# changelog

author: Thomas Woerner <twoerner@redhat.com> - 0.4.4-1
changelog:
  - Fix dist-check
  - src/Makefile.am: Install new helper files
  - config/Makefile.am: Install helpers
  - Merged translations
  - Updated translations from zanata
  - firewalld.spec: Adapt requires for PyQt5
  - firewall-applet: Fix fromUTF8 for python2 PyQt5 usage
  - firewall-applet: Use PyQt5
  - firewall-config: New nf_conntrack_select dialog, use nf_conntrack_helpers D-Bus property
  - shell-completion/bash/firewall-cmd: Updates for helpers and also some fixes
  - src/tests/firewall-[offline-]cmd_test.sh: New helper tests, adapted module tests for services
  - doc/xml/seealso.xml: Add firewalld.helper(5) man page
  - doc/xml/seealso.xml: Add firewalld.ipset(5) man page
  - Fixed typo in firewalld.ipset(5) man page
  - Updated firewalld.dbus(5) man page
  - New firewalld.helper(5) man page
  - doc/xml/firewall-offline-cmd.xml: Updated firewall-offline-cmd man page
  - doc/xml/firewall-cmd.xml: Updated firewall-cmd man page
  - firewall-offline-cmd: New support for helpers
  - firewall-cmd: New support for helpers
  - firewall.command: New check_helper_family, check_module and print_helper_info methods
  - firewall.core.fw_test: Add helpers also to offline backend
  - firewall.server.config: New AutomaticHelpers property (rw)
  - firewall.server.config: Fix an dict size changed error for firewall.conf file changes
  - firewall.server.config: Make LogDenied property readwrite to be consistent
  - Some renames of nf_conntrack_helper* functions and structures, helpers is a dict
  - firewall.core.fw: Properly check helper setting in set_automatic_helpers
  - firewall.errors: Add missing BUILTIN_HELPER error code
  - No extra interface for helpers needed in runtime, dropped DBUS_INTERFACE_HELPER
  - firewall.server.firewalld: Drop unused queryHelper D-Bus method
  - New helpers Q.931 and RAS from nf_conntrack_h323
  - firewall.core.io.helper: Allow dots in helper names, remove underscore
  - firewall.core.io.firewalld_conf: Fixed typo in FALLBACK_AUTOMATIC_HELPERS
  - firewall-[offline-]cmd: Use sys.excepthook to force exception_handler usage always
  - firewall.core.fw_config: new_X methods should also check builtins
  - firewall.client: Set helper family to "" if None
  - firewall.client: Add missing module string to FirewallClientHelperSettings.settings
  - config/firewalld.conf: Add possible values description for AutomaticHelpers
  - helpers/amanda.xml: Fix typo in helper module
  - firewall-config: Added support for helper module setting
  - firewall.client: Added support for helper module setting
  - firewall.server.config_helper: Added support for helper module setting
  - firewall.core.io.service, firewall.server.config_service: Only replace underscore by dash if module start with nf_conntrack_
  - firewall.core.fw_zone: Use helper module instead of a generated name from helper name
  - helpers: Added kernel module
  - firewall.core.io.helper: Add module to helper
  - firewall-cmd: Removed duplicate --get-ipset-types from help output
  - firewall.core.fw_zone: Add zone bingings for PREROUTING in the raw table
  - firewall.core.ipXtables: Add PREROUTING default rules for zones in raw table
  - firewall-config: New support to handle helpers, new dialogs, new helper tab, ..
  - config/org.fedoraproject.FirewallConfig.gschema.xml.in: New show-helpers setting
  - firewall.client: New helper management for runtime and permanent configuration
  - firewall.server.firewalld: New runtime helper management, new nf_conntrack_helper property
  - firewall.server.config_service: Fix module name handling (no nf_conntrack_ prefix needed)
  - firewall.server.config: New permanent D-Bus helper management
  - New firewall.server.config_helper to provide the permanent D-Bus interface for helpers
  - firewall.core.fw_zone: Use helpers fw.nf_conntrack_helper for services using helpers
  - firewall.core.fw: New helper management, new _automatic_helpers and nf_conntrack_helper settings
  - firewall.core.fw_config: Add support for permanent helper handling
  - firewall.core.io.service: The module does not need to start with nf_conntrack_ anymore
  - firewall.functions: New functions to get and set nf_conntrack_helper kernel setting
  - firewall.core.io.firewalld_conf: New support for AutomaticHelpers setting
  - firewall.config.dbus: New D-Bus definitions for helpers, new DBUS_INTERFACE_REVISION 12
  - New firewall.core.fw_helper providing FirewallHelper backend
  - New firewall.core.helper with HELPER_MAXNAMELEN definition
  - config/firewalld.conf: New AutomaticHelpers setting with description
  - firewall.config.__init__.py.in: New helpers variables
  - firewalld.spec: Add new helpers directory
  - config/Makefile.am: Install new helpers
  - New helper configuration files for amanda, ftp, irc, netbios-ns, pptp, sane, sip, snmp and tftp
  - firewall.core.io.helper: New IO handler for netfilter helpers
  - firewall.errors: New INVALID_HELPER error code
  - firewall.core.io.ifcfg: Use .bak for save files
  - firewall-config: Set internal log_denied setting after changing
  - firewall.server.config: Copy props before removing items
  - doc/xml/firewalld.ipset: Replaced icmptype name remains with ipset
  - firewall.core.fw_zone: Fix LOG rule placement for LogDenied
  - firewall.command: Use "source-ports" in print_zone_info
  - firewall.core.logger: Use syslog.openlog() and syslog.closelog()
  - firewall-[offline-]cmd man pages: Document --path-{zone,icmptype,ipset,service}
  - firewall-cmd: Enable --path-{zone,icmptype,service} options again
  - firewall.core.{ipXtables,ebtables}: Copy rule before extracting items in set_rules
  - firewall.core.fw: Do not abort transaction on failed ipv6_rpfilter rules
  - config/Makefile.am: Added cfengine, condor-collector and smtp-submission services
  - Makefile.am: New dist-check used in the archive target
  - src/Makefile.am: Reordered nobase_dist_python_DATA to be sorted
  - config/Makefile.am: New CONFIG_FILES variable to contain the config files
  - Merge pull request #150 from hspaans/master
  - Merge pull request #146 from canvon/bugfix/spelling
  - Merge pull request #145 from jcpunk/condor
  - Command line tools man pages: New section about sequence options and exit codes
  - Creating service file for SMTP-Submission.
  - Creating service file for CFEngine.
  - Fix typo in documentation: iptables mangle table
  - Only use sort on lists of main items, but not for item properties
  - firewall.core.io.io_object: import_config should not change ordering of lists
  - firewall.core.fw_transaction: Load helper modules in FirewallZoneTransaction
  - firewall.command: Fail with NOT_AUTHORIZED if authorization fails (RHBZ#1368549)
  - firewall.command: Fix sequence exit code with at least one succeeded item
  - Add condor collector service
  - firewall-cmd: Fixed --{get,set}-{description,short} for permanent zones
  - firewall.command: Do not use error code 254 for {ALREADY,NOT}_ENABLED sequences


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.1-1
changelog:
  - firewall-config: Use proper source check in sourceDialog (fixes issue#162)
  - firewallctl: New support for helpers
  - Translation updates


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.2-1
changelog:
  - New firewalld-selinux sub package delivering the SELinux policy module for
    firewalld (RHBZ#1396765) (RHBZ#1394625) (RHBZ#1394578) (RHBZ#1394573)
    (RHBZ#1394569)
  - New firewalld release 0.4.4.2:
    - firewalld.spec: Added helpers and ipsets paths to firewalld-filesystem
    - firewall.core.fw_nm: create NMClient lazily
    - Do not use hard-coded path for modinfo, use autofoo to detect it
    - firewall.core.io.ifcfg: Dropped invalid option warning with bad format
      string
    - firewall.core.io.ifcfg: Properly handle quoted ifcfg values
    - firewall.core.fw_zone: Do not reset ZONE with ifdown
    - Updated translations from zanata
    - firewall-config: Extra grid at bottom to visualize firewalld settings


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.2-2
changelog:
  - Dropping firewalld-selinux package again as the required fix made it into
    selinux-policy packages for F-23+, updated selinux-policy version conflicts


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.3-1
changelog:
  - Rebase to firewalld-0.4.4.3
    http://www.firewalld.org/2017/02/firewalld-0-4-4-3-release
  - Speed up of large file loading
  - Support for more ipset types
  - Speed up of adding or removing entries for ipsets from files
  - Support icmp-type usage in rich rules
  - Support for more icmp types
  - Support for h323 conntrack helper
  - New services
  - Code cleanup and several other bug fixes
  - Translation updates


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.4-1
changelog:
  - Rebase to firewalld-0.4.4.4
    http://www.firewalld.org/2017/03/firewalld-0-4-4-4-release
  - Drop references to fedorahosted.org from spec file and Makefile.am, use
    archive from github
  - Fix inconsistent ordering of rules in INPUT_ZONE_SOURCE (issue#166)
  - Fix ipset overloading from /etc/firewalld/ipsets
  - Fix permanent rich rules using icmp-type elements (RHBZ#1434594)
  - firewall-config: Deactivate edit, remove, .. buttons if there are no items
  - Check if ICMP types are supported by kernel before trying to use them
  - firewall-config: Show invalid ipset type in the ipset configuration dialog
    in a special label


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.5-1
changelog:
  - Rebase to firewalld-0.4.4.5
    http://www.firewalld.org/2017/06/firewalld-0-4-4-5-release
    - Fix build from spec
    - Fix –remove-service-from-zone option (RHBZ#1438127)
    - Support sctp and dccp in ports, source-ports, forward-ports, helpers and
      rich rules (RHBZ#1429808)
    - firewall-cmd: Fix –{set,get}-{short,description} for zone (RHBZ#1445238)
    - firewall.core.ipXtables: Use new wait option for restore commands if
      available
    - New services for oVirt:
      ctdb, ovirt-imageio, ovirt-storageconsole, ovirt-vmconsole and nrpe
    - Rename extension for policy choices (server and desktop) to .policy.choice
      (RHBZ#1449754)
    - D-Bus interfaces: Fix GetAll for interfaces without properties
      (RHBZ#1452017)
    - Load NAT helpers with conntrack helpers (RHBZ#1452681)
    - Translation updates
  - Additional upstream patches:
    - Rich-rule source validation (d69b7cb)
    - IPv6 ICMP type only rich-rule fix (cf50bd0)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.4.4.5-4
changelog:
  - Python 2 binary package renamed to python2-firewall
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Eric Garver <egarver@redhat.com> - 0.6.1-4
changelog:
  - backports for new failed state if startup fails
  - backports to use explicit RETURN on user defined ebtables chains
  - backports to fix nftables AUDIT log support


author: Eric Garver <egarver@redhat.com> - 0.6.1-5
changelog:
  - python3-firewalld can get by with python3-gobject-base
  - firewall-config can get by with python3-qt5-base


author: Eric Garver <egarver@redhat.com> - 0.6.3-4
changelog:
  - backport recent stable fixes
  - backport fix for lost NM interfaces during reload
  - backport rich rule priorities
  - backport fix for set entries not applied
  - update translations


author: Eric Garver <egarver@redhat.com> - 0.7.0-3
changelog:
  - backport patch to show service includes in service output
  - backport patches to fix dbus API break


author: Eric Garver <egarver@redhat.com> - 0.8.2-2
changelog:
  - fix(cli): add ipset type hash:mac is incompatible with the family parameter
  - fix(cli): add --zone is an invalid option with --direct
  - fix: update dynamic DCE RPC ports in freeipa-trust service
  - fix: core: rich: Catch ValueError on non-numeric priority values
  - fix(rich): icmptypes with one family
  - fix(direct): rule in a zone chain
  - plus additional upstream stable fixes


author: Eric Garver <egarver@redhat.com> - 0.8.2-3
changelog:
  - fix(nftables): packet marks with masks
  - fix(nftables): icmp types with code == 0
  - fix(rich icmptype): verify rule and icmptype families
  - fix(zone): cache rule_str for rich rules
  - improvement(service): IPsec: Update description and add TCP port 4500
  - feat(service): add collectd service
  - feat(service): Add rpc-rquotad.service


author: Adam Jackson <ajax@redhat.com> - 0.11.7-2
changelog:
  - Remove Requires: kernel >= 4.0.4-202, which corresponds to rawhide
    somewhere before Fedora 22 which this spec file certainly no longer
    supports.


author: Kalev Lember <klember@redhat.com> - 1.12.9-2
changelog:
  - Backport upstream patches for CVE-2024-42472
  - Require bubblewrap version that has new --bind-fd option backported for
    addressing CVE-2024-42472


author: Fabio Alessandro Locati <fale@redhat.com> - 4.6.2-1
changelog:
  - Update to 4.6.1
  - Update the brand icons list using a new script
  - Add the script to create brand icons list


author: José Expósito <jexposit@redhat.com> - 3.0.0-9
changelog:
  - Fix CVE-2024-24258 and CVE-2024-24259
    Resolves: https://issues.redhat.com/browse/RHEL-25175
    Resolves: https://issues.redhat.com/browse/RHEL-25177


author: Antonio Torres <antorres@redhat.com> - 3.0.20-13
changelog:
  - Fix multiple CVEs
  - Add rpminspect configuration
    Resolves: #2151702
    Resolves: #2151704
    Resolves: #2151706


author: Thomas Woerner <twoerner@redhat.com>
changelog:
  - removed la files, removed devel package
  - split into 4 packages: freeradius, freeradius-mysql, freeradius-postgresql,
      freeradius-unixODBC
  - fixed requires and buildrequires
  - create logging dir in post if it does not exist
  - fixed module load without la files


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.0-2.2
changelog:
  - modify default PAM configuration to remove the directory part of the module
    name, so that 32- and 64-bit libpam (called from 32- or 64-bit radiusd) on
    multilib systems will always load the right module for the architecture
  - modify default PAM configuration to use pam_stack


author: Thomas Woerner <twoerner@redhat.com> 1.0.0-0.pre3.2
changelog:
  - added buildrequires for zlib-devel (#127162)
  - fixed libdir patch to prefer own libeap instead of installed one (#127168)
  - fixed samba account maps in LDAP for samba v3 (#127173)


author: Thomas Woerner <twoerner@redhat.com> 1.0.4-2
changelog:
  - added missing build requires for libtool-ltdl-devel (#160877)
  - modified file list to get a report for missing plugins


author: Thomas Woerner <twoerner@redhat.com> 1.1.1-1
changelog:
  - new version 1.1.1
  - fixed incorrect rlm_sql globbing (#189095)
    Thanks to Yanko Kaneti for the fix.
  - fixed chown syntax in post script (#182777)
  - dropped gcc34, libdir and realloc-return patch
  - spec file cleanup with additional libtool build fixes


author: Karsten Hopp <karsten@redhat.com> 1.1.3-3
changelog:
  - remove trailing dot from summary
  - fix buildroot
  - fix post/postun/preun requirements
  - use rpm macros


author: Thomas Woerner <twoerner@redhat.com> 1.1.5-1
changelog:
  - new version 1.1.5
    - no /etc/raddb/otppasswd.sample anymore
    - build is pie by default, dropped pie patch
  - fixed build requirement for perl (perl-devel)


author: Thomas Woerner <twoerner@redhat.com> 1.1.6-2
changelog:
  - radiusd expects /etc/raddb to not be world readable or writable
    /etc/raddb now belongs to radiusd, post script sets permissions


author: Thomas Woerner <twoerner@redhat.com> 1.1.7-1
changelog:
  - new versin 1.1.7
  - install snmp MIB files
  - dropped LDAP_DEPRECATED flag, it is upstream
  - marked config files for sub packages as config (rhbz#240400)
  - moved db files to /var/lib/raddb (rhbz#199082)


author: <jdennis@redhat.com> - 1.1.7-3.3.ipa
changelog:
  - add support in rlm_ldap for reading clients from ldap
  - fix TLS parameter controling if a cert which fails to validate
    will be accepted (i.e. self-signed),
    rlm_ldap config parameter=tls_require_cert
    ldap LDAP_OPT_X_TLS_REQUIRE_CERT parameter was being passed to
    ldap_set_option() when it should have been ldap_int_tls_config()


author: John Dennis <jdennis@redhat.com> - 2.0.3-1
changelog:
  - Upgrade to current upstream 2.0.3 release
  - Many thanks to Enrico Scholz for his spec file suggestions incorporated here
  - Resolve: bug #438665: Contains files owned by buildsystem
  - Add dialupadmin-mysql, dialupadmin-postgresql, dialupadmin-ldap subpackages
    to further partition external dependencies.
  - Clean up some unnecessary requires dependencies
  - Add versioned requires between subpackages


author: John Dennis <jdennis@redhat.com> - 2.0.3-2
changelog:
  - remove support for radrelay, it's different now
  - turn off default inclusion of SQL config files in radiusd.conf since SQL
    is an optional RPM install
  - remove mssql config files


author: John Dennis <jdennis@redhat.com> - 2.0.4-1
changelog:
  - upgrade to latest upstream, see Changelog for details
  - resolves: bug #447545: freeradius missing /etc/raddb/sites-available/inner-tunnel


author: John Dennis <jdennis@redhat.com> - 2.0.5-1
changelog:
  - upgrade to latest upstream, see Changelog for details,
    upstream now has more complete fix for bug #447545, local patch removed


author: John Dennis <jdennis@redhat.com> - 2.0.5-2
changelog:
  - Resolves: bug #453761: FreeRADIUS %post should not include chown -R
    specify file attributes for /etc/raddb/ldap.attrmap
    fix consistent use of tabs/spaces (rpmlint warning)


author: John Dennis <jdennis@redhat.com> - 2.1.1-1
changelog:
  - Resolves: bug #464119 bootstrap code could not create initial certs in /etc/raddb/certs because
    permissions were 750, radiusd running as euid radiusd could not write there, permissions now 770


author: John Dennis <jdennis@redhat.com> - 2.1.1-3
changelog:
  - make spec file buildable on RHEL5.2 by making perl-devel a fedora only dependency.
  - remove diaupadmin packages, it's not well supported and there are problems with it.


author: John Dennis <jdennis@redhat.com> - 2.1.1-8
changelog:
  - add --with-system-libtool to configure as a workaround for
  undefined reference to lt__PROGRAM__LTX_preloaded_symbols


author: John Dennis <jdennis@redhat.com> - 2.1.3-1
changelog:
  - upgrade to latest upstream release, upstream summary follows:
    The focus of this release is stability.
    Feature Improvements:
      * Allow running with "user=radiusd" and binding to secure sockets.
      * Start sending Status-Server "are you alive" messages earlier, which
        helps with proxying multiple realms to a home server.
      * Removed thread pool code from rlm_perl.  It's not necessary.
      * Added example Perl configuration to raddb/modules/perl
      * Force OpenSSL to support certificates with SHA256. This seems to be
        necessary for WiMAX certs.
    Bug fixes:
      * Fix Debian patch to allow it to build.
      * Fix potential NULL dereference in debugging mode on certain
        platforms for TTLS and PEAP inner tunnels.
      * Fix uninitialized memory in handling of vendor definitions
      * Fix parsing of quoted (but non-string) attributes in the "users" file.
      * Initialize uknown NAS IP to 255.255.255.255, rather than 0.0.0.0
      * use SUN_LEN in control socket, to avoid truncation on some platforms.
      * Correct internal handling of "debug condition" to prevent it from
        being over-written.
      * Check return code of regcomp in "unlang", so that invalid regular
        expressions are caught rather than mishandled.
      * Make rlm_sql use <ltdl.h>.  Addresses bug #610.
      * Document list "type = status" better.  Closes bug #580.
      * Set "default days" for certificates, because OpenSSL won't do it.
        This closes bug #615.
      * Reference correct list in example raddb/modules/ldap. Closes #596.
      * Increase default schema size for Acct-Session-Id to 64. Closes #540.
      * Fix use of temporary files in dialup-admin.  Closes #605 and
        addresses CVE-2008-4474.
      * Addressed a number of minor issues found by Coverity.
      * Added DHCP option 150 to the dictionary.  Closes #618.


author: John Dennis <jdennis@redhat.com> - 2.1.6-1
changelog:
  - update to latest upstream release, from upstream Changelog:
    Feature improvements
      * radclient exits with 0 on successful (accept / ack), and 1
        otherwise (no response / reject)
      * Added support for %{sql:UPDATE ..}, and insert/delete
        Patch from Arran Cudbard-Bell
      * Added sample "do not respond" policy.  See raddb/policy.conf
        and raddb/sites-available/do_not_respond
      * Cleanups to Suse spec file from Norbert Wegener
      * New VSAs for Juniper from Bjorn Mork
      * Include more RFC dictionaries in the default install
      * More documentation for the WiMAX module
      * Added "chase_referrals" and "rebind" configuration to rlm_ldap.
        This helps with Active Directory.  See raddb/modules/ldap
      * Don't load pre/post-proxy if proxying is disabled.
      * Added %{md5:...}, which returns MD5 hash in hex.
      * Added configurable "retry_interval" and "poll_interval"
        for "detail" listeners.
      * Added "delete_mppe_keys" configuration option to rlm_wimax.
        Apparently some WiMAX clients misbehave when they see those keys.
      * Added experimental rlm_ruby from
        http://github.com/Antti/freeradius-server/tree/master
      * Add Tunnel attributes to ldap.attrmap
      * Enable virtual servers to be reloaded on HUP.  For now, only
        the "authorize", "authenticate", etc. processing sections are
        reloaded.  Clients and "listen" sections are NOT reloaded.
      * Updated "radwatch" script to be more robust.  See scripts/radwatch
      * Added certificate compatibility notes in raddb/certs/README,
        for compatibility with different operating systems. (i.e. Windows)
      * Permit multiple "-e" in radmin.
      * Add support for originating CoA-Request and Disconnect-Request.
        See raddb/sites-available/originate-coa.
      * Added "lifetime" and "max_queries" to raddb/sql.conf.
        This helps address the problem of hung SQL sockets.
      * Allow packets to be injected via radmin.  See "inject help"
        in radmin.
      * Answer VMPS reconfirmation request.  Patch from Hermann Lauer.
      * Sample logrotate script in scripts/logrotate.freeradius
      * Add configurable poll interval for "detail" listeners
      * New "raddebug" command.  This prints debugging information from
        a running server.  See "man raddebug.
      * Add "require_message_authenticator" configuration to home_server
        configuration.  This makes the server add Message-Authenticator
        to all outgoing Access-Request packets.
      * Added smsotp module, as contributed by Siemens.
      * Enabled the administration socket in the default install.
        See raddb/sites-available/control-socket, and "man radmin"
      * Handle duplicate clients, such as with replicated or
        load-balanced SQL servers and "readclients = yes"
    Bug fixes
      * Minor changes to allow building without VQP.
      * Minor fixes from John Center
      * Fixed raddebug example
      * Don't crash when deleting attributes via unlang
      * Be friendlier to very fast clients
      * Updated the "detail" listener so that it only polls once,
        and not many times in a row, leaking memory each time...
      * Update comparison for Packet-Src-IP-Address (etc.) so that
        the operators other than '==' work.
      * Did autoconf magic to work around weird libtool bug
      * Make rlm_perl keep tags for tagged attributes in more situations
      * Update UID checking for radmin
      * Added "include_length" field for TTLS.  It's needed for RFC
        compliance, but not (apparently) for interoperability.
      * Clean up control sockets when they are closed, so that we don't
        leak memory.
      * Define SUN_LEN for systems that don't have it.
      * Correct some boundary conditions in the conditional checker ("if")
        in "unlang".  Bug noted by Arran Cudbard-Bell.
      * Work around minor building issues in gmake.  This should only
        have affected developers.
      * Change how we manage unprivileged user/group, so that we do not
        create control sockets owned by root.
      * Fixed more minor issues found by Coverity.
      * Allow raddb/certs/bootstrap to run when there is no "make"
        command installed.
      * In radiusd.conf, run_dir depends on the name of the program,
        and isn't hard-coded to "..../radiusd"
      * Check for EOF in more places in the "detail" file reader.
      * Added Freeswitch dictionary.
      * Chop ethernet frames in VMPS, rather than droppping packets.
      * Fix EAP-TLS bug.  Patch from Arnaud Ebalard
      * Don't lose string for regex-compares in the "users" file.
      * Expose more functions in rlm_sql to rlm_sqlippool, which
        helps on systems where RTLD_GLOBAL is off.
      * Fix typos in MySQL schemas for ippools.
      * Remove macro that was causing build issues on some platforms.
      * Fixed issues with dead home servers.  Bug noted by Chris Moules.
      * Fixed "access after free" with some dynamic clients.

  - fix packaging bug, some directories missing execute permission
    /etc/raddb/dictionary now readable by all.


author: John Dennis <jdennis@redhat.com> - 2.1.7-1
changelog:
  - enable building of the rlm_wimax module
  - pcap wire analysis support is enabled and available in utils subpackage
  - Resolves bug #523053 radtest manpage in wrong package
  - update to latest upstream release, from upstream Changelog:
    Feature improvements
      * Full support for CoA and Disconnect packets as per RFC 3576
        and RFC 5176.  Both receiving and proxying CoA is supported.
      * Added "src_ipaddr" configuration to "home_server".  See
        proxy.conf for details.
      * radsniff now accepts -I, to read from a filename instead of
        a device.
      * radsniff also prints matching requests and any responses to those
        requests when '-r' is used.
      * Added example of attr_filter for Access-Challenge packets
      * Added support for udpfromto in DHCP code
      * radmin can now selectively mark modules alive/dead.
        See "set module state".
      * Added customizable messages on login success/fail.
        See msg_goodpass && msg_badpass in log{} section of radiusd.conf
      * Document "chase_referrals" and "rebind" in raddb/modules/ldap
      * Preliminary implementation of DHCP relay.
      * Made thread pool section optional.  If it doesn't exist,
        the server will run single-threaded.
      * Added sample radrelay.conf for people upgrading from 1.x
      * Made proxying more stable by failing over, rather than
        rejecting the first request.  See "response_window" in proxy.conf
      * Allow home_server_pools to exist without realms.
      * Add dictionary.iea (closes bug #7)
      * Added support for RFC 5580
      * Added experimental sql_freetds module from Gabriel Blanchard.
      * Updated dictionary.foundry
      * Added sample configuration for MySQL cluster in raddb/sql/ndb
        See the README file for explanations.
    Bug fixes
      * Fixed corner case where proxied packets could have extra
        character in User-Password attribute.  Fix from Niko Tyni.
      * Extended size of "attribute" field in SQL to 64.
      * Fixes to ruby module to be more careful about when it builds.
      * Updated Perl module "configure" script to check for broken
        Perl installations.
      * Fix "status_check = none".  It would still send packets
        in some cases.
      * Set recursive flag on the proxy mutex, which enables safer
        cleanup on some platforms.
      * Copy the EAP username verbatim, rather than escaping it.
      * Update handling so that robust-proxy-accounting works when
        all home servers are down for extended periods of time.
      * Look for DHCP option 53 anywhere in the packet, not just
        at the start.
      * Fix processing of proxy fail handler with virtual servers.
      * DHCP code now prints out correct src/dst IP addresses
        when sending packets.
      * Removed requirement for DHCP to have clients
      * Fixed handling of DHCP packets with message-type buried in the packet
      * Fixed corner case with negation in unlang.
      * Minor fixes to default MySQL & PostgreSQL schemas
      * Suppress MSCHAP complaints in debugging mode.
      * Fix SQL module for multiple instance, and possible crash on HUP
      * Fix permissions for radius.log for sites that change user/group,
        but which don't create the file before starting radiusd.
      * Fix double counting of packets when proxying
      * Make %l work
      * Fix pthread keys in rlm_perl
      * Log reasons for EAP failure (closes bug #8)
      * Load home servers and pools that aren't referenced from a realm.
      * Handle return codes from virtual attributes in "unlang"
        (e.g. LDAP-Group).  This makes "!(expr)" work for them.
      * Enable VMPS to see contents of virtual server again
      * Fix WiMAX module to be consistent with examples.  (closes bug #10)
      * Fixed crash with policies dependent on NAS-Port comparisons
      * Allowed vendor IDs to be be higher than 32767.
      * Fix crash on startup with certain regexes in "hints" file.
      * Fix crash in attr_filter module when packets don't exist
      * Allow detail file reader to be faster when "load_factor = 100"
      * Add work-around for build failures with errors related to
        lt__PROGRAM__LTX_preloaded_symbols.  libltdl / libtool are horrible.
      * Made ldap module "rebind" option aware of older, incompatible
        versions of OpenLDAP.
      * Check value of Fall-Through in attr_filter module.


author: John Dennis <jdennis@redhat.com> - 2.1.7-3
changelog:
  - resolves: bug #522111 non-conformant initscript
    also change permission of /var/run/radiusd from 0700 to 0755
    so that "service radiusd status" can be run as non-root


author: John Dennis <jdennis@redhat.com> - 2.1.7-6
changelog:
  - more spec file clean up from review comments
  - remove freeradius-libs subpackage, move libfreeradius-eap and
    libfreeradius-radius into the main package
  - fix subpackage requires, change from freeradius-libs to main package
  - fix description of the devel subpackage, remove referene to non-shipped libs
  - remove execute permissions on src files included in debuginfo
  - remove unnecessary use of ldconfig
  - since all sub-packages now require main package remove user creation for sub-packages
  - also include the LGPL library license file in addition to the GPL license file
  - fix BuildRequires for perl so it's compatible with both Fedora, RHEL5 and RHEL6


author: John Dennis <jdennis@redhat.com> - 2.1.7-7
changelog:
  - Remove devel subpackage. It doesn't make much sense to have a devel package since
    we don't ship libraries and it produces multilib conflicts.


author: John Dennis <jdennis@redhat.com> - 2.1.8-1
changelog:
  - update to latest upstream
    Feature improvements
    * Print more descriptive error message for too many EAP sessions.
      This gives hints on what to do when "failed to store handler"
    * Commands received from radmin are now printed on stdout when
      in debugging mode.
    * Allow accounting packets to be written to a detail file, even
      if they were read from a different detail file.
    * Added OpenSSL license exception (src/LICENSE.openssl)

    Bug fixes
    * DHCP sockets can now set the broadcast flag before binding to a
      socket.  You need to set "broadcast = yes" in the DHCP listener.
    * Be more restrictive on string parsing in the config files
    * Fix password length in scripts/create-users.pl
    * Be more flexible about parsing the detail file.  This allows
      it to read files where the attributes have been edited.
    * Ensure that requests read from the detail file are cleaned up
      (i.e. don't leak) if they are proxied without a response.
    * Write the PID file after opening sockets, not before
      (closes bug #29)
    * Proxying large numbers of packets no longer gives error
      "unable to open proxy socket".
    * Avoid mutex locks in libc after fork
    * Retry packet from detail file if there was no response.
    * Allow old-style dictionary formats, where the vendor name is the
      last field in an ATTRIBUTE definition.
    * Removed all recursive use of mutexes.  Some systems just don't
      support this.
    * Allow !* to work as documented.
    * make templates work (see templates.conf)
    * Enabled "allow_core_dumps" to work again
    * Print better errors when reading invalid dictionaries
    * Sign client certificates with CA, rather than server certs.
    * Fix potential crash in rlm_passwd when file was closed
    * Fixed corner cases in conditional dynamic expansion.
    * Use InnoDB for MySQL IP Pools, to gain transactional support
    * Apply patch to libltdl for CVE-2009-3736.
    * Fixed a few issues found by LLVM's static checker
    * Keep track of "bad authenticators" for accounting packets
    * Keep track of "dropped packets" for auth/acct packets
    * Synced the "debian" directory with upstream
    * Made "unlang" use unsigned 32-bit integers, to match the
      dictionaries.


author: John Dennis <jdennis@redhat.com> - 2.1.8-2
changelog:
  - resolves: bug #526559 initial install should run bootstrap to create certificates
    running radiusd in debug mode to generate inital temporary certificates
    is no longer necessary, the /etc/raddb/certs/bootstrap is invoked on initial
    rpm install (not upgrade) if there is no existing /etc/raddb/certs/server.pem file
  - resolves: bug #528493 use sha1 algorithm instead of md5 during cert generation
    the certificate configuration (/etc/raddb/certs/{ca,server,client}.cnf) files
    were modifed to use sha1 instead of md5 and the validity reduced from 1 year to 2 months


author: John Dennis <jdennis@redhat.com> - 2.1.9-1
changelog:
  - update to latest upstream, mainly bug fix release
    Feature improvements
    * Add radmin command "stats detail <file>" to see what
      is going on inside of a detail file reader.
    * Added documentation for CoA.  See raddb/sites-available/coa
    * Add sub-option support for Option 82.  See dictionary.dhcp
    * Add "server" field to default SQL NAS table, and documented it.

    Bug fixes
    * Reset "received ping" counter for Status-Server checks.  In some
      corner cases it was not getting reset.
    * Handle large VMPS attributes.
    * Count accounting responses from a home server in SNMP / statistics
      code.
    * Set EAP-Session-Resumed = Yes, not "No" when session is resumed.
    * radmin packet counter statistics are now unsigned, for numbers
      2^31..2^32.  After that they roll over to zero.
    * Be more careful about expanding data in PAP and MS-CHAP modules.
      This prevents login failures when passwords contain '{'.
    * Clean up zombie children if there were many "exec" modules being
      run for one packet, all with "wait = no".
    * re-open log file after HUP.  Closes bug #63.
    * Fix "no response to proxied packet" complaint for Coa / Disconnect
      packets.  It shouldn't ignore replies to packets it sent.
    * Calculate IPv6 netmasks correctly.  Closes bug #69.
    * Fix SQL module to re-open sockets if they unexpectedly close.
    * Track scope for IPv6 addresses.  This lets us use link-local
      addresses properly.  Closes bug #70.
    * Updated Makefiles to no longer use the shell for recursing into
      subdirs.  "make -j 2" should now work.
    * Updated raddb/sql/mysql/ippool.conf to use "= NULL".  Closes
      bug #75.
    * Updated Makefiles so that "make reconfig" no longer uses the shell
      for recursing into subdirs, and re-builds all "configure" files.
    * Used above method to regenerate all configure scripts.
      Closes bug #34.
    * Updated SQL module to allow "server" field of "nas" table
      to be blank: "".  This means the same as it being NULL.
    * Fixed regex realm example.  Create Realm attribute with value
      of realm from User-Name, not from regex.  Closes bug #40.
    * If processing a DHCP Discover returns "fail / reject", ignore
      the packet rather than sending a NAK.
    * Allow '%' to be escaped in sqlcounter module.
    * Fix typo internal hash table.
    * For PEAP and TTLS, the tunneled reply is added to the reply,
      rather than integrated via the operators.  This allows multiple
      VSAs to be added, where they would previously be discarded.
    * Make request number unsigned.  This changes nothing other than
      the debug output when the server receives more than 2^31 packets.
    * Don't block when reading child output in 'exec wait'.  This means
      that blocked children get killed, instead of blocking the server.
    * Enabled building without any proxy functionality
    * radclient now prefers IPv4, to match the default server config.
    * Print useful error when a realm regex is invalid
    * relaxed rules for preprocess module "with_cisco_vsa_hack".  The
      attributes can now be integer, ipaddr, etc.  (i.e. non-string)
    * Allow rlm_ldap to build if ldap_set_rebind_proc() has only
      2 arguments.
    * Update configure script for rlm_python to avoid dynamic linking
      problems on some platforms.
    * Work-around for bug #35
    * Do suid to "user" when running in debug mode as root
    * Make "allow_core_dumps" work in more situations.
    * In detail file reader, treat bad records as EOF.
      This allows it to continue working when the disk is full.
    * Fix Oracle default accounting queries to work when there are no
      gigawords attributes.  Other databases already had the fix.
    * Fix rlm_sql to show when it opens and closes sockets.  It already
      says when it cannot connect, so it should say when it can connect.
    * "chmod -x" for a few C source files.
    * Pull update spec files, etc. from RedHat into the redhat/ directory.
    * Allow spaces when parsing integer values.  This helps people who
      put "too much" into an SQL value field.


author: John Dennis <jdennis@redhat.com> - 2.1.10-1
changelog:
  Feature improvements
    * Install the "radcrypt" program.
    * Enable radclient to send requests containing MS-CHAPv1
      Send packets with: MS-CHAP-Password = "password".  It will
      be automatically converted to the correct MS-CHAP attributes.
    * Added "-t" command-line option to radtest.  You can use "-t pap",
     "-t chap", "-t mschap", or "-t eap-md5".  The default is "-t pap"
    * Make the "inner-tunnel" virtual server listen on 127.0.0.1:18120
      This change and the previous one makes PEAP testing much easier.
    * Added more documentation and examples for the "passwd" module.
    * Added dictionaries for RFC 5607 and RFC 5904.
    * Added note in proxy.conf that we recommend setting
      "require_message_authenticator = yes" for all home servers.
    * Added example of second "files" configuration, with documentation.
      This shows how and where to use two instances of a module.
    * Updated radsniff to have it write pcap files, too.  See '-w'.
    * Print out large WARNING message if we send an Access-Challenge
      for EAP, and receive no follow-up messages from the client.
    * Added Cached-Session-Policy for EAP session resumption.  See
      raddb/eap.conf.
    * Added support for TLS-Cert-* attributes. For details, see
      raddb/sites-available/default, "post-auth" section.
    * Added sample raddb/modules/{opendirectory,dynamic_clients}
    * Updated Cisco and Huawei, HP, Redback, and ERX dictionaries.
    * Added RFCs 5607, 5904, and 5997.
    * For EAP-TLS, client certificates can now be validated using an
      external command.  See eap.conf, "validate" subsection of "tls".
    * Made rlm_pap aware of {nthash} prefix, for compatibility with
      legacy RADIUS systems.
    * Add Module-Failure-Message for mschap module (ntlm_auth)
    * made rlm_sql_sqlite database configurable.  Use "filename"
      in sql{} section.
    * Added %{tolower: ...string ... }, which returns the lowercase
      version of the string.  Also added %{toupper: ... } for uppercase.

    Bug fixes
    * Fix endless loop when there are multiple sub-options for
      DHCP option 82.
    * More debug output when sending / receiving DHCP packets.
    * EAP-MSCHAPv2 should return the MPPE keys when used outside
      of a TLS tunnel.  This is needed for IKE.
    * Added SSL "no ticket" option to prevent SSL from creating sessions
      without IDs.  We need the IDs, so this option should be set.
    * Fix proxying of packets from inside a TTLS/PEAP tunnel.
      Closes bug #25.
    * Allow IPv6 address attributes to be created from domain names
      Closes bug #82.
    * Set the string length to the correct value when parsing double
      quotes.  Closes bug #88.
    * No longer look users up in /etc/passwd in the default configuration.
      This can be reverted by enabling "unix" in the "authorize" section.
    * More #ifdef's to enable building on systems without certain
      features.
    * Fixed SQL-Group comparison to register only if the group
      query is defined.
    * Fixed SQL-Group comparison to register <instance>-SQL-Group,
      just like rlm_ldap.  This lets you have multiple SQL group checks.
    * Fix scanning of octal numbers in "unlang".  Closes bug #89.
    * Be less aggressive about freeing "stuck" requests.  Closes bug #35.
    * Fix example in "originate-coa" to refer to the correct packet.
    * Change default timeout for dynamic clients to 1 hour, not 1 day.
    * Allow passwd module to map IP addresses, too.
    * Allow passwd module to be used for CoA packets
    * Put boot filename into DHCP header when DHCP-Boot-Filename
      is specified.
    * raddb/certs/Makefile no longer has certs depend on index.txt and
       serial.  Closes bug #64.
    * Ignore NULL errorcode in PostgreSQL client.  Closes bug #39
    * Made Exec-Program and Exec-Program-Wait work in accounting
      section again.  See sites-available/default.
    * Fix long-standing memory leak in esoteric conditions.  Found
      by Jerry Nichols.
    * Added "Password-With-Header == userPassword" to raddb/ldap.attrmap
      This will automatically convert more passwords.
    * Updated rlm_pap to decode Password-With-Header, if it was base64
      encoded, and to treat the contents as potentially binary data.
    * Fix Novell eDir code to use the right function parameters.
      Closes bug #86.
    * Allow spaces to be escaped when executing external programs.
      Closes bug #93.
    * Be less restrictive about checking permissions on control socket.
      If we're root, allow connecting to a non-root socket.
    * Remove control socket on normal server exit.  If the server isn't
      running, the control socket should not exist.
    * Use MS-CHAP-User-Name as Name field from EAP-MSCHAPv2 for MS-CHAP
      calculations.  It *MAY* be different (upper / lower case) from
      the User-Name attribute.  Closes bug #17.
    * If the EAP-TLS methods have problems, more SSL errors are now
      available in the Module-Failure-Message attribute.
    * Update Oracle configure scripts.  Closes bug #57.
    * Added text to DESC fields of doc/examples/openldap.schema
    * Updated more documentation to use "Restructured Text" format.
      Thanks to James Lockie.
    * Fixed typos in raddb/sql/mssql/dialup.conf.  Closes bug #11.
    * Return error for potential proxy loops when using "-XC"
    * Produce better error messages when slow databases block
      the server.
    * Added notes on DHCP broadcast packets for FreeBSD.
    * Fixed crash when parsing some date strings.  Closes bug #98
    * Improperly formatted Attributes are now printed as "Attr-##".
      If they are not correct, they should not use the dictionary name.
    * Fix rlm_digest to be check the format of the Digest attributes,
      and return "noop" rather than "fail" if they're not right.
    * Enable "digest" in raddb/sites-available/default.  This change
      enables digest authentication to work "out of the box".
    * Be less aggressive about marking home servers as zombie.
      If they are responding to some packets, they are still alive.
    * Added Packet-Transmit-Counter, to track detail file retransmits.
      Closes bug #13.
    * Added configure check for lt_dladvise_init().  If it exists, then
      using it solves some issues related to libraries loading libraries.
    * Added indexes to the MySQL IP Pool schema.
    * Print WARNING message if too many attributes are put into a packet.
    * Include dhcp test client (not built by default)
    * Added checks for LDAP constraint violation.  Closes bug #18.
    * Change default raddebug timeout to 60 seconds.
    * Made error / warning messages more consistent.
    * Correct back-slash handling in variable expansion.  Closes bug #46.
      You SHOULD check your configuration for backslash expansion!
    * Fix typo in "configure" script (--enable-libltdl-install)
    * Use local libltdl in more situations.  This helps to avoid
      compile issues complaining about lt__PROGRAM__LTX_preloaded_symbols.
    * Fix hang on startup when multiple home servers were defined
      with "src_ipaddr" field.
    * Fix 32/64 bit issue in rlm_ldap.  Closes bug #105.
    * If the first "listen" section defines 127.0.0.1, don't use that
      as a source IP for proxying.  It won't work.
    * When Proxy-To-Realm is set to a non-existent realm, the EAP module
      should handle the request, rather than expecting it to be proxied.
    * Fix IPv4 issues with udpfromto.  Closes bug #110.
    * Clean up child processes of raddebug.  Closes bugs #108 and #109
    * retry OTP if the OTP daemon fails.  Closes bug #58.
    * Multiple calls to ber_printf seem to work better.  Closes #106.
    * Fix "unlang" so that "attribute not found" is treated as a "false"
      comparison, rather than a syntax error in the configuration.
    * Fix issue with "Group" attribute.


author: John Dennis <jdennis@redhat.com> - 2.1.10-3
changelog:
  - bug 666589 - removing freeradius from system does not delete the user "radiusd"
    fix scriptlet argument testing, simplify always exiting with zero


author: John Dennis <jdennis@redhat.com> - 2.1.10-7
changelog:
  - Resolves: #689045 Using rlm_perl cause radiusd failed to start
    Fix configure typo which caused lt_dladvise_* functions to be skipped.
    run autogen.sh because HAVE_LT_DLADVISE_INIT isn't in src/main/autogen.h
    Implemented by: freeradius-lt-dladvise.patch


author: John Dennis <jdennis@redhat.com> - 2.1.11-1
changelog:
  - Upgrade to latest upstream release: 2.1.11
  - Remove the following two patches as upstream has incorporated them:
      freeradius-radtest-ipv6.patch
      freeradius-lt-dladvise.patch
  - Upstream changelog for 2.1.11:
    Feature improvements
    * Added doc/rfc/rfc6158.txt: RADIUS Design Guidelines.
      All vendors need to read it and follow its directions.
    * Microsoft SoH support for PEAP from Phil Mayers.
      See doc/SoH.txt
    * Certificate "bootstrap" script now checks for certificate expiry.
      See comments in raddb/eap.conf, and then "make_cert_command".
    * Support for dynamic expansion of EAP-GTC challenges.
      Patch from Alexander Clouter.
    * OCSP support from Alex Bergmann.  See raddb/eap.conf, "ocsp"
      section.
    * Updated dictionary.huawei, dictionary.3gpp, dictionary.3gpp3.
    * Added dictionary.eltex, dictionary.motorola, and dictionary.ukerna.
    * Experimental redis support from Gabriel Blanchard.
      See raddb/modules/redis and raddb/modules/rediswho
    * Add "key" to rlm_fastusers.  Closes bug #126.
    * Added scripts/radtee from original software at
      http://horde.net/~jwm/software/misc/comparison-tee
    * Updated radmin "man" page for new commands.
    * radsniff now prints the hex decoding of the packet (-x -x -x)
    * mschap module now reloads its configuration on HUP
    * Added experimental "replicate" module.  See raddb/modules/replicate
    * Policy "foo" can now refer to module "foo".  This lets you
      over-ride the behavior of a module.
    * Policy "foo.authorize" can now over-ride the behavior of module
      "foo", "authorize" method.
    * Produce errors in more situations when the configuration files
      have invalid syntax.

