily


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc3-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc3
  - resolves: #1554753 - Fix CVE-2018-1050
  - resolves: #1617912 - Fix CVE-2018-10858
  - resolves: #1617913 - Fix CVE-2018-10918
  - resolves: #1617914 - Fix CVE-2018-10919
  - resolves: #1617915 - Fix CVE-2018-1139
  - resolves: #1612522 - Manpage fixes


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc5-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc5
  - resolves: #1610909 - Re-enable glubsterfs vfs module
  - resolves: #1624170 - Build with -fstack-protectore-strong if available
  - resolves: #1602685 - Fixed issues found by covscan


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.9.1-3
changelog:
  - Temporarily remove smbtorture from samba-test due to Python 2 linkage
  - related: #1609661 - samba-test package cannot be installed due to unresolved dependencies


author: Andreas Schneider <asn@redhat.com> - 4.9.1-5
changelog:
  - resolves: #1644327 - Segfault if wrong 'passdb backend' is configured
  - resolves: #1647959 - Segfault in the debug system with hardended build


author: Andreas Schneider <asn@redhat.com> - 4.9.1-6
changelog:
  - resolves: #1642092 - Harden [homes] share export
  - resolves: #1648846 - Fix out of bound array access in ctdb
  - resolves: #1657266 - Fix tmp directory creation in /run


author: Andreas Schneider <asn@redhat.com> - 4.9.1-7
changelog:
  - resolves: #1658690 - Add smbc_setOptionProtocols()
  - resolves: #1658678 - Fix spoolss client operations against Windows


author: Andreas Schneider <asn@redhat.com> - 4.10.4-0
changelog:
  - related: #1638001 - Rebase to Samba version 4.10.4
  - resolves: #1597298 - Build Samba with python3
  - resolves: #1658558 - Add 'net ads leave --keep-account' option
  - resolves: #1669004 - Fix systemd status notifications
  - resolves: #1672167 - Fix printing cache timeout in debug output
  - resolves: #1696525 - Fix CVE-2019-3880


author: Andreas Schneider <asn@redhat.com> - 4.10.4-1
changelog:
  - resolves: #1712378 - Fix smbspool CUPS backend
  - resolves: #1696612 - Fix 'net ads join -U admin@parentdomain'


author: Andreas Schneider <asn@redhat.com> - 4.10.4-100
changelog:
  - resolves: #1754575 - Avoid overlinking with librt and libpthread
  - resolves: #1755440 - Fix forest trusts enumeration
  - resolves: #1755445 - Fix CUPS username/password authentication with smbspool


author: Andreas Schneider <asn@redhat.com> - 4.11.2-1
changelog:
  - resolves: #1754409 - Rebase to Samba version 4.11.2
  - resolves: #1776312 - Winbind is not restarted on upgrade
  - resolves: #1764469 - Fix CVE-2019-10218
  - resolves: #1746241 - Fix CVE-2019-10197
  - resolves: #1710980 - Add support for KCM ccache in pam_winbind


author: Andreas Schneider <asn@redhat.com> - 4.11.2-4
changelog:
  - related: #1754409 - Add patch to avoid overlinking with libnsl and libsocket
  - related: #1754409 - Fix permissions for pidl
  - related: #1754409 - Fix logrotate script
  - related: #1754409 - Add missing README files


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.11.2-10
changelog:
  - resolves: #1790353 - Fix access check in DsRGetForestTrustInformation
  - resolves: #1791209 - Fix CVE-2019-14907


author: Andreas Schneider <asn@redhat.com> - 4.11.2-12
changelog:
  - related: #1781232 - Improve debug output of smbclient
  - resolves: #1794461 - Do not return bogus inode numbers in
                         cli_qpathinfo2()/cli_qpathinfo3() for SMB1
  - resolves: #1794442 - Fix segfault in smbd_do_qfilepathinfo()


author: Andreas Schneider <asn@redhat.com> - 4.12.3-0
changelog:
  - resolves: #1817557 - Rebase to version 4.12.3
  - resolves: #1813833 - Fix 'net ads join createupn='


author: Andreas Schneider <asn@redhat.com> - 4.12.3-1
changelog:
  - resolves: #1666737 - Add a new smbc_readdirplus2() function to libsmbclient
  - resolves: #1842844 - Fix GnuTLS priority list for TLS connections


author: Isaac Boukris <iboukris@redhat.com> - 4.12.3-4
changelog:
  - resolves: #1850980 - Add "additional dns hostname" to keytab
  - resolves: #1850981 - Add net-ads-join dnshostname=fqdn option


author: Andreas Schneider <asn@redhat.com> - 4.12.3-5
changelog:
  - resolves: #1823612 - Fix segfault in 'net ads dns gethostbyname'
  - resolves: #1792553 - Fix 'net ads join createcomputer=OU'


author: Andreas Schneider <asn@redhat.com> - 4.12.3-7
changelog:
  - resolves: #1855711 - Fix 'require_membership_of' documentation in
                         pam_winbind manpage


author: Andreas Schneider <asn@redhat.com> - 4.12.3-9
changelog:
  - related: #1817557 - Move DECRPC mdssvc data files to correct package
  - resolves: #1856676 - Fix lookuprids in winbind


author: Andreas Schneider <asn@redhat.com> - 4.13.2-1
changelog:
  - resolves: #1878109 - Rebase Samba to version 4.13.2
  - resolves: #1872833 - Add samba-winexe subpackage
  - resolves: #1891688 - Fix CVE-2020-14323
  - resolves: #1892633 - Fix CVE-2020-14318
  - resolves: #1892639 - Fix CVE-2020-14383
  - resolves: #1879835 - Fix CVE-2020-1472
  - resolves: #1888990 - Update smb.conf manpages to describe how to apply
                         config changes.
  - resolves: #1869702 - Fix %U substitution for 'valid users' option
  - resolves: #1818038 - Improve FIPS compliance


author: Andreas Schneider <asn@redhat.com> - 4.13.2-2
changelog:
  - related: #1869702 - Fix spoolss crash
  - resolves: #1896736 - Fix name lookups of FreeIPA users
  - resolves: #1899113 - Fix DFS links


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.14.4-2
changelog:
  - resolves: rhbz#1944657 - Update to version 4.14.4
  - resolves: rhbz#1949445 - Fix CVE-2021-20254
  - resolves: rhbz#1947945 - Fix libsmbldap.so.2 not being a symbolic link
  - resolves: rhbz#1908506 - Fix creating the gencache user directory
  - resolves: rhbz#1901029 - Build the vfs_io_uring module


author: Andreas Schneider <asn@redhat.com> - 4.14.4-0
changelog:
  - related: rhbz#1944657 - Update to version 4.14.5
  - resolves: rhbz#1969787 - Fix memory leak in RPC server
  - resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
  - resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
  - resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
  - resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags


author: Andreas Schneider <asn@redhat.com> - 4.14.4-1
changelog:
  - resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
  - resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message


author: Andreas Schneider <asn@redhat.com> - 4.14.4-3
changelog:
  - resolves: rhbz#2019662 - Fix CVE-2016-2124
  - resolves: rhbz#2019668 - Fix CVE-2021-23192
  - resolves: rbhz#2019674 - Fix CVE-2020-25717


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.2-1
changelog:
  - resolves: rhbz#2013596 - Rebase to version 4.15.2
  - resolves: rhbz#1999294 - Remove noisy error message in winbindd
  - resolves: rhbz#1958881 - Don't require winbind being online for krb5 auth
                             with one-way trusts
  - resolves: rhbz#2019461 - Fix deleting directories with dangling symlinks


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.3-1
changelog:
  - related: rhbz#2013596 - Rebase to version 4.15.3
  - resolves: rhbz#2028029 - Fix possible null pointer dereference in winbind
  - resolves: rhbz#1912549 - Winexe: Kerberos Auth is respected via --use-kerberos=desired


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.4-0
changelog:
  - Update to Samba 4.15.4
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2039153 - Fix CVE-2021-20316
  - resolves: rhbz#1912549 - Winexe: Kerberos flag not invoking Kerberos Auth
  - resolves: rhbz#2039157 - Fix CVE-2021-43566
  - resolves: rhbz#2038148 - Failed to authenticate users after upgrade samba package to release samba-4.14.5-7
  - resolves: rhbz#2035528 - [smb] Segmentation fault when joining the domain
  - resolves: rhbz#2038796 - filename_convert_internal: open_pathref_fsp [xxx] failed: NT_STATUS_ACCESS_DENIED


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-0
changelog:
  - Update to Samba 4.15.5
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2046127 - Fix CVE-2021-44141
  - resolves: rhbz#2046153 - Fix CVE-2021-44142
  - resolves: rhbz#2044404 - Printing no longer works on Windows 7
  - resolves: rhbz#2043154 - Fix systemd notifications
  - resolves: rhbz#2049602 - Disable NTLMSSP for ldap client connections (e.g. libads)


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-1
changelog:
  - resolves: #1995849 - [RFE] Change change password change prompt phrasing
  - resolves: #2029417 - virusfilter_vfs_openat: Not scanned: Directory or special file


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-6
changelog:
  - resolves: rhbz#2059151 - Fix username map for unix groups
  - resolves: rhbz#2065212 - Fix 'create krb5 conf = yes` when a KDC has a single IP address.


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.3-0
changelog:
  - related: rhbz#2077468 - Rebase Samba to 4.16.3
  - resolves: rhbz#2106672 - The pcap background queue process should not be stopped
  - resolves: rhbz#2106263 - Fix crash in rpcd_classic
  - resolves: rhbz#2100093 - Fix net ads info returns LDAP server and LDAP server name


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.4-1
changelog:
  - resolves: rhbz#2221594 - Fix broken symlink for libwbclient
  - resolves: rhbz#2221600 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
  - resolves: rhbz#2175385 - Fix access of Samba share with veto files = /.*/
  - resolves: rhbz#2218237 - Fix Python tarfile extraction to avoid a warning


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.0.27-15
changelog:
  - 1554032 - saned doesn't have permissions to write on usb port
  - updated README.Fedora - mention epson official drivers


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.0.27-20
changelog:
  - 1852468, 1852467, 1852466, 1852465 - prevent buffer overflow in esci2_img
  - 1852668, 1852667, 1852666, 1852665 - disable autodiscovery for epsonds backend


author: Matej Habrnal <mhabrnal@redhat.com> 0.21-1
changelog:
  - New upstream version
    - Introduce 'serial' field in uReport
    - normalization: actualize list of functions


author: Jakub Filak <jakub@thefilaks.net> 0.22-1
changelog:
  - New upstream version
    - Added support fof JavaScript (V8) stack traces
    - Most parts of the in-hook core unwinder callable under unprivileged user
    - GDB core unwinder limits number of unwound frames
    - Fixed a pair of compile warnings - Chris Redmon <credmonster@gmail.com>


author: Matej Habrnal <mhabrnal@redhat.com> 0.23-1
changelog:
  - New upstream version
    - Allow rpm to be optional at build time
    - Do not use deprecated fedorahosted.org


author: Julius Milan <jmilan@redhat.com> 0.24-1
changelog:
  - New upstream version
    - Allow to report unpackaged problems
    - apidoc: generate html docs using doxygen
    - Fix parsing of subset of arm kernel oopses


author: Martin Kutlak <mkutlak@redhat.com> 0.25-1
changelog:
  - New upstream version
   - Normalization: actualize list of functions
   - Fix some compilation warnings
   - Allow to build python3 for rhel8
   - Makefile: add make release-* subcommands
   - Elfutils: Add missing stubs from earlier commit


author: Matej Habrnal <mhabrnal@redhat.com> 0.26-1
changelog:
  - spec: fix Allow python2 to be optional at build time
  - Allow python2 to be optional at build time
  - normalization: actualize list of functions
  - Append Python interpreter as related package
  - makefile: create .tar.xz with make release


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.2-1
changelog:
  - rebase to upstream v1.4.2
  - make sbd default to do pacemakerd-api handshake
  - conflict with pacemaker-libs < 2.0.5-4 to assure pacemaker
    is defaulting to pacemakerd-api handshake

    Resolves: rhbz#1903730
    Resolves: rhbz#1873135


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.2-3
changelog:
  - change the default for SBD_WATCHDOG_TIMEOUT to 10s
    s390(x) stays at 15s as before

    Resolves: rhbz#1922143


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.0-2
changelog:
  - reverted watchdog_timeout_default to 5s
    (slipped in via an unreleased change on 8.4.0 branch)

    Resolves: rhbz#1980797


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-1
changelog:
  - rebase to upstream v1.5.2
  - convert license naming to SPDX
  - make static analysis happy with a few checks & rearanges with
    dynamic-memory-management

    Resolves: rhbz#2168567


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-2
changelog:
  - add required tests subdirectory in addition to gating.yaml
    that had already been brought over before

    Related: rhbz#2168567


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-10
changelog:
  - Fix docdir patch (patch Makefile.am, not Makefile.in)
  - Use correct short name for Eclipse Public License 1.0
  - Use %license
  - Add explicit dependencies for libraries in Makefile.am (fixes FTBFS)
    Resolves: #1606302


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-14
changelog:
  - Fix getting of InstallDate property, improve it to work on non en_US locales
    and update support for recent Fedora distributions
    Resolves: #1776670


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.9-24
changelog:
  - Fix important coverity issues
    Resolves: #1989603
  - Fix incorrect use of temporary paths
    Resolves: #1989605


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.5.0-1
changelog:
  - Update to latest upstream version
  - Change license to Eclipse Public License 1.0
  - Use %license
  - Fix URL


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-10
changelog:
  - Fix null pointer (DoS) vulnerability via POST request to /cimom (CVE-2018-6644)
    (patch by Adam Majer)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-16
changelog:
  - Use %license for file which contains the text of the license
  - Change versioned docdir to unversioned and rename the docdir to match
    the package name
  - Remove %defattr
    Resolves: #1638007


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-9
changelog:
  - Use %license for file which contains the text of the license
  - Change versioned docdir to unversioned and rename the docdir to match
    the package name
  - Fix license tag
    Resolves: #1638015


author: Michael Simacek <msimacek@redhat.com> - 2.10.6-7
changelog:
  - Port from deprecated add_maven_depmap to mvn_install
  - Remove unused BR felix-framework
  - Fix unowned directory


author: Michael Simacek <msimacek@redhat.com> - 2.10.6-11
changelog:
  - Correct license tag to include CC0 and Public Domain
  - Repack tarball to remove possibly proprietary binaries
  - Use %license macro


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 2.10.6-13
changelog:
  - Stop scaladoc from trying to bundle non-existent resources
  - Temporarly disable docs generation during build


author: Watson Sato <wsato@redhat.com> - 0.1.63-5
changelog:
  - Update RHEL8 STIG profile to V1R8 (RHBZ#2148446)
  - Add rule warning for sysctl IPv4 forwarding config (RHBZ#2118758)
  - Fix remediation for firewalld_sshd_port_enabled (RHBZ#2116474)
  - Fix compatibility with Ansible 2.14


author: Watson Sato <wsato@redhat.com> - 0.1.66-1
changelog:
  - Rebase to a new upstream release 0.1.66 (RHBZ#2158404)
  - Update RHEL8 STIG profile to V1R9 (RHBZ#2152658)
  - Fix levels of CIS rules (RHBZ#2162803)
  - Remove unused RHEL8 STIG control file (RHBZ#2156192)
  - Fix accounts_password_pam_unix_remember's check and remediations (RHBZ#2153547)
  - Fix handling of space in sudo_require_reauthentication (RHBZ#2152208)
  - Add rule for audit immutable login uids (RHBZ#2151553)
  - Fix remediation of audit watch rules (RHBZ#2119356)
  - Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2115343)
  - Fix applicability of kerberos rules (RHBZ#2099394)
  - Add support rainer scripts in rsyslog rules (RHBZ#2072444)


author: Jan Černý <jcerny@redhat.com> - 0.1.69-1
changelog:
  - Rebase to a new upstream release 0.1.69 (RHBZ#2221695)
  - Fixed CCE link URL (RHBZ#2178516)
  - align remediations with rule description for rule configuring OpenSSL cryptopolicy (RHBZ#2192893)
  - Add rule audit_rules_login_events_faillock to STIG profile (RHBZ#2167999)
  - Fixed rules related to AIDE configuration (RHBZ#2175684)
  - Allow default permissions for files stored on EFI FAT partitions (RHBZ#2184487)
  - Add appropriate STIGID to accounts_passwords_pam_faillock_interval rule (RHBZ#2209073)
  - improved and unified OVAL checks checking for interactive users (RHBZ#2157877)
  - update ANSSI BP-028 profiles to be aligned with version 2.0 (RHBZ#2155789)
  - unify OVAL checks to correctly identify interactive users (RHBZ#2178740)
  - make rule checking for Postfix unrestricted relay accept more variants of valid configuration syntax (RHBZ#2170530)
  - Fixed excess quotes in journald configuration files (RHBZ#2169857)
  - rules related to polyinstantiated directories are not applied when building images for Image Builder (RHBZ#2130182)
  - evaluation and remediation of rules related to mount points have been enhanced for Image Builder (RHBZ#2130185)
  - do not enable FIPS mode when creating hardened images for Image Builder (RHBZ#2130181)
  - Correct URL used to download CVE checks (RHBZ#2222583)
  - mention exact required configuration value in description of some PAM related rules (RHBZ#2175882)
  - make mount point related rules not applicable when no such mount points exist (RHBZ#2176008)
  - improve checks determining if FIPS mode is enabled (RHBZ#2129100)


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.72-1
changelog:
  - Rebase to a new upstream release 0.1.72 (RHEL-25250)
  - Increase CIS standards coverage regarding SSH and cron (RHEL-1314)
  - Increase compatibility of accounts_tmout rule for ksh (RHEL-16896 and RHEL-1811)
  - Align Ansible and Bash remediation in sssd_certificate_verification rule (RHEL-1313)
  - Add a warning to rule service_rngd_enabled about rule applicability (RHEL-1819)
  - Add rule to terminate idle user sessions after defined time (RHEL-1801)
  - Allow spaces around equal sign in /etc/sudoers (RHEL-1904)
  - Add remediation for rule fapolicy_default_deny (RHEL-1817)
  - Fix invalid syntax in file /usr/share/scap-security-guide/ansible/rhel8-playbook-ospp.yml (RHEL-19127)
  - Refactor ensure_pam_wheel_group_empty (RHEL-1905)
  - Prevent remediation of display_login_attempts rule from creating redundant configuration entries (RHEL-1809)
  - Update PCI-DSS to v4 (RHEL-1808)
  - Fix regex in Ansible remediation of configure_ssh_crypto_policy (RHEL-1820)


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-2
changelog:
  - Provide manual page for scap-security-guide
  - Remove percent sign from spec's changelog to silence rpmlint warning
  - Convert RHEL6 'Restrict Root Logins' section's rules to Fedora
  - Convert RHEL6 'Set Password Expiration Parameter' rules to Fedora
  - Introduce 'Account and Access Control' section
  - Convert RHEL6 'Verify Proper Storage and Existence of Password Hashes' section's
    rules to Fedora
  - Set proper name of the build directory in the spec's setup macro.
  - Replace hard-coded paths with macros. Preserve attributes when copying files.


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-3
changelog:
  - Add .gitignore for Fedora output directory
  - Set up Fedora release name and CPE based on build system properties
  - Use correct file paths in scap-security-guide(8) manual page
    (RH BZ#1018905, c#10)
  - Apply further changes motivated by scap-security-guide Fedora RPM review
    request (RH BZ#1018905, c#8):
    * update package description,
    * make content files to be owned by the scap-security-guide package,
    * remove Fedora release number from generated content files,
    * move HTML form of the guide under the doc directory (together
      with that drop fedora/content subdir and place the content
      directly under fedora/ subdir).
  - Fixes for scap-security-guide Fedora RPM review request (RH BZ#1018905):
    * drop Fedora release from package provided files' final path (c#5),
    * drop BuildRoot, selected Requires:, clean section, drop chcon for
      manual page, don't gzip man page (c#4),
    * change package's description (c#4),
    * include PD license text (#c4).


