# changelog

author: Dogtag Team <pki-devel@redhat.com> 10.5.9-11
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1671245 - CC: unable to verify cert before import
    [rhel-7.6.z] (ascheel)
  - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL)
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-13
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1671245 - CC: unable to verify cert before import
    [rhel-7.6.z] [manpage] (ascheel)
  - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL)
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-1
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1633422 - Rebase pki-core from 10.5.1 to 10.5.16 (RHEL) 
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-2
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1491453 - Need Method to Include SKI in CA Signing
    Certificate Request [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-3
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1638379 - PKI startup initialization process should not
    depend on LDAP operational attributes [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.16 in RHCS 9.5


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-4
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1743122 - RHCS-9 CA clone SSL server cert not issued with its
    custom SAN extension, RHEL-7.6 and HSM [rhel-7.7.z] (edewata)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-5
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1750277 - CC: missing audit event for CS acting as TLS client
    [rhel-7.7.z] (cfu)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-6
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1754845 - number range depletion when multiple clones
    created from same master (ftweedal)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-3
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1638379 - PKI startup initialization process should not
    depend on LDAP operational attributes [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-1
changelog:
  - Updated jss, nuxwdog, and tomcatjss dependencies
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1733586 - Rebase pki-core from 10.5.16 to 10.5.17 (RHEL)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1718418 - Update RHCS version of CA, KRA, OCSP, and TKS so
    - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-2
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS
    client (cfu)
  - Bugzilla Bug #1597727 - CA - Unable to change a certificate’s revocation
    reason from superceded to key_compromised (rhcs-maint)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1470410 - TPS doesn't update revocation status when
    - # Bugzilla Bug #1470433 - Add supported transitions to TPS (rhcs-maint)
  - # Bugzilla Bug #1585722 - TMS - PKISocketFactory – Modify Logging to Allow
    - # Bugzilla Bug #1642577 - TPS – Revoked Encryption Certificates Marked as


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-3
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1445479 - KRATool does not support netkeyKeyRecovery
    attribute (dmoluguw)
  - Bugzilla Bug #1534013 - Attempting to add new keys using a PUT KEY APDU
    to a token that is loaded only with the default/factory keys (Key Version
    Number 0xFF) returns an APDU with error code 0x6A88. (jmagne)
  - Bugzilla Bug #1709585 - PKI (test support) for PKCS#11 standard
    AES KeyWrap for HSM support (cfu, ftweedal)
  - Bugzilla Bug #1748766 - number range depletion when multiple clones
    created from same master (ftweedal)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1520258 - TPS token search fails to find entries , LDAP filter
    - # Bugzilla Bug #1535671 - RFE to have the users be able to use the


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-5
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS client
    (cfu)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-6
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1723008 - ECC Key recovery failure with
    CKR_TEMPLATE_INCONSISTENT (cfu)
  - Bugzilla Bug #1774282 - pki-server-nuxwdog template has pid file name with
    non-breakable space char encoded instead of 0x20 space char (ascheel)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-3
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu)
  - Bugzilla Bug #1809273 - CRL generation performs an unindexed search (jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1549307 - No default TPS Auditor group (ascheel)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-4
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE
    additional support and touch-up (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1710975 - TPS - Searching the certificate DB for a brand new


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-6
changelog:
  - Patch for CMC Credential Error, RSA PSS typo, and new profile
    for directory-authentication-based Server-Side keygen
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1710109 - add RSA PSS support (jmagne)
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-7
changelog:
  - Patch for CMCResponse tool
  - Bugzilla Bug #1710109 - add RSA PSS support - fix CMCResponse tool (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-8
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1883639 - add profile caAuditSigningCert (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1710978 - TPS - Add logging to tdbAddCertificatesForCUID if
    - # Bugzilla Bug #1858860 - TPS - Update Error Codes returned to client
    - # Bugzilla Bug #1858861 - TPS - Server side key generation is not working
    - # Bugzilla Bug #1858867 - TPS does not check token cuid on the user


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-9
changelog:
  - Bugzilla Bug #1883639 - additional support on upgrade for audit
    cert profile and auditProfileUpgrade + auditProfileUpgrade part 2 (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-11
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-12
changelog:
  - Change variable 'TPS' to 'tps'
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-13
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1949136 - PKI instance creation failed with new 389-ds-base
    build (jmagne)
  - Bugzilla Bug 1949656 - CRMF requests with extensions other than SKID cannot
    be processed (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-14
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1911472 - Revoke via REST API not working when Agent
    certificate not issued by CA [rhel-7.9.z] (cfu)
  - Bugzilla Bug 1914587 - RHEL IPA PKI - Failed to read product version
    String.java.io.FileNotFoundException (ckelley)
  - Bugzilla Bug 1942687 - TPS not populating Token Policy, or switching
    PIN_RESET=YES to NO [rhel-7.9.z] (jmagne)
  - Bugzilla Bug 1955633 - Recovery of Keys migrated to latest version of KRA
    fail to recover and result in Null Point Exception [rhel-7.9.z] (jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-15
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission
    per LDAP group without immediate issuance [rhel-7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-16
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu]
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500:
    Non-2xx response from CA REST API: 500 [ftweedale, ckelley]
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1959937 - TPS Allowing Token Transactions while
    the CA is Down [cfu]
  - Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile
    Separation [cfu]


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 9):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-18
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 10):
  - ##########################################################################
  - Bugzillla Bug 1978345 - End Entity's List Certificates Page Back/Forward
    Buttons are Broken (ckelley, jonahon.d.parrish@mail.mil, mharmsen)
  - Bugzilla Bug 2008707 - pkispawn bails out too easily for things that could
    have been worked around after installation [RHEL 7.9.z] (cfu)
  - Bugzilla Bug 2016773 - Directory authentication plugin requires directory
    admin password just for user authentication (rhel-7.9.z)
    (awnuk@purestorage.com, jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-19
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 11):
  - ##########################################################################
  - Bugzilla Bug 1998597 - TPS RA Separation Issues (cfu)
  - Bugzilla Bug 2008319 - PKISpawn with ECC Signing Algorithms fail
    in FIPS Mode (cfu)
  - Bugzilla Bug 2018608 - Invalid certificates with creation of subCA
    (pkispawn single step) [rhel-7.9.0.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-20
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 14):
  - ##########################################################################
  - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
    debug level set to maximum [RHEL 7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-21
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 15):
  - ##########################################################################
  - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
    debug level set to maximum [RHEL 7.9.z] (cfu)
  - Bugzilla Bug #2082717 - SCEP manual approval failure (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-22
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-23
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-24
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-25
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 21):
  - ##########################################################################
  - Bugzilla Bug #2160355 - RA Separation by KeyType - Set Token Status
    [RHCS 9.7 bu 21] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 21):
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-26
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 22):
  - ##########################################################################
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 22):
  - ##########################################################################
  - Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
    a list of tokens [RHCS 9.7] (ckelley)
  - Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
  - Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-27
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 23):
  - ##########################################################################
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 23):
  - ##########################################################################
  - Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
    a list of tokens [RHCS 9.7] (ckelley)
  - Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
  - Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-28
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-29
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.1):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.1):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-30
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.2):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.2):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-31
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.3):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.3):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-32
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.4):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.4):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-1
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1774174 - Rebase pki-core from 10.5.17 to 10.5.18 (RHEL)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    - # Bugzilla Bug #1774181 - Update RHCS version of CA, KRA, OCSP, and TKS so


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-1
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1538311 - Using a Netmask produces an odd
    entry in a certifcate (ftweedal)
  - Bugzilla Bug #1544843 - ExternalCA: Installation failed during
    csr generation with ecc (rrelyea, gkapoor)
  - Bugzilla Bug #1557569 - Re-base pki-core from 10.5.1 to latest
    upstream 10.5.x (RHEL) (mharmsen)
  - Bugzilla Bug #1580394 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC (cfu)
  - Bugzilla Bug #1580527 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access (ftweedal, cfu)
  - Bugzilla Bug #1585866 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1588655 - Cert validation for installation with
    external CA cert (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-2
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1471935 - X500Name.directoryStringEncodingOrder overridden
    by CSR encoding (cfu)
  - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a
    certificate (ftweedal)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1550742 - Address ECC profile overrides (cfu)
  - Bugzilla Bug #1562841 - servlet profileSubmitCMCSimple throws NPE (cfu)
  - Bugzilla Bug #1572432 - AuditVerify failure due to line breaks (cfu)
  - Bugzilla Bug #1592961 - Need proper default subjectDN for CMC request
    authenticated through SharedToken (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-4
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1548203 - pki console configurations that involves ldap
    passwords leave the plain text password in signed audit logs (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1494591 - keyGen fails when only Identity


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-5
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1596629 - ipa-replica-install --setup-kra broken on DL0
    with latest version (abokovoy)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-6
changelog:
  - Updated nuxwdog dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #673182 - ECC keys not supported for signing
    audit logs (cfu)
  - Bugzilla Bug #1593805 - Better understanding of
    NSS_USE_DECODED_CKA_EC_POINT for ECC (cfu)
  - Bugzilla Bug #1601071 - Certificate generation happens with
    partial attributes in CMCRequest file (cfu)
  - Bugzilla Bug #1601569 - CC: Enable all config audit events
    (cfu)
  - Bugzilla Bug #1608375 - CMC Revocations throws exception
    with same reqIssuer & certissuer (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-7
changelog:
  - Require "tomcatjss >= 7.2.1-8" as a build and runtime requirement
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1632116 - CC: missing audit event for CS acting as
    TLS client [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632120 - Unsupported RSA_ ciphers should be
    removed from the default ciphers list [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632615 - Permit certain SHA384 FIPS ciphers to be
    enabled by default for RSA and ECC . . . [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632616 - X500Name.directoryStringEncodingOrder
    overridden by CSR encoding (coverity changes) [rhel-7.6.z] (mharmsen)
  - Bugzilla Bug #1633104 - CMC: add config to allow non-clientAuth
    [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1636490 - Installation of CA using an existing CA fails
    [rhel-7.6.z] (edewata)
  - Bugzilla Bug #1643878 - pki cli command for RHCS doesn't prompt for
    a password [rhel-7.6.z] (edewata)
  - Bugzilla Bug #1643879 - CC: Identify version/release of pki-ca, pki-kra,
    pki-ocsp, pki-tks, and pki-tps remotely [RHEL] [rhel-7.6.z] (cfu, jmagne)
  - Bugzilla Bug #1643880 - PKI subsystem process is not shutdown when
    there is no space on the disk to write logs [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-8
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1645262 - pkidestroy may not remove all files [rhel-7.6.z]
    (dmoluguw)
  - Bugzilla Bug #1645263 - Auth plugins leave passwords in the access
    log and audit log using REST [rhel-7.6.z] (dmoluguw)
  - Bugzilla Bug #1645429 - pkispawn fails due to name collision with
    /var/log/pki/<instance> [rhel-7.6.z] (dmoluguw)
  - Bugzilla Bug #1655951 - CC: tools supporting CMC requests output
    keyID needs to be captured in file [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1656297 - Unable to install with admin-generated keys
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.0-1
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Matthew Harmsen <mharmsen@redhat.com> 10.1.0-2
changelog:
  - Bugzilla Bug #1057959 - pkispawn requires policycoreutils-python
  - TRAC Ticket #840 - pkispawn requires policycoreutils-python


author: Matthew Harmsen <mharmsen@redhat.com> 10.1.1-1
changelog:
  - PKI TRAC Ticket #840 - pkispawn requires policycoreutils-python (mharmsen)
  - Bugzilla Bug #1057959 - pkispawn requires policycoreutils-python (mharmsen)
  - PKI TRAC Ticket #868 - REST API get certs links missing segment
                           (alee, mharmsen)
  - PKI TRAC Ticket #869 - f19 ipa-server-install fails at step 6/22 of cert sys
                           install - systemctl start pki-tomcatd.target fails
                           (mharmsen)
  - PKI TRAC Ticket #816 - pki-tomcat cannot be started after installation of
                           ipa replica with ca
                           (alee, cfu, edewata, mharmsen)
  - Updated version number.


author: Matthew Harmsen <mharmsen@redhat.com> 10.1.1-2
changelog:
  - Add missing 'jakarta-commons-httpclient' build and runtime requirement
  - Exclude the 'ppcle' and 'ppc64le' platforms from being built on RHEL platforms
  - Update 'resteasy-base' requirements on RHEL platforms
  - Suppress pylint on RHEL platforms


author: Matthew Harmsen <mharmsen@redhat.com> 10.1.2-2
changelog:
  - Bugzilla Bug #1108303 - Rebase pki-core to 10.1 (RHEL)
  - Bugzilla Bug #1117073 - pki-core ppc64le is missing from ExcludeArch line
    of spec file (RHEL)
  - Bumped required runtime version of tomcat >= 7.0.54 (RHEL)
  - Changed buildtime requirement from 'resteasy-base-jackson-provider >= 3.0.6-1'
    to 'resteasy-base-jettison-provider >= 3.0.6-1' (RHEL)
  - Added version number of '>= 3.0.6-1' to runtime requirements for all
    'resteasy-base' packages (RHEL)


author: Christina Fu <cfu@redhat.com> 10.1.2-3
changelog:
  - Bugzilla Bug #790924 - pkispawn (configuration) does not provide CA
    extensions in subordinate certificate signing requests (CSR)


author: Christina Fu <cfu@redhat.com> 10.1.2-4
changelog:
  - Bugzilla Bug #1151147 -  External CA install does not work
    with CA certificates signed by Microsoft Certificate Services


author: Christina Fu <cfu@redhat.com> 10.1.2-5
changelog:
  - Bugzilla Bug #1155654 - Check for null values in GetConfigEntries (alee)
  - Bugzilla Bug #1158410 - Add TLS Range in server.xml (cfu)
  - Bugzilla Bug #871171 - Provide Tomcat support for TLS v1.1 and TLS v1.2
    (client-side code) (cfu)
  - Updated JSS from "4.2.6-28" to "4.2.6-35" (TLS)
  - Require tomcatjss "7.1.0-5" (TLS)


author: Matthew Harmsen <mharmsen@redhat.com> 10.1.2-7
changelog:
  - Bugzilla Bug #1165351 - Errata TPS test fails due to dependent
    packages not found - fixed shell tests


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-3
changelog:
  - Dogtag 10.2.5-3 patch for RHEL 7.2 Re-base
  -   git format-patch cc97f8628b23f8ea75308bb97a31307cb4f162b9^..
      ac5447a8e0bac5112882be700a17a9274e322adc --stdout > pki-core-rhel-7-2.patch
  -   remove e5c4e87ac5ce881efa160352ce87ad81026f3446 (QE test)
  - Contents of 'pki-core-rhel-7-2.patch':
  -   PKI TRAC Ticket #1249 -	Misleading self test log message [edewata]
  -   PKI TRAC Ticket #1444 - pkispawn: installation aborts when HSM contains
      empty slots [edewata]
  -   PKI TRAC Ticket #995 - Provide more info on how to use --input with pki
      cert-find in the man page [edewata]
  -   PKI TRAC Ticket #1122 - Need to describe paging options in 'pki' man page
      [edewata]
  -   Cleaned up SystemConfigService.validateRequest() [edewata]
  -   Cleaned up SystemConfigService.configureClone() [edewata]
  -   PKI TRAC Ticket #1438 - pkispawn: SSL_ForceHandshake issue for non-CA on
      HSM on both shared and nonshared tomcat instances [cfu]
  -   PKI TRAC Ticket #1442 - Ability to toggle profile usablity in Web vs CLI
      tools [jmagne]
  -   PKI TRAC Ticket #1441 - Lack of Interactive Installation Support
     (Cloning, Subordinates, Externals, HSMs, ECC) [mharmsen]
  -   PKI TRAC Ticket #1446 - Unable to select ECC Curves from EE [jmagne]
  -   Fixed pki help CLI [edewata]
  -   Fixed NPE in key-archive CLI [edewata]
  -   PKI TRAC Ticket #891 - Missing fail-over code in HttpConnection [edewata]
  -   PKI TRAC Ticket #1447 - pkispawn: findCertByNickname fails to find cert in
      creating shared tomcat subsystems on HSM [cfu]
  -   PKI TRAC Ticket #1425 - pkispawn CA with HSM - if the config file has
      pki_client related params the dir is not created and the admin cert p12
      file is stored nowhere [mharmsen]
  -   PKI TRAC Ticket #1358 - Retrying failed OCSP clone results duplicate
      replecation id and a failure [jmagne]
  -   PKI TRAC Ticket #1462 - profile update in raw format accepts bad config
      [ftweedal]
  -   PKI TRAC Ticket #1449 - pki cert-find could be time consuming: add VLV
      index for new installations [edewata]


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-4
changelog:
  - Bugzilla Bug #1143067 - The pkiuser user/group should be created in
    rpm %pre, and ideally with fixed uid/gid [cheimes]


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-5
changelog:
  - Bugzilla Bug #1253045 - handle_exceptions() raises JSONDecodeError [cheimes]
    'pki-core-handle-JSON-decode-error.patch'
  -    modified for RHEL 7.2 by removing changes to '.gitignore',
       'tests/python/test_pki.py', and 'tox.ini' [mharmsen]
  - Bugzilla Bug #1253047 - issues in cloning from dogtag 9 to 10 [alee]
    'pki-core-fix-exception-when-talking-to-Dogtag-9-systems.patch'


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-6
changelog:
  - Bugzilla Bug #1258630 - Upgraded CA lacks ca.sslserver.certreq
    in CS.cfg [edewata]
  - Bugzilla Bug #1258634 - CA fails to authenticate to KRA for
    archival [edewata]


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.0-0.8.a2.1.2
changelog:
  - Update to maven 3
  - Replace nonstandard groups names with standard ones
  - Drop support for non-maven build
  - Add workarounds for RPM bug
  - Cleanup according to Fedora Packaging Guidelines
  - Include missing copyright file in javadoc package


author: Michal Srb <msrb@redhat.com> - 0:1.0-0.9.a2.1
changelog:
  - migrated to plexus-containers-container-default (#878580)
  - using global is preferred over define when defining macros
  - removed not used custom depmap file and its occurrence in spec file
  - removed unused Ant buildfile
  - fixed release number


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:2.3-1
changelog:
  - Update to upstream version 2.3
  - Use apache-commons-compress for bzip2 (de)compression
  - Resolves: CVE-2012-2098


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.4.2-2
changelog:
  - Update to latest packaging guidelines
  - Remove MIT license (only applies to test cases not binary rpm)


author: Michal Srb <msrb@redhat.com> - 0:1.0-0.15.a14
changelog:
  - Removed dependency to plexus-container-default (Resolves: #878570)
  - Removed forgotten older tarball from sources file
  - Fixed various rpmlint warnings


author: Michal Srb <msrb@redhat.com> - 1.0-0.2.alpha11
changelog:
  - Use direct link in Source0
  - Improved prep/setup section
  - mvn-rpmbuild verify is now in check section
  - More specific files section
  - add_maven_depmap macro now with -a option


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.5.5-7
changelog:
  - Fix license tag (Plexus license was replaced by MIT some time ago)
  - Update javadoc plugin BR version


author: Jaromir Capik <jcapik@redhat.com> - 1.0-0.6.a7
changelog:
  - Removal of plexus-maven-plugin dependency (not needed)
  - Minor spec file changes according to the latest guidelines


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.4-4
changelog:
  - Fixes according to new guidelines
  - Add spice-parent to Requires
  - Versionless jars & javadocs
  - Use maven3 to build


author: Jaromir Capik <jcapik@redhat.com> - 0:1.1.8-7
changelog:
  - Migration to maven3
  - Removal of plexus-maven-plugin (not needed)
  - Minor spec file changes according to the latest guidelines


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.25.20140113
changelog:
  - Read OS string from PRETTY_NAME instead of REDHAT_BUGZILLA_PRODUCT
    again, this time munging it to get rid of parts we want to hide.
    Related: #911553
    Resolves: #1306543


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.26.20140113
changelog:
  - Fix color of text progress bar
    Related: #1167735
  - Fix escape key during media check of live image
    Resolves: #1167735


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.28.20140113
changelog:
  - Don't change file mode of boot.log.  Instead, remember what mode
    the admin set it to.
    Related: #916704
  - Don't unlink boot.log before opening it.
    Related: #916704


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.29.20140113
changelog:
  - Fall back to text mode if /dev/dri/card0 can't modeset
    Resolves: #1431141
  - Remove unnecessary post scripts that rpm -V output
    Resolves: #1266085


author: Richard W.M. Jones <rjones@redhat.com> - 0.44-1
changelog:
  - New upstream version 0.44.
  - Fix incorrect use of File::Temp->tempfile (RHBZ#953066).
  - Tidy up the spec file.
  - po4a-build.conf.5 and po4a-runtime.7 man pages are no longer
    installed in the English version for some (unknown) reason.


author: Richard W.M. Jones <rjones@redhat.com> - 0.44-9
changelog:
  - Fix bang path /usr/bin/env perl -> /usr/bin/perl (RHBZ#987035).
  - Increase verbosity of po4a when building to help diagnose build errors.
  - +BR Pod::Parser.
  - Disable 24-tex.t which does not run and does not produce any
    useful diagnostics either.


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-14
changelog:
  - Fix export of fcontext socket entries (#1435100)
  - Fix checks whether a module name is passed to semanage-module (#1420527)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-15
changelog:
  - sepolicy: Do not fail when file_contexts.{homedirs,local} are not present (#1395778)
  - fixfiles - use quotes around "$FILEPATH" (#1241946)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-16
changelog:
  - Strip non-printable characters when parsing audit messages (#1406328)
  - Install seobject python module into arch specific path (#1061049)
  - restorecond: Decrease loglevel of termination message (#1422121)
  - semodule_package: do not fail with an empty fc file (#1390535)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-18
changelog:
  - semanage: Enable listing file_contexts.homedirs
  - semanage: Fix manpage author for ibpkey and ibendport pages.
  - semanage: Update man pages for infiniband
  - semanage: Update semanage to allow runtime labeling of ibendports
  - semanage: Update semanage to allow runtime labeling of Infiniband Pkeys
  - semanage: Improve semanage-port man page
  - fixfiles: do not dereference link files in tmp


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-20
changelog:
  - setfiles: Mention customizable types in restorecon man page (#1260238)
  - sepolicy: do not fail when file_contexts.local or .subs do not exist (#1512590)
  - semanage: Fix export of ibendport entries (#1471809)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-22
changelog:
  - semanage: Fix fcontext help message (#1499259)
  - semanage: Improve semanage-user.8 man page (#1079946)
  - semodule: Improve man page (#1337192)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-23
changelog:
  - Update translation files and remove empty ones (#1375915)
  - sepolicy: Fix sepolicy manpage (#1509383)
  - semanage/seobject: Fix moduleRecords.modify() (#1408331)
  - semodule: Improve man page and unify it with --help (#1320565)
  - setfiles: Improve description of -d switch (#1271327)
  - sepolgen: Try to translate SELinux contexts to raw (#1356149)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-24
changelog:
  - Stop rejecting SCTP and DCCP in sepolicy.info
  - semanage: Replace bare except with specific one (#1598444)
  - semanage: Fix logger class definition (#1598444)
  - semanage: Stop rejecting aliases in semanage commands (#1544793)
  - sepolicy: Stop rejecting aliases in sepolicy commands (#1600009)
  - semanage: Stop logging loginRecords changes (#1294663)
  - Use file_contexts.local in fixfiles restore (#1559808)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-30
changelog:
  - semanage/seobject: Fix listing boolean values (#1391605)
  - sepolicy: Make policy files sorting more robust
  - semanage: Fix setting alternative policy store (#1558033)
  - semanage: Load a store policy and set the store SELinux policy root
  - sepolicy: Add sepolicy.load_store_policy(store)
  - semanage: import sepolicy only when it's needed
  - semanage: move valid_types initialisations to class constructors
  - semanage/seobject: Fix indentation issues
  - scripts/fixfiles: Do not fail on file_contexts.local (#1647714)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-31
changelog:
  - semanage: Start exporting "ibendport" and "ibpkey" entries (#1657196)
  - semanage: Do not show "None" levels when using a non-MLS policy (#1400482)
  - semanage: Include MCS/MLS range when exporting local customizations (#1400482)


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-33
changelog:
  - Only embed mime data for gray/rgb/cmyk colorspaces
  - if image decode map is identity
  - Resolves: #1636103


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-38
changelog:
  - Constrain number of cycles in rescale filter
  - Compute correct coverage values for box filter
  - Resolves: #1688417


author: Panu Matilainen <pmatilai@redhat.com> - 1.13-12
changelog:
  - Hack poptBadOption() to return something semi-meaningful on exec alias
    failures (#697435, #710267)
  - Run internal test-suite on build, minimal as it might be


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.0-2
changelog:
  - Fixed systemd error message regarding chroot-update, patch provided
    by John Heidemann <johnh@isi.edu>
    Resolves: rhbz#917463


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.1-7
changelog:
  - Fixed haproxy with TLS
    Resolves: rhbz#1370455
  - Fixed documentation about canonical maps
    Resolves: rhbz#1381871
  - Fixed build with kernel-4.*
    Resolves: rhbz#1575658


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.1-9
changelog:
  - Compiled with USE_LDAP_SASL if both "ldap" and "sasl" options are enabled
    Resolves: rhbz#1733938


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.14-1
changelog:
  - update to 9.2.14 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-14.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Tom Lane <tgl@redhat.com> 9.1.901-3
changelog:
  - Change BuildRequires: java-1.6.0-openjdk-devel to just java-devel.
    As of 9.1-901, upstream has support for JDBC4.1, so we don't have to
    restrict to JDK6 anymore, and Fedora is moving to JDK7
  Resolves: #796580


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-4
changelog:
  - don't use removed macro %add_to_maven_depmap (#992816)
  - lint: trim-lines, reuse %{name} macro, fedora-review fixes
  - merge cleanup changes by Stano Ochotnicky


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-6
changelog:
  - fix incompatibility with 9.6+ (rhbz#1547424)
  - it's unnecessary to depend on whole java (rhbz#1406931)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-29
changelog:
  - make radius plugin config parser less strict
  - add creation of dip system group
  - resolves : #906913, #918296