    Bug fixes
    * Ignore pre/post-proxy sections if proxying is disabled
    * Add configure checks for pcap_fopen*.
    * Fix call to otp_write in rlm_otp
    * Fix issue with Access-Challenge checking from 2.1.10, when the
      debug flag was set after server startup.  Closes #116 and #117.
    * Fix typo in zombie period start time.
    * Fix leak in src/main/valuepair.c.  Patch from James Ballantine.
    * Allow radtest to use spaces in shared secret.
      Patch from Cedric Carree.
    * Remove extra calls to HMAC_CTX_init() in rlm_wimax, fixing leak.
      Patch from James Ballantine.
    * Remove MN-FA key generation.  The NAS does this, not AAA.
      Patch from Ben Weichman.
    * Include dictionary.mikrotik by default.  Closes bug #121.
    * Add group membership query to MS-SQL examples.  Closes bug #120.
    * Don't cast NAS-Port to integer in Postgresql queries.
      Closes bug #112.
    * Fixes for libtool and autoconf from Sam Hartman.
    * radsniff should read the dictionaries in more situations.
    * Use fnmatch to check for detail file reader==writer.
      Closes bug #128.
    * Check for short writes (i.e. disk full) in rlm_detail.
      Closes bug #130.  Patches and testing from John Morrissey.
    * Fix typo in src/lib/token.c.  Closes bug #124
    * Allow workstation trust accounts to use MS-CHAP.
      Closes bug #123.
    * Assigning foo=`/bin/echo hello` now produces a syntax error
      if it is done outside of an "update" section.
    * Fix "too many open file descriptors" problem when using
      "verify client" in eap.conf.
    * Many fixes to dialup_admin for PHP5, by Stefan Winter.
    * Allow preprocess module to have "hints = " and "huntgroups =",
      which allows them to be empty or non-existent.
    * Renamed "php3" files to "php" in dialup_admin/
    * Produce error when sub-TLVs are used in a dictionary.  They are
      supported only in the "master" branch, and not in 2.1.x.
    * Minor fix in dictionary.redback.  Closes bug #138.
    * Fixed MySQL "NULL" issues in ippool.conf.  Closes bug #129.
    * Fix to Access-Challenge warning from Ken-ichirou Matsuzawa.
      Closes bug #118.
    * DHCP fixes to send unicast packets in more situations.
    * Fix to udpfromto, to enable it to work on IPv6 networks.
    * Fixes to the Oracle accounting_onoff_query.
    * When using both IPv4 and IPv6 home servers, ensure that we use the
      correct local socket for proxying.  Closes bug #143.
    * Suppress messages when thread pool is nearly full, all threads
      are busy, and we can't create new threads.
    * IPv6 is now enabled for udpfromto.  Closes bug #141
    * Make sqlippool query buffer the same size as sql module.
      Closes bug #139.
    * Make Coa / Disconnect proxying work again.
    * Configure scripts for rlm_caching from Nathaniel McCallum
    * src/lib/dhcp.c and src/include/libradius.h are LGPL, not GPL.
    * Updated password routines to use time-insensitive comparisons.
      This prevents timing attacks (though none are known).
    * Allow sqlite module to do normal SELECT queries.
    * rlm_wimax now has a configure script
    * Moved Ascend, USR, and Motorola "illegal" dictionaries to separate
      files.  See share/dictionary for explanations.
    * Check for duplicate module definitions in the modules{} section,
      and refuse to start if duplicates are found.
    * Check for duplicate virtual servers, and refuse to start if
      duplicates are found.
    * Don't use udpfromto if source is INADDR_ANY.  Closes bug #148.
    * Check pre-conditions before running radmin "inject file".
    * Don't over-ride "no match" with "match" for regexes.
      Closes bug #152.
    * Make retry and error message configurable in mschap.
      See raddb/modules/mschap
    * Allow EAP-MSCHAPv2 to send error message to client.  This change
      allows some clients to prompt the user for a new password.
      See raddb/eap.conf, mschapv2 section, "send_error".
    * Load the default virtual server before any others.
      This matches what users expect, and reduces confusion.
    * Fix configure checks for udpfromto.  Fixes Debian bug #606866
    * Definitive fix for bug #35, where the server could crash under
      certain loads.  Changes src/lib/packet.c to use RB trees.
    * Updated "configure" checks to allow IPv6 udpfromto on Linux.
    * SQL module now returns NOOP if the accounting start/interim/stop
      queries don't do anything.
    * Allow %{outer.control: ... } in string expansions
    * home_server coa config now matches raddb/proxy.conf
    * Never send a reply to a DHCP Release.


author: John Dennis <jdennis@redhat.com> - 2.1.12-1
changelog:
  - Upgrade to latest upstream release: 2.1.12
  - Upstream changelog for 2.1.12:
    Feature improvements
    * Updates to dictionary.erx, dictionary.siemens, dictionary.starent,
      dictionary.starent.vsa1, dictionary.zyxel, added dictionary.symbol
    * Added support for PCRE from Phil Mayers
    * Configurable file permission in rlm_linelog
    * Added "relaxed" option to rlm_attr_filter.  This copies attributes
      if at least one match occurred.
    * Added documentation on dynamic clients.
      See raddb/modules/dynamic_clients.
    * Added support for elliptical curve cryptography.
      See ecdh_curve in raddb/eap.conf.
    * Added support for 802.1X MIBs in checkrad
    * Added support for %{rand:...}, which generates a uniformly
      distributed number between 0 and the number you specify.
    * Created "man" pages for all installed commands, and documented
      options for all commands.  Patch from John Dennis.
    * Allow radsniff to decode encrypted VSAs and CoA packets.
      Patch from Bjorn Mork.
    * Always send Message-Authenticator in radtest. Patch from John Dennis.
      radclient continues to be more flexible.
    * Updated Oracle schema and queries
    * Added SecurID module.  See src/modules/rlm_securid/README

    Bug fixes
    * Fix memory leak in rlm_detail
    * Fix "failed to insert event"
    * Allow virtual servers to be reloaded on HUP.
      It no longer complains about duplicate virtual servers.
    * Fix %{string:...} expansion
    * Fix "server closed socket" loop in radmin
    * Set ownership of control socket when starting up
    * Always allow root to connect to control socket, even if
      "uid" is set.  They're root.  They can already do anything.
    * Save all attributes in Access-Accept when proxying inner-tunnel
      EAP-MSCHAPv2
    * Fixes for DHCP relaying.
    * Check certificate validity when using OCSP.
    * Updated Oracle "configure" script
    * Fixed typos in dictionary.alvarion
    * WARNING on potential proxy loop.
    * Be more aggressive about clearing old requests from the
      internal queue
    * Don't open network sockets when using -C


author: John Dennis <jdennis@redhat.com> - 2.1.12-2
changelog:
  - rename /etc/tmpfiles.d/freeradius.conf to /etc/tmpfiles.d/radiusd.conf
    remove config(noreplace) because it must match files section and
    permissions differ between versions.
  - fixup macro usage for /var/run & /var/lib


author: John Dennis <jdennis@redhat.com> - 2.1.12-4
changelog:
  - resolves: bug#781744
    systemd service file incorrectly listed pid file as
    /var/run/radiusd/radiusd which it should have been
    /var/run/radiusd/radiusd.pid


author: John Dennis <jdennis@redhat.com> - 2.1.12-5
changelog:
  - resolves: bug#781877 (from RHEL5) rlm_dbm_parse man page misspelled
  - resolves: bug#760193 (from RHEL5) radtest PPPhint option is not parsed properly


author: John Dennis <jdennis@redhat.com> - 2.1.12-6
changelog:
  Fixing bugs in RHEL6 rebase, applying fixes here as well
    resolves: bug#700870 freeradius not compiled with --with-udpfromto
    resolves: bug#753764 shadow password expiration does not work
    resolves: bug#712803 radtest script is not working with eap-md5 option
    resolves: bug#690756 errors in raddb/sql/postgresql/admin.sql template


author: John Dennis <jdennis@redhat.com> - 2.2.0-0
changelog:
  - Add new patch to avoid reading .rpmnew, .rpmsave and other invalid
    files when loading config files
  - Upgrade to new 2.2.0 upstream release
  - Upstream changelog for 2.1.12:
    Feature improvements
    * 100% configuration file compatible with 2.1.x.
      The only fix needed is to disallow "hashsize=0" for rlm_passwd
    * Update Aruba, Alcatel Lucent, APC, BT, PaloAlto, Pureware,
      Redback, and Mikrotik dictionaries
    * Switch to using SHA1 for certificate digests instead of MD5.
      See raddb/certs/*.cnf
    * Added copyright statements to the dictionaries, so that we know
      when people are using them.
    * Better documentation for radrelay and detail file writer.
      See raddb/modules/radrelay and raddb/radrelay.conf
    * Added TLS-Cert-Subject-Alt-Name-Email from patch by Luke Howard
    * Added -F <file> to radwho
    * Added query timeouts to MySQL driver.  Patch from Brian De Wolf.
    * Add /etc/default/freeradius to debian package.
      Patch from Matthew Newton
    * Finalize DHCP and DHCP relay code.  It should now work everywhere.
      See raddb/sites-available/dhcp, src_ipaddr and src_interface.
    * DHCP capabilitiies are now compiled in by default.
      It runs as a DHCP server ONLY when manually enabled.
    * Added one letter expansions: %G - request minute and %I request
      ID.
    * Added script to convert ISC DHCP lease files to SQL pools.
      See scripts/isc2ippool.pl
    * Added rlm_cache to cache arbitrary attributes.
    * Added max_use to rlm_ldap to force connection to be re-established
      after a given number of queries.
    * Added configtest option to Debian init scripts, and automatic
      config test on restart.
    * Added cache config item to rlm_krb5. When set to "no" ticket
      caching is disabled which may increase performance.

    Bug fixes
    * Fix CVE-2012-3547.  All users of 2.1.10, 2.1.11, 2.1.12,
      and 802.1X should upgrade immediately.
    * Fix typo in detail file writer, to skip writing if the packet
      was read from this detail file.
    * Free cached replies when closing resumed SSL sessions.
    * Fix a number of issues found by Coverity.
    * Fix memory leak and race condition in the EAP-TLS session cache.
      Thanks to Phil Mayers for tracking down OpenSSL APIs.
    * Restrict ATTRIBUTE names to character sets that make sense.
    * Fix EAP-TLS session Id length so that OpenSSL doesn't get
      excited.
    * Fix SQL IPPool logic for non-timer attributes.  Closes bug #181
    * Change some informational messages to DEBUG rather than error.
    * Portability fixes for FreeBSD.  Closes bug #177
    * A much better fix for the _lt__PROGRAM__LTX_preloaded_symbols
      nonsense.
    * Safely handle extremely long lines in conf file variable expansion
    * Fix for Debian bug #606450
    * Mutex lock around rlm_perl Clone routines. Patch from Eike Dehling
    * The passwd module no longer permits "hashsize = 0".  Setting that
      is pointless for a host of reasons.  It will also break the server.
    * Fix proxied inner-tunnel packets sometimes having zero authentication
      vector.  Found by Brian Julin.
    * Added $(EXEEXT) to Makefiles for portability.  Closes bug #188.
    * Fix minor build issue which would cause rlm_eap to be built twice.
    * When using "status_check=request" for a home server, the username
      and password must be specified, or the server will not start.
    * EAP-SIM now calculates keys from the SIM identity, not from the
      EAP-Identity.  Changing the EAP type via NAK may result in
      identities changing.  Bug reported by Microsoft EAP team.
    * Use home server src_ipaddr when sending Status-Server packets
    * Decrypt encrypted ERX attributes in CoA packets.
    * Fix registration of internal xlat's so %{mschap:...} doesn't
      disappear after a HUP.
    * Can now reference tagged attributes in expansions.
      e.g. %{Tunnel-Type:1} and %{Tunnel-Type:1[0]} now work.
    * Correct calculation of Message-Authenticator for CoA and Disconnect
      replies.  Patch from Jouni Malinen
    * Install rad_counter, for managing rlm_counter files.
    * Add unique index constraint to all SQL flavours so that alternate
      queries work correctly.
    * The TTLS diameter decoder is now more lenient.  It ignores
      unknown attributes, instead of rejecting the TTLS session.
    * Use "globfree" in detail file reader.  Prevents very slow leak.
      Closes bug #207.
    * Operator =~ shouldn't copy the attribute, like :=.  It should
      instead behave more like ==.
    * Build main Debian package without SQL dependencies
    * Use max_queue_size in threading code
    * Update permissions in raddb/sql/postgresql/admin.sql
    * Added OpenSSL_add_all_algorithms() to fix issues where OpenSSL
      wouldn't use methods it knew about.
    * Add more sanity checks in dynamic_clients code so the server won't
      crash if it attempts to load a badly formated client definition.


author: John Dennis <jdennis@redhat.com> - 2.2.0-1
changelog:
  - resolves: bug#876564 - fails to start without freeradius-mysql
  - use upstream version of freeradius-exclude-config-file.patch


author: John Dennis <jdennis@redhat.com> - 2.2.0-3
changelog:
  - specify homedir (/var/lib/radiusd) for radiusd user in useradd,
    do not permit useradd to default the homedir.


author: John Dennis <jdennis@redhat.com> - 3.0.0-4
changelog:
  - resolves: bug#1031035
    remove radeapclient man page,
    upstream no longer supports radeapclient, use eapol_test instead
  - resolves: bug#1031061
    rlm_eap_leap memory corruption, see freeradius-rlm_leap.patch
  - move man pages for utils into utils subpackage from doc subpackage
  - fix HAVE_EC_CRYPTO test to include f20
  - add new directory /var/run/radiusd/tmp
    update mods-available/eap so tls-common.verify.tmpdir to point to it


author: John Dennis <jdennis@redhat.com> - 3.0.1-1
changelog:
  - Upgrade to upstream 3.0.1 release, full config compatible with 3.0.0.
    This is a roll-up of all upstream bugs fixes found in 3.0.0
    See upstream ChangeLog for details (in freeradius-doc subpackage)
  - fixes bugs 1053020 1044747 1048474 1043036


author: John Dennis <jdennis@redhat.com> - 3.0.1-2
changelog:
  - resolves: bug#1055073 (fedora 1055072)
    rlm_ippool; bad config file attribute and fails to send reply attributes
  - resolves: bug#1055567 (fedora 1056227)
    bad mysql sql syntax
  - change CFLAGS -imacros to -include to address gcc/gdb bug 1004526
    where gdb will not display source information, only <command-line>


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.1-4
changelog:
  - Fix CVE-2014-2015 "freeradius: stack-based buffer overflow flaw in rlm_pap
    module"
  - resolves: bug#1066984 (fedora 1066763)


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.2-1
changelog:
  - Upgrade to upstream 3.0.2 release, configuration compatible with 3.0.1.
    See upstream ChangeLog for details (in freeradius-doc subpackage)
  - Fixes bugs 1058884 1061408 1070447 1079500


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.3-1
changelog:
  - Upgrade to upstream 3.0.3 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
  - Minor configuration parsing change: "Double-escaping of characters in Perl,
    and octal characters has been fixed. If your configuration has text like
    "\\000", you will need to remove one backslash."
  - Additionally includes post-release fixes for:
    * case-insensitive matching in compiled regular expressions not working,
    * upstream issue #634 "3.0.3 SIGSEGV on config parse",
    * upstream issue #635 "3.0.x - rlm_perl - strings are still
      escaped when passed to perl from FreeRADIUS",
    * upstream issue #639 "foreach may cause ABORT".
  - Fixes bugs 1097266 1070447


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.3-2
changelog:
  - Add explicit dependency on OpenSSL package with fixed CVE-2014-0160
    (Heartbleed bug).
  - Add confirmation of CVE-2014-0160 being fixed in OpenSSL to radiusd.conf.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-0.1.rc2
changelog:
  - Upgrade to upstream 3.0.4-rc2 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-1
changelog:
  - Upgrade to upstream 3.0.4 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
  - Resolves: Bug#1099620


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-2
changelog:
  - Fix abort on home server triggers.
  - Fix segfault upon example.pl read failure.
  - Fix example.pl permissions.
  - Fix integer handling in various cases.
  - Fix dhcpclient's dictionary.dhcp loading.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.4-3
changelog:
  - Fix OpenSSL version parsing when checking for compatibility at run time.
    Resolves: Bug#1173821
  - Don't remove backslash from unknown escape sequences in LDAP values.
    Resolves: Bug#1173526
  - Improve dhcpclient and rad_counter online help.
    Resolves: Bug#1146966
  - raddb: Move trigger.conf INCLUDE before modules, making it easier to refer
    to trigger variables from module configurations.
    Resolves: Bug#1155961
  - Fix ipaddr option fallback onto ipv6.
    Resolves: Bug#1168868
  - raddb: Comment on ipaddr/ipv4addr/ipv6addr use.
    Resolves: Bug#1168247
  - Disable rlm_rest building explicitly to avoid unintended builds on some
    architectures breaking RPM build.
    Resolves: Bug#1162156
  - Add -D option support to dhcpclient.
    Related: Bug#1146939
  - Don't install rbmonkey - a test tool only useful to developers.
    Related: Bug#1146966
  - Update clients(5) man page
    Resolves: Bug#1147464
  - Fix possible group info corruption/segfault in rlm_unix' fr_getgrnam.
  - Fix file configuration item parsing.
  - Fix a number of trigger issues.
    Resolves: Bug#1110407 radiusd doesn't send snmp trap after "radmin -e 'hup
                          files'"
    Resolves: Bug#1110414 radiusd doesn't send snmp trap when sql connection is
                          opened,closed or fail
    Resolves: Bug#1110186 radiusd doesn't send snmp trap when ldap connection
                          fails/opens/closes
    Resolves: Bug#1109164 snmp trap messages send by radiusd are inconsistent
                          and incomplete
  - Fix two omissions from radtest manpage.
    Resolves: Bug#1146898 'eap-md5' value is missing in -t option in SYNOPSIS
                          of radtest man page
    Resolves: Bug#1114669 Missing -P option in radtest manpage
  - Disable OpenSSL version checking to avoid the need to edit radiusd.conf to
    confirm heartbleed is fixed.
    Resolves: Bug#1155070 FreeRADIUS doesn't start after upgrade due to failing
                          OpenSSL version check


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.7-1
changelog:
  - Upgrade to upstream v3.0.7 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Resolves: Bug#1133959
  - Add freeradius-rest package containing rlm_rest module.
    Resolves: Bug#1196276


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.8-1
changelog:
  - Upgrade to upstream v3.0.7 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related: Bug#1133959


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.9-1
changelog:
  - Upgrade to upstream v3.0.9 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Resolves: Bug#1133959


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.10-1
changelog:
  - Upgrade to upstream v3.0.10 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related: Bug#1133959
  - Remove rlm_eap_tnc support as the required package "tncfhh" was retired.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.11-1
changelog:
  - Upgrade to upstream v3.0.10 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.11-7
changelog:
  - Make sure FreeRADIUS starts after IPA, directory, and Kerberos servers
  - Don't rotate radutmp, as it's not a log file
  - Logrotate with "systemctl" instead of "service"
  - Remove executable bits from "radiusd.service"


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-1
changelog:
  - Upgrade to upstream v3.0.12 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-2
changelog:
  - Fix three cases of comparing pointers to zero characters
  - Support OpenSSL v1.1.0
    Resolves: Bug#1385588


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-3
changelog:
  - Do not fail logrotate if radiusd is not running.
  - Fix output to log file specified with -l option.
  - Fix long hostnames interpreted as IP addresses.
  - Avoid clashes with libtool library symbols.
  - Remove mentions of Auth-Type = System from docs.
  - Improve ip/v4/v6/addr documentation.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-1
changelog:
  - Upgrade to upstream v3.0.13 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-2
changelog:
  - Fix permissions of default key files in raddb/certs.
  - Require OpenSSL version we built with, or newer, to avoid startup failures
    due to runtime OpenSSL version checks.
    Resolves: Bug#1299388
  - Fix some issues found with static analyzers.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-3
changelog:
  - Explicitly disable rlm_cache_memcached to avoid error when the module's
    dependencies are installed, and it is built, but not packaged.
  - Prevent segfaults by adding a missing handling of connection errors in
    rlm_ldap.
  - Make radtest use Cleartext-Password for EAP, fixing its support for eap-md5.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.14-1
changelog:
  - Upgrade to upstream v3.0.14 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
  - Fix TLS resumption authentication bypass (CVE-2017-9148)


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.15-1
changelog:
  - Upgrade to upstream v3.0.15 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
  - Resolves: Bug#1471848 CVE-2017-10978 freeradius: Out-of-bounds read/write
                          due to improper output buffer size check in
                          make_secret()
  - Resolves: Bug#1471860 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63
  - Resolves: Bug#1471861 CVE-2017-10984 freeradius: Out-of-bounds write in
                          data2vp_wimax()
  - Resolves: Bug#1471863 CVE-2017-10985 freeradius: Infinite loop and memory
                          exhaustion with 'concat' attributes
  - Resolves: Bug#1471864 CVE-2017-10986 freeradius: Infinite read in
                          dhcp_attr2vp()
  - Resolves: Bug#1471865 CVE-2017-10987 freeradius: Buffer over-read in
                          fr_dhcp_decode_suboptions()
  - Resolves: Bug#1456220 freeradius-3.0.15 is available


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.15-4
changelog:
  - Python 2 binary package renamed to python2-freeradius
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.15-6
changelog:
  - Use mariadb-connector-c-devel instead of mysql-devel or mariadb-devel
    Resolves: Bug#1493904 Use mariadb-connector-c-devel instead of mysql-devel
                          or mariadb-devel


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.15-16
changelog:
  - Add make to Requires(post) to fix certificate generation on install.
    Resolves: Bug#1628213 FreeRADIUS fails to start due to default certificate
                          permissions


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.15-18
changelog:
  - Actually apply patches added previously.
    Related: Bug#1612512 Man page scan results for freeradius


author: Alexander Scheel <ascheel@redhat.com> - 3.0.17-1
changelog:
  - Update to FreeRADIUS server version 3.0.17
  - Adds OpenSSL HMAC patches from upstream (unreleased)
  - Adds Python2 shebang patches from upstream (unreleased)


author: Alexander Scheel <ascheel@redhat.com> - 3.0.17-4
changelog:
  - Fixes two EAP-PWD security issues
    Resolves: bz#1699417 authentication bypass with an invalid curve attack
    Resolves: bz#1699421 fake authentication using reflection


author: Alexander Scheel <ascheel@redhat.com> - 3.0.20-1
changelog:
  - Update to FreeRADIUS server version 3.0.20
  - Introduce Python 3 support; resolves: bz#1623069
  - DoS issues due to multithreaded BN_CTX access; resolves: bz#1818809
  - Create tmp files in /run; resolves: bz#1805975


author: Alexander Scheel <ascheel@redhat.com> - 3.0.20-2
changelog:
  - Fix breakage caused by OpenSSL FIPS regression
    Related: bz#1855822
    Related: bz#1810911
    Resolves: bz#1672285


author: Ondrej Holy <oholy@redhat.com> - - 2:2.2.0-9
changelog:
  - CVE-2022-39282: Fix length checks in parallel driver (#2136151)
  - CVE-2022-39283: Add missing length check in video channel (#2136153)
  - CVE-2022-39316, CVE-2022-39317: Add missing length checks in zgfx (#2145139)
  - CVE-2022-39318: Fix division by zero in urbdrc channel (#2145139)
  - CVE-2022-39319: Add missing length checks in urbdrc channel (#2145139)
  - CVE-2022-39320: Ensure urb_create_iocompletion uses size_t (#2145139)
  - CVE-2022-39347: Fix path validation in drive channel (#2145139)
  - CVE-2022-41877: Add missing length check in drive channel (#2145139)


author: Simone Caronni <negativo17@gmail.com> - 2:2.0.0-36.20180115git8f52c7e
changelog:
  - Update to latest snapshot.
  - Make GSS support optional and disable it for now (#1534094 and FreeRDP #4348,


author: Karsten Hopp <karsten@redhat.com> - 2.0.0-37git}
changelog:
  - use versioned build requirement on pkgconfig(openssl) to prevent using
    compat-openssl10-devel instead of openssl-devel


author: Simone Caronni <negativo17@gmail.com> - 2:2.0.0-39.20180314gitf8baeb7
changelog:
  - Update to latest snapshot.
  - Fixes connection to RDP servers with the latest Microsoft patches:
    https://github.com/FreeRDP/FreeRDP/issues/4449


author: Ondrej Holy <oholy@redhat.com> - 2:2.0.0-47.rc4
changelog:
  - Fix SCARD_INSUFFICIENT_BUFFER error (rhbz#1803054)
  - Do not advertise /usb in help output (rhbz#1761144)


author: Tomas Popela <tpopela@redhat.com> - 1.6.1-7
changelog:
  - Rebuild with newer annobin to fix rpmdiff problems
  - Fix the build with a newer opencv
  - Resolves: rhbz#1703994


author: Akira TAGOH <tagoh@redhat.com> - 1.0.4-9
changelog:
  - Fix security issues CVE-2022-25308, CVE-2022-25309, CVE-2022-25310.
    Resolves: rhbz#2050085, rhbz#2050068, rhbz#2050062
  - Drop --disable-docs from %configure. no such options available.


author: Michal Ruprich <mruprich@redhat.com> - 7.5.1-14
changelog:
  - Resolves: RHEL-6617 - Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router


author: Michal Ruprich <mruprich@redhat.com> - 7.5.1-16
changelog:
  - Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgp_flowspec.c
  - Resolves: RHEL-15919 - Out of bounds read in bgpd/bgp_label.c
  - Resolves: RHEL-15869 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
  - Resolves: RHEL-15868 - crash from malformed EOR-containing BGP UPDATE message


author: Michal Ruprich <mruprich@redhat.com> - 7.5.1-17
changelog:
  - Resolves: RHEL-6583 - Routes are not refreshed after changing the inbound route rules from deny to permit


author: Lukas Javorsky <ljavorsk@redhat.com> - 25.3.34-3
changelog:
  - Use downstream garbd-wrapper and garbd.service to ensure compatibility
  - Add upstream versions of garbd-wrapper (called garbd-systemd) and garbd.service
    in case user want's to use them


author: Lukas Javorsky <ljavorsk@redhat.com> - 25.3.34-4
changelog:
  - Explicitly require the 'procps-ng' package
  - Otherwise it will not require it in the lightweight systems (e.g. containers)
  - and Galera won't work properly


author: Rex Dieter <rdieter@fedoraproject.org> - 7.6.2-1
changelog:
  - 7.6.2 (#1531008)
  - libgc soname bump
  - -devel: include all docs here (ie, remove README's from main too)


author: Nick Clifton <nickc@redhat.com> - 9.21-1
changelog:
  - Initial check-in for scl-gcc-toolset-10 branch.  (#1817171)
  - Fix stack clash protection problem. (#1803173)


author: Nick Clifton <nickc@redhat.com> - 9.29-1
changelog:
  - Fix AArch64 checks in annobin plugin.  (#1873416)
  - gcc plugin: Detect any attempt to access the global_options array.
  - gcc plugin: Do not complain about missing pre-processor options when examining a preprocessed input file.  (#1862718)
  - Use more robust checks for AArch64 options.
  - Detect CLANG compiled assembler that is missing IBT support.
  - Improved target pointer size discovery.
  - Add support for installing clang and llvm plugins.
  - Temporary suppression of aarch64 pointer size check.  (#1860549)


author: Nick Clifton <nickc@redhat.com> - 2.35-3
changelog:
  - Do not enable debuginfod support by default.
  - Add run-time dependency on libdebuginfod library when debuginfod support is enabled.


author: Nick Clifton <nickc@redhat.com> - 2.35-5
changelog:
  - Fix building with LTO enabled.
  - Set the sh_entsize field of the AArch64's PLT section to 0.  (PR 26312)


author: Nick Clifton <nickc@redhat.com> - 2.35-9
changelog:
  - Add ability to control the display of unicode characters.  (#2009178)
  - Backport some more speed up patches.  (#1978174)
  - Remove a quadratic performance penalty processing files.  (#1978174)
  - Extend vulnerability fix again.  (#1925779)


author: Mark Wielaard <mjw@redhat.com> - 0.178-1
changelog:
  - New upstream release.
    - debuginfod: New server, client tool and library to index and fetch
                  ELF/DWARF files addressed by build-id through HTTP.
    - doc: There are now some manual pages for functions and tools.
    - backends: The libebl libraries are no longer dynamically loaded
                through dlopen, but are now compiled into libdw.so directly.
    - readelf: -n, --notes now takes an optional "SECTION" argument.
               -p and -x now also handle section numbers.
               New option --dyn-sym to show just the dynamic symbol table.
    - libdw: Abbrevs and DIEs can now be read concurrently by multiple
             threads through the same Dwarf handle.
    - libdwfl: Will try to use debuginfod when installed as fallback to
               retrieve ELF and DWARF debug data files by build-id.


author: Mark Wielaard <mjw@redhat.com> - 0.182-1
changelog:
  - Upgrade to upstream 0.182
    - backends: Support for tilegx has been removed.
    - config: New /etc/profile.d files to provide default $DEBUGINFOD_URLS.
    - debuginfod: More efficient package traversal, tolerate various
      errors during scanning, grooming progress is more visible and
      interruptible, more prometheus metrics.
    - debuginfod-client: Now supports compressed (kernel) ELF images.
    - libdwfl: Add ZSTD compression support.


author: Marek Polacek <polacek@redhat.com> 10.2.1-8
changelog:
  - update from Fedora gcc 10.2.1-8 (#1878887)
  - emit DW_AT_declaration on declaration-only DIEs (#1897272, PR debug/97060)
  - add BuildRequires: make and Requires: make, the latter for -flto reasons


author: Marek Polacek <polacek@redhat.com> 10.3.1-1
changelog:
  - update from Fedora gcc 10.3.1-1 (#1929382)
  - drop gcc10-pr97060.patch
  - use --enable-cet
  - ship gcc-accel-nvptx-none-lto-dump
  - backport PR96939 fixes


author: Kevin Buettner <kevinb@redhat.com> - 9.1-6
changelog:
  - Fix build breakage of gdb/python/python.c due to use of deprecated
    Python function (RHBZ 1822715, Kevin Buettner)


author: Keith Seitz <keiths@redhat.com> - 9.2-1
changelog:
  - Rebase to FSF GDB 9.2.
  - Add explicit python bytecode compilation.
  - Change included files to patches to quell error from rpminspect.
  - Fix attach-32.exp from gdb-6.3-inferior-notification-20050721.patch.


author: Keith Seitz <keiths@redhat.com> - 9.2-3
changelog:
  - Fix missing debuginfo messages. (Keith Seitz, RH BZ 1894703)
  - Add debuginfod.m4 patch to use pkg-config. 
  - Backport "Corefile memory access problems" patches.
    (Kevin Buettner, RH BZ 1886602)
  - Backport "Exclude debuginfo files from 'outside ELF segments' warning".
    (Keith Seitz, RH BZ 1898252)


author: Keith Seitz <keiths@redhat.com> - 9.2-4
changelog:
  - Backport "Correct recording of 'store on condition' insns"
    (Andreas Arnaz, RH BZ 1903375)
  - Backport "Fortran dynamic type related fixes"
    (Andrew Burgess, RH BZ 1905702)


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.1-3
changelog:
  - Use SPDX abbreviations for licenses.
  - Add library directories to existing LDFLAGS and not override them.


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.1-4
changelog:
  - Pull upstream fix for ioctl evdev bitset decoding, fix the tests (#1747213).
  - Include upstream patches that fix issues reported by covscan (#1747530):
    91281fec "v4l2: avoid shifting left a signed number by 31 bit",
    522ad3a0 "syscall.c: avoid infinite loop in subcalls parsing",
    9446038e "kvm: avoid bogus vcpu_info assignment in vcpu_register", and
    2b64854e "xlat: use unsgined type for mount_flags fallback values".


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.1-5
changelog:
  - Fix printing stack traces for early syscalls on process attach (#1790054):
    69b2c33a "unwind-libdw: fix initialization of libdwfl cache",
    35e080ae "syscall: do not capture stack trace while the tracee executes
             strace code", and
    8e515c74 "tests: add strace-k-p test".
  - Properly decode struct sockaddr_hci without hci_channel field.


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.1-6
changelog:
  - Fix expected alignment for IPC tests (#1794490):
    4377e3a1 "tests: fix expected output for some ipc tests", and
    a75c7c4b "tests: fix -a argument in ipc_msgbuf-Xraw test".


author: Frank Ch. Eigler <fche@redhat.com> - 4.3-7
changelog:
  - Fix rhbz1857749 with rhel8.3 baseos patch
  - Fix rhbz1852021 with more complete rhel8.3 baseos patch


author: Frank Ch. Eigler <fche@redhat.com> - 4.4-3
changelog:
  - rhbz1898288: stability for exhausted UTRACE_TASK_WORK_POOL
  - rhbz1873492 related: mokutil parser robustness for RH keys
  - rhbz1873492 related: rhel8 kernel_is_locked_down detection


author: Mark Wielaard <mjw@redhat.com> - 3.16.0-4
changelog:
  - Add valgrind-3.16.1-REX-prefix-JMP.patch
  - Add valgrind-3.16.1-epoll.patch
  - Add valgrind-3.16.1-sched_getsetattr.patch
  - Add valgrind-3.16.1-dl_runtime_resolve.patch


author: Nick Clifton <nickc@redhat.com> - 9.72-1
changelog:
  - Rebase to 9.72.  (#1957319)
  - annocheck: Accept 0 as a valid number for gcc minor versions and release numbers.
  - gcc-plugin: Add support for ARM and RISCV targets.
  - timing: do not initialise the clock if the timing tool is disabled.
  - gcc-plugin: Replace ICE messsages with verbose messages.
  - Fix the testsuite so that it can be run in parallel.
  - Annocheck: WARN if the annobin plugin was built for a newer version of the compiler than the one on which it was run.  (#1950657)
  - Obsolete annobin < 9.66-1 (bug #1949570)
  - Annocheck: Improve detection of missing GNU-stack support.
  - Correct a package rename (bug #1949570)
  - Require docs subpackage by the other ones because of a license
  - Build-requiring perl-interpreter is enough
  - Fix bz1949570
  - Fix anomolies reported by covscan.
  - Move documentation into a sub-package.
  - gcc-plugin: Use a fixed filename when running in LTO mode.
  - Annocheck: Fix detection of special function names.  (#1934189)
  - Annocheck: FAIL the deliberate use of -fno-stack-protector, but add some exceptions for glibc.  (#1923439)
  - Annocheck: Add colour to some messages.  Skip the deliberate use of -fno-stack-protector.  (#1923439)
  - Annocheck: Fix some problems with tests for missing notes.
  - Split plugins into separate sub-packages
  - Add some GO tests to annocheck.
  - Add a future fail for the presence of RPATH in the dynamic tags.
  - Add the ability to disable the warning message about -D_FORTIFY_SOURCE being missing.
  - Workaround for elflint problems with PPC compiled files.  (#1880634)
  - Fix bogus AArch64 test failures.
  - Improved testing by annocheck.  Add fixed format message mode.
  - Fix inconsistency reporting -fcf-protection and -fstack-clash-protection results.
  - Add support for -D_FORTIFY_SOURCE=3.
  - annocheck: When a binary is produced both by GAS and GCC, select GAS as the real producer.  (#1906171)
  - annocheck: Improve test for LTO compiled binaries that do not have -Wall annotations.  (#1906171)
  - annocheck: Mark a missining -D_FORTIFY_SOURCE as a FAIL.
  - annocheck: Fix notes analyzer to accept empty PPC64 notes.
  - gcc plugin: Tweak generation of end symbols for PPC64 when LTO is active.  (#1898075)
  - gcc plugin: Add support for GCC 11's cl_vars array.
  - Annocheck: Support enabling/disabling future fails.
  - GCC plugin: Always record global notes for the .text.startup,
    .text.exit, .text.hot and .text.cold sections.
  - Clang plugin: Add -lLLVM to the build command line.
  - Annocheck: Improve reporting of missing -D_FORTIFY_SOURCE option.  (#1898075)
  - Annocheck: Improve reporting of missing LTO option.
  - Add detecting of gimple compiled binaries.
  - Add --without-gcc-plugin option.
  - Annocheck: Fix bug parsing DW_AT_producer.
  - Add test of .note.gnu.property section for PowerPC.
  - Add test of objcopy's ability to merge notes.
  - NVR bump for another ELN sidetag rebuild.
  - Record the -flto setting and produce a soft warning if it is absent.
  - Suppress warnings about _D_GLIBCXX_ASSERTIONS if the source code is known to be something other than C++.
  - Correct the directory chosen for 32-bit LLVM and Clang plugins.  (#1884951)
  - Allow the use of the SHF_LINK_ORDER section flag to discard unused notes.  (Experimental).
  - Enable the build and installation of the LLVM and Clang plugins.  (Experimental).
  - gcc-plugin: Fix test for empty PowerPC sections.  (#1880634)
  - annocheck: Add tests for the AArch64 BTI and PAC security features.  (#1862478)
  - gcc plugin: Use a 4 byte offset for PowerPC start symbols, so that they do not break disassemblies.
  - gcc plugin: Correct the detection of 32-bit x86 builds.  (#1876197)
  - gcc plugin: Detect any attempt to access the global_options array.
  - gcc plugin: Do not complain about missing pre-processor options when examining a preprocessed input file.  (#1862718)
  - Use more robust checks for AArch64 options.
  - Detect CLANG compiled assembler that is missing IBT support.


author: Nick Clifton <nickc@redhat.com> - 9.79-1
changelog:
  - Annocheck: Fix spelling mistake in -mstack-realign failure message.  (#1977349)
  - gcc-plugin: Do not record global versions of stack protection settings in LTO mode, if not set.  (#1958954)
  - Annocheck: Remove limit on number of input files.
  - Annocheck: Conditionalize test of DF_PIE_1 flag.
  - clang/llvm plugins: Build with correct security options.
  - Annocheck: Better detection of GO compiler version.
  - Annocheck: Better support for symbolic links.
  - Annocheck: In verbose mode, report the reason for skipping specific tests.  (#1969584)


author: Nick Clifton <nickc@redhat.com> - 9.85-1
changelog:
  - Annocheck: Detect a missing CET note.  (#1991931)
  - Annocheck: Do not report future fails for AArch64 notes.
  - Annocheck: Warn about multiple --debug-file, --debug-rpm and --debug-dir options.
  - Annocheck: Process files in command line order.  (#1988714)
  - Annocheck: Reverse AArch64 PAC+BTI check, ie fail if they are enabled.  (#1984995)
  - Annocheck: Add another test exceptions.
  - Annocheck: Add some more test exceptions.
  - Tests: Skip glibc-notes test if the assembler does not support --generate-missing-build-notes.  (#1978573)
  - Tests: Skip objcopy test if objcopy does not support --merge-notes.


author: Nick Clifton <nickc@redhat.com> - 10.23-1 (#2020405)
changelog:
  - Annocheck: Add a test for unicode characters in identifiers.
  - gcc-plugin: Default to link-order grouping for PPC64LE.  (#2016458)
  - Annocheck: Do not fail if a --skip-<name> option does not match a known test.
  - ldconfig-test: Skip the LTO check.
  - Annocheck: Add more glibc function names.
  - gcc-plugin: Fix attaching the .text section to the .text.group section.
  - Complain about DT_RPATH for Fedora binaries.
  - Better reporting of problems in object files.  (#2013708)
  - Add a requirement on llvm-libs for clang and llvm plugins.  (#2014573)
  - Fix configuring annocheck without gcc-plugin.
  - Annocheck: Better reporting of debuginfod problems.
  - Tests: Fix bugs in debuginfod test.
  - Annocheck: Add tests based upon recent bug fixes.
  - Annocheck: Another tweak to glibc detection code.
  - Annocheck: Fix memory corruptions when using --debug-path and when a corrupt note is found.  (#20011438)
  - Annocheck: Fix MAYB results for mixed GO/C files.
  - Annocheck: Move some messages from VERBOSE to VERBOSE2.
  - Annocheck: Scan zero-length tool notes.
  - Annocheck: Fix covscan detected flaws.
  - plugins: Add more required build options.
  - Annocheck: Fix cf-prot test to fail if the CET notes are missing.
  - Annocheck: Skip gaps in the .plt section.
  - Plugins: Add -g option when building LLVM and Clang.
  - Annocheck: Add more cases of glibc startup functions.
  - Annocheck: Fix covscan detected problems.
  - Annocheck: Add --profile=el8.
  - gcc-plugin: Conditionalize generation of branch protection note.
  - Annocheck: Ignore gaps containing NOP instructions.
  - GCC Plugin: Fix detection of running inside the LTO compiler.  (#2004917)
  - Annocheck: Do not insist on the DT_AARCH64_PAC_PLT flag being present in AArch64 binaries.
  - Annocheck: With gaps at the start/end of the .text section, check for special symbols before displaying a MAYB result.
  - Annocheck: Do not set CFLAGS/LDFLAGS when building.  Take from environment instead.
  - Annocheck: Fix exit code when tests PASS.
  - Documentation: Add node for each hardening test.
  - Documentation: Install online.
  - Annocheck: Annote FAIL and MAYB results with URL to documentation
  - Annocheck: Add --no-urls and --provide-urls options
  - Annocheck: Add --help-<tool> option.
  - Annocheck: Fix fuzzing detected failures.
  - Annocheck: Add --profile option.
  - Docs: Document --profile option and rpminspect.yaml.
  - Annocheck: Skip GO/CET checks.  Fix fuzzing detected failures.
  - LLVM Plugin: Automatically choose the correct tests to run, based upon the version of Clang installed. (#1997444)
  - Annocheck: Fix memory corruption.  (#1996963)
  - Annocheck: Fix conditionalization of AArch64's PAC+BTI detection.
  - Annocheck: Add linker generated function for ppc64le exceptions.  (#1981410)
  - LLVM Plugin: Allow checks to be selected from the command line.
  - Annocheck: Examine DW_AT_producer for -flto.    
  - Annocheck: Conditionalize detection of AArch64's PAC+BTI protection.
  - Annocheck: Add linker generated function for s390x exceptions.  (#1981410)
  - Annocheck: Generate MAYB results for gaps in notes covering the .text section.  (#1991943)
  - Annocheck: Close DWARF file descriptors once the debug info is no longer needed.  (#1981410)
  - LLVM Plugin: Update to build with Clang v13.  (Thanks to: Tom Stellard <tstellar@redhat.com>)
  - Annocheck: Fix memory corruption.  (#1988715)
  - Annocheck: Skip certain tests for kernel modules.


author: Yara Ahmad <yahmad@redhat.com> - 2.36.1-4
changelog:
  - Fix addr2line from gcc-toolset-11-binutils having errors while compiling code 
    using LTO and Dwarf5  (#2153811)


author: Marek Polacek <polacek@redhat.com> 11.2.1-7
changelog:
  - update from releases/gcc-11-branch (#1996862)
    - PRs ada/100486, c++/70796, c++/92746, c++/93286, c++/94490, c++/102642,
  	c++/102786, debug/101378, debug/103046, debug/103315, fortran/87711,
  	fortran/87851, fortran/97896, fortran/99061, fortran/99348,
  	fortran/102521, fortran/102685, fortran/102715, fortran/102745,
  	fortran/102816, fortran/102817, fortran/102917, fortran/103137,
  	fortran/103138, fortran/103392, gcov-profile/100520, ipa/102714,
  	ipa/102762, ipa/103052, ipa/103246, ipa/103267, libstdc++/96416,
  	libstdc++/98421, libstdc++/100117, libstdc++/100153, libstdc++/100748,
  	libstdc++/101571, libstdc++/101608, libstdc++/102894,
  	libstdc++/103022, libstdc++/103086, libstdc++/103133,
  	libstdc++/103240, libstdc++/103381, middle-end/64888,
  	middle-end/101480, middle-end/102431, middle-end/102518,
  	middle-end/103059, middle-end/103181, middle-end/103248,
  	middle-end/103384, preprocessor/103130, rtl-optimization/102356,
  	rtl-optimization/102842, target/101985, target/102976, target/102991,
  	target/103205, target/103274, target/103275, testsuite/102690,
  	tree-optimization/100393, tree-optimization/102139,
  	tree-optimization/102505, tree-optimization/102572,
  	tree-optimization/102788, tree-optimization/102789,
  	tree-optimization/102798, tree-optimization/102970,
  	tree-optimization/103192, tree-optimization/103204,
  	tree-optimization/103237, tree-optimization/103255,
  	tree-optimization/103435
  - fix up #__VA_OPT__ handling (PR preprocessor/103415)


author: Marek Polacek <polacek@redhat.com> 11.2.1-8
changelog:
  - update from releases/gcc-11-branch (#2047286)
    - PRs ada/103538, analyzer/101962, bootstrap/103688, c++/85846, c++/95009,
  	c++/98394, c++/99911, c++/100493, c++/101715, c++/102229, c++/102933,
  	c++/103012, c++/103198, c++/103480, c++/103703, c++/103714,
  	c++/103758, c++/103783, c++/103831, c++/103912, c++/104055, c/97548,
  	c/101289, c/101537, c/103587, c/103881, d/103604, debug/103838,
  	debug/103874, fortran/67804, fortran/83079, fortran/101329,
  	fortran/101762, fortran/102332, fortran/102717, fortran/102787,
  	fortran/103411, fortran/103412, fortran/103418, fortran/103473,
  	fortran/103505, fortran/103588, fortran/103591, fortran/103606,
  	fortran/103607, fortran/103609, fortran/103610, fortran/103692,
  	fortran/103717, fortran/103718, fortran/103719, fortran/103776,
  	fortran/103777, fortran/103778, fortran/103782, fortran/103789,
  	ipa/101354, jit/103562, libfortran/103634, libstdc++/100017,
  	libstdc++/102994, libstdc++/103453, libstdc++/103501,
  	libstdc++/103549, libstdc++/103877, libstdc++/103919,
  	middle-end/101751, middle-end/102860, middle-end/103813, objc/103639,
  	preprocessor/89971, preprocessor/102432, rtl-optimization/102478,
  	rtl-optimization/103837, rtl-optimization/103860,
  	rtl-optimization/103908, sanitizer/102911, target/102347,
  	target/103465, target/103661, target/104172, target/104188,
  	tree-optimization/101615, tree-optimization/103523,
  	tree-optimization/103603, tree-optimization/103995


author: Marek Polacek <polacek@redhat.com> 11.2.1-9
changelog:
  - update from releases/gcc-11-branch (#2047286)
    - PRs fortran/104127, fortran/104212, fortran/104227, target/101529
  - fix up va-opt-6.c testcase


author: Marek Polacek <polacek@redhat.com> 11.2.1-9.2
changelog:
  - fix wstring conversions in filesystem::path (PR libstdc++/95048, #2220896)
  - mark non-exported function always_inline (PR libstdc++/105671, #2221740)


author: Keith Seitz <keiths@redhat.com> - 10.1-14
changelog:
  - Backport "Save/restore file offset while reading notes in core file"
    (Keith Seitz, RHBZ 1931344)


author: Kevin Buettner <kevinb@redhat.com> - 10.2-1
changelog:
  - Rebase to FSF GDB 10.2.
  - Drop gdb-6.3-test-pie-20050107.patch.
  - Drop gdb-6.3-test-self-20050110.patch.
  - Drop gdb-6.5-bz218379-ppc-solib-trampoline-test.patch.
  - Drop gdb-6.6-buildid-locate-core-as-arg.patch.
  - Drop gdb-6.8-quit-never-aborts.patch.
  - Drop gdb-archer-pie-addons-keep-disabled.patch.
  - Drop gdb-archer-pie-addons.patch.
  - Drop gdb-archer-vla-tests.patch.
  - Drop gdb-archer.patch.
  - Drop gdb-attach-fail-reasons-5of5.patch.
  - Drop gdb-btrobust.patch.
  - Drop gdb-bz1219747-attach-kills.patch.
  - Drop gdb-bz533176-fortran-omp-step.patch.
  - Drop gdb-dts-rhel6-python-compat.patch.
  - Drop gdb-gnat-dwarf-crash-3of3.patch.
  - Drop gdb-jit-reader-multilib.patch.
  - Drop gdb-moribund-utrace-workaround.patch.
  - Drop gdb-rhbz1930528-fix-gnulib-build-error.patch.
  - Drop gdb-rhbz1932645-aarch64-ptrace-header-order.patch.
  - Drop gdb-vla-intel-fix-print-char-array.patch.
  - Drop gdb-vla-intel-fortran-strides.patch.
  - Drop gdb-vla-intel-stringbt-fix.patch.
  - Drop gdb-vla-intel-tests.patch.
  - Drop process_psymtab_comp_unit-type-unit.patch.
  - Drop gdb-testsuite-readline63-sigint-revert.patch.
  - Drop gdb-config.patch.
  - Add following upstream patches for Fortran stride / slice support:
    gdb-rhbz1964167-convert-enum-range_type.patch
    gdb-rhbz1964167-fortran-array-slices-at-prompt.patch
    gdb-rhbz1964167-fortran-array-strides-in-expressions.patch
    gdb-rhbz1964167-fortran-clean-up-array-expression-evaluation.patch
    gdb-rhbz1964167-fortran-range_type-to-range_flag.patch
    gdb-rhbz1964167-fortran-whitespace_array.patch
    gdb-rhbz1964167-move-fortran-expr-handling.patch


author: Keith Seitz <keiths@redhat.com> - 10.2-2
changelog:
  - Backport "Correct recording of 'store on condition' insns"
    (Andreas Arnaz, RH BZ 1903375)
  - Backport "Exclude debuginfo files from 'outside ELF segments' warning".
    (Keith Seitz, RH BZ 1898252)
  - Backport "Fix crash when expanding partial symtab..."
    (Tom Tromey. gdb/27743)


author: Keith Seitz <keiths@redhat.com> - 10.2-3.el8
changelog:
  - Backport "Exclude debuginfo files from 'outside ELF segments' warning".
    (Keith Seitz, RH BZ 1898252)
  - Backport "Correct recording of 'store on condition' insns"
    (Andreas Arnez, RH BZ 1903375)


author: Keith Seitz <keiths@redhat.com> - 10.2-4.el8
changelog:
  - Backport "Fix gdb.fortran/array-slices.exp with -m32"
    (Tom de Vries, testsuite/269970)
  - Backport "adjust gdb.python/flexible-array-member.exp expected pattern"
    (Simon Marchi)