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.3-1
changelog:
  - Update versioning scheme - move fedorassgrelease to be part of
    upstream version. Rename it to fedorassgversion to avoid name collision
    with Fedora package release.


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.4-1
changelog:
  - Fix remediation for sshd set keepalive (ClientAliveCountMax) and move
    it to /shared
  - Add shared remediations for sshd disable empty passwords and
    sshd set idle timeout
  - Shared remediation for sshd disable root login
  - Add empty -compat subpackage to ensure backward-compatibility with
    openscap-content and firstaidkit-plugin-openscap packages (RH BZ#1040335)
  - OVAL check for sshd disable root login
  - Fix typo in OVAL check for sshd disable empty passwords
  - OVAL check for sshd disable empty passwords
  - Unselect no shelllogin for systemaccounts rule from being run by default
  - Rename XCCDF rules
  - Revert Set up Fedora release name and CPE based on build system properties
  - Shared OVAL check for Verify that Shared Library Files Have Root Ownership
  - Shared OVAL check for Verify that System Executables Have Restrictive Permissions
  - Shared OVAL check for Verify that System Executables Have Root Ownership
  - Shared OVAL check for Verify that Shared Library Files Have Restrictive
    Permissions
  - Fix remediation for Disable Prelinking rule
  - OVAL check and remediation for sshd's ClientAliveCountMax rule
  - OVAL check for sshd's ClientAliveInterval rule
  - Include descriptions for permissions section, and rules for checking
    permissions and ownership of shared library files and system executables
  - Disable selected rules by default
  - Add remediation for Disable Prelinking rule
  - Adjust service-enable-macro, service-disable-macro XSLT transforms
    definition to evaluate to proper systemd syntax
  - Fix service_ntpd_enabled OVAL check make validate to pass again
  - Include patch from Šimon Lukašík to obsolete openscap-content
    package (RH BZ#1028706)
  - Add OVAL check to test if there's is remote NTP server configured for
    time data
  - Add system settings section for the guide (to track system wide
    hardening configurations)
  - Include disable prelink rule and OVAL check for it
  - Initial OVAL check if ntpd service is enabled. Add package_installed
    OVAL templating directory structure and functionality.
  - Include services section, and XCCDF description for selected ntpd's
    sshd's service rules
  - Include remediations for login.defs' based password minimum, maximum and
    warning age rules
  - Include directory structure to support remediations
  - Add SCAP "replace or append pattern value in text file based on variable"
    remediation script generator
  - Add remediation for "Set Password Minimum Length in login.defs" rule


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.5-1
changelog:
  - Fix fedora-srpm and fedora-rpm Make targets to work again
  - Include RHEL-6 and RHEL-7 datastream files to support remote RHEL system scans
  - EOL for Fedora 18 support
  - Include Fedora datastream file for remote Fedora system scans


author: Šimon Lukašík <slukasik@redhat.com> - 0.1.5-3
changelog:
  - Rebase the RHEL part of SSG to the latest upstream version (0.1.18)
  - Add STIG DISCLAIMER to the shipped documentation


author: Šimon Lukašík <slukasik@redhat.com> - 0.1.22-1
changelog:
  - update to the latest upstream release
  - only DataStream file is now available for Fedora
  - start distributing security baseline for Firefox
  - start distributing security baseline for Java RunTime deployments


author: Šimon Lukašík <slukasik@redhat.com> - 0.1.24-1
changelog:
  - update to the latest upstream release
  - created doc sub-package to ship all the guides
  - start distributing centos and scientific linux content
  - rename java content to jre


author: Jan iankko Lieskovsky <jlieskov@redhat.com> - 0.1.29-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.29 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.29
  - Do not ship Firefox/DISCLAIMER documentation file since it has been removed
    in 0.1.29 upstream release


author: Jan iankko Lieskovsky <jlieskov@redhat.com> - 0.1.30-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.30 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30
  - Drop shell library for remediation functions since it is not required
    starting from 0.1.30 release any more


author: Martin Preisler <mpreisle@redhat.com> - 0.1.31-1
changelog:
  - update to the latest upstream release
  - new default location for content /usr/share/scap/ssg
  - install HTML tables in the doc subpackage


author: Watson Sato <wsato@redhat.com> - 0.1.35-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.35 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.35


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.36 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.36


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.37-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.37 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.37


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.38-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.38 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.38


author: Jan Černý <jcerny@redhat.com> - 0.1.39-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.39 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.39
  - Fix spec file to build using Python 3
  - Fix License because upstream changed to BSD-3


author: Watson Sato <wsato@redhat.com> - 0.1.40-3
changelog:
  - Use explicit path BuildRequires to get /usr/bin/python3 inside the buildroot
  - Only build content for rhel8 products


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.41-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.41 release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.41
  - Add RHEL8 Product with OSPP4.2 and PCI-DSS Profiles


author: Matěj Týč <matyc@redhat.com> - 0.1.42-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.42 release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.42
  - System-wide crypto policies are introduced for RHEL8
  - Patches introduced the RHEL8 product were dropped, as it has been upstreamed.


author: Matěj Týč <matyc@redhat.com> - 0.1.42-3
changelog:
  - Added FIPS mode rule for the OSPP profile.
  - Split the installed_OS_is certified rule.
  - Explicitly disabled OSP13, RHV4 and Example products.


author: Matěj Týč <matyc@redhat.com> - 0.1.42-5
changelog:
  - Fixed profiles descriptions, so they don't contain literal '\n'.
  - Made the configure_kerberos_crypto_policy OVAL more robust.
  - Made OVAL for libreswan and bind work as expected when those packages are not installed.


author: Matěj Týč <matyc@redhat.com> - 0.1.42-6
changelog:
  - Further fix of profiles descriptions, so they don't contain literal '\'.
  - Removed obsolete sshd rule from the OSPP profile.


author: Jan Černý <jcerny@redhat.com> - 0.1.42-7
changelog:
  - Introduce Podman backend for SSG Test suite
  - Update bind and libreswan crypto policy test scenarios


author: Matěj Týč <matyc@redhat.com> - 0.1.42-9
changelog:
  - Fixed Crypto Policy OVAL for NSS
  - Got rid of rules requiring packages dropped in RHEL8.
  - Profile descriptions fixes.


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.42-11
changelog:
  - Assign CCE to rules from OSPP profile which were missing the identifier.
  - Fix regular expression for Audit rules ordering
  - Account for Audit rules flags parameter position within syscall
  - Add remediations for Audit rules file path
  - Add Audit rules for modification of /etc/shadow and /etc/gshadow
  - Add Ansible and Bash remediations for directory_access_var_log_audit rule
  - Add a Bash remediation for Audit rules that require ordering


author: Matěj Týč <matyc@redhat.com> - 0.1.44-2
changelog:
  - Ported changelog from late 8.0 builds.
  - Disabled build of the OL8 product, updated other components of the cmake invocation.


author: Milan Lysonek <mlysonek@redhat.com> - 0.1.45-2
changelog:
  - Use crypto-policy rules in OSPP profile.
  - Re-enable FIREFOX and JRE product in build.
  - Change test suite logging message about missing profile from ERROR to WARNING.
  - Build only one version of SCAP content at a time.


author: Watson Sato <wsato@redhat.com> - 0.1.46-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.46 release
  - Align OSPP Profile with Common Criteria Requirements (RHBZ#1714798)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.48-4
changelog:
  - Drop rsyslog rules from OSPP profile
  - Update COBIT URI
  - Add rules for strong source of RNG entropy
  - Enable build of RHEL8 STIG Profile (RHBZ#1755447)
  - STIG profile: added rsyslog rules and updated SRG mappings
  - Split audit rules according to audit component (RHBZ#1791312)


author: Watson Sato <wsato@redhat.com> - 0.1.50-2
changelog:
  - Fix Ansible for no_direct_root_logins
  - Fix Ansible template for SELinux booleans
  - Add CCEs to rules in RHEL8 CIS Profile (RHBZ#1760734)


author: Watson Sato <wsato@redhat.com> - 0.1.50-3
changelog:
  - HIPAA Profile (RHBZ#1832760)
    - Enable build of RHEL8 HIPAA Profile
    - Add kickstarts for HIPAA
  - CIS Profile (RHBZ#1760734)
    - Add Ansible fix for sshd_set_max_sessions
    - Add CIS Profile content attribution to Center for Internet Security


author: Matěj Týč <matyc@redhat.com> - 0.1.50-10
changelog:
  - Update the scapval invocation (RHBZ#1815007)
  - Re-added the SSH Crypto Policy rule to OSPP, and added an SRG to the rule (RHBZ#1815007)
  - Change the spec file macro invocation from patch to Patch
  - Fix the rekey limit in ssh/sshd rules (RHBZ#1813066)


author: Matěj Týč <matyc@redhat.com> - 0.1.50-11
changelog:
  - fixed link in a grub2 rule description (rhbz#1854854)
  - fixed selinux_all_devicefiles_labeled rule (rhbz#1852367)
  - fixed no_shelllogin_for_systemaccounts on ubi8 (rhbz#1836873)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.53-3
changelog:
  - Enforce pam_wheel for "su" in the OSPP profile (RHBZ#1884062)
  - Fix case insensitive checking in rsyslog_remote_tls (RHBZ#1899032)
  - Exclude kernel_trust_cpu_rng related rules on s390x (RHBZ#1899041)
  - Create a SSH_USE_STRONG_RNG rule for SSH client and select it in OSPP profile (RHBZ#1884067)
  - Disable usbguard rules on s390x architecture (RHBZ#1899059)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.53-4
changelog:
  - Fix description of rule installed_OS_is_vendor_supported (RHBZ#1914193)
  - Fix RHEL6 CPE dictionary (RHBZ#1899059)
  - Fix SRG mapping references for ssh_client_rekey_limit and use_pam_wheel_for_su (RHBZ#1914853)


author: Watson Sato <wsato@redhat.com> - 0.1.54-1
changelog:
  - Update to the latest upstream release (RHBZ#1889344)
  - Add Minimal, Intermediary and Enhanced ANSSI Profiles (RHBZ#1778188)


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.57-2
changelog:
  - Update Ansible login banner fixes to avoid unnecessary updates (RHBZ#1857179)
  - Include tests for Ansible Playbooks that remove and reintroduce files.
  - Update RHEL8 STIG profile to V1R3 (RHBZ#1993056) 
  - Improve Audit Rules remediation to group similar syscalls (RHBZ#1876483)
  - Reestructure RHEL7 and RHEL8 CIS profiles according to the policy (RHBZ#1993197)
  - Add Kickstart files for ISM profile (RHBZ#1955373)
  - Fix broken RHEL7 documentation links (RHBZ#1966577)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.57-3
changelog:
  - Fix remaining audit rules file permissions (RHBZ#1993056)
  - Mark a STIG service rule as machine only (RHBZ#1993056)
  - Fix a remaining broken RHEL7 documentation link. (RHBZ#1966577)


author: Matej Tyc <matyc@redhat.com> - 0.1.58-1
changelog:
  - Rebase to a new upstream release. (RHBZ#2014485)
  - Add a VM wait handling to fix issues with tests.


author: Watson Sato <wsato@redhat.com> - 0.1.60-2
changelog:
  - Update RHEL8 STIG profile to V1R5 (RHBZ#2049555)
  - Align audit rules for OSPP profile (RHBZ#2000264)
  - Fix rule selection in ANSSI Enhanced profile (RHBZ#2053587)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.60-3
changelog:
  - Update sudoers rules in RHEL8 STIG V1R5 (RHBZ#2049555)
  - Add missing SRG references in RHEL8 STIG V1R5 rules (RHBZ#2049555)
  - Update chronyd_or_ntpd_set_maxpoll to disregard server and poll directives (RHBZ#2026301)
  - Fix GRUB2 rule template to configure the module correctly on RHEL8 (RHBZ#2030966)
  - Update GRUB2 rule descriptions (RHBZ#2014485)
  - Make package_rear_installed not applicable on AARCH64 (RHBZ#2014485)


author: Watson Sato <wsato@redhat.com> - 0.1.60-4
changelog:
  - Fix Ansible service disabled tasks (RHBZ#2014485)
  - Set rule package_krb5-workstation_removed as not applicable on RHV (RHBZ#2055149)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.60-5
changelog:
  - Remove tmux process runinng check in configure_bashrc_exec_tmux (RHBZ#2055860)
  - Fix issue with getting STIG items in create_scap_delta_tailoring.py (RHBZ#2014485)
  - Update rule enable_fips_mode to check only for technical state (RHBZ#2014485)


author: Watson Sato <wsato@redhat.com> - 0.1.60-8
changelog:
  - Update to ensure a sysctl option is not defined in multiple files (RHBZ#2079241)
  - Update RHEL8 STIG profile to V1R6 (RHBZ#2079241)


author: Watson Sato <wsato@redhat.com> - 0.1.60-9
changelog:
  - Fix validation of OVAL 5.10 content (RHBZ#2079241)
  - Fix Ansible sysctl remediation (RHBZ#2079241)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.63-2
changelog:
  - aligning with the latest STIG update (RHBZ#2112937)
  - OSPP: use Authselect minimal profile (RHBZ#2117192)
  - OSPP: change rules for protecting of boot (RHBZ#2116440)
  - add warning about configuring of TCP queues to rsyslog_remote_loghost (RHBZ#2078974)
  - fix handling of Defaults clause in sudoers (RHBZ#2083109)
  - make rules checking for mount options of /tmp and /var/tmp applicable only when the partition really exists (RHBZ#2032403)
  - fix handling of Rsyslog include directives (RHBZ#2075384)


author: Jan Černý <jcerny@redhat.com> - 0.1.73-1
changelog:
  - Rebase scap-security-guide package to version 0.1.73 (RHEL-36733)
  - Change crypto policy used in the CUI profile to FIPS (RHEL-30346)
  - Fix file path identification in Rsyslog configuration (RHEL-17202)
  - Use a correct chrony server address in STIG profile (RHEL-1814)
  - Don't BuildRequire /usr/bin/python3 (RHEL-2244)


author: Matthew Burket <mburket@redhat.com> - 0.1.74-1
changelog:
  - Rebase to a new upstream release 0.1.74 (RHEL-53913)
  - Improve Rsyslog rules to support RainerScript syntax (RHEL-1816)
  - Update password hashing settings for ANSSI-BP-028 (RHEL-54390)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.74-3
changelog:
  - fix build
  - keep firefox and rhel8 ds-1.2 files in the package in form of symbolic links to regular ds files


author: Matthew Burket <mburket@redhat.com> - 0.1.75-1
changelog:
  - Rebase scap-security-guide to the latest upstream version (RHEL-66153)
  - detection of Grub2 kernel command line arguments has been enhanced to cover more use cases (RHEL-53365)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 1:2.0.2-9
changelog:
  - use %{?dist} instead of %{dist} (#1725774)
  - scl-utils-build own the pkgconfig directory by %scl_files (#1431962)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 1:2.0.2-10
changelog:
  - use %__python3 instead of macro %__python (#1733526)
  - corrected unescaped per-cent character in the changelog (#1734103)


author: Daniel Kopecek <dkopecek@redhat.com> - 2.5.2-14
changelog:
  Resolves: rhbz#1689897 - Missing '--extent-only' patch
  Resolves: rhbz#1630298 - Removal of component scrub or its crypto from RHEL


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.12.0-5.el8
changelog:
  - seabios-add-get_keystroke_full-helper.patch [bz#1693031]
  - seabios-bootmenu-add-support-for-more-than-9-entries.patch [bz#1693031]
  - Resolves: bz#1693031
    (On systems with more than 10 available boot devices, keys are uninintuitive)


author: Jon Maloy <jmaloy@redhat.com> - 1.15.0-1.el8
changelog:
  - pci-reserve-resources-for-pcie-pci-bridge-to-fix-reg.patch [bz#2001921]
  - pci: let firmware reserve IO for pcie-pci-bridge.patch [bz#2001921]
  - Resolves: bz#2001921


author: Paweł Poławski <ppolawsk@redhat.com> - 1.16.0-1
changelog:
  - Rebase to upstream 1.16 tag [bz#2066828]
  - Resolves: bz#2066828
    (rebase seabios to 1.16 release)


author: Jon Maloy <jmaloy@redhat.com> - 1.16.0-2
changelog:
  - seabios-shortcut-skip-unbootable-disks-optimitation.patch [bz#2073012]
  - seabios-pci-refactor-the-pci_config_-functions.patch [bz#2083884]
  - seabios-reset-force-standard-PCI-configuration-access.patch [bz#2083884]
  - Resolves: bz#2073012
    (Guest whose os is installed multiple disks but boot partition is installed on single disk can't boot into OS on RHEL 8 [rhel-8.7.0])
  - Resolves: bz#2083884
    (qemu reboot problem with seabios 1.16.0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.16.0-3
changelog:
  - seabios-virtio-blk-use-larger-default-request-size.patch [bz#2101787]
  - Resolves: bz#2101787
    ([rhel.8.7] Loading a kernel/initrd is sometimes very slow)


author: Jon Maloy <jmaloy@redhat.com> - 1.16.0-4
changelog:
  - seabios-malloc-use-variable-for-ZoneHigh-size.patch [bz#2227373]
  - seabios-malloc-use-large-ZoneHigh-when-there-is-enough-memor.patch [bz#2227373]
  - Resolves: bz#2227373
    ("No bootable device" with OS boot disk interface VirtIO-SCSI and with more than 9 VirtIO disks.)


author: Robert Scheck <robert@fedoraproject.org> - 8.15.2-27
changelog:
  - Use SSL_CTX_use_certificate_chain_file() to handle intermediate
    certificates passed additionally in confSERVER_CERT (#1565341)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.15.2-30
changelog:
  - Dropped sysvinit support
    Resolves: rhbz#1610287
  - Dropped hesiod support
    Resolves: rhbz#1638491


author: Vit Mojzis <vmojzis@redhat.com> - 4.2.1-3
changelog:
  - Use 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-1
changelog:
  - SETools 4.3.0 release (#1820079)
  - Revised sediff method for TE rules. This drastically reduced memory and run time.
  - Added infiniband context support to seinfo, sediff, and apol.
  - Added apol configuration for location of Qt assistant.
  - Fixed sediff issue where properties header would display when not requested.
  - Fixed sediff issue with type_transition file name comparison.
  - Fixed permission map socket sendto information flow direction.
  - Added methods to TypeAttribute class to make it a complete Python collection.
  - Genfscon now will look up classes rather than using fixed values which
    were dropped from libsepol.
  - setools requires -console, -console-analyses and -gui packages (#1820078)


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-4
changelog:
  - Disable/remove neverallow options in frontends (#2184141)
  - AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.24-2
changelog:
  - Optimize get_rpm_nvr_by_type by adding a cache (#1794807)
  - Stop building seappletlegacy (#1878792)
  - Update translations


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-1
changelog:
  - Revert "Replace pydbus with dasbus"
  - Fix typos in --help, man pages and developer's guide (#2028226)
  - Do not use Python slip package
  - Stop SetroubleshootFixit after 10 seconds of inactivity
  - Fix plugin exception reporting
  - export alert dbus signal
  - Make sure local_policy_package is not None
  - sealert: add "Last Seen" column to alert list


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-4
changelog:
  - Decrease setroubleshootd priority and limit RAM utilization to 1GB (#2064727)
  - doc: Document performance related changes


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-6
changelog:
  - Fix shebang of SetroubleshootPrivileged.py (#2231023)
  - Check that SELinux is enabled before running (#2178950)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.10-1
changelog:
  - Handle no "allowed_target_types" properly
  - bind_ports: Do not use when there are no allowed_target_types
  - Fix summary and "if" text for AVCs with unknown target path
  - plugins: Update translations


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.10-2
changelog:
  - update "file" plugin (#1649818)
  - Update "xen_image" plugin (#1649831)
  - Update qemu_blk_image and qemu_file_image (#1649838)


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.12-1
changelog:
  - Use get_package_nvr* functions instead of get_rpm_nvr*
  - Update deprecated type references (#1829306)


author: Nathan Scott <nathans@redhat.com> - 0.6.2-1
changelog:
  - Switch to enabling the Java 8+ maven modules only now.
  - Add unitsofmeasurement prefix to package name.
  - Update to latest upstream sources.