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-30
changelog:
  - don't ship /var/lock/ppp in rpm payload and create it in %post instead
  - fix installation of tmpfiles.d configuration
  - enable hardened build
  - fix bogus dates in changelog
  - compile all binaries with hardening flags
  - fix possible NULL pointer dereferencing


author: Miroslav Lichvar <mlichvar@redhat.com> 0-0.7.20120407git0deb9c
changelog:
  - update to 20120407git0deb9c
  - move timepps.h to sys (#852950)
  - include license files in devel subpackage
  - remove obsolete macros


author: Paul Howarth <paul@city-fan.org> 1.7.2-13.2
changelog:
  - Add patch to fix highly-parallel build (e.g. -j16)
  - Add additional compiler warning flags to highlight questionable code
  - Add patch to fix comparisons between signed and unsigned integers
  - Add patch to fix const usage
  - Add patch to fix missing field initializers
  - Add patch to suppress warnings about possibly unused variables
  - Add patch to fix declarations that are not prototypes
  - Add patch to fix warnings about nested externs
  - Add patch to fix dubious typecasts that violate strict-aliasing rules
  - Update the FSF address references and GPLv2 license text
  - Use default optimization level (-O2) again


author: Paul Howarth <paul@city-fan.org> 1.7.2-14
changelog:
  - Build with warning-fix patches to address occasional segfaults (#749455)
  - Patches have all now been merged upstream


author: Paul Howarth <paul@city-fan.org> 1.7.2-17
changelog:
  - Add note in options.pptp about MPPE not being available in FIPS mode
    (#845112)
  - Add note in options.pptp about PPTP with MSCHAP-V2 being insecure


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-10
changelog:
  - Fixes sysinfo - devices with name longer than 20 chars are mistaken for partitions
  - Resolves: rhbz#1169349


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-28
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: manpage line about I/O blocked procs unclear
  - Resolves: rhbz#1624514, rhbz#1796043


author: Kaylin Devchand <kaylin.devchand@oracle.com> - 3.3.10-28.0.1
changelog:
  - ps: remove uptime integer conversion [Orabug: 35834625]
  - ps: improved three elapsed 'jiffies/tics' calculations [Orabug: 35834625]


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-9
changelog:
  - Fixes showing same cgroups for threads under process by adding format option
  - Resolves: rhbz#1284087


author: Conrad Meyer <cemeyer@uw.edu> - 2.5.0-2
changelog:
  - Remove changelog history from before 2010
  - This spec already runs autoreconf -fi during %build, but bump build for
    rhbz #926374


author: Adrian Reber <areber@redhat.com> - 1.0.2-1
changelog:
  - new upstream release
  - split off protoc-c into protobuf-c-compiler to reduce runtime
    dependencies of the main package


author: Jiri Popelka <jpopelka@redhat.com> - 1.17-40
changelog:
  - fix dist tag and URL
  - put psutils-copyright.patch among sources as it's used only in
    psutils-remove-copyrighted-files
  - no need to define BuildRoot and clean it in %clean and %install anymore
  - %defattr no longer needed in %files


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.7-19
changelog:
  - Build with -D_FILE_OFFSET_BITS=64 to get stat64 in pth_high.c
  - Guard the ARM CFLAGS sed substitution.


author: Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.10.2-4
changelog:
  * Sat Aug 25 2012 Peter Robinson <pbrobinson@fedoraproject.org> - 2.10.7-1
  - New 2.10.7 stable release


author: Jeff Fearn <jfearn@redhat.com> 3.1.2-0
changelog:
  - Fix tests failing when publican not installed. BZ #908956
  - Fix broken mr-IN/Conventions.po. BZ #908956
  - Fix footnote link unclickable. BZ #909006
  - Fix missing translations for common files. BZ #908976
  - Fix using edition for version on cover pages. BZ #912180
  - Fix nested entities causing XML::TreeBuilder to fail. BZ #912187


author: Jeff Fearn <jfearn@redhat.com> 3.1.3-1
changelog:
  - Fix add_revision breaking XML parser. BZ #912985
  - Stronger fix for cover pages causing page number overrun. BZ #912967
  - Fix CSS for article front page subtile. BZ #913016


author: Jeff Fearn <jfearn@redhat.com> 3.1.4-0
changelog:
  - Fix entities in Book_Info braking build. BZ #917898
  - add translations of "Revision History". BZ #918365
  - Fix TOC title not translated in PDF. BZ #918365
  - Fix translated strings with parameters. BZ #891166
  - update translations
  - add it-IT translation of PUG via <fedora@marionline.it> BZ #797515


author: Jeff Fearn <jfearn@redhat.com> 3.2.0-0
changelog:
  - Add spaces to web-spec.xsl to work around newer libxml2 eating white space in spec files  BZ #982424
    - Fix typos in common content BZ #952490 #974918
    - Stop menu bouncing. BZ #953716
    - Fix ID missing from admonitions. BZ #966494
    - Support corpauthor for PDF. BZ #908666
    - Fix nested block tags breaking translation flow. BZ #909728
    - Fix multiple calls to update_po breaking packaging. BZ #891167
    - Add website labels and translations. BZ #979885
    - Add orgname to block/inline code. BZ #872955
    - Fix get_keywords not using correct info file. BZ #957956
    - Improve web print CSS. BZ #927513
    - Fix pre border in PDF. BZ #905752
    - Fix epub DOCTYPE. BZ #875129
    - Fix step first child style. BZ #971221
    - Fix long link word wrap in PDF. BZ #923481
    - Support case-insensitive "language" attribute. BZ #919474
    - Apply title style patch from Jaromir Hradilek. BZ #924518
    - Expose %book_ver_list to products/versions_index.tmpl. BZ #962643
    - Allow brands to ship web templates. Add site config toc_js. BZ #956935
    - Add pdftool option to build for pdf tool control. BZ #953728
    - Add default mapping for language to locale. BZ #844202
    - Fix ID missing from translated Revision History. BZ #911462
    - Add pub_dir option to override publish directory. BZ #830062
    - Removed show_unknown parameter and associated code. BZ #915428
    - Add img_dir parameter to override images directory. BZ #919481
    - Support all DocBook conditionals. BZ #919486
    - Flag spaces in product number as invalid. BZ #973895
    - Standardized prompts in commands. BZ #880456sources
    - Updated web_formats publican.cfg info BZ #839141
    - Replaced 'home page' with 'product or version page' BZ #921803
    - Replaced a broken link to CPAN with a working link BZ# 973461
    - Remove duplicate brand files from base install. BZ #966143
    - Add extras_dir parameter to override extras directory. BZ #953998
    - Fix PDF ignoring cover logo. BZ #974353
    - Add trans_drop action to freeze source language for translation. BZ #887707
    - Fix empty pot files not being deleted. BZ #961413
    - Fix long title layout on cover page in PDF. BZ #956934
    - Add Mac OS X Lion installation instructions. BZ# 979229
    - Add file handle limit workaround to FAQ BZ #952476
    - Support CDATA tags. BZ #958343
    - Fix UTF8 image names getting mangled in publish. BZ #953618
    - Add wkhtmltopdf_opts parameter to pass options to wkhtmltopdf. BZ #951290
    - Fix edition missing on PDF cover pages. BZ #956940
    - Support XML in add_revision member. BZ #862465
    - Fix duplicate footnotes in bibliography. BZ #653447
    - Fix Link from footlink to footlink-ref not working in PDF. BZ #909786
    - Fix TOC draft watermark in PDF. BZ #905271
    - Add common-db5 sub package. BZ #958495
    - Support decimals in colwidth & convert exact measures to pixels. BZ #913775
    - Tweak equation formatting. BZ #804531
    - Fix POT-Creation-Date format. BZ #985836
    - Fix site stats report swapping languages and products.
    - Fix web_dir not used for home page packages. BZ #988191
    - Updated web site instructions - BZ#979224


author: Jingdong Lu <jingdong.lu@oracle.com> 3.2.0-4.0.1
changelog:
  - add publican-oracle-linux.patch and publican-oracle-linux-po.patch
  - replace engops.png by blank image in tarball


author: Rex Dieter <rdieter@fedoraproject.org> - 6.0-7
changelog:
  - better autostart.patch, handle case were autospawn is disabled
    (or otherwise doesn't work, like for root user)
  - Resolves: #1269104


author: Wim Taymans <wtaymans@redhat.com> - 10.0-4
changelog:
  - Add support for usb audio in the Dell dock TB16
  - Add patches to improve default sinks
  - Resolves: #1457385


author: Wim Taymans <wtaymans@redhat.com> - 6.0-4
changelog:
  - Add more Requires to avoid testing multiple versions
  - enable hardened build
  - Fix missing %endif
  - Resolves: #1174548


author: Tomáš Mráz <tmraz@redhat.com> - 0.13-6
changelog:
  - Check for error returns which cause segfaults in FIPS mode
  - Fix missing error check and leak found by gcc-with-cpychecker (#800086)


author: Tomáš Mráz <tmraz@redhat.com> - 0.13.1-1
changelog:
  - new upstream release fixing a security issue with string
    formatting subjectAltName of a certificate


author: Tomáš Mráz <tmraz@redhat.com> - 0.13.1-4
changelog:
  - fix various testsuite failures
  - fix exception propagation from private key passphrase callback (#1227505)
  - add optional digest parameter to CRL.export method (#1523772)


author: John (J5) Palmieri <johnp@redhat.com> - 2.28.6-2
changelog:
  - disable introspection in anticipation of pygobject3
  - https://bugzilla.redhat.com/show_bug.cgi?id=731851
  - pygobject2 now becomes legacy for static binding support (e.g. PyGTK)


author: Colin Walters <walters@redhat.com> - 2.28.6-8
changelog:
  - Add various missing BuildRequires, switch to pkgconfig() syntax
  - Backport upstream patch which fixes a crasher in some applications


author: Thomas Moschny <thomas.moschny@gmx.de> - 2.2.4-4
changelog:
  - Add conditional for sphinx on rhel.
  - Remove rhel logic from with_python3 conditional.
  - Disable failing tests for Python3.


author: Thomas Moschny <thomas.moschny@gmx.de> - 2.3.1-1
changelog:
  - Update to 2.3.1.
  - Re-enable some tests, ignore others.
  - Docs are available in English and Japanese now.


author: Thomas Moschny <thomas.moschny@gmx.de> - 2.3.5-1
changelog:
  - Update to 2.3.5.
  - Docutils needed now to build README.html.
  - Add some BR optionally used by the testsuite.


author: Thomas Moschny <thomas.moschny@gmx.de> - 2.3.5-2
changelog:
  - Use python-sphinx for rhel > 6 (rhbz#973318).
  - Update BR to use python-pexpect instead of pexpect.


author: Petr Viktorin <pviktori@redhat.com> - 2.7.5-63
changelog:
  - Make it more likely for the system allocator to release free()d memory arenas
  Resolves: rhbz#1468410


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-65
changelog:
  - Fix hanging of all threads when trying to access an inaccessible NFS server.
  Resolves: rhbz#1520068


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-68
changelog:
  - Add Conflicts tag with old virtualenv versions due to new behaviour of
    httplib (patch 295)
  Resolves: rhbz#1483438


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-71
changelog:
  - Limit the number of CPU cores when building the package on power architectures
  Resolves: rhbz#1568974


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-72
changelog:
  - Fix CVE-2018-1060 and CVE-2018-1061
  Resolves: rhbz#1563454 and rhbz#1549192
  - Provide python2-libs from the python-libs subpackage
  Resolves: rhbz#1557460


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-74
changelog:
  - Fix OSERROR 17 due to _multiprocessing/semaphore.c assuming
    a one-to-one Pid -> process mapping
  Resolves: rhbz#1579432


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-79
changelog:
  - Moved the macros.python/2 files into their own packages python/2-rpm-macros
  Resolves: rhbz#1679221


author: Victor Stinner <vstinner@redhat.com> - 2.7.5-80
changelog:
  - Security fix for CVE-2019-5010: crash on parsing a specially crafted X509 certificate
    (resolves: rhbz#1666788)


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-91
changelog:
  - Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
  - Test fixes for the latest expat security release
  - Update the certificates utilized in the test suite
  Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494


author: David Lehman <dlehman@redhat.com> - 0.61.15.70-1
changelog:
  - Deactivate incomplete VGs along with everything else. (dlehman)
    Resolves: rhbz#1554224
  - Work around udev timing issues. (dlehman)
    Resolves: rhbz#1592253
    Resolves: rhbz#1592191
  - nvdimm: don't crash on non-block devices (rvykydal)
    Related: rhbz#1280500
  - Add NVDIMM detection to "addUdevDiskDevice" (vtrefny)
    Related: rhbz#1558942
  - Add 'NVDIMMNamespaceDevice' device representing NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a function for identifying NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a singleton for NVDIMM namespaces management (vtrefny)
    Resolves: rhbz#1558942
  - Backport DependencyGuard from master (vtrefny)
    Related: rhbz#1558942
  - Ignore nvdimm devices unless configured in kickstart (rvykydal)
    Related: rhbz#1280500
  - Do not ignore nvdimm (pmemX) devices (rvykydal)
    Related: rhbz#1280500


author: David Lehman <dlehman@redhat.com> - 0.61.15.71-1
changelog:
  - Remove dependency on libblockdev-nvdimm (vtrefny)
    Resolves: rhbz#1601557
  - Do not try to load NVDIMM plugin on non-x86_64 architectures (vtrefny)
    Related: rhbz#1601557
  - Add version to the LUKS format (vtrefny)
    Resolves: rhbz#1607830


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.72-1
changelog:
  - Install ndctl when NVDIMMs are used. (dlehman)
    Related: rhbz#1600496
  - Escape dots in lvm filter devices (vtrefny)
    Resolves: rhbz#1614039


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.73-1
changelog:
  - Use --yes when calling pvresize (vtrefny)
    Related: rhbz#1657000
  - Fix typo in partitioning test cleanup. (dlehman)
    Related: rhbz#1657000
  - Remove selinux test that doesn't do anything meaningful. (dlehman)
    Related: rhbz#1657000
  - Improve parsing of mdadm detail output. (dlehman)
    Related: rhbz#1657000
  - Update btrfs tests to use sufficiently large loop devices. (dlehman)
    Related: rhbz#1657000
  - vfat labels apparently cannot contain lower case characters. (dlehman)
    Related: rhbz#1657000
  - Check label format regardless of mechanism used to set it. (dlehman)
    Related: rhbz#1657000
  - Adapt to presence or absence of python-mock. (dlehman)
    Related: rhbz#1657000
  - Fixed KS forcing zerombr onto RO disk (japokorn)
    Resolves: rhbz#1544425
  - Tell LVM to wipe cachepool metadata when attaching the cachepool (vtrefny)
    Resolves: rhbz#1643531
  - Add dependency on python-six (vtrefny)
    Resolves: rhbz#1647173


author: David Lehman <dlehman@redhat.com> - 0.61.15.74-1
changelog:
  - Handle exceptions raised from parted.Disk ctor. (dlehman)
    Related: rhbz#1677383
  - Recommend DASD disk label for disks with an existing DASD label (vtrefny)
    Resolves: rhbz#1677383


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.75-1
changelog:
  - Always set default key size to 512 bits for ciphers with XTS mode (vtrefny)
    Resolves: rhbz#1716674


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.76-1
changelog:
  - edd: Fix UnboundLocalError when trying to close fd in collect_mbrs (vtrefny)
    Related: rhbz#1879920
  - Close fd if it fails to read the device (nashok)
    Resolves: rhbz#1879920


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 0.61.15.76-1.0.1
changelog:
  - Check for oracle-release file first when attempting to determine version [Orabug: 18493611] (Kevin Lyons)
  - Added bug30138855-remove-upstream-references.patch [Orabug: 30138855]


author: Vojtech Trefny <vtrefny@redhat.com> - 3.1.3-1
changelog:
  - Don't crash if blockdev mpath plugin isn't available. (#1672971) (dlehman)
  - iscsi: Add default value to unused 'storage' argument in 'write' (vtrefny)
  - Add exported property to LVMVolumeGroupDevice (vtrefny)
  - Add VG data to static_data (vtrefny)
  - Do not try to get format free space for non-existing formats (vtrefny)
  - Do not raise exception if can't get PV free space (vtrefny)
  - Fix undefined attribute in LVM info cache (vtrefny)
  - Use raw_device to get thinpool device in LVMThinPFactory (#1490174) (vtrefny)
  - Do not crash if DM RAID activation fails (#1661712) (vtrefny)
  - Remove the unused sysroot property (vponcova)
  - Remove unused attributes from the Blivet class (vponcova)
  - Remove the unused gpt flag (vponcova)
  - Copy the iSCSI initiator name file to the installed system (vtrefny)
  - Use udev to determine if disk is a multipath member. (dlehman)
  - Require libfc instead of fcoe for offloaded FCoE. (#1575953) (dlehman)


author: Pavel Cahyna <pcahyna@redhat.com> - 3.1.3-2
changelog:
  - Initial import of python-blivet3 by David Lehman <dlehman@redhat.com>
    derived from python-blivet-3.1.2-1
  - clear the old python-blivet %changelog except the most recent entry.


author: David Lehman <dlehman@redhat.com> - 3.1.3-3
changelog:
  - spec file requires fixes from pcahyna
  - adjust to older pyudev API
  - adjust tags implementation to absence of enum in python-2.7
  - fix bare imports in example scripts
  - update factory example to match latest API


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.10-0.1.20120730svn7490
changelog:
  - Update to snapshot that's supposed to take care of the date directive unicode
    problem in a different way
  - Patch to fix PyXML conflict without using rpm conflicts


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.10-0.5.20120824svn7502
changelog:
  - Rebase to new snapshot with some fixes integrated
  - Reenable one test that I can't replicate the failure with.


author: Bala.FA <barumuga@redhat.com> - 3.7.1-7
changelog:
  - fixes bugs bz#1227197 bz#1228127 bz#1230612 bz#1231782 bz#1235735 
    bz#1236556 bz#1237053 bz#1237165 bz#1238167


author: Bala.FA <barumuga@redhat.com> - 3.7.1-8
changelog:
  - fixes bugs bz#1223205 bz#1224177 bz#1228247 bz#1229567 bz#1230513 
    bz#1231635 bz#1231732 bz#1239280 bz#1240168 bz#1240245


author: Bala.FA <barumuga@redhat.com> - 3.7.1-9
changelog:
  - fixes bugs bz#1224177 bz#1224610 bz#1230525 bz#1231647 bz#1234725 
    bz#1235121 bz#1239057 bz#1239108 bz#1239317 bz#1240196 bz#1240338 bz#1240925 
    bz#1241048 bz#1241150 bz#1241366 bz#1241830 bz#1241839 bz#1241904 bz#1242046


author: Bala.FA <barumuga@redhat.com> - 3.7.1-10
changelog:
  - fixes bugs bz#1224177 bz#1230513 bz#1240617 bz#1242367 bz#1242423 
    bz#1242543 bz#1242585 bz#1242767


author: Bala.FA <barumuga@redhat.com> - 3.7.1-12
changelog:
  - fixes bugs bz#1027723 bz#1064265 bz#1065651 bz#1134288 bz#1213893 
    bz#1226665 bz#1226817 bz#1229606 bz#1229621 bz#1230532 bz#1232216 bz#1235571 
    bz#1236546 bz#1236672 bz#1236990 bz#1238049 bz#1238071 bz#1239075 bz#1240657 
    bz#1241649 bz#1241761 bz#1243542 bz#1243722 bz#1243886 bz#1244527 bz#1245448 
    bz#1245536 bz#1245542 bz#1245897 bz#1245915 bz#1245919 bz#1246946 bz#1252359 
    bz#1253549


author: Bala.FA <barumuga@redhat.com> - 3.7.1-13
changelog:
  - fixes bugs bz#1224184 bz#1225452 bz#1227759 bz#1228135 bz#1231080 
    bz#1234399 bz#1235971 bz#1236038 bz#1238070 bz#1238111 bz#1238171 bz#1238398 
    bz#1238977 bz#1239021 bz#1240918 bz#1245165 bz#1245636 bz#1245924 bz#1251409 
    bz#1255471 bz#1257007 bz#1247349


author: Bala.FA <barumuga@redhat.com> - 3.7.1-14
changelog:
  - fixes bugs bz#1115367 bz#1232569 bz#1234213 bz#1234610 bz#1241336 
    bz#1241385 bz#1241862 bz#1242803 bz#1245077 bz#1251457


author: Bala.FA <barumuga@redhat.com> - 3.7.1-15
changelog:
  - fixes bugs bz#1253774 bz#1257509 bz#1259221 bz#1259750 bz#1260086 
    bz#1260512 bz#1262236 bz#1262291


author: Aleš Kozumplik <ales@redhat.com> - 0.5.1-1
changelog:
  - pool_split_evr() assert if we hit unexpected data. (Related:RhBug:1141634) (Ales Kozumplik)
  - README: changed references to new repo location (Jan Silhan)
  - iutil-py: removed pyseq_to_packagelist function (Jan Silhan)
  - improved performance of python sequence iteration (RhBug:1109554) (Jan Silhan)
  - reldep: constructor accepts unicode strings (RhBug:1124968) (Jan Silhan)
  - Fix pool_split_evr's handling of EVRs without releases. (Radek Holy)
  - added sha512 support (RhBug:1082658) (Jan Silhan)
  - cosmetic: removed unneeded semicolon (Jan Silhan)
  - goal: does not raise exception on empty selector (Related:RhBug:1127206) (Jan Silhan)


author: Jan Silhan <jsilhan@redhat.com> - 0.5.3-1
changelog:
  - README: made readthedoc documentation official (Jan Silhan)
  - sack: deprecation of create_cmdline_repo (Jan Silhan)
  - does not break Sack.__init__ API from 8ce3ce7 (Jan Silhan)
  - doc: document the new logdir parameter of Sack.__init__. (Radek Holy)
  - New version: 0.5.3 (Jan Silhan)
  - apichange: sack: added optional param logdir (Related:RhBug:1175434) (Jan Silhan)
  - apichange: py: rename: Sack.cache_path -> Sack.cache_dir (Radek Holy)
  - doc: add Sack to the Python API reference manual. (Radek Holy)
  - cosmetic: autopep8 applied on __init__.py (Jan Silhan)
  - query: support multiple flags in filter (RhBug:1173027) (Jan Silhan)
  - packaging: make the spec file compatible with GitHub packaging guideliness. (Radek Holy)
  - New version: 0.5.2 (Michal Luscon)
  - hy_chksum_str() returns NULL in case of incorrect type (Michal Luscon)
  - Fix defects found by coverity scan (Michal Luscon)
  - selector: allow selecting provides with globs (RhBug: 1148353) (Michal Luscon)
  - py: nevra_init() references possibly uninitialized variable. (Ales Kozumplik)
  - package: add weak deps attributes. (Ales Kozumplik)


author: Jan Silhan <jsilhan@redhat.com> - 0.5.3-2
changelog:
  - bumped release to be greater than f21 release
  - Add Peter to Authors (Peter Hjalmarsson)
  - Add support for armv6hl (Peter Hjalmarsson)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.2-1
changelog:
  - Reverted flawed patch for #1051427 (this reintroduces #1052102).
  - Spec cleanup (removed rhel < 7 specific stuff).
  - Update to 2.7.2.
  Resolves: rhbz#1052777


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.2.4-1
changelog:
  - Upstream update 0.2.4
    - Changes i18n.easy_gettext_setup() to return lgettext functions when
      byte strings are requested.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.47
changelog:
  - v2v: Work around 'umount: /sysroot: target is busy'
    resolves: rhbz#1246032
  - v2v: Permit libguestfs-winsupport to be used by virt-win-reg and
    virt-inspector
    resolves: rhbz#1243493


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.50
changelog:
  - v2v:
    * When debugging, dump OVF to stderr.
    * Ignore missing kernels from grub
      resolves: rhbz#1230412
    * Calculate VMware dcPath correctly (1256823)
    * Map empty VMware network or bridge name to default (1257895)
  - p2v:
    * Wait for network to come online before testing connection
      resolves: rhbz#1256222
  - Fix tests to run correctly with libguestfs-winsupport 7.2.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.51
changelog:
  - v2v: Fix handling of extra slashes in dcPath calculation
    resolves: rhbz#1258342 rhbz#1256823
  - v2v: Fix -oa preallocation option
    resolves: rhbz#1251909


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.52
changelog:
  - v2v: Warn if Group Policy or AV software may result in 7B boot failure
    (1260689)
  - v2v: Fix OVF XML to enable qxl display
    resolves: rhbz#1260590