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-4
changelog:
  - Work around unknown msgctl/semctl/shmctl cmd check issue in tests-m32
    and tests-mx32 as well (#1997082).


author: Mark Wielaard <mjw@redhat.com> - 3.17.0-4
changelog:
  - Update to upstream 3.17.0 final.
  - Add valgrind-3.17.0-ppc64-isa-3.1{,tests}.patch
  - Add valgrind-3.17.0-s390_insn_as_string.patch
  - Add valgrind-3.17.0-debuginfod.patch
  - Add valgrind-3.17.0-clone-parent-res.patch


author: Marek Polacek <polacek@redhat.com> - 12.0-3
changelog:
  - use rpm/macros.gcc-toolset-12-enable for %enable_devtoolset12 and put it in
    the -runtime subpackage (#2009528)


author: Florian Weimer <fweimer@redhat.com> - 10.94-1
changelog:
  - Rebase to 10.94, brining in support for LLVM 15.  (#2118992)
  - Annocheck: Better detection of binaries which do not contain code.  (#2144533)
  - Annocheck: Provide more information when a test is skipped because the file being tested was not compiled.
  - Annocheck: Try harder not to run mutually exclusive tests.
  - Tests: Fix future-test so that it properly handles the situation where the compiler does not support the new options.
  - Libannocheck: Actually set result fields after tests are run.
  - Libannocheck: Replace libannocheck_version variable with LIBANNOCHECK_VERSION define.
  - Libannocheck: Remove 'Requires binutils-devel' from libannocheck.pc.
  - Libannocheck: Move into separate sub-package.
  - Libannocheck: Add libannocheck.pc pkgconfig file.
  - Libannocheck: Add libannocheck_reinit().
  - GCC Plugin: Record -ftrivial-auto-var-init and -fzero-call-used-regs.
  - Annocheck: Add future tests for  -ftrivial-auto-var-init and -fzero-call-used-regs.
  - Clang Plugin: Fix for building with Clang-15.  (#2125875)
  - Annocheck: Add a test for the inconsistent use of -Ofast.  (#1248744)
  - Plugin: Fix top level configuration support for RiscV.
  - Annocheck: Improvements to the size tool.
  - Annocheck: Fixes for libannocheck.h.
  - Annocheck: Add automatic profile selection.
  - Annocheck: Improve gap detection and reporting.
  - Spec File: Use the %dir directive in the %files section to ensure that
  -  plugin directories are useable.  (#2080454)


author: Nick Clifton <nickc@redhat.com> - 10.98-1
changelog:
  - GCC Plugin: Fix building with gcc-13.
  - Annocheck: Add test for binaries built by cross compilers.
  - Annocheck: Improve heuristic used to detect binaries without code. (#2144533)
  - Annocheck: Use real filename rather than debuginfo filename.  (#2152280)


author: Nick Clifton <nickc@redhat.com> - 11.05-1
changelog:
  - Annocheck: Fix handling of empty files.  (#2159292)
  - Annocheck: Add crti.o and crtn.o to the list of known glibc special files.  (#2158740)
  - Annocheck: Fix memory leaks.
  - Annocheck: Do not assume that object files contain no code simply because they do not have an executable segment.  (#2158182)
  - Annocheck: Add more special glibc filenames.  (#2158100)


author: Nick Clifton <nickc@redhat.com> - 11.06-1
changelog:
  - Annocheck: Fix handling of file built by multiple versions of gcc.  (#2160701)
  - Spec file: Enable annotated building.


author: Nick Clifton <nickc@redhat.comn> - 2.38-15
changelog:
  - Adjust Provides and Requires fields of the sub-packages.
  - Use GTS-12 gcc to build static libraries.


author: Marek Polacek <polacek@redhat.com> 12.2.1-4
changelog:
  - update from releases/gcc-12 branch (#2110582)
  - fix up std::from_chars behavior in rounding modes other than FE_TONEAREST
    (PR libstdc++/107468)


author: Marek Polacek <polacek@redhat.com> 10.1.1-1.1
changelog:
  - correct instructions for creation of newlib tarball, filter out sun-rpc
    licensed code that is never used during the package build


author: Marek Polacek <polacek@redhat.com> 10.2.1-1
changelog:
  - GCC 10.2 release
  - add symlink to liblto_plugin.so in /usr/lib/bfd-plugins
  - disable -flto in %{optflags}, lto bootstrap will be enabled the GCC way
    later
  - require MPFR Library version 3.1.0 (or later)


author: Marek Polacek <polacek@redhat.com> 10.2.1-1.2
changelog:
  - avoid stack overflow in std::vector (PR libstdc++/94540, #1859670)
  - adjust some libstdc++_nonshared.a symbols
  - apply gcc10-libgfortran-compat-2.patch


author: Marek Polacek <polacek@redhat.com> 10.2.1-2
changelog:
  - update from Fedora gcc 10.2.1-2
  - emit debug info for C/C++ external function declarations used in the TU
    (PR debug/96383)
  - discard SHN_UNDEF global symbols from LTO debuginfo (PR lto/96385)
  - strip also -flto=auto from optflags


author: Marek Polacek <polacek@redhat.com> 11.1.1-2
changelog:
  - update from Fedora gcc 11.1.1-2
  - fix up mausezahn miscompilation (PR tree-optimization/100566)
  - fix build with removed linux/cyclades.h header (PR sanitizer/100379)
  - add a few Provides: bundled (#1859893)


author: Marek Polacek <polacek@redhat.com> 11.1.1-6
changelog:
  - update from Fedora gcc 11.1.1-6 (#1946782)
    - PRs c++/100876, c++/100879, c++/101106, c/100619, c/100783, fortran/95501,
     fortran/95502, fortran/100283, fortran/101123, inline-asm/100785,
     libstdc++/91488, libstdc++/95833, libstdc++/100806, libstdc++/100940,
     middle-end/100250, middle-end/100307, middle-end/100574,
     middle-end/100684, middle-end/100732, middle-end/100876,
     middle-end/101062, middle-end/101167, target/99842, target/99939,
     target/100310, target/100777, target/100856, target/100871,
     target/101016


author: Marek Polacek <polacek@redhat.com> 11.2.1-1
changelog:
  - update from releases/gcc-11-branch (#1986838)
    - GCC 11.2 release
    - PRs middle-end/101586, rtl-optimization/101562


author: Marek Polacek <polacek@redhat.com> 11.2.1-6
changelog:
  - update from releases/gcc-11-branch (#1996862)
    - PRs target/100208, target/100316, target/102761
  - build target shared libraries with -Wl,-z,relro,-z,now
  - add mwaitintrin.h on x86 (#2013860)
  - improve generated code with extern thread_local constinit vars
    with trivial dtors
  - add support for C++20 #__VA_OPT__
  - apply DTS-specific testsuite patches (#1996085)


author: Marek Polacek <polacek@redhat.com> 12.1.1-3
changelog:
  - update from releases/gcc-12 branch
    - PRs c++/49387, c++/102307, c++/102651, c++/104470, c++/105491, c++/105589,
  	c++/105623, c++/105652, c++/105655, c++/105725, c++/105734,
  	c++/105756, c++/105761, c++/105779, c++/105795, c++/105852,
  	c++/105871, c++/105885, c++/105908, c++/105925, c++/105931,
  	c++/105964, c++/106001, c/105635, d/105544, fortran/105230,
  	gcov-profile/105535, ipa/100413, ipa/105600, ipa/105639, ipa/105739,
  	libgomp/105745, libgomp/106045, libstdc++/104731, libstdc++/105284,
  	libstdc++/105671, libstdc++/105681, middle-end/105537,
  	middle-end/105604, middle-end/105711, middle-end/105951,
  	middle-end/105998, middle-end/106030, other/105527,
  	preprocessor/105732, rtl-optimization/105455, rtl-optimization/105559,
  	rtl-optimization/105577, sanitizer/105714, sanitizer/105729,
  	target/101891, target/104871, target/105162, target/105209,
  	target/105292, target/105472, target/105556, target/105599,
  	target/105854, target/105879, target/105953, target/105960,
  	target/105970, target/105981, target/106096, tree-optimization/103116,
  	tree-optimization/105431, tree-optimization/105458,
  	tree-optimization/105528, tree-optimization/105562,
  	tree-optimization/105618, tree-optimization/105726,
  	tree-optimization/105736, tree-optimization/105786,
  	tree-optimization/105940
  - enable tsan and lsan on s390x (#2101610)
  - fix up libtsan on s390x
  - fix nvptx build (PRs bootstrap/105551, target/105938)


author: Marek Polacek <polacek@redhat.com> 12.2.1-7.5
changelog:
  - fix conditions for using memcmp in
    std::lexicographical_compare_three_way (PR libstdc++/113960, RHEL-29952)


author: Kevin Buettner - 11.2-2
changelog:
  - On ix86, add -Wno-format-overflow to --enable-gdb-build-warnings. 
    (This is a workaround for the bogus warning/error that we now see
    on i686 regarding a "may write a terminating nul past the end of
    the destination" message for the sprintf() call in
    global_symbol_searcher::search() in gdb/symtab.c.)


author: Kevin Buettner - 11.2-3
changelog:
  - Backport upstream patch which removes sizes from debuginfod download
    messages when the size is not available (RHBZ 2068280, Aaron Merey).


author: Marek Polacek <polacek@redhat.com> - 12.0-3
changelog:
  - use rpm/macros.gcc-toolset-13-enable for %enable_devtoolset12 and put it in
    the -runtime subpackage (#2009528)


author: Nick Clifton <nickc@redhat.com> - 12.14-1
changelog:
  - Annocheck: Do not ignore separate debuginfo files that do not contain any DWARF.  (#2144553)
  - Annocheck: Ignore /dev/null filename in string notes.
  - Annocheck: More tweaks to glibc detection heuristics.  (#2215968)
  - Annocheck: Check for string notes in separate debug info files.  (#2211694)
  - Annocheck: Add support for el10 and rhel-10 profiles.  (RHEL-526)


author: Nick Clifton <nickc@redhat.com> - 12.16-1
changelog:
  - Spec File: Rebuild with annobin annotation.  (#2217812)
  - Annocheck: Ignore weak/undef function symbols when checking to see if a binary contains code.  (#2217840)
  - Annocheck: Add --suppress-version-warnings option.


author: Nick Clifton <nickc@redhat.com> - 12.20-1
changelog:
  - Annocheck: Ignore AArch64 $x and $d symbols.  (#2221192)
  - GCC Plugin: Suppress active checks for fortran sources.  Improve scanning of COLLECT_GCC_OPTIONS.
  - Annocheck: Remove dependency upon libiberty.


author: Nick Clifton <nickc@redhat.com> - 12.32-1
changelog:
  - LLVM Plugin: Fix building with LLVM version 17.  (RHEL-17311)
  - GCC Plugin: Add support for -fhardended.
  - Update glibc detection heuristics for PPC64.  (RHEL-16453)
  - Fix another atexit test failure.  (#2247481)
  - Fix atexit test failure.
  - Notes: Add support for string format notes.
  - GCC Plugin: Record settings of -Wstrict-flex-arrays and -fstrict-flex-arrays
  - Annobin: Add future test of these options.
  - GCC Plugin: Record settings of -Wimplicit-int and -Wimplicit-function-declaration.
  - Annobin: Add test for these warnings.
  - GCC Plugin: Enable string note format by default.
  - Annocheck: Change GO FIPS test to look for CGO_ENABLED markers.
  - Annocheck: Add test for FIPS compliant GO binaries.
  - Annocheck: Fix double free.  (#2226749)


author: Nick Clifton <nickc@redhat.com> - 12.32-2
changelog:
  - GCC Plugin: Add %verify tokens to show that the default plugin names are symbolic links. (RHEL-17505)


author: Nick Clifton <nickc@redhat.com> - 2.0-1
changelog:
  - Fixes for problems reported by the package submission review:
     * Add %license entry to %file section.
     * Update License and BuildRequires tags.
     * Add Requires tag.
     * Remove %clean.
     * Add %check.
     * Clean up the %changelog.
  - Update to use version 2 of the specification and sources.


author: Nick Clifton <nickc@redhat.com> - 2.3-1
changelog:
  - Add annobin-tests subpackage containing some preliminary tests.
  - Remove link-time test for unsupported targets.


author: Nick Clifton <nickc@redhat.com> - 3.4-1
changelog:
  - Change type and size of symbols to STT_NOTYPE/0 so that they do not confuse GDB.  (#1539664)
  - Add run-on-binaries-in.sh script to allow the other scripts to be run over a repository.


author: Nick Clifton <nickc@redhat.com> - 3.6-1
changelog:
  - Add --ignore-gaps option to check-abi.sh script.
  - Use this option in the abi-test check.
  - Tweak hardening test to skip pic and stack protection checks.


author: Nick Clifton <nickc@redhat.com> - 5.0-1
changelog:
  - Bias file start symbols by 2 in order to avoid them confused with function symbols.  (#1554332)
  - Version jump is to sync the version number with the annobin plugins internal version number.


author: Nick Clifton <nickc@redhat.com> - 5.6-1
changelog:
  - Skip the isa_flags check in the ABI test because the crt[in].o files are compiled with different flags from the test files.


author: Nick Clifton <nickc@redhat.com> - 7.0-1
changelog:
  - Add -debug-rpm= option to annocheck.
  - Only use a 2 byte offset for the initial symbol on PowerPC.


author: Nick Clifton <nickc@redhat.com> - 7.1-1
changelog:
  - Skip some checks for relocatable object files, and dynamic objects.
  - Stop bogus complaints about stackrealignment not being enabled.


author: Nick Clifton <nickc@redhat.com> - 8.0-1
changelog:
  - Use a prefix for all annobin generated symbols, and make them hidden.
  - Only generate weak symbol definitions for linkonce sections.


author: Nick Clifton <nickc@redhat.com> - 8.11-1
changelog:
  - Handle function sections properly.  Handle .text.startup and .text.unlikely sections.  Improve gap detection and reporting.  (#1601055)


author: Nick Clifton <nickc@redhat.com> - 8.22-1
changelog:
  - Reduce version check to gcc major version number only.  Skip compiler option checks if binary not built with gcc.  (#1603089)


author: Nick Clifton <nickc@redhat.com> - 8.28-1
changelog:
  - Skip gaps covered by _x86.get_pc_thunk and _savegpr symbols. (#1619267)
  - Merge ranges where one is wholly covered by another.


author: Nick Clifton <nickc@redhat.com> - 8.31-1
changelog:
  - Fix bug in hardened tool which would skip gcc compiled files if the notes were too small.
  - Fix bugs in section-size tool.
  - Fix bug in built-by tool.


author: Nick Clifton <nickc@redhat.com> - 8.33-1
changelog:
  - Add timing tool to report on speed of the checks.
  - Add check for conflicting use of the -fshort-enum option.
  - Add check of the GNU Property notes.
  - Skip check for -O2 if compiled with -Og.  (#1624162)


author: Nick Clifton <nickc@redhat.com> - 8.38-1
changelog:
  - Generate notes and groups for .text.hot and .text.unlikely sections.
  - When -ffunction-sections is active, put notes for startup sections into .text.startup.foo rather than .text.foo.
  - Similarly put exit section notes into .text.exit.foo.  (#1630574)
  - Change annocheck's maybe result for GNU Property note being missing into a PASS if it is not needed and a FAIL if it is needed.


author: Nick Clifton <nickc@redhat.com> - 8.46-1
changelog:
  - Annobin:   Fix section name selection for startup sections.
  - Annocheck: Improve gap skipping heuristics.   (#1630574)


author: Nick Clifton <nickc@redhat.com> - 8.66-1
changelog:
  - Annocheck: Do not ignore -Og when checking to see if an optimization level has been set.  (#1624162)


author: Nick Clifton <nickc@redhat.com> - 8.67-1
changelog:
  - Annocheck: Only skip specific checks for specific symbols.  (#1666823)
  - Annobin: Record the setting of the -fomit-frame-pointer option.


author: Nick Clifton <nickc@redhat.com> - 8.68-1
changelog:
  - Annocheck: Skip checks for -D_FORTIFY_SOURCE and -D_GLIBCXX_ASSERTIONS if there is no compiler generated code in the binary.


author: Nick Clifton <nickc@redhat.com> - 8.69-1
changelog:
  - Annobin: Add support for .text.startup and .text.exit sections generated by gcc 9.
  - Annocheck: Add a note displaying tool.


author: Nick Clifton <nickc@redhat.com> - 8.76-1
changelog:
  - Report a missing -D_FORTIFY_SOUCRE option if -D_GLIBCXX_ASSERTIONS was detected.  (#1703499)
  - Do not report problems with -fstack-protection if the binary was not built by gcc or clang.  (#1703788)


author: Nick Clifton <nickc@redhat.com> - 8.77-1
changelog:
  - Another attempt at fixing the detection and reporting of missing -D_FORTIFY_SOURCE options.  (#1703500)


author: Nick Clifton <nickc@redhat.com> - 8.81-1
changelog:
  - Improve detection of GO binaries.
  - Add gcc version information to annobin notes.
  - Do not complain about missing FORTIFY_SOURCE and GLIBCXX_ASSERTIONS in LTO compilations.


author: Nick Clifton <nickc@redhat.com> - 8.83-1
changelog:
  - If notes cannot be found in the executable look for them in the debuginfo file, if available.
  - Generate a FAIL if notes are missing from the executable/debuginfo file.
  - Record and report the setting of the AArcht64 specific -mbranch-protection option.


author: Nick Clifton <nickc@redhat.com> - 9.06-1
changelog:
  - Annobin: Note when stack clash notes are generated.
  - Annocheck: Handle multiple builder IDs in the .comment section.


author: Nick Clifton <nickc@redhat.com> - 9.11-1
changelog:
  - Fix infinite loop hangup in annocheck.
  - Disable debuginfod support by default.
  - Improve parsing of .comment section.


author: Nick Clifton <nickc@redhat.com> - 9.12-1
changelog:
  - Improve builtby tool.
  - Stop annocheck complaining about missing notes when the binary is not compiled by either gcc or clang.
  - Skip the check of the ENTRY instruction for binaries not compiled by gcc or clang.  (#1809656)


author: Nick Clifton <nickc@redhat.com> - 9.13-1
changelog:
  - Rename gcc plugin directory to gcc-plugin.
  - Stop annocheck from complaining about missing options when the binary has been built in a mixed environment.


author: Nick Clifton <nickc@redhat.com> - 9.14-1
changelog:
  - Annobin: Use offsets stored in gcc's cl_option structure to access the global_options array, thus removing the need to check for changes in the size of this structure.


author: Nick Clifton <nickc@redhat.com> - 9.24-1
changelog:
  - Add support for installing clang and llvm plugins.
  - Temporary suppression of aarch64 pointer size check.  (#1860549)


author: Nick Clifton <nickc@redhat.com> - 9.28-1
changelog:
  - gcc plugin: Do not complain about missing pre-processor options when examining a preprocessed input file.  (#1862718)


author: Nick Clifton <nickc@redhat.com> - 9.31-1
changelog:
  - gcc plugin: Use a 4 byte offset for PowerPC start symbols, so that they do not break disassemblies.


author: Nick Clifton <nickc@redhat.com> - 9.36-1
changelog:
  - Record the -flto setting and produce a soft warning if it is absent.
  - Suppress warnings about _D_GLIBCXX_ASSERTIONS if the source code is known to be something other than C++.


author: Nick Clifton <nickc@redhat.com> - 9.37-1
changelog:
  - Add test of .note.gnu.property section for PowerPC.
  - Add test of objcopy's ability to merge notes.


author: Nick Clifton <nickc@redhat.com> - 9.45-1
changelog:
  - GCC plugin: Always record global notes for the .text.startup,
    .text.exit, .text.hot and .text.cold sections.


author: Nick Clifton <nickc@redhat.com> - 9.52-1
changelog:
  - annocheck: When a binary is produced both by GAS and GCC, select GAS as the real producer.  (#1906171)


author: Nick Clifton <nickc@redhat.com> - 9.62-1
changelog:
  - Annocheck: Add colour to some messages.  Skip the deliberate use of -fno-stack-protector.  (#1923439)


author: Nick Clifton <nickc@redhat.com> - 9.63-1
changelog:
  - Annocheck: FAIL the deliberate use of -fno-stack-protector, but add some exceptions for glibc.  (#1923439)


author: Petr Pisar <ppisar@redhat.com> - 9.66-3
changelog:
  - Correct a package rename (bug #1949570)
  - Require docs subpackage by the other ones because of a license
  - Build-requiring perl-interpreter is enough


author: Nick Clifton <nickc@redhat.com> - 9.68-1
changelog:
  - Annocheck: WARN if the annobin plugin was built for a newer version of the compiler than the one on which it was run.  (#1950657)


author: Nick Clifton <nickc@redhat.com> - 9.72-1
changelog:
  - Annocheck: Accept 0 as a valid number for gcc minor versions and release numbers.
  - gcc-plugin: Add support for ARM and RISCV targets.


author: Nick Clifton <nickc@redhat.com> - 9.74-1
changelog:
  - Annocheck: Better support for symbolic links.
  - Annocheck: In verbose mode, report the reason for skipping specific tests.  (#1969584)


author: Nick Clifton <nickc@redhat.com> - 9.78-1
changelog:
  - gcc-plugin: Do not record global versions of stack protection settings in LTO mode, if not set.  (#1958954)


author: Nick Clifton <nickc@redhat.com> - 9.80-1
changelog:
  - Tests: Skip glibc-notes test if the assembler does not support --generate-missing-build-notes.  (#1978573)
  - Tests: Skip objcopy test if objcopy does not support --merge-notes.


author: Nick Clifton <nickc@redhat.com> - 9.85-1
changelog:
  - Annocheck: Detect a missing CET note.  (#1991931)
  - Annocheck: Do not report future fails for AArch64 notes.
  - Annocheck: Warn about multiple --debug-file, --debug-rpm and --debug-dir options.


author: Nick Clifton <nickc@redhat.com> - 9.88-1
changelog:
  - Annocheck: Generate MAYB results for gaps in notes covering the .text section.  (#1991943)
  - Annocheck: Close DWARF file descriptors once the debug info is no longer needed.  (#1981410)
  - LLVM Plugin: Update to build with Clang v13.  (Thanks to: Tom Stellard <tstellar@redhat.com>)


author: Nick Clifton <nickc@redhat.com> - 9.89-1
changelog:
  - Annocheck: Conditionalize detection of AArch64's PAC+BTI protection.
  - Annocheck: Add linker generated function for s390x exceptions.  (#1981410)


author: Nick Clifton <nickc@redhat.com> - 9.90-1
changelog:
  - Annocheck: Add linker generated function for ppc64le exceptions.  (#1981410)
  - LLVM Plugin: Allow checks to be selected from the command line.
  - Annocheck: Examine DW_AT_producer for -flto.


author: Nick Clifton <nickc@redhat.com> - 9.92-1
changelog:
  - Annocheck: Fix memory corruption.  (#1996963)
  - spec file: Add the creation of a gcc-plugin version info file in /usr/lib/rpm/redhat.


author: Nick Clifton <nickc@redhat.com> - 9.93-1
changelog:
  - LLVM Plugin: Automatically choose the correct tests to run, based upon the version of Clang installed. (#1997444)
  - spec file: Add the installation of the annobon sources into /usr/src/annobin.


author: Nick Clifton <nickc@redhat.com> - 9.95-1
changelog:
  - Annocheck: Fix fuzzing detected failures.
  - Annocheck: Add --profile option.
  - Docs: Document --profile option and rpminspect.yaml.


author: Nick Clifton <nickc@redhat.com> - 10.01-1
changelog:
  - Documentation: Add node for each hardening test.
  - Documentation: Install online.
  - Annocheck: Annote FAIL and MAYB results with URL to documentation
  - Annocheck: Add --no-urls and --provide-urls options
  - Annocheck: Add --help-<tool> option.


author: Nick Clifton <nickc@redhat.com> - 10.04-1
changelog:
  - Annocheck: With gaps at the start/end of the .text section, check for special symbols before displaying a MAYB result.


author: Nick Clifton <nickc@redhat.com> - 10.08-1
changelog:
  - Annocheck: Fix covscan detected problems.
  - Annocheck: Add --profile=el8.
  - gcc-plugin: Conditionalize generation of branch protection note.


author: Nick Clifton <nickc@redhat.com> - 10.10-1
changelog:
  - Annocheck: Fix cf-prot test to fail if the CET notes are missing.
  - Annocheck: Skip gaps in the .plt section.
  - Plugins: Add -g option when building LLVM and Clang.


author: Nick Clifton <nickc@redhat.com> - 10.12-1
changelog:
  - Annocheck: Fix MAYB results for mixed GO/C files.
  - Annocheck: Move some messages from VERBOSE to VERBOSE2.
  - Annocheck: Scan zero-length tool notes.


author: Nick Clifton <nickc@redhat.com> - 10.13-1
changelog:
  - Annocheck: Fix memory corruptions when using --debug-path and when a corrupt note is found.  (#20011438)


author: Nick Clifton <nickc@redhat.com> - 10.16-1
changelog:
  - Fix configuring annocheck without gcc-plugin.
  - Annocheck: Better reporting of debuginfod problems.
  - Tests: Fix bugs in debuginfod test.


author: Nick Clifton <nickc@redhat.com> - 10.21-1
changelog:
  - Annocheck: Do not fail if a --skip-<name> option does not match a known test.
  - ldconfig-test: Skip the LTO check.


author: Nick Clifton <nickc@redhat.com> - 10.29-1
changelog:
  - gcc-plugin: Fix bug creating empty attachments.
  - Annocheck: Change MAYB result to SKIP for DT_RPATH.  (#2026300)


author: Nick Clifton <nickc@redhat.com> - 10.39-1
changelog:
  - Annocheck: Add /usr/lib/ld-linux-aarch64.so.1 to the list of known glibc binaries.  (#2033255)
  - Doc: Note that ENDBR is only needed as the landing pad for indirect branches/calls.  (#28705)
  - Spec File: Store full	gcc version release string in plugin info file.  (#2030671)


author: Nick Clifton <nickc@redhat.com> - 10.40-1
changelog:
  - Annocheck: Do not complaining about missing stack clash notes if the compilation used LTO.  (#2034946)


author: Nick Clifton <nickc@redhat.com> - 10.41-1
changelog:
  - Annocheck: Ignore gaps that contain the _start symbol (for AArch64).  (#1995224)
  - Annocheck: Ignore more glibc special binaries.  (#2037220)


author: Nick Clifton <nickc@redhat.com> - 10.47-1
changelog:
  - Annocheck: Improve detection of kernel modules.
  - GCC Plugin: Only default to link-once when using gcc-12 or later.  (#2039297)


author: Nick Clifton <nickc@redhat.com> - 10.51-1
changelog:
  - Annocheck: Add an option to disable the use of debuginfod (if available).
  - Annocheck: Add more glibc special file names.
  - Annocheck: Skip some tests for BPF binaries.


author: Nick Clifton <nickc@redhat.com> - 10.66-1
changelog:
  - Annocheck: Do not complain about missing -mbranch-protection option in AArch64 binaries if compiled in LTO mode.


author: Nick Clifton <nickc@redhat.com> - 10.67-1
changelog:
  - Annocheck: Do not complain about missing -mbranch-protection option in AArch64 binaries if compiled by golang.


author: Nick Clifton <nickc@redhat.com> - 10.69-1
changelog:
  - Annocheck: Do not complain about unenabled -mbranch-protection option in AArch64 binaries if compiled using LTO.  (#2082146)


author: Nick Clifton <nickc@redhat.com> - 10.72-1
changelog:
  - Annocheck: Do not complain about unenabled -mbranch-protection option in AArch64 binaries.  (#2078909)


author: Nick Clifton <nickc@redhat.com> - 10.74-1
changelog:
  - Annocheck: Handle binaries created by Rust 1.18.  (#2094420)
  - Annocheck: Add optional function name to --skip arguments.  (PR 29229)


author: Nick Clifton <nickc@redhat.com> - 10.76-1
changelog:
  - Annocheck: Check build-id of separate debuginfo files.
  - Annocheck: Add GAPS test replacing --ignore-gaps.


author: Nick Clifton <nickc@redhat.com> - 10.76-3
changelog:
  - Spec File: Use the %dir directive in the %files section to ensure that
  -  plugin directories are useable.  (#2080454)


author: Nick Clifton <nickc@redhat.com> - 10.85-1
changelog:
  - GCC Plugin: Record -ftrivial-auto-var-init and -fzero-call-used-regs.
  - Annocheck: Add future tests for  -ftrivial-auto-var-init and -fzero-call-used-regs.


author: Nick Clifton <nickc@redhat.com> - 10.91-1
changelog:
  - Tests: Fix future-test so that it properly handles the situation where the compiler does not support the new options.


author: Nick Clifton <nickc@redhat.com> - 10.93-1
changelog:
  - Annocheck: Provide more information when a test is skipped because the file being tested was not compiled.


author: Nick Clifton <nickc@redhat.com> - 11.02-1
changelog:
  - Annocheck: Do not assume that object files contain no code simply because they do not have an executable segment.  (#2158182)


author: Nick Clifton <nickc@redhat.com> - 11.09-1
changelog:
  - Libannocheck: Fix thinko in debugging code.
  - Annocheck: Fix LTO test.
  - Notes: Display notes held in separate dbeuginfo files.


author: Nick Clifton <nickc@redhat.com> - 12.02-1
changelog:
  - gcc plugin: Add filenames to string notes.  Allow use of ANNOBIN environment variable.
  - llvm plugin: Add workaround for building with LLVM-16.
  - clang plugin: Fix for building with Clang-16.


author: Nick Clifton <nickc@redhat.com> - 12.04-1
changelog:
  - configure: More improvements.
  - annocheck: Fix seg-fault when checking for glibc components in string format notes.


author: Nick Clifton <nickc@redhat.com> - 12.07-1
changelog:
  - gcc-plugin: generate warnings about misspelt -D_FORTIFY_SOURCE and/or -D_GLIBCXX_ASSERTIONS options.


author: Nick Clifton <nickc@redhat.com> - 12.65-1
changelog:
  - Rebase to 12.65.  (RHEL-51018)
  - Annocheck: Fix recording arguments for later re-use.  (RHEL-50802)
  - GCC Plugin: Fix building AArch64 components with gcc earlier than 11.3.
  - Annocheck: Add improvements to the builtby utility.
  - Annocheck: Add support for ADA binaries.
  - Annocheck: Add support for binaries built from more than two high level source languages.
  - Annocheck: Add support for object files containing no executable code.
  - Annocheck: Do not FAIL LLVM compiled binaries that have not been built with sanitize-cfi and/or sanitize-safe-stack.
  - Annocheck: Add support for Fortran binaries.
  - Annocheck: Add heuristic for detecting parts of the CGO runtime library.
  - Annocheck: Add improvements for handling Clang runtime binaries.
  - Annocheck: Add tweaks for mixed Rust/C binaries.  (#2284605)
  - Annocheck: Add more glibc source file names.
  - Annocheck: Skip GAPS test for GO binaries.  (RHEL-36308)
  - Annocheck: Remove some false positives for Rust binaries.  (#2280239)
  - Annocheck: Defer passing the branch protection test until all notes have been checked.
  - GCC Plugin: Add extra code for detecting the branch protection setting.  (RHEL-35958)


author: Nick Clifton <nickc@redhat.com> - 12.69-1
changelog:
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Spec File: Use correct names for the symlinks.  (RHEL-53572)


author: Nick Clifton <nickc@redhat.com> - 12.92-1
changelog:
  - Rebase to bring in improvements for locating string notes.  (RHEL-79974)
  - Annocheck: Do not rely upon libelf's ability to detect links to separate debuginfo files.  (RHEL-79264)
  - Annocheck: Fix resource leak.  (RHEL-79253)
  - Annocheck: Fix double free. Add special handling for COMBOOT modules.
  - Annocheck: Improve diagnostics when a separate debug info file cannot be found.
  - Annocheck: Look for -fstack-clash-protection in DW_AT_producer string.  (RHEL-77328)
  - Annocheck: Fix locating string notes (again).  Add exception for glibc benchmark tests.  (RHEL-76456)
  - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries.  (RHEL-760404)
  - Annocheck: Fix the --debug-dir option.
  - Annocheck: Fix corrupt warning message when unable to locate separate debug info files.
  - Annocheck: Remove spurious debugging messages.
  - Annocheck: Always look for annobin notes in separate debug info files.  (RHEL-75778)
  - Annocheck: Support multiple --debug-rpm and --debug-file options.  (RHEL-73349)
  - Annocheck: Add support for sys-root'ed glibc packages.  (RHEL-71296)
  - GCC Plugin: Tidy up use of gcc's diagnoatic headers.  (#32429)
  - Testsuite: Use configured compiler when running tests.
  - GCC Plugin: Fix building with gcc 15.  (#32429)
  - Annocheck: Fix overly long debug messages.
  - Annocheck: Rename rwx-seg test to load-segments.  Add more checks.  Add check for gaps as a future fail.
  - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
  - Annocheck: Add --enable-future to enable future fail components in normal tests.
  - Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
  - Annocheck: Add more exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Add --skip-passes option.
  - Annocheck: Add exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Skip property note test for i386 binaries created by LLVM.  (#2323797)
  - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info.  (RHEL-65411)
  - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.


author: Nick Clifton <nickc@redhat.com> - 2.40-12
changelog:
  - Spec File: Enable building with GTS-13 gcc.  (#2217911)
  - Spec File: Build static libraries with -fno-lto.


author: Nick Clifton <nickc@redhat.com> - 2.40-17
changelog:
  - Spec File: Do not use of the system zlib by default.  (RHEL-19373)
  - Spec File: Do not check the mtime of ld.bfd. (RHEL-21303)


author: Nick Clifton <nickc@redhat.com> - 2.40-19
changelog:
  - Spec File: Restore the SElinux context to %{_libdir}.  (RHEL-22817)
  - [2.40-18: was a failed attempt to fix RHEL-22817]


author: Marek Polacek <polacek@redhat.com> 13.1.1-4
changelog:
  - update from releases/gcc-13 branch (#2188499)
    - PRs bootstrap/110085, c++/109871, fortran/100607, libgcc/109670,
  	libgcc/109685, libstdc++/108178, libstdc++/109261, libstdc++/109758,
  	libstdc++/109822, libstdc++/109949, libstdc++/110139,
  	middle-end/110200, target/82931, target/92729, target/104327,
  	target/105753, target/106907, target/109547, target/109650,
  	target/109800, target/109939, target/109954, target/110036,
  	target/110044, target/110088, target/110108, target/110227,
  	tree-optimization/109505, tree-optimization/110165,
  	tree-optimization/110166


author: Marek Polacek <polacek@redhat.com> 13.2.1-4
changelog:
  - update from releases/gcc-13 branch
    - PRs ada/110488, ada/111434, c++/99631, c++/111471, c++/111485, c++/111493,
  	c++/111512, fortran/68155, fortran/92586, fortran/111674,
  	libstdc++/108046, libstdc++/111050, libstdc++/111102,
  	libstdc++/111511, middle-end/111699, modula2/111510, target/111121,
  	target/111411, tree-optimization/110315, tree-optimization/110386,
  	tree-optimization/111331, tree-optimization/111519


author: Marek Polacek <polacek@redhat.com> 13.2.1-5
changelog:
  - update from releases/gcc-13 branch
    - PRs c++/89038, c/111884, d/110712, d/112270, fortran/67740, fortran/97245,
  	fortran/111837, fortran/112316, libbacktrace/111315,
  	libbacktrace/112263, libstdc++/110944, libstdc++/111172,
  	libstdc++/111936, libstdc++/112089, libstdc++/112314,
  	middle-end/111253, middle-end/111818, modula2/111756, modula2/112110,
  	target/101177, target/110170, target/111001, target/111366,
  	target/111367, target/111380, target/111935, target/112443,
  	tree-optimization/111397, tree-optimization/111445,
  	tree-optimization/111489, tree-optimization/111583,
  	tree-optimization/111614, tree-optimization/111622,
  	tree-optimization/111694, tree-optimization/111764,
  	tree-optimization/111820, tree-optimization/111833,
  	tree-optimization/111917
    - fix aarch64 RA ICE (#2241139, PR target/111528)
  - fix ia32 doubleword rotates (#2238781, PR target/110792)


author: Marek Polacek <polacek@redhat.com> 13.2.1-6
changelog:
  - update from releases/gcc-13 branch
    - PRs c++/33799, c++/102191, c++/111703, c++/112269, c++/112301, c++/112633,
  	c/112339, fortran/111880, fortran/112764, libgomp/111413,
  	libstdc++/112348, libstdc++/112491, libstdc++/112607,
  	middle-end/111497, target/53372, target/110411, target/111408,
  	target/111815, target/111828, target/112672, tree-optimization/111137,
  	tree-optimization/111465, tree-optimization/111967,
  	tree-optimization/112496
  - add -fno-stack-protector to aarch64 tests (RHEL-16940)


author: Marek Polacek <polacek@redhat.com> 12.2.1-4
changelog:
  - update from releases/gcc-12 branch (#2110583)
  - fix up std::from_chars behavior in rounding modes other than FE_TONEAREST
    (PR libstdc++/107468)


author: Marek Polacek <polacek@redhat.com> 13.1.1-1
changelog:
  - update from releases/gcc-13 branch (#2188499)
    - GCC 13.1 release
    - PRs c/107041, target/109566
  - remove libcc1


author: Jakub Jelinek <jakub@redhat.com> 13.1.1-2
changelog:
  - update from releases/gcc-13 branch
    - PRs c++/91618, c++/96604, c++/109506, c++/109640, c++/109642, c++/109666,
  	c++/109671, c++/109756, c/107682, c/109409, c/109412, debug/109676,
  	fortran/109622, libffi/109447, libgomp/108098, libstdc++/40380,
  	libstdc++/109694, libstdc++/109703, rtl-optimization/109585,
  	target/108758, target/109069, target/109535, target/109661,
  	target/109762, tree-optimization/109573, tree-optimization/109609,
  	tree-optimization/109724, tree-optimization/109778


author: Jakub Jelinek <jakub@redhat.com> 13.1.1-3
changelog:
  - update from releases/gcc-13 branch
    - PRs c++/80488, c++/83258, c++/97700, c++/103807, c++/109651, c++/109745,
  	c++/109761, c++/109774, c++/109868, c++/109884, fortran/109641,
  	fortran/109846, libstdc++/109816, libstdc++/109883, target/104338,
  	target/109697


author: Marek Polacek <polacek@redhat.com> 13.3.1-1
changelog:
  - update from releases/gcc-13 branch
    - GCC 13.3 release
    - PRs analyzer/104042, analyzer/108171, analyzer/109251, analyzer/109577,
  	analyzer/110014, analyzer/110112, analyzer/110700, analyzer/110882,
  	analyzer/111289, analyzer/112790, analyzer/112889, analyzer/112969,
  	analyzer/113253, analyzer/113333, analyzer/114408, analyzer/114473,
  	bootstrap/106472, bootstrap/114369, c/112571, c/114780, c++/89224,
  	c++/97990, c++/100667, c++/103825, c++/110006, c++/111284, c++/112769,
  	c++/113141, c++/113966, c++/114303, c++/114377, c++/114537,
  	c++/114561, c++/114562, c++/114572, c++/114580, c++/114634,
  	c++/114691, c++/114709, debug/112718, driver/111700, fortran/36337,
  	fortran/50410, fortran/55978, fortran/89462, fortran/93678,
  	fortran/95374, fortran/101135, fortran/102003, fortran/103707,
  	fortran/103715, fortran/103716, fortran/104352, fortran/106987,
  	fortran/106999, fortran/107426, fortran/110987, fortran/112407,
  	fortran/113799, fortran/113866, fortran/113885, fortran/113956,
  	fortran/114001, fortran/114474, fortran/114535, fortran/114739,
  	fortran/114825, fortran/115039, gcov-profile/114115,
  	gcov-profile/114715, ipa/92606, ipa/108007, ipa/111571, ipa/112616,
  	ipa/113359, ipa/113907, ipa/113964, jit/110466, libgcc/111731,
  	libquadmath/114533, libstdc++/66146, libstdc++/93672,
  	libstdc++/104606, libstdc++/107800, libstdc++/108976,
  	libstdc++/110050, libstdc++/110054, libstdc++/113841,
  	libstdc++/114147, libstdc++/114316, libstdc++/114359,
  	libstdc++/114367, libstdc++/114401, libstdc++/114750,
  	libstdc++/114803, libstdc++/114863, libstdc++/115063, lto/114655,
  	middle-end/110027, middle-end/111151, middle-end/111632,
  	middle-end/111683, middle-end/112684, middle-end/112732,
  	middle-end/113396, middle-end/113622, middle-end/114070,
  	middle-end/114348, middle-end/114552, middle-end/114599,
  	middle-end/114734, middle-end/114753, middle-end/114907,
  	rtl-optimization/54052, rtl-optimization/114415,
  	rtl-optimization/114768, rtl-optimization/114924, sanitizer/97696,
  	sanitizer/114687, sanitizer/114743, sanitizer/114956,
  	sanitizer/115172, target/88309, target/101865, target/105522,
  	target/110621, target/111234, target/111600, target/111610,
  	target/111822, target/112397, target/113095, target/113233,
  	target/113950, target/114049, target/114130, target/114160,
  	target/114172, target/114175, target/114272, target/114747,
  	target/114752, target/114794, target/114837, target/114848,
  	target/114981, testsuite/111066, testsuite/112297, testsuite/114034,
  	testsuite/114036, testsuite/114662, tree-optimization/91838,
  	tree-optimization/109925, tree-optimization/110838,
  	tree-optimization/111009, tree-optimization/111268,
  	tree-optimization/111407, tree-optimization/111736,
  	tree-optimization/111882, tree-optimization/112281,
  	tree-optimization/112303, tree-optimization/112793,
  	tree-optimization/112961, tree-optimization/112991,
  	tree-optimization/113552, tree-optimization/113630,
  	tree-optimization/113670, tree-optimization/113831,
  	tree-optimization/113910, tree-optimization/114027,
  	tree-optimization/114115, tree-optimization/114121,
  	tree-optimization/114203, tree-optimization/114231,
  	tree-optimization/114246, tree-optimization/114375,
  	tree-optimization/114396, tree-optimization/114485,
  	tree-optimization/114566, tree-optimization/114672,
  	tree-optimization/114733, tree-optimization/114736,
  	tree-optimization/114749, tree-optimization/114787,
  	tree-optimization/114799, tree-optimization/114876,
  	tree-optimization/114965, tree-optimization/115143,
  	tree-optimization/115152, tree-optimization/115154
  - add --without-clang-plugin --without-llvm-plugin to annobin configure
    options


author: Marek Polacek <polacek@redhat.com> 13.3.1-2
changelog:
  - update from releases/gcc-13 branch
    - PRs ada/114398, ada/114708, c/114493, c++/111529, c++/113598,
  	fortran/110415, fortran/114827, fortran/115150, libstdc++/114940,
  	libstdc++/115269, middle-end/108789, rtl-optimization/114902,
  	rtl-optimization/115092, target/113281, target/113719, target/115297,
  	target/115317, target/115324, tree-optimization/115192,
  	tree-optimization/115307, tree-optimization/115337
  - fix a shell condition (RHEL-40722)
  - backport a fix for modes_1.f90 (RHEL-40234)
  - fix up pointer types to may_alias structures (PR c/114493, RHEL-39736)


author: Keith Seitz <keiths@redhat.com> - 12.1-14
changelog:
  From Sergey Mende:
  - Backport upstream patch "gdb: call check_typedef at beginning of
    dwarf_expr_context::fetch_result". (Simon Marchi)


author: Kevin Buettner <kevinb@redhat.com> - 12.1-16
changelog:
  - Tweak gdb-6.3-rh-testversion-20041202.patch so that $_gdb_major
    and $_gdb_minor will be obtained correctly.


author: Keith Seitz <keiths@redhat.com> - 12.1-2.el9
changelog:
  - Backport binutls/29699 "Fix an illegal memory access when parsing..."
    (Nick Clifton, RHBZ 2153227)


author: Keith Seitz <keiths@redhat.com> - 12.1-4.el8
changelog:
  - Backport "Add a recursion limit to the demangle_const function
    in the Rust demangler."
    (Nick Clifton, RHEL-4237)


author: Nick Clifton <nickc@redhat.com> - 12.52-1
changelog:
  - Initial import of sources.
  - Compared to GTS-13 annobin (12.32) the improvements are:
  - Annocheck: Add OpenSSL Engine test.  (PTG-319)
  - Annocheck: Test for gaps even when only one note is present.
  - Annocheck: Skip AArch64 branch protection test for GO binaries.
  - GCC Plugin: Disable active check for -Wimplicit-int for non-C sources.  (#2275884)
  - Annocheck: Ignore stack checks for AMD GPU binaries.
  - Annocheck: Do not produce FAIL result for i686 binaries in the RHEL-10 profile.
  - Annocheck: Test for __stack_chk_guard being writeable.
  - Annocheck: Update heuristics for detecting glibc code in executables.  (RHEL-30579)
  - Clang & LLVM Plugins: Allow environment to override fortification level.  (RHEL-30579)
  - Spec File: Override fortification level and set it to 3.
  - Annocheck: Improve detection of -mbranch-protection option.
  - Clang Plugin: Add global-file-syms option.
  - LLVM Plugin: Add global-file-syms option.
  - Plugins: Add support for ANNOBIN environment variable.
  - GCC Plugin: Fix bug extracing the value of target specific command line options.
  - Configure: Remove check for FrontendPluginRegistry.h header as it is stored in a non-standard location on Debian systems.
  - Debuginfod test: Allow for the libdwfl library silently contacting the debuginfod server.
  - LLVM Plugin: Use llvm-config to get the correct paths and options for building executables.
  - Clang Plugin: Likewise.
  - Enable silent rules for most building.
  - Annocheck: Correctly extract DWARF attributes from DT_REL files.
  - Annocheck: Improve heuristics for locating debug info files.  (#2267097)
  - Configure: Harmonize configure options.    
  - Clang Plugin: Fix building with Clang 18.  (#31414)
  - GCC Plugin: Add support for MIPS specific target functions.
  - GCC Plugin: Use .dc.a for address expressions in 64-bit ELF format notes.
  - Spec File: Remove a workaround for ppc64le.
  - Annocheck: Improve heuristic for skipping LTO and FORTIFY tests.  (#2264000)
  - Annocheck: Also skip property note test for i686 binaries. (#2258571)
  - Annocheck: Also skip the entry point test for i686 binaries. (#2258571)
  - GCC Plugin: Do not use section groups with string format notes.
  - Annocheck: Disable cf-protection test for i686 architecture. (#2258571)
  - Spec File: Disable hard gcc check in order to allow builds with new version of gcc.
  - Spec File: Do not install annocheck.1.gz when annocheck is disabled.
  - Annocheck: Improve detection of FIPS compliant GO binaries.
  - GCC Plugin: Fix recording of the -Wimplicit-int and -Wimplicit-function-declaration warnings.  Add active checks for when they are deliberately disabled.
  - Tests: Fix implicit-values test so that it will compile with gcc 14+.