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.0-2
changelog:
  - update to latest content of https://github.com/containers/skopeo/releases/tag/1.14.0
    (https://github.com/containers/skopeo/commit/6abf96bb82666fbb3d4ad9faf1812e5ae2d31a74)


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.3-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/1c2ab99)
  - Related: Jira:RHEL-2110


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-2
changelog:
  - use rhel-shortnames only from trusted registries
  - sync with config files from current versions of vendored projects
  - Resolves: #1933775
  - Resolves: #1933776


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-3
changelog:
  - use infra_image = "registry.redhat.io/rhel8/pause" in contiainers.conf
  - add update-vendored.sh script which will always assure we ship
    documentation/configs for versions vendored in podman, buildah and
    skopeo
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-4
changelog:
  - use infra_image = "registry.redhat.io/ubi8/pause" in containers.conf
    (unlike previous one ubi8/pause doesn't require authentication)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-5
changelog:
  - require crun >= 0.19 and set it as default OCI runtime
  - add ensure() function to update.sh so that configuration statements
    can be easily amended/reviewed
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.3-1
changelog:
  - update to skopeo-1.2.3
  - sync with Fedora deps
  - fix typo in upstream Makefile
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.3-2
changelog:
  - assure runc is set as default runtime in RHEL8
  - update shortnames from upstream
  - sync vendored component versions with upstream
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.3.0-3
changelog:
  - update to new versions of vendored components
  - fail is there is an issue in communication with Pyxis API
  - understand devel branch in update.sh script
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.3.1-3
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.3
    (https://github.com/containers/skopeo/commit/038f70e)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.3.1-4
changelog:
  - add direct runc dependency to avoid situation when runc is listed
    as default runtime but only crun is present in RHEL8
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.0-1
changelog:
  - update vendored components
  - ship /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release only on non-RHEL and
    CentOS distros
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.0-7
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.4
    (https://github.com/containers/skopeo/commit/ea32394)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.4
    (https://github.com/containers/skopeo/commit/130f32f)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.2-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.4
    (https://github.com/containers/skopeo/commit/01e51ce)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/47b8082)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.3
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/177443f)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.4
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/31b8981)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.5
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/db1e814)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.6
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/c5a5199)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.7
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/25d3e7b)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.8
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/4d3588e)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.9
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/86fa758)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.10
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/53cf287)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.11
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/a95b0cc)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-0.12
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/ff88d3f)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.1-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/fc81803)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.1-0.2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/116e75f)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.1-0.3
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/9c9a9f3)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.2-0.4
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.11
    (https://github.com/containers/skopeo/commit/8191ef3)
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.3-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.11
    (https://github.com/containers/skopeo/commit/d79588e)
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.3-0.2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.11
    (https://github.com/containers/skopeo/commit/7e11ab4)
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:1.12.0-2
changelog:
  - rebuild for following CVEs:
  CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
  - Resolves: #2179951
  - Resolves: #2187319
  - Resolves: #2187367
  - Resolves: #2203682
  - Resolves: #2207513


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.3-0.2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/d0a0f1a)
  - Resolves: RHEL-28226


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.14.3-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/4a2bc3a)
  - Resolves: RHEL-28226


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.3-2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/5f2b9af)
  - Resolves: RHEL-28728


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.4-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/78d9c9a)
  - Resolves: RHEL-40852


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.5-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/072072b)
  - Resolves: RHEL-40801


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/540efb3)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/4336972)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-3
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/4414e52)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-4
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/f952195)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-5
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/c20c32d)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-7
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/2b16a1c)
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-8
changelog:
  - rebuild for following CVEs:
  CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
  - Resolves: #2179946
  - Resolves: #2187316
  - Resolves: #2187362
  - Resolves: #2203679
  - Resolves: #2207508


author: Nalin Dahyabhai <nalin@redhat.com> - 0.8.3-1
changelog:
  - update to 0.8.3 to also notice and reflect changes caused by internal
    add/modify/modrdn/delete operations


author: Nalin Dahyabhai <nalin@redhat.com> - 0.8.4-1
changelog:
  - update to 0.8.4 to fix:
    - problems updating references, particularly those for %referred() (#474478)
    - inability to notice internal add/modify/modrdn/delete operations (really
      this time) (#474426)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.8.5-2
changelog:
  - make the example nsslapd-pluginpath values the same on 32- and 64-bit
    systems, because we can depend on the directory server "knowing" which
    directory to search for the plugins


author: Nalin Dahyabhai <nalin@redhat.com> - 0.15-1
changelog:
  - fix %deref and %referred to fail rather than return a valid-but-empty
    result when they fail to evaluate (reported by Rob Crittenden)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.16-1
changelog:
  - fix NIS server startup problem when no port is explicitly configured and
    we're using portmap instead of rpcbind (#500903)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.17-3
changelog:
  - change buildreq from fedora-ds-base-devel to 389-ds-base-devel, which
    should avoid multilib conflicts from installing both arches of the new
    package (#511504)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.18-1
changelog:
  - update to 0.18
    - add a deref_rf function
    - schema-compat: don't respond to search requests for which there's no backend
    - schema-compat: add the ability to do standalone compat containers


author: Nalin Dahyabhai <nalin@redhat.com> - 0.21-1
changelog:
  - update to 0.21
    - schema-compat: don't look at standalone compat containers for a search,
      since we'll already have looked at the group container


author: Nalin Dahyabhai <nalin@redhat.com> - 0.21-2
changelog:
  - make sure we always pull in nss-devel and nspr-devel, and the right
    ldap toolkit for the Fedora or RHEL version


author: Nalin Dahyabhai <nalin@redhat.com> - 0.24-1
changelog:
  - carry our own yp.x, so that we don't get bitten if libc doesn't include
    yp client routines
  - we need rpcgen at build-time now


author: Nalin Dahyabhai <nalin@redhat.com> - 0.25-1
changelog:
  - speed up building compat entries which reference thousands of other entries
    (more of #692690)
  - 389-ds-base is apparently exclusive to x86_64 and %{ix86} on EL, so we have
    to be, too


author: Nalin Dahyabhai <nalin@redhat.com> - 0.26-1
changelog:
  - when building for 389-ds, use libpthread's read-write locks instead of
    NSPR's (part of #730394/#730403)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.27-1
changelog:
  - when building for 389-ds, use Slapi_RWLocks if they appear to be available
    (the rest of #730394/#730403)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.28-1
changelog:
  - when configured with --with-ldap=openldap, link with -lldap_r rather
    than -lldap (rmeggins, #769107)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.29-1
changelog:
  - add regmatchi/regsubi formatting functions which work like regmatch/regsub,
    but do matching in a case-insensitive manner
  - update NIS map defaults to match {CRYPT} userPassword values in a
    case-insensitive manner so that we also use {crypt} userPassword values
  - fix inconsistencies in the NIS service stemming from using not-normalized DNs
    in some places where it should have used normalized DNs


author: Nalin Dahyabhai <nalin@redhat.com> - 0.30-1
changelog:
  - skip recalculations when the attributes which changed don't factor into
    our calculations (part of #771493)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.33-1
changelog:
  - get more aggressive about skipping unnecessary calculations (most of
    the problem in #771444, though not the approach described there)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.34-1
changelog:
  - do entry comparisons ourselves, albeit less throughly, to avoid the worst
    case in pathological cases (more of #771444)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.35-1
changelog:
  - add mmatch/mregmatch[i]/mregsub[i] formatting functions which work like
    match/regmatch[i]/regsub[i], but which can handle and return lists of
    zero or more results (part of #783274)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.36-1
changelog:
  - take steps to avoid making yp_first/yp_next clients loop indefinitely
    when a single LDAP entry produces multiple copies of the same NIS key
    for a given map


author: Nalin Dahyabhai <nalin@redhat.com> - 0.37-1
changelog:
  - fix a compile error on systems where LDAP_SCOPE_SUBORDINATE isn't defined
    (reported by Christian Neuhold)
  - conditionalize whether we have a build dependency on tcp_wrappers (older
    releases) or tcp_wrappers-devel (newer releases)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.39-1
changelog:
  - add a "default" function for trying to evaluate one expression, then
    another, then another... (part of #767372)
  - when creating a compat entry based on a real entry, set an entryUSN based on
    the source entry or the rootDSE (freeipa #864); the "scaffolding" entries
    won't have them


author: Nalin Dahyabhai <nalin@redhat.com> - 0.40-1
changelog:
  - treat padding values passed to the "link" function as expressions to be
    evaluated rather than simply as literal values (part of #767372)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.41-1
changelog:
  - log errors evaluating pad expressions in %link rather than continuing on
    until we hit an arithmetic exception (#810258)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix a leak due to us assuming that slapi_mods_add_smod() not taking ownership
    of an smod along with its contents, when it just keeps the contents


author: Nalin Dahyabhai <nalin@redhat.com> - 0.43-1
changelog:
  - reintroduce support for directory server transactions (nhosoi, IPA#3046)
  - control transaction support at run-time, deciding when to do things based
    on the value of the nsslapd-pluginbetxn attribute in the plugin's entry
  - NIS: add default settings for shadow.byname and passwd.adjunct.byname maps


author: Nalin Dahyabhai <nalin@redhat.com> - 0.44-1
changelog:
  - add missing newline to a couple of debug log messages
  - note whether or not betxn support is compiled in as part of the
    nsslapd-pluginVersion value we report to the server
  - register callbacks in the same order in both plugins, so that
    their log messages are logged in the same order


author: Nalin Dahyabhai <nalin@redhat.com> - 0.44-2
changelog:
  - set betxn support to be disabled by default on Fedora 17 or EL 5 or older,
    which have versions of IPA < 3.0, per mkosek on freeipa-devel


author: Nalin Dahyabhai <nalin@redhat.com> - 0.46-1
changelog:
  - when checking if we can skip processing for a given change, pay attention to
    whether or not the changes cause the entry to need to be added or removed
    from a map (#912673)
  - check SLAPI_PLUGIN_OPRETURN in post-change hooks, in case the backend failed
    to update things but the server called us anyway


author: Nalin Dahyabhai <nalin@redhat.com> - 0.47.5-1
changelog:
  - merge Alexander Bokovoy's patches to
    - teach the schema compatibility plugin to optionally serve user and group
      information retrieved from libc as part of a set of compat entries
    - handle simple bind requests for those entries by calling out to PAM
    - to rewrite the DN of incoming bind requests to compat entries to point
      at the source entries, instead of returning a referral which most clients
      won't handle
  - include IPA-specific docs as docs


author: Nalin Dahyabhai <nalin@redhat.com> - 0.47.6-1
changelog:
  - only buildrequire libsss_nss_idmap-devel on releases that included SSSD
    version 1.10 or later, where it first appeared


author: Nalin Dahyabhai <nalin@redhat.com> - 0.47.7-1
changelog:
  - fix building against versions of directory server older than 1.3.0, which
    first introduced slapi_escape_filter_value()


author: Nalin Dahyabhai <nalin@redhat.com> - 0.48-1
changelog:
  - try to gracefully handle failures obtaining internal locks
  - fix locating-by-name of entries with names that require escaping
  - add self-tests for nsswitch and PAM functionality
  - make nsswitch mode properly handle user and group names with commas in them
  - handle attempts to PAM authenticate to compat groups (i.e., with failure)
  - drop the "schema-compat-origin" attribute


author: Nalin Dahyabhai <nalin@redhat.com> - 0.49-1
changelog:
  - add {nis,schema-compat}-ignore-subtree and -restrict-subtree settings,
    which should let us avoid deadlocks when tasks are modifying data in
    the backend database (#1007451)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.50-1
changelog:
  - if we get an EPIPE while registering with rpcbind, try to reconnect and
    retransmit before giving up


author: Nalin Dahyabhai <nalin@redhat.com> - 0.51-1
changelog:
  - fix another request argument memory leak in NIS server (#1040159)
  - fix miscellaneous items found by static analysis


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-1
changelog:
  - correctly reflect whether or not we're built with transaction support in
    the module's nsslapd-pluginVersion attribute
  - fix a couple of should've-used-memmove()-instead-of-memcpy() cases which
    would hit when removing maps or groups of maps (#1043546/#1043638)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-3
changelog:
  - remove ExclusiveArch if %{rhel} is 7 or higher, because 389-ds-base gets
    built for everything now (#1055711)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.53-1
changelog:
  - correct the default NIS map settings for hosts.byname and hosts.byaddr,
    from report by Rik Megens
  - fix several problems when hitting out-of-memory conditions, spotted by
    static analysis


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-1
changelog:
  - Add support for FreeIPA's ID views
  - Allow searching SSSD-provided users as memberUid case-insensitevly
    Fixes bug #1130131


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54.1-1
changelog:
  - support FreeIPA overrides in LDAP BIND callback
  - ignore FreeIPA override searchs outside configured schema compat subtrees


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54.2-1
changelog:
  - CVE-2015-0283 slapi-nis: infinite loop in getgrnam_r() and getgrgid_r() (#1206049)
  - Make sure nss_sss.so.2 module is used directly
  - Allow building slapi-nis with ID views against 389-ds-base from RHEL7.0/CentOS7.0 releases


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.55-1
changelog:
  - Support external members of IPA groups in schema compat
  - Support bind over ID overrides when uid is not overridden
  - Populate schema compat trees in parallel to LDAP server startup


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.2-1
changelog:
  - New upstream release
  - Update links to the upstream project page and releases
  - Use extended SSSD API to signal that an entry should not be cached anymore
  - Add support for timeout-based NSS queries with libsss_nss_idmap


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.2-3
changelog:
  - Do not build on i686 in Fedora 28 or later as 389-ds-base is not available there anymore
  - Resolves rhbz#1556448
  - Remove outdated ExclusiveArch for RHEL6


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.2-5
changelog:
  - Link with libnsl explicitly in Fedora 28 or later
  - Require libnsl2-devel for build
  - Resolves rhbz#1573636


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-1
changelog:
  - Upstream release 0.56.5
  - Resolves: rhbz#1751295: (2) When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming
  - Resolves: rhbz#1768156: ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.6-2
changelog:
  - CVE 2021-3480:  idm:DL1/slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1944713


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.6-3
changelog:
  - Resolves: rhbz#1958909 - fix regression for scoped searches in compat tree
  - Resolves: rhbz#1978189 - better handle error response from libsss_nss_idmap


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Resolves: rhbz#1984010
    Fix ID views integration
  - Fix base scope lookups
  - Resolves: rhbz#1784172
    Bump NIS max dgram size to 8KB by default instead of 1KB
  - Resolves: rhbz#2070575
    Allow to rebuild the compat tree


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-4
changelog:
  - Ignore updates from non-tracked subtrees during modify/modrdn/update
    to avoid deadlocks with retro changelog
  - Resolves: RHEL-5134


author: Jindrich Novy <jnovy@redhat.com> - 0.4.0-1
changelog:
  - update to v.0.4.0
  - sync with fedora spec
  - drop applied CVE-2019-14378 patch
  - Resolves: #1766774


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.2
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.3
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.4-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.4
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.6-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.6
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.7-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.7
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.8-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.8
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.0.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/archive/v1.0.1.tar.gz
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.1
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.2.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.1
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 1.2.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.2
  - Related: Jira:RHEL-2110


author: Jindrich Novy <jnovy@redhat.com> - 1.2.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3
  - Related: Jira:RHEL-2110


author: Rajeesh K V <rajeeshknambiar@fedoraproject.org> 6.1-3
changelog:
  - Updated license for AnjaliOldLipi to OFL 1.1
  - Drop the email confirmation on AnjaliOldLipi license


author: Paul Wouters <pwouters@redhat.com> - 1.7.4.1-1
changelog:
  - Resolves: rhbz#1805132 socat does not recognize IP addresses of the SAN extensions in ssl mode
  - Resolves: rhbz#1870279 Transfer via socat fails with openssl enabled
  - Resolves: rhbz#1914989 Socat udp4-recvfrom cause endless loop error when target is not vaild


author: Paul Wouters <paul@xelerance.com> - 1.3.0-3
changelog:
  - Initial Fedora package
  - Do not install the .a file
  - Use a separate "opendnssec" user to own /var/sofhsm


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-3
changelog:
  - Add support for CKM_RSA_PKCS_OAEP key un/wrapping [Petr Spacek]
  - Use OpenSSL EVP interface for AES key wrapping [Petr Spacek]
  - Fix softhsm2-pk11install buid and post call
  - Do not use --with-objectstore-backend-db (causes issues on i686)
  - Change install directory to /usr/lib*/pkcs11/
  - Install pkcs11 module file
  - Use official upstream tar ball
  - Create ods user to own softhsm/token files
  - Enable migration tools (for softhsm-v1 installs)
  - Add softlink for softhsm-v1 .so (needed for opendnssec's conf.xml)
  - Require p11-kit, nss-tools, for SoftHSM PKCS #11 Module file
  - Copy pk11install.c from coolkey package
  - Enable hardened build
  - Add upstream official source url


author: Paul Wouters <pwouters@redhat.com> - 2.0.0-1
changelog:
  - Resolves: rhbz#1244461 Update to softhsm-2.0.0
  - Resolves: rhbz#1177086 A marked as trusted certificate cannot be written in a softhsmv2 db
  - Resolves: rhbz#1159827 Typo in homedir in /etc/passwd
  - Added global prever to toggle snapshot vs full release build changes


author: Paul Wouters <pwouters@redhat.com> - 2.1.0-1
changelog:
  - Resolves: rhbz#1244461 Updated to 2.1.0
  - Resolves: rhbz#1272423 Softhsm PKCS#11 module not visible to NSS becasue it is not in the search path
  - Resolves: rhbz#1177086 A marked as trusted certificate cannot be written in a softhsmv2 db
  - Resolves: rhbz#1272453 - A marked as CA certificate cannot be written in a softhsmv2 db
  - Removed merged in bug#162 patch
  - Temporarily disable make check because cppunit is broken


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.2.0-2
changelog:
  - Increased the level of messages that go to syslog, thus softhsm
    will no longer write on syslog when it cannot open the shared DB (#1425135)
  - Allow users in the 'ods' group to store their keys in /var/lib/softhsm/tokens/
    while at the same time disallow deleting other users' keys (using the
    sticky bit). Prevent users in the 'ods' group from writing in /var/lib/softhsm.


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.3.0-3
changelog:
  - Remove softhsm2-pk11install. Software modules are to be registered with
    p11-kit as in https://fedoraproject.org/wiki/PackagingDrafts/Pkcs11Support (#1541095).