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.28.1-1.53
changelog:
  - v2v: Error if certain options appear twice on the command line (1261242)
  - v2v: Add --dcpath parameter to allow dcPath to be overridden (1256823)
  - v2v: Partially revert: Fix OVF XML to enable qxl display (1260590)
  - v2v: Detect AVG Technologies as AV software (1261436)
    resolves: rhbz#1261281


author: Jeffrey Ollie <jeff@ocjtech.us> - 2.3.5-1
changelog:
  - Bugs fixed
  -
  -  * Crash when merging text nodes in element.remove().
  -  * Crash in sax/target parser when reporting empty doctype.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.0-1
changelog:
  - 3.0 (2012-10-08)
  - ================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * End-of-file handling was incorrect in iterparse() when reading from
  -   a low-level C file stream and failed in libxml2 2.9.0 due to its
  -   improved consistency checks.
  -
  - Other changes
  - -------------
  -
  - * The build no longer uses Cython by default unless the generated C files
  -   are missing.  To use Cython, pass the option "--with-cython".  To ignore
  -   the fatal build error when Cython is required but not available (e.g. to
  -   run special setup.py commands that do not actually run a build), pass
  -   "--without-cython".
  -
  -
  - 3.0beta1 (2012-09-26)
  - =====================
  -
  - Features added
  - --------------
  -
  - * Python level access to (optional) libxml2 memory debugging features
  -   to simplify debugging of memory leaks etc.
  -
  - Bugs fixed
  - ----------
  -
  - * Fix a memory leak in XPath by switching to Cython 0.17.1.
  -
  - * Some tests were adapted to work with PyPy.
  -
  - Other changes
  - -------------
  -
  - * The code was adapted to work with the upcoming libxml2 2.9.0 release.
  -
  -
  - 3.0alpha2 (2012-08-23)
  - ======================
  -
  - Features added
  - --------------
  -
  - * The .iter() method of elements now accepts tag arguments like "{*}name"
  -   to search for elements with a given local name in any namespace.  With
  -   this addition, all combinations of wildcards now work as expected:
  -   "{ns}name", "{}name", "{*}name", "{ns}*", "{}*" and "{*}*".  Note that
  -   "name" is equivalent to "{}name", but "*" is "{*}*".  The same change
  -   applies to the .getiterator(), .itersiblings(), .iterancestors(),
  -   .iterdescendants(), .iterchildren() and .itertext() methods,  the
  -   strip_attributes(), strip_elements() and strip_tags() functions as well
  -   as the iterparse() function.
  -
  - * C14N allows specifying the inclusive prefixes to be promoted to
  -   top-level during exclusive serialisation.
  -
  - Bugs fixed
  - ----------
  -
  - * Passing long Unicode strings into the feed() parser interface failed to
  -   read the entire string.
  -
  - Other changes
  - -------------
  -
  -
  - 3.0alpha1 (2012-07-31)
  - ======================
  -
  - Features added
  - --------------
  -
  - * Initial support for building in PyPy (through cpyext).
  -
  - * DTD objects gained an API that allows read access to their
  -   declarations.
  -
  - * xpathgrep.py gained support for parsing line-by-line (e.g.
  -   from grep output) and for surrounding the output with a new root
  -   tag.
  -
  - * E-factory in lxml.builder accepts subtypes of known data
  -   types (such as string subtypes) when building elements around them.
  -
  - * Tree iteration and iterparse() with a selective tag
  -   argument supports passing a set of tags.  Tree nodes will be
  -   returned by the iterators if they match any of the tags.
  -
  - Bugs fixed
  - ----------
  -
  - * The .find*() methods in lxml.objectify no longer use XPath
  -   internally, which makes them faster in many cases (especially when
  -   short circuiting after a single or couple of elements) and fixes
  -   some behavioural differences compared to lxml.etree.  Note that
  -   this means that they no longer support arbitrary XPath expressions
  -   but only the subset that the ElementPath language supports.
  -   The previous implementation was also redundant with the normal
  -   XPath support, which can be used as a replacement.
  -
  - * el.find('*') could accidentally return a comment or processing
  -   instruction that happened to be in the wrong spot.  (Same for the
  -   other .find*() methods.)
  -
  - * The error logging is less intrusive and avoids a global setup where
  -   possible.
  -
  - * Fixed undefined names in html5lib parser.
  -
  - * xpathgrep.py did not work in Python 3.
  -
  - * Element.attrib.update() did not accept an attrib of
  -   another Element as parameter.
  -
  - * For subtypes of ElementBase that make the .text or .tail
  -   properties immutable (as in objectify, for example), inserting text
  -   when creating Elements through the E-Factory feature of the class
  -   constructor would fail with an exception, stating that the text
  -   cannot be modified.
  -
  - Other changes
  - --------------
  -
  - * The code base was overhauled to properly use 'const' where the API
  -   of libxml2 and libxslt requests it.  This also has an impact on the
  -   public C-API of lxml itself, as defined in etreepublic.pxd, as
  -   well as the provided declarations in the lxml/includes/ directory.
  -   Code that uses these declarations may have to be adapted.  On the
  -   plus side, this fixes several C compiler warnings, also for user
  -   code, thus making it easier to spot real problems again.
  -
  - * The functionality of "lxml.cssselect" was moved into a separate PyPI
  -   package called "cssselect".  To continue using it, you must install
  -   that package separately.  The "lxml.cssselect" module is still
  -   available and provides the same interface, provided the "cssselect"
  -   package can be imported at runtime.
  -
  - * Element attributes passed in as an attrib dict or as keyword
  -   arguments are now sorted by (namespaced) name before being created
  -   to make their order predictable for serialisation and iteration.
  -   Note that adding or deleting attributes afterwards does not take
  -   that order into account, i.e. setting a new attribute appends it
  -   after the existing ones.
  -
  - * Several classes that are for internal use only were removed
  -   from the lxml.etree module dict:
  -   _InputDocument, _ResolverRegistry, _ResolverContext, _BaseContext,
  -   _ExsltRegExp, _IterparseContext, _TempStore, _ExceptionContext,
  -   __ContentOnlyElement, _AttribIterator, _NamespaceRegistry,
  -   _ClassNamespaceRegistry, _FunctionNamespaceRegistry,
  -   _XPathFunctionNamespaceRegistry, _ParserDictionaryContext,
  -   _FileReaderContext, _ParserContext, _PythonSaxParserTarget,
  -   _TargetParserContext, _ReadOnlyProxy, _ReadOnlyPIProxy,
  -   _ReadOnlyEntityProxy, _ReadOnlyElementProxy, _OpaqueNodeWrapper,
  -   _OpaqueDocumentWrapper, _ModifyContentOnlyProxy,
  -   _ModifyContentOnlyPIProxy, _ModifyContentOnlyEntityProxy,
  -   _AppendOnlyElementProxy, _SaxParserContext, _FilelikeWriter,
  -   _ParserSchemaValidationContext, _XPathContext,
  -   _XSLTResolverContext, _XSLTContext, _XSLTQuotedStringParam
  -
  - * Several internal classes can no longer be inherited from:
  -   _InputDocument, _ResolverRegistry, _ExsltRegExp, _ElementUnicodeResult,
  -   _IterparseContext, _TempStore, _AttribIterator, _ClassNamespaceRegistry,
  -   _XPathFunctionNamespaceRegistry, _ParserDictionaryContext,
  -   _FileReaderContext, _PythonSaxParserTarget, _TargetParserContext,
  -   _ReadOnlyPIProxy, _ReadOnlyEntityProxy, _OpaqueDocumentWrapper,
  -   _ModifyContentOnlyPIProxy, _ModifyContentOnlyEntityProxy,
  -   _AppendOnlyElementProxy, _FilelikeWriter, _ParserSchemaValidationContext,
  -   _XPathContext, _XSLTResolverContext, _XSLTContext,
  -   _XSLTQuotedStringParam, _XSLTResultTree, _XSLTProcessingInstruction


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.0.1-1
changelog:
  - 3.0.1 (2012-10-14)
  - Bugs fixed
  -
  -  * LP#1065924: Element proxies could disappear during garbage collection
  -    in PyPy without proper cleanup.
  -  * GH#71: Failure to work with libxml2 2.6.x.
  -  * LP#1065139: static MacOS-X build failed in Py3.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.1.0-1
changelog:
  - 3.1.0 (2013-02-10)
  - ==================
  -
  - Features added
  - --------------
  -
  - * GH#89: lxml.html.clean allows overriding the set of attributes that it
  -   considers 'safe'.  Patch by Francis Devereux.
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1104370: ``copy.copy(el.attrib)`` raised an exception.  It now returns
  -   a copy of the attributes as a plain Python dict.
  -
  - * GH#95: When used with namespace prefixes, the  ``el.find*()`` methods
  -   always used the first namespace mapping that was provided for each
  -   path expression instead of using the one that was actually passed
  -   in for the current run.
  -
  - * LP#1092521, GH#91: Fix undefined C symbol in Python runtimes compiled
  -   without threading support.  Patch by Ulrich Seidl.
  -
  - Other changes
  - -------------
  -
  -
  - 3.1beta1 (2012-12-21)
  - =====================
  -
  - Features added
  - --------------
  -
  - * New build-time option ``--with-unicode-strings`` for Python 2 that
  -   makes the API always return Unicode strings for names and text
  -   instead of byte strings for plain ASCII content.
  -
  - * New incremental XML file writing API ``etree.xmlfile()``.
  -
  - * E factory in lxml.objectify is callable to simplify the creation of
  -   tags with non-identifier names without having to resort to getattr().
  -
  - Bugs fixed
  - ----------
  -
  - * When starting from a non-namespaced element in lxml.objectify, searching
  -   for a child without explicitly specifying a namespace incorrectly found
  -   namespaced elements with the requested local name, instead of restricting
  -   the search to non-namespaced children.
  -
  - * GH#85: Deprecation warnings were fixed for Python 3.x.
  -
  - * GH#33: lxml.html.fromstring() failed to accept bytes input in Py3.
  -
  - * LP#1080792: Static build of libxml2 2.9.0 failed due to missing file.
  -
  - Other changes
  - -------------
  -
  - * The externally useless class ``_ObjectifyElementMakerCaller`` was
  -   removed from the module API of lxml.objectify.
  -
  - * LP#1075622: lxml.builder is faster for adding text to elements with
  -   many children.  Patch by Anders Hammarquist.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.2.0-1
changelog:
  - 3.2.0 (2013-04-28)
  - ==================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * LP#690319: Leading whitespace could change the behaviour of the string
  -   parsing functions in ``lxml.html``.
  -
  - * LP#599318: The string parsing functions in ``lxml.html`` are more robust
  -   in the face of uncommon HTML content like framesets or missing body tags.
  -   Patch by Stefan Seelmann.
  -
  - * LP#712941: I/O errors while trying to access files with paths that
  -   contain non-ASCII characters could raise ``UnicodeDecodeError`` instead
  -   of properly reporting the ``IOError``.
  -
  - * LP#673205: Parsing from in-memory strings disabled network access in the
  -   default parser and made subsequent attempts to parse from a URL fail.
  -
  - * LP#971754: lxml.html.clean appends 'nofollow' to 'rel' attributes instead
  -   of overwriting the current value.
  -
  - * LP#715687: lxml.html.clean no longer discards scripts that are explicitly
  -   allowed by the user provided whitelist.  Patch by Christine Koppelt.
  -
  - 3.1.2 (2013-04-12)
  - ==================
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1136509: Passing attributes through the namespace-unaware API of
  -   the sax bridge (i.e. the ``handler.startElement()`` method) failed
  -   with a ``TypeError``.  Patch by Mike Bayer.
  -
  - * LP#1123074: Fix serialisation error in XSLT output when converting
  -   the result tree to a Unicode string.
  -
  - * GH#105: Replace illegal usage of ``xmlBufLength()`` in libxml2 2.9.0
  -   by properly exported API function ``xmlBufUse()``.
  -
  - 3.1.1 (2013-03-29)
  - ==================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1160386: Write access to ``lxml.html.FormElement.fields`` raised
  -   an AttributeError in Py3.
  -
  - * Illegal memory access during cleanup in incremental xmlfile writer.
  -
  - Other changes
  - -------------
  -
  - * The externally useless class ``lxml.etree._BaseParser`` was removed
  -   from the module dict.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.2.1-1
changelog:
  - 3.2.1 (2013-05-11)
  - ==================
  -
  - Features added
  - --------------
  -
  - * The methods ``apply_templates()`` and ``process_children()`` of XSLT
  -   extension elements have gained two new boolean options ``elements_only``
  -   and ``remove_blank_text`` that discard either all strings or
  -   whitespace-only strings from the result list.
  -
  - Bugs fixed
  - ----------
  -
  - * When moving Elements to another tree, the namespace cleanup mechanism
  -   no longer drops namespace prefixes from attributes for which it finds
  -   a default namespace declaration, to prevent them from appearing as
  -   unnamespaced attributes after serialisation.
  -
  - * Returning non-type objects from a custom class lookup method could lead
  -   to a crash.
  -
  - * Instantiating and using subtypes of Comments and ProcessingInstructions
  -   crashed.


author: pcpa <paulo.cesar.pereira.de.andrade@gmail.com> - 1.2.0-8
changelog:
  - Update fontconfig patch to apply issue found by upstream
  - Update fontconfig patch to apply issue with missing afm fonts (#896182)


author: pcpa <paulo.cesar.pereira.de.andrade@gmail.com> - 1.2.0-10
changelog:
  - Use stix fonts avoid problems with missing cm fonts (#908717)
  - Correct type mismatch in python3 font_manager (#912843, #928326)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.21-1
changelog:
  - New purely textual text interface (vpodzime)
  - Add dumb enableNetwork implementation to GraphicalIntf (vpodzime)
  - Destroy main window after running it (vpodzime)
  - Get rid of the accountManager and use new libreport API (vpodzime)
  - Add a way to override previously registered callback (vpodzime)
  - Allow callbacks marked as attachment only (vpodzime)
  - Add support for callbacks providing additional data (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.22-1
changelog:
  - Some more stuff for ABRT/libreport (#929181) (vpodzime)
  - Tell ABRT we are reporting a Python excetion (vpodzime)
  - Use named tuples instead of our magic tuples (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.23-1
changelog:
  - Use Sphinx syntax for docstrings (vpodzime)
  - Allow a change of the I/O functions (vpodzime)
  - Reword the 'Debug' button warning (#948256) (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.25-1
changelog:
  - Add and use the safe_string module and the SafeStr class (vpodzime)
  - Give translators hint about the cryptic strings (vpodzime)


author: David Malcolm <dmalcolm@redhat.com> - 1.1.2-5
changelog:
  - rebuild for https://fedoraproject.org/wiki/Features/Python_3.3
  - disable selftests that fail under 3.3


author: John Dennis <jdennis@redhat.com> - 0.14-1
changelog:
  External Changes:
    -----------------

    The primary enhancements in this version is support of certifcate
    validation, OCSP support, and support for the certificate "Authority
    Information Access" extension.

    Enhanced certifcate validation including CA certs can be done via
    Certificate.verify() or Certificate.is_ca_cert(). When cert
    validation fails you can now obtain diagnostic information as to why
    the cert failed to validate. This is encapsulated in the
    CertVerifyLog class which is a iterable collection of
    CertVerifyLogNode objects. Most people will probablby just print the
    string representation of the returned CertVerifyLog object. Cert
    validation logging is handled by the Certificate.verify() method.
    Support has also been added for the various key usage and cert type
    entities which feature prominently during cert validation.


    * Certificate() constructor signature changed from

      Certificate(data=None, der_is_signed=True)

      to

      Certificate(data, certdb=cert_get_default_certdb(), perm=False, nickname=None)

      This change was necessary because all certs should be added to the
      NSS temporary database when they are loaded, but earlier code
      failed to to that. It's is not likely that an previous code was
      failing to pass initialization data or the der_is_signed flag so
      this change should be backwards compatible.

    * Fix bug #922247, PKCS12Decoder.database_import() method. Importing into
      a NSS database would sometimes fail or segfault.

    * Error codes and descriptions were updated from upstream NSPR & NSS.

    * The password callback did not allow for breaking out of a password
      prompting loop, now if None is returned from the password callback
      the password prompting is terminated.

    * nss.nss_shutdown_context now called from InitContext destructor,
      this assures the context is shutdown even if the programmer forgot
      to. It's still best to explicitly shut it down, this is just
      failsafe.

    * Support was added for shutdown callbacks.

    * The following classes were added:
      - nss.CertVerifyLogNode
      - nss.CertVerifyLog
      - error.CertVerifyError (exception)
      - nss.AuthorityInfoAccess
      - nss.AuthorityInfoAccesses


    * The following class methods were added:
      - nss.Certificate.is_ca_cert
      - nss.Certificate.verify
      - nss.Certificate.verify_with_log
      - nss.Certificate.get_cert_chain
      - nss.Certificate.check_ocsp_status
      - nss.PK11Slot.list_certs
      - nss.CertVerifyLogNode.format_lines
      - nss.CertVerifyLog.format_lines
      - nss.CRLDistributionPts.format_lines

    * The following class properties were added:
      - nss.CertVerifyLogNode.certificate
      - nss.CertVerifyLogNode.error
      - nss.CertVerifyLogNode.depth
      - nss.CertVerifyLog.count

    * The following module functions were added:
      - nss.x509_cert_type
      - nss.key_usage_flags
      - nss.list_certs
      - nss.find_certs_from_email_addr
      - nss.find_certs_from_nickname
      - nss.nss_get_version
      - nss.nss_version_check
      - nss.set_shutdown_callback
      - nss.get_use_pkix_for_validation
      - nss.set_use_pkix_for_validation
      - nss.enable_ocsp_checking
      - nss.disable_ocsp_checking
      - nss.set_ocsp_cache_settings
      - nss.set_ocsp_failure_mode
      - nss.set_ocsp_timeout
      - nss.clear_ocsp_cache
      - nss.set_ocsp_default_responder
      - nss.enable_ocsp_default_responder
      - nss.disable_ocsp_default_responder

    * The following files were added:
        src/py_traceback.h
        doc/examples/verify_cert.py
        test/test_misc.py

    * The following constants were added:
      - nss.KU_DIGITAL_SIGNATURE
      - nss.KU_NON_REPUDIATION
      - nss.KU_KEY_ENCIPHERMENT
      - nss.KU_DATA_ENCIPHERMENT
      - nss.KU_KEY_AGREEMENT
      - nss.KU_KEY_CERT_SIGN
      - nss.KU_CRL_SIGN
      - nss.KU_ENCIPHER_ONLY
      - nss.KU_ALL
      - nss.KU_DIGITAL_SIGNATURE_OR_NON_REPUDIATION
      - nss.KU_KEY_AGREEMENT_OR_ENCIPHERMENT
      - nss.KU_NS_GOVT_APPROVED
      - nss.PK11CertListUnique
      - nss.PK11CertListUser
      - nss.PK11CertListRootUnique
      - nss.PK11CertListCA
      - nss.PK11CertListCAUnique
      - nss.PK11CertListUserUnique
      - nss.PK11CertListAll
      - nss.certUsageSSLClient
      - nss.certUsageSSLServer
      - nss.certUsageSSLServerWithStepUp
      - nss.certUsageSSLCA
      - nss.certUsageEmailSigner
      - nss.certUsageEmailRecipient
      - nss.certUsageObjectSigner
      - nss.certUsageUserCertImport
      - nss.certUsageVerifyCA
      - nss.certUsageProtectedObjectSigner
      - nss.certUsageStatusResponder
      - nss.certUsageAnyCA
      - nss.ocspMode_FailureIsVerificationFailure
      - nss.ocspMode_FailureIsNotAVerificationFailure

    * cert_dump.py extended to print NS_CERT_TYPE_EXTENSION

    * cert_usage_flags, nss_init_flags now support optional repr_kind parameter

    Internal Changes:
    -----------------

    * Reimplement exception handling
      - NSPRError is now derived from StandardException instead of
        EnvironmentError. It was never correct to derive from
        EnvironmentError but was difficult to implement a new subclassed
        exception with it's own attributes, using EnvironmentError had
        been expedient.

      - NSPRError now derived from StandardException, provides:
        * errno (numeric error code)
        * strerror (error description associated with error code)
        * error_message (optional detailed message)
        * error_code (alias for errno)
        * error_desc (alias for strerror)

      - CertVerifyError derived from NSPRError, extends with:
        * usages (bitmask of returned usages)
        * log (CertVerifyLog object)

    * Expose error lookup to sibling modules

    * Use macros for bitmask_to_list functions to reduce code
      duplication and centralize logic.

    * Add repr_kind parameter to cert_trust_flags_str()

    * Add support for repr_kind AsEnumName to bitstring table lookup.

    * Add cert_type_bitstr_to_tuple() lookup function

    * Add PRTimeConvert(), used to convert Python time values
      to PRTime, centralizes conversion logic, reduces duplication

    * Add UTF8OrNoneConvert to better handle unicode parameters which
      are optional.

    * Add Certificate_summary_format_lines() utility to generate
      concise certificate identification info for output.

    * Certificate_new_from_CERTCertificate now takes add_reference parameter
      to properly reference count certs, should fix shutdown busy problems.

    * Add print_traceback(), print_cert() debugging support.


author: John Dennis <jdennis@redhat.com> - 0.14.0-2
changelog:
  - resolves: bug#1002589
  - resolves: bug#1003979

  - Rewrite setup_certs.py. No longer behaves like an expect script
    which was fragile. By default now creates a sql style database.
  - By default all examples & tests use new sql format for NSS database
  - db-name is now used instead of dbdir to provide distinction between
    the database directory and it's scheme (e.g. 'sql:')
  - all examples and tests now default db-name to 'sql:pki'
  - replaced legacy getopt & optparse command line argument handling
    with modern argparse.


author: John Dennis <jdennis@redhat.com> - 0.14.0-3
changelog:
  - resolves: bug#1003979
  - In coordination with QE with regards to bz 1019934 it was requested
    the unittest patches be enhanced with a more robust version of
    test_pkcs12, no actual bug, just better testing.


author: John Dennis <jdennis@redhat.com> - 0.15.0-1
changelog:
  - resolves: bug#1109769 rebase to 0.15.0
  - includes fixes for 1087031 and 1060314
    See doc/Changelog for details


author: John Dennis <jdennis@redhat.com> - 0.16.0-1
changelog:
  - resolves: bug#1155703 - Add API call for SSL_VersionRangeSet (rebase)
    rebased to 0.16.0
  - The primary enhancements in this version is adding support for the
    setting trust attributes on a Certificate, the SSL version range API,
    information on the SSL cipher suites and information on the SSL connection.

    * The following module functions were added:

      - ssl.get_ssl_version_from_major_minor
      - ssl.get_default_ssl_version_range
      - ssl.get_supported_ssl_version_range
      - ssl.set_default_ssl_version_range
      - ssl.ssl_library_version_from_name
      - ssl.ssl_library_version_name
      - ssl.get_cipher_suite_info
      - ssl.ssl_cipher_suite_name
      - ssl.ssl_cipher_suite_from_name

    * The following deprecated module functions were removed:

      - ssl.nssinit
      - ssl.nss_ini
      - ssl.nss_shutdown

    * The following classes were added:

      - SSLCipherSuiteInfo
      - SSLChannelInfo

    * The following class methods were added:

      - Certificate.trust_flags
      - Certificate.set_trust_attributes

      - SSLSocket.set_ssl_version_range
      - SSLSocket.get_ssl_version_range
      - SSLSocket.get_ssl_channel_info
      - SSLSocket.get_negotiated_host
      - SSLSocket.connection_info_format_lines
      - SSLSocket.connection_info_format
      - SSLSocket.connection_info_str
  	
      - SSLCipherSuiteInfo.format_lines
      - SSLCipherSuiteInfo.format

      - SSLChannelInfo.format_lines
      - SSLChannelInfo.format

    * The following class properties were added:

      - Certificate.ssl_trust_flags
      - Certificate.email_trust_flags
      - Certificate.signing_trust_flags

      - SSLCipherSuiteInfo.cipher_suite
      - SSLCipherSuiteInfo.cipher_suite_name
      - SSLCipherSuiteInfo.auth_algorithm
      - SSLCipherSuiteInfo.auth_algorithm_name
      - SSLCipherSuiteInfo.kea_type
      - SSLCipherSuiteInfo.kea_type_name
      - SSLCipherSuiteInfo.symmetric_cipher
      - SSLCipherSuiteInfo.symmetric_cipher_name
      - SSLCipherSuiteInfo.symmetric_key_bits
      - SSLCipherSuiteInfo.symmetric_key_space
      - SSLCipherSuiteInfo.effective_key_bits
      - SSLCipherSuiteInfo.mac_algorithm
      - SSLCipherSuiteInfo.mac_algorithm_name
      - SSLCipherSuiteInfo.mac_bits
      - SSLCipherSuiteInfo.is_fips
      - SSLCipherSuiteInfo.is_exportable
      - SSLCipherSuiteInfo.is_nonstandard

      - SSLChannelInfo.protocol_version
      - SSLChannelInfo.protocol_version_str
      - SSLChannelInfo.protocol_version_enum
      - SSLChannelInfo.major_protocol_version
      - SSLChannelInfo.minor_protocol_version
      - SSLChannelInfo.cipher_suite
      - SSLChannelInfo.auth_key_bits
      - SSLChannelInfo.kea_key_bits
      - SSLChannelInfo.creation_time
      - SSLChannelInfo.creation_time_utc
      - SSLChannelInfo.last_access_time
      - SSLChannelInfo.last_access_time_utc
      - SSLChannelInfo.expiration_time
      - SSLChannelInfo.expiration_time_utc
      - SSLChannelInfo.compression_method
      - SSLChannelInfo.compression_method_name
      - SSLChannelInfo.session_id

    * The following files were added:

      - doc/examples/cert_trust.py
      - doc/examples/ssl_version_range.py

    * The following constants were added:
      - nss.CERTDB_TERMINAL_RECORD
      - nss.CERTDB_VALID_PEER
      - nss.CERTDB_TRUSTED
      - nss.CERTDB_SEND_WARN
      - nss.CERTDB_VALID_CA
      - nss.CERTDB_TRUSTED_CA
      - nss.CERTDB_NS_TRUSTED_CA
      - nss.CERTDB_USER
      - nss.CERTDB_TRUSTED_CLIENT_CA
      - nss.CERTDB_GOVT_APPROVED_CA
      - ssl.SRTP_AES128_CM_HMAC_SHA1_32
      - ssl.SRTP_AES128_CM_HMAC_SHA1_80
      - ssl.SRTP_NULL_HMAC_SHA1_32
      - ssl.SRTP_NULL_HMAC_SHA1_80
      - ssl.SSL_CK_DES_192_EDE3_CBC_WITH_MD5
      - ssl.SSL_CK_DES_64_CBC_WITH_MD5
      - ssl.SSL_CK_IDEA_128_CBC_WITH_MD5
      - ssl.SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
      - ssl.SSL_CK_RC2_128_CBC_WITH_MD5
      - ssl.SSL_CK_RC4_128_EXPORT40_WITH_MD5
      - ssl.SSL_CK_RC4_128_WITH_MD5
      - ssl.SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA
      - ssl.SSL_FORTEZZA_DMS_WITH_NULL_SHA
      - ssl.SSL_FORTEZZA_DMS_WITH_RC4_128_SHA
      - ssl.SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA
      - ssl.SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA
      - ssl.TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
      - ssl.TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_DES_CBC_SHA
      - ssl.TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
      - ssl.TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_DES_CBC_SHA
      - ssl.TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_anon_EXPORT_WITH_RC4_40_MD5
      - ssl.TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_anon_WITH_AES_128_CBC_SHA
      - ssl.TLS_DH_anon_WITH_AES_256_CBC_SHA
      - ssl.TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_anon_WITH_DES_CBC_SHA
      - ssl.TLS_DH_anon_WITH_RC4_128_MD5
      - ssl.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_EMPTY_RENEGOTIATION_INFO_SCSV
      - ssl.TLS_FALLBACK_SCSV
      - ssl.TLS_NULL_WITH_NULL_NULL
      - ssl.TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
      - ssl.TLS_RSA_EXPORT_WITH_RC4_40_MD5
      - ssl.TLS_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_RSA_WITH_AES_256_CBC_SHA256
      - ssl.TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_RSA_WITH_IDEA_CBC_SHA
      - ssl.TLS_RSA_WITH_NULL_MD5
      - ssl.TLS_RSA_WITH_NULL_SHA
      - ssl.TLS_RSA_WITH_NULL_SHA256
      - ssl.TLS_RSA_WITH_RC4_128_MD5
      - ssl.TLS_RSA_WITH_RC4_128_SHA
      - ssl.TLS_RSA_WITH_SEED_CBC_SHA
      - ssl.SSL_VARIANT_DATAGRAM
      - ssl.SSL_VARIANT_STREAM
      - ssl.SSL_LIBRARY_VERSION_2
      - ssl.SSL_LIBRARY_VERSION_3_0
      - ssl.SSL_LIBRARY_VERSION_TLS_1_0
      - ssl.SSL_LIBRARY_VERSION_TLS_1_1
      - ssl.SSL_LIBRARY_VERSION_TLS_1_2
      - ssl.SSL_LIBRARY_VERSION_TLS_1_3
      - ssl.ssl2
      - ssl.ssl3
      - ssl.tls1.0
      - ssl.tls1.1
      - ssl.tls1.2
      - ssl.tls1.3

     * The following methods were missing thread locks, this has been fixed.