author: Nick Clifton <nickc@redhat.com> - 12.65-1
changelog:
  - Rebase to 12.65.  (RHEL-51056)
  - Annocheck: Fix recording arguments for later re-use.  (RHEL-50802)
  - GCC Plugin: Fix building AArch64 components with gcc earlier than 11.3.
  - Annocheck: Add improvements to the builtby utility.
  - Annocheck: Add support for ADA binaries.
  - Annocheck: Add support for binaries built from more than two high level source languages.
  - Annocheck: Add support for object files containing no executable code.
  - Annocheck: Do not FAIL LLVM compiled binaries that have not been built with sanitize-cfi and/or sanitize-safe-stack.
  - Annocheck: Add support for Fortran binaries.
  - Annocheck: Add heuristic for detecting parts of the CGO runtime library.
  - Annocheck: Add improvements for handling Clang runtime binaries.
  - Annocheck: Add tweaks for mixed Rust/C binaries.  (#2284605)
  - Annocheck: Add more glibc source file names.
  - Annocheck: Skip GAPS test for GO binaries.  (RHEL-36308)
  - Annocheck: Remove some false positives for Rust binaries.  (#2280239)
  - Annocheck: Defer passing the branch protection test until all notes have been checked.
  - GCC Plugin: Add extra code for detecting the branch protection setting.  (RHEL-35958)


author: Nick Clifton <nickc@redhat.com> - 12.67-1
changelog:
  - Annocheck: Stop spurious assembler warnings.  (RHEL-53213)
  - Annocheck: Stop warnings about known gaps.    (RHEL-53218)
  - Annocheck: Fix stack realign test.  (#2302427)


author: Nick Clifton <nickc@redhat.com> - 12.67-2
changelog:
  - Spec File: Use correct directory for plugin installation.  (RHEL-53210)
  - Spec File: Disable plugin when running on wrong major version of the compiler.


author: Nick Clifton <nickc@redhat.com> - 12.69-1
changelog:
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Spec File: Use correct names for the symlinks.  (RHEL-53210)


author: Nick Clifton <nickc@redhat.com> - 12.87-1
changelog:
  - Rebase for GTS 14.1 release.  (RHEL-76929)
  - Annocheck: Fix locating string notes (again).  Add exception for glibc benchmark tests.  (RHEL-76456)
  - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries.  (RHEL-760404)
  - Annocheck: Fix the --debug-dir option.
  - Annocheck: Fix corrupt warning message when unable to locate separate debug info files.
  - Annocheck: Remove spurious debugging messages.
  - Annocheck: Always look for annobin notes in separate debug info files.  (RHEL-75778)
  - Annocheck: Support multiple --debug-rpm and --debug-file options.  (RHEL-73349)
  - Annocheck: Add support for sys-root'ed glibc packages.  (RHEL-71296)
  - GCC Plugin: Tidy up use of gcc's diagnoatic headers.  (#32429)
  - Testsuite: Use configured compiler when running tests.
  - GCC Plugin: Fix building with gcc 15.  (#32429)
  - Annocheck: Fix overly long debug messages.
  - Annocheck: Rename rwx-seg test to load-segments.  Add more checks.  Add check for gaps as a future fail.
  - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
  - Annocheck: Add --enable-future to enable future fail components in normal tests.
  - Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
  - Annocheck: Add more exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Add --skip-passes option.
  - Annocheck: Add exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Skip property note test for i386 binaries created by LLVM.  (#2323797)
  - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info.  (RHEL-65411)
  - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.


author: Marek Polacek <polacek@redhat.com> 14.2.1-1
changelog:
  - update from releases/gcc-14 branch
    - GCC 14.2 release
    - PRs analyzer/114899, c++/99241, c++/99242, c++/104981, c++/106760,
  	c++/111890, c++/115165, c++/115476, c++/115550, c++/115561,
  	c++/115583, c++/115623, c++/115754, c++/115783, c++/115865,
  	c++/115897, c++/115900, c++/115986, fortran/59104, fortran/84006,
  	fortran/93635, fortran/98534, fortran/99798, fortran/100027,
  	fortran/103115, fortran/103312, fortran/113363, fortran/115700,
  	ipa/111613, ipa/113291, ipa/113787, ipa/114207, ipa/115033,
  	ipa/115277, ipa/116055, libstdc++/113376, libstdc++/114387,
  	libstdc++/115399, libstdc++/115482, libstdc++/115522,
  	libstdc++/115585, libstdc++/115807, libstdc++/115854,
  	libstdc++/116070, middle-end/115527, middle-end/115836,
  	middle-end/115887, pch/115312, rtl-optimization/115049,
  	rtl-optimization/115565, target/87376, target/88236, target/97367,
  	target/98762, target/105090, target/113715, target/114759,
  	target/114890, target/114936, target/114988, target/115068,
  	target/115153, target/115188, target/115351, target/115389,
  	target/115456, target/115457, target/115459, target/115475,
  	target/115526, target/115554, target/115562, target/115591,
  	target/115611, target/115691, target/115725, target/115726,
  	target/115752, target/115763, target/115840, target/115872,
  	target/115978, target/115981, target/115988, target/116035,
  	testsuite/115826, testsuite/116061, tree-optimization/113673,
  	tree-optimization/115382, tree-optimization/115646,
  	tree-optimization/115669, tree-optimization/115694,
  	tree-optimization/115701, tree-optimization/115723,
  	tree-optimization/115841, tree-optimization/115843,
  	tree-optimization/115867, tree-optimization/115868,
  	tree-optimization/116034, tree-optimization/116057


author: Marek Polacek <polacek@redhat.com> 14.2.1-7
changelog:
  - update from releases/gcc-14 branch (RHEL-74062)
    - PRs ada/113036, ada/113868, ada/115917, ada/117328, ada/117996,
  	analyzer/115724, c/117641, c/117745, c/117802, c++/100358, c++/101463,
  	c++/102594, c++/109859, c++/113108, c++/114854, c++/115008,
  	c++/115430, c++/115657, c++/116108, c++/116634, c++/117158,
  	c++/117317, c++/117614, c++/117615, c++/117792, c++/117825,
  	c++/117845, c++/117880, c++/117925, c++/117985, c++/118060,
  	c++/118069, driver/117942, fortran/84674, fortran/84869,
  	fortran/105054, fortran/109105, fortran/109345, fortran/115070,
  	fortran/115348, fortran/116388, fortran/117730, fortran/117763,
  	fortran/117774, fortran/117791, fortran/117797, fortran/117819,
  	fortran/117820, fortran/117843, fortran/117897, libgomp/117851,
  	libstdc++/89624, libstdc++/106212, libstdc++/106676, libstdc++/108236,
  	libstdc++/109517, libstdc++/109976, libstdc++/112349,
  	libstdc++/112641, libstdc++/117520, libstdc++/117560,
  	libstdc++/117822, libstdc++/117962, libstdc++/117966,
  	libstdc++/118035, libstdc++/118093, middle-end/43374,
  	middle-end/102674, middle-end/116997, middle-end/117433,
  	middle-end/117458, middle-end/117459, middle-end/117847,
  	middle-end/118024, modula2/114529, modula2/115003, modula2/115057,
  	modula2/115164, modula2/115276, modula2/115328, modula2/115536,
  	modula2/115540, modula2/115804, modula2/115823, modula2/115957,
  	modula2/116048, modula2/116181, modula2/116378, modula2/116557,
  	modula2/116918, modula2/117120, modula2/117371, modula2/117555,
  	modula2/117660, modula2/117904, modula2/117948, other/116603,
  	preprocessor/117118, rtl-optimization/113994, rtl-optimization/116799,
  	rtl-optimization/117095, sanitizer/117960, target/64242,
  	target/114801, target/114942, target/116371, target/116629,
  	target/116999, target/117045, target/117105, target/117304,
  	target/117357, target/117408, target/117418, target/117443,
  	target/117500, target/117525, target/117562, target/117564,
  	target/117642, target/117659, target/117675, target/117744,
  	target/117926, testsuite/103298, testsuite/109360,
  	tree-optimization/94589, tree-optimization/112376,
  	tree-optimization/116463, tree-optimization/117142,
  	tree-optimization/117254, tree-optimization/117307,
  	tree-optimization/117333, tree-optimization/117398,
  	tree-optimization/117417, tree-optimization/117439,
  	tree-optimization/117574, tree-optimization/117594,
  	tree-optimization/117612, tree-optimization/117912
  - fix up -freport-bug default (#2330362, RHEL-73476)
  - revert -mearly-ldp-fusion and -mlate-ldp-fusion default to enabled on
    aarch64 to match upstream (RHEL-74058)
  - consider TARGET_EXPR invariant like SAVE_EXPR (PR c++/118509)
  - have gfortran require install-info (RHEL-76087)


author: Marek Polacek <polacek@redhat.com> 15.1.1-1
changelog:
  - update from releases/gcc-15 branch
    - GCC 15.1 release
    - PRs fortran/119836, target/119327, target/119873, tree-optimization/118407


author: Marek Polacek <polacek@redhat.com> 15.1.1-2
changelog:
  - update from releases/gcc-15 branch
    - PRs ada/112958, ada/120104, c/120057, c++/119863, c++/119864, c++/119938,
     c++/119939, c++/119981, c++/119996, c++/120012, c++/120013,
     c++/120023, c++/120125, c++/120161, c++/120350, fortran/102891,
     fortran/102900, fortran/119928, fortran/119986, fortran/120049,
     fortran/120107, fortran/120139, fortran/120163, fortran/120179,
     fortran/120191, ipa/119852, ipa/119973, ipa/120006, ipa/120146,
     libfortran/120152, libfortran/120153, libfortran/120158,
     libfortran/120196, libstdc++/118260, libstdc++/119427,
     libstdc++/119714, libstdc++/120029, libstdc++/120114,
     libstdc++/120159, libstdc++/120187, libstdc++/120190,
     libstdc++/120198, libstdc++/120293, modula2/115276, modula2/119914,
     modula2/119915, modula2/120117, modula2/120188, preprocessor/116047,
     preprocessor/120061, target/119610, testsuite/119909,
     tree-optimization/111873, tree-optimization/119712,
     tree-optimization/120043, tree-optimization/120048,
     tree-optimization/120074, tree-optimization/120089,
     tree-optimization/120143, tree-optimization/120211


author: Marek Polacek <polacek@redhat.com> 15.1.1-2.3
changelog:
  - re-enable annobin-plugin and offload-nvptx
  - configure with --enable-host-pie --enable-host-bind-now (RHEL-95594)


author: Nick Clifton <nickc@redhat.com> - 9.07-1
changelog:
  - Rebase to 9.07 release:
  - Annobin: Add checks of the exact location of the examined switches.
  - Annobin: Note when stack clash notes are generated.
  - Annocheck: Handle multiple builder IDs in the .comment section.
  - Add configure option to suppress building annocheck.
  - Fix debuginfod test.
  - Correct the build requirement for building with debuginfod support.
  - Add debuginfod support.
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
  - Rebuild againt latest gcc-10.
  - Add clang plugin (experimental).
  - Have annocheck ignore notes with an end address of 0.
  - Improve checking of gcc versions.
  - Do not skip positive results.
  - Generate a WARN result for code compiled with instrumentation enabled.  (#1753918)
  - Replace address checks with dladdr1.
  - Use libabigail like checking to ensure variable address consistency.
  - Skip generation of global notes for hot/cold sections.
  - Generate FAIL results if -Wall or -Wformat-security are missing.
  - If notes cannot be found in the executable look for them in the debuginfo file, if available.
  - Generate a FAIL if notes are missing from the executable/debuginfo file.
  - Record and report the setting of the AArcht64 specific -mbranch-protection option.
  - Improve detection of GO binaries.
  - Add gcc version information to annobin notes.
  - Do not complain about missing FORTIFY_SOURCE and GLIBCXX_ASSERTIONS in LTO compilations.
  - Allow compiler used to run tests to be specified on the command line.  (#1723401)


author: Nick Clifton <nickc@redhat.com> - 2.32-17
changelog:
  - Fix a potential seg-fault in the BFD library when parsing pathalogical debug_info sections.  (#1779255)
  - Fix a potential memory exhaustion in the BFD library when parsing corrupt DWARF debug information.
  - Backport H.J.Lu's patch to add a workaround for the JCC Errata to the assembler. (#1779417)
  - Fix potential integer overflow in readelf.  (#1740470)
  - Fix potential integer overflow in GOLD.  (#1739491)


author: Nick Clifton <nickc@redhat.com> 2.29.1-4
changelog:
  - Have readelf suggest the use of --use-dynamic when there are dynamic relocs that could have been displayed.  (#1507694)


author: Nick Clifton <nickc@redhat.com> 2.29.1-14
changelog:
  - Fix creation of PowerPC64 function call stubs.  (#1523457)
  - Disable -z defs during build.
  - Disable binary annotations.  (temporary ?)


author: Nick Clifton <nickc@redhat.com> 2.30-5
changelog:
  - Fix assignment of pages to segments. (PR 22758)
  - Inject RPM_LD_FLAGS into the build.  (#1541027)
  - Fix slowdown in readelf when examining files with lots of debug information.  (PR 22802)
  - Remove support for PowerPC speculation barrier insertion.
  - Rebase on 2.30
  - Retire binutils-2.22.52.0.1-relro-on-by-default.patch
  - Retire binutils-2.28-dynamic-section-warning.patch
  - Retire binutils-2.29-skip-rp14918-test-for-arm.patch
  - Retire binutils-2.29.1-gold-start-stop.patch
  - Retire binutils-2.29.1-readelf-use-dynamic.patch
  - Retire binutils-aarch64-pie.patch
  - Retire binutils-coverity.patch
  - Retire binutils-ppc64-stub-creation.patch
  - Retire binutils-strip-delete-relocs.patch
  - Retire binutils-support-v3-build-notes.patch
  - Retire binutils-z-undefs.patch


author: Nick Clifton <nickc@redhat.com> 2.30.90-2
changelog:
  - Revert fix for PR 23161 which was placing unversioned section symbols (_edata, _end, __bss_start) into shared libraries.  (#1599521)


author: Nick Clifton <nickc@redhat.com> 2.30.90-3
changelog:
  - Stop gold from complaining about annobin note relocs against symbols in sections which have been discarded.  (#1600431)


author: Nick Clifton <nickc@redhat.com> - 2.31.1-1
changelog:
  - Rebase to official 2.31.1 GNU Binutils release.
  - Retire: binutils-2.22.52.0.1-export-demangle.h.patch
  - Retire: binutils-2.30-allow_R_AARCH64-symbols.patch
  - Retire: binutils-CVE-2018-10372.patch
  - Retire: binutils-CVE-2018-10373.patch
  - Retire: binutils-CVE-2018-10534.patch
  - Retire: binutils-CVE-2018-10535.patch
  - Retire: binutils-CVE-2018-6323.patch
  - Retire: binutils-CVE-2018-6759.patch
  - Retire: binutils-CVE-2018-7208.patch
  - Retire: binutils-CVE-2018-7568.patch
  - Retire: binutils-CVE-2018-7569.patch
  - Retire: binutils-CVE-2018-7570.patch
  - Retire: binutils-CVE-2018-7642.patch
  - Retire: binutils-CVE-2018-7643.patch
  - Retire: binutils-CVE-2018-8945.patch
  - Retire: binutils-PowerPC-IEEE-long-double-warnings.patch
  - Retire: binutils-debug-section-marking.patch
  - Retire: binutils-gas-build-notes.patch
  - Retire: binutils-gold-llvm-plugin.patch
  - Retire: binutils-ifunc-relocs-in-notes.patch
  - Retire: binutils-linkonce-notes.patch
  - Retire: binutils-missing-notes.patch
  - Retire: binutils-page-to-segment-assignment.patch
  - Retire: binutils-revert-PowerPC-speculation-barriers.patch
  - Retire: binutils-skip-dwo-search-if-not-needed.patch
  - Retire: binutils-speed-up-objdump.patch
  - Retire: binutils-strip-unknown-relocs.patch
  - Retire: binutils-x86-local-relocs.patch
  - Retire: binutils-x86-local-version.patch


author: Nick Clifton <nickc@redhat.com> - 2.31.1-13
changelog:
  - Delay the evaluation of linker script constants until after the configuration options have been set.  (#1624751)


author: Nick Clifton <nickc@redhat.com> - 2.31.1-14
changelog:
  - Fix a potential buffer overrun when parsing a corrupt ELF file.  (#1632912)
  - Add a .attach_to_group pseuo-op to assembler (for use by annobin).  (#1630574)
  - Stop the binutils from statically linking with libstdc++.  (#1630550)
  - Include gold testsuite results in test logs.
  - Disable readelf's reporting of gaps in build notes.  (#1623556)


author: Nick Clifton <nickc@redhat.com> - 2.32-1
changelog:
  - Rebase to GNU Binutils 2.32
  - Retire: binutils-s390-partial-relro.patch
  - Retire: binutils-note-merge-improvements.patch
  - Retire: Retire: binutils-merge-attribute-sections.patch
  - Retire: binutils-gold-discard-version-info.patch
  - Retire: binutils-gas-input-matches-output.patch
  - Retire: binutils-fix-testsuite-failures.patch
  - Retire: binutils-do-not-provide-shared-section-symbols.patch
  - Retire: binutils-disable-readelf-gap-reports.patch
  - Retire: binutils-detect-corrupt-sym-version-info.patch
  - Retire: binutils-delay-ld-script-constant-eval.patch
  - Retire: binutils-clear-version-info.patch
  - Retire: binutils-CVE-2018-20002.patch
  - Retire: binutils-CVE-2018-17358.patch
  - Retire: binutils-2.31-export-demangle.h.patch
  - Retire: binutils-2.28-ignore-gold-duplicates.patch
  - Retire: binutils-2.26-lto.patch


author: Nick Clifton <nickc@redhat.com> - 2.32-7
changelog:
  - Stop gold from aborting when it encounters input sections with the same name and different flags.  (#1722715)


author: Nick Clifton <nickc@redhat.com> - 2.32-15.1
changelog:
  - Fix a potential seg-fault in the BFD library when parsing pathalogical debug_info sections.  (#1779255)
  - Fix a potential memory exhaustion in the BFD library when parsing corrupt DWARF debug information.
  - Backport H.J.Lu's patch to add a workaround for the JCC Errata to the assembler. (#1783958)
  - Fix potential integer overflow in readelf.  (#1740470)
  - Fix potential integer overflow in GOLD.  (#1739491)


author: Mark Wielaard <mjw@fedoraproject.org> - 0.171-1
changelog:
  - New upstream release.
    - DWARF5 and split dwarf, including GNU DebugFission, support.
    - readelf: Handle all new DWARF5 sections.
      --debug-dump=info+ will show split unit DIEs when found.
      --dwarf-skeleton can be used when inspecting a .dwo file.
      Recognizes GNU locviews with --debug-dump=loc.
    - libdw: New functions dwarf_die_addr_die, dwarf_get_units,
      dwarf_getabbrevattr_data and dwarf_cu_info.
      libdw will now try to resolve the alt file on first use
      when not set yet with dwarf_set_alt.
      dwarf_aggregate_size() now works with multi-dimensional arrays.
    - libdwfl: Use process_vm_readv when available instead of ptrace.
    - backends: Add a RISC-V backend.


author: Mark Wielaard <mjw@fedoraproject.org> - 0.172-1
changelog:
  - New upstream release.
    - No functional changes compared to 0.171.
    - Various bug fixes in libdw and eu-readelf dealing with bad DWARF5
      data. Thanks to running the afl fuzzer on eu-readelf and various
      testcases.
    - eu-readelf -N is ~15% faster.


author: Mark Wielaard <mjw@redhat.com> - 0.173-1
changelog:
  - New upstream release
    - More fixes for crashes and hangs found by afl-fuzz. In particular
      various functions now detect and break infinite loops caused by bad
      DIE tree cycles.
    - readelf: Will now lookup the size and signedness of constant value
      types to display them correctly (and not just how they were encoded).
    - libdw: New function dwarf_next_lines to read CU-less .debug_line data.
      dwarf_begin_elf now accepts ELF files containing just .debug_line
      or .debug_frame sections (which can be read without needing a DIE
      tree from the .debug_info section).
      Removed dwarf_getscn_info, which was never implemented.
    - backends: Handle BPF simple relocations.
      The RISCV backends now handles ABI specific CFI and knows about
      RISCV register types and names.

  - Add scl macros and elfutils-0.173-dts.patch.


author: Mark Wielaard <mjw@redhat.com> - 0.174-1
changelog:
  - New upstream release
    - libelf, libdw and all tools now handle extended shnum and shstrndx
      correctly
    - elfcompress: Don't rewrite input file if no section data needs
      updating.  Try harder to keep same file mode bits (suid) on rewrite.
    - strip: Handle mixed (out of order) allocated/non-allocated sections.
    - unstrip: Handle SHT_GROUP sections.
    - Fixes CVE-2018-16062, CVE-2018-16402 and CVE-2018-16403.


author: Mark Wielaard <mjw@redhat.com> - 0.176-1
changelog:
  - Update to elfutils-0.176.
    - Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150,
            CVE-2019-7664, CVE-2019-7665.


author: Mark Wielaard <mjw@redhat.com> - 0.176-4
changelog:
  - Add elfutils-0.176-gcc-pr88835.patch
  - Add elfutils-0.176-xlate-note.patch
  - Add elfutils-0.176-elf-update.patch


author: Marek Polacek <polacek@redhat.com> 9.1.1-2
changelog:
  - update from Fedora 9.1.1-2 (#1728745)
  - apply Fortran patches (#1722881)
  - do not include libasan5 and libubsan1 on RHEL 8 and use the system
    version (#1722892)


author: Marek Polacek <polacek@redhat.com> 9.2.1-2
changelog:
  - update from Fedora gcc-9.2.1-2 (#1747158)
  - fix ABI change in deque iterators (PR libstdc++/92267)
  - fix up sink select_best_block (PR tree-optimization/91355)
  - revert PR tree-optimization/91790 fix
  - allow MODE_PARTIAL_INT modes for integer constant input operands
    (PR other/92090)
  - fix adjust_unroll_factor (PR middle-end/90796)
  - fixes for SVE Vector PCS on AArch64: emit .variant_pcs for
    aarch64_vector_pcs symbol references (#1726641)


author: Sergio Durigan Junior <sergiodj@redhat.com> - 8.2.90.20190320-21
changelog:
  - Rebase to FSF GDB 8.2.90.20190320 (8.3pre).
  - Fix 'New gdb terminal colors are unreadable on GNOME Terminal "dark"
    theme.' (Tom Tromey, RH BZ 1688372).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 8.3-1
changelog:
  - Release GDB 8.3.
  - Fix 'gcore does not support COREFILTER_ELF_HEADERS' (Sergio Durigan
    Junior, RH BZ 1371380).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 8.3-2
changelog:
  - "Fix" segfault that happens on parse_macro_definition because
    debugedit corrupts the .debug_macro section (Sergio Durigan Junior,
    RH BZ 1708192).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 8.3-3
changelog:
  - Complement previous fix of a segfault that happens on
    parse_macro_definition (RHBZ 1715008, Sergio Durigan Junior).


author: Keith Seitz <keiths@redhat.com> - gcc-toolset-9 8.3-1
changelog:
  - Add Buildrequire for boost-devel.
  - Include guile support for RHEL.
  - Add gating for gcc-toolset-9.
  - Define global __python to workaround scl python issue.


author: DJ Delorie <dj@redhat.com> - 0.7.91-27
changelog:
  - Fix aarch64 long parameters (via $r8) support.
  - Make system_call_params test compare more exactly.


author: Patsy Griffin Franklin <pfrankli@redhat.com> 1:4.2.1-9
changelog:
  - Fix build failure caused by automake versioning differences related
    to the glob changes.
  - Fix testing failure due to Perl changes related to expanding paths.


author: Frank Ch. Eigler <fche@redhat.com> - 4.1-2
changelog:
  - Disable various host-service-related options.
  - Correct GNU_parameter_ref dwarf feature typo.
  - Upstream release.


author: Mark Wielaard <mjw@redhat.com> - 3.14.0-8
changelog:
  - Update valgrind-3.14.0-jm-vmx-constraints.patch for ppc64. (#1658680)
  - Show all diff files in check, not just the main/default one.


author: Mark Wielaard <mjw@fedoraproject.org> - 3.15.0-5
changelog:
  - Add valgrind-3.15.0-exp-sgcheck-no-aarch64.patch
  - Add valgrind-3.15.0-scalar-arm64.patch
  - Add valgrind-3.15.0-scalar-x86.patch


author: Mark Wielaard <mjw@redhat.com> - 3.15.0-6
changelog:
  - Update valgrind-3.15.0-copy_file_range.patch.
  - Update valgrind-3.15.0-some-stack-protector.patch to include getoff.
  - Add valgrind-3.15.0-some-Wl-z-now.patch
  - Add valgrind-3.15.0-s390x-wrap-drd.patch


author: Kalev Lember <klember@redhat.com> - 3.27.92-1
changelog:
  - Update to 3.27.92
  - Use valgrind_arches macro instead of hardcoding valgrind arch list
  - Drop group tags
  - Drop ldconfig scriptlets
  - Move desktop file validation to check section
  - Drop ancient conflicts


author: Remi Collet <remi@fedoraproject.org> - 2.2.5-1
changelog:
  - Update to 2.2.5
  - fix double-free in gdImagePngPtr(). CVE-2017-6362
  - fix buffer over-read into uninitialized memory. CVE-2017-7890


author: mskalick@redhat.com - 2.2.5-6
changelog:
  - Check return value in gdImageBmpPtr to avoid double free (CVE-2018-1000222)
    Resolves: RHBZ#1621956


author: fjanus@redhat.com - 2.2.5-7
changelog:
  - Fix CVE-2018-14553 - Potential Null pointer dereference in gdImageClone
    Resolves: RHBZ#1811788
  - Fixed heap based buffer overflow in gd_color_match.c:gdImageColorMatch() in libgd as used in imagecolormatch()
    Resolves: RHBZ#1678104 (CVE-2019-6977)
  - Fixed potential double-free in gdImage*Ptr()
    Resolves: RHBZ#1679002 (CVE-2019-6978)


author: Keith Seitz <keiths@redhat.com> - 8.2-13.el8
changelog:
  - Backport "Fix terminal problems when error() is called."
    (Alan Hayward RH BZ 1852580)
  - Backport "core file memory access problem."
    (Kevin Buettner, RH BZ 1785126)
  - Backport "Stop the BFD library from issuing a warning message..."
    (Nick Clifton, RH BZ 1878810)


author: Keith Seitz <keiths@redhat.com> - 8.2-14.el8
changelog:
  - Obsolete earlier versions on x86_64 and conflict with 64-bit
    glibc on ix86. (Keith Seitz, RH BZ 1853140)
  - Really fix 1878810 (Keith Seitz, RH BZ 1878810)


author: Keith Seitz <keiths@redhat.com> - 8.2-15.el8
changelog:
  - Backport "Correct recording of 'store on condition' insns"
    (Andreas Arnaz, RH BZ 1903374)
  - Backport "Fortran dynamic type related fixes"
    (Andrew Burgess, RH BZ 1905701)


author: Keith Seitz <keiths@redhat.com> - 8.2-16.el8
changelog:
  - Backport "Fix segfault with nameless fortran modules."
    (Bernhard Heckel, RH BZ 1934673)
  - Backport "PowerPC remove 512 bytes region limit if 2nd DAWR is available"
    and related patches.
    (Rogerio Alves et al RH BZ 1854784)


author: Keith Seitz <keiths@redhat.com> - 8.2-19.el8
changelog:
  - Backport "Fix restoring of inferior terminal settings"
  - Backport "Avoid GDB SIGTTOU on catch exec + set follow-exec-mode
    new (PR 23368)"
    (Simon Marchi, RH BZ 2015131)


author: Keith Seitz <keiths@redhat.com> - 8.2-20.el8
changelog:
  - Backport portion of "Fix crash in new DWARF indexer".
    (Tom Tromey, RH BZ 2150363)
  - Backport "Fix assertion failure in copy_type" and
    "Fix PR20630 regression test in gdb.base/printcmds.exp".
    (Tom Tromey and Tom de Vries, RH BZ 2156888)


author: Richard Hughes <rhughes@redhat.com> - 2.31.3-2
changelog:
  - Split out the modules as a subpackage to allows us to depend on the core
    library on the cloud image and not drag every image loader known to man.


author: Richard Hughes <rhughes@redhat.com> - 2.31.3-3
changelog:
  - Split out the xlib code as a subpackage to allows us to depend on the core
    library on the cloud image and not depends on half of Xorg.


author: Tomas Popela <tpopela@redhat.com> - 2.36.12-6
changelog:
  - Backport fixes for CVE-2022-48622
  - Apply patches with git to enable binary patching
  - Resolves: RHEL-30478


author: Paul Howarth <paul@city-fan.org> - 2.3.1-1
changelog:
  - Update to 2.3.1
    - geoipupdate now uses TCP keep-alive when compiled with cURL 7.25 or
      greater
    - Previously, on an invalid gzip file, geoipupdate would output binary data
      to stderr; it now displays an appropriate error message
    - Install README, ChangeLog, GeoIP.conf.default etc. into docdir (GH#33)
    - $(sysconfdir) is now created if it doesn't exist (GH#33)
    - The sample config file is now usable (GH#33)


author: Paul Howarth <paul@city-fan.org> - 2.4.0-1
changelog:
  - Update to 2.4.0
    - geoipupdate now checks that the database directory is writable: if it is
      not, it reports the problem and aborts
    - geoipupdate now acquires a lock when starting up to ensure only one
      instance may run at a time: a new option, 'LockFile', exists to set the
      file to use as a lock ('.geoipupdate.lock' in the database directory by
      default)
    - geoipupdate now prints out additional information from the server when a
      download request results in something other than HTTP status 2xx; this
      provides more information when the API does not respond with a database
      file
    - ${datarootdir}/GeoIP is now created on 'make install' (GH#29)
    - Previously, a variable named 'ERROR' was used, which caused issues building
      on Windows (GH#36)
  - Drop EL-5 support
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section
    - noarch subpackages always available now
    - libcurl-devel always available now


author: Paul Howarth <paul@city-fan.org> - 2.5.0-1
changelog:
  - Update to 2.5.0
    - Replace use of strnlen() due to lack of universal availability (GH#71)
    - Document the 'LockFile' option in the 'GeoIP.conf' man page (GH#64)
    - Remove unused base64 library (GH#68)
    - Add the new configuration option 'PreserveFileTimes'; if set, the
      downloaded files will get the same modification times as their original on
      the server (default is '0') (GH#63)
    - Use the correct types when calling 'curl_easy_setopt()'; this fixes
      warnings generated by libcurl's 'typecheck-gcc.h' (GH#61)
    - In 'GeoIP.conf', the 'UserId' option was renamed to 'AccountID' and the
      'ProductIds' option was renamed to 'EditionIDs'; the old options will
      continue to work, but upgrading to the new names is recommended for
      forward compatibility


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 5.50 at last...
  - hpdj 2.6
  - Added 3rd party drivers:
    - Lexmark 5700 (lxm5700m)
    - Alps MD-* (md2k, md5k)
    - Lexmark 2050, 3200, 5700 and 7000 (lex2050, lex3200, lex5700, lex7000)


author: Michael Stefaniuc <mstefani@redhat.com>
changelog:
  - added the stp driver from the gimp-print project.
    It supports high quality printing especialy with Epson Stylus Photo.


author: Crutcher Dunnavant <crutcher@redhat.com>
changelog:
  - merged in some patches that got away:
    * Fri Sep  1 2000 Mitsuo Hamada <mhamada@redhat.com>
    - add support JIS B size
    - fix the problem of reconverting GNUPLOT output


author: Crutcher Dunnavant <crutcher@redhat.com>
changelog:
  - upgraded to 6.51, a major version upgrade
  - rewrote spec file, threw out some patches
  - turned on IBM's Omni print drivers interface
  - turned on HP's hpijs print drivers interface
  - turned on every driver that looked usable from linux
  - sacrificed a chicken to integrate the old Japanese drivers
  - - This didn't work. The japanese patches are turned off, pending review.
  - - I can do loops with C, but the bugs are in Postscript init files


author: Crutcher Dunnavant <crutcher@redhat.com> 6.51-2
changelog:
  - luckily, I had a spare chicken. Thanks to some work by Nakai, and one last
  - desperate search through google, everything /seems/ to be working. I know
  - that there are going to be problems in the japanese code, and I need to turn
  - on the cjk font map from adobe, but it /works/ at the moment.


author: Crutcher Dunnavant <crutcher@redhat.com> 6.51-4
changelog:
  - applied drepper@redhat.com's patch for #50300
  - fixed build deps on zlib-devel and libpng-devel, #49853
  - made gs_init.ps a config file; #25096
  - O\^/nZ the daTa directorieZ now; #50693


author: Crutcher Dunnavant <crutcher@redhat.com> 6.51-9
changelog:
  - applied IBM's glib patches for Omni, which now works.
  - BE AWARE: we now link against libstdc++ and glib for this, and use a c++
  - link stage to do the dirty.
  - added glib-devel buildreq and glib req, I don't think we require everything
  - yet, I could pull in sasl.


author: Bernhard Rosenkraenzer <bero@redhat.com> 6.52-1
changelog:
  - Updates:
    - ghostscript 6.52
    - hpdj 2.6 -> pcl3 3.3
    - CJK Patchlevel 3, adobe-cmaps 200109
    - gimp-print 4.2.0
  - Adapt patches
  - Fix various URLs
  - Begin cleaning up spec file
  - Fix bugs #21879 and #50923


author: Tim Waugh <twaugh@redhat.com> 6.52-6
changelog:
  - Fix config patch so that gs --help displays the right thing.
  - Don't ship sysvlp.sh.
  - Fix some shell scripts.
  - Ship escputil man page (bug #58919).


author: Tim Waugh <twaugh@redhat.com> 7.05-1
changelog:
  - 7.05.
  - No longer need mkstemp, vflib.fixup, quoting, or PARANOIDSAFER
    patches.
  - Don't apply CJK patches any more (no longer needed).
  - Updated Source15, Patch0, Patch10, Patch5, Patch24, Patch14, Patch12.
  - Made gdevdmpr.c compile again.
  - Move gimp-print to a separate package.
  - Ship the shared object too (and a .so file that is dlopened).
  - Update Omni patch.  No longer need Omni_path, Omni_quiet, Omni_glib patches.
  - Require Omni >= 0.6.1.
  - Add patch to fix gtk+ initial window size.
  - Add devel package with header files.
  - Turn on IJS support.
  - Update hpijs to 1.1.
  - Don't ship the hpijs binary in the ghostscript package.
  - Use -fPIC when building ijs.


author: Tim Waugh <twaugh@redhat.com> 7.05-2
changelog:
  - Don't apply bogus parts of vflib patch (bug #65268).
  - Work around Omni -sPAPERSIZE=a4 problem (bug #65269).


author: Tim Waugh <twaugh@redhat.com> 7.05-8
changelog:
  - Requires recent version of patchutils (bug #65947).
  - Don't ship broken man page symlinks (bug #66238).


author: Tim Waugh <twaugh@redhat.com> 7.05-25
changelog:
  - Fix level 1 PostScript output (bug #78450).
  - No need to carry gomni.c, since it comes from the patch.


author: Tim Waugh <twaugh@redhat.com> 7.05-26
changelog:
  - Don't ship the shared object yet (part of bug #79340).
  - Don't make the gtk package, since that needs the shared object.


author: Tim Waugh <twaugh@redhat.com> 7.05-33
changelog:
  - Add some missing font aliases (bug #73342).
  - Use the system jpeg library.
  - Update hpijs to 1.3.1.
  - Update gdevcups.c from cups-1.1.18.


author: Tim Waugh <twaugh@redhat.com> 7.05-34
changelog:
  - Apply fix for CJK font search method when the fonts are not available
    (bug #83516).
  - The gb18030 patch no longer applies here.


author: Tim Waugh <twaugh@redhat.com> 7.06-1
changelog:
  - 7.06.
  - Updated config, vflib.fixup patches.
  - No longer need dx6, jpeg patches.
  - No longer need to add in missed GNU drivers.
  - Turn off dj970 driver (hpijs drives that).


author: Tim Waugh <twaugh@redhat.com> 7.07-1
changelog:
  - 7.07.
  - Parametrize build_libgs.
  - Remove Omni requirement (bug #88177).
  - Fix ghostscript-gtk obsoletes: line (bug #88175).


author: Tim Waugh <twaugh@redhat.com> 7.07-15
changelog:
  - Build for Fedora Core 1 printer drivers update.
  - Conflicts with foomatic before hpijs 1.5 data.
  - Make fontconfig optional.


author: Tim Waugh <twaugh@redhat.com> 7.07-17
changelog:
  - Removed stp driver.  Use the IJS version (ijsgimpprint) instead.
  - No longer conflicts with foomatic for hpijs versioning.


author: Tim Waugh <twaugh@redhat.com> 7.07-19
changelog:
  - Attempt to fix gdevcups crash (bug #114256).
  - Make gs dynamically link to libgs (bug #114276).
  - Fix gdevesmv.c's misuse of const (bug #114250).


author: Tim Waugh <twaugh@redhat.com>
changelog:
  - Run /sbin/ldconfig in %post/%postun.
  - Stricter requirements for the main package in the subpackages.


author: Tim Waugh <twaugh@redhat.com> 8.15-0.rc3.1
changelog:
  - Switch to ESP Ghostscript.
  - 8.15rc3.
  - Lots of patches dropped.  Perhaps some will need to be re-added.


author: Tim Waugh <twaugh@redhat.com> 8.15-0.rc3.2
changelog:
  - Drop 'Provides: libijs.so' because it is incorrect.
  - Build igcref.c with -O0 to work around bug #150771.
  - Renumber patches.


author: Tim Waugh <twaugh@redhat.com> 8.15-0.rc3.4
changelog:
  - Add Japanese fonts to FAPIcidfmap (bug #161187).
  - Moved Resource directory.
  - Added use-external-freetype patch (bug #161187).


author: Tim Waugh <twaugh@redhat.com> 8.15-0.rc3.5
changelog:
  - Split font configuration (bug #161187).
  - Reverted this change:
    - Build requires xorg-x11-devel, not XFree86-devel.


author: Tim Waugh <twaugh@redhat.com> 8.15.2-9
changelog:
  - Apply CJKV patch from svn164:165 plus the fix from svn173:174 (bug #194592,
    bug #203712, possibly bug #167596).


author: Tim Waugh <twaugh@redhat.com> 8.15.3-2
changelog:
  - 8.15.3.  No longer need gtk2, ps2epsi, badc, pagesize,
    use-external-freetype, split-font-configuration or cjkv patches.
  - Renumbered patches.


author: Tim Waugh <twaugh@redhat.com> 8.15.3-6
changelog:
  - Configure with --with-drivers=ALL since the advertised default is not
    what gets used (bug #223819).


author: Tim Waugh <twaugh@redhat.com> 8.15.3-7
changelog:
  - dvipdf script fixes (bug #88906).
  - Moved libijs.so and libgs.so into devel package (bug #203623).


author: Tim Waugh <twaugh@redhat.com> 8.15.4-3
changelog:
  - Apply fonts in CIDFnmap even if the same fontnames are already registered
    (bug #163231).
  - New file CIDFmap (bug #233966).
  - Allow local overrides for FAPIcidfmap, cidfmap and Fontmap (bug #233966).


author: Tim Waugh <twaugh@redhat.com> 8.60-0.r8112.1
changelog:
  - 8.60 snapshot from svn.  Patches dropped:
    - big-cmap-post
    - split-cidfnmap
    - exactly-enable-cidfnmap
    - Fontmap.local
    No longer needed:
    - gxcht-64bit-crash


author: Tim Waugh <twaugh@redhat.com> 8.61-2
changelog:
  - Add /usr/share/fonts to fontpath (bug #402551).
  - Restore cidfmap-switching bits, except for FAPIcidfmap which is no
    longer used.
  - Add runlibfileifexists to gs_init.ps.
  - Build with --disable-compile-inits (bug #402501).


author: Tim Waugh <twaugh@redhat.com> 8.61-9
changelog:
  - Build with jasper again (bug #433897).  Build requires jasper-devel, and
    a patch to remove jas_set_error_cb reference.


author: Tim Waugh <twaugh@redhat.com> 8.62-4
changelog:
  - Applied patch to work around bug #229174.
  - Applied patch from upstream to fix box_fill_path for shfill (bug #452348).


author: Tim Waugh <twaugh@redhat.com> 8.63-1
changelog:
  - 8.63.  No longer need r8591 or incomplete-ccittfax patches.
  - Compile without strict aliasing opts due to warnings across several
    files.
  - Don't run autogen.sh for main package, just for ijs which doesn't
    ship with a configure script.


author: Tim Waugh <twaugh@redhat.com> 8.64-6
changelog:
  - Applied patch to fix CVE-2009-0792 (bug #491853).
  - Applied patch to fix CVE-2009-0196 (bug #493379).


author: Tim Waugh <twaugh@redhat.com> 8.64-11
changelog:
  - Fixed CVE-2009-0583,0584 patch by using 255 as the maximum number of
    points, not 100, and by not treating a missing black point tag as an
    error (bug #487744).


author: Tim Waugh <twaugh@redhat.com> 8.70-1
changelog:
  - 8.70.
  - License has changed to GPLv3+.  Packages containing programs that
    link to libgs/libijs are:
    - foomatic (GPLv2+)
    - libspectre (GPLv2+)
    - ImageMagick (ImageMagick, listed on Licensing wiki page under
      "Good Licenses" and marked as GPLv3 compat)
    - gutenprint (GPLv2+)


author: Tim Waugh <twaugh@redhat.com> 8.70-3
changelog:
  - Don't ship libtool la files (bug #542674).
  - Fix debugging output from gdevcups (CVE-2009-4270, bug #540760).
  - Harden ghostscript's debugging output functions (bug #540760).


author: Tim Waugh <twaugh@redhat.com> 8.70-6
changelog:
  - Fixed pdftoraster so that it waits for its sub-process to exit.
  - Another gdevcups duplex fix from upstream revision 10631
    (bug #541604).


author: Tim Waugh <twaugh@redhat.com> 8.71-4
changelog:
  - Actually revert the upstream gdevcups changes (bug #563313).
  - Fixed pdf2dsc.ps (bug #565935).
  - Use fixed patch for LDFLAGS to make sure libgs.so gets a soname
    (bug #565935).


author: Tim Waugh <twaugh@redhat.com> 8.71-6
changelog:
  - Fixed summary.
  - Fixed macros in changelog.
  - Avoid mixed spaces and tabs.
  - Ship COPYING file.
  - Added comments for all patches.
  - More consistent macro use.


author: Tim Waugh <twaugh@redhat.com> 8.71-7
changelog:
  - Don't own the %{_datadir}/ghostscript or
    %{_datadir}/ghostscript/conf.d directories as the filesystem
    package already does (bug #569442).


author: Tim Waugh <twaugh@redhat.com> 8.71-8
changelog:
  - Restore the TIFF default strip size of 0 (bug #571520).
  - Don't segfault closing tiffg3 device if opening failed (bug #571520).
  - Don't revert gdevcups y-axis change (bug #541604).
  - Reallocate memory in gdevcups when color depth changes (bug #563313).


author: Tim Waugh <twaugh@redhat.com> 8.71-9
changelog:
  - Backported some more TIFF fixes (bug #573970).
  - Use upstream fix for TIFF default strip size (bug #571520).


author: Tim Waugh <twaugh@redhat.com> 8.71-12
changelog:
  - Change SEARCH_HERE_FIRST default to make -P- default instead of -P
    (bug #599564).
  - Removed redundant gs-executable patch (bug #502550).


author: Tim Waugh <twaugh@redhat.com> 8.71-15
changelog:
  - Restored Fontmap.local patch, incorrectly dropped after
    ghostscript-8.15.4-3 (bug #610301).
  - Applied patch to let gdevcups use automatic memory allocation.  Use
    RIPCache=auto in /etc/cups/cupsd.conf to enable.
  - Applied patch to fix NULL dereference in bbox driver (bug #591624).
  - Applied upstream patch to fix iname.c segfault (bug #465311).


author: Tim Waugh <twaugh@redhat.com> 9.00-1
changelog:
  - Updated to 9.00.  No longer need -P-, CVE-2009-4270, CVE-2010-1628,
    SEARCH_HERE_FIRST, bbox-close, cups-realloc-color-depth,
    epstopdf-failure, fPIC, gdevcups-ripcache, iname-segfault, ldfalgs,
    pdf2dsc, pdftoraster-exit, tif-fail-close, tiff-default-strip-size,
    or tiff-fixes patches.


author: Tim Waugh <twaugh@redhat.com> 9.00-3
changelog:
  - Don't use carriage return in ps2epsi output (bug #635786).
  - Include more documentation (bug #634354).


author: Tim Waugh <twaugh@redhat.com> 9.00-8
changelog:
  - Applied upstream ICC fix (bug #655449).
  - gdevcups: use correct width and height values when allocating memory
    (upstream bug 691733).


author: Tim Waugh <twaugh@redhat.com> 9.01-1
changelog:
  - 9.01.  No longer needed gdevcups-691733, glyph-stretch-691920,
    icc-fix, scan_token, or system-jasper patches.


author: Tim Waugh <twaugh@redhat.com> - 9.05-3
changelog:
  - Removed more bundled packages (bug #816747).
  - Fixed missing error check when setting ICC profile.


author: Tim Waugh <twaugh@redhat.com> - 9.06-5
changelog:
  - Updated build requirement from gtk2-devel to gtk3-devel so that gsx
    gets built using the correct loader (bug #884483).


author: Tim Waugh <twaugh@redhat.com> 9.07-10
changelog:
  - Added in missing part of gs_sprintf backport: add in the header to
    stdio_.h. Without this there are problems with va_args on some
    platforms (bug #979681).


author: Tim Waugh <twaugh@redhat.com> 9.14-3
changelog:
  - Applied patch from upstream to fix memory handling issue that could
    lead to crashes (bug #1087071).


author: Tim Waugh <twaugh@redhat.com> 9.15-3
changelog:
  - Avoid shipping ramfs source as its license is unclear. Similarly
    with some documentation and example code (bug #1149617).


author: Tim Waugh <twaugh@redhat.com> 9.15-4
changelog:
  - New ghostscript-x11 package for X11 driver (bug #148939).
  - Ghostscript not requiring X11 is now in ghostscript-core.
  - The 'ghostscript' package requires both of these.