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.6.0-1
changelog:
  - Fixes: rhbz#1818877 - rebase to softhsm 2.6.0+
  - Fixes: rhbz#1701233 - support setting supported signature methods on the token


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.6.0-3
changelog:
  - Fixes: rhbz#1834909 - softhsm use-after-free on process exit
  - Synchronize the final fix with Fedora


author: Jake Hunsaker <jhunsake@redhat.com> - 1.6-1
changelog:
  - Drop paramiko dependency, use OpenSSH ControlPersist instead
  - Layered cluster profiles can now accept base profile options
  - Debian/Ubuntu hosts now supported


author: Jake Hunsaker <jhunsake@redhat.com> - 1.7-1
changelog:
  - New upstream release
  - Overhaul mechanism of execution of sosreport in containers
  - Added RHCOS support
  - Added a 'none' cluster type


author: Jake Hunsaker <jhunsake@redhat.com> - 1.7-2
changelog:
  - Fix 'none' cluster type enablement
  - Update RHCOS image to RHEL 8 version
  - Fix execution from within a container


author: Sérgio Basto <sergio@serjux.com> - 1.9.2-1
changelog:
  - Update to 1.9.2 (#961876).
  - Modernize spec file.
  - Makefile.am handles mmx and sse flags well, so no need patch 01 and sed anymore.
  - Patch 02 disabled, I hope we already have asm fixed on X86_64.


author: Sérgio Basto <sergio@serjux.com> - 1.9.2-2
changelog:
  - Add license tag.
  - Add back sed on -O3 .
  - Not modify soundtouch_config.h because looks correct, just have one line !.


author: Per Øyvind Karlsen <peroyvind@linux-mandrake.com> 1.8-1mdk
changelog:
  - 1.8
  - drop Prefix tag
  - clean out redundant buildrequires
  - rm -rf $RPM_BUILD_ROOT at the beginning of %install, not %prep
  - use %makeinstall_std macro
  - cosmetics


author: Adrian Reber <adrian@lisas.de> - 2.3-2
changelog:
  - using a new url.lang to fix #195720
    (https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=131352)


author: Leigh Scott <leigh123linux@googlemail.com> - 3.1.3-1
changelog:
  - updated to 3.1.3
  - change configure command so it finds boost_regex
  - fix source url's
  - add devel package
  - fix directory ownership
  - fix rpath on binary


author: Adrian Reber <adrian@lisas.de> - 3.1.6-1
changelog:
  - updated to 3.1.6
  - removed buildroot and clean section
  - fixed "missing c++ source language detection for .cxx extension" (#728311)
  - fixed "source-highlight : Conflicts with autoconf-archive" (#797794)


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.2-10
changelog:
  - Fixed CVE-2018-11805
  - Resolves: rhbz#1787514
  - Fixed CVE-2020-1930
  - Resolves: rhbz#1820649
  - Fixed CVE-2020-1931
  - Resolves: rhbz#1820650


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.2.0-1
changelog:
  - update to 1.2.0
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - include soname in file list
  - use license macro


author: Uri Lublin <uril@redhat.com> - 8.3-1
changelog:
  - mingw-virt-viewer 9.0-1
  - spice-usbdk-win   1.0-22
  - mingw-spice-gtk   0.38-4
  - mingw-libgovirt   0.3.7-2
  - mingw-spice-protocol 0.14-2
    Related:  rhbz#1841952, rhbz#1179070, rhbz#1428402
    Related:  rhbz#1575043, rhbz#1640058, rhbz#1793019
    Related:  rhbz#1841951
    Related:  rhbz#1842532
    Related:  rhbz#1841949
    Related:  rhbz#1773899
    Related:  rhbz#1741202, rhbz#1741252


author: Uri Lublin <uril@redhat.com> - 8.4-1
changelog:
  - mingw-virt-viewer 9.0-3
  - mingw-libgovirt   0.3.7-5
  - mingw-spice-gtk   0.38-5
    Related: rhbz#844683
    Related: rhbz#1839104 rhbz#1874740 rhbz#1017261
    Related: rhbz#1918459


author: Uri Lublin <uril@redhat.com> - 8.5-5
changelog:
  - mingw-virt-viewer 9.0-6
    Resolves: rhbz#1997058
    Resolves: rhbz#1918877
    Related:  rhbz#1939111
    Related:  rhbz#1942919


author: Victor Toso <victortoso@redhat.com> - 0.38-2
changelog:
  - Brings some post releases fixes and disables celt051 that is
    deprecated in spice-protocol 0.14.2
  - Possibly related to rhbz#1688737 rhbz#1746239
    Related: rhbz#1817471
  - Fix mouse pointer on relative mouse mode
    Resolves: rhbz#1674311
  - Handle detailed errors from guest agent
    Related:  rhbz#1520393


author: Uri Lublin <uril@redhat.com> - 0.38-4
changelog:
  - Fix some static analyzer issues
    Resolves: rhbz#1839104
  - Fix spice-usbredir-redirect-on-connect
    Resolves: rhbz#1874740


author: Julien Ropé <jrope@redhat.com> - 0.20.0-3
changelog:
  - Fix mouse problems in multi-monitor environments under Wayland
    Resolves: rhbz#1790904 rhbz#1824610


author: Uri Lublin <uril@redhat.com> - 0.10.0-4
changelog:
  - Reset properly state of pending large messages upon disconnection
    Resolves rhbz#1548419
  - Return detailed message for file transfer
    Resolves rhbz#1520393


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-2
changelog:
  - Resolves: #2006121 - SQUID shortens FTP Link wrong that contains a semi-colon
    and as a result is not able to download zip file.CODE 404 TO CLIENT)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-3
changelog:
  - Resolves: #1941506 - CVE-2021-28116 squid:4/squid: out-of-bounds read in WCCP
    protocol data may lead to information disclosure


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-5
changelog:
  - Resolves: #2130260 - CVE-2022-41318 squid:4/squid: buffer-over-read in SSPI and SMB
    authentication


author: Tomas Korbar <tkorbar@redhat.com> - 4.15-6
changelog:
  - Resolves: #2072988 - [RFE] Add the "IP_BIND_ADDRESS_NO_PORT"
    flag to sockets created for outgoing connections in the squid source code.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-8
changelog:
  - Resolves: RHEL-18351 - squid:4/squid: Buffer over-read in the HTTP Message
    processing feature (CVE-2023-49285)
  - Resolves: RHEL-18342 - squid:4/squid: Incorrect Check of Function Return
    Value In Helper Process management (CVE-2023-49286)
  - Resolves: RHEL-18230 - squid:4/squid: Denial of Service in SSL Certificate
    validation (CVE-2023-46724)
  - Resolves: RHEL-15911 - squid:4/squid: NULL pointer dereference in the gopher
    protocol code (CVE-2023-46728)
  - Resolves: RHEL-18251 - squid crashes in assertion when a parent peer exists
  - Resolves: RHEL-14794 - squid: squid multiple issues in HTTP response caching
    (CVE-2023-5824)
  - Resolves: RHEL-14803 - squid: squid: Denial of Service in HTTP Digest
    Authentication (CVE-2023-46847)
  - Resolves: RHEL-14777 - squid: squid: Request/Response smuggling in HTTP/1.1
    and ICAP (CVE-2023-46846)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-9
changelog:
  - Resolves: RHEL-19552 - squid:4/squid: denial of service in HTTP request 
    parsing (CVE-2023-50269)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10
changelog:
  - Resolves: RHEL-28529 - squid:4/squid: Denial of Service in HTTP Chunked
    Decoding (CVE-2024-25111)
  - Resolves: RHEL-26088 - squid:4/squid: denial of service in HTTP header
    parser (CVE-2024-25617)


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - first build against glibc
  - patched out the use of setresuid(), which is available only on kernels
    2.1.44 and later


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated the init script to use reconfigure option to restart squid instead
    of shutdown/restart (both safer and quicker)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - cache & log dirs shouldn't be world readable
  - remove preun script (leave logs & cache @ uninstall)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - switch to using group squid
  - turn off icmp (insecure)
  - update to 2.2.DEVEL3
  - build FAQ docs from source


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Fix compliance with ftp RFCs
    (http://www.wu-ftpd.org/broken-clients.html)
  - Work around a bug in some versions of autoconf
  - BuildPrereq sgml-tools - we're using sgml2html


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix init script again (#11699)
  - add --enable-delay-pools (#11695)
  - update to STABLE3
  - update FAQ


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix path references in QUICKSTART (#15114)
  - fix initscript translations (#24086)
  - fix shutdown logic (#24234), patch from <jos@xos.nl>
  - add /etc/sysconfig/squid for daemon options & shutdown timeouts
  - three more bugfixes from the Squid people
  - update FAQ.sgml
  - build and ship auth modules (#23611)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.4.STABLE1 + patches
  - enable some more configure options (#24981)
  - oops, ship /etc/sysconfig/squid


author: Bill Nottingham <notting@redhat.com>
changelog:
  - 2.4.STABLE3 + patches
  - turn off HTCP at request of maintainers
  - leave SNMP enabled in the build, but disabled in the default config


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE3-0
changelog:
  - Spec file change to enable the nul storage module. bugzilla #74654
  - Upgrade to 2.5STABLE3 with current official patches.
  - Added --enable-auth="basic,ntlm": closes bugzilla #90145
  - Added --with-winbind-auth-challenge: closes bugzilla #78691
  - Added --enable-useragent-log and --enable-referer-log, closes
  - bugzilla #91884


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE4-1
changelog:
  - New upstream version.
  - Fix the Source: line in this spec file to point to the correct URL.
  - redo the -location patch to work with the new upstream version.


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Incorporate many upstream patches
  - Include many spec file changes from D.Johnson <dj@www.uk.linux.org>


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE4-3
changelog:
  - Clean up the spec file to work on 64-bit platforms (use %{_libdir}
    instead of /usr/lib, etc)
  - Make the release number in the changelog section agree with reality.
  - use -fPIE rather than -fpie.  s390 fails with just -fpie


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE5-1
changelog:
  - New upstream version, obsoletes many patches.
  - Fix --datadir passed to configure.  Configure automatically adds /squid
    so we shouldn't.
  - Remove the problematic triggerpostun trigger, since is's broken, and FC2
    never shipped with that old version.
  - add %{?_smp_mflags} to make line.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE5-2
changelog:
  - Include the first 10 upstream patches
  - Add a patch for the correct location of the winbindd pipe.  This closes
    bugzilla #107561
  - Remove the change to ssl_support.c from squid-2.5.STABLE3-build patch
    This closes #117851
  - Include /etc/pam.d/squid .  This closes #113404
  - Include a patch to close #111254 (assignment in assert)
  - Change squid.init to put output messages in /var/log/squid/squid.out
    This closes #104697
  - Only useradd the squid user if it doesn't already exist, and error out
    if the useradd fails.  This closes #118718.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5STABLE5-5
changelog:
  - Merge current upstream patches.
  - Fix the -pipe patch to have the correct name of the winbind pipe.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE6-1
changelog:
  - New upstream version, with 32 upstream patches.
    This closes #133970, #133931, #131728, #128143, #126726

  - Change the permissions on /etc/squid/squid.conf to 640.  This closes
    bugzilla #125007


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE6-3
changelog:
  - include patch from Ulrich Drepper <drepper@redhat.com> to stop
    problems with O_NONBLOCK.  This closes #136049


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-1
changelog:
  - new upstream version, with 3 upstream patches.
    Updated the -build and -config patches
  - Include patch from Ulrich Drepper <frepper@redhat.com> to more
    intelligently close all file descriptors.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-2
changelog:
  - Add a triggerin on samba-common to make /var/cache/samba/winbindd_privileged
    accessable so that ntlm_auth will work.  It needs to be in this rpm,
    because the Samba RPM can't assume the squid user exists.
    Note that this will only work if the Samba RPM is recent enough to create
    that directory at install time instead of at winbindd startup time.
    That should be samba-common-3.0.0-15 or later.
    This fixes bugzilla #103726
  - Clean up extra whitespace in this spec file.
  - Add additional upstream patches. (Now 18 upstream patches).
  - patch #112 closes CAN-2005-0096 and CAN-2005-0097, remote DOS security holes.
  - patch #113 closes CAN-2005-0094, a remote buffer-overflow DOS security hole.
  - patch #114 closes CAN-2005-0095, a remote DOS security hole.
  - Remove the -nonbl (replaced by #104) and -close (replaced by #111) patches, since
    they're now fixed by upstream patches.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-4
changelog:
  - Include two more upstream patches for security vulns:
    bz#146783 Correct handling of oversized reply headers
    bz#146778 CAN-2005-0211 Buffer overflow in WCCP recvfrom() call


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE8-2
changelog:
  - new upstream version with 4 upstream patches.
  - Reorganize spec file to apply upstream patches first


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE9-4
changelog:
  - More upstream patches, including the fixed 2GB patch.
  - include the -libbind patch, which prevents squid from using the optional
    -lbind library, even if it's installed.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE9-6
changelog:
  - More upstream patches, including a fix for
    bz#157456 CAN-2005-1519 DNS lookups unreliable on untrusted networks


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE10-1
changelog:
  - new upstream version
  - enabled fakeauth utility (#154020)
  - enabled digest authentication scheme (#155882)
  - all error pages marked as config (#127836)
  - patch for 64bit statvfs interface (#153274)
  - added httpd config file for cachemgr.cgi (#112725)


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE10-3
changelog:
  - removed "--enable-truncate" option (#165948)
  - added "--enable-cache-digests" option (#102134)
  - added "--enable-ident-lookups" option (#161640)
  - some clean up (#165949)


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE11-5
changelog:
  - fix for #171213 - CVE-2005-3258 Squid crash due to malformed FTP response
  - more fixes from upstream


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE12-2
changelog:
  - rewriten patch squid-2.5.STABLE10-64bit.patch, it works with
    "--with-large-files" option now
  - fix for #72896 - squid does not support > 1024 file descriptors,
    new "--enable-fd-config" option for it.


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE1-1
changelog:
  - new upstream + the latest CVS snapshot from 2006/07/18
  - updated fd config patch
  - enabled epoll
  - fixed release format (#197405)
  - enabled WCCPv2 support (#198642)


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE4-2
changelog:
  - upstream fixes:
    * Accept 00:00-24:00 as a valid time specification (upstream BZ #1794)
    * aioDone() could be called twice
    * Squid reconfiguration (upstream BZ #1800)


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE4-3
changelog:
  - added fix for #183869 - squid can abort when getting status
  - added upstream fixes:
      * Bug #1796: Assertion error HttpHeader.c:914: "str"
      * Bug #1779: Delay pools fairness, correction to first patch
      * Bug #1802: Crash on exit in certain conditions where cache.log is not writeable
      * Bug #1779: Delay pools fairness when multiple connections compete for bandwidth
      * Clarify the select/poll/kqueue/epoll configure --enable/disable options
  - reworked fd patch for STABLE4


author: Martin Bacovsky <mbacovsk@redhat.com> - 7:2.6.STABLE16-2
changelog:
  - our fd_config patch was replaced by upstream's version 
  - Source1 (FAQ.sgml) points to local source (upstream's moved to wiki)


author: Martin Nagy <mnagy@redhat.com> - 7:3.0.STABLE2-1
changelog:
  - upgrade to latest upstream 3.0.STABLE2
  - check config file before starting (#428998)
  - whitespace unification of init script
  - some minor path changes in the QUICKSTART file
  - configure with the --with-filedescriptors=16384 option


author: Martin Nagy <mnagy@redhat.com> - 7:3.0.STABLE5-2
changelog:
  - fix configure detection of netfilter kernel headers (#435499),
    patch by aoliva@redhat.com
  - add support for negotiate authentication (#445337)


author: Jiri Skala <jskala@redhat.com> - 7:3.0.STABLE7-2
changelog:
  - used ncsa_auth.8 from man-pages. there will be this file removed due to conflict
  - fix #458593 noisy initscript
  - fix #463129 init script tests wrong conf file
  - fix #450352 - build.patch patches only generated files


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.0.STABLE13-2
changelog:
  - backported logfile.cc syslog parameters patch from 3.1 (b9443.patch)
  - GCC-4.4 workaround in src/wccp2.cc


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.0.STABLE17-2
changelog:
  - Bug #514014, update to 3.0.STABLE17 fixing the denial of service issues
    mentioned in Squid security advisory SQUID-2009_2.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.13-1
changelog:
  - Upgrade to next upstream release 3.1.0.13 with many new features
    * IPv6 support
    * NTLM-passthru
    * Kerberos/Negotiate authentication scheme support
    * Localized error pages based on browser language preferences
    * Follow X-Forwarded-For capability
    * and more..


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.13-7
changelog:
  - Include upstream patches fixing important operational issues
  - Enable ESI support now that it does not conflict with normal operation


author: Jiri Skala <jskala@redhat.com> 7:3.1.0.14-2
changelog:
  - fixed #532930 Syntactic error in /etc/init.d/squid
  - fixed #528453 cannot initialize cache_dir with user specified config file


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.15-3
changelog:
  - fixed #551302 PROXY needs libcap. Also increases security a little.
  - merged relevant upstream bugfixes waiting for next 3.1 release


author: Jiri Skala <jskala@redhat.com> - 7:3.1.0.16-4
changelog:
  - spec file modified to be fedora packaging guidline compliant
  - little shifting lines in init script header due to rpmlint complaint
  - fixes assertion during start up


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.16-6
changelog:
  - Patch for Squid security advisory SQUID-2010:2, denial of service
    issue in HTCP processing (CVE-2010-0639)


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.1-2
changelog:
  - Update to 3.1.1 Squid bug #2827 crash with assertion failed:
    FilledChecklist.cc:90: "conn() != NULL" under high load.


author: Jiri Skala <jskala@redhat.com>
changelog:
  - fixes #548903 - "comm_open: socket failure: (97) Address family not supported by protocol" if IPv6 disabled


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.3-2
changelog:
  - Fully fix #548903 - "comm_open: socket failure: (97) Address family not supported by protocol" if IPv6 disabled
  - Various IPv6 related issues fixed, making tcp_outgoing_address behave
    as expected and no commResetFD warnings when using tproxy setups.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.4-1
changelog:
  - Upstream 3.1.4 bugfix release, issues relating to IPv6, TPROXY, Memory
    management, follow_x_forwarded_for, and stability fixes


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.5-2
changelog:
  - Upstream 3.1.5 bugfix release
  - Upstream patch for Bug #614665: Squid crashes with  ident auth
  - Upstream patches for various memory leaks


author: Jiri Skala <jskala@redhat.com> - 7:3.2.0.9-1
changelog:
  - upgrade to squid-3.2
  - fixes #720445 - Provide native systemd unit file
  - SysV initscript moved to subpackage
  - temproary disabled eCap


author: Jiri Skala <jskala@redhat.com> - 7:3.2.0.13-2
changelog:
  - fixes #747103 - squid does not start if /var/spool/squid is empty
  - fixes #747110 - squid does not start adding "memory_pools off"


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.2.0.14-6
changelog:
  - upstream gcc-4.7 patch
  - fix for bug #772483 running out of memory, mem_node growing out of bounds


author: Michal Luscon <mluscon@redhat.com> - 7:3.2.3-2
changelog:
  - Resolved: #854356 - squid.service use PIDFile
  - Resolved: #859393 - Improve cache_swap script
  - Resolved: #791129 - disk space warning
  - Resolved: #862252 - reload on VPN or network up/down
  - Resolved: #867531 - run test suite during build
  - Resolved: #832684 - missing after dependency nss-lookup.target
  - Removed obsolete configure options


author: Michal Luscon <mluscon@redhat.com> - 7:3.2.9-1
changelog:
  - Update to latest upstream version 3.2.9
  - Fixed: CVE-2013-1839
  - Removed: makefile-patch (+make check)


author: Ville Skyttä <ville.skytta@iki.fi> - 7:3.3.4-2
changelog:
  - Fix basic auth and log daemon DB helper builds.
  - Use xz compressed tarball, fix source URLs.
  - Fix bogus dates in %changelog.


author: Michal Luscon <mluscon@redhat.com> - 7:3.3.9-1
changelog:
  - Update to latest upstream version 3.3.9
  - Fixed #976815: file descriptors are hard coded to 16384
  - Fixed: active ftp crashing
  - Fixed: offset of patches


author: Michal Luscon <mluscon@redhat.com> - 7:3.4.1-1
changelog:
  - Rebase to latest stable upstream release 3.4.1
  - Fixed #1034306: fails to build for AArch64
  - Fixed: active ftp


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.4.12-1
changelog:
  - Update to latest upstream version 3.4.12
  - bug #1173946: Disable -march=native compile time optimization, use Fedora defaults.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.5.2-2
changelog:
  - Update to latest upstream version 3.5.2
  - Remove deprecated (and renamed) squid_msnt_auth basic auth helper. Only
    performs LM authentication and not considered useful in todays networks.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.13-3
changelog:
  - Resolves: #1308866 - CVE-2016-2390 squid: incorrect server error 
    handling resulting in denial of service