       - nss.nss_initialize
       - nss.nss_init_context
       - nss.nss_shutdown_context


author: John Dennis <jdennis@redhat.com> - 0.16.0-3
changelog:
  - Resolves: #1225212
    Reads from file like objects actually only worked for file objects
  - Resolves: #1179573
    python-nss-doc package is missing the run_tests script
  - Resolves: #1194349
    test_pkcs12.py does not works in FIPS mode


author: Pavel Cahyna <pcahyna@redhat.com> - 2.1.1-3
changelog:
  - Fix a security flaw (CVE-2018-7750) in Paramiko's server
    mode (emphasis on **server** mode; this does **not** impact *client* use!)
    Backported from 2.1.5.
    Resolves #1557142


author: Pavel Cahyna <pcahyna@redhat.com> - 2.1.1-4
changelog:
  - Add a dependency on python2-pyasn1. It used to be a dependency
    of python2-cryptography, but it is not the case with newer versions.
    (RHBZ #1559133)


author: Jake Hunsaker <jhunsake@redhat.com> - 2.1.1-9
changelog:
  - Fix a security flaw (CVE-2018-1000805) in Paramiko's server
    mode (does not effect client mode).
    Backported from 2.1.6
    Resolves rhbz#1637366


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.12.1.el7]
changelog:
  - [ethernet] ixgbe: remove CIAA/D register reads from bad VF check (John Greene) [1245597 1205903]
  - [kernel] sched: Avoid throttle_cfs_rq() racing with period_timer stopping (Rik van Riel) [1241078 1236413]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.13.1.el7]
changelog:
  - [dma] ioat: fix tasklet tear down (Herton R. Krzesinski) [1251523 1210093]
  - [drm] radeon: Fix VGA switcheroo problem related to hotplug (missing hunk) (Rob Clark) [1207879 1223472]
  - [security] keys: Ensure we free the assoc array edit if edit is valid (David Howells) [1246039 1244171] {CVE-2015-1333}
  - [net] tcp: properly handle stretch acks in slow start (Florian Westphal) [1243903 1151756]
  - [net] tcp: fix no cwnd growth after timeout (Florian Westphal) [1243903 1151756]
  - [net] tcp: increase throughput when reordering is high (Florian Westphal) [1243903 1151756]
  - [of] Fix sysfs_dirent cache integrity issue (Gustavo Duarte) [1249120 1225539]
  - [tty] vt: don't set font mappings on vc not supporting this (Jarod Wilson) [1248384 1213538]
  - [scsi] fix regression in scsi_send_eh_cmnd() (Ewan Milne) [1243412 1167454]
  - [net] udp: fix behavior of wrong checksums (Denys Vlasenko) [1240760 1240761] {CVE-2015-5364 CVE-2015-5366}
  - [fs] Convert MessageID in smb2_hdr to LE (Sachin Prabhu) [1238693 1161441]
  - [x86] bpf_jit: fix compilation of large bpf programs (Denys Vlasenko) [1236938 1236939] {CVE-2015-4700}
  - [net] sctp: fix ASCONF list handling (Marcelo Leitner) [1227960 1206474] {CVE-2015-3212}
  - [fs] ext4: allocate entire range in zero range (Lukas Czerner) [1193909 1187071] {CVE-2015-0275}
  - [x86] ASLR bruteforce possible for vdso library (Jacob Tanenbaum) [1184898 1184899] {CVE-2014-9585}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.14.1.el7]
changelog:
  - [s390] zcrypt: Fixed reset and interrupt handling of AP queues (Hendrik Brueckner) [1248381 1238230]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.15.1.el7]
changelog:
  - [cpufreq] intel_pstate: Fix overflow in busy_scaled due to long delay (Prarit Bhargava) [1255496 1228346]
  - [netdrv] be2net: avoid vxlan offloading on multichannel configs (Ivan Vecera) [1256609 1232327]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.17.1.el7]
changelog:
  - [hv] vmbus: Cleanup vmbus_establish_gpadl() (Vitaly Kuznetsov) [1262096 1211914]
  - [scsi] iscsi: let session recovery_tmo sysfs writes persist across recovery (Chris Leech) [1261879 1139038]
  - [scsi] ipr: Fix invalid array indexing for HRRQ (Gustavo Duarte) [1260625 1251184]
  - [scsi] ipr: Fix incorrect trace indexing (Gustavo Duarte) [1260625 1251184]
  - [net] netfilter: synproxy: fix sending window update to client (Phil Sutter) [1257289 1257290 1251031 1242094]
  - [net] netfilter: ip6t_synproxy: fix NULL pointer dereference (Phil Sutter) [1257289 1257290 1251031 1242094]
  - [fs] nfsv4: Always drain the slot table before re-establishing the lease (Benjamin Coddington) [1256649 1240790]
  - [fs] Recover from stateid-type error on SETATTR (Benjamin Coddington) [1256639 1214410]
  - [netdrv] virtio-net: drop NETIF_F_FRAGLIST (Jason Wang) [1247839 1247840] {CVE-2015-5156}
  - [x86] mm: add memory tracking to native_pmdp_get_and_clear (David Bulkow) [1263525 1227357]
  - [fs] dcache: d_walk() might skip too much (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}
  - [fs] dcache: deal with deadlock in d_walk() (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}
  - [fs] dcache: move d_rcu from overlapping d_child to overlapping d_alias (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}
  - [fs] dcache: fold try_to_ascend() into the sole remaining caller (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.18.1.el7]
changelog:
  - [scsi] sd: split sd_init_command (Ewan Milne) [1264141 1109348]
  - [scsi] sd: retry discard commands (Ewan Milne) [1264141 1109348]
  - [scsi] sd: retry write same commands (Ewan Milne) [1264141 1109348]
  - [scsi] sd: don't use scsi_setup_blk_pc_cmnd for discard requests (Ewan Milne) [1264141 1109348]
  - [scsi] sd: don't use scsi_setup_blk_pc_cmnd for write same requests (Ewan Milne) [1264141 1109348]
  - [scsi] sd: don't use scsi_setup_blk_pc_cmnd for flush requests (Ewan Milne) [1264141 1109348]
  - [scsi] set sc_data_direction in common code (Ewan Milne) [1264141 1109348]
  - [scsi] restructure command initialization for TYPE_FS requests (Ewan Milne) [1264141 1109348]
  - [scsi] move the nr_phys_segments assert into scsi_init_io (Ewan Milne) [1264141 1109348]
  - [fs] xfs: remove bitfield based superblock updates (Brian Foster) [1261781 1225075]
  - [netdrv] ixgbe: fix X540 Completion timeout (John Greene) [1257633 1173786]
  - [lib] radix-tree: handle allocation failure in radix_tree_insert() (Seth Jennings) [1264142 1260613]
  - [crypto] nx - Fixing the limit number of bytes to be processed (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Fix SHA concurrence issue and sg limit bounds (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-XCBC to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-GCM to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-ECB to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving limit and bound logic in CTR and fix IV vector (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-CCM to be processed logic and sg_list bounds (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-CBC to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Check for bogus firmware properties (Herbert Xu) [1247127 1190103]
  - [md] raid1: extend spinlock to protect raid1_end_read_request against inconsistencies (Jes Sorensen) [1263416 1255758]
  - [md] raid1: fix test for 'was read error from last working device' (Jes Sorensen) [1263416 1255758]
  - [fs] xfs: direct IO EOF zeroing needs to drain AIO (Brian Foster) [1258942 1213370]
  - [fs] xfs: DIO write completion size updates race (Brian Foster) [1258942 1213370]
  - [fs] pnfs: Fix a memory leak when attempted pnfs fails (Steve Dickson) [1256640 1234986]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.19.1.el7]
changelog:
  - Revert: [fs] xfs: DIO write completion size updates race (Phillip Lougher) [1258942 1213370]
  - Revert: [fs] xfs: direct IO EOF zeroing needs to drain AIO (Phillip Lougher) [1258942 1213370]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.20.1.el7]
changelog:
  - Revert: [crypto] nx - Check for bogus firmware properties (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-CBC to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-CCM to be processed logic and sg_list bounds (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving limit and bound logic in CTR and fix IV vector (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-ECB to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-GCM to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-XCBC to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Fix SHA concurrence issue and sg limit bounds (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Fixing the limit number of bytes to be processed (Phillip Lougher) [1247127 1190103]


author: Roman Rakus <rrakus@redhat.com> - 2.0.0-12
changelog:
  - Mark doc subpackage arch dependent. Docs are built depending on supported
    features, which are different across archs.
    Resolves: rhbz#987839


author: Charalampos Stratakis <cstratak@redhat.com> - 2.0.0-23gitd1c6db8
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042522


author: Miro Hrončok <mhroncok@redhat.com> - 9.0.3-2
changelog:
  - Allow to import pip10's main from pip9's /usr/bin/pip
  - Do not show the "new version of pip" warning outside of venv
  Resolves: rhbz#1569488
  Resolves: rhbz#1571650
  Resolves: rhbz#1573755


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-3
changelog:
  - Converting pip specfile from F28 to RHEL7
  - Disabled building of the Python 2 subpackage
  - Disabled building of docs, because we don't ship its build dependencies in
    RHEL7
  - Updated to a newer version of tests to match the package version
  - Backported Patch3 and Patch4 from Fedora
  Resolves: rhbz#1660573


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-6
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Devrim Gündüz <devrim@gunduz.org> 2.5-1
changelog:
  - Update to 2.5, per changes described at:
    http://www.psycopg.org/psycopg/articles/2013/04/07/psycopg-25-released/


author: Thomas Moschny <thomas.moschny@gmx.de> - 1.4.14-2
changelog:
  - Use python-sphinx for rhel > 6 (rhbz#973321).
  - Update URL.
  - Fix changelog entry with an incorrect date (rhbz#973325).


author: Jamie Nguyen <jamielinux@fedoraproject.org> - 0.1.6-1
changelog:
  - update to upstream release 0.1.6
  - update modules to 0.0.4
  - update description
  - add python3-pyasn1 subpackage
  - add versioned Requires for the module subpackages
  - add %check section


author: Steve Milner <smilner@fedoraproject.org> - 1.4-1
changelog:
  - update for upstream release
  - Add python2.6 support done by Steve Traylen <steve.traylen@cern.ch>. BZ#662755.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.4-2
changelog:
  - Fix python main package having dependencies for the python2.6 subpackage
  - Fix places that used the default python instead of python26
  - Attempt to make byte compilation more robust in case we add python3 to EPEL5
  - Run unittests on python3 in F15+


author: Michel Salim <salimma@fedoraproject.org> - 2.4.1-2
changelog:
  - Clean up spec, removing unnecessary declarations
  - Rename tool in %{_bindir} to the less ambiguous qrcode


author: David Sloboda <david.x.sloboda@oracle.com> - 2.1.72-1.0.1
changelog:
  - Add patch 0005-allow-mixed-case-in-oracle-iqns to fix [Orabug: 27613482]
  - Add patch 0004-allow-underscore-in-oracle-iqns to fix [Orabug: 27582660]
  - Add patch 0014-reenable-vhost to fix [Orabug: 27707403] <alan.adamson@oracle.com>


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb63-5
changelog:
  - rtslib never creates hba directories without a storage object within it,
    but if under some circumstance these existed then we should remove them.


author: EL Errata <el-errata_ww@oracle.com> - 2.1.fb63-11.0.1
changelog:
  - Add patch 0005-allow-mixed-case-in-oracle-iqns to fix [Orabug: 27613482]
  - Add patch 0004-allow-underscore-in-oracle-iqns to fix [Orabug: 27582660]


author: Nils Philippsen <nils@redhat.com> - 0.2.19-1
changelog:
  - allow service object methods to be called locally
  - preserve signature, docstrings, etc. of decorated methods


author: Nils Philippsen <nils@redhat.com> - 0.4.0-1
changelog:
  - version 0.4.0:
    - get rid of (ancient) PolicyKit-0.x support
    - add basic (experimental, unstable) dbus introspection support
    - learn to cope with polkitd being restarted


author: Charalampos Stratakis <cstratak@redhat.com> - 0.4.0-3
changelog:
  - Make firewalld to not log errors when running commands as root
  in the absence of polkitd.
  Resolves: rhbz#1393488


author: Charalampos Stratakis <cstratak@redhat.com> - 1.0.13-8
changelog:
  - Fix memory leak in the auth_fn callback.
  - Make sure auth info is NUL-terminated.
  Resolves: rhbz#1248519


author: Thomas Spura <tomspur@fedoraproject.org> - 2.2.1-1
changelog:
  - update to upstream release 2.2.1 (fixes CVE-2012-2374)
  - fix typo for epel6 macro bug #822972 (Florian La Roche)


author: Julian Sikorski <belegdol@fedoraproject.org> - 11.1.0-1
changelog:
  - Updated to 11.1.0
  - Obsoleted zsh subpackage (upstream ticket #3078)
  - mktap is gone (upstream ticket #5293)
  - Dropped obsolete Group, Buildroot, %clean and %defattr


author: Lumír Balhar <lbalhar@redhat.com> - 12.1.0-7
changelog:
  - Fix CVE-2020-10108 and CVE-2020-10109 multiple HTTP request smuggling vulnderabilities
  Resolves: rhbz#1813439 rhbz#1813447
  - Remove useless macros definitions


author: Ralph Bean <rbean@redhat.com> - 1.5-4
changelog:
  - Upstream patch to fix Accept header when behind a proxy.
  - Reorganize patch numbers to more clearly distinguish them.


author: bkabrda <bkabrda@redhat.com> - 1.10.2-2
changelog:
  - Fix the way we unbundle six to make ovirt work even when they remove .py files
  Resolves: rhbz#1247093


author: Lumir Balhar & Tomas Orsava <lbalhar@redhat.com> - 3.6.8-2
changelog:
  - Converting F28 python3 specfile to RHEL7
  - Updated the bootstrapping sequence
  - Disabled LTO because of buggy support for it in gcc on RHEL7
  - Removed deprecated system-python and platform-python tags and files
  - Removed a tag from `python3-libs` that recommended the `python3` package,
    because the Recommends tag doesn't work in RHEL7
  - Remove unnecessary unversioned requires on glibc and gdbm
  - Changes from RHEL8:
    - Move macros.pybytecompile to python-rpm-macros
    - Enable test_gdb, test_faulthandler
  - Changes from Fedora:
    - Security fix for CVE-2019-5010 (#1666519, #1666522)
    - Make sure we don't ship any exe files (not needed an prebuilt)
  Resolves: rhbz#1597718


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-4
changelog:
  - Add explicit conflicts with python34 < 3.4.9-3, which was the main python3
    package in EPEL before that version and contained conflicting files,
    e.g. /usr/bin/python3
  Resolves: rhbz#1597718


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-8
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1703535 and rhbz#1704364


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-19
changelog:
  - Security fix for CVE-2023-24329
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2173917


author: EL Errata <el-errata_ww@oracle.com> - 3.6.8-19.0.1
changelog:
  - Remove the "getfile" feature of pydoc [Orabug: 33182027][CVE-2021-3426]
  - Fix buffer overflow in PyCArg_repr [Orabug: 32551171][CVE-2021-3177]
  - Add Oracle Linux distribution in platform.py [Orabug: 20812544]


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-7
changelog:
  - Converting specfile from F28 to RHEL7
  - Tests disabled because the minimal RHEL7 Python 3 stack does not contain test
    dependencies
  - Disabled building of the Python 2 subpackage
  Resolves: rhbz#1660563


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-8
changelog:
  - SRPM renamed from python-setuptools to python3-setuptools
  - Package prepared to contain only Python 3 version
  Resolves: rhbz#1660563


author: Rex Dieter <rdieter@fedoraproject.org> - 0.0.4-2
changelog:
  - update summary/description/Source_url
  - %files: track soname
  - cleaner cmake-fu
  - upstream noexecstack patch


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 0.0.4-3
changelog:
  - require the main package with exact version-release in -examples
  - remove explicit Requires: qt4-devel pkgconfig from -devel, now autodetected


author: Rex Dieter <rdieter@fedoraproject.org> - 0.7.1-8
changelog:
  - skip stripping some compiler flags (undocumented)
  - %files: track files closer (lib soname in particular)
  - -devel: avoid dep on cmake 
  - %check: +make test, pkgconfig check


author: Matthieu Saulnier <fantom@fedoraproject.org> - 3.2.0-1
changelog:
  - update to 3.2.0
  - remove BuildRoot tag in spec file
  - remove "rm -rf $RPM_BUILD_ROOT" at the beginning of %install section
  - remove %clean section
  - remove %defattr lines
  - add a joker for libqrencode.so.* files


author: Peter Gordon <peter@thecodergeek.com> - 3.2.0-2
changelog:
  - Add patch to fix improper LIBPTHREAD macro in the pkgconfig file:
    + fix-LIBPTHREAD-macro.patch
  - Resolves: #795582 (qrencode-devel: Malformed pkgconfig file causes build to
    fail ("@LIBPTHREAD@: No such file or directory"))


author: Matthieu Saulnier <fantom@fedoraproject.org> - 3.3.1-1
changelog:
  - update to 3.3.1
  - remove "Group" tag in spec file
  - fix manfile suffix
  - remove patch to fix improper LIBPTHREAD macro in the pkgconfig file:
    - upstream issue


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-4
changelog:
  - Bump build version for RPM to not consider z-stream build as newer
    Revert fix for font cache check in QFontEngineFT::recalcAdvances()
    Resolves: bz#1684167


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-8
changelog:
  - Fix QImage allocation failure in qgifhandler
    Resolves: bz#1667863

  - Fix QTgaFile CPU exhaustion
    Resolves: bz#1667879

  - Fix QBmpHandler segmentation fault on malformed BMP file
    Resolves: bz#1667862


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-14
changelog:
  * Mon May 02 2016 Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-13
  - Prefer adwaita-qt theme over gtk
    Resolves: bz#1332094


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-1
changelog:
  - Update to 4.8.7 (+ sync with Fedora)
    Resolves: bz#1484361

  - Don't close Qt apps in Gnome on shutdown dialog
    Resolves: bz#1378865


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-8
changelog:
  - make 10-qt5-check-opengl2.sh xinit script more robust
  - enable journald support for el7+ (#1315239)


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-4
changelog:
  - backport upstream fixes
  - drop -fno-delete-null-pointer-checks hack (included in qt5-rpm-macros as needed now)


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-2
changelog:
  - libwebp security fixes:
    Resolves: bz#1961742
    Resolves: bz#1961743
    Resolves: bz#1961744
    Resolves: bz#1961745


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-7
changelog:
  - quagga is service which might implement networking, thus it should not have
    WantedBy=network.target in its systemd configuration
  - resolves: #976883


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.3-1
changelog:
  - update to 0.99.22.3
  - disable ospfapi and ospfclient
  - fix bogus dates in changelog
  - resolves : #984532


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.4-4
changelog:
  - fix link to upstream tarball (#1059219)
  - reference pidfiles of quagga daemons in service files (#842309)


author: Ondřej Lysoněk <olysonek@redhat.com> - 0.99.22.4-5
changelog:
  - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing
    certain forms of UPDATE message allowing to crash or potentially execute
    arbitrary code
  - Resolves: rhbz#1546015


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-9
changelog:
  - Move /sbin/* files under /usr (bug #983179)
  - Harden executables due to rpc.rquotad and quota_nld daemons (bug #983179)
  - Document quotagrpadmins(5), quotatab(5), warnquota.conf(5), rcp.rquota(8)
    (bug #983179)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-12
changelog:
  - Do not warn if rquotad RPC service is not registered (bug #1155584)
  - Query kernel for next quota on XFS or file system with hidden quota files
    (bug #1305968)
  - Add rpc-rquotad.service file which was known as nfs-rquotad.service
    in nfs-utils (bug #1207239)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-14
changelog:
  - Add nfs-rquotad.service alias for backward compatibility (bug #1207239)
  - Start rpc-rquotad.service when starting nfs-server.service (bug #1207239)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-18
changelog:
  - Distinguish between none quota limits and no allocated resources in quota(1)
    tool (bug #1601109)


author: Mridula Shastry <mridula.c.shastry@oracle.com> - 0.8.1-11.0.1
changelog:
  - rarian-sk-gen-uuid: Fix incorrect output and buffer overflow
  <stanislav.kholmanskikh@oracle.com> <bert.barbe@oracle.com>
  [Orabug 31074163]
  - rarian-main: Add missing null check in scan_directory function
  <bert.barbe@oracle.com> [Orabug 31074163]


author: Prarit Bhargava <prarit@redhat.com>
changelog:
  - Initial import from https://github.com/andikleen/mce-inject.git
  - Initial import from git://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git


author: Prarit Bhargava <prarit@redhat.com>
changelog:
  - Initial import from git://git.kernel.org/pub/scm/utils/cpu/mce/mce-test.git
  - updated mce-inject to commit 4cbe4632


author: Jarod Wilson <jarod@redhat.com> - 12-3
changelog:
  - Take libi40iw out of tech-preview state (rhbz 1428930)
  - Add ibv_*_pingpong man pages (rhbz 1416541)


author: Jarod Wilson <jarod@redhat.com> - 12-4
changelog:
  - Clean up devel files list
  - Fix up a few dependencies rpmdiff complained about (rhbz 1404035)
  - Add Requires: pciutils for dracut to behave in minimalist cases (rhbz 1429046)
  - Adjust Conflicts: on infiniband-diags to match RHEL packaging (rhbz 1428785)


author: Jarod Wilson <jarod@redhat.com> - 13-1
changelog:
  - Update to rdma-core v13 release (rhbz 1404035)
  - Mellanox mlx5 Direct Verbs support (rhbz 1426430)
  - Get build working on s390x, less mlx5 (rhbz 1434029)


author: Jarod Wilson <jarod@redhat.com> 22-1
changelog:
  - Rebase to upstream rdma-core v22
  - Resolves: rhbz#1641921
  - Add mlx5 IB Device Memory support (MEMIC)
  - Resolves: rhbz#1644697
  - Add mlx5 Tunnel protocol RX decap/encap offload
  - Resolves: rhbz#1644709
  - Add mlx5 Tunnel protocol TX decap/encap offload
  - Resolves: rhbz#1644778
  - Add support for mlx5 infiniband flow counters
  - Resolves: rhbz#1644714
  - Add mlx5 DEVX interface
  - Resolves: rhbz#1644722
  - Add libbnxt_re support for SRQ
  - Resolves: rhbz#1570393


author: Jarod Wilson <jarod@redhat.com> 22.1-1
changelog:
  - Update to upstream v22.1 release with stable-v22 branch fixes
  - Add support for Broadcom 57500 RoCE adapter
  - Resolves: rhbz#1678274


author: Jarod Wilson <jarod@redhat.com> 22.4-1
changelog:
  - Update to v22.4 stable release
  - Support mlx5 scatter to CQE over DCT QP
  - Fix ibacm segfault on non-IB hardware
  - Resolves: rhbz#1715489
  - Resolves: rhbz#1712296


author: Sumit Bose <sbose@redhat.com> - 0.16.1-6
changelog:
  - Resolves: rhbz#1258745
  - Resolves: rhbz#1258488
  - Resolves: rhbz#1267563
  - Resolves: rhbz#1293390
  - Resolves: rhbz#1273924
  - Resolves: rhbz#1274368
  - Resolves: rhbz#1291924


author: Sumit Bose <sbose@redhat.com> - 0.16.1-10
changelog:
  Use current Samba options and read NetBIOS name from keytab
  - Resolves: rhbz#1484072
  - Resolves: rhbz#1370457


author: Sumit Bose <sbose@redhat.com> - 0.16.1-12
changelog:
  Fixes for RHEL-7.9
  - Resolves: rhbz#1625001
  - Resolves: rhbz#1625005
  - Resolves: rhbz#1638396
  - Resolves: rhbz#1714223
  - Resolves: rhbz#1832134


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-7
changelog:
  - Backport fix for upstream bug 1913 (backup succeeds in case of tar error)
    Resolves: rhbz1631183
  - Apply upstream patch PR1885
    Partition information recorded is unexpected when disk has 4K block size
    Resolves: rhbz1610638
  - Apply upstream patch PR1887
    LPAR/PPC64 bootlist is incorrectly set when having multiple 'prep' partitions
    Resolves: rhbz1610647
  - Apply upstream patch PR1993
    Automatically exclude $BUILD_DIR from the backup
    Resolves: rhbz1655956
  - Require xorriso instead of genisoimage, it is now the preferred method
    and supports files over 4GB in size.
    Resolves: rhbz1462189


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-8
changelog:
  - Backport fix for upstream issue 2187 (disklayout.conf file contains
    duplicate lines, breaking recovery in migration mode or when
    thin pools are used). PR2194, 2196.
    Resolves: rhbz1732328


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-9
changelog:
  - Apply upstream PR2173 - Cannot restore using Bacula method
    due to "bconsole" not showing its prompt
    Resolves: rhbz1726982


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-11
changelog:
  - Apply upstream PR2122: add additional NBU library path to fix support for
    NetBackup 8.
    Resolves: rhbz1700807
  - Apply upstream PR212: Be safe against empty docker_root_dir (issue 1989)
    Resolves: rhbz1711123, where ReaR can not create a backup in rescue mode,
    because it thinks that the Docker daemon is running and hits the problem
    with empty docker_root_dir.
  - Apply upstream PR2223 and commit 36cf20e to avoid an empty string in the
    list of users to clone, which can lead to bash overflow with lots of users
    and groups per user and to wrong passwd/group files in the rescue system.
    Resolves: rhbz1692575
  - Backport of Upstream fix for issue 2035: /run is not mounted in the rescue
    chroot, which causes LVM to hang, especially if rebuilding initramfs.
    Resolves: rhbz1697815
  - Backport upstream PR 2218: avoid keeping build dir on errors
    by default when used noninteractively
    Resolves: rhbz1693608


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-15
changelog:
  - Backport PR2608:
    Fix setting boot path in case of UEFI partition (ESP) on MD RAID
    Resolves: rhbz1945869
  - Backport PR2625 & 2675
    Prevents accidental backup removal in case of errors
    Resolves: rhbz1843585
  - Fix rsync error and option handling
    Fixes metadata storage when rsync user is not root
    Resolves: rhbz1947064
  - Changes for NetBackup (NBU) support, upstream PR2544
    Resolves: rhbz2031833
  - On POWER add bootlist & ofpathname to the list of required programs
    conditionally (bootlist only if running under PowerVM, ofpathname
    always except on PowerNV) - upstream PR2665, add them to package
    dependencies
    Resolves: rhbz1983008
  - On POWER mount /sys in the chroot, otherwise ofpathname does not work
    and we risk ending up with not instlaling the bootloader properly
    Resolves: rhbz1983000


author: Zoltan Kota <z.kota[AT]gmx.net> 3.6-29
changelog:
  - Fix build on x86_64. Run autoreconf to update config files.
    autoconf >= 2.64 needs to patch the flex.m4 file.
    Fixing FTBFS bug #564601.