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.16-5
changelog:
  - [TEMPORARY] Support for OpenJPEG disabled for builds to pass.
  - Security fix for BZ #1380416 backported.


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.20-1
changelog:
  - Rebase to latest ghostscript-9.20. Major changes in this rebase:
    - OpenJPEG support has been re-enabled
    - ijs-config custom tool has been removed (pkg-config is used by default)
    - old irrelevant patches removed (changes are part of upstream release now)
    - remaining patches has been updated & renamed
    - no API/ABI changes according to upstream


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.20-2
changelog:
  - Added security fixes for:
    - CVE-2016-7979 (bug #1382305)
    - CVE-2016-7976 (bug #1382294)
    - CVE-2016-7978 (bug #1382300)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.20-5
changelog:
  - Added fix to avoid SIGSEGV for some *.ps files. More info here:
    <http://bugs.ghostscript.com/show_bug.cgi?id=697286>


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.20-6
changelog:
  - Remove and (re-implement) ConvertUTF.c (bug #1404933)
  - Added security fix for CVE-2016-9601 (bug #1410021)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.20-9
changelog:
  - Added security fixes for:
    - CVE-2016-10217 (bug #1441564)
    - CVE-2016-10218 (bug #1441568)
    - CVE-2016-10219 (bug #1441569)
    - CVE-2016-10220 (bug #1441571)
    - CVE-2017-5951  (bug #1441572)
    - CVE-2017-8291  (bug #1446063)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.22-4
changelog:
  - complete cleanup in ghostscript specfile according to FPG
  - libgs -- new separate package (Ghostscript library)
  - libgs-devel -- new separate subpackage (devel files for Ghostscript library)
  - libijs -- now shipped as a separate package on Pagure
  - ghostscript-tools-fonts -- new subpackage
  - ghostscript-tools-printing -- new subpackage
  - ghostscript-core -- changed to transitional metapackage
  - package is now completely debundled from already packaged software/resources
  - versioned paths for documentation, resources, etc. are no longer used
  - LPR setup scripts removed (no longer shipped)
  - added symlinks for direct resources location to speedup Ghostscript startup times
  - Ghostscript's search path updated to include only fonts locations as a backup
  - support for /usr/share/ghostscript/conf.d dropped (using Google Droid Sans Fallback instead)
  - examples/ folder dropped from *-doc subpackage


author: Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 9.22-8
changelog:
  - Switch to %ldconfig_scriptlets
    >> https://fedoraproject.org/wiki/Changes/Removing_ldconfig_scriptlets


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.24-1
changelog:
  - rebase to latest upstream version, which contains important CVE fixes
  - additional ZER0-DAY fixes added


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.25-1
changelog:
  - rebase to latest upstream version to fix issues discovered in previous CVE fixes (bug #1631701 and #1626997)


author: Martin Osvald <mosvald@redhat.com> - 9.25-2
changelog:
  - Resolves: #1652937 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c
  - Resolves: #1642586 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1642580 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1642941 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1656336 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)
  - Resolves: #1660571 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660830 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661280 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)
  - Resolves: #1668891 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators (700317)


author: Martin Osvald <mosvald@redhat.com> - 9.25-3
changelog:
  - Resolves: #1692798 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - Resolves: #1678170 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1691414 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)
  - fix included for ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - fix for pdf2dsc regression added to allow fix for CVE-2019-3839


author: Martin Osvald <mosvald@redhat.com> - 9.25-5
changelog:
  - Resolves: #1744011 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445)
  - Resolves: #1744015 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444)
  - Resolves: #1744006 - CVE-2019-14813 ghostscript: Safer Mode Bypass by .forceput Exposure in setsystemparams (701443)
  - Resolves: #1744231 - CVE-2019-14817 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdfexectoken and other procedures (701450)


author: Richard Lescak <rlescak@redhat.com> - 9.27-3
changelog:
  - fixed drifting text to the right when printing
  - added Requirement for jbig2dec
  - added patch for CVE-2020-16301
  - Resolves: rhbz#2097515, rhbz#2097448


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.27-16
changelog:
  - RHEL-18396 CVE-2023-46751 ghostscript: dangling pointer in gdev_prn_open_printer_seekable()
  - RHEL-67046 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space
  - RHEL-15067 CVE-2020-27792 ghostscript: heap buffer over write vulnerability in GhostScript's lp8000_print_page() in gdevlp8k.c
  - RHEL-67051 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding
  - RHEL-67051 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript
  - RHEL-67051 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution


author: Masahiro Matsuya <mmatsuya@redhat.com> - 2:2.8.22-25
changelog:
  - fix CVE-2023-44442
  - fix CVE-2023-44444
  - disable gimp-2.8.22-python-path.patch required for flatpak
  - partially cherry-pick from upstream commit 2987f012 to fix fclose leak
    Resolves: RHEL-17048 RHEL-17060


author: Josef Ridky <jridky@redhat.com> - 2:2.8.22-26.3
changelog:
  - fix CVE-2025-10920
  - fix CVE-2025-10921
  - fix CVE-2025-10922
  - fix CVE-2025-10923
  - fix CVE-2025-10924
  - fix CVE-2025-10925
  - fix CVE-2025-10934


author: Horst H. von Brand <vonbrand@inf.utfsm.cl>
changelog:
  - Redid the description
  - Cut overlong make line, loosened changelog a bit
  - I think Junio (or perhaps OSDL?) should be vendor...


author: Tom "spot" Callaway <tcallawa@redhat.com> 0.99.4-3
changelog:
  - use dist tag to differentiate between branches
  - use rpm optflags by default (patch0)
  - own %{_datadir}/git-core/


author: Chris Wright <chrisw@osdl.org> 0.99.4-4
changelog:
  - drop sh_utils, sh-utils, diffutils, mktemp, and openssl Requires
  - use RPM_OPT_FLAGS in spec file, drop patch0


author: H. Peter Anvin <hpa@zytor.com> 0.99.9j-1
changelog:
  - Change subpackage names to git-<name> instead of git-core-<name>
  - Create empty root package which brings in all subpackages
  - Rename git-tk -> gitk


author: Chris Wright <chrisw@redhat.com> 1.1.0-1
changelog:
  - Update to latest git-1.1.0 (drop git-email for now)
  - Now creates multiple packages:
  -        git-core, git-svn, git-cvs, git-arch, gitk


author: Josh Boyer <jwboyer@gmail.com> 1.5.3.6-1
changelog:
  - git-1.5.3.6
  - git-core requires perl(Error) (bug 367861)
  - git-svn requires perl(Term:ReadKey) (bug 261361)
  - git-email requires perl-Git (bug 333061)


author: Jeremy Katz <katzj@redhat.com> - 1.5.4.1-2
changelog:
  - Add upstream patch (e62a641de17b172ffc4d3a803085c8afbfbec3d1) to have 
    gitweb rss feeds point be commitdiffs instead of commit


author: James Bowes <jbowes@redhat.com> 1.5.4.4-3
changelog:
  - Include the sample hooks from contrib/hooks as docs (bug 321151).
  - Install the bash completion script from contrib (bug 433255).
  - Include the html docs in the 'core' package again (bug 434271).


author: Josh Boyer <jwboyer@gmail.com> 1.6.0.3-1
changelog:
  - git-1.6.0.3
  - Drop curl requirement in favor of libcurl (bug 449388)
  - Add requires for SMTP-SSL perl module to make git-send-email work (bug 443615)


author: Todd Zullinger <tmz@pobox.com> 1.6.0.6-1
changelog:
  - git-1.6.0.6
  - Fixes a local privilege escalation bug in gitweb
    (http://article.gmane.org/gmane.comp.version-control.git/103624)
  - Add gitk Requires to git-gui (bug 476308)


author: Todd Zullinger <tmz@pobox.com> 1.6.1-1
changelog:
  - Install git-* commands in %{_libexecdir}/git-core, the upstream default
  - Remove libcurl from Requires, rpm will pick this up automatically
  - Consolidate build/install options in %make_git (Roland McGrath)
  - Include DirectoryIndex in gitweb httpd-config (bug 471692)
  - Define DOCBOOK_XSL_172 to fix minor manpage issues
  - Rename %{_var}/lib/git-daemon to %{_var}/lib/git
  - Preserve timestamps on installed files
  - Quiet some rpmlint complaints
  - Use macros more consistently


author: Todd Zullinger <tmz@pobox.com> 1.6.1.3-1
changelog:
  - git-1.6.1.3
  - Set htmldir so "git help -w <command>" works
  - Patch git-web--browse to not use "/sbin/start" to browse
  - Include git-daemon documentation in the git-daemon package


author: Todd Zullinger <tmz@pobox.com> - 1.6.1.3-2
changelog:
  - Require perl(Authen::SASL) in git-email (bug 483062)
  - Build many of the subpackages as noarch
  - Update URL field


author: Todd Zullinger <tmz@pobox.com> - 1.6.2-1
changelog:
  - git-1.6.2
  - Include contrib/emacs/README in emacs subpackage
  - Drop upstreamed git-web--browse patch


author: Todd Zullinger <tmz@pobox.com> - 1.6.2.2-1
changelog:
  - git-1.6.2.2
  - Include contrib/ dir in %doc (bug 492490)
  - Don't set DOCBOOK_XSL_172, fix the '\&.ft' with sed (bug 485161)
  - Ignore Branches output from cvsps-2.2b1 (bug 490602)
  - Remove shebang from bash-completion script
  - Include README in gitweb subpackage


author: Todd Zullinger <tmz@pobox.com> - 1.6.3.2-1
changelog:
  - git-1.6.3.2
  - Require emacs >= 22.2 for emacs support (bug 495312)
  - Add a .desktop file for git-gui (bug 498801)
  - Set ASCIIDOC8 and ASCIIDOC_NO_ROFF to correct documentation issues,
    the sed hack to fix bug 485161 should no longer be needed
  - Escape newline in git-daemon xinetd description (bug 502393)
  - Add xinetd to git-daemon Requires (bug 504105)
  - Organize BuildRequires/Requires, drop redundant expat Requires
  - Only build noarch subpackages on Fedora >= 10
  - Only build emacs and arch subpackages on Fedora
  - Handle curl/libcurl naming for EPEL and Fedora


author: Todd Zullinger <tmz@pobox.com> - 1.6.3.3-1
changelog:
  - git-1.6.3.3
  - Move contributed hooks to %{_datadir}/git-core/contrib/hooks (bug 500137)
  - Fix rpmlint warnings about Summary and git-mergetool--lib missing shebang


author: Todd Zullinger <tmz@pobox.com> - 1.6.5.2-1
changelog:
  - git-1.6.5.2
  - Drop asciidoc --unsafe option, it should not be needed anymore
  - Don't use install -t/-T, they're not compatible with older coreutils
  - Don't use -perm /a+x with find, it's incompatible with older findutils


author: Todd Zullinger <tmz@pobox.com> - 1.6.5.3-1
changelog:
  - git-1.6.5.3
  - Only BR perl(Error) on Fedora and RHEL >= 5
  - Use config.mak to set build options
  - Improve compatibility with EPEL
  - Replace $RPM_BUILD_ROOT with %{buildroot}
  - Fix Obsoletes for those rebuilding on EL-4


author: Todd Zullinger <tmz@pobox.com> - 1.6.6.1-1
changelog:
  - git-1.6.6.1
  - Use %{gitcoredir}/git-daemon as xinetd server option, for SELinux (#529682)
  - Make %{_var}/lib/git the default gitweb projectroot (#556299)
  - Include gitweb/INSTALL file as documentation, the gitweb README refers to it
  - Ship a short example gitweb config file (%{_sysconfdir}/gitweb.conf)
  - Remove long fixed xinetd IPv6 workaround on Fedora (#557528)
  - Install missing gitweb.js (#558740)


author: Todd Zullinger <tmz@pobox.com> - 1.7.0-1
changelog:
  - git-1.7.0
  - Link imap-send with libcrypto (#565147)
  - Disable building of unused python remote helper libs


author: Todd Zullinger <tmz@pobox.com> - 1.7.1-1
changelog:
  - git-1.7.1
  - Fix conditionals for EL-6
  - Comply with Emacs add-on packaging guidelines (#573423), Jonathan Underwood
    - Place elisp source files in separate emacs-git-el package
    - Place git support files in own directory under site-lisp
    - Use Emacs packaging macros


author: Todd Zullinger <tmz@pobox.com> - 1.7.4.1-1
changelog:
  - Update to 1.7.4.1
  - Clean up documentation settings (the defaults changed in 1.7.4)
  - Improve EL-5 compatibility, thanks to Kevin Fenzi for emacs testing


author: Adam Tkac <atkac redhat com> - 1.7.4.2-1
changelog:
  - update to 1.7.4.2
  - move man3/Git.3pm file to perl-Git subpkg (#664889)
  - add perl-DBD-SQLite dependency to git-cvs (#602410)


author: Todd Zullinger <tmz@pobox.com> - 1.7.6-4
changelog:
  - Drop git-arch on fedora >= 16, the tla package has been retired
  - Rework most spec file dist conditionals to make future changes easier


author: Todd Zullinger <tmz@pobox.com> - 1.7.6.2-1
changelog:
  - Update to 1.7.6.2
  - Fixes incompatibility caused by git push --quiet fix
    http://thread.gmane.org/gmane.comp.version-control.git/180652


author: Adam Tkac <atkac redhat com> - 1.8.0-1
changelog:
  - update to 1.8.0
  - include git-credential-gnome-keyring helper in git pkg
  - 0001-cvsimport-strip-all-inappropriate-tag-strings.patch was merged


author: Todd Zullinger <tmz@pobox.com> - 1.8.1.4-2
changelog:
  - Update asciidoc requirements, drop unsupported ASCIIDOC7
  - Define GNU_ROFF to force ASCII apostrophes in manpages (so copy/paste works)
  - Install tcsh completion (requires manual setup by users)
  - Clean up dist conditionals, don't pretend to support EL-4 builds
  - Use prebuilt documentation on EL-5, where asciidoc is too old
  - Respect gitexecdir variable in git-subtree install


author: Todd Zullinger <tmz@pobox.com> - 1.8.2-2
changelog:
  - Require perl(Term::ReadKey) for git add --interactive (#928328)
  - Drop DESTDIR from python instlibdir
  - Fix bogus changelog dates


author: Todd Zullinger <tmz@pobox.com> - 1.8.5.3-2
changelog:
  - Drop unused python DESTIR patch
  - Consolidate settings for Fedora 19+ and EL 7+
  - Use new rpm filtering on Fedora 19+ and EL 7+
  - Rebuild with file-5.14-14 (#1026760)


author: Petr Stodulka <pstodulk@redhat.com> - 2.4.2-2
changelog:
  - split create subpackage git-core (perl-less) from git package
  - git package requires git-core and it has same tool set as
    before
  - relevant docs are part of git-core package too
  - removed proved and obsoletes in git for git-core


author: Petr Stodulka <pstodulk@gmail.com> - 2.4.4-2
changelog:
  - git-svn - added requires for perl-Digest-MD5 (#1218176)
  - solve troubles with infinite loop due to broken symlink (probably
    shouldn't be problem here, but it's reproducible manually)
    (#1204193)


author: Jonathan Underwood <jonathan.underwood@gmail.com> - 2.4.5-2
changelog:
  - Comply with modern Emacs packaging guidelines on recent Fedora
    No longer split out emacs-git and emacs-git-el sub-packages on recent Fedora
    Require emacs-filesystem on recent Fedora (#1234552)


author: Konrad Scherer <Konrad.Scherer@windriver.com>
changelog:
  - Workaround missing git subtree documentation in prebuilt docs (bug 1320210)
  - Only add git-cvsserver binary once if the core dir matches the bin dir as it
    does on el5 (bug 1320210)


author: Todd Zullinger <tmz@pobox.com> - 2.8.2-4
changelog:
  - Use perl(MOD::NAME) format for perl-DBD-SQLite and perl-Digest-MD5 deps
  - Define __global_ldflags on EL < 7 (#1337137)


author: Todd Zullinger <tmz@pobox.com> - 2.11.1-3
changelog:
  - Remove unnecessary rsync requirement from git-core
  - Move gnome-keyring credential helper from git-core to git
  - Enable libsecret credential helper
  - Run git test suite
  - Use %{_mandir} in git/git-core file list filters
  - Fix version of emacs-git and emacs-git-el provides
  - Clean up contrib/{credential,subtree} to avoid cruft in git-core-doc
  - Fix a number of macro-in-comment warnings from rpmlint


author: Petr Stodulka <pstodulk@redhat.com> - 2.11.1-3
changelog:
  - remove non-ASCII characters from description and title of packages
  - fix requiremets
  - fix spec to be compatible for other systems
  - remove deprecated credential-gnome-keyring


author: Petr Stodulka <pstodulk@redhat.com> - 2.13.3-2
changelog:
  - Move documentation files from all subpackages into the %{_pkgdocdir}
    directory, so links inside doc and man files are correct
    Resolves: #1357438
  - Quiet a few rpmlint complaints regarding hidden files in contrib dir
  - Remove explicit libcurl requirement from git-core


author: Iryna Shcherbina <ishcherb@redhat.com> - 2.14.0-2
changelog:
  - Add a build-time dependency on python2-devel for p4
    Resolves: #1479713
  - Skip all grep tests on s390x for now because it failes intermittently


author: Todd Zullinger <tmz@pobox.com> - 2.15.0-2
changelog:
  - Fix git-clone memory exhaustion (CVE-2017-15298)
    Resolves: #1510455, #1510457
  - Disable cross-directory hardlinks
  - Drop ancient obsoletes for git and git-arch
  - Update summary/description of numerous subpackages
  - Fix shebang in a few places to silence rpmlint complaints
  - Fix t9020-remote-svn failure when setting PYTHON_PATH
  - Rename %gitcoredir to %gitexecdir; upstream uses the latter
  - Move commands which no longer require perl into git-core
  - Move filter-branch out of core, it needs perl now
  - Improve test suite coverage


author: Todd Zullinger <tmz@pobox.com> - 2.15.1-3
changelog:
  - Include verbose logs in build output for 'make test' failures
  - Use %autosetup macro to unpack and patch source
  - Remove second make invocation for doc build/install
  - Fix builds using '--without docs'
  - Mark git-core-docs sub-package noarch
  - Avoid failures in svnserve tests when run in parallel
  - Run tests in parallel by default on Fedora
  - Skip 'git svn branch' tests which fail intermittently
  - Re-enable grep tests on s390x


author: Todd Zullinger <tmz@pobox.com>
changelog:
  - Avoid excluding non-existent .py[co] files in %doc
  - Remove obsolete gnome-keyring credential helper


author: Todd Zullinger <tmz@pobox.com>
changelog:
  - Add %{emacs_filesystem} to simplify emacs support
  - Use .in template for git@.service to ensure paths are substituted


author: Todd Zullinger <tmz@pobox.com> - 2.16.0-1
changelog:
  - Update to 2.16.0
  - Use 'prove' as test harness, enable shell tracing
  - Disable t5000-tar-tree.sh on x86 in f28


author: Todd Zullinger <tmz@pobox.com> - 2.16.1-2
changelog:
  - git-svn: avoid segfaults in 'git svn branch', re-enable t9128, t9141, and
    t9167
  - Drop obsolete BuildRoot, Group, %clean, and buildroot cleanup


author: Todd Zullinger <tmz@pobox.com> - 2.16.1-3
changelog:
  - Order %files and %packages sections by name
  - Remove obsolete %defattr
  - Don't package contrib/svn-fe in %doc
  - Split git-subtree into a separate package


author: Todd Zullinger <tmz@pobox.com> - 2.17.0-0.0.rc0
changelog:
  - Update to 2.17.0-rc0
  - Adjust for simplified perl install
  - Require git-core rather than git for git-daemon
  - Rename gitweb httpd config file
  - Install contrib/diff-highlight (#1550251)


author: Todd Zullinger <tmz@pobox.com> - 2.17.0-0.1.rc1.1
changelog:
  - Drop .py extension from contrib/hooks/multimail/git_multimail.py
  - Remove unnecessary "chmod +x contrib/hooks/*"


author: Todd Zullinger <tmz@pobox.com>
changelog:
  - Allow git-p4 subpackage to be toggled via --with/--without
  - Use %bcond_(with|without) to enable/disable python3
  - Add support for disabling python2


author: Todd Zullinger <tmz@pobox.com>
changelog:
  - daemon: use --log-destination=stderr with systemd
  - daemon: fix condition for redirecting stderr
  - git-svn: avoid uninitialized value warning


author: Pavel Cahyna <pcahyna@redhat.com>
changelog:
  - Use BuildRequires: perl-interpreter per the packaging guidelines
  - Update conditions for future RHEL


author: Todd Zullinger <tmz@pobox.com> - 2.17.0-4
changelog:
  - Fix segfault in rev-parse with invalid input (#1581678)
  - Move TEST_SHELL_PATH setting to config.mak


author: Todd Zullinger <tmz@pobox.com> - 2.17.1-3
changelog:
  - Use %apply_patch for aarch64 zlib patch, return to %autosetup
  - Disable jgit tests on s390x, they're unreliable
  - Use %make_build and %make_install


author: Sebastian Kisela <skisela@redhat.com> - 2.18.0-4
changelog:
  - Fix %{perllibdir} path
  - %{perllibdir} now points to where perl-git modules are installed.
    This was introduced in fedora commit:
    f3c13faa206935a844e09c7dc9d78d6325100ced.


author: Sebastian Kisela <skisela@redhat.com> - 2.18.0-5
changelog:
  - Add %{?scl_prefix} macros for services + desktop files.
  - Add tests, checking hardcoded content of dist git sources,
  written by pstodulk.
  - Make git-gui.desktop, git@.service and gitweb-httpd.conf content
  point to the correct scl paths.
  - Move instaweb to separate subpackage
  - Switch instaweb default HTTP daemon to httpd
  - Use the correct apache module directory in instaweb.
  - Build docs with TZ=UTC to make results deterministic.
    Inspired by https://wiki.debian.org/ReproducibleBuilds/TimestampsInDocumentationGeneratedByAsciidoc


author: Pavel Cahyna <pcahyna@redhat.com> - 2.18.1-2
changelog:
  - Fix build when apr-util does not pull in apr-util-bdb, adapt the existing Fedora condition.
    Problem caused by changes in #1633973 and #1491151.
  - Fix builds without docs and without cvs and/or p4 (from skisela)
  - Fix smart-http test due to changes in cookie sort order in curl-7.61.1


author: Pavel Cahyna <pcahyna@redhat.com> - 2.18.1-3
changelog:
  - apply upstream run-command PATH fix (CVE-2018-19486)
  - config: document value 2 for protocol.version (upstream patch)


author: Ondrej Pohorelsky <opohorel@redhat.com> - 2.18.2-1
changelog:
  - Update to release 2.18.2
  - Remote code execution in recursive clones with nested submodules
    Resolves: CVE-2019-1387
  - Fixes CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,	
    CVE-2019-1352, CVE-2019-1353, CVE-2019-1354


author: Karsten Hopp <karsten@redhat.com> - 3.20.0-6
changelog:
  - apply upstream patch from Jonh Wendell to fix g_ptr_array_find types and make it
    build with latest glib2


author: Rafal Luzynski <digitalfreak@lingonborough.com> 1.2.5-4
changelog:
  - New translations: Friulian, Kazakh, Norwegian Nynorsk
  - Translation updates: Dutch, Finnish, Marathi


author: Julius Milan <jmilan@redhat.com> 1.2.6-1
changelog:
  - Translation updates
  - Satisfy pylint v1.7.1 warnings
  - pylintrc: disable pylint no-else-return warnings
  - Add fur, kk, nn languages into LINGUAS


author: Matej Habrnal <mhabrnal@redhat.com> - 1.2.6-5
changelog:
  - pylint(R0205): Remove explicit object inheritance
  - Fix incorrect parsing of reported_to file
  - Apply the new packaging guidelines
  - Mark the `--help' command line descriptions for translation
  - Remove Expert mode and the remaining Analyze code


author: Ryan Lerch <rlerch@redhat.com> - 3.24.0-2
changelog:
  - Split the package into gnome-backgrounds for the default adwaita background,
    and gnome-backgrounds-extras for the other standard GNOME wallpapers.


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-30
changelog:
  - Fix stuck grab if disabled with open context menu
    Resolves: #2149670
  - Support .desktop files of type Link
    Resolves: #2143825


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-31
changelog:
  - Adjust classification banner position in fullscreen
    Resolves: #2150107
  - Allow inhibiting workspace switch gesture
    Resolves: #2138109


author: Alexey Lyubimov <a.lyubimov@msvsphere.ru> - 3.32.1-38.inferit
changelog:
  - dash to panel Update Russian translation
  - dash to panel Removing items from apps menu
  - Rebuilt for MSVSphere 8.9


author: Timur Kristóf <venemo@fedoraproject.org> - 3.0.2-1.g63dd27cgit
changelog:
  - Update to a newer git snapshot
  - Fix RHBZ bug #708230
  - Enabled systemMonitor extension, but commented out since the requirements are not available


author: Michel Salim <salimma@fedoraproject.org> - 3.1.4-1
changelog:
  - Update to 3.1.4
  - Enable systemMonitor extension
  - Prepare xrandr-indicator, commenting out since it does not seem to work yet
  - Rename subpackages in line with new guidelines (# 715367)
  - Sort subpackages in alphabetical order


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 3.1.91-3.20111001gite102c0c6
changelog:
  - Update to a newer git snapshot
  - Fix GNOME Shell version to work with GS 3.2.0
  - Add Requires on GS 3.2.0 or above to gnome-shell-common


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 3.7.3-1
changelog:
  - Update to 3.7.3
  - Enable new default-min-max and static-workspaces extensions
  - Provide new subpackage gnome-classic-session
  - Revamp summaries and descriptions


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 3.7.5.1-1
changelog:
  - Update to 3.7.5
  - Enable new launch-new-instance and window-list extensions, and add them in the
    classic-mode extension set
  - Re-add places-menu in the classic-mode extension set


author: Rahul Sundaram <sundaram@fedoraproject.org> - 3.9.3-1
changelog:
  - Update to 3.9.3
  - Obsolete default-min-max and static workspaces extensions
  - Use make_install macro
  - Fix bogus dates in spec changelog


author: Ray Strode <rstrode@redhat.com> - 3.28.1-3
changelog:
  - Add a wayland variant of gnome-classic
    Also change up the names to Standard and Classic to match UX design

    Related: #1612915 1595825


author: Ray Strode <rstrode@redhat.com> - 3.28.1-4
changelog:
  - Add back corporate logo on the left of Activities
  - Remove shadow remnants of app logo to the right of Activities
    Resolves: #1620241


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-5
changelog:
  - Small refinements after design feedback:
    - use default icon size in picker button to avoid blurriness
    - use <super> shortcut to open window picker
    Resolves: #1721195


author: Florian Müllner <fmuellner@redhat.com> - 3.32-1-6
changelog:
  - Fix new classic mode issues:
    - stray signal handler with overlay key
      Resolves: #1722844
    - improve DND support:
      + don't consider regular windows
        (it doesn't work well, and GNOME 2 didn't support it either)
      + indicate that workspace thumbs are drop targets
     Related: #1704360


author: Florian Müllner <fmuellner@redhat.com> - 3.32-1-7
changelog:
  - Add window thumbnails to workspace switcher
    Resolves: #1723467
  - Fix apps-menu not disabling itself entirely
    Resolves: #1722047


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-11
changelog:
  - Adjust dash-to-dock for classic backports
    Resolves: #1805929
  - Fix inconsistent state in window-list prefs dialog
    Resolves: #1824362


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-15
changelog:
  - Fix stuck window picker after screen lock
    Resolves: #1905000
  - Add tooltips to workspace previews
    Resolves: #1894613


author: Florian Müllner <fmuellner@redhat.com> - 3.32.1-40
changelog:
  - Fix '%k' macro in .desktop files
    Resolves: RHEL-72966
  - Indicate urgency-hint in window-list
    Resolves: RHEL-70534


author: Benjamin Berg <bberg@redhat.com> - 3.28.2-30
changelog:
  - Fix connection list AP selection and SSID display for OWE
    Resolves: #2023156
  - Fix saving passwords for non-wifi connections
    Resolves: #1938944


author: Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 3.28.2-37.inferit
changelog:
  - Check MSVSPHERE_PRETTY_NAME field first to set OS name (adapted patch by Arkady L. Shane for MSVSphere 9)
  - Updated Russian translation


author: Adam Williamson <awilliam@redhat.com> - 3.28.0-7
changelog:
  - Drop unnecessary pkgconfig(NetworkManager) BuildRequire
  - Run autoreconf to avoid automake version mismatch


author: Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 3.28.0-11.inferit
changelog:
  - Location and reporting services option should be off by default
  - Updated Russian translation
  - Rebuilt for MSVSphere 8.9


author: Kalev Lember <klember@redhat.com> - 3.27.92-1
changelog:
  - Update to 3.27.92
  - Don't set group tags
  - Remove ancient obsoletes
  - Remove gsettings schema scriptlets


author: Alexander Larsson <alexl@redhat.com> - 2.20-2
changelog:
  - Backport fix from svn where newly created keyrings weren't
    found
  - Don't unset default keyring on daemon shutdown


author: Alexander Larsson <alexl@redhat.com> - 2.20-4
changelog:
  - Have the pam module tell the daemon to init the login keyring 
    without using the socket as selinux limits access to that


author: Colin Walters <walters@redhat.com> - 2.22.3.6-2
changelog:
  - Add --disable-acl-prompts; you can't try to maintain integrity
    between two processes with the same UID and no other form of
    access control.


author: Richard Hughes <rhughes@redhat.com> - 2.26.0-2
changelog:
  - Fix a nasty bug that's been fixed upstream where gnome-keyring-daemon
    would hang when re-allocating from a pool of secure memory.


author: Matthias Clasen <mclasen@redhat.com> - 2.26.1-1
changelog:
  - Update to 2.26.1
  - See http://download.gnome.org/sources/gnome-keyring/2.26/gnome-keyring-2.26.1.news


author: Tomas Bzatek <tbzatek@redhat.com> - 2.29.5-2
changelog:
  - Fix endless loop when looking for password in login keyring
  - Fix undefined reference to S_ISSOCK (#557970)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.29.92-2
changelog:
  - More robust error display and handling
  - [secret-store] Don't save session keyring to disk
  - [dbus] Allow unlocking even when always unlock is not available
  - [dbus] Hide the automatically unlock check when login not usable
  - [login] Fix various issues storing and using auto unlock passwords


author: David King <amigadave@amigadave.com> - 3.15.90-1
changelog:
  - Update to 3.15.90
  - Update URL
  - Use pkgconfig for BuildRequires
  - Use license macro for COPYING and COPYING.LIB
  - Preserve timestamps during install


author: Ray Strode <rstrode@redhat.com> 3.18.0-4
changelog:
  - Fix password handoff in non-autologin case
  - Remove unneccessary part of autologin fix
    Related: #1269581


author: Milan Crha <mcrha@redhat.com> - 3.28.2-5
changelog:
  - Resolves: RHEL-10493 (Move account types that depend on WebKitGTK into separate optional subpackage)


author: Milan Crha <mcrha@redhat.com> - 3.28.2-6
changelog:
  - Resolves: RHEL-10493 (Move account types that depend on WebKitGTK into separate optional subpackage)
  - backport upstream fix to use external browser for OAuth2


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.0-3
changelog:
  - Drop the run-time requirement on ImageMagick
  - Enable Python 2 during the build for itstool
  Resolves: #1564997


author: Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 3.28.1-21.inferit
changelog:
  - Update Russian translation in desktop files
  - Drop gnome-custom-session.desktop
  - Rebuilt for MSVSphere 8.9


author: Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 3.32.0-19.inferit.1
changelog:
  - Removing the 'System Not Registered' notification from GNOME (https://access.redhat.com/solutions/6976776)


author: Ray Strode <rstrode@redhat.com> - 3.32.0-20
changelog:
  - Backport some upstream smartcard changes that make it work
    better with p11-kit
    Resolves: #1796190
  - Rework how subscription-manager plugin is conditionalized so
    it doens't get built on centos 8 stream


author: Florian Müllner <fmuellner@redhat.com> - 3.32.2-50
changelog:
  - Fix struts on login screen
    Resolves: #2138941
  - Fix launching network device settings
    Resolves: #1879405


author: Owen Taylor <otaylor@redhat.com> - 2.27.2-1
changelog:
  - Update to 2.27.2
  - Add an explicit dep on gobject-introspection 0.6.5 which is required 
    for the new version


author: Adam Miller <maxamillion@fedoraproject.org> - 2.28.0.20101015git-1
changelog:
  - Added dependency on a git build of gobject-introspect to solve some breakage
  - Also went ahead and made a new git tarball


author: Adam Miller <maxamillion@fedoraproject.org> - 2.29.1-2
changelog:
  - Bumped for new version of mutter and clutter
  - Added version requirement to gjs-devel because of dependency of build


author: Adam Miller <maxamillion@fedoraproject.org> - 2.31.2-2
changelog:
  - Added new version requirements for dependencies based on upstream releases
  - Added new file listings for gnome-shell-clock-preferences binary and .desktop
  - Added gnome-shell man page file listing


author: Owen Taylor <otaylor@redhat.com> - 2.91.1-1
changelog:
  - Update to 2.91.1
  - Add libcroco-devel to BuildRequires, apparently it was getting
    pulled in indirectly before
  - Add libcanberra-devel and pulseaudio-libs-devel BuildRequires


author: Nils Philippsen <nils@redhat.com> - 3.0.0.2-1
changelog:
  - Update to 3.0.0.2 (fixes missing import that was preventing extensions from
    loading.)
  - Update source URL


author: Dan Williams <dcbw@redhat.com> - 3.0.1-4
changelog:
  - Fix initial connections to WPA Enterprise access points (#699014)
  - Fix initial connections to mobile broadband networks


author: Owen Taylor <otaylor@redhat.com> - 3.4.0-2
changelog:
  - Change gnome-shell-favourite-apps-firefox.patch to also patch the JS code
    to handle the transition from mozilla-firefox.desktop to firefox.desktop.
    (#808894, reported by Jonathan Kamens)


author: Florian Müllner <fmuellner@redhat.com> - 3.6.1-2
changelog:
  - Remove avoid-redhat-menus patch

    The standard way of supporting a desktop-specific menu layout is
    to set XDG_MENU_PREFIX (which we made gnome-session do now).


author: Kalev Lember <kalevlember@gmail.com> - 3.9.1-2
changelog:
  - Add missing telepathy-logger runtime dep
  - Depend on gnome-session-xsession so that it gets pulled in for
    typical GNOME installs


author: Florian Müllner <fmuellner@redhat.com> - 3.11.90-3
changelog:
  - Add dependency on gnome-control-center - several panels are referenced
    by a number of menu items


author: Ray Strode <rstrode@redhat.com> 3.15.91-2
changelog:
  - Drop dep on NetworkManager-config-connectivity-fedora
    It's already required by fedora-release-workstation


author: Kalev Lember <klember@redhat.com> - 3.17.4-2
changelog:
  - Create empty directories for extensions and search providers
  - Move desktop file validation to %check section
  - Use make_install macro


author: Florian Müllner <fmuellner@redhat.com> - 3.21.90.1-1
changelog:
  - Update to 3.21.90.1
    (Fixes a corrupt .desktop file that made it from the build directory into
     the 3.21.90 tarball)


author: Florian Müllner <fmuellner@redhat.com> - 3.28.3-9
changelog:
  - Fix JS "invalid access" warnings (#1642482, #1637622)
  - Fix new input sources only working after re-login (#1628154)
  - Backport IM support fixes (#1668979)


author: Carlos Garnacho <cgarnach@redhat.com> - 3.32.2-12
changelog:
  - Fix window dragging with tablets in the overview
    Resolves: #1716767
  - Fix high-contrast/symbolic race
    Resolves: #1730612
  - Make perf-tool usable on wayland
    Resolves: #1652178


author: Florian Müllner <fmuellner@redhat.com> - 3.32.2-17
changelog:
  - Really allow using perf-tool on wayland
    Resolves: #1652178
  - Fix timed login without user list
    Resolves: #1668895
  - Fix HighContrast/symbolic icon mixup
    Resolves: #1794045
  - Backport introspect API changes
    Resolves: #1837413


author: Florian Müllner <fmuellner@redhat.com> - 3.32.2-22
changelog:
  - Wake up lock screen when deactivated programmatically
    Resolves: #1854290
  - Backport better caps-lock warning
    Resolves: #1861357
  - Fix more (harmless) JS warnings
    Resolves: #1881312


author: Ray Strode <rstrode@redhat.com> - 3.32.2-36
changelog:
  - Add ability to lock down password showing
    Resolves: #1770302
  - Add requires on newer mutter version
    Related: #1937866


author: Florian Müllner <fmuellner@redhat.com> - 3.32.2-45
changelog:
  - Fix lock up when previous focus actor is destroyed during modal
    Resolves: #2075231
  - Defend against corrupt notifications file
    Resolves: #2078564


author: Joan Torres Lopez <joantolo@redhat.com> - 3.32.2-58
changelog:
  - Don't hard depend on gnome-session-xsession to allow
    using other session types, e.g. wayland
    Resolves: RHEL-110531


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.3-3
changelog:
  - Support using the '0', '+' and '-' keys from the numeric keypad as
    accelerators
  - Resolves: #837035


author: Milan Crha <mcrha@redhat.com> - 3.28.1-7
changelog:
  - extensions: Incorrectly shows enabled extensions as disabled after enable-all
  - Resolves: #1804123


author: Parag Nemade <pnemade AT redhat DOT com> - 20120503-10
changelog:
  - Add metainfo file to show this font in gnome-software
  - Remove %clean section which is optional now
  - Remove buildroot which is optional now
  - Remove removal of buildroot in %install
  - Remove %defattr
  - Remove group tag


author: Pavel Cahyna <pcahyna@redhat.com> - 5.2.4-1
changelog:
  - Rebase to upstream release 5.2.4
  - Add workaround for broken info generation (upstream bug
    https://sourceforge.net/p/gnuplot/bugs/1963/) from Debian
  - Use explicit path for texdir
  - Correct the description of command line options in manpage, bz#1612690
  - Install gnuplot-qt and gnuplot-wx manpage links, bz#1612690


author: Pavel Cahyna <pcahyna@redhat.com> - 5.2.4-2
changelog:
  - Add --with-bitmap-terminals to configure flags, among others this enables
    the pbm terminal, bz#2122652


author: Zoltan Fridrich <zfridric@redhat.com> - 3.6.16-6
changelog:
  - Fix x86_64 CPU feature detection when AVX is not available (#2131152)
  - Fix timing side-channel in TLS RSA key exchange (#2162598)


author: Alejandro Sáez <asm@redhat.com> - 2-17
changelog:
  - Add and update the go-compiler functionality (gobuild macro)
  - Deprecate ix86
  - Update Source0
  - Resolves: rhbz#1905383


author: Kalev Lember <klember@redhat.com> - 1.55.2-1
changelog:
  - Update to 1.55.2
  - Drop /usr/bin/env shebang patch as the brp scripts now handle this correctly
  - Remove ldconfig scriptlets


author: Adam Goode <adam@spicenitz.org> - 1.1.1-3
changelog:
  - Use lua for pretrans (http://fedoraproject.org/wiki/Packaging:Guidelines#The_.25pretrans_scriptlet)


author: Adam Goode <adam@spicenitz.org> - 1.1.1-4
changelog:
  - Move src to libdir for now (#973842) (upstream issue https://code.google.com/p/go/issues/detail?id=5830)
  - Eliminate noarch data package to work around RPM bug (#975909)
  - Try to add runtime-gdb.py to the gdb safe-path (#981356)


author: Adam Miller <maxamillion@fedoraproject.org> - 1.1.2-5
changelog:
  - Pull upstream patches for BZ#1010271
  - Add glibc requirement that got dropped because of meta dep fix


author: Vincent Batts <vbatts@redhat.com> - 1.1.2-6
changelog:
  - don't symlink /usr/bin out to ../lib..., move the file
  - seperate out godoc, to accomodate the go.tools godoc


author: Adam Miller <maxamillion@fedoraproject.org> 1.2-7
changelog:
  - Remove  _BSD_SOURCE and _SVID_SOURCE, they are deprecated in recent
    versions of glibc and aren't needed


author: Vincent Batts <vbatts@fedoraproject.org> 1.2.1-3
changelog:
  - including more to macros (%go_arches)
  - set a standard goroot as /usr/lib/golang, regardless of arch
  - include sub-packages for compiler toolchains, for all golang supported architectures


author: Vincent Batts <vbatts@fedoraproject.org> - 1.3-10
changelog:
  - more work to get cgo.a timestamps to line up, due to build-env
  - explicitly list all the files and directories for the source and packages trees
  - touch all the built archives to be the same


author: Vincent Batts <vbatts@fedoraproject.org> - 1.5-3
changelog:
  - bz1256910 only allow the golang zoneinfo.zip to be used in tests
  - bz1166611 add golang.org/x directory
  - bz1256525 include stdlib shared object. This will let other libraries and binaries
    build with `go build -buildmode=shared -linkshared ...` or similar.


author: Vincent Batts <vbatts@fedoraproject.org> - 1.5-6
changelog:
  - starting a shared object subpackage. This will be x86_64 only until upstream supports more arches shared objects.


author: Jakub Čajka <jcajka@redhat.com> - 1.5.2-1
changelog:
  - bz1288263 rebase to 1.5.2
  - spec file clean up
  - added build options
  - scrubbed "Project Gutenberg License"


author: Jakub Čajka <jcajka@redhat.com> - 1.5.3-1
changelog:
  - rebase to 1.5.3
  - resolves bz1293451, CVE-2015-8618
  - apply timezone patch, avoid using bundled data
  - print out rpm build system info


author: Jakub Čajka <jcajka@redhat.com> - 1.6-0.1.rc1
changelog:
  - Resolves bz1292640, rebase to pre-release 1.6
  - bootstrap for PowerPC
  - fix rpmlint errors/warning


author: Jakub Čajka <jcajka@redhat.com> - 1.6-1
changelog:
  - Resolves: bz1304701 - rebase to go1.6 release
  - Resolves: bz1304591 - fix possible stack miss-alignment in callCgoMmap


author: Jakub Čajka <jcajka@redhat.com> - 1.6.1-1
changelog:
  - rebase to 1.6.1
  - Resolves: bz1324344 - CVE-2016-3959
  - Resolves: bz1324951 - prelink is gone, /etc/prelink.conf.d/* is no longer used
  - Resolves: bz1326366 - wrong epoll_event struct for ppc64le/ppc64


author: Jakub Čajka <jcajka@redhat.com> - 1.7-0.0.rc2
changelog:
  - rebase to 1.7rc2
  - added s390x build
  - improved shared lib packaging
  - Resolves: bz1357602 - CVE-2016-5386
  - Resolves: bz1342090, bz1342090


author: Jakub Čajka <jcajka@redhat.com> - 1.7-0.3.rc5
changelog:
  - Obsolete golang-vet and golang-cover from golang-googlecode-tools package
    vet/cover binaries are provided by golang-bin rpm (thanks to jchaloup)
  - clean up exclusive arch after s390x boostrap
  - resolves: #1268206


author: Jakub Čajka <jcajka@redhat.com> - 1.8-0.rc3.2
changelog:
  - make possible to override default traceback level at build time
  - add sub-package race containing std lib built with -race enabled
  - Related: BZ#1411242


author: Derek Parker <deparker@redhat.com> - 1.10.3-15
changelog:
  - Remove usage of redhat hardening flag file, just pass a select few manually
  - Resolves: rhbz#1642798


author: David Benoit <dbenoit@redhat.com> - 1.15.2-1
changelog:
  - Rebase to 1.15.2
  - fix rhbz#1872622 in commit af9a1b1f6567a1c5273a134d395bfe7bb840b7f8
  - Resolves: rhbz#1872622
  - add net/http graceful shutdown patch
  - Resolves: rhbz#1888673
  - add x509warnCN patch
  - Resolves: rhbz#1889437


author: Alejandro Sáez <asm@redhat.com> - 1.16.1-1
changelog:
  - Rebase to go-1.16.1-2-openssl-fips
  - Resolves: rhbz#1938071
  - Adds a workaround for rhbz#1939923
  - Removes Patch224, it's on upstream -> rhbz#1888673
  - Removes Patch225, it's on upstream -> https://go-review.googlesource.com/c/text/+/238238
  - Removes old patches for cleaning purposes


author: Alejandro Sáez <asm@redhat.com> - 1.16.5-1
changelog:
  - Rebase to 1.16.5
  - Removes rhbz#1955032 patch, it's already included in this release
  - Removes rhbz#1956891 patch, it's already included in this release
  - Related: rhbz#1979677
  - Related: rhbz#1968738
  - Related: rhbz#1972420


author: David Benoit <dbenoit@redhat.com> - 1.16.7-1
changelog:
  - Rebase to Go 1.16.7
  - Resolves: rhbz#1994079
  - Add reject leading zeros patch
  - Resolves: rhbz#1993314


author: Alejandro Sáez <asm@redhat.com> - 1.17.2-1
changelog:
  - Rebase to Go 1.17.2
  - Related: rhbz#2014088
  - Remove golang-1.15-warnCN.patch
  - Remove reject-leading-zeros.patch
  - Remove favicon.ico and robots.txt references
  - Exclude TestEd25519Vectors test


author: David Benoit <dbenoit@redhat.com> - 1.17.4-1
changelog:
  - Rebase Go to 1.17.4
  - Add remove_waitgroup_misuse_tests patch
  - Related: rhbz#2014088
  - Resolves: rhbz#2028570
  - Resolves: rhbz#2022828
  - Resolves: rhbz#2024686
  - Resolves: rhbz#2028662


author: David Benoit <dbenoit@redhat.com> - 1.17.5-1
changelog:
  - Rebase to Go 1.17.5
  - Remove vdso_s390x_gettime patch
  - Resolves: rhbz#2031112
  - Related: rhbz#2028570


author: David Benoit <dbenoit@redhat.com> - 1.19.4-1
changelog:
  - Rebase to Go 1.19.4
  - Fix ppc64le linker issue
  - Remove defunct patches
  - Remove downstream generated FIPS mode patches
  - Add golang-fips/go as the source for FIPS mode patches
  - Resolves: rhbz#2144542


author: Archana Ravindar <aravinda@redhat.com> - 1.21.3-2
changelog:
  - Rebase disable_static_tests_part2.patch to Go 1.21.3
  - Add missing strict fips runtime detection patch
  - Temporarily disable FIPS tests on aarch64 due to builder kernel bugs
  - Remove fix-memory-leak patch as it is fixed upstream
  - Resolves: RHEL-12620


author: Alejandro Sáez <asm@redhat.com> - 1.21.7-1
changelog:
  - Rebase to Go 1.21.7
  - Add release information
  - Set GOTOOLCHAIN to local
  - Skip TestOverlongMessagePKCS1v15
  - Resolves: RHEL-24082
  - Resolves: RHEL-18363
  - Resolves: RHEL-18382


author: David Benoit <dbenoit@redhat.com> - 1.21.13-2
changelog:
  - Rebuild Go with CVE Fixes
  - Remove fix-memleak-setupRSA.patch (exists upstream)
  - Resolves: RHEL-58223
  - Resolves: RHEL-57961
  - Resolves: RHEL-57847
  - Resolves: RHEL-57860


author: David Benoit <dbenoit@redhat.com> - 1.22.3-1
changelog:
  - Update to Go 1.22.3
  - Resolves: RHEL-35884
  - Resolves: RHEL-35075
  - Resolves: RHEL-35632
  - Resolves: RHEL-35901


author: David Benoit <dbenoit@redhat.com> - 1.22.7-1
changelog:
  - Update to Go 1.22.7
  - Resolves: RHEL-58223
  - Resolves: RHEL-57961
  - Resolves: RHEL-57847
  - Resolves: RHEL-57860


author: Archana <aravinda@redhat.com> - 1.22.11-1
changelog:
  - Rebase to Go1.22.11 to pick up fixes for CVE 2024-45341 and 2024-45336
  - Fix test failures with expired certificates
  - Resolves: RHEL-73752


author: David Benoit <dbenoit@redhat.com> - 1.25.3-1
changelog:
  - Update to Go 1.25.3 (sync from CentOS Stream 9)
  - Build go-toolset as a subpackage
  - Preserve GOAMD64=v1 for RHEL 8
  - Resolves: RHEL-121223


author: Parag Nemade <pnemade AT redhat DOT com> - 20120715-8
changelog:
  - Add metainfo file to show this font in gnome-software
  - Remove %clean section which is optional now
  - Remove removal of buildroot in %install
  - Remove group tag