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.15-1
changelog:
  - new version 3.5.15
  - Resolves: #1311585 - squid: Multiple Denial of Service issues in
    HTTP Response processing
  - Resolves: #1312267 - squid: SQUID-2016_2 advisory, multiple DoS issues


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.0.23-5
changelog:
  - Resolves: #1585617 - Build against libdb only instead of libdb4
  - disabled strict checking for now (squid can not be built with GCC8)


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-1
changelog:
  - Resolves: #1656871 - squid rebase to 4.4
  - Resolves: #1645148 - CVE-2018-19131 squid: Cross-Site Scripting when
    generating HTTPS response messages about TLS errors
  - Resolves: #1645156 - CVE-2018-19132 squid: Memory leak in SNMP query
    rejection code


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-6
changelog:
  - Resolves: #1679526 - Missing detailed configuration file
  - Resolves: #1703117 - RHEL 7 to 8 fails with squid installed because dirs
    changed to symlinks
  - Resolves: #1691741 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1683527 - "Reloading" message on a fresh reboot after enabling
    squid


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-8
changelog:
  - Resolves: # 1738485 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow
    in HttpHeader::getAuth


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-9
changelog:
  - Resolves: #1738583 - CVE-2019-12525 squid:4/squid: parsing of header
    Proxy-Authentication leads to memory corruption
  - Resolves: #1828369 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828370 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-1
changelog:
  - new version 4.11
  - libsystemd integration
  - Resolves: #1829467 - squid:4 rebase
  - Resolves: #1828378 - CVE-2019-12521 squid:4/squid: off-by-one error in
    addStackElement allows for a heap buffer overflow and a crash
  - Resolves: #1828377 - CVE-2019-12520 squid:4/squid: improper input validation
    in request allows for proxy manipulation
  - Resolves: #1828375 - CVE-2019-12524 squid:4/squid: improper access restriction
    in url_regex may lead to security bypass
  - Resolves: #1820664 - CVE-2019-18860 squid: mishandles HTML in the host
    parameter to cachemgr.cgi which could result in squid behaving in unsecure way
  - Resolves: #1802514 - CVE-2020-8449 squid:4/squid: Improper input validation
    issues in HTTP Request processing
  - Resolves: #1802513 - CVE-2020-8450 squid:4/squid: Buffer overflow in a Squid
    acting as reverse-proxy
  - Resolves: #1802512 - CVE-2019-12528 squid:4/squid: Information Disclosure
    issue in FTP Gateway
  - Resolves: #1771288 - CVE-2019-18678 squid:4/squid: HTTP Request Splitting
    issue in HTTP message processing
  - Resolves: #1771283 - CVE-2019-18679 squid:4/squid: Information Disclosure
    issue in HTTP Digest Authentication
  - Resolves: #1771280 - CVE-2019-18677 squid:4/squid: Cross-Site Request Forgery
    issue in HTTP Request processing
  - Resolves: #1771275 - CVE-2019-12523 squid:4/squid: Improper input validation
    in URI processor
  - Resolves: #1771272 - CVE-2019-18676 squid:4/squid: Buffer overflow in URI
    processor
  - Resolves: #1771264 - CVE-2019-12526 squid:4/squid: Heap overflow issue in URN
    processing
  - Resolves: #1738581 - CVE-2019-12529 squid: OOB read in Proxy-Authorization
    header causes DoS


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-2
changelog:
  - Resolves: #1853130 - CVE-2020-15049 squid:4/squid: request smuggling and
    poisoning attack against the HTTP cache
  - Resolves: #1853136 - CVE-2020-14058 squid:4/squid: DoS in TLS handshake


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-3
changelog:
  - Resolves: #1871705 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1871702 - CVE-2020-15811 squid: HTTP Request Splitting could result
    in cache poisoning
  - Resolves: #1871700 - CVE-2020-15810 squid: HTTP Request Smuggling could result
    in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-5
changelog:
  - Resolves: #1944261 - CVE-2020-25097 squid:4/squid: improper input validation
    may allow a trusted client to perform HTTP Request Smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.1
changelog:
  - Resolves: RHEL-56024 - (Regression) Transfer-encoding:chunked data is not sent
    to the client in its complementary


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.2
changelog:
  - Disable ESI support
  - Resolves: RHEL-65075 - CVE-2024-45802 squid:4/squid: Denial of Service
    processing ESI response content


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.3
changelog:
  - Resolves: RHEL-22593 - CVE-2024-23638 squid:4/squid: vulnerable to
    a Denial of Service attack against Cache Manager error responses


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.6
changelog:
  - Resolves: RHEL-84420 - A squid child process causes a memory reference error
    and the squid service terminates abnormally


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
  - Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
  - Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
  - Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
  - Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
  - Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
  - Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
  - Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
  - Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
  - Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
  - Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
  - Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
  - Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
  - Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
  - Resolves: RHEL-10721 - very bad performance when requesting service tickets
  - Resolves: RHEL-19011 - Invalid handling groups from child domain
  - Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
  - Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
  - Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New stable upstream version 1.2.1
  - Resolves: rhbz#595529 - spec file should eschew %define in favor of
  -                         %global
  - Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart.
  - Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
  -                         keyring
  - Resolves: rhbz#599724 - sssd is broken on Rawhide


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.91-20
changelog:
  - New upstream version 1.2.91 (1.3.0rc1)
  - Improved LDAP failover
  - Synchronous sysdb API (provides performance enhancements)
  - Better online reconnection detection


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-30
changelog:
  - Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
  -                           against LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-32
changelog:
  - Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
  -                         doesn't require it


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-1
changelog:
  - New upstream release 1.4.0
  - Added support for netgroups to the LDAP provider
  - Performance improvements made to group processing of RFC2307 LDAP servers
  - Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
  - Build-system improvements to support Gentoo
  - Split out several libraries into the ding-libs tarball
  - Manpage reviewed and updated


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-1
changelog:
  - New upstream release 1.4.1
  - Add support for netgroups to the proxy provider
  - Fixes a minor bug with UIDs/GIDs >= 2^31
  - Fixes a segfault in the kerberos provider
  - Fixes a segfault in the NSS responder if a data provider crashes
  - Correctly use sdap_netgroup_search_base


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-3
changelog:
  - Solve a shutdown race-condition that sometimes left processes running
  - Resolves: rhbz#606887 - SSSD stops on upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  -Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Fix nested group member filter sanitization for RFC2307bis
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#677768 - name service caches names, so id command shows
  -                         recently deleted users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.2-1
changelog:
  - New upstream release 1.5.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
  - Fixes for support of FreeIPA v2
  - Fixes for failover if DNS entries change
  - Improved sss_obfuscate tool with better interactive mode
  - Fix several crash bugs
  - Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
  - Delete users from the local cache if initgroups calls return 'no such user'
  - (previously only worked for getpwnam/getpwuid)
  - Use new Transifex.net translations
  - Better support for automatic TGT renewal (now survives restart)
  - Netgroup fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.4-1
changelog:
  - New upstream release 1.5.4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
  - Fixes for Active Directory when not all users and groups have POSIX attributes
  - Fixes for handling users and groups that have name aliases (aliases are ignored)
  - Fix group memberships after initgroups in the IPA provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-1
changelog:
  - New upstream release 1.5.5
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
  - Fixes for several crash bugs
  - LDAP group lookups will no longer abort if there is a zero-length member
  - attribute
  - Add automatic fallback to 'cn' if the 'gecos' attribute does not exist


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-3
changelog:
  - Fix systemd conversion. Upgrades from SysV to systemd weren't properly
  - enabling the systemd service.
  - Fix a serious memory leak in the memberOf plugin
  - Fix an issue where the user's full name would sometimes be removed
  - from the cache


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
changelog:
  - Resolves: rhbz#697057 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server
  - Upgrades from SysV should now maintain enabled/disabled status


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.6-1
changelog:
  - New upstream release 1.5.6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
  - Fixed a serious memory leak in the memberOf plugin
  - Fixed a regression with the negative cache that caused it to be essentially
  - nonfunctional
  - Fixed an issue where the user's full name would sometimes be removed from
  - the cache
  - Fixed an issue with password changes in the kerberos provider not working
  - with kpasswd


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-1
changelog:
  - Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
  -                         cached password with predicatable filename


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-3
changelog:
  - Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
  - Make sure to properly convert to systemd if upgrading from newer
  - updates for Fedora 14


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.8-1
changelog:
  - New upstream release 1.5.8
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
  - Support for the LDAP paging control
  - Support for multiple DNS servers for name resolution
  - Fixes for several group membership bugs
  - Fixes for rare crash bugs


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.9-1
changelog:
  - New upstream release 1.5.9
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
  - Support for overriding home directory, shell and primary GID locally
  - Properly honor TTL values from SRV record lookups
  - Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
  - servers)
  - Properly escape IPv6 addresses in the failover code
  - Do not crash if inotify fails (e.g. resource exhaustion)
  - Don't add multiple TGT renewal callbacks (too many log messages)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.10-1
changelog:
  - New upstream release 1.5.10
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
  - Fixed a regression introduced in 1.5.9 that could result in blocking calls
  - to LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.11-2
changelog:
  - New upstream release 1.5.11
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
  - Fix a serious regression that prevented SSSD from working with ldaps:// URIs
  - IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
  - address being saved to the AAAA record


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
changelog:
  - New upstream release 1.6.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
  - Add host access control support for LDAP (similar to pam_host_attr)
  - Finer-grained control on principals used with Kerberos (such as for FAST or
  - validation)
  - Added a new tool sss_cache to allow selective expiring of cached entries
  - Added support for LDAP DEREF and ASQ controls
  - Added access control features for Novell Directory Server
  - FreeIPA dynamic DNS update now checks first to see if an update is needed
  - Complete rewrite of the HBAC library
  - New libraries: libipa_hbac and libipa_hbac-python


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.1-1
changelog:
  - New upstream release 1.6.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
  - Fixes a serious issue with LDAP connections when the communication is
    dropped (e.g. VPN disconnection, waking from sleep)
  - SSSD is now less strict when dealing with users/groups with multiple names
    when a definitive primary name cannot be determined
  - The LDAP provider will no longer attempt to canonicalize by default when
    using SASL. An option to re-enable this has been provided.
  - Fixes for non-standard LDAP attribute names (e.g. those used by Active
    Directory)
  - Three HBAC regressions have been fixed.
  - Fix for an infinite loop in the deref code


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-1
changelog:
  - Improved handling of users and groups with multi-valued name attributes
    (aliases)
  - Performance enhancements
      Initgroups on RFC2307bis/FreeIPA
      HBAC rule processing
  - Improved process-hang detection and restarting
  - Enabled the midpoint cache refresh by default (fewer cache misses on
    commonly-used entries)
  - Cleaned up the example configuration
  - New tool to change debug level on the fly


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-4
changelog:
  - Change selinux policy requirement to Conflicts: with the old version,
    rather than Requires: the supported version.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release 1.6.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
  - Fixes a major cache performance issue introduced in 1.6.2
  - Fixes a potential infinite-loop with certain LDAP layouts


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-4
changelog:
  - Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758425 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.4-1
changelog:
  - New upstream release 1.6.4
  - Rolls up previous patches applied to the 1.6.3 tarball
  - Fixes a rare issue causing crashes in the failover logic
  - Fixes an issue where SSSD would return the wrong PAM error code for users
    that it does not recognize.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-1
changelog:
  - New upstream release 1.7.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
  - Support for case-insensitive domains
  - Support for multiple search bases in the LDAP provider
  - Support for the native FreeIPA netgroup implementation
  - Reliability improvements to the process monitor
  - New DEBUG facility with more consistent log levels
  - New tool to change debug log levels without restarting SSSD
  - SSSD will now disconnect from LDAP server when idle
  - FreeIPA HBAC rules can choose to ignore srchost options for significant
    performance gains
  - Assorted performance improvements in the LDAP provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-3
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-5
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features - fix netgroups and sudo as well


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta1
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta2
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
  - Fix two minor manpage bugs
  - Include the IPA AutoFS provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - New upstream release 1.8.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed several memory-corruption bugs
  - Finalized the ABI for the autofs support
  - Fixed a regression in the proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - New upstream release 1.8.0
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)
  - Include the IPA AutoFS provider
  - Fixed several memory-corruption bugs
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed a regression in the proxy provider
  - Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
  - Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
                            logged at each login
  - Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-7
changelog:
  - New upstream release 1.8.1
  - Resolve issue where we could enter an infinite loop trying to connect to an
    auth server
  - Fix serious issue with complex (3+ levels) nested groups
  - Fix netgroup support for case-insensitivity and aliases
  - Fix serious issue with lookup bundling resulting in requests never
    completing
  - IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
    in addition to pam_authenticate
  - Fix several regressions in the proxy provider
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-8
changelog:
  - Fix uninitialized value bug causing crashes throughout the code
  - Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-9
changelog:
  - Don't duplicate libsss_autofs.so in two packages
  - Set explicit package contents instead of globbing


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.2-10
changelog:
  - New upstream release 1.8.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
  - Several fixes to case-insensitive domain functions
  - Fix for GSSAPI binds when the keytab contains unrelated principals
  - Fixed several segfaults
  - Workarounds added for LDAP servers with unreadable RootDSE
  - SSH knownhostproxy will no longer enter an infinite loop preventing login
  - The provided SYSV init script now starts SSSD earlier at startup and stops
    it later during shutdown
  - Assorted minor fixes for issues discovered by static analysis tools


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.3-11
changelog:
  - New upstream release 1.8.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
  - Numerous manpage and translation updates
  - LDAP: Handle situations where the RootDSE isn't available anonymously
  - LDAP: Fix regression for users using non-standard LDAP attributes for user
    information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-1.beta1
changelog:
  - New upstream release 1.9.0 beta 1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
  - Add native support for autofs to the IPA provider
  - Support for ID-mapping when connecting to Active Directory
  - Support for handling very large (> 1500 users) groups in Active Directory
  - Support for sub-domains (will be used for dealing with trust relationships)
  - Add a new fast in-memory cache to speed up lookups of cached data on
    repeated requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-2.beta1
changelog:
  - Fix several regressions since 1.5.x
  - Ensure that the RPM creates the /var/lib/sss/mc directory
  - Add support for Netscape password warning expiration control
  - Rebuild against libldb 1.1.6


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-5.beta2
changelog:
  - New upstream release 1.9.0 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
  - Add support for the Kerberos DIR cache for storing multiple TGTs
    automatically
  - Major performance enhancement when storing large groups in the cache
  - Major performance enhancement when performing initgroups() against Active
    Directory
  - SSSDConfig data file default locations can now be set during configure for
    easier packaging


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-7.beta2
changelog:
  - Switch unicode library from libunistring to Glib
  - Drop unnecessary explicit Requires on keyutils
  - Guarantee that versioned Requires include the correct architecture


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-8.beta3
changelog:
  - New upstream release 1.9.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
  - Add a new PAC responder for dealing with cross-realm Kerberos trusts
  - Terminate idle connections to the NSS and PAM responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-9.beta4
changelog:
  - New upstream release 1.9.0 beta 4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
  - Add a new AD provider to improve integration with Active Directory 2008 R2
    or later servers
  - SUDO integration was completely rewritten. The new implementation works
    with multiple domains and uses an improved refresh mechanism to download
    only the necessary rules
  - The IPA authentication provider now supports subdomains
  - Fixed regression for setups that were setting default_tkt_enctypes
    manually by reverting a previous workaround.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-12.beta5
changelog:
  - New upstream release 1.9.0 beta 5
  - Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
  - Many fixes for the support for setting default SELinux user context from
    FreeIPA, most notably fixed the specificity evaluation
  - Fixed an incorrect default in the krb5_canonicalize option of the AD
    provider which was preventing password change operation
  - The shadowLastChange attribute value is now correctly updated with the
    number of days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-13.beta6
changelog:
  - New upstream release 1.9.0 beta 6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
  - A new option, override_shell was added. If this option is set, all users
    managed by SSSD will have their shell set to its value.
  - Fixes for the support for setting default SELinux user context from FreeIPA.
  - Fixed a regression introduced in beta 5 that broke LDAP SASL binds
  - The SSSD supports the concept of a Primary Server and a Back Up Server in
    failover
  - A new command-line tool sss_seed is available to help prime the cache with
    a user record when deploying a new machine
  - SSSD is now able to discover and save the domain-realm mappings
    between an IPA server and a trusted Active Directory server.
  - Packaging changes to fix ldconfig usage in subpackages (#843995)
  - Rebuild against libldb 1.1.9


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-14.beta6
changelog:
  - Don't discard HBAC rule processing result if SELinux is on
    Resolves: rhbz#846792 (CVE-2012-3462)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-18.beta6
changelog:
  - Change the default ccache location to DIR:/run/user/${UID}/krb5cc
    and patch man page accordingly
  - Resolves: rhbz#851304


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.4-3
changelog:
  - Recreate Kerberos ccache directory if it's missing
  - Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
                            directory /run/user/UID/ccdir does not exist


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-4.beta1
changelog:
  - Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
    in ding-libs
  - Fix SSH integration with fully-qualified domains
  - Add the ability to dynamically discover the NetBIOS name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-6.beta1
changelog:
  - Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
                            realm join
  - Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
                            default for AD Provider
  - Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
                            parent directory when logging in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-7.beta1
changelog:
  - Apply a couple of patches from upstream git that resolve crashes when
    ID mapping object was not initialized properly but needed later


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-8.beta2
changelog:
  - New upstream release 1.10 beta2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
  - BuildRequire libcmocka-devel in order to run all upstream tests during build
  - BuildRequire libnl3 instead of libnl1
  - No longer BuildRequire initscripts, we no longer use /sbin/service
  - Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
    older krb5-libs version


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-9.beta2
changelog:
  - Fix typo in Requires that prevented an upgrade (#973916)
  - Use a hardcoded version in Conflicts, not less-than-current


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-11.beta2
changelog:
  - Apply a number of patches from upstream to fix issues found post-beta,
    in particular:
    -- segfault with a high DEBUG level
    -- Fix IPA password migration (upstream #1873)
    -- Fix fail over when retrying SRV resolution (upstream #1886)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-14
changelog:
  - Fix Obsoletes: to account for dist tag
  - Convert post and pre scripts to run on the sssd-common subpackage
  - Remove old conversion from SYSV


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-16
changelog:
  - Move sssd_pac to the sssd-ipa and sssd-ad subpackages
  - Trim out RHEL5-specific macros since we don't build on RHEL 5
  - Trim out macros for Fedora older than F18
  - Update libldb requirement to 1.1.16
  - Trim RPM changelog down to the last year


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0.2beta2
changelog:
  - Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
                        pam libraries


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-0.4.beta2
changelog:
  - Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
                        Process /usr/libexec/sssd/sssd_nss was killed by
                        signal 11 (SIGSEGV)
  - Resolves: #996214 - sssd proxy_child segfault


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-2
changelog:
  - Backport simplification of ccache management from 1.11.1
  - Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-3
changelog:
  - Fix multicast checks in the SSSD
  - Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
                             code getting the host info


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-1
changelog:
  - New upstream release 1.11.2
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.3-1
changelog:
  - New upstream release 1.11.3
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.4-1
changelog:
  - New upstream release 1.11.4
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.5-1
changelog:
  - New upstream release 1.11.5
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.1-2
changelog:
  - Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
                             private group from server


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.2-6
changelog:
  - Fix regressions and bugs in sssd upstream 1.12.2
  - https://fedorahosted.org/sssd/ticket/{id}
  - Regressions: #2471, #2475, #2483, #2487, #2529, #2535
  - Bugs: #2287, #2445


author: Sumit Bose <sbose@redhat.com> - 1.12.2-7
changelog:
  - Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
                             crash in wbinfo
                             - in addition to the patch libwbclient.so is
                               filtered out of the Provides list of the package


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-1
changelog:
  - New upstream release 1.12.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
  - Fix spelling errors in description (fedpkg lint)