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-18
changelog:
  - Require sil-abyssinica-fonts in supplemental(#994341)
  - Fully specify requirements on subpackages(#971386)


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.5-9
changelog:
  - Install LICENSE file with javadoc package
  - Add maven POM file
  - Update to current packaging guidelines
  - Convert versioned JAR to unversioned


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.0-10.5
changelog:
  - Install license file with javadoc package
  - Convert versioned javadoc to versionless
  - Update to current packaging guidelines
  - Remove msv provides and obsoletes


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.8
changelog:
  - gcp-vpc-move-route, gcp-vpc-move-vip: add project parameter and
    make vpc_network parameter optional

    Resolves: rhbz#1913936


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.13
changelog:
  - SAPHana: use actual_mode from global.ini and fallback to mode when
    it's not set

    Resolves: rhbz#1855888


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.15
changelog:
  - gcp-pd-move/gcp-vpc-move-route/gcp-vpc-move-vip: dont fail with
    configuration rc when it might be a network hickup

    Resolves: rhbz#2042070


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.18
changelog:
  - db2: add PRIMARY/REMOTE_CATCHUP_PENDING/CONNECTED status to promote-check

    Resolves: rhbz#2127477


author: Ade Lee <alee@redhat.com> - 2.3.2-11
changelog:
  - Removed unneeded maven-checkstyle-plugin BR
  - Removed Tomcat 6 dependency
  - Replaced maven BR with maven-local


author: Ade Lee <alee@redhat.com> - 2.3.2-12
changelog:
  - Removed modules not needed for pki-core
  - Bugzilla # 973224 - resteasy-base must be split into subpackages to 
    simplify dependencies.  With help from msrb.


author: Elliott Baron <ebaron@redhat.com> - 1.7R5-1
changelog:
  - Update to 1.7R5.
  - Add rhino-backout-686806.patch for backward compatibility.
  - Resolves: rhbz#1350331


author: Natalya Naumova <natalya.naumova@oracle.com> 2.0.2-24.0.1
changelog:
  - Fix Empty UUID Workaround
  - Obsolete subscription-manager-plugin-container and subscription-manager-initial-setup-addon
  - Updated public-yum-ol7.repo [ OraBug 26241827 ] (Keshav Sharma)
  - Missing fixes for bug 24659077 [OraBug 24659077]
  - Update ULN-CA-CERT [OraBug 24825502]
  - update public-yum-ol7.repo file [Orabug 24659077]
  - added ceph repository to public-yum-ol7.repo file [Orabug 24910502]
  - enable UEKR4 repository in public-yum-ol7.repo file [Orabug 25031255]
  - Replace Redhat string with ULN
  - do not move repo files [orabug 22230790]
  - added repo entry for 7.2  base  in public-yum repo file.
  - replace up2date.png in tarball [bug 20542844]
  - fix public-yum-ol7.repo [orabug 20281779]
  - fix indentation error in rhnreg_ks/ulnreg_ks [bug 20369398]
  - remove --use-eus-channel option from rhnreg_ks/ulnreg_ks [bug 20369398]
  - Enable rhnreg_ks register to spacewalk server, BZ14791
  - Fixes for RHEL-> ULN Migration
  - Fixed public-yum-ol7.repo file [OraBug 19176214]
  - Added 7.1 entries to public-yum-ol7.repo file [OraBug 20281779]
  - Merge ksplice firstboot plugin from 1.0.0.1-17.0.3.el6
  - Fixed text in rh_register.glade [Orabug 19192726] (Keshav Sharma)
  - Fixed error text in rhnregGui.py [Orabug 19167535] (Keshav Sharma)
  - Added MySQL repositories to public-yum-ol7.repo file. (Keshav Sharma)
  - Fix text in up2date.config file [Orabug 18892489] (Keshav Sharma)
  - Fix url in public-yum.ol7.repo file (Keshav Sharma)
  - Fix firstboot issue [Orabug 18851116] (Keshav Sharma)
  - Fix display text [Orabug 19051197] (Keshav Sharma)
  - Fix public-yum.repo file [Orabug 18380583] (Keshav Sharma)
  - Fix bug 18910928 (Leon Wang)
  - Add ULN-specific changes (Jared Greenwald)
  - Updated public-yum-ol7.repo [Orabug 27696955]
  - Updated public-yum-ol7.repo file for aarch64 [OraBug 27029619] (keshav.sharma@oracle.com)
  - Updated public-yum-ol7.repo
  - Updated public-yum-ol7.repo [Orabug 28375712]
  - Updated replacement ULN-CA-CERT
  - updated public-yum-ol7.repo for 7.6 beta [Orabug 28624952]
  - updated public-yum-ol7.repo for 7.6


author: Florian Festi <ffesti@redhat.com> - 4.11.3-28
changelog:
  - Make sure files in /usr/src/debug are not world writable (RHBZ #1441098)
  - Increase maximal header size (RHBZ #1434656)
  - Increase buffer to be able to render Korean dates (RHBZ #1425231)
  - Add --noconfig option (RHBZ #1406611)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.3-31
changelog:
  - Backport missing infra for --noconfig option (#1406611)
  - As a side-effect, this also makes --noghost work as intended


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-33
changelog:
  - Repair of --noghost option implementation (#1395818)
  - Backport fix rpmSign() return value in case of failure (#1419590)
  - Backport passing _find_debuginfo_opts -g to eu-strip for executables
    (#1540653)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-34
changelog:
  - Adjust --noghost documentation (#1395818)
  - Provide audit events on update verification (#1555326)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-36
changelog:
  - Add popt-based options --setcaps and --restore (#1550745)
  - Improve hardlink handling in disk space calculation (#1491786)
  - Remove perl dependencies that are provided in the same file (#1570181)


author: Florian Festi <ffesti@redhat.com> - 4.11.3-22
changelog:
  - Move rpm-plugin-systemd-inhibit man page to that package (#1360706)
  - Fix off by one error in base64 code (#1341913)
  - Add sources to lua to prevent %autosetup failing in some cases (#1359084)
  - Fix refcounting for Python hdr objects (#1358467)
  - Perl dependecy generator: Skip blocks after variable definitions (#1378307)
  - Verify signatures properly (#1371487)
  - Export function in Python binding for yum (#1343692)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1.4.8-1
changelog:
  - New version
    Resolves: rhbz#966639
  - Updated and defuzzified patches
  - Still use lua-5.1 (fedoras < f20)


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-8
changelog:
  RHEL 7.4 ERRATUM
  - added dependency automake autoconf libtool due to yum-builddep
  - reenable omruleset module
    resolves: rhbz#1431615
    resolves: rhbz#1428403
    resolves: rhbz#1427821(fix regression, failed QA)
    resolves: rhbz#1432069
  - resolves: rhbz#1165236
    resolves: rhbz#1419228
    resolves: rhbz#1431616 
    resolves: rhbz#1196230(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-9
changelog:
  RHEL 7.4 ERRATUM
  - added autoreconf call
  - added patch to replace gethostbyname with getaddrinfo call
    resolves: rhbz#1056548(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-10
changelog:
  RHEL 7.4 ERRATUM
  - edited patches Patch19 and Patch21
    resolves: rhbz#1419228(coverity scan problems)
    resolves: rhbz#1056548(failed QA, coverity scan problems)


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-11
changelog:
  RHEL 7.4 ERRATUM
  - added new patch that backports num2ipv4 due to rhbz#1427821
    resolves: rhbz#1427821
  - enable pmrfc3164sd module
    resolves: rhbz#1431616


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-13
changelog:
  RHEL 7.5 ERRATUM
  - added patch to properly resolve FQDN
    resolves: rhbz#1401456
  - added documentation patch correcting qeues default values
    resolves: rhbz#1459896
  - added patch adjusting log level of journal reloaded msg
    resolves: rhbz#1497985 
  - added patch to prevent crash with invalid set statement
    this also obsoletes patch2 (for 1188503) 
    resolves: rhbz#1462160
  - added patch with nullptr check to prevent ABRT
    resolves: rhbz#1488186


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-14
changelog:
  RHEL 7.5 ERRATUM
  - renamed patch for undocumented recover_qi script to correct bz number
    resolves: rhbz#1507028
  - added patch ensuring relp conneciton is active before closing it
    resolves: rhbz#1505103


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-15
changelog:
  RHEL 7.5 ERRATUM
  - made rsyslog-doc noarch and fixed search on doc regeneration
    resolves: rhbz#1507028


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16
changelog:
  RHEL 7.5 ERRATUM
  - edited the patch to conform to latest upstream doc
    resolves: rhbz#1459896 (failedQA)
  - disabled 32-bit builds on all arches as they are not shipped
    anymore in RHEL7


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16.5
changelog:
  RHEL 7.5.z ERRATUM
  - fixed imjournal duplicating msgs under some conditions
    resolves: rhbz#1545582


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-24
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with fixes from covscan
    resolves: rhbz#1531295
  - updated mmkubernetes patch with fixes from covscan
    resolves: rhbz#1539193
  - updated imjournal duplicates patch with fixes from covscan
    resolves: rhbz#1538372
  - updated omelastic enhancement patch with fixes from covscan
    resolves: rhbz#1565214


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-26
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch according to early testing
    resolves: rhbz#1531295
  - added patch fixing pid file name in manpage
    resolves: rhbz#1597264
  - updated json-parsing patch with one more bugfix
    resolves: rhbz#1565219


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-27
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch fixing last update regressions
    resolves: rhbz#1531295
  - added patch fixing deadlock in async logging
    resolves: rhbz#1559408
  - added patch fixing NULL access in worktable create
    resolves: rhbz#1600462
  - now putting release number into configure to have it present
    in error messages


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-28
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch fixing next round of regressions
    resolves: rhbz#1531295
    resolves: rhbz#1602156
  - updated mmkubernetes patch with NULL ret-check
    resolves: rhbz#1539193


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-30
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with next bugfix
    resolves: rhbz#1531295
  - updated imjournal duplicates patch making slower code optional
    and added corresponding doc patch
    resolves: rhbz#1538372


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-31
changelog:
  RHEL 7.6 ERRATUM
  - added new patch fixing ompipe dropping messages when pipe full
    resolves: rhbz#1591819
  - updated mmkubernetes patch to accept non-kubernetes containers
    resolves: rhbz#1539193
    resolves: rhbz#1609023
  - removed json-parsing patches as the bug is now fixed in liblognorm


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-32
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with no log on EACCES
    resolves: rhbz#1531295
  - removed now needless build-deps


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-33
changelog:
  RHEL 7.6 ERRATUM
  - updated imfile rewrite patch with extended symlink watching
    resolves: rhbz#1531295
  - updated mmkubernetes patch to accept dots in pod name
    resolves: rhbz#1539193


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-35
changelog:
  RHEL 7.7 ERRATUM
  - added patch fixing memory corruption in omfwd module
    resolves: rhbz#1632659
  - added patch fixing imfile sopping monitor after rotation
    resolves: rhbz#1649250
  - added patch addressing imptcp CVE-2018-16881
    resolves: rhbz#1658288


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-36
changelog:
  RHEL 7.7 ERRATUM
  - added patch fixing mmkubernetes halt after pod deletition
    resolves: rhbz#1622767


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-37
changelog:
  RHEL 7.7 ERRATUM
  - edited patch fixing mmkubernetes halt after pod deletition
    (covscan found an issue in previous version)
    resolves: rhbz#1622767
  - added patch stopping flooding logs with journald errors
    resolves: rhbz#1632211
  - added patch stopping flooding logs with symlink false-positives
    resolves: rhbz#1685901
  - added patch stopping memory leak when processing internal msgs
    resolves: rhbz#1666365
  - added documentation patch with info about CRI-O to mmkubernetes
    resolves: rhbz#1625935


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-38
changelog:
  RHEL 7.7 ERRATUM
  - added patch increasing max path size preventing buffer overflow
    with too long paths
    resolves: rhbz#1656860


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.1
changelog:
  RHEL 7.7.z ERRATUM
  - added patch resolving possible segfault in core-ratelimiter
    resolves: rhbz#1746497


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.2
changelog:
  RHEL 7.7.z ERRATUM
  - edited imjournal memleaks patch to fix introduced regression
    resolves: rhbz#1752424


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.3
changelog:
  RHEL 7.7.z ERRATUM
  - added patch fixing hash file_id feature to properly monitor files
    after rotation
    resolves: rhbz#1805675


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41.4
changelog:
  RHEL 7.7.z ERRATUM
  - edited patch fixing hashed file_ids for imfile statefiles
    resolves: rhbz#1805675


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-41
changelog:
  RHEL 7.8 ERRATUM
  - added patch and doc-patch with new "fsync" imjournal option
    resolves: rhbz#1696686
  - added patch resolving omelasticsearch crash on "nothing" reply
    resolves: rhbz#1684236


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-44
changelog:
  RHEL 7.8 ERRATUM
  - added patch and doc-patch for new caseSensitive imUDP/TCP option
    resolves: rhbz#1309698


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-46
changelog:
  RHEL 7.8 ERRATUM
  - Support Intermediate Certificate Chains in rsyslog
    resolves: rhbz#1627799
  - fixed WorAroundJournalBug patch to not cause leaks
    resolves: rhbz#1744617
  - added patch fixing possible segfault in rate-limiter
    resolves: rhbz#1744682


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-47
changelog:
  RHEL 7.8 ERRATUM
  - edited imfile truncation detection patch with reression fix
    resolves: rhbz#1744856


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-48
changelog:
  RHEL 7.8 ERRATUM
  - added patch resolving crash on wrong MsgProperty
    resolves: rhbz#1549706
  - added patch resolving CVE in pmaixforward module
    resolves: rhbz#1768320
  - added patch resolving CVE in pmcisconames module
    resolves: rhbz#1768323
  - added patch implementing file ID for imfile
    resolves: rhbz#1763746
  - added patch fixing omelasticsearch with ES 6.X
    resolves: rhbz#1600171


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-49
changelog:
  RHEL 7.8 ERRATUM
  - fixed fsync patch to actually revognize the new option
    resolves: rhbz#1696686 (failedQA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-52
changelog:
  RHEL 7.8 ERRATUM
  - edited patch file ID for imfile to not log useless errors
    also improved file-id behavior to adress newly found problems
    resolves: rhbz#1763746


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-53
changelog:
  RHEL 7.9 ERRATUM
  - one more fix for file ID patch to extend to offline behavior
    resolves: rhbz#1806493
  - added patch resoving race in serialization resulting in crash
    resolves: rhbz#1778841


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-55
changelog:
  RHEL 7.9 ERRATUM
  - edited imfile file-id patch to not segfault on selinux block
    resolves: rhbz#1843992


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-57
changelog:
  RHEL 7.9 ERRATUM
  - added patch resolving buffer overflows in select() function
    resolves: rhbz#1858297


author: Tianyue Lan <tianyue.lan@oracle.com> - 8.24.0-57.0.1.el7_9.1
changelog:
  - added patch to flush the journal state file [Orabug: 32583987] (venu.busireddy@oracle.com)
  - Reviewed-by: Laurence Rochfort <laurence.rochfort@oracle.com>


author: Venu Busireddy <venu.busireddy@oracle.com> - 8.24.0-57.0.1
changelog:
  - added patch to flush the journal state file [Orabug: 32583987]
  - Reviewed-by: Laurence Rochfort <laurence.rochfort@oracle.com>


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-14
changelog:
  - add a patch to prevent loss of partial messages
    resolves: rhbz#1312459
  - add a patch to allow multiple rulesets in imrelp
    resolves: rhbz#1223566
  - add a patch to fix a race condition during shutdown
    resolves: rhbz#1295798
  - add a patch to backport the mmutf8fix plugin
    resolves: rhbz#1146237
  - add a patch to order service startup after the network
    resolves: rhbz#1263853


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-15
changelog:
  - add a patch to make state file handling in imjournal more robust
    resolves: rhbz#1245194
  - add a patch to support wildcards in imfile
    resolves: rhbz#1303617


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-6
changelog:
  - RHEL 7.4 ERRATUM
  - rsyslog rebase to 8.24
  - added patch to prevent segfault while setting aclResolveHostname
    config options
    resolves: rhbz#1422414
  - added patch to check config variable names at startup
    resolves: rhbz#1427828
  - added patch for str2num to handle empty strings
    resolves: rhbz#1427821
  - fixed typo in added-chdir patch
    resolves: rhbz#1422789
  - added patch to log source process when beginning rate-limiting
    resolves: rhbz#1196230
  - added patch to chdir after chroot
    resolves: rhbz#1422789
  - added patch to remove "inputname" imudp module parameter 
    deprecation warnings
    resolves: rhbz#1403907
  - added patch which resolves situation when time goes backwards
    and statefile is invalid
    resolves rhbz#1088021
  - added a patch to bring back deprecated cmd-line switches and
    remove associated warnings
    resolves: rhbz#1403831
  - added documentation recover_qi.pl
    resolves: rhbz#1286707
  - add another setup for doc package
  - add --enable-generate-man-pages to configure parameters;
    the rscryutil man page isn't generated without it
    https://github.com/rsyslog/rsyslog/pull/469
  - enable mmcount, mmexternal modules
  - remove omruleset and pmrfc3164sd modules


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.598-24
changelog:
  - Rebased to Ruby 2.0.0-p598.
    * Remove Patch19: ruby-2.0.0-p247-Make-stable-Gem-Specification.files-in-
        default-.gems.patch; subsumed
    * Remove Patch20: ruby-2.1.1-fix-test-failures-due-to-expired-certs.patch;
        subsumed
    * Remove Patch21: ruby-2.1.0-test_aes_gcm_wrong_tag-Dont-use-String
        -succ.patch; subsumed
    * Remove Patch22: ruby-2.2.0-fix-error-with-tzdata.patch; subsumed
    Resolves: rhbz#1071187
  - Incorporates fixes for CVE-2014-8080 and CVE-2015-8090.
    Resolves: rhbz#1164000
  - Fix for Proxy Realm feature.
    Resolves: rhbz#1122140
  - Fix off-by-one stack-based buffer overflow in the encodes() function
    (CVE-2014-4975).
    Related: rhbz#1164000


author: Pavel Valena <pvalena@redhat.com> - 2.0.0.648-26
changelog:
  - Rebase to Ruby 2.0.0-p648
    Resolves: rhbz#1197720, rhbz#1298282, rhbz#1258863
    * Remove Patch18: ruby-2.0.0-p247-Revert-mkmf.rb-prefix-install_dirs-only-
        with-DESTDIR.patch; subsumed
    * Remove Patch23: ruby-openssl-wrap-cipher-fix.patch; subsumed
    * Remove Patch25: ruby-2.0.0-p607-DNS-Resolv-fall-back-if-canonicalization-
        fails.patch; subsumed
  - Remove tests depending on europe/moscow to avoid failures due to tzdata change
    https://github.com/eggert/tz/commit/8ee11a301cf173afb0c76e0315b9f9ec8ebb9d95
  - Add checks for systemtap, abrt hook and rubygems version
  - Fix significant hash table performance slowdown on ppc64le
    Resolves: rhbz#1163032
  - Support in no_proxy for domain names with whitespaces and leading dots
    Resolves: rhbz#1300433


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-30
changelog:
  - Fix test_npn_protocol_selection_ary and test_npn_protocol_selection_enum
    failures with newest openssl.
    Resolves: rhbz#1416123
  - Add gemspec_add_dep and gemspec_remove_dep macros.
  - Extend 'gem_' macros for pre-release version support.
    Resolves: rhbz#1397390
  - Make symlinks for json gem.
    Resolves: rhbz#1308992


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
  - Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
    * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
        -vulnerability.patch
    Resolves: CVE-2017-0903
  - Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
    Resolves: CVE-2017-0899
  - Fix a DOS vulernerability in the query command (CVE-2017-0900).
    Resolves: CVE-2017-0900
  - Fix a vulnerability in the gem installer that allowed a malicious gem
      to overwrite arbitrary files (CVE-2017-0901).
    Resolves: CVE-2017-0901
  - Fix a DNS request hijacking vulnerability (CVE-2017-0902).
    * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
    Resolves: CVE-2017-0902
  - Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
    * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
    Resolves: CVE-2017-0898
  - Escape sequence injection vulnerability in the Basic
      authentication of WEBrick (CVE-2017-10784).
    * ruby-2.2.8-sanitize-any-type-of-logs.patch
    Resolves: CVE-2017-10784
  - Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
    * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
    Resolves: CVE-2017-14064
  - Command injection vulnerability in Net::FTP (CVE-2017-17405).
    * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
    Resolves: CVE-2017-17405
  - Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
    * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
    Resolves: CVE-2017-14033
  - Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
      execution(CVE-2017-17790).
    * ruby-2.5.0-Fixed-command-Injection.patch
    Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
  - Add Psych.safe_load
    * ruby-2.1.0-there-should-be-only-one-exception.patch
    * ruby-2.1.0-Adding-Psych.safe_load.patch
    Related: CVE-2017-0903
  - Disable Tokyo TZ tests broken by recen tzdata update.
    * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
    Related: CVE-2017-0903


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-35
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
  - Fix escape sequence injection vulnerability in API response handling.
  - Prohibit arbitrary code execution when installing a malicious gem.
  - Fix escape sequence injection vulnerability in errors.
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch
    Resolves: rhbz#1699283


author: Jun Aruga <jaruga@redhat.com> - 2.0.0.648-35
changelog:
  - Kill bundled certificates.
  - Add macros to edit files lists in .gemspec
  - Fix buffer under-read in String#unpack
    Resolves: CVE-2018-8778
  - Fix HTTP response splitting in WEBrick
    Resolves: CVE-2017-17742
  - Fix DoS by large request in WEBrick
    Resolves: CVE-2018-8777
  - Fix directory traversal by poisoned NULL byte in Dir.
    Resolves: CVE-2018-8780
  - Fix file and directory creation with directory traversal.
    Resolves: CVE-2018-6914
  - Fix socket creation by poisoned NULL byte.
    Resolves: CVE-2018-8779
  - Fix: return default path with nonexistent home dir
  - Fix flags not propagated in Array#pack and String#unpack.
    Resolves: CVE-2018-16396
  - Fix strictly interpret octal fields in tar headers.
    Resolves: CVE-2018-1000075
  - Fix a security error for duplicate files in a package.
    Resolves: CVE-2018-1000076
  - Enforce URL validation on spec homepage attribute.
    Resolves: CVE-2018-1000077
  - Mitigate XSS vulnerability in homepage attribute.
    Resolves: CVE-2018-1000078
  - Prevent Path Traversal issue during gem installation.
    Resolves: CVE-2018-1000079
  - Fix unsafe Object Deserialization Vulnerability in gem owner.
    Resolves: CVE-2018-1000074
  - Refresh expired certificates.
  - Fix path traversal when writing to a symlinked basedir outside of the root
    Resolves: CVE-2018-1000073


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-36
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
    Resolves: CVE-2019-8322
  - Fix escape sequence injection vulnerability in API response handling.
    Resolves: CVE-2019-8323
  - Prohibit arbitrary code execution when installing a malicious gem.
    Resolves: CVE-2019-8324
  - Fix escape sequence injection vulnerability in errors.
    Resolves: CVE-2019-8325
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch


author: <vondruch@redhat.com> - 1.7.8-2
changelog:
  - Update to Bundler 1.7.8.
    Resolves: rhbz#1194243
  - Use symlinks for vendored libraries.
    Resolves: rhbz#1163076


author: Vít Ondruch <vondruch@redhat.com> - 0.16.0-1
changelog:
  - Update to thor 0.16.0.
  - Remove rubygem(diff-lcs) dependency, since it is just optional.
  - Remove rubygem(ruby2ruby) dependnecy, since it is just optional, to allow
    conversion of Rakefiles to Thorfiles (but it doesnt work withou ParseTree anyway).


author: - Alexander Bokovoy <abokovoy@redhat.com> - 4.1.1-30
changelog:
  - resolves: #1083859  - Force KRB5CCNAME in Samba systemd units.
  - related: #1082598 - Fully enables systemd integration.


author: - Guenther Deschner <gdeschner@redhat.com> - 4.1.1-35
changelog:
  - resolves: #1105504 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1108844 - CVE-2014-3493: DoS in smbd with unicode path names.
  - resolves: #1105573 - CVE-2014-0178: Uninitialized memory exposure.