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 2.0-2.1219svn
changelog:
  - Moved munge repacking to prep
  - Added -Dversion to change generated manifest version
  - Removed http part of URL


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 3.1.2-1
changelog:
  - Complete rewrite of the spec file
  - New upstream, to ease future maintenance
  - Build with maven instead of ant
  - Split into multiple subpackages


author: Peng Wu <pwu@redhat.com> - 1.004-6
changelog:
  - Disable Obsoletes for epel: for google-noto-sans-cjk-fonts (rh#1396260)
  - Disable notocjkrep macro definition for epel


author: Mike FABIAN <mfabian@redhat.com> - 20180508-1
changelog:
  - Update to upstream snapshot tarball (color emoji font version 2.011)
  - Add patch to build all country flags (Resolves: rhbz#1574195)


author: Pravin Satpute <psatpute@redhat.com> - 20161022-1
changelog:
  - Resolves #1321685 - Added Noto Mono font.
  - License changed from ASL 2.0 to OFL. 
  - New package addition: Mono, Serif Bengali, Serif Devanagari
  - Serif Gujarari, Serif Malayalam, Serif Tamil and Serif Telugu.


author: Jens Petersen <petersen@redhat.com> - 20161022-3
changelog:
  - add a fontconfig priority option to the notopkg macro,
    which allows overriding the default 66 priority


author: Akira TAGOH <tagoh@redhat.com> - 20161022-7.1
changelog:
  - Add CI tests
    Resolves: rhbz#1682152
  - Fix typos in fontconfig config for Kannada
    Resolves: rhbz#1764502


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.40.1-43
changelog:
  - Fixed races during pdf documentation build which should build docs correctly
    Related: CVE-2020-18032


author: Jose Noguera <jnoguera@redhat.com> - 0.12.0-1
changelog:
  - Update to 0.12.0
  - Add ability to configure maximum number of boot attempts via env var and config file.
  - Add How does it work section to README.
  - Add CI via GitHub Actions and unit testing with BATS.
  - Add update platforms DNS resolutiona and connection checker as health checks out of the box


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.14.0-1
changelog:
  - Release 0.14.0 (Peter Robinson)
  - Updated testing documentation (Jose Noguera)
  - README updated with TOC and improved explanations (Jose Noguera)
  - Add watchdog-triggered boot check #2 (Jose Noguera)
  - Update specfile and README to reflect changes in subpackage layout. (Jose Noguera)
  - Ensure all required health checks are run #52 (Jose Noguera)


author: Dominik Mierzejewski <rpm[AT]greysector.net> 1.0.17-1
changelog:
  - update to 1.0.17 (#1465878)
  - ease future updates by better macro use
  - drop obsolete patch hunks
  - fix missing prototype for fchown warning


author: Dominik Mierzejewski <rpm[AT]greysector.net> 1.0.17-5
changelog:
  - ensure binaries are linked with Fedora LDFLAGS (#1548532)
  - use ldconfig_scriptlets macro
  - add proper man links for tcat and untoast


author: Yanko Kaneti <yaneti@declera.com> - 1.0.0-2
changelog:
  - Initial spec for review - 0.98.0-0.1.a648648
  - Additional patch + references + using %autopatch - 0.98.0-0.2.a648648
  - Update to 1.0.0. drop upstreamed paches - 1.0.0-1
  - Own some more directories as per review (#1167482) - 1.0.0-2


author: Julien Rische <jrische@redhat.com> - 1.2.0-1
changelog:
  - New release 1.2.0
  - Fix CVE-2023-25563: multiple out-of-bounds read when decoding NTLM fields
  - Fix CVE-2023-25564: memory corruption when decoding UTF16 strings
  - Fix CVE-2023-25565: incorrect free when decoding target information
  - Fix CVE-2023-25566: memory leak when parsing usernames
  - Fix CVE-2023-25567: out-of-bounds read when decoding target information
  - Resolves: rhbz#2181313


author: Rex Dieter <rdieter@fedoraproject.org> - 1.13.1-3
changelog:
  - %build: --disable-fatal-warnings --disable-silent-rules
  - fix rpath harder
  - use %ldconfig_scriptlets, %make_build, %make_install
  - -devel: tighten deps with %{_isa}


author: Wim Taymans <wtaymans@redhat.com> - 1.14.0-3
changelog:
  - Remove obsolete liboil BR (#1588303)
  - Only build extras on Fedora
  - bluez is not in extras
  - vdpau is in extras


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-1
changelog:
  - Update to 1.16.1
  - Remove upstreamed patches
  - Remove dependency on removed package
  - Add sctp and closedcaption plugins
  - The vcdsrc plugin was removed
  - Resolves: rhbz#1756299


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-4
changelog:
  - Patch CVE-2023-40474: Integer overflow
  - Patch CVE-2023-40475: Integer overflow
  - Patch CVE-2023-40476: Integer overflow in H.265 video parser
  - Resolves: RHEL-19500, RHEL-19504, RHEL-19507


author: Tomas Popela <tpopela@redhat.com> - 1.14.0-2
changelog:
  - Enable Wayland support (previously disabled due to missing wayland-devel
    as a BR - before it was probably brought in by something else).


author: Rex Dieter <rdieter@fedoraproject.org> - 1.13.1-2
changelog:
  - tigten subpkg deps
  - fix rpaths
  - update %files
  - use %ldconfig_scriptlets %make_build %make_install
  - %build: --disable-fatal-warnings --disable-silent-rules
  - Conflicts: gstreamer1-plugins-bad-free < 1.13


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-5
changelog:
  - Fixes for CVE-2024-47538, CVE-2024-47607, CVE-2024-47615
    Resolves: RHEL-70974, RHEL-71010, RHEL-70986


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-4
changelog:
  - CVE-2023-37327: integer overflow leading to heap overwrite in
    FLAC image tag handling
  - Resolves: RHEL-19469


author: Brian Pepple <bpepple@fedoraproject.org> - 0.11.93-1
changelog:
  - Update to 0.11.93.
  - Add batch to fix build with recent kernels, the v4l2_buffer input field was removed.
  - Use %global instead of %define.


author: Ralf Corsépius <corsepiu@fedoraproject.org> - 1.7.1-3
changelog:
  - Append --disable-fatal-warnings to %configure to prevent
    building from aborting for negligible warnings (Fix F24FTBFS)
  - Append --disable-silent-rules to %configure to make
    building verbose.
  - Don't remove buildroot before installing.


author: Wim Taymans <wtaymans@redhat.com> - 1.13.1-2
changelog:
  - The gtk plugin was moved from -bad, make a new subpackage for it.
  - the mp3 plugins were moved from -ugly, add BuildRequires.
  - build requires GL now for gtkglsink


author: Rex Dieter <rdieter@fedoraproject.org> - 1.13.1-3
changelog:
  - -gtk: Obsoletes/Provides: gstreamer1-plugins-bad-free-gtk
  - Obsoletes/Provides: gstreamer1-plugin-mpg123


author: Wim Taymans <wtaymans@redhat.com> - 1.16.1-5
changelog:
  - CVE-2024-47537, CVE-2024-47539, CVE-2024-47540, CVE-2024-47606,
    CVE-2024-47613
    Resolves: RHEL-70949, RHEL-70962, RHEL-70936, RHEL-71022
    Resolves: RHEL-70998


author: Daniel P. Berrangé <berrange@redhat.com> - 0.9.0-1
changelog:
  - Update to 0.9.0 release
  - Use gcrypt for DES impl instead of local DES impl (rhbz #1618426)
  - Fix crash if connection fails early (rhbz #1622189)


author: Daniel P. Berrangé <berrange@redhat.com> - 0.9.0-2
changelog:
  - Fix crash when TLS handshake fails (rhbz #1665837)
  - Ensure auth failure signal is emitted when SASL fails (rhbz #1688275)


author: Kalev Lember <klember@redhat.com> - 2.24.5-1
changelog:
  - Update to 2.24.5
  - Use license macro for COPYING
  - Don't set group tags
  - Tighten -devel requires with the _isa macro


author: Rex Dieter <rdieter@fedoraproject.org> - 5:2.0.14-7
changelog:
  - avoid linking all guile-devel consumers to libgc
  - BR: gcc
  - use %{make_build},%{make_install}
  - %check: make non-fatal


author: Peter Robinson <pbrobinson@fedoraproject.org> 0.12.8-1
changelog:
  - 0.12.8 release
  - http://ftp.gnome.org/pub/GNOME/sources/gupnp-av/0.12/gupnp-av-0.12.8.news
  - Use %license


author: Kalev Lember <klember@redhat.com> - 0.12.9-1
changelog:
  - Update to 0.12.9
  - Don't set group tags
  - Tighten subpackage deps with the _isa macro
  - Use make_install macro


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.2.4-6
changelog:
  - Python 2 binary package renamed to python2-gupnp-igd
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Kalev Lember <klember@redhat.com> - 0.2.5-1
changelog:
  - Update to 0.2.5
  - Update inter-package dependencies after python2-gupnp-igd rename
  - Tighten deps with the _isa macro
  - Update source URLs
  - Use license macro for COPYING


author: Bastien Nocera <bnocera@redhat.com> - 0.2.5-3
changelog:
  + gupnp-igd-0.2.5-3
  - Remove python2-gupnp-igd sub-package, nothing uses it in Fedora
    and gobject-introspection supports both Python2 and Python3


author: Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 5.2.14-3.inferit
changelog:
  - Added SELinux policy (based on Arkady L. Shane <tigro@msvsphere-os.ru> patch for MSVSphere 9)
  - Rebuilt for MSVSphere 8.9


author: Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 1.36.2-14.inferit
changelog:
  - Added yandex disk webdav support (by Alexey Berezhok <aberezhok@msvsphere-os.ru>)
  - Rebuilt for MSVSphere 8.9


author: Tomas Bzatek <tbzatek@redhat.com> - 0.2.1-2
changelog:
  - Added libarchive dependency for archive backend
  - Require new libsmbclient in order to get smb backend working again


author: David Zeuthen <davidz@redhat.com> - 0.2.3-9
changelog:
  - Ensure archive mounts are read-only and turn on thumbnailing on them
  - Update fuse threading patch


author: Alexander Larsson <alexl@redhat.com> - 1.0.2-2
changelog:
  - Don't return generic fallback icons for files,
    as this means custom mimetypes don't work (from svn)


author: David Zeuthen <davidz@redhat.com> - 1.2.1-3
changelog:
  - Clean up gdu patches and bump BR for gdu to 0.3
  - Avoiding showing volume for ignored mounts (#495033)


author: David Zeuthen <davidz@redhat.com> - 1.2.2-4
changelog:
  - Don't show drives that are supposed to be hidden (#498649)
  - Only automount if media or drive was just inserted - this fixes
    a problem with spurious automounts when partitioning/formatting


author: Tomas Bzatek <tbzatek@redhat.com> - 1.2.2-5
changelog:
  - Require separate libtalloc to fix libsmbclient
  - Ref the infos in next_files_finish (gnome #582195)
  - FTP: parse file sizes > 4GB correctly (#499286)
  - CDDA: allow query well-formed filenames only (#499266)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.3.3-2
changelog:
  - Fix gedit crashed with SEGV in strlen()
  - Fix SMB protocol not handled when opening from a bookmark (#509832)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.3.3-3
changelog:
  - Fix bad mount prefix stripping (part of #509612)
  - Fix gvfsd-sftp segfault when asking a question
  - Enable tar+xz in the archive mounter


author: Tomas Bzatek <tbzatek@redhat.com> - 1.4.0-4
changelog:
  - Fix Nautilus not displaying friendly icons for SSH-connected system (#526892)
  - Actually apply the logical partitions patch


author: Tomas Bzatek <tbzatek@redhat.com> - 1.4.0-5
changelog:
  - Don't always overwrite on trash restore
  - Separate "Safely Remove Drive" from "Eject"
  - Don't advertise can_poll for drives not using removable media
  - Disallow mounting empty drives
  - Disallow ejecting empty drives
  - Silently drop eject error messages when detaching drive


author: Tomas Bzatek <tbzatek@redhat.com> - 1.4.0-7
changelog:
  - HTTP: Support g_file_input_stream_query_info()
  - HTTP: Use libsoup header parsing function
  - Set correct MIME type for MTP music players


author: Tomas Bzatek <tbzatek@redhat.com> - 1.5.1-2
changelog:
  - Metadata fixes
  - SMB: Fix free space calculation for older samba servers
  - fuse: Fix setting timestamps


author: Tomas Bzatek <tbzatek@redhat.com> - 1.5.1-4
changelog:
  - Don't leak mount job operation (#552842)
  - Recognize gphoto2 cameras which don't implement get storageinfo (#552856)
  - ObexFTP: Use a private D-Bus connection for obex-data-server (#539347)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.8.0-2
changelog:
  - Fix threadsafety of closing channels
  - Fix d-bus messages leaks
  - Fix /dev symlink checks in gdu volume monitor


author: Ondrej Holy <oholy@redhat.com> - 1.25.2-2
changelog:
  - Move client libs into the own subpackage
  - Move gvfs tools into the own subpackage
  - Move gvfsd-fuse-tmpfiles.conf into fuse subpackage
  - Remove obsoleted expat-devel dependency
  - Remove obsoleted Group tags
  - Fix bogus dates


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-1
changelog:
  - Update to 1.36.2
  - Remove mount-archive.desktop helper
  - Remove obsolete gvfs utils
  - Disable nfs support


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-6
changelog:
  - Prevent spawning new daemons if outgoing operation exists (#1739117)
  - Force NT1 protocol version for workgroup support (#1739116)


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-7
changelog:
  - Remove libbluray support (#1747972)
  - CVE-2019-12448: Add query_info_on_read/write functionality (rhbz#1754506)
  - CVE-2019-12447: Use fsuid to ensure correct file ownership (rhbz#1752926)
  - CVE-2019-12449: Ensure correct ownership when moving to file:// uri (rhbz#1753972)


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.3-22
changelog:
  - Elimitate race condition when injecting JAR manifest
  - Resolves: rhbz#1495234
  - Remove bogus hamcrest-text JAR


author: Guillaume Rousse <guillomovitch@users.sourceforge.net> 3.7-1mdk
changelog:
  - 3.7
  - vendor tag
  - packager tag
  - s/Copyright/License/
  - truncated description to 72 columns in spec
  - spec cleanup
  - used versioned jar
  - moved demo files to %{_datadir}/%{name}


author: Guillaume Rousse <guillomovitch@users.sourceforge.net> 3.7-6jpp
changelog:
  - versioned dir for javadoc
  - no dependencies for manual and javadoc packages
  - stricter dependency for demo package
  - additional sources in individual archives
  - section macro


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 3.8.2-3jpp.1
changelog:
  - Committed on behalf of Tania Bento <tbento@redhat.com>
  - Update per Fedora review process
  - Resolves rhbz#225954


author: Ben Konrath <bkonrath@redhat.com> - 4.3.1-2jpp
changelog:
  - Set gcj_support to 0 to work around problems with GCJ.
  - Fix buglet with the gcj post/postun if statement.
  - Fix tab / space problems.
  - Fix buildroot.
  - Update Summary.
  - Convert html files to Unix file endings.
  - Disable aot-compile-rpm because it's not working ATM.


author: Ralph Apel <r.apel@r-apel.de> - 0:4.3.1-3jpp
changelog:
  - build and upload noarch packages
  - Add pom and depmap frag
  - BR java-devel = 1.5.0
  - Restore Vendor, Distribution from macros


author: David Walluck <dwalluck@redhat.com> 0:1.1-2
changelog:
  - add options to build without integration, jarjar, and tests
  - allow build with java-devel >= 1.5.0
  - remove javadoc scriptlets
  - use more strict file list
  - fix maven directory ownership
  - add non-versioned symlink for demo
  - fix GCJ requires
  - fix eol in LICENSE.txt
  - remove Vendor and Distribution


author: David Walluck <dwalluck@redhat.com> 0:1.1-7.1
changelog:
  - Fedora-specific: enable GCJ support
  - Fedora-specific: build with java 1.6.0
  - Fedora-specific: disable integration and tests


author: Mat Booth <mat.booth@redhat.com> - 0:1.3-8
changelog:
  - Fix FTBFS
  - Always build integration jar (removes some complexity from the spec)
  - Drop unused patch


author: Jeremy Hinegardner <jeremy@hinegardner.org> - 1.3.12.1-1
changelog:
  - switch to 1.3.12.1 branch
  - add patch from upstream with O'Reilly licensing updates.
  - convert ISO-8859-1 doc files to UTF-8


author: Jeremy Hinegardner <jeremy at hinegardner dot org> - 1.3.14.2-1
changelog:
  - update to 1.3.14.2
  - update make flags that changed with this upstream release
  - added man page installation


author: Jeremy Hinegardner <jeremy at hinegardner dot org> - 1.3.14.6-1
changelog:
  - update to 1.3.14.6
  - remove gcc 4.3 patch, it has been applied upstream
  - remove MIT license as that code has been removed from upstream


author: Jeremy Hinegardner <jeremy at hinegardner dot org> - 1.3.15.6-1
changelog:
  - update to 1.3.15.6
  - use new build targets from upstream
  - add in recommended build options for x86 from upstream


author: Robin Lee <cheeselee@fedoraproject.org> - 1.4.22-1
changelog:
  - Update to 1.4.22 (CVE-2012-2942, #824544)
  - Use linux2628 build target
  - No separate x86_64 build target for halog
  - halog build honors rpmbuild optflags
  - Specfile cleanup


author: Ryan O'Hara <rohara@redhat.com> - 1.4.23-1
changelog:
  - Update to 1.4.23 (CVE-2013-1912, #947697)
  - Drop supplementary groups after setuid/setgid (#894626)


author: Florian Weimer <fweimer@redhat.com> - 1.8.3-5
changelog:
  - Build halog and iprange with linker flags from redhat-rpm-config
  - Tell build to include <crypt.h>


author: Ryan O'Hara <rohara@redhat.com> - 1.8.15-1
changelog:
  - Update to 1.8.15 (#1631815)
  - Resolve CVE-2018-20102 (#1659017)
  - Resolve CVE-2018-20103 (#1659019)


author: Debarshi Ray <rishi@fedoraproject.org> 2.14.1-2
changelog:
  - Always use lua over luajit, just more common
  - Remove no longer needed snippets
  - Add enchant/enchant2 to requires


author: Danilo de Paula <ddepaula@redhat.com> - 1.3.15-7
changelog:
  - Rebuild all virt packages to fix RHEL's upgrade path
  - Resolves: rhbz#1695587
    (Ensure modular RPM upgrade path)


author: Davide Caratti <dcaratti@redhat.com> - 2.9-16
changelog:
  - disable 'badfuncs' rpminspect test
  - change default value of CONFIG_TLS_DEFAULT_CIPHERS to allow using OpenSSL
    to compute 3DES


author: Jakub Hrozek <jhrozek@redhat.com> - 2.8.0-2
changelog:
  - Resolves: #rhbz1654223: CVE-2018-7159 http-parser: nodejs: HTTP parser
                            allowed for spaces inside Content-Length header
                            values [rhel-8]


author: Sergio Correia <scorreia@redhat.com> - 2.8.0-4
changelog:
  - Resolves: rhbz#1666382: CVE-2018-12121 http-parser: nodejs: Denial of
                            Service with large HTTP headers [rhel-8]


author: Sergio Corrreia <scorreia@redhat.com> - 2.8.0-7
changelog:
  - Resolves: CVE-2019-15605 http-parser: nodejs: HTTP request
                             smuggling using malformed Transfer-Encoding header


author: Severin Gehwolf <sgehwolf@redhat.com> 4.1.1-2
changelog:
  - Add BR/R apache-commons-codec, since httpcomponents-client's
    MANIFEST.MF has an Import-Package: org.apache.commons.codec
    header.


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 4.2.1-2
changelog:
  - Install NOTICE.txt file
  - Fix javadir directory ownership
  - Fix directory permissions
  - Preserve timestamps
  - Replace add_to_maven_depmap with add_maven_depmap


author: Mat Booth <mat.booth@redhat.com> - 4.5.6-2
changelog:
  - Add a patch to allow building with mockito 2
  - Don't package tests jars, the tests jars have the same OSGi metadata as the
    main jars, which can cause tycho to resolve the wrong one when building
    eclipse plugins


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 4.5.10-4
changelog:
  - Fix incorrect handling of malformed authority component in request URIs
  - Resolves: CVE-2020-13956


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 4.1.1-1
changelog:
  - Update to latest upstream (4.1.1)
  - Use new maven macros
  - Tweaks according to new guidelines
  - Enable tests again (seem to work OK even in koji now)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-62
changelog:
  - Resolves: #2221083 - Apache Bug 57087: mod_proxy_fcgi doesn't send cgi 
    CONTENT_LENGTH variable when the client request used Transfer-Encoding:chunked


author: Joe Orton <jorton@redhat.com> - 2.2.15-3
changelog:
  - default config tweaks:
   * harden httpd.conf w.r.t. .htaccess restriction (#591293)
   * load mod_substitute, mod_version by default
   * drop proxy_ajp.conf, load mod_proxy_ajp in httpd.conf
   * add commented list of shipped-but-unloaded modules
   * bump up worker defaults a little
   * drop KeepAliveTimeout to 5 secs per upstream
  - fix LSB compliance in init script (#522074)
  - bundle NOTICE in -tools
  - use init script in logrotate postrotate to pick up PIDFILE
  - drop some old Obsoletes/Conflicts


author: Joe Orton <jorton@redhat.com> - 2.2.17-7
changelog:
  - generate dummy mod_ssl cert with CA:FALSE constraint (#667841)
  - add man page stubs for httpd.event, httpd.worker
  - drop distcache support
  - add STOP_TIMEOUT support to init script


author: Joe Orton <jorton@redhat.com> - 2.2.21-6
changelog:
  - complete conversion to systemd, drop init script (#770311)
  - fix comments in /etc/sysconfig/httpd (#771024)
  - enable PrivateTmp in service file (#781440)
  - set LANG=C in /etc/sysconfig/httpd


author: Joe Orton <jorton@redhat.com> - 2.4.1-1
changelog:
  - update to 2.4.1
  - adopt upstream default httpd.conf (almost verbatim)
  - split all LoadModules to conf.modules.d/*.conf
  - include conf.d/*.conf at end of httpd.conf
  - trim %changelog


author: Joe Orton <jorton@redhat.com> - 2.4.1-2
changelog:
  - clean docroot better
  - ship proxy, ssl directories within /var/cache/httpd
  - default config:
   * unrestricted access to (only) /var/www
   * remove (commented) Mutex, MaxRanges, ScriptSock
   * split autoindex config to conf.d/autoindex.conf
  - ship additional example configs in docdir


author: Joe Orton <jorton@redhat.com> - 2.4.1-3
changelog:
  - add mod_proxy_html subpackage (w/mod_proxy_html + mod_xml2enc)
  - move mod_ldap, mod_authnz_ldap to mod_ldap subpackage


author: Joe Orton <jorton@redhat.com> - 2.4.2-4
changelog:
  - pull from upstream:
    * use TLS close_notify alert for dummy_connection (r1326980+)
    * cleanup symbol exports (r1327036+)


author: Joe Orton <jorton@redhat.com> - 2.4.2-15
changelog:
  - move tmpfiles.d fragment into /usr/lib per new guidelines
  - package /run/httpd not /var/run/httpd
  - set runtimedir to /run/httpd likewise


author: Joe Orton <jorton@redhat.com> - 2.4.2-18
changelog:
  - avoid use of "core" GIF for a "core" directory (#168776)
  - drop use of "syslog.target" in systemd unit file


author: Joe Orton <jorton@redhat.com> - 2.4.3-7
changelog:
  - use systemd scriptlets if available (#850149)
  - don't run posttrans restart if /etc/sysconfig/httpd-disable-posttrans exists


author: Joe Orton <jorton@redhat.com> - 2.4.3-13
changelog:
  - filter mod_*.so auto-provides (thanks to rcollet)
  - pull in syslog logging fix from upstream (r1344712)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-5
changelog:
  - execute systemctl reload as result of apachectl graceful
  - mod_ssl: ignore SNI hints unless required by config
  - mod_cache: forward-port CacheMaxExpire "hard" option
  - mod_ssl: fall back on another module's proxy hook if mod_ssl proxy
    is not configured.


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-6
changelog:
  - htpasswd/htdbm: fix hash generation bug (#956344)
  - do not dump vhosts twice in httpd -S output (#928761)
  - mod_cache: fix potential crash caused by uninitialized variable (#954109)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-12
changelog:
  - mod_unique_id: replace use of hostname + pid with PRNG output (#976666)
  - apxs: mention -p option in manpage


author: Joe Orton <jorton@redhat.com> - 2.4.6-4
changelog:
  - load mod_macro by default (#998452)
  - add README to conf.modules.d
  - mod_proxy_http: add possible fix for threading issues (r1534321)
  - core: add fix for truncated output with CGI scripts (r1530793)


author: Joe Orton <jorton@redhat.com> - 2.4.10-2
changelog:
  - enable mod_request by default for mod_auth_form
  - move disabled-by-default modules from 00-base.conf to 00-optional.conf


author: Joe Orton <jorton@redhat.com> - 2.4.10-6
changelog:
  - mod_ssl: treat "SSLCipherSuite PROFILE=..." as special (#1109119)
  - switch default ssl.conf to use PROFILE=SYSTEM (#1109119)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.10-7
changelog:
  - mod_systemd: updated to the latest version
  - use -lsystemd instead of -lsystemd-daemon (#1125084)
  - fix possible crash in SIGINT handling (#958934)


author: Joe Orton <jorton@redhat.com> - 2.4.10-8
changelog:
  - pull in httpd-filesystem as Requires(pre) (#1128328)
  - fix cipher selection in default ssl.conf, depend on new OpenSSL (#1134348)
  - require hostname for mod_ssl post script (#1135118)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.10-15
changelog:
  - core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
  - mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)
  - mod_proxy_fcgi: fix a potential crash with long headers (CVE-2014-3583)
  - mod_lua: fix handling of the Require line when a LuaAuthzProvider is used
    in multiple Require directives with different arguments (CVE-2014-8109)


author: Joe Orton <jorton@redhat.com> - 2.4.17-1
changelog:
  - update to 2.4.17 (#1271224)
  - build, load mod_http2
  - don't build mod_asis, mod_file_cache
  - load mod_cache_socache, mod_proxy_wstunnel by default
  - check every built mod_* is configured
  - synch ssl.conf with upstream; disable SSLv3 by default


author: Joe Orton <jorton@redhat.com> - 2.4.18-3
changelog:
  - remove httpd pre script (duplicate of httpd-filesystem's)
  - in httpd-filesystem pre script, create group/user iff non-existent


author: Joe Orton <jorton@redhat.com> - 2.4.23-1
changelog:
  - update to 2.4.23 (#1325883, #1353203)
  - load mod_proxy_hcheck
  - recommend use of "systemctl edit" in httpd.service


author: Joe Orton <jorton@redhat.com> - 2.4.23-2
changelog:
  - restore build of mod_proxy_fdpass (#1325883)
  - improve check tests to catch configured-but-not-built modules


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.23-7
changelog:
  - Resolves: #1401530 - CVE-2016-8740 httpd: Incomplete handling of
    LimitRequestFields directive in mod_http2


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.25-7
changelog:
  - Resolves: #1397243 - Backport Apache Bug 53098 - mod_proxy_ajp:
    patch to set worker secret passed to tomcat


author: Joe Orton <jorton@redhat.com> - 2.4.27-9
changelog:
  - use sscg defaults; append CA cert to generated cert
  - document httpd-init.service in httpd-init.service(8)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.28-2
changelog:
  - Resolves: #1512563 - httpd: update welcome page branding
  - Resolves: #1511123 - RFE: httpd use event MPM by default
  - Resolves: #1493510 - RFE: httpd, add IP_FREEBIND support for Listen


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.35-4
changelog:
  - Resolves: #1635681 - sync with Fedora 28/29 httpd
  - comment-out SSLProtocol, SSLProxyProtocol from ssl.conf in default
    configuration; now follow OpenSSL system default (#1468322)
  - dropped NPN support
  - mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
  - don't block on service try-restart in posttrans scriptlet
  - build and load mod_brotli
  - mod_systemd: show bound ports in status and log to journal
    at startup
  - updated httpd.service.xml man page
  - tweak wording in privkey passphrase prompt
  - drop sslmultiproxy patch
  - apachectl: don't read /etc/sysconfig/httpd
  - drop irrelevant Obsoletes for devel subpackage
  - move instantiated httpd@.service to main httpd package


author: Joe Orton <jorton@redhat.com> - 2.4.35-7
changelog:
  - mod_ssl: drop SSLRandomSeed from default config (#1638730)
  - mod_ssl: follow OpenSSL protocol defaults if SSLProtocol
       is not configured (Rob Crittenden, #1638738)


author: Joe Orton <jorton@redhat.com> - 2.4.37-7
changelog:
  - add DefaultStateDir/ap_state_dir_relative() (#1653009)
  - mod_dav_fs: use state dir for default DAVLockDB
  - mod_md: use state dir for default MDStoreDir


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-11
changelog:
  - Resolves: #1695432 - CVE-2019-0211 httpd: privilege escalation
    from modules scripts
  - Resolves: #1696091 - CVE-2019-0215 httpd:2.4/httpd: mod_ssl: access control 
    bypass when using per-location client certification authentication


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-13
changelog:
  - Resolves: #1696142 - CVE-2019-0217 httpd:2.4/httpd: mod_auth_digest: access
    control bypass due to race condition
  - Resolves: #1696097 - CVE-2019-0220 httpd:2.4/httpd: URL normalization
    inconsistency
  - Resolves: #1669221 - `ExtendedStatus Off` directive when using mod_systemd
    causes systemctl to hang
  - Resolves: #1673022 - httpd can not be started with mod_md enabled


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-16
changelog:
  - Resolves: #1744999 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount
    of data request leads to denial of service
  - Resolves: #1745086 - CVE-2019-9516 httpd:2.4/mod_http2: HTTP/2: 0-length
    headers leads to denial of service
  - Resolves: #1745154 - CVE-2019-9517 httpd:2.4/mod_http2: HTTP/2: request for
    large response leads to denial of service


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-18
changelog:
  - Resolves: #1744121 - Unexpected OCSP in proxy SSL connection
  - Resolves: #1725031 - htpasswd: support SHA-x passwords for FIPS compatibility
  - Resolves: #1633224 - mod_cgid logging issues


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-21
changelog:
  - Resolves: #1775158 - POST request with TLS 1.3 PHA client auth fails:
    Re-negotiation handshake failed: Client certificate missing


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-27
changelog:
  - Resolves: #1823259 - CVE-2020-1927 httpd:2.4/httpd: mod_rewrite configurations
    vulnerable to open redirect
  - Resolves: #1747284 - CVE-2019-10098 httpd:2.4/httpd: mod_rewrite potential
    open redirect
  - Resolves: #1747281 - CVE-2019-10092 httpd:2.4/httpd: limited cross-site 
    scripting in mod_proxy error page
  - Resolves: #1747291 - CVE-2019-10097 httpd:2.4/httpd: null-pointer dereference
    in mod_remoteip
  - Resolves: #1771847 - BalancerMember ping parameter for mod_proxy_http
    doesn't work
  - Resolves: #1794728 - Backport of SessionExpiryUpdateInterval directive


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-29
changelog:
  - Resolves: #1823263 (CVE-2020-1934) - CVE-2020-1934 httpd: mod_proxy_ftp use of
    uninitialized value


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-31
changelog:
  - Resolves: #1677590 - CVE-2018-17199 httpd:2.4/httpd: mod_session_cookie does
    not respect expiry time
  - Resolves: #1869075 - CVE-2020-11984 httpd:2.4/httpd: mod_proxy_uswgi buffer
    overflow
  - Resolves: #1872828 - httpd: typo in htpasswd, contained in httpd-tools package
  - Resolves: #1869576 - httpd : mod_proxy should allow to specify
    Proxy-Authorization in ProxyRemote directive
  - Resolves: #1875844 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
  - Resolves: #1891829 - mod_proxy_hcheck Doesn't perform checks when in
    a balancer


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-33
changelog:
  - Resolves: #1868608 - Intermittent Segfault in Apache httpd due to pool
    concurrency issues
  - Resolves: #1861380 - httpd/mod_proxy_http/mod_ssl aborted when sending
    a client cert to backend server
  - Resolves: #1680118 - unorderly connection close when client attempts
    renegotiation


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-36
changelog:
  - Resolves: #1896176 - [RFE] ProxyWebsocketIdleTimeout from httpd
    mod_proxy_wstunnel
  - Resolves: #1847585 - mod_ldap: High CPU usage at apr_ldap_rebind_remove()


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-37
changelog:
  - Resolves: #1883648 - [RFE] Update httpd directive SSLProxyMachineCertificateFile
    to be able to handle certs without matching private key


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-40
changelog:
  - Resolves: #1952557 - mod_proxy_wstunnel.html is a malformed XML
  - Resolves: #1937334 - SSLProtocol with based virtual hosts


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-41
changelog:
  - Resolves: #1680111 - httpd sends reply to HTTPS GET using two TLS records
  - Resolves: #1905613 - mod_ssl does not like valid certificate chain
  - Resolves: #1935742 - [RFE] backport samesite/httponly/secure flags for
    usertrack
  - Resolves: #1972500 - CVE-2021-30641 httpd:2.4/httpd: MergeSlashes regression
  - Resolves: #1968307 - CVE-2021-26690 httpd:2.4/httpd: mod_session NULL pointer
    dereference in parser
  - Resolves: #1934741 - Apache trademark update - new logo


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-42
changelog:
  - Resolves: #2007236 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via
    a crafted request uri-path
  - Resolves: #1969229 - CVE-2021-26691 httpd:2.4/httpd: Heap overflow in
    mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-43
changelog:
  - Related: #2007236 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via
    a crafted request uri-path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-44
changelog:
  - Resolves: #1968278 - CVE-2020-35452 httpd:2.4/httpd: Single zero byte stack
    overflow in mod_auth_digest
  - Resolves: #2001046 - Apache httpd OOME with mod_dav in RHEL 8
  - Resolves: #2005128 (CVE-2021-34798) - CVE-2021-34798 httpd: NULL pointer
    dereference via malformed requests
  - Resolves: #1984828 - mod_proxy_hcheck piles up health checks leading to high
    memory consumption
  - Resolves: #2005119 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-45
changelog:
  - Resolves: #2007199 - CVE-2021-36160 httpd:2.4/httpd: mod_proxy_uwsgi:
    out-of-bounds read via a crafted request uri-path
  - Resolves: #1972491 - CVE-2021-33193 httpd:2.4/mod_http2: Request splitting via
    HTTP/2 method injection and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-46
changelog:
  - Resolves: #2035063 - CVE-2021-44790 httpd:2.4/httpd: mod_lua: possible buffer
    overflow when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-47
changelog:
  - Resolves: #2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference
    or SSRF in forward proxy configurations


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-48
changelog:
  - Resolves: #2065249 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-50
changelog:
  - Resolves: #2065237 - CVE-2022-22719 httpd:2.4/httpd: mod_lua: Use of
    uninitialized value of in r:parsebody
  - Resolves: #2065267 - CVE-2022-22721 httpd:2.4/httpd: core: Possible buffer
    overflow with very large or unlimited LimitXMLRequestBody
  - Resolves: #2065324 - CVE-2022-23943 httpd:2.4/httpd: mod_sed: Read/write
    beyond bounds


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-51
changelog:
  - Resolves: #2097015 - CVE-2022-28614 httpd:2.4/httpd: out-of-bounds read via
    ap_rwrite()
  - Resolves: #2097031 - CVE-2022-28615 httpd:2.4/httpd: out-of-bounds read in
    ap_strcmp_match()
  - Resolves: #2097458 - CVE-2022-30522 httpd:2.4/httpd: mod_sed: DoS
    vulnerability
  - Resolves: #2097480 - CVE-2022-30556 httpd:2.4/httpd: mod_lua: Information
    disclosure with websockets
  - Resolves: #2098247 - CVE-2022-31813 httpd:2.4/httpd: mod_proxy:
    X-Forwarded-For dropped by hop-by-hop mechanism
  - Resolves: #2097451 - CVE-2022-29404 httpd:2.4/httpd: mod_lua: DoS in
    r:parsebody
  - Resolves: #2096997 - CVE-2022-26377 httpd:2.4/httpd: mod_proxy_ajp: Possible
    request smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-56
changelog:
  - Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
    of zero byte
  - Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
  - Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
    smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-56.4
changelog:
  - Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
    with mod_rewrite and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.1
changelog:
  - Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue
    in mod_rewrite (CVE-2024-38474)
  - Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding problem in
    mod_proxy (CVE-2024-38473)
  - Resolves: RHEL-45777 - httpd:2.4/httpd: Improper escaping of output
    in mod_rewrite (CVE-2024-38475)
  - Resolves: RHEL-45758 - httpd:2.4/httpd: null pointer dereference
    in mod_proxy (CVE-2024-38477)
  - Resolves: RHEL-45743 - httpd:2.4/httpd: Potential SSRF
    in mod_rewrite (CVE-2024-39573)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.2
changelog:
  - Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend
    applications whose response headers are malicious or exploitable (CVE-2024-38476)
  - Resolves: RHEL-53022 - Regression introduced by CVE-2024-38474 fix


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.3
changelog:
  - Resolves: RHEL-56068 - Apache HTTPD no longer parse PHP files with
    unicode characters in the name


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.5
changelog:
  - Resolves: RHEL-99944 - CVE-2025-49812 httpd: HTTP Session Hijack via a TLS upgrade
  - Resolves: RHEL-99969 - CVE-2024-47252 httpd: insufficient escaping of
    user-supplied data in mod_ssl
  - Resolves: RHEL-99961 - CVE-2025-23048 httpd: access control bypass by trusted
    clients is possible using TLS 1.3 session resumption


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.6
changelog:
  - Resolves: RHEL-127073 - mod_ssl: allow more fine grained SSL SNI vhost check
    to avoid unnecessary 421 errors after CVE-2025-23048 fix
  - mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default


author: Parag Nemade <pnemade AT redhat DOT com> - 0.20080825-12
changelog:
  - Add Supplements: tag for langpacks naming guidelines
  - Clean the specfile to follow current packaging guidelines


author: Michael Stahl <mstahl@redhat.com> - 0.20151222-1
changelog:
  - upgrade to latest version
  - upstream removed "OASIS distribution license agreement 0.1", only GPLv2/v3 now
  - remove needless use of percent-defattr


author: Michael Stahl <mstahl@redhat.com> - 0.20160407-1
changelog:
  - Resolves: rhbz#1344662 upgrade to latest release
  - switch source URL to https
  - revert the GNU grep 2.23 LANG=C bug workaround
  - added explicit build dependency on perl, now required on rawhide


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.28.20180415git.el8
changelog:
  - hpvd-Set-IgnoreOnIsolate-1-in-systemd-units.patch [bz#1769920]
  - Resolves: bz#1769920
    ([Hyper-V][RHEL8] Running 'systemctl isolate' on any target stops hyperv-daemon services)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.29.20180415git.el8
changelog:
  - hvd-Update-C-files-and-scripts-to-kernel-version-5.7-rc1.patch [bz#1816750]
  - hvd-Add-vmbus_testing-tool-build-files.patch [bz#1816750]
  - Resolves: bz#1816750
    ([Hyper-V][RHEL8.3] Update Hyper-V tools)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.30.20180415git.el8
changelog:
  - hvd-tools-hv-change-http-to-https-in-hv_kvp_daemon.c.patch [bz#1886104]
  - Resolves: bz#1886104
    ([Hyper-V][RHEL8.4] Update Hyper-V-Daemons)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.31.20180415git.el8
changelog:
  - hpvd-Enable-build-on-aarch64.patch [bz#2020141]
  - Resolves: bz#2020141
    ([Hyper-V][RHEL8.6][ARM64] No hyperv-daemons package built for aarch64 platform)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.32.20180415git.el8
changelog:
  - hpvd-hv_set_ifconfig.sh-Use-nmcli-commands.patch [bz#2065202]
  - hpvd-Use-filename-for-connection-profile.patch [bz#2065202]
  - Resolves: bz#2065202
    ([RHEL8.6][Hyper-V]The /usr/libexec/hypervkvpd/hv_set_ifconfig need update since the ifdown/ifup was not supported on RHEL8 [rhel-8.7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.33.20180415git
changelog:
  - hpvd-hypervkvpd.service-ordering-fixes.patch [bz#2115761]
  - hpvd-redhat-Add-ConditionalVirtualization-to-the-rest-of-.patch [bz#2115761]
  - Resolves: bz#2115761
    ([Hyper-V][RHEL-8] hypervkvpd.service service ordering)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.34.20180415git
changelog:
  - hpvd-redhat-hv_set_if_config-Workaround-for-gateway-numbe.patch [bz#2142028]
  - hpvd-tools-hv-Remove-an-extraneous-the.patch [bz#2139456]
  - hpvd-tools-hv-kvp-remove-unnecessary-void-conversions.patch [bz#2139456]
  - Resolves: bz#2142028
    ([Hyper-V][RHEL-8] Cannot set gateway properly when set static IPADDR0,NETMASK0,GATEWAY in ifcfg-eth0)
  - Resolves: bz#2139456
    ([Hyper-V][RHEL8.8] Update Hyper-V-Daemons)


author: Tomas Hozza <thozza@redhat.com> - 0-0.2.20130826git
changelog:
  - Use 'hypervkvpd' directory in libexec for KVP daemon scripts (#1010268)
  - daemons are now WantedBy multi-user.target instead of basic.target (#1010260)


author: Tomas Hozza <thozza@redhat.com> - 0-0.3.20131022git
changelog:
  - rebase to the latest git snapshot next-20130927 (obtained 2013-10-22)
    - KVP, VSS: daemon use single buffer for send/recv
    - KVP: FQDN is obtained on start and cached


author: Tomas Hozza <thozza@redhat.com> - 0-0.5.20140219git
changelog:
  - rebase to the latest git snapshot next-20140219
    - KVP, VSS: removed inclusion of linux/types.h
    - VSS: Ignore VFAT mounts during freeze operation


author: Tomas Hozza <thozza@redhat.com> - 0-0.7.20140611git
changelog:
  - Fix FTBFS (#1106781)
  - Use kernel-headers instead of kernel-devel for building
  - package new Hyper-V fcopy daemon as hypervfcopyd sub-package


author: Tomas Hozza <thozza@redhat.com> - 0-0.8.20140714git
changelog:
  - Update the File copy daemon to the latest git snapshot
  - Fix hyperfcopyd.service to check for /dev/vmbus/hv_fcopy


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.10.20150108git
changelog:
  - Rebase to 3.19-rc3 (20150108 git snapshot)
  - Drop 'nodaemon' patches, use newly introduced '-n' option


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.12.20150702git
changelog:
  - Rebase to 4.2-rc0 (20150702 git snapshot)
  - Switch to new chardev-based communication layer (#1195029)


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.15.20160728git
changelog:
  - Rebase to 4.8-rc0 (20160728 git snapshot)
  - Disable services and remove ConditionVirtualization, multi-user.target
    dependencies switching to udev-only activation (#1331577)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.34.20180415git.el8_7
changelog:
  - hpvd-redhat-hv_set_if_config-Workaround-for-gateway-numbe.patch [bz#2150255]
  - Resolves: bz#2150255
    ([Hyper-V][RHEL-8] Cannot set gateway properly when set static IPADDR0,NETMASK0,GATEWAY in ifcfg-eth0 [rhel-8.7.0.z])


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-13
changelog:
  - Resolves: #1897548 - Rebuild IBus emoji with unicode-emoji-13.0-4 and cldr-emoji-annotation-39-2
  - Rebuild ibusemojigen.h and ibusunicodegen.h
  - Add ibus-1897548-emoji-unicode.patch to lookup Unicode names
  - Add U+32FF to IBusUnicodeData
  - Add ibus-po-1.5.19-20210706.tar.gz


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090211-1
changelog:
  - Add --xim argument in xinput-ibus
  - Add Obsoletes:  ibus-qt <= 1.1.0
  - Move libibus.so.* to ibus-libs to make ibus multilib.
  - Update to 1.1.0.20090211.


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090211-6
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree.
  - The new patch fixes ibus-x11 segfault (#485661).


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090211-10
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree.
  - Put 'Select an input method' in engine select combobox (#485861).


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090225-1
changelog:
  - Update to ibus-1.1.0.20090225.
  - Fix problems in %post and %postun scripts.
  - Hide ibus & ibus preferences menu items.


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090311-1
changelog:
  - Update to ibus-1.1.0.20090311.
  - Update setup ui follow GNOME Human Interface Guidelines 2.2 (#489497).