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-2
changelog:
  - Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
  - Resolves: rhbz#1179379 - gzip: stdin: file size changed while
                             zipping when rotating logfile


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-3
changelog:
  - Apply a number of patches from upstream to fix issues found 1.12.3
  - Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
                             interfaces, or isn't documented to be able to
  - Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
                            not running
  - Resolves: upstream #2557  authentication failure with user from AD


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-4
changelog:
  - Decrease priority of sssd-libwbclient 20 -> 5
  - It should be lower than priority of samba veriosn of libwbclient.
  - https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-6
changelog:
  - Fix double free in monitor
  - Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
                          sssd killed by SIGABRT


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-2
changelog:
  - Add support for python3 bindings
  - Add requirement to python3 or python3 bindings
  - Resolves: rhbz#1014594 - sssd: Support Python 3


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-5
changelog:
  - Fix regressions with ipa and SELinux
  - Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
                               context on client is staff_u


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-6
changelog:
  - Fix slow login with ipa and SELinux
  - Resolves: upstream #2624 - Only set the selinux context if the context
                               differs from the local one


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-8
changelog:
  - Backport important patches from upstream 1.13 prerelease
  - Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
                             attribute for group name
  - Resolves: upstream #2335 - Investigate using the krb5 responder
                               for driving the PAM conversation with OTPs
  - Enable cmocka tests for secondary architectures


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-4
changelog:
  - Fix ipa-migration bug
  - Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
                               migration mode


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-6
changelog:
  - Fix OTP bug
  - Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
                               entered separately


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-2
changelog:
  - Fix few segfaults
  - Resolves: upstream #2811 - PAM responder crashed if user was not set
  - Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-3
changelog:
  - python-sssdconfig: Fix parssing sssd.conf without config_file_version
  - Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-5
changelog:
  - Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
                             groups during getgrnam and getgrgid
  - Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
                             in call to 'print'


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-6
changelog:
  - Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
                             prompts (e.g. Password + Token)
  - Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
                             by remote host" if locale not available


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.4-3
changelog:
  - Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
                             sssd_ifp killed by SIGSEGV


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-2
changelog:
  - Backport important patches from upstream 1.14.2 prerelease
  - Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
                               boot
  - Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-3
changelog:
  - Fix regression with krb5_map_user
  - Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
  - Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
                             default if nonexistent domain is mentioned


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.2-2
changelog:
  - Resolves: rhbz#1369130 - nss_sss should not link against libpthread
  - Resolves: rhbz#1392916 - sssd failes to start after update
  - Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
                             on the directory /etc/sssd


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.0-4
changelog:
  - Cherry-pick patches from upstream that enable the files provider
  - Enable the files domain
  - Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
    which is superseded by the files domain autoconfiguration
  - Related: rhbz#1357418 - SSSD fast cache for local users


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.2
changelog:
  - Fix issue with IPA + SELinux in containers
  - Resolves: upstream https://fedorahosted.org/sssd/ticket/3297


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.3
changelog:
  - Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
  - Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
                             file from package sssd-common-1.15.1-1.fc25.x86_64
  - Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-4
changelog:
  - Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
                             access on the sock_file system_bus_socket
  - Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
                             fails to download desktop profile data
  - Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
  - Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
                              after applying ID Views for them in IPA server
  - Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
                              mapping is applied


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-5
changelog:
  - Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database access on
                             the sock_file system_bus_socket


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.16.0-5
changelog:
  - Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
                              setnetgrent_result_timeout
  - Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
                              or machine swaps
  - Resolves: failure in glibc tests
              https://sourceware.org/bugzilla/show_bug.cgi?id=22530
  - Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
                              auth_provider ldap, login fails if the LDAP server
                              is not allowing anonymous binds
  - Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
                              corrected with AD
  - Resolves: upstream#3586 - Give a more detailed debug and system-log message
                              if krb5_init_context() failed
  - Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
                             in /etc/systemd/system
  - Backport few upstream features from 1.16.1


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.0-12
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Resolves: upstream#3621 - FleetCommander integration must not require
                              capability DAC_OVERRIDE


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-2
changelog:
  - Resolves: upstream#3573 - sssd won't show netgroups with blank domain
  - Resolves: upstream#3660 - confdb_expand_app_domains() always fails
  - Resolves: upstream#3658 - Application domain is not interpreted correctly
  - Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
                              json_loads()
  - Resolves: upstream#3386 - KCM: Payload buffer is too small
  - Resolves: upstream#3666 - Fix usage of str.decode() in our tests
  - A few KCM misc fixes


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-3
changelog:
  - Resolves: upstream#3684 - A group is not updated if its member is removed
                              with the cleanup task, but the group does not
                              change
  - Resolves: upstream#3558 - sudo: report error when two rules share cn
  - Tone down shutdown messages for socket activated responders
  - IPA: Qualify the externalUser sudo attribute
  - Resolves: upstream#3550 - refresh_expired_interval does not work with
                              netgrous in 1.15
  - Resolves: upstream#3402 - Support alternative sources for the files provider
  - Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
  - Resolves: upstream#3679 - Make nss netgroup requests more robust
  - Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
                              configured
  - Resolves: upstream#3469 - extend sss-certmap man page regarding priority
                              processing
  - Improve docs/debug message about GC detection
  - Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
                              list out of bound?
  - Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
                              set.
  - Document which principal does the AD provider use
  - Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
                              defined, but contains no SIDs
  - Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
  - Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
                             Provider returned an error
                             [org.freedesktop.sssd.Error.DataProvider.Fatal]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-1
changelog:
  - Update to 1.16.2 release
  - Cleanup unused global definitions
  - Remove python2 references from the spec file
  - Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-2
changelog:
  - Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
                             fails with the KCM ccache


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-4
changelog:
  - Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                             users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-7
changelog:
  - Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
                             differs from the default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-8
changelog:
  - Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
                              /usr/libexec/sssd/sssd_be killed by 11 crash
                              func _dbus_list_unlink


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-9
changelog:
  - Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
                             commands in man pages since local provider
                             is deprecated


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-10
changelog:
  - Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
                             started due to a misconfiguration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-11
changelog:
  - Resolves: rhbz#1628122 - Printing incorrect information about domain
                             with sssctl utility


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-16
changelog:
  - Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
                            PKCS#11 URI


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-17
changelog:
  - Related: rhbz#1637131 - pam_unix unable to match fully qualified username
                            provided by sssd during smartcard auth using gdm


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-18
changelog:
  - Related: rhbz#1638006 - Files: The files provider always enumerates
                            which causes duplicate when running getent passwd


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-19
changelog:
  - Add OSCP checks for p11_child
  - Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                            users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-21
changelog:
  - Related: rhbz#1638150 - session not recording for local user when groups defined
  - Also add silence a Coverity warning, which is related to rhbz#1637131


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-23
changelog:
  - Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
                             with smart card


author: Michal Židek <mzidek@redhat.com> - 2.0.0-24
changelog:
  - Resolves: rhbz#1646168 - sssctl access-report always prints an error message
  - Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
                             configuration without having to restart the whole
                             sssd
  - Resolves: rhbz#1640576 - sssctl reports incorrect information about local
                             user's cache entry expiration time
  - Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
  - Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys


author: Michal Židek <mzidek@redhat.com> - 2.0.0-25
changelog:
  - Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
                             for D-bus, resulting in a crash


author: Michal Židek <mzidek@redhat.com> - 2.0.0-27
changelog:
  - Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
                             if ID provider is authenticated with GSSAPI


author: Michal Židek <mzidek@redhat.com> - 2.0.0-29
changelog:
  - Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
                             /usr/libexec/sssd/proxy_child killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.0.0-30
changelog:
  - Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
                        retrieve AD users through IPA Trust


author: Michal Židek <mzidek@redhat.com> - 2.0.0-32
changelog:
  - Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
              and libtevent to avoid an issue in GPO processing


author: Michal Židek <mzidek@redhat.com> - 2.0.0-33
changelog:
  - Resolves: rhbz#1646113 - Missing concise documentation about valid options
                             for sssd-files-provider


author: Michal Židek <mzidek@redhat.com> - 2.0.0-34
changelog:
  - Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
                             kdestroy caused by KCM returning a wrong error
                             code during the delete operation


author: Michal Židek <mzidek@redhat.com> - 2.0.0-36
changelog:
  - Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
                             suggests using * for backend sss


author: Michal Židek <mzidek@redhat.com> - 2.0.0-38
changelog:
  - Resolves: rhbz#1578014 - sssd does not work under non-root user
  - Note: Actually the patches were in the 2.0.0-37, this one just adds this
          changelog because it was missing.


author: Michal Židek <mzidek@redhat.com> - 2.0.0-39
changelog:
  - Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
                             1.x, this can result in time outs


author: Michal Židek <mzidek@redhat.com> - 2.0.0-40
changelog:
  -Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
                            UnknownProperty: Unknown property


author: Michal Židek <mzidek@redhat.com> - 2.0.0-41
changelog:
  -Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
                            subdomain service name being used


author: Michal Židek <mzidek@redhat.com> - 2.0.0-42
changelog:
  - Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
                             of gen_new to avoid a subsequent switch call
                             failure


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-43
changelog:
  - Resolves: rhbz#1672780 - gdm login not prompting for username when smart
                             card maps to multiple users


author: Michal Židek <mzidek@redhat.com> - 2.0.0-45
changelog:
  - Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
    done here in order to unblock gating changes before rebase.
  - Related: rhbz#1682305


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-2
changelog:
  - Resolves: rhbz#1673443 - sssd man pages: The default value of
                             "ldap_user_home_directory" is not mentioned
                             with AD server configuration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-3
changelog:
  - Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
                             no members


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-4
changelog:
  - Resolves: rhbz#1283798 - sssd failover does not work on connecting to
                             non-responsive ldaps:// server


author: Michal Židek <mzidek@redhat.com> - 2.2.0-6
changelog:
  - Resolves: rhbz#1726945 - negative cache does not use values from
                             'filter_users' config option for known domains


author: Michal Židek <mzidek@redhat.com> - 2.2.0-7
changelog:
  - Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
                             not FIPS140 compliant


author: Michal Židek <mzidek@redhat.com> - 2.2.0-8
changelog:
  - Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
                             repository
                           - This just required a raise in release number
                             and changelog for the record.


author: Michal Židek <mzidek@redhat.com> - 2.2.0-10
changelog:
  - Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
                             the trailing colon


author: Michal Židek <mzidek@redhat.com> - 2.2.0-11
changelog:
  - Resolves: rhbz#1733372 - permission denied on logs when running sssd as
                             non-root user


author: Michal Židek <mzidek@redhat.com> - 2.2.0-13
changelog:
  - Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
              systemd-user service in the account phase in RHEL-8


author: Michal Židek <mzidek@redhat.com> - 2.2.0-14
changelog:
  - Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
                             should not cause files domain entries to be
                             qualified, this can break sudo access


author: Michal Židek <mzidek@redhat.com> - 2.2.0-15
changelog:
  - Resolves: rhbz#1736265 - Smart Card auth of local user: endless
                             loop if wrong PIN was provided


author: Michal Židek <mzidek@redhat.com> - 2.2.0-16
changelog:
  - Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
                             the IP address of the machine updated in IPA upon
                             sssd.service startup


author: Michal Židek <mzidek@redhat.com> - 2.2.0-17
changelog:
  - Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
                             keyring
  - Also apply a patch to fix gating tests issue


author: Michal Židek <mzidek@redhat.com> - 2.2.0-18
changelog:
  - Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
  - Also sync. kcm multihost tests with master


author: Michal Židek <mzidek@redhat.com> - 2.2.0-19
changelog:
  - Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
                             new ones (kcm)


author: Michal Židek <mzidek@redhat.com> - 2.2.3-2
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              PART2: Fix gating issue.


author: Michal Židek <mzidek@redhat.com> - 2.2.3-3
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              Increasing version number to pick latest libldb


author: Michal Židek <mzidek@redhat.com> - 2.2.3-4
changelog:
  * Resolves: rhbz#1781728 - sssctl config-check command does not give proper
                             error messages with line numbers


author: Michal Židek <mzidek@redhat.com> - 2.2.3-5
changelog:
  * Resolves: rhbz#1744500 - [Doc]Provide explanation on escape character
                             for match rules sss-certmap


author: Michal Židek <mzidek@redhat.com> - 2.2.3-9
changelog:
  * Resolves: rhbz#1783190 - [abrt] [faf] sssd:
                             raise(): /usr/libexec/sssd/sssd_autofs killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.2.3-10
changelog:
  * Resolves: rhbz#1583592 - [RFE] Add configurable randomness to SSSD ldap
                             connection timeout


author: Michal Židek <mzidek@redhat.com> - 2.2.3-14
changelog:
  - Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
                             specified up to the seconds


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-16
changelog:
  - Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
                             omitted and auth_provider is krb5


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-17
changelog:
  - Resolves: rhbz#1718193 - p11_child should have an option to skip
                             C_WaitForSlotEvent if the PKCS#11 module
                             does not implement it properly


author: Michal Židek <mzidek@redhat.com> - 2.2.3-18
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
                             information


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate
                             (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
  - Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
  - Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
  - Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.1
changelog:
  - Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
  - Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
  - Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
  - Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
  - Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
  - Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.2
changelog:
  - Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
  - Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
  - Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]


author: Fernando Pacheco <fpacheco@redhat.com> - 1.15-1
changelog:
  - stalld: Fix incorrect open() return value checks
  - stalld: Pass errno to strerror() on sig*set() failures
  - throttling: Always null terminate sched_rt_runtime_us output
  - stalld: Remove unreachable statement in detect_task_format()
  - tests: Fix uninitialized value action.sa_mask
  - utils: Bail if malloc() returns null in parse_cpu_list()
  - stalld: Use correct format specifier for long types
    Resolves: rhbz#1990057, rhbz#1996799, rhbz#1996825


author: Fernando Pacheco <fpacheco@redhat.com> - 1.16-1
changelog:
  - stald/utils: Space, lines and voids clenaups
  - stalld: Add an option to easily set stalld as SCHED_DEADLINE
  - stalld: Comments cleanup
  - src/utils: Comments cleanup
  - src/throttling: Comments cleanup
  - src/stalld.h Comments cleanup
    Resolves: rhbz#2068549


author: Leah Leshchinsky <lleshchi@redhat.com> - 1.17.1-1
changelog:
  - stalld: Fix memory leak in print_boosted_info()
  - utils: Check if the system is in lockdown mode
  - stalld: print process comm and cpu when boosting
  Resolves: rhbz#2120800


author: Parag Nemade <pnemade AT redhat DOT com> - 1.1.0-7
changelog:
  - Add metainfo file to show this font in gnome-software
  - Remove %clean section which is optional now
  - Remove buildroot which is optional now
  - Remove removal of buildroot in %install
  - Remove group tag


author: Dennis Keefe <dkeefe@redhat.com> - 2.0.0-2
changelog:
  - Update to 2.0.0
  - Allow the user to interact with the daemon under conditions
    where a pool, filesystem, or blockdev is not fully functional.
  - Resolves: rhbz#1730493
  - Establish an environment variable for D-Bus timeout parameter.
  - Resolves: rhbz#1678631
  - Return detailed error messages on all error-appearing user actions.
  - Resolves: rhbz#1642393
  - Resolves: rhbz#1687869
  - Exit with error code 0 and error message on stderr for all command-line
    parsing errors.
  - Resolves: rhbz#1747564
  - Show more complete error messages on D-Bus method call failures.
  - Resolves: rhbz#1717460
  - Add version numbers to required packages
  - Resolves: rhbz#1717489


author: Dennis Keefe <dkeefe@redhat.com> - 2.1.1-6
changelog:
  - Update to 2.1.1
  - Resolves: rhbz#1791472
  - Update RPM spec file
  - Resolves: rhbz#1827360
  - Error messages when creating a pool are more helpful
  - Resolves: rhbz#1734496
  - Support per-pool encryption of devices that form a pools data tier
  - Resolves: rhbz#1768580
  - Improve error handling on partial unlock failure of encrypted pools
  - Resolves: rhbz#1855520


author: Bryan Gurney <bgurney@redhat.com> - 2.4.2-1
changelog:
  - Update to 2.4.2
  - Resolves: rhbz#1931670
  - Remove requirement for python3-semantic_version
  - Resolves: rhbz#1972355
  - Remove unnecessary keyutils Requires line


author: Dennis Keefe <dkeefe@redhat.com> - 2.0.0-4
changelog:
  - Update to 2.0.0
  - Resolves: rhbz#1760906
  - Fix a bug where last update time for variable length metadata was not set
    properly on startup:
  - Resolves: rhbz#1720399
  - Specify path of PID file as "/run/stratisd.pid" instead of 
    "/var/run/stratisd.pid".
  - Resolves: rhbz#1754649
  - For a particular log entry, reduce log level from INFO to DEBUG and make the
    log message more detailed:
  - Resolves: rhbz#1680052


author: Dennis Keefe <dkeefe@redhat.com> - 2.1.0-1
changelog:
  - Update to 2.1.0
  - Resolves: rhbz#1791473
  - Update Stratis RPM Spec File
  - Resolves: rhbz#1828487
  - Support per-pool encryption of the devices that form a pool's data tier
  - Resolves: rhbz#1768580
  - Improve systemd unit file description
  - Resolves: rhbz#1756525


author: Dennis Keefe <dkeefe@redhat.com> - 2.3.0-2
changelog:
  - Update to 2.3.0
  - Resolves: rhbz#1885328
  - Stratis devices inhabit an existing root directory path
  - Resolves: rhbz#1798244
  - Add Clevis Support
  - Resolves: rhbz#1868100
  - Improve stratisd log levels
  - Resolves: rhbz#1757976


author: Bryan Gurney <bgurney@redhat.com> - 2.4.0-3
changelog:
  - Update to 2.4.0
  - Resolves: rhbz#1931671
  - Improve stratis by adding Multi-threading
  - Resolves: rhbz#1927485
  - Dump stratis configuration on demand or in debug
  - Resolves: rhbz#1735475
  - Add noalign option to XFS creation on MDV
  - Resolves: rhbz#1908318
  - Cap thinpool metadata device size at devicemapper-set limit
  - Resolves: rhbz#1707461


author: Bryan Gurney <bgurney@redhat.com> - 2.4.2-1
changelog:
  - Update to 2.4.2
  - Resolves: rhbz#1931671
  - Ensure that binaries are installed with proper features enabled
  - Split dracut modules out to subpackage
  - Add additional dependencies in dracut module


author: John Kacur <jkacur@redhat.com> - 0.15.00-1
changelog:
  - Rebase to upstream V0.15.00
  - Add the following upstream patches
  - stress-shm: move /dev/shm check to earlier in the setup phase
  - stress-shm: skip stressor if /dev/shm is not mounted with tmpfs on linux
  - stress-sysfs: check for zero sysfs entries after pruning the directory
  Resolves: rhbz#2144068


author: Petr Viktorin <pviktori@redhat.com> - 1.15.0-8
changelog:
  - Run sanity-check.py with Python 3
    https://bugzilla.redhat.com/show_bug.cgi?id=1595816
    https://bugzilla.redhat.com/show_bug.cgi?id=1610038


author: Christopher Snyder <csnyder@redhat.com>
changelog:
  - 1776461: Rebase subscription-manager-migration-data component to the latest
    upstream branch for RHEL 8.2.0 (csnyder@redhat.com)
  - 1776461: Update product certs to include those for 8.2 (csnyder@redhat.com)


author: Kalev Lember <kalevlember@gmail.com> - 0.5.1-1
changelog:
  - Update to 0.5.1
  - Build with libmusicbrainz4
  - Adjust the spec file for the changes in private library location
  - Remove and obsolete the -devel subpackage


author: David King <amigadave@amigadave.com> - 3.15.90-1
changelog:
  - Update to 3.15.90
  - Use license macro for COPYING
  - Use pkgconfig for BuildRequires
  - Compile GSettings schemas


author: Michael Catanzaro <mcatanzaro@redhat.com> - 3.28.3-3
changelog:
  - Use autosetup so WebKitGTK patch actually gets applied, and rewrite the patch to work
    Resolves: RHEL-26699


author: Tom Stellard <tstellar@redhat.com> - 4.0.2-2
changelog:
  - Use make macros
    https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Disable Go tests


author: Bastien Nocera <bnocera@redhat.com> - 1.1-1
changelog:
  + switcheroo-control-1.1-1
  - Update to 1.1
  - Don't throw errors when the machine doesn't have dual-GPU (#1391212)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.0-2.20200828git0c238a2
changelog:
  - Backport fixes from 0.4.0 stable branch. Resolves: rhbz#1868375
    (fixes usage of swtpm-localca with passwords when signing keys)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.2-1.20201201git2df14e3
changelog:
  - Update to 0.4.2, to address potential symlink vulnerabilities (CVE-2020-28407).
    Resolves: rhbz#1906043


author: <msekleta@redhat.com> - 11.7.3-7
changelog:
  - Don't trigger autofs mounts when running sadc (#2000910)
  - sar: Add missing %gnice CPU value for tickless CPU (#2000916)
  - sadf: Fix seg fault on empty data files (#1910841)
  - sar: Fix typo in manual page (#1877836)


author: psimovec <psimovec@redhat.com> - 11.7.3-11
changelog:
  - fix the arithmetic overflow in allocate_structures() that is still possible on some 32 bit systems (CVE-2023-33204)


author: Ivana Varekova <varekova@redhat.com> - 8.0.1-1
changelog:
  - update to 8.0.1
  - remove useless patches
  - spec file cleanup
  - remove smp build flag (ar problem)
  - add libdir flags


author: Ivana Varekova <varekova@redhat.com> - 8.0.2-2
changelog:
  - change license tag
  - remove sysstat.crond source (add -d)
  - remove obsolete sysconfig file
  - spec file cleanup


author: Ivana Varekova <varekova@redhat.com> - 9.0.4-3
changelog:
  - fix init script - add INIT INFO flags (#522740)
    and add condrestart, try-restart and force-reload (#522743)


author: Ivana Hutarova Varekova <varekova@redhat.com> - 9.0.6.1-7
changelog:
  - remove needless DOCDIR setting
  - remove needless INIT_DIR setting
  - fix the problem with --disable-man-group option


author: Ivana Hutarova Varekova <varekova@redhat.com> - 10.0.0-4
changelog:
  - close the file descriptor in a special situation in read_uoptime function
  - fix the number on open files in cifsiostat output