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.10-6.1
changelog:
  - Fix issues caused by security tightening for Badlock:
    - Only validate MIC when "map to guest" is set
    - NetApp SMB servers don't negotiate NTLMSSP_SIGN
    - Anonymous connections don't work anymore
    - wbinfo -u or 'net ads search' don't work anymore
    - Handle empty session in client code
  - resolves: #1333794


author: Andreas Schneider <asn@redhat.com> - 4.2.10-6.2
changelog:
  - related: #1333794 - Fix issues caused by security tightening for Badlock
    o ntlm_auth issues and segfault
    o rpcclient doesn't respect "client ipc *" options
    o fix anonymous authentication if signing is mandatory


author: Andreas Schneider <asn@redhat.com> - 4.2.10-6.3
changelog:
  - resolves: #1350759 - Fix idmap_hash when used with other modules
  - resolves: #1351260 - Fix krb5 encryption type setup during join


author: Martin Milata <mmilata@redhat.com> - 0.13-5
changelog:
  - Fix minor bugs found by static analyzers
    - Resolves: #1142856
  - Return empty duphash for koopses with no reliable frames
    - Resolves: #1123262
  - Fix parsing of python SyntaxError exceptions
    - Resolves: #1142339
  - Fix parsing of ppc64 gdb stacktraces
    - Resolves: #1142338
  - Limit the depth of generated stacktrace to avoid huge reports
    - Resolves: #1142346
  - Add authentication support to uReport, needed for reporting to customer portal
    - Resolves: #1139555


author: Matej Habrnal <mhabrnal@redhat.com> - 0.13-13
changelog:
  - add support for Ruby
    - Related: #1334604
  - actualize list of normalization function in satyr
    - Related: #1332869
  - fix defects found by coverity
    - Related: #1336390


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.5.1-11
changelog:
  - Fix mounted filesystem is shown as disabled when fstab entry uses link, UUID or LABEL
    Resolves: #921487


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.0-5
changelog:
  - Add support for arbitrary names of network devices in Linux_NetworkPortImplementsIPEndpoint
    association
    Resolves: #682386
  - Remove macros from changelog, register to sfcb


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.2.0-3
changelog:
  - Fix provider segfaults when enumerating instances of Linux_SysfsAttribute class
  - Fix provider doesn't show much sysfs entries
  - Add mofs registration for various CIMOMs


author: Tomas Bzatek <tbzatek@redhat.com> - 0.8.0-10.20120315cvs
changelog:
  - Add support for rsyslog $IncludeConfig directive (#971807)
  - Add support for filter definitions (#971807)
  - Various rsyslog compatibility fixes (#971807)


author: Roman Rakus <rrakus@redhat.com> - 2.2.7-3
changelog:
  - Fixed a typo
  - Added missing providers
  - improved providers registration
  - Fixed owning of filesystem's directories (man)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-7
changelog:
  - Fix sblim-gather is installing files under /etc/tmpfiles.d/
    Resolves: #1180992
  - Build with PIE and full RELRO
    Resolves: #1092566


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-8
changelog:
  - Fix reposd crashes with SIGFPE during calcluation of interval metric when there
    are duplicate data values in the repository
    Resolves: #1467038


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-9
changelog:
  - Use Pegasus root/interop instead of root/PG_Interop
  - Enable System Z specific providers for s390 and s390x architecture
    Resolves: #1545811


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.5-6
changelog:
  - Move libcimcClientXML.so from -devel to main package - it's needed for proper function
    Resolves: #1056407


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.23-1
changelog:
  - Rebase to upstream scap-security-guide-0.1.23 version
  - Update upstream tarball source URL to GitHub archive location
  - Drop the following patches that have been accepted upstream:
    * scap-security-guide-0.1.19-rhel7-include-only-rht-ccp-profile.patch
    * scap-security-guide-0.1.19-rhel7-drop-restorecond-since-in-optional.patch
    * scap-security-guide-0.1.19-update-man-page-for-rhel7-content.patch
    * scap-security-guide-0.1.19-rhel7-update-pam-XCCDF-to-use-pam_pwquality.patch
    * scap-security-guide-0.1.20-rhel7-shared-fix-limit-password-reuse-remediation.patch
    * scap-security-guide-0.1.20-rhel6-rhel7-PR#280-set-deny-prerequisite-#1.patch
    * scap-security-guide-0.1.20-rhel6-rhel7-set-deny-prerequisite-#2.patch
    * scap-security-guide-0.1.20-shared-fix-set-deny-for-failed-password-attempts-remediation.patch
    * scap-security-guide-0.1.20-rhel7-specify-exact-profile-name-when-generating-guide.patch
  - Include the datastream versions of Firefox and Java Runtime Environment (JRE) benchmarks
  - Include USGCB and DISA STIG profile kickstart files for Red Hat Enterprise Linux 6


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.24-1
changelog:
  - Rebase to upstream scap-security-guide-0.1.24 version
  - Start producing the -doc subpackage to provide the HTML formatted
    documents containing security guides generated from shipped XCCDF benchmarks


author: Martin Preisler <mpreisle@redhat.com> 0.1.24-2
changelog:
  - Break-down firewalld rule description for Red Hat Enterprise Linux 7 product
    into multiple lines, prevents HTML guide UX issues


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.24-3
changelog:
  - Add remediation script for 'accounts_passwords_pam_faillock_unlock_time' rule
    for Red Hat Enterprise Linux 7 product
  - Override title and description for all existing profiles for Red Hat
    Enterprise Linux 6 product that are extending another SCAP profile
    (RHBZ#1246529)
  - Correct various issues in the included Oscap Anaconda Addon PCI-DSS profile
    kickstart file for Red Hat Enterprise Linux 7 product
  - Add remediation script for 'audit_rules_time_clock_settime' rule for
    Red Hat Enterprise Linux 7 product
  - Add remediation scripts for 'audit_rules_time_adjtimex',
    'audit_rules_time_settimeofday', and 'audit_rules_time_stime' rules for
    Red Hat Enterprise Linux 7 product
  - Tag current PCI-DSS profile for Red Hat Enterprise Linux 7 product with
    "Draft" label
  - Disable the following rules in the PCI-DSS profile for the Red Hat Enterprise
    Linux 7 product:
    * dconf_gnome_screensaver_idle_delay -- missing remediation script,
    * dconf_gnome_screensaver_idle_activation -- missing remediation script,
    * dconf_gnome_screensaver_lock_enabled -- missing remediation script,
    * audit_rules_login_events -- incorrect OVAL check (upstream issue #607),
    * audit_rules_privileged_commands -- missing remediation script, and
    * audit_rules_immutable -- missing remediation script.


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.25-3
changelog:
  - Drop "Verify and Correct File Permissions with RPM" rule from the PCI-DSS
    profile for Red Hat Enterprise Linux 7 (RH BZ#1267861)


author: Jacob Wang <jacob.wang@oracle.com> 0.1.25-3.0.1
changelog:
  - Oracle files:docs/RedHat/en-US/images/image_right.png docs/RedHat/en-US/images/rhlogo.png docs/RedHat/en-US/images/documentation.png docs/RedHat/en-US/images/image_left.png 
  - Oracle files:JBossEAP5/docs/jboss_logo.png JBossFuse6/docs/jboss_logo.png
  - Fixed initial OL CPE patch placing oval cpe checks to shared/oval (ilya.okomin@oracle.com)
  - Updated platform metadata value: multi_platform_all (ilya.okomin@oracle.com)
  - Replace jboss_logo.png and redhat image under docs/RedHat/en-US/images/ in tarball.
  - Added OL6 and OL7 CPE names approved by NIST support (ilya.okomin@oracle.com)
  - Update description for Oracle Linux


author: Watson Sato <wsato@redhat.com> - 0.1.57-7
changelog:
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix name of antivirus package in STIG profile (RHBZ#2066321)
  - Update RHEL7 DISA STIG profile to v3r7 (RHBZ#2079217)


author: Watson Sato <wsato@redhat.com> - 0.1.63-1
changelog:
  - Update to the latest upstream release (RHBZ#2116359)
  - Fix SSH Key permissions (RHBZ#2021258)
  - Remove PCI-DSS Benchmark(RHBZ2038165)
  - Updated source of CVE data feed(RHBZ#2028432)
  - Improved alignment with DISA's RHEL7 STIG(RHBZ#1967950)
  - Update RHEL7 STIG profile to v3r8 (RHBZ#2112939)
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix smartcard_auth rule for systems installed without authconfig (RHBZ#2116359)
  - Fix check of enable_fips_mode on s390x (RHBZ#2116359)
  - Fix applicability of pam_pkcs11 and grub2 rules on s390x (RHBZ#2116359)


author: Watson Sato <wsato@redhat.com> - 0.1.66-1
changelog:
  - Rebase to a new upstream release 0.1.66 (RHBZ#2158410)
  - Update RHEL7 STIG profile to V3R10 (RHBZ#2152657)
  - Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2123284)
  - Fix remediation of audit watch rules (RHBZ#2123367)
  - Fix check firewalld_sshd_port_enabled (RHBZ#2158410)
  - Fix accepted control flags for pam_pwhistory (RHBZ#2158410)
  - Unselect rule logind_session_timeout (RHBZ#2158410)
  - Add support rainer scripts in rsyslog rules (RHBZ#2170038)


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.66-1.0.1
changelog:
  - Rebase to a new Red Hat errata 0.1.66-1 [Orabug: 35165879]
  - Sync OL7 stig profile with DISA STIG v2r10 [Orabug: 35049052]
  - Update rhel7 project profiles to use oracle gpgkey [Orabug: 33612582]
  - Update rhel7 profiles to generate Oracle Linux 7 content [Orabug: 33612582]
  - Update source to generate Oracle Linux 7 content [Orabug: 33612582]
  - Use separate rule for each audit syscall in pci-dss profile [Orabug: 33612582]
  - Add ntpd and chronyd OL approved servers support [Orabug: 33612582]
  - Add UEFI boot loader rules to Oracle Linux 7 profiles [Orabug: 33612582]
  - Fix OL7 mapping in stable_profile_ids test [Orabug: 33612582]
  - Update OL7 Essential Eight profile [Orabug: 33612582]
  - Disable cis profile [Orabug: 33612582]
  - Disable new CIS and stig_gui profiles for RHEL7 product [Orabug: 34195638]
  - Update regex for audit_rules_suid_privilege_function rule [Orabug: 34664858]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.66-1.0.3
changelog:
  - Introduce a new OVAL macro to consistently identify interactive users [Orabug: 35214522]
  - Update accounts_user_dot_no_world_writable_programs rule to look for
   initialization files on the user's homedirs only and to prevent the search for
   world-writables to descend to other file systems [Orabug: 35214522]
  - Align the OL7 stig profile with latest DISA release v2r11 [Orabug: 35334374]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.66-1.0.5
changelog:
  - Fix url to remote oval definitions [Orabug: 35441381]
  - Update rules about password aging so they take into account empty string 
   passwords [Orabug: 35450273]
  - Update jinja conditionals in source, so built contents include all expected
   strings/code [Orabug: 35450273]
  - Update regex in OVAL of rule postfix_prevent_unrestricted_relay to allow
   multiple compliant scenarios [Orabug: 35446144]
  - Add OVAL, Bash and ansible to rule file_permission_user_init_files [Orabug: 35450273]
  - Update vendor references to mention Oracle and Oracle Linux [Orabug: 35450273]


author: Jan Černý <jcerny@redhat.com> - 0.1.69-1
changelog:
  - Rebase to the latest upstream release (RHBZ#2221694)
  - Make IPv6 related rules applicable only in case IPv6 is actually enabled. (RHBZ#2210276)
  - update ANSSI BP-028 profiles to be aligned with version 2.0 (RHBZ#2155793)
  - Correct URL used to download CVE checks. (RHBZ#2223817)


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.69-1.0.1
changelog:
  - Fix url to remote oval definitions [Orabug: 35441381]
  - Update jinja conditionals in source, so built contents include all expected
   strings/code [Orabug: 35450273]
  - Update vendor references to mention Oracle and Oracle Linux [Orabug: 35450273]
  - Update rhel7 project profiles to use oracle gpgkey [Orabug: 33612582]
  - Update rhel7 profiles to generate Oracle Linux 7 content [Orabug: 33612582]
  - Update source to generate Oracle Linux 7 content [Orabug: 33612582]
  - Add ntpd and chronyd OL approved servers support [Orabug: 33612582]
  - Add UEFI boot loader rules to Oracle Linux 7 profiles [Orabug: 33612582]
  - Fix OL7 mapping in stable_profile_ids test [Orabug: 33612582]
  - Update OL7 Essential Eight profile [Orabug: 33612582]
  - Disable cis profile [Orabug: 33612582]
  - Disable new CIS and stig_gui profiles for RHEL7 product [Orabug: 34195638]
  - Update OL7 STIG to V2R12 [Orabug: 35663532]
  - Update OL8 STIG to V1R7  [Orabug: 35765451]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.69-1.0.3
changelog:
  - Update stig profiles to latest DISA standard V2r14 [Orabug: 36237419]
  - Make sssd rules look into /etc/sssd/conf.d/*.conf files for the desired
    configuration [Orabug: 36237419]


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.72-1
changelog:
  - Rebase to a new upstream release 0.1.72 (RHEL-25251)
  - Include filter to dracut files in audit_rules_privileged_commands rule (RHEL-11938)


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.72-2.0.1
changelog:
  - Make sssd rules look into /etc/sssd/conf.d/*.conf files for the desired
    configuration [Orabug: 36237419]
  - Rebase patches to v0.1.72-2.0.1 [Orabug: 36340168]
  - Update jinja conditionals in source, so built contents include all expected
   strings/code [Orabug: 35450273]
  - Update vendor references to mention Oracle and Oracle Linux [Orabug: 35450273]
  - Update rhel7 project profiles to use oracle gpgkey [Orabug: 33612582]
  - Update rhel7 profiles to generate Oracle Linux 7 content [Orabug: 33612582]
  - Update source to generate Oracle Linux 7 content [Orabug: 33612582]
  - Add ntpd and chronyd OL approved servers support [Orabug: 33612582]
  - Add UEFI boot loader rules to Oracle Linux 7 profiles [Orabug: 33612582]
  - Fix OL7 mapping in stable_profile_ids test [Orabug: 33612582]
  - Update OL7 Essential Eight profile [Orabug: 33612582]
  - Disable cis profile [Orabug: 33612582]
  - Disable new CIS and stig_gui profiles for RHEL7 product [Orabug: 34195638]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.73-1.0.1
changelog:
  - Rebase patches to v0.1.73-1 [Orabug: 36702060]
  - Update jinja conditionals in source, so built contents include all expected
   strings/code [Orabug: 35450273]
  - Update vendor references to mention Oracle and Oracle Linux [Orabug: 35450273]
  - Update rhel7 project profiles to use oracle gpgkey [Orabug: 33612582]
  - Update rhel7 profiles to generate Oracle Linux 7 content [Orabug: 33612582]
  - Update source to generate Oracle Linux 7 content [Orabug: 33612582]
  - Add ntpd and chronyd OL approved servers support [Orabug: 33612582]
  - Add UEFI boot loader rules to Oracle Linux 7 profiles [Orabug: 33612582]
  - Fix OL7 mapping in stable_profile_ids test [Orabug: 33612582]
  - Update OL7 Essential Eight profile [Orabug: 33612582]
  - Disable cis profile [Orabug: 33612582]
  - Disable new CIS and stig_gui profiles for RHEL7 product [Orabug: 34195638]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.73-1.0.3
changelog:
  - Update stig profile version to v2r1 for ol8 [Orabug: 36922647]
  - Add ansible remediation to the rules
    accounts_user_dot_no_world_writable_programs
    no_tmux_in_shells 
    account_password_selinux_faillock_dir
    configure_usbguard_auditbackend [Orabug: 36922647]
  - Fix bash bug in account_disable_inactivity rules [Orabug: 36922647]


author: Lubos Kardos <lkardos@redhat.com> - 20130529-10
changelog:
  - Allow to use vendor prefix in packages names
  - Include %nfsmountable macro into scl's rpm macros file


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-13
changelog:
  - bump the version to get in sync with 7.1 branch
  - Reflect the state of %nfsmountable macro in collections' rpm macro files
  - escape all the % chars in changelog


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-1
changelog:
  - rebase to most up2date upstream tarball, remove patches already upstream, fix
    code movements in patches (#928758)
  - fix man-page-day objections (private #948866)
  - fix the build for aarch64 (#926571)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-2
changelog:
  - package spax and scpio separately (#959917)
  - fedora-review fixes, unapplied patch
  - make the spax to be pax alternative (#960007)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-7
changelog:
  - we should provide /etc/rmt symlink for a while (related to #968980)
  - use the ssh as the default remote access method


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.9.1-5.el7_3.1
changelog:
  - seabios-vgabios-Reorder-video-modes-to-work-around-a-Windows.patch [bz#1392028]
  - Resolves: bz#1392028
    ([virtio-win][svvp][ws2016] cannot generate dump file when using nmi on ws2016 and win10-32/64)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.1-2.el7
changelog:
  - seabios-smm-disable-by-default.patch [bz#1378006]
  - seabios-ahci-Set-upper-32-bit-registers-to-zero.patch [bz#1418320]
  - Resolves: bz#1378006
    (guest paused on target host sometimes when do migration during guest boot)
  - Resolves: bz#1418320
    (Seabios does not fully reset AHCI adapters)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.2-2.el7
changelog:
  - seabios-resume-Don-t-attempt-to-use-generic-reboot-mechanism.patch [bz#1428347]
  - Resolves: bz#1428347
    (reboot hangs on rhel6 machine types (~1/20 times))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.2-3.el7
changelog:
  - seabios-blockcmd-accept-only-disks-and-CD-ROMs.patch [bz#1020622]
  - seabios-blockcmd-generic-SCSI-luns-enumeration.patch [bz#1020622]
  - seabios-virtio-scsi-enumerate-luns-with-REPORT-LUNS.patch [bz#1020622]
  - seabios-usb-uas-enumerate-luns-with-REPORT-LUNS.patch [bz#1020622]
  - Resolves: bz#1020622
    (seabios fail to recognize virtio-scsi device if specify LUN not 0)


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 1.10.2-4.el7
changelog:
  - seabios-virtio-IOMMU-support.patch [bz#1463163, bz#1467811]
  - Resolves: bz#1463163
    (Guest OS will down when disk enable the IOMMU for Virtio)
  - Resolves: bz#1467811
    (Guest OS will down when disk enable the IOMMU for virtio-scsi)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.10.2-5.el7
changelog:
  - seabios-boot-Rename-drive_g-to-drive.patch [bz#1452603]
  - seabios-disk-Don-t-require-the-struct-drive_s-to-be-in-the-f.patch [bz#1452603]
  - seabios-block-Rename-disk_op_s-drive_gf-to-drive_fl.patch [bz#1452603]
  - seabios-virtio-Allocate-drive_s-storage-in-low-memory.patch [bz#1452603]
  - Resolves: bz#1452603
    (can't bootup from image when attached multi-virtio-scsi disks with multi-luns)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.11.0-2.el7
changelog:
  - seabios-pci-fix-io-hints-capability-for-RedHat-PCI-bridges.patch [bz#1523166]
  - Resolves: bz#1523166
    ([Q35] guest kernel panic when boot with 9 nics)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-187
changelog:
  - Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets
  Resolves: rhbz#1535196
  - Add new interface ppp_filetrans_named_content()
  Resolves: rhbz#1530601
  - Allow keepalived_t read sysctl_net_t files
  Resolves: rhbz#1477542
  - Allow puppetmaster_t domtran to puppetagent_t
  Resolves: rhbz#1376893
  - Allow kdump_t domain to read kernel ring buffer
  Resolves: rhbz#1540004
  - Allow ipsec_t domain to exec ifconfig_exec_t binaries.
  Resolves: rhbz#1539416
  - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock
  Resolves: rhbz#1530601
  - Allow updpwd_t domain to create files in /etc with shadow_t label
  Resolves: rhbz#1412838
  - Allow iptables sysctl load list support with SELinux enforced
  Resolves: rhbz#1535572


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-188
changelog:
  - Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t
  Resolves: rhbz#1540702
  - Allow keepalived_t domain getattr proc filesystem
  Resolves: rhbz#1477542
  - Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t
  Resolves: rhbz#1538544
  - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t
  Resolves: rhbz:#1539416
  - Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t
  Resolves: rhbz#1479350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-189
changelog:
  - Allow dirsrv_t domain to create tmp link files
  Resolves: rhbz#1536011
  - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t
  Resolves: rhbz#1428568
  - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries
  - Allow ipsec_mgmt_t nnp domain transition to ifconfig_t
  Resolves: rhbz#1539416


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-190
changelog:
  - Allow openvswitch domain to manage svirt_tmp_t sock files
  Resolves: rhbz#1540702
  - Fix broken systemd_tmpfiles_run() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-192
changelog:
  - Label /usr/libexec/dbus-1/dbus-daemon-launch-helper  as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled.
  Resolves: rhbz#1546721


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-192.0.1.3
changelog:
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-192.0.3
changelog:
  - Add vhost-scsi to be vhost_device_t type [OraBug 27774921]
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-192.0.5
changelog:
  - SELinux support for cgroup2 filesystem. [OraBug 28127822]
  - refpolicy: Define and allow map permission [OraBug 28229492]
  - refpolicy: Define extended_socket_class policy capability and socket classes [OraBug 28229492]
  - refpolicy: Define smc_socket security class [OraBug 28229492]
  - refpolicy: Define getrlimit permission for class process [OraBug 28229492]
  - Add vhost-scsi to be vhost_device_t type [OraBug 27774921]
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Naoki Tanaka <naoki.tanaka@oracle.com> - 3.13.1-192.0.6
changelog:
  - Allow map permission for systemd-journald [OraBug 28523895]
  - contrib: allow map permission where needed [OraBug 28523895]
  - allow map permission where needed [OraBug 28523895]
  - Remove map permissions from merging commit with refpolicy [OraBug 28523895]
  - Allow sssd_t domain to map sssd_var_lib_t files [OraBug 28523895]
  - Allow just map permission insead of using mmap_file_pattern because mmap_files_pattern allows also executing objects. [OraBug 28523895]
  - Allow abrt_t domain to mmap files with label syslogd_var_run_t BZ(1514975) [OraBug 28523895]
  - Allow mandb_t domain to mmap files with label mandb_cache_t BZ(1514093) [OraBug 28523895]
  - Update gnome_manage_home_config() to allow also map permission BZ(1544270) [OraBug 28523895]
  - Allow rpm domain to mmap rpm_var_lib_t files [OraBug 28523895]
  - logging: Various audit tools (auditctl, ausearch, etc) map their config and logs [OraBug 28523895]


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-221
changelog:
  - Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket
  - Allow httpd_t domain to mmap tmp files
  Resolves: rhbz#1608355
  - Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files
  - Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks
  - Label /dev/tpmrm[0-9]* as tpm_device_t
  - Allow semanage_t domain mmap usr_t files
  Resolves: rhbz#1622607
  - Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-223
changelog:
  - Make working SELinux sandbox with Wayland.
  Resolves: rhbz#1624308
  - Allow svirt_t domain to mmap svirt_image_t block files
  Resolves: rhbz#1624224
  - Add caps dac_read_search and dav_override to pesign_t domain
  - Allow iscsid_t domain to mmap userio chr files
  Resolves: rhbz#1623589
  - Add boolean: domain_can_mmap_files.
  Resolves: rhbz#1460322
  - Add execute_no_trans permission to mmap_exec_file_perms pattern
  - Allow sudodomain to search caller domain proc info
  - Allow xdm_t domain to mmap and read cert_t files
  - Replace optional policy blocks to make dbus interfaces effective
  Resolves: rhbz#1624414
  - Add interface dev_map_userio_dev()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-224
changelog:
  - Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs.
  Resolves: rhbz#1625678
  - Allow chronyd_t domain to read virt_var_lib_t files
  - Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333)
  Resolves: rhbz#1625613
  - Allow tomcat services create link file in /tmp
  Resolves: rhbz#1624289
  - Add boolean: domain_can_mmap_files.
  Resolves: rhbz#1460322


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-225
changelog:
  - Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs
  Resolves: rhbz#1627114
  - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t
  Resolves: rhbz#1567753


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-226
changelog:
  - Allow tomcat servers to manage usr_t files
  Resolves: rhbz#1625678
  - Dontaudit tomcat serves to append to /dev/random device
  Resolves: rhbz#1625678
  - Allow sys_nice capability to mysqld_t domain
  - Allow dirsrvadmin_script_t domain to read httpd tmp files
  Resolves: rhbz#1622602
  - Allow syslogd_t domain to manage cert_t files
  Resolves: rhbz#1615995


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-227
changelog:
  - Add interface apache_read_tmp_dirs()
  - Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs
  Resolves: rhbz#1622602


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-228
changelog:
  - Allow tomcat_domain to read /dev/random
  Resolves: rhbz#1631666
  - Allow neutron_t domain to use pam
  Resolves: rhbz#1630318


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-229.0.1
changelog:
  - SELinux support for cgroup2 filesystem. [OraBug 28127822]
  - refpolicy: Define getrlimit permission for class process [OraBug 28229492]
  - Add vhost-scsi to be vhost_device_t type [OraBug 27774921]
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.3
changelog:
  - Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.4
changelog:
  - Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging'
  Resolves: rhbz#1638427


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.5
changelog:
  - Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.6
changelog:
  - Allow nova_t domain to use pam
  Resolves: rhbz:#1645270
  - sysstat: grant sysstat_t the search_dir_perms set
  Resolves: rhbz#1645271


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.8
changelog:
  - Add interface domain_rw_all_domains_keyrings()
  Resolves: rhbz#1665815
  - Allow gssd_t domain to read/write kernel keyrings of every domain.
  Resolves: rhbz#1665815


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.9
changelog:
  - Allow gssd_t domain to manage kernel keyrings of every domain.
  Resolves: rhbz#1665815
  - Add new interface domain_manage_all_domains_keyrings()
  Resolves: rhbz#1665815


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.11
changelog:
  - Update nagios_run_sudo boolean with few allow rules related to accessing sssd
  Resolves: rhbz#1692893