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090311-2
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree.
  - Fix bug 490009 - Deleting Next Engine shortcuts doesn't work
  - Fix bug 490381 - Change "Next/Previous engine" labels


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090311-3
changelog:
  - Recreate the ibus-HEAD.patch from upstream git source tree
  - Fix bug 491999 - up/down arrow keys broken in xchat


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090331-1
changelog:
  - Update to ibus-1.1.0.20090331.
  - Fix bug 492956 - screws up keyboard input in firefox
  - Fix bug 490143 - ibus issue with gnome-keyring


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090407-1
changelog:
  - Update to ibus-1.1.0.20090407.
  - Fix bug 491042 - ibus default trigger hotkeys
  - Fix bug 492929 - ibus-hangul can cause gtk app to lockup
  - Fix bug 493701 -  (ibus) imsettings disconnect/reconnect kills gtk app
  - Fix bug 493687 -  ibus-hangul should default to vertical candidate selection
  - Fix bug 493449 -  ibus broke Alt-F2 command auto-completion


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090407-3
changelog:
  - Update the tarball.
  - Fix bug 494511 - ibus-gtk makes gnome-terminal abort 
    when a key is pressed


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090413-2
changelog:
  - Update ibus-HEAD.patch.
  - Change the mode of /tmp/ibus-$USER to 0700 to improve security
  - Change the mode of /tmp/ibus-$USER/socket-address to 0600 to improve security
  - Update as.po


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090413-3
changelog:
  - Update ibus-HEAD.patch.
  - Fix bug 495431 -  ibus Release modifier doesn't work with Alt
  - Fix bug 494445 -  ibus-hangul missing Hangul Han/En mode
    (and Alt_R+release hotkey)
  - Update te.po


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090417-1
changelog:
  - Update to ibus-1.1.0.20090417.
  - Fix bug 496199 -  cannot remove Ctrl+Space hotkey with ibus-setup


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090423-1
changelog:
  - Update to ibus-1.1.0.20090423.
  - Fix bug 497265 - [mai_IN] Maithili language name is not correct.
  - Fix bug 497279 - IBus does not works with evolution correctly.
  - Enhance authentication both in daemon & clients


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090423-2
changelog:
  - Fix bug 498141 - new ibus install needs gtk immodules
  - Separate ibus document from ibus-devel to ibus-devel-docs


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-1
changelog:
  - Update to 1.1.0.20090508
  - Fix bug 499533 - [Indic] ibus should allow input in KDE using all supported Indic locales
  - Fix bug 498352 - hotkey config table should list keys in same order as on main setup page
  - Fix bug 497707 - ibus French translation update


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-2
changelog:
  - Remove requires notification-daemon
  - Fix bug 500588 - Hardcoded requirement for notification-daemon


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-4
changelog:
  - Update ibus-HEAD.patch.
  - Fix bug 501211 - ibus-setup window should be raised if running or just stay on top/grab focus
  - Fix bug 501640 - ibus should adds new IMEs at end of engine list not beginning
  - Fix bug 501644 - [IBus] focus-out and disabled IME should hide language panel


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090508-5
changelog:
  - Update ibus-HEAD.patch.
  - Show the default input method with bold text
  - Add information text below input methods list


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090609-1
changelog:
  - Update to Update to 1.1.0.20090609
  - Fix bug 502414 - Implemented on-screen help facility
  - Fix bug 502561 - iBus should show keymap name on iBus panel
  - Fix bug 498043 - ibus Alt-grave trigger conflicts with openoffice.org
  - Implemented API for setting labels for candidates in LookupTable


author: Peng Huang <phuang@redhat.com> - 1.1.0.20090612-1
changelog:
  - Update to 1.1.0.20090612
  - Fix bug 504942 - PageUp and PageDown do not work in candidate list
  - Fix bug 491040 - Implememnt mouse selection in candidate list


author: Peng Huang <phuang@redhat.com> - 1.2.0.20090828-1
changelog:
  - Update to 1.2.0.20090828
  - Change the icon on systray.
  - Fix segment fault in ibus_hotkey_profile_destroy
  - Fix some memory leaks.


author: Peng Huang <phuang@redhat.com> - 1.2.0.20090915-1
changelog:
  - Update to 1.2.0.20090915
  - Fix bug 521591 - check if the icon filename is a real file before trying to open it
  - Fix bug 522310 - Memory leak on show/hide
  - Fix bug 509518 - ibus-anthy should only override to jp layout for kana input


author: Peng Huang <phuang@redhat.com> - 1.2.0.20091124-1
changelog:
  - Update to 1.2.0.20091124
  - Update some translations.
  - Fix bug 538147 - [abrt] crash detected in firefox-3.5.5-1.fc12


author: Peng Huang <phuang@redhat.com> - 1.2.0.20091204-1
changelog:
  - Update to 1.2.0.20091204
  - Fix Bug 529920 - language panel pops up on the wrong monitor
  - Fix Bug 541197 - Ibus crash


author: Peng Huang <phuang@redhat.com> - 1.2.0.20091225-1
changelog:
  - Update to 1.2.0.20091225
  - Fix bug 513895 - new IME does not show up in ibus-setup
  - Fix bug 531857 - applet order should correspond with preferences order
  - Fix bug 532856 - should not list already added input-methods in Add selector


author: Peng Huang <phuang@redhat.com> - 1.3.0-3
changelog:
  - Update ibus-HEAD.patch
  - Fix bug - some time panel does not show candidates.
  - Update some po files


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.8-1
changelog:
  - Updated to 1.3.8
  - Added ibus-541492-xkb.patch
    Fixes Bug 541492 - ibus needs to support some xkb layout switching
  - Added ibus-435880-surrounding-text.patch
    Fixes Bug 435880 - ibus-gtk requires surrounding-text support
  - Added ibus-xx-workaround-gtk3.patch
    Workaround for f14 http://koji.fedoraproject.org/koji/taskinfo?taskID=2516604


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20101202-1
changelog:
  - Updated to 1.3.99.20101202
  - Added ibus-530711-preload-sys.patch
    Fixed Bug 530711 - Reload preloaded engines by login


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110117-1
changelog:
  - Updated to 1.3.99.20110117
  - Fixed Bug 666427 - ibus requires dbus-x11
  - Fixed Bug 670137 - QT_IM_MODULE=xim in ibus.conf without ibus-qt


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110228-1
changelog:
  - Updated to 1.3.99.20110228
  - Integrated the part of gjs in Bug 657165 ibus for gnome-shell.
    Added ibus-657165-panel-libs.patch
    Added gnome-shell-ibus-plugins-20110304.tar.bz2
  - Fixed Bug 675503 - a regression in sync mode
    Added ibus-675503-gnome-shell-workaround.patch until gnome-shell is updated.
  - Fixed Bug 677856 - left ibus snooper when im client is switched.
  - Fixed Bug 673047 - abrt ibus_xkb_get_current_layout for non-XKB system
    Updated ibus-541492-xkb.patch


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110408-1
changelog:
  - Updated to 1.3.99.20110408
    Fixed Bug 683484 - Timed out SetEngine when select an engine from panel.
    Fixed Bug 657165 - IBus for gnome-shell for Fedora 15.
  - Upstreamed ibus-657165-panel-libs.patch
  - Removed ibus-675503-gnome-shell-workaround.patch
  - Added ibus-xx-setup-frequent-lang.patch
  - Updated ibus-541492-xkb.patch
    Fixed Bug 696481 - no the variant maps without language codes
  - Added dependency of imsettings-gnome.
    Fixed Bug 696510 - need a dependency in ibus-gtk3 for imsettings-gnome


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110419-1
changelog:
  - Updated to 1.3.99.20110419
  - Added ibus-HEAD.patch
    Fixed Bug 697471 - ibus-gconf zombie when restart ibus from ibus panel.
  - Updated ibus-541492-xkb.patch
    Fixed Bug 701202 - us(dvorak) does not show up in list
    Updated ibus-1.0.pc for ibus-xkb
    Showed XKB variant descriptions only without layout descriptions.
  - Updated ibus-xx-setup-frequent-lang.patch
    Updated UI strings


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110817-3
changelog:
  - Fixed Bug 700472 Use a symbol icon instead of an image icon.
  - Updated ibus-HEAD.patch for upstream.
  - Removed ibus-435880-surrounding-text.patch as upstream.
  - Added ibus-711632-fedora-fallback-icon.patch
    Fixed SEGV with no icon in oxygen-gtk icon theme.
  - Added ibus-xx-bridge-hotkey.patch
    Triaged Bug 707370 SetEngine timeout
    Fixed Bug 731610 Keep IM state when text input focus changes
  - Added transitional ibus-gnome3 package.
    Fixed Bug 718110 Use a shell icon instead of pygtk2 icon.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.99.20110817-4
changelog:
  - Updated ibus-gjs 3.1.91.20110908 and 3.0.2.20110908 for gnome-shell.
    Fixed preedit active segments on gnome-shell and X11 apps.
  - Added ibus-xx-g-s-disable-preedit.patch
    Disabled preedit on gnome-shell for a workaround.
  - Updated ibus.spec
    Fixed Bug 735879 pre/postun scripts


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-2
changelog:
  - Updated to 1.4.0
  - Updated ibus-gjs 3.0.2.20110928 for f15.
  - Updated ibus-gjs 3.2.0.20110928 for f16. (#740588)
  - Updated ibus-530711-preload-sys.patch
    Fixed not to show duplicated engine names in setup treeview (#740447)
  - Updated bus-gjs-xx-gnome-shell-3.1.4-build-failure.patch for f16.
  - Updated ibus-xx-bridge-hotkey.patch
    Fixed a XKB configuration without the input focus for f16 (#739165)
    Fixed not to show null strings in case of no variants (#738130)


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-9
changelog:
  - Updated ibus-HEAD.patch
    Fixed prev/next keys without global engine.
  - Updated ibus-xx-bridge-hotkey.patch for f16
    Fixed Bug 747902 - mouse and ctrl+space not working
    Fixed Bug 749770 - IME hotkey after Control + Space
  - Updated ibus-711632-fedora-fallback-icon.patch
    Fixed Bug 717831 - use old icon for desktops other than gnome


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-10
changelog:
  - Updated ibus-xx-bridge-hotkey.patch for f16
    Fixed no XKB languages from layout only. e.g. in(eng).
  - Updated ibus-541492-xkb.patch
    Fixed not to show 'eng' on GUI for in(eng).


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-11
changelog:
  - Updated ibus-541492-xkb.patch
    Fixed Bug 750484 - support reloading Xmodmap
  - Updated ibus-HEAD.patch
    Fixed Bug 753781 - ibus-x11 needs async for hangul ibus_commit_text.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-14
changelog:
  - Enabled dconf.
  - Updated ibus-HEAD.patch
    Fixed Bug 618229 - engine setup buton on ibus-setup.
  - Removed ibus-711632-fedora-fallback-icon.patch as upstreamed.
  - Updated ibus-xx-bridge-hotkey.patch
    Removed Enable/Disable buttons on ibus-setup


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-16
changelog:
  - Enhanced ibus-gnome3 shell lookup window.
  - Updated ibus-HEAD.patch from upstream
    Fixed Bug 769135 - ibus-x11 SEGV in _process_key_event_done.
  - Updated ibus-541492-xkb.patch
    Fixed Bug 757889 - ibus-setup SEGV without active engine.
    Fixed Bug 760213 - ibus-setup saves XKB variants correctly.
    Fixed Bug 769133 - ibus-engine-xkb returns FALSE for ASCII typings.
  - Updated ibus-xx-bridge-hotkey.patch for an enhancement.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.0-17
changelog:
  - Added ibus-771115-property-compatible.patch for f16
    Fixed Bug 771115 - IBusProperty back compatibility.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120203-1
changelog:
  - Updated to 1.4.99.20120203
  - Removed ibus-xx-bridge-hotkey.patch
  - Updated ibus-541492-xkb.patch to use libgnomekbd.
  - Updated ibus-xx-setup-frequent-lang.patch for 1.4.99.20120203


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120203-3
changelog:
  - Fixed ibus-setup on C locale
  - Fixed to show no registered engines from g-c-c.
  - Enabled Alt_R keybinding on ko locales for ibus gtk only.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120303-3
changelog:
  - Bumped to ibus-gjs 3.3.90.20120308 to work with gnome-shell 3.3.90
  - Fixed Bug 786906 - Added ifnarch ppc ppc64 s390 s390x
  - Updated ibus-HEAD.patch
    Fixed Bug 800897 - After doing "ctrl+space", ibus tray icon freezes


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120317-1
changelog:
  - Bumped to 1.4.99.20120317
    Fixed Bug 718668 - focus move is slow with ibus-gnome3
    Fixed Bug 749497 - Enhance IME descriptions in status icon active menu
  - Bumped to ibus-gjs 3.3.90.20120317
  - Added ibus-xx-no-use.diff
    Fixed Bug 803260 - Disable non-global input method mode
  - Updated ibus-HEAD.patch
    Fixed Bug 803250 - ibus lookup window font customization
    Fixed Bug 803177 - language id on ibus-ui-gtk3 switcher
  - Update ibus-530711-preload-sys.patch
    Fixed Bug 797023 - port preload engines


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120428-1
changelog:
  - Bumped to 1.4.99.20120428
    Fixed Bug 799571 - no IME list at the session login.
    Fixed Bug 810415 - ibus does not handle Ctrl+space with BUTTON_PRESS.
  - Bumped to ibus-gjs 3.4.1.20120428
    Fixed Bug 802052 - no modifiers trigger keys.
    Fixed Bug 803244 - IME switch Ctrl+space not working on shell text entry.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120428-2
changelog:
  - Updated ibus-HEAD.patch
  - Updated ibus-541492-xkb.patch
  - Updated ibus-xx-branding-switcher-ui.patch
    Fixed Bug 810211 - Cancel Control + space pressing Control key.
  - Updated ibus-xx-no-use.diff
    Enabled to customize trigger keys with non-modifier trigger keys.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120822-1
changelog:
  - Bumped to 1.4.99.20120822
  - Bumped to ibus-gjs 3.4.1.20120815
    Fixed Bug 845956 - ibus backward trigger key is not customized
    Fixed Bug 844580 - ibus-dconf does not load the system gvdb
  - Separated ibus-810211-no-switch-by-no-trigger.patch from ibus-HEAD.patch


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20120822-2
changelog:
  - Updated ibus-530711-preload-sys.patch
  - Updated ibus-541492-xkb.patch
  - Updated ibus-xx-no-use.diff
    Fixed Bug 854161 - not able to add keymap with ibus-setup


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.4.99.20121109-1
changelog:
  - Bumped to 1.4.99.20121109
  - Removed im-chooser, imsettings-gnome, gnome-icon-theme-symbolic
    dependencies in f18 because ibus gnome integration is done.
    Use ibus-keyboard instead of input-keyboard-symbolic.
  - Disabled ibus-gjs build because of ibus gnome integration.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.2-1
changelog:
  - Bumped to 1.5.2
  - Created noarch packages for python files due to .pyc and .pyo.
  - Added man pages.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.2-4
changelog:
  - Updated ibus-HEAD.patch for upstream.
  - Added ibus-xx-1.5.2.patch until 1.5.3 will be released.
  - Added ibus-xx-ctrl-space.patch for back compatible triggers.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-1
changelog:
  - Bumped to 1.5.3
  - Deleted ibus-xx-g-s-disable-preedit.patch as EOL.
  - Deleted ibus-gjs as EOL.
  - Removed imsettings-gnome, im-chooser, libgnomekbd dependencies.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.4-1
changelog:
  - Bumped to 1.5.4
  - Added ibus.conf.5
  - Added ibus-xkb-1.5.0.tar.gz for po files.
  - Added ibus-xx-f19-password.patch for back compatibility.
  - Added ibus-wayland in f20 or later.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.7-5
changelog:
  - Updated ibus-HEAD.patch from upstream.
    Added pl(qwertz).
    Fixed escape key with Ctrl-Shift-U.
    Updated pt-br compose table from the latest xorg.
    Do not sort ibus engines when they are saved by ibus-setup.
    Updated jp IBusKeymap.
    Added ibus reset-config and read-config sub-commands.
    Update ibus(1) for read-config and reset-config.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.7-6
changelog:
  - Updated ibus-HEAD.patch from upstream.
    Fixed ibus-setup SEGV when an engine is selected.
    Fixed ibus-setup deprecated warnings with the latest python3-gobject.
    Integrated the 'IBUS_SETUP_XID' environment variable for each engine setup.
    Set prgname 'ibus-setup' for ibus-setup.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.8-1
changelog:
  - Bumped to 1.5.8
  - Deleted ibus-810211-no-switch-by-no-trigger.patch
  - Deleted ibus-541492-xkb.patch
  - Deleted ibus-530711-preload-sys.patch
  - Deleted ibus-xx-setup-frequent-lang.patch
  - Deleted ibus-xx-f19-password.patch


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.9-6
changelog:
  - Updated ibus-xx-increase-timeout.patch to fix #1163722
  - Updated ibus-HEAD.patch for upstream #1747, #1748, #1753
    and gnome #703020, gnome #730628


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.10-2
changelog:
  - Updated ibus-HEAD.patch from upstream
    Added Swedish svdvorak
    I18N engine longnames and descriptions on ibus-setup
    Moved PropertyPanel at bottom right in KDE5
    Drew gray color on Handle PropertyPanel
    Enabled ibus engine full path icon in KDE5
    Updated translations


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.10-3
changelog:
  - Updated ibus-HEAD.patch from upstream
    Fixed to show shortcuts on ibus-setup.
    Bug 1214271 Fixed to enable IME with GTK3 applications in wayland.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.13-3
changelog:
  - Bug 1349732 - ibus not working at all in Gnome Wayland
  - Add ibus service file
  - Fix CSS color format and font size


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.14-3
changelog:
  - Fixed Bug 1380675 - Emoji leaves the candidates of @laugh when @laughing
  - Fixed Bug 1380690 - User is not able to select emojis from digit keys
  - Fixed Bug 1380691 - PageUp PageDown buttons on emoji lookup not working


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.14-5
changelog:
  - support scroll event in candidates panel
  - Fixed Bug 1403985 - Emoji typing is enabled during Unicode typing
  - Fixed Bug 1402494 - Font settings of ibus are ignored on non-Gnome


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-2
changelog:
  - Added ibus-HEAD.patch to get upstream patches
    Fixed ibus_emojier_run() SIGABRT with `ibus emoji`
    Enhanced theme color on emoji candidates


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-3
changelog:
  - Emoji dialog enhancements and bug fixes
    Fixed ibus_emoji_dict_load() API.
    Focus on emoji text entry by default
    Removed internal text buffer and use Gtk.Entry buffer instead.
    Implemented cursor left, right, home, end on emoji annotation preedit.
    Show localized emoji description from tts in emoji xml.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-4
changelog:
  - Implemented Ctrl-[f|b|n|p|h|e|a|u] for cursor operations on emoji dialog
  - Added XSetIOErrorHandler() for GNOME3 desktop


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-5
changelog:
  - Moved language setting on IBusEmojier to ibus-setup.
  - Enabled strcasecmp to match emoji annotations.
  - Added a build error message if emoji xml files are not found.


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-6
changelog:
  - Enabled unicode_alt in EmojiOne json file
  - Enabled to type multiple code points on Emojier
  - Fixed IBusEmojiDialog_1_0_gir_LIBS for --as-needed LDFLAGS


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.15-8
changelog:
  - Dropped nodejs-emojione-json and import unicode-emoji instead
  - Created emoji tab in ibus-setup
  - Set default emoji font size from gsettings in ibus emoji command
  - Added an option of emoji partial match in ibus-setup
  - Hid emoji variants by default
  - Added ibus-emoji man page
  - emoji favorites category is updated by selecting emoji


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.16-2
changelog:
  - Added ctrl-c,v,x for annotations and ctrl-shift-c for emoji
  - Added Malay and Mongolian keymaps
  - Made all emoji dicts to fully qualified


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.16-9
changelog:
  - Fix scaling factor, mouse events on switcher, c-s-u on im-ibus, 
    propertypanel position and menu 
  - Add ibus-portal
  - Move ibus-emoji-dialog.vapi in the build
  - Fixed some SEGVs #1406699 #1432252


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.17-9
changelog:
  - Added panel extension for emoji keybinding not to depen on desktops
  - Showed Unicode code points on Unicode name list


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-5
changelog:
  - Disabled python2 since RHEL8
  - Run make check in %check except for GUI testings
  - Fixed Bug 1574855 - [abrt] ibus: ibus_engine_filter_key_event()


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-7
changelog:
  - Moved input focus on Emojier to engines' preedit
  - Removed ibus-xx-emoji-harfbuzz.patch not to change session emoji font


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-9
changelog:
  - Do not use combined characters on preedit for compose keys
  - Fixed an infinite loop of extension preedit with xterm


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.18-14
changelog:
  - Fixed Man page scan results for ibus
  - Added IBUS_DISCARD_PASSWORD env variable for password dialog in firefox
  - Added history annotation for previous emojis


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-3
changelog:
  - Fix Bug SEGV Choose an emoji by mouse from the emoji category list
  - Fix Bug 1618682 - SEGV with ASCII on emojier in Wayland
  - Support Shift-Space on emojier preedit
  - Do not move Emojier popup with the active candidate in Xorg
  - Do not clear Unicode data when emoji annotation lang is changed


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-5
changelog:
  - Resolves: #1713606 - Fix hangul preedit commit with mouse click
  - Resolves: #1682157 - Integrate ibus-desktop-testing and test cases


author: Mike FABIAN <mfabian@redhat.com> - 1.9.18-1
changelog:
  - update to 1.9.18
  - validate ibus-table.appdata.xml in %check
  - Update translations from zanata (pt_BR updated, es new)
  - Don't query user database if user define phrase and
    dynamic adjust are disabled (thanks to heiher)
  - Enable hash map based cache for user database enabled
    (thanks to heiher)
  - Import hash map based cache for table database (thanks to
    heiher)
  - Install appstream metadata to /usr/share/metainfo/ (thanks
    to jbicha)
  - Fix some appdata validation issues (thanks to jbicha)
  - Fix bug in Unihan_Variants.txt, 著 U+8457 is both
    simplified *and* traditional Chinese (thanks to heiher)


author: Jiri Vanek <jvanek@redhat.com> 1.7.1-16
changelog:
  - added patch1, patch4 and patch11 to fix CVE-2019-10182
  - added patch2 to fix CVE-2019-10181
  - added patch3 and patch33 to fix CVE-2019-10185
  - Resolves: rhbz#1724958 
  - Resolves: rhbz#1725928 
  - Resolves: rhbz#1724989


author: - Jiri Vanek <jvanek@redhat.com> -1.8.4-2
changelog:
  - added native launchers, via separate subpackage, but efectively changed main package to arched one
  - removed policyeditor man page, it was link to itself
  - Resolves: rhbz#1900043


author: - Jiri Vanek <jvanek@redhat.com> -1.8.4-4
changelog:
  - added patch2, fed2f5b-22402bb.patch containing important fixes from future 1.8.5
  - Resolves: rhbz#1900043


author: Richard W.M. Jones <rjones@redhat.com> - 0.31.3-1
changelog:
  - New upstream version 0.31.3.
  - This includes all the previous upstream patches, and reverts the
    check which broke processing of PE binaries.


author: Martin Gieseking <martin.gieseking@uos.de> - 0.32.3-1
changelog:
  - Updated to version 0.32.3.
  - Dropped patch to fix https://savannah.nongnu.org/bugs/?52319 (applied upstream)


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.0-0.3
changelog:
  - Iryna Shcherbina <ishcherb@redhat.com>: Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
  - Rebase to PKI 10.6.0 beta2


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.1-1
changelog:
  - Rebase to PKI 10.6.1
  - Bug 1559047 - pki-core misses a dependency to pki-symkey
  - Bug 1573094 - FreeIPA external CA installation fails


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.2-3
changelog:
  - Fix macro expressions
  - Bug 1566606 - pki-core: Switch to Python 3
  - Bug 1590467 - pki-core: Drop pylint dependency from RHEL 8


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.4-3
changelog:
  - Patch PKI to use Jackson 2 and avoid Jackson 1 dependency.
    Add direct dependency on slf4j-jdk14.


author: Alexander Bokovoy <abokovoy@redhat.com> 10.6.6-2
changelog:
  - Use platform-python interpreter
  - Bug 1620066 - pkispawn crashes as /usr/bin/python3 does not exist


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.8-1
changelog:
  - Rebase to PKI 10.6.8
  - Bug 1602659 - Fix issues found by covscan
  - Bug 1566360 - Fix missing serial number from pki-server subsystem-cert-find


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.9-1
changelog:
  - Rebase to PKI 10.6.9
  - Bug 1629048 - X500Name.directoryStringEncodingOrder overridden by CSR encoding
  - Bug 1652269 - Replace Nuxwdog
  - Bug 1656856 - Need Method to Include SKI in CA Signing Certificate Request


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.7.2-1
changelog:
  - Rebase to PKI 10.7.2
  - Bug 1721340 - TPS installation failure
  - Bug 1248216 - Incorrect pkidaemon status
  - Bug 1729215 - cert-fix: detect and prevent pkidbuser being used as --agent-uid
  - Bug 1698059 - pki-core implements crypto


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.7.3-1
changelog:
  - Rebase to PKI 10.7.3
  - Bug 1698084 - pkidestroy not working as expected
  - Bug 1468050 and Bug #1448235 - Support AES for LWCA key replication


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.3-1
changelog:
  - Rebase to PKI 10.8.3
  - Bug 1809210 - TPS installation failure on HSM machine
  - Bug 1807421 - Subordinate CA installation failed
  - Bug 1806840 - KRA cloning with HSM failed


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.1-2
changelog:
  - Bug 1857933 - CA Installation is failing with ncipher v12.30 HSM
  - Bug 1868233 - Disabling AIA and cert policy extensions in ACME examples


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.3-1
changelog:
  - Rebase to PKI 10.9.3
  - Bug 1869893 - Common certificates are missing in CS.cfg on shared PKI instance


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.4-1
changelog:
  - Rebase to PKI 10.9.4
  - Bug 1873235 - Fix SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT in pki ca-user-cert-add


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.0-0.2.beta1
changelog:
  - Rebase to PKI 10.10.0-beta1
  - Bug 1868233 - Disabling AIA and cert policy extensions in ACME examples


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.0-1
changelog:
  - Rebase to PKI 10.10.0
  - Add workaround for missing capture_output in Python 3.6
  - Fix JSS initialization in pki-server <subsystem>-user-cert-add
  - Fix NPE in UGSubsystem.findUsersByKeyword()
  - Bug 1787115 - Need Method to copy SKI from CSR to Certificate signed
  - Bug 1875563 - Add KRA Transport and Storage Certificates profiles, audit for IPA
  - Bug 1883996 - Inconsistent folders in pki-tools


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.1-1
changelog:
  - Rebase to PKI 10.10.1
  - Bug 1843416 - kra-audit-mod fail with Invalid event configuration
  - Bug 1889691 - ACME failed when run with more than 1 thread/connection
  - Bug 1891577 - Sub-ordinate installation is failing with NullPointerException


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.2-1
changelog:
  - Rebase to PKI 10.10.2
  - Bug 1392616 - KRA key recovery cli kra-key-retrieve generates an invalid p12 file
  - Bug 1897120 - pki-server cert-fix command failing
  - Bug 1694664 - ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (503)


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.3-1
changelog:
  - Rebase to PKI 10.10.3
  - Bug 1584550 - CRMFPopClient: unexpected behavior with -y option when values are specified
  - Bug 1590942 - CMCResponse treats -d as optional
  - Bug 1890639 - Two-step installation with external certificates fails on HSM configured system
  - Bug 1912493 - pkispawn reports incorrect FIPS mode


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.4-1
changelog:
  - Rebase to PKI 10.10.4
  - Bug 1664435 - Error instantiating class for challenge_password with SCEP request
  - Bug 1912418 - OCSP and TKS cloning failed due to duplicate replica ID
  - Bug 1916686 - Memory leak during ACME performance test
  - Bug 1919282 - ACME cert enrollment failed with HTTP 500


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.12.0-0.1
changelog:
  - Rebase to PKI 10.12.0
  - Bug 1904112 - pki fails to start if empty dir /var/lib/pki/pki-tomcat/kra exists
  - Bug 1984455 - [RFE] Date Format on the TPS Agent Page
  - Bug 1980378 - 'keyctl_search: Required key not available' message when running 'ipa-healthcheck'
  - Bug 2004084 - Reinstall of the same ipa-replica fails with 'RuntimeError: CA configuration failed.'
  - Bug 2006070 - Upgrades incorrectly add secret attribute to connectors


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.12.0-4
changelog:
  - Bug 2107334 - CVE-2022-2414 access to external entities when parsing XML can lead to XXE
  - Rename packages to idm-pki


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.14.3-1
changelog:
  - Rebase to PKI 10.14.3
  - Bug 1959057 - An error has ocorred (IPA Error 4301:CertificateOperationError)
  - Bug 2016164 - IdM Install fails on RHEL 8.5 Beta when DISA STIG is applied
  - Bug 2022561 - ipa-healthcheck CADogtagCertsConfigCheck fail to process the scenario of renewed IPA CA certificates ( ipa get_cert_from_db() )


author: Tomas Popela <tpopela@redhat.com> - 1.0.2-1
changelog:
  - Bring Inkscape 1.0.1 into RHEL 8.8 and obsolete the previous 0.92.3 modular
    package. See https://issues.redhat.com/browse/RHELPLAN-121672
  - Resolves: rhbz#1891732


author: Colin Walters <walters@redhat.com> - 0.51.0-4
changelog:
  - Add patch to hopefully close race condition in systemd builds
  - Related to https://bugzilla.redhat.com/show_bug.cgi?id=1249051
  - And the test suite is failing but the logs are hidden under
    test-suite.log, so copy some code I had in dbus.spec to cat them.


author: Tomas Orsava <torsava@redhat.com> - 1.2.0-9
changelog:
  - Switch hardcoded python3 shebangs into the %{__python3} macro
  - Add missing BuildRequires on python3-devel so that %{__python3} macro is
    defined


author: Eric Sandeen <sandeen@redhat.com> - 1.0.1-2
changelog:
  - Upstream respun the release tarball to re-include top-level dir
  - drop exclude of bno_plot.py[co], not getting built now?


author: Rob Crittenden <rcritten@redhat.com> - 0.1.0-2
changelog:
  - Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
  - Remove references to admin server in ipa-server-setupssl
  - Generate a client certificate for the XML-RPC server to connect to LDAP with
  - Create a keytab for Apache
  - Create an ldif with a test user
  - Provide a certmap.conf for doing SSL client authentication


author: Karl MacMillan <kmacmill@redhat.com> - 0.4.0-2
changelog:
  * Fri Sep 7 2007 Karl MacMillan <kmacmill@redhat.com> - 0.3.0-1
  - Added support for libipa-dna-plugin


author: Rob Crittenden <rcritten@redhat.com> - 0.4.1-2
changelog:
  - Broke invididual Requires and BuildRequires onto separate lines and
    reordered them
  - Added python-tgexpandingformwidget as a dependency
  - Require at least fedora-ds-base 1.1


author: Rob Crittenden <rcritten@redhat.com> 0.99-3
changelog:
  - Included LICENSE and README in all packages for documentation
  - Move user-modifiable content to /etc/ipa and linked back to
    /usr/share/ipa/html
  - Changed some references to /usr to the {_usr} macro and /etc
    to {_sysconfdir}
  - Added popt-devel to BuildRequires for Fedora 8 and higher and
    popt for Fedora 7
  - Package the egg-info for Fedora 9 and higher for ipa-python


author: Rob Crittenden <rcritten@redhat.com> 0.99-7
changelog:
  - Ensure that /etc/ipa exists before moving user-modifiable html files there
  - Put html files into /etc/ipa/html instead of /etc/ipa


author: Rob Crittenden <rcritten@redhat.com> 0.99-9
changelog:
  - Pull upstream changelog 641
  - Require minimum version of krb5-server on F-7 and F-8
  - Package some new files


author: Rob Crittenden <rcritten@redhat.com> 0.99-10
changelog:
  - Pull upstream changelog 678
  - Add new subpackage, ipa-server-selinux
  - Add Requires: authconfig to ipa-python (bz #433747)
  - Package i18n files


author: Rob Crittenden <rcritten@redhat.com> 0.99-11
changelog:
  - Pull upstream changelog 698
  - Fix ownership of /var/log/ipa_error.log during install (435119)
  - Add pwpolicy command and man page


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-2
changelog:
  - Fix Requires for krb5-server that was missing for Fedora versions > 9
  - Remove quotes around test for fedora version to package egg-info


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-4
changelog:
  - Add missing entry for /var/cache/ipa/kpasswd (444624)
  - Added patch to fix permissions problems with the Apache NSS database.
  - Added patch to fix problem with DNS querying where the query could be
    returned as the answer.
  - Fix spec error where patch1 was in the wrong section


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-5
changelog:
  - Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
    version to 1.0.7-4 so we pick up the NSS fixes.
  - Add selinux-policy-base(post) to Requires (446496)


author: Rob Crittenden <rcritten@redhat.com> - 1.1.0-1
changelog:
  - Update to upstream version 1.1.0
  - Patch for indexing memberof attribute
  - Patch for indexing uidnumber and gidnumber
  - Patch to change DNA default values for replicas
  - Patch to fix uninitialized variable in ipa-getkeytab


author: Simo Sorce <ssorce@redhat.com> - 1.1.0-3
changelog:
  - Fix for CVE-2008-3274
  - Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
  - Add fix for bug #453185
  - Rebuild against openldap libraries, mozldap ones do not work properly
  - TurboGears is currently broken in rawhide. Added patch to not build
    the UI locales and removed them from the ipa-server files section.


author: Rob Crittenden <rcritten@redhat.com> - 1.2.0-1
changelog:
  - Update to upstream version 1.2.0
  - Set fedora-ds-base minimum version to 1.1.3 for winsync header
  - Set the minimum version for SELinux policy
  - Remove references to Fedora 7


author: Simo Sorce <ssorce@redhat.com> - 1.2.0-3
changelog:
  - Respin after the tarball has been re-released upstream
    New hash is 506c9c92dcaf9f227cba5030e999f177


author: Jason Gerard DeRose <jderose@redhat.com> - 1.99-8
changelog:
  - Removed python-cherrypy from BuildRequires and Requires
  - Added Requires python-assets, python-wehjit


author: Rob Crittenden <rcritten@redhat.com> - 1.99-23
changelog:
  - Change Requires from fedora-ds-base to 389-ds-base
  - Set minimum level of 389-ds-base to 1.2.6 for the replication
    version plugin.


author: Rob Crittenden <rcritten@redhat.com> - 1.99-27
changelog:
  - Set minimum version of certmonger to 0.26 (to pck up #621670)
  - Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
  - Set minimum version of pki-ca to 1.3.6
  - Set minimum version of sssd to 1.2.1


author: Rob Crittenden <rcritten@redhat.com> - 1.99-28
changelog:
  - Drop conflicts on mod_nss
  - Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
  - Drop a slew of conditionals on older Fedora releases (< 12)
  - Add a few conditionals against RHEL 6
  - Add Requires of nss-tools on ipa-client


author: Rob Crittenden <rcritten@redhat.com> - 1.99-29
changelog:
  - Drop requires on python-configobj (not used any more)
  - Drop ipa-ldap-updater message, upgrades are done differently now


author: Simo Sorce <ssorce@redhat.com> - 1.99-39
changelog:
  - Remove dependency on nss_ldap/nss-pam-ldapd
  - The official client is sssd and that's what we use by default.


author: Rob Crittenden <rcritten@redhat.com> - 1.99-41
changelog:
  - Re-arrange doc and defattr to clean up rpmlint warnings
  - Remove conditionals on older releases
  - Move some man pages into admintools subpackage
  - Remove some explicit Requires in client that aren't needed
  - Consistent use of buildroot vs RPM_BUILD_ROOT


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.2.beta.git80e87e7
changelog:
  - Remove unnecessary moving of v1 CA serial number file in post script
  - Add Obsoletes for server-selinxu subpackage
  - Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.beta2
changelog:
  - Set min version of 389-ds-base to 1.2.8
  - Set min version of mod_nss 1.0.8-10
  - Set min version of selinux-policy to 3.9.7-27
  - Add dogtag themes to Requires
  - Update to upstream freeipa-2.0.0.pre2


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.rc1
changelog:
  - Set minimum version of sssd to 1.5.1
  - Update to upstream freeipa-2.0.0.rc1
  - Move server-only binaries from admintools subpackage to server


author: Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.4.rc2
changelog:
  - Update to upstream freeipa-2.0.0.rc2
  - Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
  - Set minimum version of sssd to 1.5.1
  - Patch to include SuiteSpotGroup when setting up 389-ds instances
  - Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled


author: Rob Crittenden <rcritten@redhat.com> - 2.0.1-1
changelog:
  - Update minimum selinux-policy to 3.9.16-18
  - Update minimum pki-ca and pki-selinux to 9.0.7
  - Update minimum 389-ds-base to 1.2.8.0-1
  - Update to upstream 2.0.1


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-6
changelog:
  - Introduce upgrade script to recover existing configuration after systemd migration
    as user has no means to recover FreeIPA from systemd migration
  - Upgrade script:
    - recovers symlinks in Dogtag instance install
    - recovers systemd configuration for FreeIPA's directory server instances
    - recovers freeipa.service
    - migrates directory server and KDC configs to use proper keytabs for systemd services


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-2
changelog:
  - Allow longer dirsrv startup with systemd:
    - IPAdmin class will wait until dirsrv instance is available up to 10 seconds
    - Helps with restarts during upgrade for ipa-ldap-updater
  - Fix pylint warnings from F16 and Rawhide


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-3
changelog:
  - Allow Web-based migration to work with tightened SE Linux policy (#769440)
  - Rebuild slapi plugins against re-enterant version of libldap


author: Martin Kosek <mkosek@redhat.com> - 2.1.4-4
changelog:
  - Fix ipa-replica-install crashes
  - Fix ipa-server-install and ipa-dns-install logging
  - Set minimum version of pki-ca to 9.0.17 to fix sslget problem
    caused by FEDORA-2011-17400 update (#771357)


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-5
changelog:
  - Force to use 389-ds 1.2.10-0.8.a7 or above
  - Improve upgrade script to handle systemd 389-ds change
  - Fix freeipa to work with python-ldap 2.4.6


author: Rob Crittenden <rcritten@redhat.com> - 2.1.90-0.2
changelog:
  - Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
  - Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
  - Add Conflicts on mod_ssl
  - Update minimum n-v-r of 389-ds-base to 1.2.10.4
  - Update minimum n-v-r of sssd to 1.8.0
  - Update minimum n-v-r of slapi-nis to 0.38
  - Update minimum n-v-r of pki-* to 9.0.18
  - Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
  - Update conflicts on bind to < 9.9.0-1
  - Drop requires on krb5-server-ldap
  - Add patch to remove escaping arguments to pkisilent


author: Rob Crittenden <rcritten@redhat.com> - 2.2.0-1
changelog:
  - Updated to upstream 2.2.0 GA
  - Update minimum n-v-r of certmonger to 0.53
  - Update minimum n-v-r of slapi-nis to 0.40
  - Add Requires in client to oddjob-mkhomedir and python-krbV
  - Update minimum selinux-policy to 3.10.0-110


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.8
changelog:
  - Updated to upstream 3.0.0 rc 1
  - Update BR for 389-ds-base to 1.2.11.14
  - Update BR for krb5 to 1.10
  - Update BR for samba4-devel to 4.0.0-139 (rc1)
  - Add BR for python-polib
  - Update BR and Requires on sssd to 1.9.0
  - Update Requires on policycoreutils to 2.1.12-5
  - Update Requires on 389-ds-base to 1.2.11.14
  - Update Requires on selinux-policy to 3.11.1-21
  - Update Requires on dogtag to 10.0.0-0.33.a1
  - Update Requires on certmonger to 0.60
  - Update Requires on tomcat to 7.0.29
  - Update minimum version of bind to 9.9.1-10.P3
  - Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
  - Remove Requires on authconfig from python sub-package


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.10
changelog:
  - Updated to upstream 3.0.0 rc 2
  - Include new FF configuration extension
  - Set minimum Requires of selinux-policy to 3.11.1-33
  - Set minimum Requires dogtag to 10.0.0-0.43.b1
  - Add new optional strict sub-package to allow users to limit other
    package upgrades.


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-1
changelog:
  - Updated to upstream 3.0.0 GA
  - Set minimum for samba to 4.0.0-153.
  - Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
    plugin to /dev/null since they cannot be used when trusts are configured
  - Restrict krb5-server to 1.10.
  - Update BR for 389-ds-base to 1.3.0
  - Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
  - Add Requires on zip for generating FF browser extension


author: Rob Crittenden <rcritten@redhat.com> - 3.1.0-1
changelog:
  - Updated to upstream 3.1.0 GA
  - Set minimum for sssd to 1.9.2
  - Set minimum for pki-ca to 10.0.0-1
  - Set minimum for 389-ds-base to 1.3.0
  - Set minimum for selinux-policy to 3.11.1-60
  - Remove unneeded dogtag package requires


author: Martin Kosek <mkosek@redhat.com> - 3.1.0-2
changelog:
  - Remove redundat Requires versions that are already in Fedora 17
  - Replace python-crypto Requires with m2crypto
  - Add missing Requires(post) for client and server-trust-ad subpackages
  - Restart httpd service when server-trust-ad subpackage is installed
  - Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes


author: Rob Crittenden <rcritten@redhat.com> - 3.1.2-1
changelog:
  - Update to upstream 3.1.2
  - CVE-2012-4546: Incorrect CRLs publishing
  - CVE-2012-5484: MITM Attack during Join process
  - CVE-2013-0199: Cross-Realm Trust key leak
  - Updated strict dependencies to 389-ds-base = 1.3.0.2 and
    pki-ca = 10.0.1


author: Martin Kosek <mkosek@redhat.com> - 3.2.0-0.1.pre1
changelog:
  - Update to upstream 3.2.0 Prerelease 1
  - Use upstream reference spec file as a base for Fedora spec file


author: Rob Crittenden <rcritten@redhat.com> - 3.2.0-0.3.beta1
changelog:
  - Add a Requires for java-atk-wrapper until we can determine which package
    should be pulling it in, dogtag or tomcat.


author: Rob Crittenden <rcritten@redhat.com> - 3.2.0-1
changelog:
  - Update to upstream 3.2.0 GA
  - ipa-client-install fails if /etc/ipa does not exist (#961483)
  - Certificate status is not visible in Service and Host page (#956718)
  - ipa-client-install removes needed options from ldap.conf (#953991)
  - Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
  - Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
  - Require nss 3.14.3-12.0 to address certutil certificate import
    errors (#953485)
  - Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
    environments. (#953464)
  - ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
  - ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
  - Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
    socket based connections (#960222)
  - Require libsss_nss_idmap-python
  - Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
    member is now done automatically and having it in the config file raises
    an error.
  - Add backup and restore tools, directory.
  - require at least systemd 38 which provides the journal (we no longer
    need to require syslog.target)
  - Update Requires on policycoreutils to 2.1.14-37
  - Update Requires on selinux-policy to 3.12.1-42
  - Update Requires on 389-ds-base to 1.3.1.0
  - Remove a Requires for java-atk-wrapper


author: Martin Kosek <mkosek@redhat.com> - 3.2.2-1
changelog:
  - Update to upstream 3.2.2
  - Drop ipa-server-selinux subpackage
  - Drop redundant directory /var/cache/ipa/sessions
  - Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
  - Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
    issues when there are still old parts of software (like entitlements plugin)


author: Martin Kosek <mkosek@redhat.com> - 3.3.0-2
changelog:
  - Remove ipa-server-selinux obsoletes as upgrades from version prior to
    3.3.0 are not allowed
  - Wrap server-trust-ad subpackage description better
  - Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
  - Change permissions on default_encoding_utf8.so to fix ipa-python Provides


author: Martin Kosek <mkosek@redhat.com> - 3.3.0-4
changelog:
  - ipa-server-install fails if --subject parameter is other than default
    realm (#983075)
  - do not allow configuring bind-dyndb-ldap without persistent search (#967876)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-2
changelog:
  - Unable to remove replica by ipa-replica-manage (#1001662)
  - Before uninstalling a server, warn about active replicas (#998069)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-3
changelog:
  - Replica installation fails for RHEL 6.4 master (#1004680)
  - Server uninstallation crashes if DS is not available (#998069)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-5
changelog:
  - Remove dependency on python-paramiko (#1002884)
  - Broken redirection when deleting last entry of DNS resource
    record (#1006360)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-1
changelog:
  - Update to upstream 3.3.2 (#991064)
  - Add delegation info to MS-PAC (#915799)
  - Warn about incompatibility with AD when IPA realm and domain
    differs (#1009044)
  - Allow PKCS#12 files with empty password in install tools (#1002639)
  - Privilege "SELinux User Map Administrators" did not list
    permissions (#997085)
  - SSH key upload broken when client joins an older server (#1009024)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-2
changelog:
  - Deprecate --serial-autoincrement option (#1016645)
  - CA installation always failed on replica (#1005446)
  - Re-initializing a winsync connection exited with error (#994980)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-4
changelog:
  - Server install failure during client enrollment shouldn't
    roll back (#1023086)
  - nsds5ReplicaStripAttrs are not set on agreements (#1023085)
  - ipa-server conflicts with mod_ssl (#1018172)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-5
changelog:
  - Temporarily move ipa-backup and ipa-restore functionality
    back to make them available in public Beta (#1003933)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-3
changelog:
  - Installer did not detect different server and IPA domain (#1026845)
  - Allow kernel keyring CCACHE when supported (#1026861)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-5
changelog:
  - Trust add tries to add same value of --base-id for sub domain,
    causing an error (#1033068)
  - Improved error reporting for adding trust case (#1029856)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-6
changelog:
  - Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
  - Re-adding existing trust fails (#1033216)
  - IPA uninstall exits with a samba error (#1033075)
  - Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
  - Fixed ownership of /usr/share/ipa/ui/js (#1026260)
  - ipa-tests: support external names for hosts (#1032668)
  - ipa-client-install fail due fail to obtain host TGT (#1029354)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-8
changelog:
  - Fix status trust-add command status message (#910453)
  - NetBIOS was not trimmed at 15 characters (#1030517)
  - Harden CA subsystem certificate renewal on CA clones (#1040018)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-12
changelog:
  - Missing objectclasses when empty password passed to host-add (#1052979)
  - sudoOrder missing in sudoers (#1052983)
  - Missing examples in sudorule help (#1049464)
  - Client automount does not uninstall when fstore is empty (#910899)
  - Error not clear for invalid realm given to trust-fetch-domains (#1052981)
  - trust-fetch-domains does not add idrange for subdomains found (#1049926)
  - Add option to show if an AD subdomain is enabled/disabled (#1052973)
  - ipa-adtrust-install still failed with long NetBIOS names (#1030517)
  - Error not clear for invalid relam given to trustdomain-find (#1049455)
  - renewed client cert not recognized during IPA CA renewal (#1033273)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-13
changelog:
  - Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
  - Increase default timeout for IPA services (#1033273)
  - Error while running trustdomain-find (#1054376)
  - group-show lists SID instead of name for external groups (#1054391)
  - Fix IPA server NetBIOS name in samba configuration (#1030517)
  - dnsrecord-mod produces missing API version warning (#1054869)
  - Hide trust-resolve command as internal (#1052860)
  - Add Trust domain Web UI (#1054870)
  - ipasam cannot delete multiple child trusted domains (#1056120)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-16
changelog:
  - Fallback to global policy in ipa lockout plugin (#912725)
  - Migration does not add users to default group (#903232)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-18
changelog:
  - Display server name in ipa command's verbose mode (#1061703)
  - Remove sourcehostcategory from default HBAC rule (#1061187)
  - dnszone-add cannot add classless PTR zones (#1058688)
  - Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-20
changelog:
  - trustdomain-find with pkey-only fails (#1068611)
  - Invalid credential cache in trust-add (#1069182)
  - ipa-replica-install prints unexpected error (#1069722)
  - Too big font in input fields in details facet in Firefox (#1069720)
  - trust-add for POSIX AD does not fetch trustdomains (#1070925)
  - Misleading trust-add error message in some cases (#1070926)
  - Access is not rejected for disabled domain (#1070924)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-22
changelog:
  - ipa-replica-install never checks for 7389 port (#1075165)
  - Non-terminated string may be passed to LDAP search (#1075091)
  - ipa-sam may fail to translate group SID into GID (#1073829)
  - Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-26
changelog:
  - When IdM server trusts multiple AD forests, IPA client returns invalid group
    membership info (#1079498)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-28
changelog:
  - ipa-client-automount fails with incompatibility error when installed against
    older IPA server (#1083108)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-29
changelog:
  - Server installation fails using external signed certificates with
    "IndexError: list index out of range" (#1111320)
  - Add rhino to BuildRequires to fix Web UI build error