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.1-1
changelog:
  - resolves: #844387
    update to 10.1.1
  - keep log files for 28 days instead of 7
  - collect all aditional statistics


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-1
changelog:
  - resolves: #863791
    updated to 10.1.2
  - resolves: #850333
    migrated to the new systemd-rpm macros
  - cleaned .spec file


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-2
changelog:
  - added new -y option to iostat command to skip first since boot report if
    displaying multiple reports


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.6-1
changelog:
  - resolves: #972508
    updated to 10.1.6
  - resolves: #993394
    fixed FTBFS (added BR on systemd)
  - install the docs in the new pkgdocdir
    (thanks to Mathieu Bridon <bochecha@fedoraproject.org> for the patch)


author: Michal Sekletár <msekleta@redhat.com> - 11.7.3-2
changelog:
  - sysstat's buildsystem doesn't really use LDFLAGS, we have to merge CFLAGS and LDFLAGS to get binaries with full RELRO (#1624177)


author: Lukáš Zaoral <lzaoral@redhat.com> - 11.7.3-13
changelog:
  - fix memory allocation errors with malformed sa files (RHEL-35511)
  - reorder patches to prevent errors during their application


author: Stan Cox <scox@redhat.com> - 4.7-1
changelog:
  - Upstream release, see wiki page below for detailed notes.
    https://sourceware.org/systemtap/wiki/SystemTapReleases


author: Frank Ch. Eigler <fche@redhat.com> - 4.8-2
changelog:
  - rhbz2156092 = rhbz1997192
  - rhbz2145241 = rhbz2145242
  - rhbz2156093 = rhbz2149223
  - rhbz2156095 = rhbz2149666
  - rhbz2156094 = rhbz2154430


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.6-2
changelog:
  - Splitted documentation to the doc subpackage
    Resolves: rhbz#1380291
  - Fixed whitespace
  - Dropped obsoleted defattr


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.8-2
changelog:
  - Reverted _module_build macro check which fixes systemtap probes on RHEL-8
    Resolves: rhbz#1579386


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Removing build-time dependency on sharutils(rhbz#1587877)
  - Changing git dependency to smaller git-core


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-6
changelog:
  - Resolves: #1715423 - tcpdump pre creates user and groups unconditionally
  - Resolves: #1655622 - CVE-2018-19519 Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-2
changelog:
  - Resolves: #1860216 - tcpdump can not parse mptcp options
  - Resolves: #1901635 - ppp decapsulator can be convinced to allocate a large amount of memory
  - Adding tedude test to gating


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-69
changelog:
  - Resolves: #1445259 - telnet won't build with latest gcc
  - added note about address resolution in manpage


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-73
changelog:
  - Resolves: #1602711 - Please review important issues found by covscan
  - Resolves: #1637085 - Option -i is missing in telnet in el8 but is available in el7


author: Parag Nemade <pnemade AT redhat DOT com> - 0.1-20
changelog:
  - Resolves:rh#921852 - Four culmus subpackages are not listed in build require
  - Added BR: and R: for the following packages
  - culmus-hadasim-clm-fonts, culmus-simple-clm-fonts
  - culmus-stamashkenaz-clm-fonts, culmus-stamsefarad-clm-fonts


author: Jindrich Novy <jnovy@redhat.com> 2008-0.1
changelog:
  - initial packaging for TeX Live 2008
  - wrote tl2rpm.c to autogenerate packages and post scriptlets
  from TeX Live metadata
  - fix kpathsea default search path


author: Jindrich Novy <jnovy@redhat.com> 2008-0.2
changelog:
  - update to today's svn sources of binaries from upstream
  - fix directory -> symlink conversion
  - add ly1 (#488651)


author: Jindrich Novy <jnovy@redhat.com> 2009-0.2
changelog:
  - add tetex-* virtual provides
  - fix unversioned requires
  - filter out unwanted libs and utilities from source


author: Jindrich Novy <jnovy@redhat.com> 2009-0.3
changelog:
  - require system psutils and t1utils and don't build the TL ones
  - correctly obsolete old kpathsea
  - binaries now have -bin postfix
  - support for Fedora fonts


author: Jindrich Novy <jnovy@redhat.com> 2009-0.11
changelog:
  - fix generation of packages that ships only documentation
  - fix versioning of packages without version but with revision
  - fix heuristics for gathering .sty files dependencies
  - include packages under GFSL license
  - make files in old texmf tree from previous installs visible
  - do not obsolete old kpathsea, try to coexist
  - remove dvipdfm, dvipdfmx,depend of Fedora ones


author: Jindrich Novy <jnovy@redhat.com> 2009-2
changelog:
  - install man and info pages into proper locations visible
  by man and info
  - update scriptlets
  - remove xindy bits


author: Jindrich Novy <jnovy@redhat.com> 2009-3.20100326
changelog:
  - declare fmutil.cnf, updmap.cfg, context.cnf and texmf.cnf as config files
  so that they don't get overwritten with texlive-kpathsea update
  - move man and info pages to the main packages, not -doc


author: Jindrich Novy <jnovy@redhat.com> 2010-7.20100531
changelog:
  - switch to "tlpretest" source tree
  - add lua and ruby dependencies to packages requiring them
  - generate global package database "texlive.tlpdb" directly from
  tlpobj files shipped with each package


author: Jindrich Novy <jnovy@redhat.com> 2010-8.20100715
changelog:
  - move all the licenses and base directory hierarchy to texlive-base
  noarch subpackage
  - add automatic licensing code


author: Jindrich Novy <jnovy@redhat.com> 2010-9.20100814
changelog:
  - fix file attributes and rpmlint warnings
  - define libdir when calling configure
  - rebuild against new poppler


author: Jindrich Novy <jnovy@redhat.com> 2010-11.20101007
changelog:
  - sync with the latest TL2010 sources
  - don't make redundant copies of binaries, symlink them
  - fix symlinks to perl utilities


author: Jindrich Novy <jnovy@redhat.com> 2010-13.20101112
changelog:
  - temporarily disable dvi2tty because of failing test suite
  - package /etc/texmf and point texmf-config there


author: Jindrich Novy <jnovy@redhat.com> 2011-0.1.20110120
changelog:
  - bump release to 2011 (we are using the 2011/dev SVN version)
  - add more file virtual provides (TFM, TTF, TTC, PFA, PFB, PCF, OTF,
  TEX, CNF, CFG, DEF, DAT, LDF, FD, ENC, MAP, VF, VPL, CLO, BUG, BUG2)


author: Jindrich Novy <jnovy@redhat.com> 2011-0.1.20110227
changelog:
  - fix upgrade path with old TL2007 xetex, context or dvips installed
  - fix package generation bug that caused some package might be missing
  from the repository
  (http://www.linux.cz/pipermail/texlive/2011-February/000086.html)
  - fix upstream source URLs


author: Jindrich Novy <jnovy@redhat.com> 2012-2-20120926
changelog:
  - drop relase subpackage (no more needed as TL is now in Fedora)
  - fix -doc dependencies
  - remove (not-built) asymtote from source tarball
  - undefined catalogue version defaults to 0
  - perform automatic license audit
  - include also packages not part of any scheme
  - don't strip binaries so that we can generate debuginfo (#863635)
  - clean up depsolver


author: Jindrich Novy <jnovy@redhat.com> 2012-3-20120926
changelog:
  - obsolete chktex (#864211)
  - make config.ps a config file (#441171)
  - fix post/postun scriptlet dependencies
  - all subpackages now have %dist tag


author: Jindrich Novy <jnovy@redhat.com> 2012-3-20121019
changelog:
  - sync with upstream sources
  - make /usr/share/texmf visible to kpathsea, make texmf-local
  pointing to it (#867656, #864875)
  - fix versioning of binary packages


author: Jindrich Novy <jnovy@redhat.com> 2012-3-20121024
changelog:
  - sync with upstream - fixes problem lcdf-typetools tests
  - disable largefile support to fix pdflatex on 32bit arches (#872231)
  - put compatibility TEXMF tree reference into texm-local instead
  symlinking it to /usr/share/texmf directly


author: Jindrich Novy <jnovy@redhat.com> 2012-5-20121024
changelog:
  - don't conflict with latexmk (#868996)
  - unify versioning for both binary and noarch subpackages
  - remove lcdf-typetools hack for s390(x)


author: Jindrich Novy <jnovy@redhat.com> 2012-8-20121115
changelog:
  - prevent sed from being verbose in install log when uninstalling
  - be sure the old /usr/share/texmf tree is indexed and searched by
  kpathsea (#876710)
  - drop patch to fix build for dvisvgm, it is now applied upstream
  - fix dependencies in texlive and texlive-base subpackages (#875364)


author: Jindrich Novy <jnovy@redhat.com> 2012-9-20121120
changelog:
  - obsolete metapost-metauml (#573863)
  - update BR perl-MD5 to perl(Digest::MD5) - required for updmap
  - remove redundant posttrans executions in texlive-base (#865650)
  - own ls-R in texmf-local directory


author: Jindrich Novy <jnovy@redhat.com> 2012-10-20121205
changelog:
  - sync with CTAN
  - compile also C++ sources with -fno-strict-aliasing
  - ship adhocfilelist
  - fix changelog dates


author: Jindrich Novy <jnovy@redhat.com> 2012-11-20130102
changelog:
  - sync with CTAN
  - added new buildrequires
  - don't use texlive's psutils
  - don't obsolete latexmk (#868996)


author: Jindrich Novy <jnovy@redhat.com> 2012-12-20130102
changelog:
  - fix dependencies and upgrade path (#892054, #891709)
  - do not ship windows and other unneeded files


author: Jindrich Novy <jnovy@redhat.com> 2012-15-20130131
changelog:
  - enlarge tex(latex) dependency set, introduce tex(latex-base) (#904147)
  - fix post-scriptlets (#875257)
  - ship macros.texlive (#885762)
  - depend directly on texlive-kpathsea-lib
  - disable rpath


author: Jindrich Novy <jnovy@redhat.com> 2012-17-20130310
changelog:
  - run updmap-sys --syncwithtrees posttrans (#915086)
  - don't conflict with other packages (#913678)
  - obsolete tex-cm-lgc (#907728)
  - obsolete tex-kerkis (#907726)
  - fix clashes with xmltex (#877690)
  - use fedora latexmk instead of texlive latexmk (#914689)
  - fix broken symlinks in /usr/bin (#910952)
  - fmtutil doesn't print jadetex errors any more (#875266)
  - fix post scriptlets


author: Jindrich Novy <novyjindrich@gmail.com> - 2012-20-20130321
changelog:
  - bring chkweb back to life
  - fix context script (#924918)
  - prefer scripts installed from sources than from CTAN
  - BR: ghostscript-devel because of dvisvgm (#924662)


author: Jindrich Novy <novyjindrich@gmail.com> - 2012-21-20130427
changelog:
  - add missing shebang to context script
  - mark language.dat as config file (#929367)
  - add scripts for checking out sources and CTAN archives


author: Than Ngo <than@redhat.com> - 2:2012-34.20130427_r30134
changelog:
  - Resolves: bz#1064453, add missing texlive-metapost and groff.enc
    Resolves: bz#948532, add missing manpages for pdfxmltex, xmltex
    Resolves: bz#1213886, tex4ht-bin requires latex
    Resolves: bz#1217556, port for poppler-0.26.5
    Resolves: bz#1035679, scriptlet errors when installing texlive packages
    Resolves: bz#1184987, add texlive-titling


author: Than Ngo <than@redhat.com> - 7:20170524-3
changelog:
  - add anyfontsize, classpack, collection-htmlxml, latex2man
  - add provide tetex-tex4ht, jadetex, tetex-tex4ht, texlive-collection-htmlxml, tex(anyfontsize.sty), texlive-latex2man


author: Than Ngo <than@redhat.com> - 7:20170524-6
changelog:
  - fix wrong provides tex(english.ldf)
  - add babel-english. add fontawesome, awesomebox
  - add reference to support old texmf tree
  - fix build issue, not found html.sty and texinfo.tex


author: Than Ngo <than@redhat.com> - 7:20180414-12
changelog:
  - texconfig is needed in texconfig-sys, added Requirement texlive-texconfig
  - multilib issue detected by rpmdiff
  - drop obsoleted patch for poppler-0.58
  - XML validity issue
    Related: #1602712


author: Lukáš Zaoral <lzaoral@redhat.com> - 5.2-25
changelog:
  - Fix inconsistent --map-file option spelling in manual (rhbz#2066853)
  - Fix memory corruption in tftpd when filename remapping with macro \x
    is used (rhbz#2066862)


author: Parag Nemade <pnemade AT redhat DOT com> - 0.5.0-9
changelog:
  - Add metainfo file to show this font in gnome-software
  - Remove group tag
  - Replace %define with %global


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: Tomas Popela <tpopela@redhat.com> - 78.12.0-3
changelog:
  - Add script to process the official tarball to comply with PELC review
  - Fix the build with newer glibc


author: Adam Tkac <atkac redhat com> 0.0.90-0.4.20090403svn3751
changelog:
  - update to r3751
  - patches merged
    - tigervnc-xclients.patch
    - tigervnc-clipboard.patch
    - tigervnc-rh212985.patch
  - basic RandR support in Xvnc (resize of the desktop)
  - use built-in libjpeg (SSE2/MMX accelerated encoding on x86 platform)
  - use Tight encoding by default
  - use TigerVNC icons


author: Adam Tkac <atkac redhat com> 0.0.90-0.6.20090427svn3789
changelog:
  - update to r3789
    - tigervnc-rh494801.patch merged
  - tigervnc-newfbsize.patch is no longer needed
  - fix problems when vncviewer and Xvnc run on different endianess (#496653)
  - UltraVNC and TightVNC clients work fine again (#496786)


author: Adam Tkac <atkac redhat com> 0.0.90-0.10
changelog:
  - rebuild against 1.6.1.901 X server (#497835)
  - disable i18n, vncviewer is not UTF-8 compatible (#501832)


author: Adam Tkac <atkac redhat com> 0.0.91-0.11
changelog:
  - update to 0.0.91 (1.0.0 RC1)
  - patches merged
    - tigervnc10-rh499401.patch
    - tigervnc10-rh497592.patch
    - tigervnc10-rh501832.patch
  - after discusion in upstream drop tigervnc-bounds.patch
  - configure flags cleanup


author: Adam Tkac <atkac redhat com> 0.0.91-0.13
changelog:
  - temporary use F11 Xserver base to make Xvnc compilable
  - BuildRequires: libXi-devel
  - don't ship tigervnc-server-module on s390/s390x


author: Adam Tkac <atkac redhat com> 1.0.0-2
changelog:
  - update underlying X source to 1.6.4-0.3.fc11
  - remove bogus '-nohttpd' parameter from /etc/sysconfig/vncservers (#525629)
  - initscript LSB compliance fixes (#523974)
  - improve -LowColorSwitch documentation and handling (#510185)
  - honor dotWhenNoCursor option (and it's changes) every time (#524340)


author: Adam Tkac <atkac redhat com> 1.0.90-0.1.20091221svn3929
changelog:
  - update to 1.0.90 snapshot
  - patches merged
    - tigervnc10-compat.patch
    - tigervnc10-rh510185.patch
    - tigervnc10-rh524340.patch
    - tigervnc10-rh516274.patch


author: Adam Tkac <atkac redhat com> 1.0.90-0.2.20091221svn3929
changelog:
  - add patch for upstream X.Org issue #25909
  - add libXdmcp-devel to build requires to build Xvnc with XDMCP support (#552322)


author: Adam Tkac <atkac redhat com> 1.0.90-0.4.20091221svn3929
changelog:
  - mark stack as non-executable in jpeg ASM code
  - add xorg-x11-xauth to Requires
  - add support for X.Org 1.8
  - drop shave sources, they are no longer needed


author: Adam Tkac <atkac redhat com> 1.0.90-0.6.20100219svn3993
changelog:
  - add mesa-dri-drivers and xkeyboard-config to -server Requires
  - update to r3993 1.0.90 snapshot
    - tigervnc11-noexecstack.patch merged
    - tigervnc11-xorg18.patch merged
    - xserver18.patch is no longer needed


author: Adam Tkac <atkac redhat com> 1.0.90-0.9.20100219svn3993
changelog:
  - add server-applet subpackage which contains Java vncviewer applet
  - fix Java applet; it didn't work when run from web browser
  - add xorg-x11-xkb-utils to server Requires


author: Adam Tkac <atkac redhat com> 1.0.90-0.10.20100420svn4030
changelog:
  - update to r4030 snapshot
  - patches merged to upstream
    - tigervnc11-rh522369.patch
    - tigervnc11-rh551262.patch
    - tigervnc11-r4002.patch
    - tigervnc11-r4014.patch


author: Adam Tkac <atkac redhat com> 1.0.90-0.11.20100420svn4030
changelog:
  - link libvnc.so "now" to catch "undefined symbol" errors during Xorg startup
  - use always XkbConvertCase instead of XConvertCase (#580159, #586406)
  - don't link libvnc.so against libXi.la, libdix.la and libxkb.la; use symbols
    from Xorg instead


author: Adam Tkac <atkac redhat com> 1.0.90-0.14.20100420svn4030
changelog:
  - fix memory leak in Xvnc input code (#597172)
  - don't crash when receive negative encoding (#600070)
  - explicitly disable udev configuration support
  - add gettext-autopoint to BR