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-229.0.3
changelog:
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Add fs_relabel_pstore_dirs() interface. [Orabug: 28260775]
  - Allow systemd running as init_t to relabel pstore directories. [Orabug: 28260775]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Allow insmod_t to load modules BZ(1544189) [Orabug: 28260775]
  - Allow chronyd_t to execute shell scripts [Orabug: 28260775]
  - SELinux support for cgroup2 filesystem. [OraBug 28127822]
  - refpolicy: Define getrlimit permission for class process [OraBug 28229492]
  - Add vhost-scsi to be vhost_device_t type [OraBug 27774921]
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Naoki Tanaka <naoki.tanaka@oracle.com> - 3.13.1-229.0.2
changelog:
  - Add fs_relabel_pstore_dirs() interface. [Orabug: 28260775]
  - Allow systemd running as init_t to relabel pstore directories. [Orabug: 28260775]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Allow insmod_t to load modules BZ(1544189) [Orabug: 28260775]
  - Allow chronyd_t to execute shell scripts [Orabug: 28260775]


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.14
changelog:
  - Allow nrpe_t domain to read process state of systemd_logind_t
  - Alow nrpe_t to send signull to sssd domain when nagios_run_sudo boolean is turned on
  - Allow nrpe_t domain to be dbus cliennt
  - Allow ngaios to use chown capability
  Resolves: rhbz#1692893


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-229.0.4
changelog:
  - Make rpm_transition_script() a nested optional policy in init policy module [Orabug: 29661269]
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Add fs_relabel_pstore_dirs() interface. [Orabug: 28260775]
  - Allow systemd running as init_t to relabel pstore directories. [Orabug: 28260775]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Allow insmod_t to load modules BZ(1544189) [Orabug: 28260775]
  - Allow chronyd_t to execute shell scripts [Orabug: 28260775]
  - SELinux support for cgroup2 filesystem. [OraBug 28127822]
  - refpolicy: Define getrlimit permission for class process [OraBug 28229492]
  - Add vhost-scsi to be vhost_device_t type [OraBug 27774921]
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-246
changelog:
  - Allow ngaios to use chown capability
  Resolves: rhbz#1653309
  - Dontaudit gpg_domain to create netlink_audit sockets
  Resolves: rhbz#1535109
  - Update fs_rw_cephfs_files() interface to allow also caller domain to read/write cephpfs_t lnk files
  Resolves: rhbz#1558836
  - Update domain_can_mmap_files() boolean to allow also mmap lnk files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-247
changelog:
  - Fix typo in gpg SELinux module
  - Update gpg policy to make ti working with confined users
  Resolves: rhbz#1535109
  - Alow nrpe_t to send signull to sssd domain when nagios_run_sudo boolean is turned on
  Resolves: rhbz#1653309
  - Allow nrpe_t domain to be dbus cliennt
  Resolves: rhbz#1653309
  - Add interface sssd_signull()
  Resolves: rhbz#1653309
  - Update userdomains to allow confined users to create gpg keys
  Resolves: rhbz#1535109


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-249
changelog:
  - Allow nrpe_t domain to read process state of systemd_logind_t
  - Add interface systemd_logind_read_state()
  Resolves: rhbz#1653309


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-252.4
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command.
  Resolves: rhbz#1766095


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-252.0.2
changelog:
  - Make tuned work with mls policy [Orabug: 29778485]
  - Make rpm_transition_script() a nested optional policy in init policy module [Orabug: 29661269]
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Add fs_relabel_pstore_dirs() interface. [Orabug: 28260775]
  - Allow systemd running as init_t to relabel pstore directories. [Orabug: 28260775]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Allow insmod_t to load modules BZ(1544189) [Orabug: 28260775]
  - Allow chronyd_t to execute shell scripts [Orabug: 28260775]
  - SELinux support for cgroup2 filesystem. [OraBug 28127822]
  - refpolicy: Define getrlimit permission for class process [OraBug 28229492]
  - Add vhost-scsi to be vhost_device_t type [OraBug 27774921]
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-258
changelog:
  - Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessions
  Resolves: rhbz#1688729
  - Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t label
  Resolves: rhbz#1658319


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-259
changelog:
  - Allow ganesha_t domain to read system network state and connect to cyphesis_port_t
  Resolves: rhbz#1653857
  - Label /var/log/collectd.log as collectd_log_t
  - Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessions
  Resolves: rhbz#1688729
  - Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t label
  Resolves: rhbz#1658319
  - Update sbd policy to allow manage cgroups
  Resolves: rhbz#1715136
  - Allow sudo userdomain to run rpm related commands
  - Update rpm_run() interface to avoid duplicate role transition in sudo_role_template
  Resolves: rhbz#1651253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-261
changelog:
  - Update sudo_role_template() to allow caller domain to read syslog pid files
  Resolves: rhbz#1651253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-264
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command
  Resolves: rhbz#1765063


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-266.0.1
changelog:
  - Make unconfined domains part of domain_named_attribute [Orabug: 30700069]
  - Make tuned work with mls policy [Orabug: 29778485]
  - Make rpm_transition_script() a nested optional policy in init policy module [Orabug: 29661269]
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Add fs_relabel_pstore_dirs() interface. [Orabug: 28260775]
  - Allow systemd running as init_t to relabel pstore directories. [Orabug: 28260775]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Allow insmod_t to load modules BZ(1544189) [Orabug: 28260775]
  - Allow chronyd_t to execute shell scripts [Orabug: 28260775]
  - SELinux support for cgroup2 filesystem. [OraBug 28127822]
  - refpolicy: Define getrlimit permission for class process [OraBug 28229492]
  - Add vhost-scsi to be vhost_device_t type [OraBug 27774921]
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-266.0.3
changelog:
  - Make various processes work with mls policy [Orabug: 29848756]
  - Make unconfined domains part of domain_named_attribute [Orabug: 30700069]
  - Make tuned work with mls policy [Orabug: 29778485]
  - Make rpm_transition_script() a nested optional policy in init policy module [Orabug: 29661269]
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Add fs_relabel_pstore_dirs() interface. [Orabug: 28260775]
  - Allow systemd running as init_t to relabel pstore directories. [Orabug: 28260775]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Allow insmod_t to load modules BZ(1544189) [Orabug: 28260775]
  - Allow chronyd_t to execute shell scripts [Orabug: 28260775]
  - SELinux support for cgroup2 filesystem. [OraBug 28127822]
  - refpolicy: Define getrlimit permission for class process [OraBug 28229492]
  - Add vhost-scsi to be vhost_device_t type [OraBug 27774921]
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-267
changelog:
  - Allow chronyd_t domain to exec shell
  Resolves: rhbz#1775573
  - Allow pmie daemon to send signal pcmd daemon
  Resolves: rhbz#1770123
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1780332


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268
changelog:
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1837461
  - Allow ipa-adtrust-install restart sssd and dirsrv services
  Resolves: rhbz#1820298
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1824625
  - selinux policy: add the right context for org.freeipa.server.trust-enable-agent
  Related: rhbz#1820298


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-268.0.1
changelog:
  - Make cloud-init work with mls policy [Orabug: 31428176]
  - Allow cloud-init to create /var/run/cloud-init dir with net_conf_t SELinux label. [Orabug: 31428176]
  - Make various processes work with mls policy [Orabug: 29848756]
  - Make unconfined domains part of domain_named_attribute [Orabug: 30700069]
  - Make tuned work with mls policy [Orabug: 29778485]
  - Make rpm_transition_script() a nested optional policy in init policy module [Orabug: 29661269]
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Add fs_relabel_pstore_dirs() interface. [Orabug: 28260775]
  - Allow systemd running as init_t to relabel pstore directories. [Orabug: 28260775]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Allow insmod_t to load modules BZ(1544189) [Orabug: 28260775]
  - Allow chronyd_t to execute shell scripts [Orabug: 28260775]
  - SELinux support for cgroup2 filesystem. [OraBug 28127822]
  - refpolicy: Define getrlimit permission for class process [OraBug 28229492]
  - Add vhost-scsi to be vhost_device_t type [OraBug 27774921]
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268.2
changelog:
  - Allow certmonger add new entries in a generic certificates directory
  Resolves: rhbz#1879496
  - Allow slapd add new entries in ldap certificates directory
  Resolves: rhbz#1879496
  - Add miscfiles_add_entry_generic_cert_dirs() interface
  Resolves: rhbz#1879496


author: Naoki Tanaka <naoki.tanaka@oracle.com> - 3.13.1-268.0.7.2
changelog:
  - Add new interface init_manage_script_tmp_files() [Orabug: 32785674]
  - Add new interface init_write_initrc_tmp_pipes() [Orabug: 32785674]
  - Allow ldconfig_t domain to manage initrc_tmp_t objects [Orabug: 32785674]
  - Allow ldconfig_t domain to manage initrc_tmp_t link files [Orabug: 32785674]


author: sagar sagar <sagar.sagar@oracle.com> - 3.13.1-268.0.17.2
changelog:
  - Allow unconfined domains to bpf all other domains [Orabug: 35217863]
  - Allow unconfined_domain_type to use bpf tools [Orabug: 35217863]


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-184
changelog:
  - Allow chronyc_t domain to manage chronyd_keys_t files.
  Resolves: rhbz#1530525
  - Make virtlog_t domain system dbus client
  Resolves: rhbz#1481109
  - Update openvswitch SELinux module
  Resolves: rhbz#1482682
  - Allow virtd_t to create also sock_files with label virt_var_run_t
  Resolves: rhbz#1484075


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-185
changelog:
  - Allow vmtools_t domain creating vmware_log_t files
  Resolves: rhbz#1507048
  - Allow openvswitch_t domain to acces infiniband devices
  Resolves: rhbz#1532705


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-186
changelog:
  - Allow virt_domains to acces infiniband pkeys.
  Resolves: rhbz#1533183
  - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t
  Resolves: rhbz#1535133
  - Allow audisp_remote_t domain write to files on all levels
  Resolves: rhbz#1534924


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.6-2
changelog:
  - Fixed milter_helo regression (milter-helo-fix patch)
    Resolves: rhbz#895552
  - Fixed bogus dates in changelog


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.7-5
changelog:
  - Explicitly enabled sm-client statistics
    Resolves: rhbz#890585
  - Enable ECDHE support
    Resolves: rhbz#1124827
  - Properly set {client_port} value on little endian machines,
    patch by Kelsey Cumminngs <kgc@corp.sonic.net>
    Resolves: rhbz#1210914
  - Added makemap and its manual page into alternatives
    Resolves: rhbz#1225891
  - Modified nm-dispatcher script to asynchronously restart sendmail and
    not block the connection activation
    Resolves: rhbz#1237070
  - Added config options allowing disablement of TLS 1.1/2
    Resolves: rhbz#1281476
  - Fixed problem with e-mails not sending from IPv6 enabled server
    to servers with MX record pointing to CNAME
    Resolves: rhbz#1294870
  - Added editmap
    Resolves: rhbz#1342393
  - Removed systemd limit for sendmail restarts to workaround failure due to
    rapid restarts caused by NetworkManager dispatcher script
    Resolves: rhbz#1395102
  - Fixed op.pdf
    Resolves: rhbz#1401070


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.7-6
changelog:
  - Use SSL_CTX_use_certificate_chain_file() to handle intermediate
    certificates passed additionally in confSERVER_CERT
    Resolves: rhbz#1596725


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-1
changelog:
  - Fix summary and "if" text for AVCs with unknown target path (#1437772)
  - Remove unused booleans.py file
  - src/sealert: Finish dbus communication after error (#1461486)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-3
changelog:
  - Check for the existence of setroubleshoot group separately (#1478118)
  - Fix AVC.__typeMatch to handle aliases properly (#1459844, #1459835, #1459875)
  - Fix allowed_target_types (#1460642, #1460648)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-4
changelog:
  - Catch exceptions caused by lookup_signature (#1636369, #1627908)
  - Fix translation of hex values in AVCs (#1477236)


author: Petr Lautrbach <plautrba@redhat.com> - 3.0.65-1
changelog:
  - Remove duplicated strings from sys_resource.py
  - Spelling fixes
  - Fix catchall plugin message for capability2
  - Stop executing restorecon plugin on specified path prefixes


author: Vit Mojzis <vmojzis@redhat.com> - 3.0.66-1
changelog:
  - Fix catchall plugin message for process2 (#1507909)
  - Correct grammatical errors (#1331780)
  - Do not split If sentences to framework and plugins (#1177347)
  - Fix typo in "lt" translation header (#1468985)
  - catchall_boolean.py - 'None' man page is None man page
  - Fix restorecon "then" text (#1332097)


author: Vit Mojzis <vmojzis@redhat.com> - 3.0.67-1
changelog:
  - bind_ports: Do not use when there are no allowed_target_types (#1255627)
  - Fix summary and "if" text for AVCs with unknown target path (#1437772)
  - Update translations


author: EL Errata <el-errata_ww@oracle.com> - 3.0.67-4.0.1
changelog:
  - Add setroubleshoot-plugins-oracle-config.patch to use oracle url
  - Add setroubleshoot-plugins-oracle-po.patch to use oracle url for po


author: Dan Horák <dan@danny.cz> - 1.37-5
changelog:
  - fix various man pages (#948463)
  - add man page for the rescan-scsi-bus.sh script (#948463)
  - Resolves: #948463


author: David Sommerseth <davids@redhat.com> - 1.37-7
changelog:
  - Avoid deletion of /dev/null (#1298737)
  - Fix syntax error in rescan-scsi-bus related to multipath flushing (#1255564)
  - Add upstream updates to sg_inq, sg_rdac and sg_vpd (#1170719)


author: Gris Ge <fge@redhat.com> 1.37-17
changelog:
  - Fix help documents of sg_requests, sg_senddiag and sg_write_buffer.
    (RHBZ #1359282, #1359286, #1359292)


author: Tomas Bzatek <tbzatek@redhat.com> 1:1.37-19
changelog:
  - Reorder 59-fc-wwpn-id.rules to run after 60-persistent-storage.rules (#1785303)
  - Fix the 59-fc-wwpn-id.rules syntax (#1750417)
  - Add 59-fc-wwpn-id.rules (#1684302)


author: Richard W.M. Jones <rjones@redhat.com> - 0-1.1.20110622svn
changelog:
  - Fix date in release string.
    NB: To make this version > than the previous, I had to use 1.1.20110622
    instead of 0.1.20110622, since the old second field was 20110623.
  - Unset MAKEFLAGS, since parallel make breaks the build.
  - Bring the spec file up to modern standards.


author: Petr Pisar <ppisar@redhat.com> - 4.13.3-2
changelog:
  - Fix decoding from positional argument while overriding output file
    (bug #901895)
  - Fix decoding to standard output when output file is - or /dev/stdout
    (bug #901895)


author: Peter Jones <pjones@redhat.com> - 15-6
changelog:
  - Rebuild for bug fixes and new signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Implement Lenny's workaround.
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-8.el7
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1862045
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Peter Jones <pjones@redhat.com> - 15.6-3.el7
changelog:
  - Patch to work around upstream issue #533
    Related: CVE-2020-14372
  - Run the test suite during the build, to be sure.


author: Alex Burmashev <alexander.burmashev@oracle.com> - - 15.8-2.0.1.el7
changelog:
  - Set SBAT_AUTOMATIC_DATE to 2021030218 [Orabug: 36271343]
  - Rebuild with Oracle certificates [Orabug: 36271343]
  - Full list of fixed CVEs: CVE-2023-40546, CVE-2023-40547,
    CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 [Orabug: 36271343]


author: Peter Jones <pjones@redhat.com> - 0.9-2
changelog:
  - Apparently I'm *never* going to learn to build this in the right target
    the first time through.
    Related: rhbz#1100048


author: Peter Jones <pjones@redhat.com> - 10-0.1
changelog:
  - Support ia32
    Resolves: rhbz#1310766
  - Handle various different load option implementation differences
  - TPM 1 and TPM 2 support.
  - Update to OpenSSL 1.0.2k


author: Peter Jones <pjones@redhat.com> - 11-0.1
changelog:
  - Update to 11-0.1 to match shim-11-1
    Related: rhbz#1310766
  - Fix regression in PE loader
    Related: rhbz#1310766
  - Fix case where BDS invokes us wrong and we exec shim again as a result
    Related: rhbz#1310766


author: Livy Ge <livy.ge@oracle.com> - 12-1.0.1
changelog:
  - New secure boot signing key
  - aarch64 is not supported by Oracle Linux thus aarch64 shim is not needed
  - Use redhat as efidir to maintain compatibility with RedHat
  - updated with shim.efi signed by Microsoft
  - shim update


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.6-1.0.1
changelog:
  - Update to 15.6.rc1 [JIRA: OLDIS-16370]
  - update CVE-2022-28737 patches [JIRA: OLDIS-16370]
  - Fix CVE-2022-28737 [JIRA: OLDIS-16370]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 15.8-1.0.1
changelog:
  - Set shim.ol sbat generation to 3 [Orabug: 36271343]
  - Set SBAT_AUTOMATIC_DATE to 2021030218 [Orabug: 36271343]
  - Rebuild with Oracle certificates [Orabug: 36271343]
  - Full list of fixed CVEs: CVE-2023-40546, CVE-2023-40547,
    CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551 [Orabug: 36271343]
  - Disable ia32 build [Orabug: 36271343]


author: Nathan Scott <nathans@redhat.com> - 0.6.2-1
changelog:
  - Switch to enabling the Java 8+ maven modules only now.
  - Add unitsofmeasurement prefix to package name.
  - Update to latest upstream sources.


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 2.3.0-6
changelog:
  - Add ASM dependency only to a single module, not all of them
  - Disable animal-sniffer plugin
  - Don't generate auto-requires for optional dependencies


author: Michal Srb <msrb@redhat.com> - 2.3.0-7
changelog:
  - sisu-inject-bean: add dependency on asm
  - Fix dependencies on javax.inject and javax.enterprise.inject
  - Remove bundled JARs and .class files from tarball


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 2.3.0-8
changelog:
  - Remove unneeded animal-sniffer BuildRequires
  - Add forge-parent to BuildRequires to ensure it's present


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-1
changelog:
  - Upstream release 0.56.5
  - Resolves: rhbz#1820124 When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming
  - Resolves: rhbz#1820122 ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED
  - Resolves: rhbz#1819018 ipa slapi-nis stack traces review request for LDAP server deadlock
  - Resolves: rhbz#1830894 Memory leak during search of idview overrides


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-4
changelog:
  - CVE 2021-3480:  slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1942937


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Resolves: rhbz#1978748
    Release adds following fixes:
    - Fix ID views integration
    - Fix base scope lookups
    - Bump NIS max dgram size to 8KB by default instead of 1KB
    - Allow to rebuild the compat tree


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-4
changelog:
  - Ignore updates from non-tracked subtrees during modify/modrdn/update
    to avoid deadlocks with retro changelog
  - Resolves: RHEL-11869


author: Michal Srb <msrb@redhat.com> - 1.11-5
changelog:
  - Replace bundled base64 implementation
  - Replace bundled gdata-java-client classes with apache-commons-codec


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-2
changelog:
  - Change install directory to /usr/lib*/pkcs11/
  - Install pkcs11 module file
  - Use official upstream tar ball
  - Create ods user to own softhsm/token files
  - Enable migration tools (for epel6 softhsm-v1 installs)
  - Require p11-kit, nss-tools, for SoftHSM PKCS #11 Module file
  - Copy pk11install.c from coolkey package which is not built on all arches
  - Enable hardened build
  - Add upstream official source url
  - Add devel package
  - Excluding i686/ppc (make check fails and we are a leave package)
  - (thanks to Petr for jumping in for the initial build while I was too busy)


author: Paul Wouters <pwouters@redhat.com> - 2.0.0b1-3
changelog:
  - Fix softhsm2-pk11install buid and post call
  - Do not use --with-objectstore-backend-db (causes issues on i686)


author: Petr Spacek <pspacek@redhat.com> - 2.0.0rc1-1
changelog:
  - Resolves: rhbz#1193892 Rebase to latest upstream version
  - i686/ppc/s390 architectures are now included in the build


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.1.0-3
changelog:
  - Resolves: rhbz#1507409 ObjectStore.cpp(59): Failed to enumerate object store in /var/lib/softhsm/tokens/
  - Resolves: rhbz#1540010 gnome-settings-daemon: gnome-settings-daemon killed by SIGSEGV


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 3.9-5.0.13.10
changelog:
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553348]
  - Add support for Oracle VM Server 3.4.7 [Orabug: 32914180]
  - Add in some btrfs commands [Orabug: 32382141]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618934]
  - Stop exit on unknown plugin [Orabug: 32544261]
  - Allow a journal log size to be smaller than 100M [Orabug: 32381520]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Add ksplice plugin [Orabug: 28931307]
  - Added bug28674897.patch (Recognize Oracle Linux distribution/vendor, fix plugin discovery on OL) [Orabug: 28674897]
  - Added sos-oraclelinux-vendor-vendorurl.patch


author: Anil Lal <anil.palakunnathu.kunnengeri@oracle.com> - 3.9-5.0.19.10
changelog:
  - Adding virsh qemu-monitor info-tree command [Orabug: 34886153]
  - Adding virsh guest cgroup configuration info [Orabug: 35145483]


author: Adrian Reber <adrian@lisas.de> - 3.1.6-1
changelog:
  - updated to 3.1.6
  - removed buildroot and clean section
  - fixed "missing c++ source language detection for .cxx extension" (#728311)
  - fixed "source-highlight : Conflicts with autoconf-archive" (#797794)


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 14.4.1-4
changelog:
  - removed liblpc10 from source tarball due to licensing uncertainity
  - added license file to libgsm
  - fixed bogus dates in changelog


author: Jiri Kucera <jkucera@redhat.com> - 14.4.1-7
changelog:
  - Fix CVE-2017-18189
    Upstream patch: https://sourceforge.net/p/sox/code/ci/09d7388c8ad5701ed9c59d1d600ff6154b066397/
    Resolves: #1553590


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.2-0.17.rc1
changelog:
  - update config.guess and config.sub for aarch64 (#926562)
  - make some dependencies arch-specific
  - remove obsolete macros


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-3
changelog:
  - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages
    sent from an authenticated client
    Resolves: CVE-2017-7506


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-2.3
changelog:
  - Revert back to spice 0.12 behaviour where QXL guest resources for cursor
    commands are only released when the current cursor is replaced. This avoids
    a QEMU regression causing crashes during migration
    Resolves: rhbz#1572489


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-4
changelog:
  - Revert back to spice 0.12 behaviour where QXL guest resources for cursor
    commands are only released when the current cursor is replaced. This avoids
    a QEMU regression causing crashes during migration
    Resolves: rhbz#1567944


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-5
changelog:
  - Don't mute Record channel on client reconnection
    Resolves: rhbz#1549132
  - Allow to configure TLS protocol versions and ciphers which SPICE will use for
    TLS communications
    Resolves: rhbz#1562213
  - Enable ECDH ciphers with OpenSSL 1.0
    Resolves: rhbz#1566597


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-7
changelog:
  - Fix off-by-one error during guest-to-host memory address conversion
    Resolves: CVE-2019-3813
  - Add patch for upstream commit 48179332d9da0. This should help with corrupted
    spice-html5 displays
    Resolves: rhbz#1573739
  - Add missing minimum openssl version Requires for patch #24
    Resolves: rhbz#1627693


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-1
changelog:
  - Rebase to 0.33
    Resolves: rhbz#1402474
  - Rebuilt with correct hardening flags due to bug 1387475
    Resolves: rhbz#1420778
  - Fix copy paste issues
    Resolve: rhbz#1409854


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-2
changelog:
  - Add missing patch for rebase
    Resolves: rhbz#1402474
  - Add obsoletes to the spec file to ease updates
    Resolves: rhbz#1432776
  - Fix black screen in virt-manager
    Resolves: rhbz#1433242
  - Make connection error message more clear
    Resolves: rhbz#1365736


author: Victor Toso <victortoso@redhat.com> - 0.33-3
changelog:
  - Avoid CRITICALs on copy-paste
    Resolves: rhbz#1440096
  - Avoid assertions on file-xfer while agent disconnects
    Related: rhbz#1440096


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-4
changelog:
  - Make connection error message more clear
    Resolves: rhbz#1365736
  - Improve audio debug
    Resolves: rhbz#1436249
  - Fix wrong encoding of transferred files
    Resolves: rhbz#1440206


author: Victor Toso <victortoso@redhat.com> - 0.35-5
changelog:
  - Keepalive fix
    Resolves: rhbz#1719736
  - Fix hang on migration after password expired
    Resolves: rhbz#1761776


author: Pavel Grunt <pgrunt@redhat.com> - 0.26-7
changelog:
  - Improve message for number of usb channels in usb device widget
    Resolves: rhbz#1299931
  - Fix usbredir leak when redirecting a webcam
    Resolves: rhbz#1270363


author: Pavel Grunt <pgrunt@redhat.com> - 0.26-8
changelog:
  - Check runtime usbredir version
    Resolves: rhbz#1320827
  - Allow connection to password protected guests
    Resolves: rhbz#1320806
  - Fix runtime warnings related to shared folders and usb redirection
    Resolves: rhbz#1319405
  - Change runtime warning for empty monitor config to debug message
    Resolves: rhbz#1319405
  - Fix 16 bpp LZ image decompression
    Resolves: rhbz#1285469


author: Victor Toso <victortoso@redhat.com> - 0.31-3
changelog:
  - Fix client's crash when agent is killed
    Resolves: rhbz#1336321
  - Parse ipv6 address
    Resolves: rhbz#1335239
  - Improving parsing of Smartcard messages
    Resolves: rhbz#1338727
  - Fix hangs with "Connected to graphic server"
    Resolves: rhbz#1323092


author: Pavel Grunt <pgrunt@redhat.com> - 0.31-4
changelog:
  - Fix SASL GSSAPI (kerberos authentication)
    Resolves: rhbz#1343361
  - Allow to connect to ipv6 behind proxy
    Resolves: rhbz#1331777


author: Pavel Grunt <pgrunt@redhat.com> - 0.31-5
changelog:
  - Allow to connect to ipv6 without proxy
    Resolves: rhbz#1361478
  - Silence a critical when migrating
    Resolves: rhbz#1356162
  - Disable EPOXY / EGL usage
    Resolves: rhbz#1362460


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 15-7
changelog:
  - Fix build requires and requires (#884632)
  - Cleanup specfile for latest guidelines 
  - Add ASL license text


author: Frediano Ziglio <fziglio@redhat.com> - 0.12.4-20
changelog:
  - Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large
    messages.
    Resolves: CVE-2016-9577
  - Fix remote DoS via crafted message.
    Resolves: CVE-2016-9578