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-4
changelog:
  - Update Requires on pki-ca to 10.1.2-4 (#1129558)
  - build: increase java stack size for all arches
  - Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
  - Fix dns zonemgr validation regression (#1056202)
  - Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
  - Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
    (#886645)
  - Add bind-dyndb-ldap working dir to IPA specfile
  - Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
    (#886645)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - Deadlock in schema compat plugin (#1161131)
  - ipactl stop should stop dirsrv last (#1161129)
  - Upgrade 3.3.5 to 4.1 failed (#1161128)
  - CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-5
changelog:
  - Update slapi-nis dependency to pull 0.54-2 (#891984)
  - ipa-restore: Don't crash if AD trust is not installed (#951581)
  - Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
  - Trust setting not restored for CA cert with ipa-restore command (#1159011)
  - ipa-server-install fails when restarting named (#1162340)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-6
changelog:
  - Fix: DNS installer adds invalid zonemgr email (#1056202)
  - ipaplatform: Use the dirsrv service, not target (#951581)
  - Fix: DNS policy upgrade raises asertion error (#1161128)
  - Fix upgrade referint plugin (#1161128)
  - Upgrade: fix trusts objectclass violationi (#1161128)
  - group-add doesn't accept gid parameter (#1149124)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-7
changelog:
  - ipa-csreplica-manage connect fails (#1157735)
  - error message which is not understandable when IDNA2003 characters are
    present in --zonemgr (#1163849)
  - Fix warning message should not contain CLI commands (#1114013)
  - Renewing the CA signing certificate does not extend its validity period end
    (#1163498)
  - RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
    httpd (#1159330)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-8
changelog:
  - Improve otptoken help messages (#919228)
  - Ensure users exist when assigning tokens to them (#919228)
  - Enable QR code display by default in otptoken-add (#919228)
  - Show warning instead of error if CA did not start (#1158410)
  - CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
  - Traceback when adding zone with long name (#1164859)
  - Backup & Restore mechanism (#951581)
  - ignoring user attributes in migrate-ds does not work if uppercase characters
    are returned by ldap (#1159816)
  - Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
  - Failure when installing on dual stacked system with external ca (#1128380)
  - ipa-server should keep backup of CS.cfg (#1059135)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - webui: use domain name instead of domain SID in idrange adder dialog
    (#891984)
  - webui: normalize idview tab labels (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-9
changelog:
  - schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
    build fails (#1167196)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - "ipa trust-add ... " cmd says : (Trust status: Established and verified)
    while in the logs we see "WERR_ACCESS_DENIED" during verification step.
    (#1144121)
  - POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
    (#1156466)
  - Add support/hooks for a one-time password system like SecureID in IPA
    (#919228)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - ID Views: Support migration from the sync solution to the trust solution
    (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-11
changelog:
  - Throw zonemgr error message before installation proceeds (#1163849)
  - Winsync: Setup is broken due to incorrect import of certificate (#1169867)
  - Enable last token deletion when password auth type is configured (#919228)
  - ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
  - add --hosts and --hostgroup options to allow/retrieve keytab methods
    (#1007367)
  - Extend host-show to add the view attribute in set of default attributes
    (#1168916)
  - Prefer TCP connections to UDP in krb5 clients (#919228)
  - [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
  - webui: increase notification duration (#1171089)
  - RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
  - RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
    (#1170003)
  - Improve validation of --instance and --backend options in ipa-restore
    (#951581)
  - RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
  - Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-12
changelog:
  - RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
    (#1169591)
  - CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
    (#1172578)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-13
changelog:
  - Expand the token auth/sync windows (#919228)
  - Access is not rejected for disabled domain (#1172598)
  - krb5kdc crash in ldap_pvt_search (#1170695)
  - RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-14
changelog:
  - IPA Replicate creation fails with error "Update failed! Status: [10 Total
    update abortedLDAP error: Referral]" (#1166265)
  - running ipa-server-install --setup-dns results in a crash (#1072502)
  - DNS zones are not migrated into forward zones if 4.0+ replica is added
    (#1175384)
  - gid is overridden by uid in default trust view (#1168904)
  - When migrating warn user if compat is enabled (#1177133)
  - Clean up debug log for trust-add (#1168376)
  - No error message thrown on restore(full kind) on replica from full backup
    taken on master (#1175287)
  - ipa-restore proceed even IPA not configured (#1175326)
  - Data replication not working as expected after data restore from full backup
    (#1175277)
  - IPA externally signed CA cert expiration warning missing from log (#1178128)
  - ipa-upgradeconfig fails in CA-less installs (#1181767)
  - IPA certs fail to autorenew simultaneouly (#1173207)
  - More validation required on ipa-restore's options (#1176034)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-16
changelog:
  - PassSync does not sync passwords due to missing ACIs (#1181093)
  - ipa-replica-manage list does not list synced domain (#1181010)
  - Do not assume certmonger is running in httpinstance (#1181767)
  - ipa-replica-manage disconnect fails without password (#1183279)
  - Put LDIF files to their original location in ipa-restore (#1175277)
  - DUA profile not available anonymously (#1184149)
  - IPA replica missing data after master upgraded (#1176995)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-17
changelog:
  - Wrong directories created on full restore (#1186398)
  - ipa-restore crashes if replica is unreachable (#1186396)
  - idoverrideuser-add option --sshpubkey does not work (#1185410)


author: Martin Kosek <mkosek@redhat.com> - 4.1.0-18
changelog:
  - Fix ipa-pwd-extop global configuration caching (#1187342)
  - group-detach does not add correct objectclasses (#1187540)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-18.1
changelog:
  - "an internal error has occurred" during ipa host-del --updatedns (#1198431)
  - Renamed patch 1013 to 0114, as it was merged upstream
  - Fax number not displayed for user-show when kinit'ed as normal user.
    (#1198430)
  - Replication agreement with replica not disabled when ipa-restore done without
    IPA installed (#1199060)
  - Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.1.0-18.2
changelog:
  - IPA extdom plugin fails when encountering large groups (#1193759)
  - CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
    (#1202998)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-18.3
changelog:
  - [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
    (SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-0.1.alpha1
changelog:
  - Resolves: #805188  [RFE] "ipa migrate-ds" ldapsearches with scope=1
  - Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
    throws Internal server error
  - Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
  - Resolves: #1045153 ipa-managed-entries --list -p <badpassword> still requires
    DM password
  - Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
    from ldap_port_t
  - Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
  - Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
    matching uidgid
  - Resolves: #1176036 IDM client registration failure in a high load environment
  - Resolves: #1183116 Remove Requires: subscription-manager
  - Resolves: #1186054 permission-add does not prompt to enter --right option in
    interactive mode
  - Resolves: #1187524 Replication agreement with replica not disabled when
    ipa-restore done without IPA installed
  - Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
    normal user.
  - Resolves: #1189034 "an internal error has occurred" during ipa host-del
    --updatedns
  - Resolves: #1193554 ipa-client-automount: failing with error LDAP server
    returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
  - Resolves: #1193759 IPA extdom plugin fails when encountering large groups
  - Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
    certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
  - Resolves: #1194633 Default trust view can be deleted in lower case
  - Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
    server instance - confusing CA staus message on TLS error
  - Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
  - Resolves: #1199527 [RFE] Use datepicker component for datetime fields
  - Resolves: #1200867 [RFE] Make OTP validation window configurable
  - Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
  - Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
    get_user_grouplist() [rhel-7.2]
  - Resolves: #1204637 slow group operations
  - Resolves: #1204642 migrate-ds: slow add o users to default group
  - Resolves: #1208461 IPA CA master server update stuck on checking getStatus
    via https
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1211708 ipa-client-install gets stuck during NTP sync
  - Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
    sync
  - Resolves: #1215200 ipa-client-install configures IPA server as NTP source
    even if IPA server has not ntpd configured
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
  - Related:  #1204809 Rebase ipa to 4.2
    - Update to upstream 4.2.0.alpha1


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-0.2.alpha1
changelog:
  - Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
  - Related:  #1204809 Rebase ipa to 4.2
    - Fix minimum version of slapi-nis
    - Require python-sss and python-sss-murmur (provided by sssd-1.13.0)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-1
changelog:
  - Resolves: #846033  [RFE] Documentation for JSONRPC IPA API
  - Resolves: #989091  Ability to manage IdM/IPA directly from a standard LDAP
    client
  - Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
    users in IdM
  - Resolves: #1115294 [RFE] Add support for DNSSEC
  - Resolves: #1145748 [RFE] IPA running with One Way Trust
  - Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
  - Resolves: #1200728 [RFE] Replicate PKI Profile information
  - Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
  - Resolves: #1204054 SSSD database is not cleared between installs and
    uninstalls of ipa
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
  - Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
  - Resolves: #1204504 [RFE] Add access control so hosts can create their own
    services
  - Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
  - Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
  - Resolves: #1209476 package ipa-client does not require package dbus-python
  - Resolves: #1211589 [RFE] Add option to skip the verify_client_version
  - Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
  - Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
  - Resolves: #1217010 OTP Manager field is not exposed in the UI
  - Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
    00007fffd68b2340 error 6 in libc-2.17.so
  - Related:  #1204809 Rebase ipa to 4.2
    - Update to upstream 4.2.0
    - Move /etc/ipa/kdcproxy to the server subpackage


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-2
changelog:
  - Resolves: #1131907 [ipa-client-install] cannot write certificate file
    '/etc/ipa/ca.crt.new': must be string or buffer, not None
  - Resolves: #1195775 unsaved changes dialog internally inconsistent
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - Stageusedr-activate: show username instead of DN
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - Prevent to rename certprofile profile id
  - Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
  - Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
    - copy-schema-to-ca: allow to overwrite schema files
  - Resolves: #1241941 kdc component installation of IPA failed
    - spec file: Update minimum required version of krb5
  - Resolves: #1242036 Replica install fails to update DNS records
    - Fix DNS records installation for replicas
  - Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
    - Start dirsrv for kdcproxy upgrade


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-3
changelog:
  - Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
    that conflicts with AD DC
    - trusts: Check for AD root domain among our trusted domains
  - Resolves: #1195339 ipa-client-install changes the label on various files
    which causes SELinux denials
    - sysrestore: copy files instead of moving them to avoind SELinux issues
  - Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
    commands / ntpd -qgc $tmpfile hangs
    - enable debugging of ntpd during client installation
  - Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
    - migration: Use api.env variables.
  - Resolves: #1212719 abort-clean-ruv subcommand should allow
    replica-certifyall: no
    - Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
  - Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
    occurred
    - dcerpc: Expand explanation for WERR_ACCESS_DENIED
    - dcerpc: Fix UnboundLocalError for ccache_name
  - Resolves: #1222778 idoverride group-del can delete user and user-del can
    delete group
    - dcerpc: Add get_trusted_domain_object_type method
    - idviews: Restrict anchor to name and name to anchor conversions
    - idviews: Enforce objectclass check in idoverride*-del
  - Resolves: #1234919 Be able to request certificates without certmonger service
    running
    - cermonger: Use private unix socket when DBus SystemBus is not available.
    - ipa-client-install: Do not (re)start certmonger and DBus daemons.
  - Resolves: #1240939 Please add dependency on bind-pkcs11
    - Create server-dns sub-package.
    - ipaplatform: Add constants submodule
    - DNS: check if DNS package is installed
  - Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
    calling out oddjobd-activated services
    - selinux: enable httpd_run_ipa to allow communicating with oddjobd services
  - Resolves: #1243261 non-admin users cannot search hbac rules
    - fix hbac rule search for non-admin users
    - fix selinuxusermap search for non-admin users
  - Resolves: #1243652 Client has missing dependency on memcache
    - do not import memcache on client
  - Resolves: #1243835 [webui] user change password dialog does not work
    - webui: fix user reset password dialog
  - Resolves: #1244802 spec: selinux denial during kdcproxy user creation
    - Fix selinux denial during kdcproxy user creation
  - Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
    - oddjob: avoid chown keytab to sssd if sssd user does not exist
  - Resolves: #1246136 Adding a privilege to a permission avoids validation
    - Validate adding privilege to a permission
  - Resolves: #1246141 DNS Administrators cannot search in zones
    - DNS: Consolidate DNS RR types in API and schema
  - Resolves: #1246143 User plugin - user-find doesn't work properly with manager
    option
    - fix broken search for users by their manager


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-4
changelog:
  - Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
    users in IdM
    - store certificates issued for user entries as
    - user-show: add --out option to save certificates to file
  - Resolves: #1145748 [RFE] IPA running with One Way Trust
    - Fix upgrade of sidgen and extdom plugins
  - Resolves: #1195339 ipa-client-install changes the label on various files
    which causes SELinux denials
    - Use 'mv -Z' in specfile to restore SELinux context
  - Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
    for combinations of "User authentication types"
    - webui: add LDAP vs Kerberos behavior description to user auth
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - ULC: Fix stageused-add --from-delete command
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - certprofile-import: do not require profileId in profile data
    - Give more info on virtual command access denial
    - Allow SAN extension for cert-request self-service
    - Add profile for DNP3 / IEC 62351-8 certificates
    - Work around python-nss bug on unrecognised OIDs
  - Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
    - Validate vault's file parameters
    - Fixed missing KRA agent cert on replica.
  - Resolves: #1225866 display browser config options that apply to the browser.
    - webui: add Kerberos configuration instructions for Chrome
    - Remove ico files from Makefile
  - Resolves: #1246342 Unapply idview raises internal error
    - idviews: Check for the Default Trust View only if applying the view
  - Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
    - webui: fix regressions failed auth messages
  - Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
    - dcerpc: Fix UnboundLocalError for ccache_name
  - Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
    allow access to \\pipe\lsarpc
    - Fix selector of protocol for LSA RPC binding string
    - dcerpc: Simplify generation of LSA-RPC binding strings
  - Resolves: #1250192 Error in ipa trust-fecth-domains
    - Fix incorrect type comparison in trust-fetch-domains
  - Resolves: #1251553 Winsync setup fails with unexpected error
    - replication: Fix incorrect exception invocation
  - Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
    - ACI plugin: correctly parse bind rules enclosed in
  - Resolves: #1252414 Trust agent install does not detect available replicas to
    add to master
    - adtrust-install: Correctly determine 4.2 FreeIPA servers


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-5
changelog:
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - user-undel: Fix error messages.
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - Prohibit deletion of predefined profiles
  - Resolves: #1232819 testing ipa-restore on fresh system install fails
    - Backup/resore authentication control configuration
  - Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
    server
    - Require Dogtag PKI >= 10.2.6
  - Resolves: #1245225 Asymmetric vault drops traceback when the key is not
    proper
    - Asymmetric vault: validate public key in client
  - Resolves: #1248399 Missing DNSSEC related files in backup
    - fix typo in BasePathNamespace member pointing to ods exporter config
    - ipa-backup: archive DNSSEC zone file and kasp.db
  - Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
    finished
    - winsync-migrate: Add warning about passsync
    - winsync-migrate: Expand the man page
  - Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
    - adjust search so that it works for non-admin users
  - Resolves: #1250093 ipa certprofile-import accepts invalid config
    - Require Dogtag PKI >= 10.2.6
  - Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
    agents
    - trusts: Detect missing Samba instance
  - Resolves: #1250111 User lifecycle - preserved users can be assigned
    membership
    - ULC: Prevent preserved users from being assigned membership
  - Resolves: #1250145 Add permission for user to bypass caacl enforcement
    - Add permission for bypassing CA ACL enforcement
  - Resolves: #1250190 idrange is not added for sub domain
    - idranges: raise an error when local IPA ID range is being modified
    - trusts: harden trust-fetch-domains oddjobd-based script
  - Resolves: #1250928 Man page for ipa-server-install is out of sync
    - install: Fix server and replica install options
  - Resolves: #1251225 IPA default CAACL does not allow cert-request for services
    after upgrade
    - Fix default CA ACL added during upgrade
  - Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
    - validate mutually exclusive options in vault-add
  - Resolves: #1251579 ipa vault-add --user should set container owner equal to
    user on first run
    - Fixed vault container ownership.
  - Resolves: #1252517 cert-request rejects request with correct
    krb5PrincipalName SAN
    - Fix KRB5PrincipalName / UPN SAN comparison
  - Resolves: #1252555 ipa vault-find doesn't work for services
    - vault: Add container information to vault command results
    - Add flag to list all service and user vaults
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - Added CLI param and ACL for vault service operations.
  - Resolves: #1252557 certprofile: improve profile format documentation
    - certprofile-import: improve profile format documentation
    - certprofile: add profile format explanation
  - Resolves: #1253443 ipa vault-add creates vault with invalid type
    - vault: validate vault type
  - Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
    owner
    - baseldap: Allow overriding member param label in LDAPModMember
    - vault: Fix param labels in output of vault owner commands
  - Resolves: #1253511 ipa vault-find does not use criteria
    - vault: Fix vault-find with criteria
  - Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
    - install: Fix replica install with custom certificates
  - Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
    - improve the handling of krb5-related errors in dnssec daemons
  - Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
    starting CA and named-pkcs11.service
    - Server Upgrade: Start DS before CA is started.
  - Resolves: #1254637 Add ACI and permission for managing user userCertificate
    attribute
    - add permission: System: Manage User Certificates
  - Resolves: #1254641 Remove CSR allowed-extensions restriction
    - cert-request: remove allowed extensions check
  - Resolves: #1254693 vault --service does not normalize service principal
    - vault: normalize service principal in service vault operations
  - Resolves: #1254785 ipa-client-install does not properly handle dual stacked
    hosts
    - client: Add support for multiple IP addresses during installation.
    - Add dependency to SSSD 1.13.1
    - client: Add description of --ip-address and --all-ip-addresses to man page


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-6
changelog:
  - Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
    - DNSSEC: fix forward zone forwarders checks
  - Resolves: #1250190 idrange is not added for sub domain
    - trusts: format Kerberos principal properly when fetching trust topology
  - Resolves: #1252334 User life cycle: missing ability to provision a stage user
    from a preserved user
    - Add user-stage command
  - Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
    start.
    - spec file: Add Requires(post) on selinux-policy
  - Resolves: #1254304 Changing vault encryption attributes
    - Change internal rsa_(public|private)_key variable names
    - Added support for changing vault encryption.
  - Resolves: #1256715 Executing user-del --preserve twice removes the user
    pernamently
    - improve the usability of `ipa user-del --preserve` command


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-7
changelog:
  - Resolves: #1256840 [webui] majority of required fields is no longer marked as
    required
    - fix missing information in object metadata
  - Resolves: #1256842 [webui] no option to choose trust type when creating a
    trust
    - webui: add option to establish bidirectional trust
  - Resolves: #1256853 Clear text passwords in KRA install log
    - Removed clear text passwords from KRA install log.
  - Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
    discouraged
    - vault: change default vault type to symmetric
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: prevent rename (modrdn)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-8
changelog:
  - Resolves: #1254689 Storing big file as a secret in vault raises traceback
    - vault: Limit size of data stored in vault
  - Resolves: #1255880 ipactl status should distinguish between different
    pki-tomcat services
    - ipactl: Do not start/stop/restart single service multiple times


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-9
changelog:
  - Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
    tracked
    - cert renewal: Include KRA users in Dogtag LDAP update
    - cert renewal: Automatically update KRA agent PEM file
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: remove 'rename' option
  - Resolves: #1257968 kinit stop working after ipa-restore
    - Backup: back up the hosts file
  - Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
    - DNSSEC: remove "DNSSEC is experimental" warnings
  - Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
    - Installer: do not modify /etc/hosts before user agreement
  - Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
    zone
    - DNSSEC: backup and restore opendnssec zone list file
    - DNSSEC: remove ccache and keytab of ipa-ods-exporter
    - DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
    - DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
    - DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
      key master
    - DNSSEC: Fix key metadata export
    - DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
  - Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
    - Using LDAPI to setup CA and KRA agents.
  - Resolves: #1259848 server closes connection and refuses commands after
    deleting user that is still logged in
    - ldap: Make ldap2 connection management thread-safe again
  - Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
    'ra_certprofile' while ipa-ca-install
    - load RA backend plugins during standalone CA install on CA-less IPA master


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-10
changelog:
  - Resolves: #1260663 crash of ipa-dnskeysync-replica component during
    ipa-restore
    - IPA Restore: allows to specify files that should be removed
  - Resolves: #1261806 Installing ipa-server package breaks httpd
    - Handle timeout error in ipa-httpd-kdcproxy
  - Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
    - Server Upgrade: backup CS.cfg when dogtag is turned off


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-11
changelog:
  - Resolves: #1258965 ipa vault: set owner of vault container
    - baseldap: make subtree deletion optional in LDAPDelete
    - vault: add vault container commands
    - vault: set owner to current user on container creation
    - vault: update access control
    - vault: add permissions and administrator privilege
    - install: support KRA update
  - Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
    - config: allow user/host attributes with tagging options
  - Resolves: #1262315 Unable to establish winsync replication
    - winsync: Add inetUser objectclass to the passsync sysaccount


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-12
changelog:
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
    - winsync-migrate: Convert entity names to posix friendly strings
    - winsync-migrate: Properly handle collisions in the names of external groups
  - Resolves: #1261074 Adjust Firefox configuration to new extension signing
    policy
    - webui: use manual Firefox configuration for Firefox >= 40
  - Resolves: #1263337 IPA Restore failed with installed KRA
    - ipa-backup: Add mechanism to store empty directory structure
  - Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
    and private key in world readable file [rhel-7.2]
    - install: fix KRA agent PEM file permissions
  - Resolves: #1265086 Mark IdM API Browser as experimental
    - WebUI: add API browser is experimental warning
  - Resolves: #1265277 Fix kdcproxy user creation
    - install: create kdcproxy user during server install
    - platform: add option to create home directory when adding user
    - install: fix kdcproxy user home directory
  - Resolves: #1265559 GSS failure after ipa-restore
    - destroy httpd ccache after stopping the service


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-13
changelog:
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
    - Fix an integer underflow bug in libotp
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - install: always export KRA agent PEM file
    - vault: select a server with KRA for vault operations
  - Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
    - do not overwrite files with local users/groups when restoring authconfig
  - Renamed patch 1011 to 0138, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-14
changelog:
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - upgrade: make sure ldap2 is connected in export_kra_agent_pem
  - Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
    external CA
    - schema: do not derive ipaVaultPublicKey from ipaPublicKey


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15
changelog:
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - vault: fix private service vault creation


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-16
changelog:
  - Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
    Credential"
    - cert renewal: make renewal of ipaCert atomic
  - Resolves: #1278330 installer options are not validated at the beginning of
    installation
    - install: fix command line option validation
  - Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
    from starting up
    - client install: do not corrupt OpenSSH config with Match sections
  - Resolves: #1282935 ipa upgrade causes vault internal error
    - install: export KRA agent PEM file in ipa-kra-install
  - Resolves: #1283429 Default CA ACL rule is not created during
    ipa-replica-install
    - TLS and Dogtag HTTPS request logging improvements
    - Avoid race condition caused by profile delete and recreate
    - Do not erroneously reinit NSS in Dogtag interface
    - Add profiles and default CA ACL on migration
    - disconnect ldap2 backend after adding default CA ACL profiles
    - do not disconnect when using existing connection to check default CA ACLs
  - Resolves: #1283430 ipa-kra-install: fails to apply updates
    - suppress errors arising from adding existing LDAP entries during KRA
      install
  - Resolves: #1283748 Caching of ipaconfig does not work in framework
    - fix caching in get_ipa_config
  - Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
    upgrade from RHEL 7.0 to RHEL 7.2
    - upgrade: fix migration of old dns forward zones
    - Fix upgrade of forwardzones when zone is in realmdomains
  - Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
    connection
    - ipa-cacert-renew: Fix connection to ldap.
  - Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
    - ipa-otptoken-import: Fix connection to ldap.
  - Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
    "yum update ipa* sssd"
    - Set minimal required version for openssl
  - Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
    - Upgrade: Fix upgrade of NIS Server configuration
  - Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
    permissions on /var/lib/ipa/dnssec
    - DNS: fix file permissions
    - Explicitly call chmod on newly created directories
    - Fix: replace mkdir with chmod
  - Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
    - Fix version comparison
    - use FFI call to rpmvercmp function for version comparison
  - Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
    groups are missing
    - ipa-kdb: map_groups() consider all results
  - Resolves: #1293870 User should be notified for wrong password in password
    reset page
    - Fixed login error message box in LoginScreen page
  - Resolves: #1296196 Sysrestore did not restore state if a key is specified in
    mixed case
    - Allow to used mixed case for sysrestore
  - Resolves: #1296214 DNSSEC key purging is not handled properly
    - DNSSEC: Improve error reporting from ipa-ods-exporter
    - DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
      LDAP
    - DNSSEC: Make sure that current key state in LDAP matches key state in BIND
    - DNSSEC: remove obsolete TODO note
    - DNSSEC: add debug mode to ldapkeydb.py
    - DNSSEC: logging improvements in ipa-ods-exporter
    - DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
    - DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
    - DNSSEC: ipa-ods-exporter: add ldap-cleanup command
    - DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
    - DNSSEC: Log debug messages at log level DEBUG
  - Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
    - prevent crash of CA-less server upgrade due to absent certmonger
    - always start certmonger during IPA server configuration upgrade
  - Resolves: #1297811 The ipa -e skip_version_check=1 still issues
    incompatibility error when called against RHEL 6 server
    - ipalib: assume version 2.0 when skip_version_check is enabled
  - Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
    - Do not decode HTTP reason phrase from Dogtag
  - Resolves: #1300252 shared certificateProfiles container is missing on a
    freshly installed RHEL7.2 system
    - upgrade: unconditional import of certificate profiles into LDAP
  - Resolves: #1301674 --setup-dns and other options is forgotten for using an
    external PKI
    - installer: Propagate option values from components instead of copying them.
    - installer: Fix logic of reading option values from cache.
  - Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
    IPA setup
    - ipa-ca-install: print more specific errors when CA is already installed
    - cert renewal: import all external CA certs on IPA CA cert renewal
    - CA install: explicitly set dogtag_version to 10
    - fix standalone installation of externally signed CA on IPA master
    - replica install: validate DS and HTTP server certificates
    - replica install: improvements in the handling of CA-related IPA config
      entries
  - Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
    - slapi-nis: update configuration to allow external members of IPA groups
  - Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - upgrade: fix config of sidgen and extdom plugins
    - trusts: use ipaNTTrustPartner attribute to detect trust entries
    - Warn user if trust is broken
    - fix upgrade: wait for proper DS socket after DS restart
    - Insure the admin_conn is disconnected on stop
    - Fix connections to DS during installation
    - Fix broken trust warnings
  - Resolves: #1321092 Installers fail when there are multiple versions of the
    same certificate
    - certdb: never use the -r option of certutil
  - Related: #1317381 Crash during IPA upgrade due to slapd
    - spec file: update minimum required version of slapi-nis
  - Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
    CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
    [rhel-7.3]
    - Rebuild against newer Samba version


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37
changelog:
  - Resolves: #837369 [RFE] Switch to client promotion to replica model
  - Resolves: #1199516 [RFE] Move replication topology to the shared tree
  - Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
    list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
  - Resolves: #1267206 ipa-server-install uninstall should warn if no
    installation found
  - Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
    ipa-client-automount is executed.
  - Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
    displayed when certificate generated using IPA on RHEL 7.2up2.
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605191449GITf8edf37


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37.1
changelog:
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
    - Rebuild with krb5-1.14.1


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3
changelog:
  - Resolves: #1339233 CA installed on replica is always marked as renewal master
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605241723GIT1b427d3


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3.1
changelog:
  - Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
    - Fix incorrect rebase of patch 1001


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.1.alpha1
changelog:
  - Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
    setting password for default sudo binddn.
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
  - Resolves: #825391 [RFE] Replica installation should provide a means for
    inheriting nssldap security access settings
  - Resolves: #921497 Incorrect *.py[co] files placement
  - Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
  - Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
  - Resolves: #1196958 IPA replica installation failing with high number of users
    (160000).
  - Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
    uninstall a replica
  - Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
    Authentication Indicator
  - Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
    principal expiration"
  - Resolves: #1234223 [WebUI] General invalid password error message appearing
    for "Locked user"
  - Resolves: #1254267 ipa-server-install failure applying ldap updates with
    limits exceeded
  - Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
    doamin already is in forwardzone.
  - Resolves: #1259020 ipa-server-adtrust-install doesn't allow
    NetBIOS-name=EXAMPLE-TEST.COM (dash character)
  - Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
    message when DNSSEC master not installed
  - Resolves: #1262747 dnssec options missing in ipa-dns-install man page
  - Resolves: #1265900 Fail installation immediately after dirsrv fails to
    install using ipa-server-install
  - Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
    resolvable anymore
  - Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
    LimitsExceeded: limits exceeded for this query
  - Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
  - Resolves: #1269200 ipa-server crashing while trying to preserve admin user
  - Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
  - Resolves: #1271579 Automember rule expressions disappear from tables on
    single expression delete
  - Resolves: #1275816 Incomplete ports for IPA ad-trust
  - Resolves: #1276351 [RFE] Remove
    /usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
  - Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
    the IPA UI
  - Resolves: #1278426 Better error message needed for invalid ca-signing-algo
    option
  - Resolves: #1279932 ipa-client-install --request-cert needs workaround in
    anaconda chroot
  - Resolves: #1282521 Creating a user w/o private group fails when doing so in
    WebUI
  - Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
    by "IPA is not configured on this system"
  - Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
    file
  - Resolves: #1287194 [RFE] Support of UPN for trusted domains
  - Resolves: #1288967 Normalize Manager entry in ipa user-add
  - Resolves: #1289487 Priority field missing in Password Policy detail tab
  - Resolves: #1291140 ipa client should configure kpasswd_server directive in
    krb5.conf
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0.alpha1
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1300576 Browser setup page includes instructions for Internet
    Explorer
  - Resolves: #1301586 ipa host-del --updatedns should remove related dns
    entries.
  - Resolves: #1304618 Residual Files After IPA Server Uninstall
  - Resolves: #1305144 ipa-python does not require its dependencies
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
  - Resolves: #1313798 Console output post ipa-winsync-migrate command should be
    corrected.
  - Resolves: #1314786 [RFE] External Trust with Active Directory domain
  - Resolves: #1319023 Include description for 'status' option in man page for
    ipactl command.
  - Resolves: #1319912 ipa-server-install does not completely change hostname and
    named-pkcs11 fails
  - Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
    Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
    it is executed on server already installed with KRA.
  - Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
    to 'rpcbind'
  - Resolves: #1329275 ipa-nis-manage command should include status option
  - Resolves: #1330843 'man ipa' should be updated with latest commands
  - Resolves: #1333755 ipa cert-request causes internal server error while
    requesting certificate
  - Resolves: #1337484 EOF is not handled for ipa-client-install command
  - Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
    members of the role which has "User Administrators" privilege.
  - Resolves: #1343142 IPA DNS should do better verification of DNS zones
  - Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
    browser


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.2.alpha1
changelog:
  - Resolves: #1348948 IPA server install fails with build
    ipa-server-4.4.0-0.el7.1.alpha1
    - Revert "Increased mod_wsgi socket-timeout"


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-1
changelog:
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
    in the default global_policy in IPA sets user's password expiration
    (krbPasswordExpiration) to be 90 days
  - Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
  - Resolves: #1084018 [RFE] Add IdM user password change support for legacy
    client compat tree
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - Fix incorrect check for principal type when evaluating CA ACLs
  - Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
  - Resolves: #1238190 ipasam unable to lookup group in directory yet manual
    search works
  - Resolves: #1250110 search by users which don't have read rights for all attrs
    in search_attributes fails
  - Resolves: #1263764 Show Certificate displays in useless format
  - Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
    the options after adding new certificate
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0
  - Resolves: #1294503 IPA fails to issue 3rd party certs
  - Resolves: #1298242 [RFE] API compatibility - compatibility of clients
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1298966 [RFE] Extend Smart Card support
  - Resolves: #1315146 Multiple clients cannot join domain simultaneously:
    /var/run/httpd/ipa/clientcaches race condition?
  - Resolves: #1318903 ipa server install failing when SUBCA signs the cert
  - Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
    console output
  - Resolves: #1324055 IPA always qualify requests for admin
  - Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
  - Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
    hold
  - Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
  - Resolves: #1349281 Fix `Conflicts` with ipa-python
  - Resolves: #1350695 execution of copy-schema script fails
  - Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
  - Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
    execution to 7.3
  - Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
    create ipa-ca entry
  - Related: #1343422 [RFE] Add GssapiImpersonate option


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2
changelog:
  - Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
    with certmonger
    - uninstall: untrack lightweight CA certs
  - Resolves: #1351807 ipa-nis-manage config.get_dn missing
    - ipa-nis-manage: Use server API to retrieve plugin status
  - Resolves: #1353452 ipa-compat-manage command failed,
    exception: NotImplementedError: config.get_dn()
    - ipa-compat-manage: use server API to retrieve plugin status
  - Resolves: #1353899 ipa-advise: object of type 'type' has no len()
    - ipa-advise: correct handling of plugin namespace iteration
  - Resolves: #1356134 'kinit -E' does not work for IPA user
    - kdb: check for local realm in enterprise principals
  - Resolves: #1353072 ipa unknown command vault-add
    - Enable vault-* commands on client
    - vault-add: set the default vault type on the client side if none was given
  - Resolves: #1353995 Default CA can be used without a CA ACL
    - caacl: expand plugin documentation
  - Resolves: #1356144 host-find should not print SSH keys by default, only
    SSH fingerprints
    - host-find: do not show SSH key by default
  - Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
    - Removed unused method parameter from migrate-ds


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2.1
changelog:
  - Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
  - Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
  - Related: #1356134 'kinit -E' does not work for IPA user


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-3
changelog:
  - Resolves: #1296140 Remove redhat-access-plugin-ipa support
    - Obsolete and conflict redhat-access-plugin-ipa
  - Resolves: #1351119 Multiple issues while uninstalling ipa-server
    - server uninstall fails to remove krb principals
  - Resolves: #1351758 ipa commands not showing expected error messages
    - frontend: copy command arguments to output params on client
    - Show full error message for selinuxusermap-add-hostgroup
  - Resolves: #1352883 Traceback on adding default automember group and hostgroup
    set
    - allow 'value' output param in commands without primary key
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - schema: Fix subtopic -> topic mapping
  - Resolves: #1354348 ipa trustconfig-show throws internal error.
    - allow 'value' output param in commands without primary key
  - Resolves: #1354381 ipa trust-add with raw option gives internal error.
    - trust-add: handle `--all/--raw` options properly
  - Resolves: #1354493 Replica install fails with old IPA master
    - DNS install: Ensure that DNS servers container exists
  - Resolves: #1354628 ipa hostgroup-add-member does not return error message
    when adding itself as member
    - frontend: copy command arguments to output params on client
  - Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
    - messages: specify message type for ResultFormattingError
  - Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
    secret key
    - expose `--secret` option in radiusproxy-* commands
    - prevent search for RADIUS proxy servers by secret
  - Resolves: #1356099 Bug in the ipapwd plugin
    - Heap corruption in ipapwd plugin
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
  - Resolves: #1356964 Renaming a user removes all of his principal aliases
    - Preserve user principal aliases during rename operation


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-4
changelog:
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - harden the check for trust namespace overlap in new principals
  - Resolves: #1351142 CLI is not using session cookies for communication with
    IPA API
    - Fix session cookies
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - help: Add dnsserver commands to help topic 'dns'
  - Resolves: #1354406 host-del updatedns options complains about missing ptr
    record for host
    - Host-del: fix behavior of --updatedns and PTR records
  - Resolves: #1355718 ipa-replica-manage man page example output differs actual
    command output
    - Minor fix in ipa-replica-manage MAN page
  - Resolves: #1358229 Traceback message should be fixed, seen while editing
    winsync migrated user information in Default trust view.
    - baseldap: Fix MidairCollision instantiation during entry modification
  - Resolves: #1358849 CA replica install logs to wrong log file
    - unite log file name of ipa-ca-install
  - Resolves: #1359130 ipa-server-install command fails to install IPA server.
    - DNS Locations: fix update-system-records unpacking error
  - Resolves: #1359237 AVC on dirsrv config caused by IPA installer
    - Use copy when replacing files to keep SELinux context
  - Resolves: #1359692 ipa-client-install join fail with traceback against
    RHEL-6.8 ipa-server
    - compat: fix ping call
  - Resolves: #1359738 ipa-replica-install --domain=<IPA primary domain> option
    does not work
    - replica-install: Fix --domain
  - Resolves: #1360778 Vault commands are available in CLI even when the server
    does not support them
    - Revert "Enable vault-* commands on client"
    - client: fix hiding of commands which lack server support
  - Related: #1281704 Rebase to softhsm 2.1.0
    - Remove the workaround for softhsm bug #1293340
  - Related: #1298288 [RFE] Improve performance in large environments.
    - Create indexes for krbCanonicalName attribute


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-5
changelog:
  - Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
    - Do not initialize API in ipa-client-automount uninstall
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - idrange: fix unassigned global variable
  - Resolves: #1360792 Migrating users doesn't update krbCanonicalName
    - re-set canonical principal name on migrated users
  - Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
    and 'bool' objects
    - Fix ipa hbactest output
  - Resolves: #1362260 ipa vault-mod no longer allows defining salt
    - vault: add missing salt option to vault_mod
  - Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
    public key
    - vault: Catch correct exception in decrypt
  - Resolves: #1362537 ipa-server-install fails to create symlink from
    /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
    - Correct path to HTTPD's systemd service directory
  - Resolves: #1363756 Increase length of passwords generated by installer
    - Increase default length of auto generated passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-6
changelog:
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
    - Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
  - Resolves: #1341249 Subsequent external CA installation fails
    - install: fix external CA cert validation
  - Resolves: #1353831 ipa-server-install fails in container because of
    hostnamectl set-hostname
    - server-install: Fix --hostname option to always override api.env values
    - install: Call hostnamectl set-hostname only if --hostname option is used
  - Resolves: #1356091 ipa-cacert-manage --help and man differ
    - Improvements for the ipa-cacert-manage man and help
  - Resolves: #1360631 ipa-backup is not keeping the
    /etc/tmpfiles.d/dirsrv-<instance>.conf
    - ipa-backup: backup /etc/tmpfiles.d/dirsrv-<instance>.conf
  - Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
    file is needed
    - Update ipa-replica-install documentation
  - Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
    not rpm-require it
    - client: RPM require initscripts to get *-domainname.service
  - Resolves: #1364197 caacl: error when instantiating rules with service
    principals
    - caacl: fix regression in rule instantiation
  - Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
    - parameters: move the `confirm` kwarg to Param
  - Resolves: #1364464 Topology graph: ca and domain adders shows question marks
    instead of plus icon
    - Fix unicode characters in ca and domain adders
  - Resolves: #1365083 Incomplete output returned for command ipa vault-add
    - client: add missing output params to client-side commands
  - Resolves: #1365526 build fails during "make check"
    - ipa-kdb: Fix unit test after packaging changes in krb5


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-7
changelog:
  - Resolves: #1361119 UPN-based search for AD users does not match an entry in
    slapi-nis map cache
    - support multiple uid values in schema compatibility tree


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-8
changelog:
  - Resolves: #1298288 [RFE] Improve performance in large environments.
    - cert: speed up cert-find
  - Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
    authentication
    - service: add flag to allow S4U2Self
    - Add 'trusted to auth as user' checkbox
    - Added new authentication method
  - Resolves: #1353881 ipa-replica-install suggests about
    non-existent --force-ntpd option
    - Don't show --force-ntpd option in replica install
  - Resolves: #1354441 DNS forwarder check is too strict: unable to add
    sub-domain to already-broken domain
    - DNS: allow to add forward zone to already broken sub-domain
  - Resolves: #1356146 performance regression in CLI help
    - schema: Speed up schema cache
    - frontend: Change doc, summary, topic and NO_CLI to class properties
    - schema: Introduce schema cache format
    - schema: Generate bits for help load them on request
    - help: Do not create instances to get information about commands and topics
    - schema cache: Do not reset ServerInfo dirty flag
    - schema cache: Do not read fingerprint and format from cache
    - Access data for help separately
    - frontent: Add summary class property to CommandOverride
    - schema cache: Read server info only once
    - schema cache: Store API schema cache in memory
    - client: Do not create instance just to check isinstance
    - schema cache: Read schema instead of rewriting it when SchemaUpToDate
  - Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
    - server install: do not prompt for cert file PIN repeatedly
  - Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
    cache directory: [Errno 13] Permission denied: '/home/test_user'
    - schema: Speed up schema cache
  - Resolves: #1366604 `cert-find` crashes on invalid certificate data
    - cert: do not crash on invalid data in cert-find
  - Resolves: #1366612 Middle replica uninstallation in line topology works
    without '--ignore-topology-disconnect'
    - Fail on topology disconnect/last role removal
  - Resolves: #1366626 caacl-add-service: incorrect error message when service
    does not exists
    - Fix ipa-caalc-add-service error message
  - Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
    does not happen to run during dnf upgrade
    - DNS server upgrade: do not fail when DNS server did not respond
  - Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
    with CA
    - Add warning about only one existing CA server
    - Set servers list as default facet in topology facet group
  - Resolves: #1367773 thin client ignores locale change
    - schema check: Check current client language against cached one


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-9
changelog:
  - Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
    - Fix ipa-server-install in pure IPv6 environment
  - Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
    reachable via the forest root
    - trust: make sure ID range is created for the child domain even if it exists
    - ipa-kdb: simplify trusted domain parent search
  - Resolves: #1335567 Update Warning in IdM Web UI API browser
    - WebUI: add API browser is tech preview warning
  - Resolves: #1348560 Mulitple domain Active Directory Trust conflict
    - ipaserver/dcerpc: reformat to make the code closer to pep8
    - trust: automatically resolve DNS trust conflicts for triangle trusts
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)
  - Resolves: #1353936 custodia.conf and server.keys file is world-readable.
    - Remove Custodia server keys from LDAP
    - Secure permissions of Custodia server.keys
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
    - custodia: include known CA certs in the PKCS#12 file for Dogtag
    - custodia: force reconnect before retrieving CA certs from LDAP
  - Resolves: #1362333 ipa vault container owner cannot add vault
    - Fix: container owner should be able to add vault
  - Resolves: #1365546 External trust with root domain is transitive
    - trust: make sure external trust topology is correctly rendered
  - Resolves: #1365572 IPA server broken after upgrade
    - Require pki-core-10.3.3-7
  - Resolves: #1367864 Server assumes latest version of command instead of
    version 1 for old / 3rd party clients
    - rpcserver: assume version 1 for unversioned command calls
    - rpcserver: fix crash in XML-RPC system commands
  - Resolves: #1367773 thin client ignores locale change
    - schema cache: Fallback to 'en_us' when locale is not available
  - Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
    - Fail on topology disconnect/last role removal
  - Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
    - otptoken, permission: Convert custom type parameters on server
  - Resolves: #1369414 ipa server-del fails with Python stack trace
    - Handled empty hostname in server-del command
  - Resolves: #1369761 ipa-server must depend on a version of httpd that support
    mod_proxy with UDS
    - Require httpd 2.4.6-31 with mod_proxy Unix socket support
  - Resolves: #1370512 Received ACIError instead of DuplicatedError in
    stageuser_tests
    - Raise DuplicatedEnrty error when user exists in delete_container
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add missing param values to cert-find output
  - Renamed patch 1011 to 0100, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-10
changelog:
  - Resolves: #1355753 adding two way non transitive(external) trust displays
    internal error on the console
    - Always fetch forest info from root DCs when establishing two-way trust
    - factor out `populate_remote_domain` method into module-level function
    - Always fetch forest info from root DCs when establishing one-way trust
  - Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
    after `ipa-replica-install`
    - Track lightweight CAs on replica installation
  - Resolves: #1357488 ipa command stuck forever on higher versioned client with
    lower versioned server
    - compat: Save server's API version in for pre-schema servers
    - compat: Fix ping command call
    - schema cache: Store and check info for pre-schema servers
  - Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
    - Fix man page ipa-replica-manage: remove duplicate -c option
      from --no-lookup
  - Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
    when revoking certificate
    - cert: include CA name in cert command output
    - WebUI add support for sub-CAs while revoking certificates
  - Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
    - Add support for additional options taken from table facet
    - WebUI: Fix showing certificates issued by sub-CA
  - Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
    internactively
    - dns: normalize record type read interactively in dnsrecord_add
    - dns: prompt for missing record parts in CLI
    - dns: fix crash in interactive mode against old servers
  - Resolves: #1370519 Certificate revocation in service-del and host-del isn't
    aware of Sub CAs
    - cert: fix cert-find --certificate when the cert is not in LDAP
    - Make host/service cert revocation aware of lightweight CAs
  - Resolves: #1371901 Use OAEP padding with custodia
    - Use RSA-OAEP instead of RSA PKCS#1 v1.5
  - Resolves: #1371915 When establishing external two-way trust, forest root
    Administrator account is used to fetch domain info
    - do not use trusted forest name to construct domain admin principal
  - Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
    certificate request
    - Fix CA ACL Check on SubjectAltNames
  - Resolves: #1373272 CLI always sends default command version
    - cli: use full name when executing a command
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix ipa-certupdate for CA-less installation
  - Resolves: #1373540 client-install with IPv6 address fails on link-local
    address (always)
    - Fix parse errors with link-local addresses


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-11
changelog:
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix regression introduced in ipa-certupdate


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-12
changelog:
  - Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
  - Resolves: #1375269 ipa trust-fetch-domains throws internal error


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-13
changelog:
  - Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
    - Keep NSS trust flags of existing certificates
  - Resolves: #1360813 ipa-server-certinstall does not update all certificate
    stores and doesn't set proper trust permissions
    - Add cert checks in ipa-server-certinstall
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add revocation reason back to cert-find output
  - Resolves: #1375133 WinSync users who have First.Last casing creates users who
    can have their password set
    - ipa passwd: use correct normalizer for user principals
  - Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
    - Properly handle LDAP socket closures in ipa-otpd
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Make httpd publish its CA certificate on DL1


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14
changelog:
  - Resolves: #1378353 Replica install fails with old IPA master sometimes during
    replication process
    - spec file: bump minimal required version of 389-ds-base
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Fix missing file that fails DL1 replica installation
  - Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
    - WebUI: services without canonical name are shown correctly
  - Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
    - trustdomain-del: fix the way how subdomain is searched


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - password policy: Add explicit default password policy for hosts and
      services
  - Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
    certprofile-mod
    - certprofile-mod: correctly authorise config update


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.2
changelog:
  - Resolves: #1382812 Creation of replica for disconnected environment is
    failing with CA issuance errors; Need good steps.
    - gracefully handle setting replica bind dn group on old masters
  - Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
    temporary CA admin
    - replication: ensure bind DN group check interval is set on replica config
    - add missing attribute to ipaca replica during CA topology update
  - Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
    named-pkcs11
    - bindinstance: use data in named.conf to determine configuration status