author: Adam Tkac <atkac redhat com> 1.0.90-0.17.20100721svn4113
changelog:
  - update to r4113
  - patches merged
    - tigervnc11-rh586406.patch
    - tigervnc11-libvnc.patch
    - tigervnc11-rh597172.patch
    - tigervnc11-rh600070.patch
    - tigervnc11-options.patch
  - don't own %{_datadir}/icons directory (#614301)
  - minor improvements in the .desktop file (#616340)
  - bundled libjpeg configure requires nasm; is executed even if system-wide
    libjpeg is used


author: Adam Tkac <atkac redhat com> 1.0.90-0.19.20100813svn4123
changelog:
  - separate Xvnc, vncpasswd and vncconfig to -server-minimal subpkg (#626946)
  - move license to separate subpkg and Requires it from main subpkgs
  - Xvnc: handle situations when no modifiers exist well (#611677)


author: Adam Tkac <atkac redhat com> 1.0.90-0.20.20100813svn4123
changelog:
  - press fake modifiers correctly (#633931)
  - supress unneeded debug information emitted from initscript (#633645)


author: Adam Tkac <atkac redhat com> 1.0.90-0.24.20100813svn4123
changelog:
  - rebuild against xserver 1.10.X
  - 0001-Return-Success-from-generate_modkeymap-when-max_keys.patch merged


author: Adam Tkac <atkac redhat com> 1.0.90-0.25.20101208svn4225
changelog:
  - update to r4225
  - patches merged
    - tigervnc11-rh611677.patch
    - tigervnc11-rh633931.patch
    - tigervnc11-xorg1.10.patch
  - enable VeNCrypt and PAM support


author: Adam Tkac <atkac redhat com> - 1.0.90-3
changelog:
  - fix wrong usage of memcpy which caused screen artifacts (#652590)
  - don't point to inaccessible link in sysconfig/vncservers (#644975)


author: Adam Tkac <atkac redhat com> - 1.1.0-1
changelog:
  - update to 1.1.0
  - update the xorg11 patch
  - patches merged
    - tigervnc11-glx.patch
    - tigervnc11-CVE-2011-1775.patch
    - 0001-Use-memmove-instead-of-memcpy-in-fbblt.c-when-memory.patch


author: Adam Tkac <atkac redhat com> - 1.1.0-3
changelog:
  - don't build X.Org devel docs (#755782)
  - applet: BR generic java-devel instead of java-gcj-devel (#755783)
  - use runuser to start Xvnc in systemd service file (#754259)
  - don't attepmt to restart Xvnc session during update/erase (#753216)


author: Adam Tkac <atkac redhat com> - 1.1.0-5
changelog:
  - clean Xvnc's /tmp environment in service file before startup
  - fix building against the latest JAVA 7 and X.Org 1.12


author: Adam Tkac <atkac redhat com> 1.2.80-0.1.20120905svn4996
changelog:
  - update to 1.2.80
  - remove deprecated patches
    - tigervnc-102434.patch
    - tigervnc-viewer-reparent.patch
    - tigervnc11-java7.patch
  - patches merged
    - tigervnc11-xorg111.patch
    - tigervnc11-xorg112.patch


author: Adam Tkac <atkac redhat com> - 1.2.80-0.12.20130314svn5065
changelog:
  - include /etc/X11/xorg.conf.d/10-libvnc.conf sample configuration (#712482)
  - vncserver now honors specified -geometry parameter (#755947)


author: Tim Waugh <twaugh@redhat.com> 1.2.80-0.14.20130314svn5065
changelog:
  - Use systemd rpm macros (bug #850340).  Moved systemd requirements
    from main package to server sub-package.
  - Applied Debian patch to fix busy loop when run from inetd in nowait
    mode (bug #920373).
  - Added dependency on xorg-x11-xinit to server sub-package so that
    default window manager can be found (bug #896284, bug #923655).
  - Fixed bogus changelog date.


author: Tim Waugh <twaugh@redhat.com> 1.3.0-3
changelog:
  - Avoid PIDFile problems in systemd unit file (bug #983232).
  - libvnc.so: don't use unexported key_is_down function.
  - Don't use shebang in vncserver script.


author: Tim Waugh <twaugh@redhat.com> 1.3.0-15
changelog:
  - Disable dri3 to enable building (bug #1063392).
  - Fixed heap-based buffer overflow (CVE-2014-0011, bug #1050928).


author: Tim Waugh <twaugh@redhat.com> - 1.3.1-8
changelog:
  - Input reset fixes from upstream (bug #1116956).
  - No longer need ppc64le patch as it's now in xorg-x11-server.
  - Rebased xserver114.patch again.


author: Tim Waugh <twaugh@redhat.com> - 1.4.2-1
changelog:
  - Rebased xserver116.patch against xorg-x11-server-1.17.1.
  - Allow build against xorg-x11-server-1.17.
  - 1.4.2.


author: Jan Grulich <jgrulich@redhat.com> - 1.6.0-4
changelog:
  - Utilize system-wide crypto policies
    Resolves: bz#1179345
  - Try to disable patch4 as it was previously written to support an
    older version of a different client and breaks some other usage
    Resolves: bz#1280440


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-3
changelog:
  - Bug 1438704 - CVE-2017-7392 CVE-2017-7393 CVE-2017-7394
                  CVE-2017-7395 CVE-2017-7396 tigervnc: various flaws
    + other upstream related fixes


author: Jan Grulich <jgrulich@redhat.com> - 1.9.0-7
changelog:
  - Improve coverity scan fixes
    Resolves: bz#1602714

    Inform whether view-only password is used or not
    Resolves: bz#1639169

    Backport fixes from RHEL 7
    Resolves: bz#1651254


author: Jan Grulich <jgrulich@redhat.com> - 1.10.1-5
changelog:
  - Install the HOWTO file to correct location
  - Add /usr/bin/vncserver file informing users to read the HOWTO.md file
    Resolves: bz#1790443


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-1
changelog:
  - Update to 1.11.0
    Resolves: bz#1880985
  - Backport fix to allow Tigervnc use boolean values in config files
    Resolves: bz#1883415


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-2
changelog:
  - Revert removal of vncserver
    Resolves: bz#1897504
  - Correctly start vncsession as a daemon
    Resolves: bz#1897498


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-4
changelog:
  - Added vncsession-restore script for SELinux policy migration
    Fix SELinux context for root user
    Resolves: bz#2021892


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-1
changelog:
  - 1.13.1
    Resolves: bz#2175748
  - Restore "--fallbacktofreeport" option in the vncserver script
    Resolves: bz#2174398


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege
    Escalation Vulnerability
    Resolves: bz#2180306


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-4
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
    Resolves: RHEL-15236

  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15230


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-5
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18410
  - Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18422


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-7
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20388
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20382
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20530
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21214


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-9
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-30755
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30767
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-10
changelog:
  - Drop patches that are already part of xorg-x11-server
    Resolves: RHEL-30755
    Resolves: RHEL-30767
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com>
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-61999


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-15
changelog:
  - Fix CVE-2025-26594 xorg-x11-server Use-after-free of the root cursor
    Resolves: RHEL-79397
  - Fix CVE-2025-26595 xorg-x11-server Buffer overflow in XkbVModMaskText()
    Resolves: RHEL-79401
  - Fix CVE-2025-26596 xorg-x11-server Heap overflow in XkbWriteKeySyms()
    Resolves: RHEL-79386
  - Fix CVE-2025-26597 xorg-x11-server Buffer overflow in XkbChangeTypesOfKey()
    Resolves: RHEL-79380
  - Fix CVE-2025-26598 xorg-x11-server Out-of-bounds write in CreatePointerBarrierClient()
    Resolves: RHEL-79369
  - Fix CVE-2025-26599 xorg-x11-server Use of uninitialized pointer in compRedirectWindow()
    Resolves: RHEL-79364
  - Fix CVE-2025-26600 xorg-x11-server Use-after-free in PlayReleasedEvents()
    Resolves: RHEL-79360
  - Fix CVE-2025-26601 xorg-x11-server Use-after-free in SyncInitTrigger()
    Resolves: RHEL-79348


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-4
changelog:
  - Add option "ApproveLoggedUserOnly" allowing to connect only the user
    owning the running session
    Resolves: RHEL-91104


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-6
changelog:
  - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors
    Resolves: RHEL-97268
  - Fix CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97294
  - Fix CVE-2025-49178: xorg-x11-server: Unprocessed Client Request Due to Bytes to Ignore
    Resolves: RHEL-97364
  - Fix CVE-2025-49179: xorg-x11-server: Integer overflow in X Record extension
    Resolves: RHEL-97397
  - Fix CVE-2025-49180: xorg-x11-server: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension
    Resolves: RHEL-97232


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-7
changelog:
  - Additional fix to CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97294


author: Justin Stephenson <jstephen@redhat.com> - 8-1
changelog:
  - Release v8
  - Spec file fixes for EL6
  - Spec file improvements for Debian/Ubuntu pkg-config
  - Tlog-play improve authentication options
  - Handle piped in I/O from stdin and improve the main recording transfer exit
    condition.
  - Use empty string on hostname resolution failure


author: Justin Stephenson <jstephen@redhat.com> - 9-1
changelog:
  - Release v9
  - Add libutempter support
  - Require journal match filter
  - Add file reader match functionality
  - Restore cursor visibility and color attributes on tlog-play exit
  - Add "time" real clock timestamp message field
  - Various upstream CI improvements


author: Justin Stephenson <jstephen@redhat.com> - 11-1
changelog:
  - Fire SIGCHLD after utempter_add_record since it probably eats it.
  - Correct suse rpmbuild
  - Update debbuild for travis CI


author: Justin Stephenson <jstephen@redhat.com> - 12-1
changelog:
  - Release v12
  - Prevent infinite transfer loop on GDM login.
  - tlog-play: add journal namespace support.
  - tlitest: extend delay for limit-action delay test.


author: Justin Stephenson <jstephen@redhat.com> - 12.1
changelog:
  - Exit transfer loop when output fd is closed
  - Revert "Prevent infinite transfer loop on GDM login"


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-10
changelog:
  - Resolves: #2210630 CVE-2023-28709 tomcat
  - Resolves: #2181448 CVE-2023-28708 tomcat: not including the secure attribute causes information disclosure


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-16
changelog:
  - Resolves: RHEL-12543 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
  - Remove JDK subpackges which are unused


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-28
changelog:
  - Resolves: RHEL-13907
  - Resolves: RHEL-13904
  - Resolves: RHEL-12951
  - Resolves: RHEL-12544
  - Resolves: RHEL-2386


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-6
changelog:
  - Resolves: #2173874 Tomcat installs older java even though newer java is installed
  - Sync with rhel-8.8.0 branch


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-7
changelog:
  - Related: #2173874 Tomcat installs older java even though newer java is installed
  - Bump release number


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-10
changelog:
  - Resolves: #2210630 CVE-2023-28709 tomcat
  - Resolves: #2181448 CVE-2023-28708 tomcat: not including the secure attribute causes information disclosure
  - tomcat: Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)
    tomcat: JsonErrorReportValve injection (CVE-2022-45143)
    tomcat: request smuggling (CVE-2022-42252)
    tomcat: local privilege escalation vulnerability (CVE-2022-23181)


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-16
changelog:
  - Resolves: RHEL-12543
    tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  - Remove JDK subpackges which are unused


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-27
changelog:
  - Related: RHEL-12543
    tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  - Bump release number


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-28
changelog:
  - Resolves: RHEL-13907
    tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)
  - Resolves: RHEL-13904
    tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)
  - Resolves: RHEL-12951
    tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)
  - Resolves: RHEL-12544
    tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  - Resolves: RHEL-2386
    tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-29
changelog:
  - Resolves: RHEL-17602
    tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)
  - tomcat: Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)


author: Sokratis Zappis <szappis@redhat.com> - 1:9.0.87-1.el8_10.1
changelog:
  - Resolves: RHEL-38548 - Amend tomcat package's changelog so that fixed CVEs are mentioned explicitly
  - Resolves: RHEL-35813 - Rebase tomcat to version 9.0.87
  - Resolves: RHEL-29255
    tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)
  - Resolves: RHEL-29250
    tomcat: Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.3
changelog:
  - Resolves: RHEL-82934
    tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
  - Resolves: RHEL-71708
    tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)


author: Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-1
changelog:
  - Update to 0.0.99.2
  - Make 'toolbox' create or fall back to a container if possible
  Resolves: #1914687
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-2
changelog:
  - Actually apply the patch to make 'toolbox' create or fall back to a
    container if possible
  - Support logging into a registry if necessary
  - Related: #1934415


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-2
changelog:
  - Update to 0.0.99.3
  - BuildRequire only systemd-rpm-macros as recommended by the Fedora packaging
    guidelines
  - Update the Summary to match upstream
  - Update the URL to point to the website
  Resolves: #2115089


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-3
changelog:
  - Rebuild for CVE-2022-41723, CVE-2023-24534, CVE-2023-24536 and
    CVE-2023-24538
  Resolves: #2187343, #2187363, #2203694


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-3
changelog:
  - Rebuild for CVE-2022-41723, CVE-2023-24534, CVE-2023-24536 and
    CVE-2023-24538
  Resolves: #2187345, #2187368, #2203690


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-7
changelog:
  - Rebuild for CVE-2023-29406, CVE-2023-39318 and CVE-2023-39319
  Resolves: RHEL-4231, RHEL-4475, RHEL-4502


author: Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-2
changelog:
  - Update to 0.0.99.3
  - BuildRequire only systemd-rpm-macros as recommended by the Fedora packaging
    guidelines
  - Update the Summary to match upstream
  - Update the URL to point to the website
  Resolves: #2047290


author: Honggang Li <honli@redhat.com> - 4.2.10-25
changelog:
  - Rebase to latest Fedora release
  - Fix file conflicts in torque-devel multilib packages
  - Resolve: bz1853167


author: Jan Vcelak <jvcelak@redhat.com> 2.1.0-1
changelog:
  - new release:
    - daemon: allow running without selected profile
    - daemon: fix profile merging, allow only safe characters in profile names
    - daemon: implement missing methods in DBus interface
    - daemon: implement profile recommendation
    - daemon: improve daemonization, PID file handling
    - daemon: improved device matching in profiles, negation possible
    - daemon: various internal improvements
    - executables: check for EUID instead of UID
    - executables: run python with -Es to increase security
    - plugins: cpu - fix cpupower execution
    - plugins: disk - fix option setting
    - plugins: mounts - new, currently supports only barriers control
    - plugins: sysctl - fix a bug preventing settings application
    - powertop2tuned: speedup, fix crashes with non-C locales
    - powertop2tuned: support for powertop 2.2 output
    - profiles: progress on replacing scripts with plugins
    - tuned-adm: bash completion - suggest profiles from all supported locations
    - tuned-adm: complete switch to D-bus
    - tuned-adm: full control to users with physical access


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.1.2-1
changelog:
  - new release:
    - systemtap {disk,net}devstat: fix typo in usage
    - switched to configobj parser
    - latency-performance: disabled THP
    - fixed fd leaks on subprocesses


author: Jan Vcelak <jvcelak@redhat.com> 2.2.0-1
changelog:
  - new release:
    - remove nobarrier from virtual-guest (data loss prevention)
    - devices enumeration via udev, instead of manual retrieval
    - support for dynamically inserted devices (currently disk plugin)
    - dropped rfkill plugins (bluetooth and wifi), the code didn't work


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.2.1-1
changelog:
  - new release:
    - audio plugin: fixed error handling in _get_timeout
    - removed cpupower dependency, added sysfs fallback
    - powertop2tuned: fixed parser crash on binary garbage
      resolves: rhbz#914933
    - cpu plugin: dropped multicore_powersave as kernel upstream already did
    - plugins: options manipulated by dynamic tuning are now correctly saved and restored
    - powertop2tuned: added alias -e for --enable option
    - powertop2tuned: new option -m, --merge-profile to select profile to merge
    - prefer transparent_hugepage over redhat_transparent_hugepage
    - recommend: use recommend.conf not autodetect.conf
    - tuned.service: switched to dbus type service
      resolves: rhbz#911445
    - tuned: new option --pid, -P to write PID file
    - tuned, tuned-adm: added new option --version, -v to show version
    - disk plugin: use APM value 254 for cleanup / APM disable instead of 255
      resolves: rhbz#905195
    - tuned: new option --log, -l to select log file
    - powertop2tuned: avoid circular deps in include (one level check only)
    - powertop2tuned: do not crash if powertop is not installed
    - net plugin: added support for wake_on_lan static tuning
      resolves: rhbz#885504
    - loader: fixed error handling
    - spec: used systemd-rpm macros
      resolves: rhbz#850347


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.2.2-1
changelog:
  - new-release:
    - cpu plugin: fixed cpupower workaround
    - cpu plugin: fixed crash if cpupower is installed


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3.0-1
changelog:
  - new-release
    resolves: rhbz#1020743
    - audio plugin: fixed audio settings in standard profiles
      resolves: rhbz#1019805
    - video plugin: fixed tunings
    - daemon: fixed crash if preset profile is not available
      resolves: rhbz#953128
    - man: various updates and corrections
    - functions: fixed usb and bluetooth handling
    - tuned: switched to lightweighted pygobject3-base
    - daemon: added global config for dynamic_tuning
      resolves: rhbz#1006427
    - utils: added pmqos-static script for debug purposes
      resolves: rhbz#1015676
    - throughput-performance: various fixes
      resolves: rhbz#987570
    - tuned: added global option update_interval
    - plugin_cpu: added support for x86_energy_perf_policy
      resolves: rhbz#1015675
    - dbus: fixed KeyboardInterrupt handling
    - plugin_cpu: added support for intel_pstate
      resolves: rhbz#996722
    - profiles: various fixes
      resolves: rhbz#922068
    - profiles: added desktop profile
      resolves: rhbz#996723
    - tuned-adm: implemented non DBus fallback control
    - profiles: added sap profile
    - tuned: lowered CPU usage due to python bug
      resolves: rhbz#917587


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3.0-2
changelog:
  - fixed race condition in the start/stop code
    resolves: rhbz#1028119
  - improved tuned responsiveness
    resolves: rhbz#1028122


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.4.0-1
changelog:
  - new-release
    resolves: rhbz#1093883
    - fixed traceback if profile cannot be loaded
      related: rhbz#953128
    - powertop2tuned: fixed traceback if rewriting file instead of dir
      resolves: rhbz#963441
    - throughput-performance: altered dirty ratios for better performance
      resolves: rhbz#1043533
    - latency-performance: leaving THP on its default
      resolves: rhbz#1064510
    - used throughput-performance profile on server by default
      resolves: rhbz#1063481
    - network-latency: added new profile
      resolves: rhbz#1052418
    - network-throughput: added new profile
      resolves: rhbz#1052421
    - recommend.conf: fixed config file
      resolves: rhbz#1069123
    - systemd: added cpupower.service conflict
      resolves: rhbz#1073392
    - balanced: used medium_power ALPM policy
    - added support for >, < assignment modifiers in tuned.conf
    - handled root block devices
    - balanced: used conservative CPU governor
      resolves: rhbz#1124125
    - plugins: added selinux plugin
    - plugin_net: added nf_conntrack_hashsize parameter
    - profiles: added atomic-host profile
      resolves: rhbz#1091977
    - profiles: added atomic-guest profile
      resolves: rhbz#1091979
    - moved profile autodetection from post install script to tuned daemon
      resolves: rhbz#1144067
    - profiles: included sap-hana and sap-hana-vmware profiles
    - man: structured profiles manual pages according to sub-packages
    - added missing hdparm dependency
      resolves: rhbz#1144858
    - improved error handling of switch_profile
      resolves: rhbz#1068699
    - tuned-adm: active: detect whether tuned deamon is running
      related: rhbz#1068699
    - removed active_profile from RPM verification
      resolves: rhbz#1104126
    - plugin_disk: readahead value can be now specified in sectors
      resolves: rhbz#1127127
    - plugins: added bootloader plugin
      resolves: rhbz#1044111
    - plugin_disk: added error counter to hdparm calls
    - plugins: added scheduler plugin
      resolves: rhbz#1100826
    - added tuned-gui