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-1
changelog:
  - Rebase to spice-server 0.12.8
    Resolves: rhbz#1388947
    Resolves: rhbz#1377551
    Resolves: rhbz#1283202


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-5
changelog:
  - Resolves: #1404817 - SIGSEV in TunnelStateData::handleConnectResponse()
    during squid reconfigure and restart


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15
changelog:
  - Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1680022 - squid can't display download/upload packet size for HTTPS
    sites
  - Resolves: #1717430 - Excessive memory usage when running out of descriptors
  - Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts
  - Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter
    in cachemgr.cgi
  - Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15.1
changelog:
  - Resolves: #1828359 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828360 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow
  - Resolves: #1829772 - CVE-2019-12525 squid: parsing of header
    Proxy-Authentication leads to memory corruption


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17
changelog:
  - Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow [rhel


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2
changelog:
  - Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues
    in HTTP Request processing
  - Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
    as reverse-proxy
  - Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning
    attack against the HTTP cache
  - Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in
    FTP Gateway


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4
changelog:
  - Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could
    result in cache poisoning
  - Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could
    result in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6
changelog:
  - Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow
    a trusted client to perform HTTP Request Smuggling


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.10
changelog:
  - Resolves: RHEL-16779 - squid: NULL pointer dereference in the gopher protocol
    code -- Remove support for Gopher protocol (CVE-2023-46728)
  - Resolves: RHEL-18176 - squid: Buffer over-read in the HTTP Message processing
    feature (CVE-2023-49285)
  - Resolves: RHEL-18171 - squid: Incorrect Check of Function Return Value In
    Helper Process management (CVE-2023-49286)
  - Resolves: RHEL-16758 - squid: Denial of Service in SSL Certificate validation
    (CVE-2023-46724)
  - Resolves: RHEL-19557 - squid: denial of service in HTTP request parsing
    (CVE-2023-50269)
  - Resolves: RHEL-26082 - squid: denial of service in HTTP header parser
    (CVE-2024-25617)


author: EL Errata <el-errata_ww@oracle.com> - 7:3.5.20-17.0.1
changelog:
  - Mutiple CVE fixes for squid [Orabug: 33146289]
  - Resolves: CVE-2021-28651 squid: Bug 5104: Memory leak in RFC 2169 response parsing (#778)
  - Resolves: CVE-2021-28652 squid: Bug 5106: Broken cache manager URL parsing (#788)
  - Resolves: CVE-2021-31806,31807,31808 squid: Handle more Range requests (#790)
  - Resolves: CVE-2021-33620 squid: Handle more partial responses (#791)


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-16
changelog:
  - Resolves: #1738582 - CVE-2019-12525 squid: parsing of header 
    Proxy-Authentication leads to memory corruption


author: Sushmita Bhattacharya <sushmita.bhattacharya@oracle.com> - 7:3.5.20-17.0.1
changelog:
  - Mutiple CVE fixes for squid [Orabug: 33146289]
  - Resolves: CVE-2021-28651 squid: Bug 5104: Memory leak in RFC 2169 response parsing (#778)
  - Resolves: CVE-2021-28652 squid: Bug 5106: Broken cache manager URL parsing (#788) 
  - Resolves: CVE-2021-31806,31807,31808 squid: Handle more Range requests (#790) 
  - Resolves: CVE-2021-33620 squid: Handle more partial responses (#791)


author: Doug Ledford <dledford@redhat.com> - 0.0.4-13
changelog:
  - Further tweaks to LSB init script headers
  - Add a %post and %preun scriptlets to add/remove the init script


author: Honggang Li <honli@redhat.com> - 1.0.3-1
changelog:
  - Update to latest upstream version 1.0.3.
  - Remove executable permission bits of srpd.service.
  - Start srpd.service before remote-fs service.
  - Resolves: bz1092530, bz1273181, bz1274119


author: Nicolas Mailhot <nicolas.mailhot at laposte.net>
changelog:
  - 1.1.0-1
  — Update to new stable release
  — Major refactoring now that some sanity prevailed upstream in font naming
    Be careful if you used the old font family names


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-2
changelog:
  - Copy over changes in tests/ioctl_evdev-success.c (from cdd8206a
    "tests: test evdev bitset decoding more thoroughly")
    to tests-m32/ioctl_evdev-success.c and tests-mx32/ioctl_evdev-success.c
  - Copy over changes in tests/ioctl_evdev.c (from 5ee385e2
    "evdev: fix decoding of EVIOCGBIT(0, ...)") to tests-m32/ioctl_evdev.c
    and tests-mx32/ioctl_evdev.c
  - Resolves: #1746478


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-4
changelog:
  - Include upstream patches that fix issues reported by covscan:
    91281fec "v4l2: avoid shifting left a signed number by 31 bit",
    522ad3a0 "syscall.c: avoid infinite loop in subcalls parsing", and
    9446038e "kvm: avoid bogus vcpu_info assignment in vcpu_register".
  - Resolves: #1747524


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-5
changelog:
  - Fix printing stack traces for early syscalls on process attach (#1790052):
    69b2c33a "unwind-libdw: fix initialization of libdwfl cache" and
    8e515c74 "tests: add strace-k-p test".
  - Add commit v5.4~97 "xlat: use unsgined type for mount_flags fallback values"
    (A leftover for #1747524).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-6
changelog:
  - Fix expected alignment for IPC tests (#1795261):
    4377e3a1 "tests: fix expected output for some ipc tests", and
    a75c7c4b "tests: fix -a argument in ipc_msgbuf-Xraw test".


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-7
changelog:
  - Fix incorrect ifname printing buffer size (#2028146):
    e27b0677 "print_ifindex: fix IFNAME_QUOTED_SZ definition".


author: Joe Orton <jorton@redhat.com> - 1.7.14-13
changelog:
  - fix mod_authz_svn regression with mod_auth_kerb (#1306431)
  - fix "svn diff" property handling (#1378178)
  - fix permissions of /run/svnserve to match tmpfiles (#1496243)


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
  - RHEL 7.4 erratum
  - added doc patch about sudo lookup issue
    Resolves: rhbz#1293306
  - added test suite patch
    Resolves: rhbz#1360687
  - fixed use after free fqdn problem
    Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
  - RHEL 7.4 erratum
  - added patch to fix output truncation (in some cases) when log_output
    option is enabled
    Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
  - RHEL 7.4 erratum
  - Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
    Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
  - RHEL 7.4 erratum
  - removed patch for output truncation (1454571) which introduced regression
    Resolves: rhbz#1360687


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-12
changelog:
  - RHEL 7.5 erratum
  - Fixed exit codes for `sudo -l -U <user>`
  - Fixed truncated output when log_output is enabled
  - Updated use_pty and IO logging manpage

    Resolves: rhbz#1458696
    Resolves: rhbz#1454571
    Resolves: rhbz#1490358

  - Fixed second pass LDAP filter expression in the sudoers ldap backend
    - inclomplete patch for rhbz#1485397


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-13
changelog:
  - RHEL 7.5 erratum
  - Fixed sudo -l checking results whether user should be authenticated
  - Enabled LDAP filter patch
  - Fixed double free in sssd

    Resolves: rhbz#1505409
    Resolves: rhbz#1511850
    Resolves: rhbz#1518104


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-1
changelog:
  - RHEL-7.6 erratum
    Resolves: rhbz#1547974 - Rebase sudo to latest stable upstream version (1.8.23)
    Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets
    Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
    Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
    Resolves: rhbz#1548380 - RFE: Create flag to filter to sudo -l output
    Resolves: rhbz#1510002 - Ensure that the command input (stdin) eating behaviour of Default log_input is documented
    Resolves: rhbz#1596032 - Why does sudo package depend on vim-minimal?


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-2
changelog:
  - RHEL-7.6 erratum
    Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
    Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
    Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
  - RHEL-7.7 erratum
    Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
    Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-5
changelog:
  - RHEL-7.8 erratum
    Resolves: rhbz#1711997 sudo is super slow when /etc/security/limits.conf contains many entries


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-6
changelog:
  - RHEL-7.8 erratum
    Resolves: rhbz#1647678 sudo access denied with pam_access and pts terminal configurations


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.2
changelog:
  - RHEL 7.9.Z ERRATUM
  - defaults use_pty plus SELinux ROLE in user specification breaks terminal
    Resolves: rhbz#1972820


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.3
changelog:
  RHEL 7.9.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161222


author: Keshav Sharma <keshav.sharma@oracle.com> 1.8.23-4.0.1
changelog:
  - Treat an ID of -1 as invalid since that means "no change" [Orabug: 30421281] {CVE-2019-14287}
  - Add sudo_strtoid() tests for -1 and range errors. [Orabug: 30421281]


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-4
changelog:
  - RHEL 7.4 erratum
  - fixed cmnd_no_wait patch
  - backported iolog_flush sudoers default
    Resolves: rhbz#1369856
    Resolves: rhbz#1425853


author: Nils Philippsen <nils@redhat.com> - 4.0.2-10
changelog:
  - ship licenses as documentation in the base package (#1019315)
  - hardlink duplicate documentation/license files


author: Richard W.M. Jones <rjones@redhat.com> - 5.1.9-1.4
changelog:
  - Completely remove dependency on prelink/execstack (RHBZ#1093261).
  - Rebuild for aarch64 and ppc64le (1125690).


author: Richard W.M. Jones <rjones@redhat.com> - 5.1.15-1
changelog:
  - Rebase to supermin 5.1.15.
    resolves: rhbz#1271255
  - Create supermin5-devel package containing RPM dependency generator.


author: Richard W.M. Jones <rjones@redhat.com> - 5.1.15-3
changelog:
  - Add all upstream patches since 5.1.15 was released.
  - These should improve boot performance and initrd size.


author: Richard W.M. Jones <rjones@redhat.com> - 5.1.19-1
changelog:
  - Rebase to supermin 5.1.19.
  - Build on s390x.
  - Add upstream signature.
  - Remove upstream patches.
    resolves: rhbz#1484890, rhbz#1484973


author: Noriko Hosoi <nhosoi@redhat.com> - 4.1.0-1
changelog:
  - release 4.1.0-1
  - Resolves: Bug 1324983 - Rebase: svrcore
              Added systemd ask password support (DS 48450)


author: Adam Tkac <atkac redhat com> 2.0.8-1
changelog:
  - update to 2.0.8 (#851364)
  - swig207-rh830660.patch merged
  - swig207-r13128.patch merged
  - swig-rh841245.patch merged


author: Jitka Plesnikova <jplesnik@redhat.com> - 2.0.10-1
changelog:
  - Update to 2.0.10
  - swig203-rh706140.patch merged
  - swig204-rh752054.patch merged
  - Create swig-2.0.10-Fix-x390-build.patch


author: Peter Jones <pjones@redhat.com> - 4.05-4
changelog:
  - Fix build problem from kernel-headers' removeal of ext2_fs.h
    (fix backported from as-yet-unreleased upstream version.)


author: Peter Jones <pjones@redhat.com> - 4.05-12
changelog:
  - Toolchain changes between when this originally got built and 4.05-9 means
    4.05-9 - 4.05-11 don't actually work.
    Related: rhbz#1085434


author: Michal Sekletár <msekleta@redhat.com> - 10.1.5-18
changelog:
  - add -f flag to force fdatasync() after sa file update (#1662094)
  - don't call filesystem count functions when we are not collecting fs statistics (#1670060)
  - skip autofs when gathering filesystem statistics (#1670060)
  - fix use of incorrect preposition in sar man page (#1624410)
  - fix CPU usage reporting (#1618688)


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 10.1.5-20.0.3
changelog:
  - Rework procedures used to count processors on the machine [Orabug: 33547406]
  - mpstat: Compute global CPU stats as the sum of individual ones [Orabug: 33547406]


author: Nils Philippsen <nils@redhat.com> - 1.10.1-1
changelog:
  - don't trip over missing /etc/sysconfig/network file (#857412)
  - pull updated translations
  - install and use timezone translations properly


author: Nils Philippsen <nils@redhat.com> - 1.10.5-1
changelog:
  - pull updated and new translations (#878319)
  - catch (rare) errors from fork()
  - catch unavailable display (#766936)
  - pull updated time zones


author: Jan Synáček <jsynacek@redhat.com> - 1.10.6-3
changelog:
  - remove invalid source links (#1502430)
  - system-config-date can't enable ntp because /bin/systemd doesn't exist (#1381321)


author: EL Errata <el-errata_ww@oracle.com> - 1.10.6-3.0.1
changelog:
  - Add system-config-date-oracle.patch bug#11479
    update Makefile to add ntp servers {0,1,2}.pool.ntp.org to ntp.conf.template
  - Reset POOL_NTP_ORG_VENDOR in specfile


author: Thomas Woerner <twoerner@redhat.com> 1.2.29-4
changelog:
  - fixed possible privilege escalation flaw via use of python pickle
    (CVE-2011-2520), replaced pickle by json (rhbz#717985) and (rhbz#722991)
  - stop D-BUS firewall mechanism on update


author: Lukas Nykryn <lnykryn@redhat.com> - 219-50
changelog:
  - core: fix the reversed sanity check when setting StartupBlockIOWeight over dbus (#1302305)
  - shared/dropin: ignore ENAMETOOLONG when checking drop-in directories (#7525) (#1489095)
  - enable display manager only on systemd installation (#1464893)
  - remove unnecessary dependency on dracut (#1466676)
  - substitute PACKAGE_STRING with the actual package NVR (#1453153)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-52
changelog:
  - cryptsetup: when unlocking always put path to the object into Id (#1511043)
  - cryptsetup: use more descriptive name for the variable and drop redundant function (#1511043)
  - cryptsetup-generator: do not bind to the decrypted device unit (#6538) (#1511043)
  - introduce naming based on phys_port_name for nfp via udev rule (#1516283)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-54
changelog:
  - automount: ack automount requests even when already mounted (#1535135)
  - udev: net_id add support for platform bus (ACPI, mostly arm64) devices (#1529633)
  - journald-native: Fix typo in MANDLOCK message (#1501017)
  - process-util: make our freeze() routine do something useful (#1540941)
  - dbus: propagate errors from bus_init_system() and bus_init_api() (#1541061)
  - bus-util.c: fix TasksMax= property assignment (#1537147)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-55
changelog:
  - sparse: avoid clash with __bitwise and __force from 4.10 linux/types.h (#5061) (#1447937)
  - core: Let two more booleans survive a daemon-reload (#1542391)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-57
changelog:
  - sd-journal: properly handle inotify queue overflow (#1540538)
  - sd-journal: make sure it's safe to call sd_journal_process() before the first sd_journal_wait() (#1540538)
  - journalctl: Periodically call sd_journal_process in journalctl (#1540538)
  - sd-journal: when picking up a new file, compare inode/device info with previous open file by same name (#1540538)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-57.1
changelog:
  - umount: always use MNT_FORCE in umount_all() (#7213) (#1571098)
  - core: Implement timeout based umount/remount limit (#1571098)
  - core: Implement sync_with_progress() (#1571098)


author: EL Errata <el-errata_ww@oracle.com> - 219-57.0.1
changelog:
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]


author: Lukas Nykryn <lnykryn@redhat.com> - 219-58
changelog:
  - tmpfiles: don't skip cleanup of read-only root owned files if TMPFILES_AGE_ALL is set (#1533638)
  - timer: we already got the trigger before, no need to call UNIT_TRIGGER again (#1549119)
  - doc: fix links to binfmt_misc kernel documentation (#1572244)
  - man/udevadm: remove superfluous --version from subcommand (#1553076)
  - man/udevadm: correctly show the short version of --exit (#1552712)
  - core/timer: downgrade message about random time addition (#5229) (#1587906)
  - fd-util: add new acquire_data_fd() API helper (#1446095)
  - systemd-analyze: make dump work for large # of units (#1446095)
  - use max. message size allowed by DBus spec (#8936) (#1446095)
  - cryptsetup: support LUKS2 on-disk format (#1573838)
  - units: don't put udev to its own mount namespace with slave propagation (#1432211)
  - rules: disable support for Lenovo IR cameras (#1540418)
  - core: make sure "systemctl reload-or-try-restart is actually a noop if a unit is not running (#1191920)
  - core: fix confusing logging of instantaneous jobs (#1506256)
  - core: correct return value from reload methods (#1506256)
  - core: always try harder to get unit status message format string (#1506256)
  - core: unit_get_status_message_format() never returns NULL (#1506256)
  - core: try harder to get job completion messages too (#1506256)
  - core: remove generic job completion messages from unit vtables (#1506256)
  - core: do not log done failed-condition jobs as if unit started (#1506256)
  - core: log completion of remaining job types (#1506256)
  - core: adjust job completion message log levels (#1506256)
  - mount: add new LazyUnmount= setting for mount units, mapping to umount(8)'s "-l" switch (#3827) (#1497264)
  - rules: Add MODEL_ID for NVMe device (#7037) (#1397264)
  - umount: always use MNT_FORCE in umount_all() (#7213) (#1571098)
  - core: Implement timeout based umount/remount limit (#1571098)
  - core: Implement sync_with_progress() (#1571098)
  - journal: forward messages from /dev/log unmodified to syslog.socket (#1409659)
  - tmpfiles: use safe_glob() (#1436004)
  - core: delay adding target dependencies until all units are loaded and aliases resolved (#8381) (#1368856)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-59
changelog:
  - man: correct the meaning of TimeoutStopSec= (#1305509)
  - rules: mark hotplugged memory as movable (#1563532)
  - udev: add ID_INPUT_SWITCH for devices with switch capability (#5057) (#1597240)
  - rules: disable support for Dell IR cameras (#1591316)
  - rpm: fix 
  if [ $1 -eq 1 ] ; then 
                  systemctl preset \--global  >/dev/null 2>&1 || : 
  fi 
  () macro. (#1582383)
  - rpm: remove confusing --user before --global (#1582383)
  - automount: handle state changes of the corresponding mount unit correctly (#1596241)
  - man: document that SIGCONT always follows SIGTERM (#1601794)
  - rules: add udev rule that automatically offline HW attached to ACPI container (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-60
changelog:
  - Revert "rules: mark hotplugged memory as movable" (#1614686)
  - rules: implement new memory hotplug policy (#1614686)
  - Revert "rules: add udev rule that automatically offline HW attached to ACPI container" (#1597958)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1619743)
  - cryptsetup-generator: don't return error if target directory already exists (#1619743)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1619743)
  - Make sure the mount units pulled by 'RequiresMountsFor=' are loaded (if they exist) (#1619743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.2
changelog:
  - journald: do not store the iovec entry for process commandline on stack (#1657788)
  - journald: set a limit on the number of fields (1k) (#1657792)
  - journal-remote: set a limit on the number of fields in a message (#1657792)


author: EL Errata <el-errata_ww@oracle.com> - 219-62.0.4
changelog:
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.4
changelog:
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667870)
  - Allocate temporary strings to hold dbus paths on the heap (#1667870)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.6
changelog:
  - Revert "bus: when dumping string property values escape the chars we use as end-of-line and end-of-item marks" (#1643172)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-63
changelog:
  - dhcp6: make sure we have enough space for the DHCP6 option header (CVE-2018-15688)
  - journald: do not store the iovec entry for process commandline on stack (#1657788)
  - journald: set a limit on the number of fields (1k) (#1657792)
  - journal-remote: set a limit on the number of fields in a message (#1657792)
  - journald: free cmdline buffers owned by iovec (#1666646)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-64
changelog:
  - detect-virt: do not try to read all of /proc/cpuinfo (#1631531)
  - core: disable the effect of Restart= if there's a stop job pending for a service (#6581) (#1626382)
  - networkd: respect DHCP UseRoutes option (#1663365)
  - networkd: fix dhcp4 link without routes not being considered ready (#8728) (#1663365)
  - networkd: dont crash when mtu changes (#6594) (#1663365)
  - tmpfiles: "e" takes globs (#1641764)
  - tmpfiles: 'e' is supposed to operate on directory only (#1641764)
  - tmpfiles: 'e' is supposed to accept shell-style globs (#1641764)
  - bus-message: do not crash on message with a string of zero length (#1643396)
  - Revert "bus: when dumping string property values escape the chars we use as end-of-line and end-of-item marks" (#1643172)
  - set automount state to waiting when the mount is stopped (#1651257)
  - core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
  - shorten hostname before checking for trailing dot (#1631625)
  - journald: fixed assertion failure when system journal rotation fails (#9893) (#1619543)
  - local-addresses: handle gracefully if routes lack an RTA_OIF attribute (#1627750)
  - rules: fix memory hotplug rule so systemd-detect-virt does not run too often (#1666612)
  - 6647 - use path_startswith("/dev") in cryptsetup (#6732) (#1664695)
  - core: mount-setup: handle non-existing mountpoints gracefully (#1585411)
  - units/rescue.service.in: fix announcement message (#1660422)
  - systemctl: Allow 'edit' and 'cat' on unloaded units (#1649518)
  - main: improve RLIMIT_NOFILE handling (#5795) (#1585913)
  - shared/sleep-config: exclude zram devices from hibernation candidates (#1609816)
  - journalctl: allow --file/--directory with --boot or --list-boots (#1463678)
  - journalct: allow --boot=0 to DTRT with --file/--directory (#1463678)
  - journal-remote: show error message if output file name does not end with .journal (bz#1267552)
  - artificially serialize building of .policy files (#1272485)
  - cryptsetup: add support for sector-size= option (#9936) (#1571801)
  - cryptsetup: do not define arg_sector_size if libgcrypt is v1.x (#9990) (#1571801)
  - journal: fix syslog_parse_identifier() (#1657794)
  - journal: do not remove multiple spaces after identifier in syslog message (#1657794)
  - tmpfiles: change ownership of symlinks too (#1620110)
  - tmpfiles: fix check for figuring out whether to call chmod() (#1620110)
  - shared/install: allow "enable" on linked unit files (#1628575)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-65
changelog:
  - backport fd_is_fs_type (#1663143)
  - backport chase_symlinks (#1663143)
  - fs-util: add new CHASE_SAFE flag to chase_symlinks() (#1663143)
  - fs-util: add new chase_symlinks() flag CHASE_OPEN (#1663143)
  - sd-dameon: also sent ucred when our UID differs from EUID (#1663143)
  - notify: add new --uid= command (#1663143)
  - core: be stricter when handling PID files and MAINPID sd_notify() messages (#1663143)
  - journald: respect KeepFree= as well as MaxUse= values (#1361893)
  - shutdown: in_container was used before its definition (#1693716)
  - core: Fix edge case when processing /proc/self/mountinfo (#1691511)
  - sd-bus: deal with cookie overruns (#1693559)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667871)
  - Allocate temporary strings to hold dbus paths on the heap (#1667871)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1667871)
  - udev: check if the spawned PID didn't exit after reaping unexpected PID (#1697909)
  - udev: call poll() again after killing the spawned process (#1697909)
  - udev: check age against both timeouts to prevent integer wraparound (#1697909)
  - avoid possible hang if our child process hangs (#1697909)
  - missing: when adding syscall replacements, use different names (#1694605)
  - include sys/sysmacros.h in more places (#1694605)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-66
changelog:
  - sd-bus: unify three code-paths which free struct bus_container (#1643394)
  - hashmap: don't use mempool (#1609349)
  - man: be more explicit about thread safety of sd_journal (#1609349)
  - selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to audit (#1240730)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-67.1
changelog:
  - return error value on failure (#1729226)
  - revert local changes made during backport of the test (#1729226)
  - core/timer: Prevent timer looping when unit cannot start (#1729230)
  - core: add a "Requires=" dependency between units and the slices they are located in (#1729228)
  - core: rerun GC logic for a unit that loses a reference (#1729228)
  - pid1: rename unit_check_gc to unit_may_gc (#1729228)
  - pid1: include the source unit in UnitRef (#1729228)
  - pid1: fix collection of cycles of units which reference one another (#1729228)
  - pid1: free basic unit information at the very end, before freeing the unit (#1729228)
  - pid1: properly remove references to the unit from gc queue during final cleanup (#1729228)
  - service: relax PID file symlink chain checks a bit (#8133) (#1729414)
  - path-util: fix more path_is_mount e792e890f fallout (#1279231)


author: EL Errata <el-errata_ww@oracle.com> - 219-67.0.5
changelog:
  - fix to generate the systemd-pstore.service file [Orabug: 30235241]
  - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]


author: systemd maintenance team <systemd-maint@redhat.com> - 219-67.4
changelog:
  - core: when restarting services, don't close fds (#1798162)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1798162)
  - tests: add basic journal test (#1798162)
  - tests: add regression test for `systemctl restart systemd-journald` (#1798162)
  - tests: add test that journald keeps fds over termination by signal (#1798162)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-69
changelog:
  - revert local changes made during backport of the test (#1726785)
  - core: add a "Requires=" dependency between units and the slices they are located in (#1718953)
  - core: rerun GC logic for a unit that loses a reference (#1718953)
  - pid1: rename unit_check_gc to unit_may_gc (#1718953)
  - pid1: include the source unit in UnitRef (#1718953)
  - pid1: fix collection of cycles of units which reference one another (#1718953)
  - pid1: free basic unit information at the very end, before freeing the unit (#1718953)
  - pid1: properly remove references to the unit from gc queue during final cleanup (#1718953)
  - core/timer: Prevent timer looping when unit cannot start (#1710302)
  - service: relax PID file symlink chain checks a bit (#8133) (#1724420)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-70
changelog:
  - udev-rules: Add rule for /dev/kfd (#1659516)
  - core: exclude .slice units from "systemctl isolate" (#1745199)
  - udev/scsi_id: fix incorrect page length when get device identification VPD page (#1635945)
  - core: when determining whether a process exit status is clean, consider whether it is a command or a daemon (#1560417)
  - units: add Wants=initrd-cleanup.service to initrd-switch-root.target (#4345) (#1560417)
  - units: make sure initrd-cleanup.service terminates before switching to rootfs (#1560417)
  - core: tiny tweak for cgroup trimming during manager_free() (#1630378)
  - process: an empty environment block should be returned as such (#1685648)
  - core: make sure initrd-switch-root command survives PID1's killing spree (#4730) (#1754053)
  - systemctl: always avoid being killed when doing switch-root (#1754053)
  - units: drop KillMode= from initrd-switch-root.service (#1754053)
  - systemctl: ignore SIGTERM after switch root (#1754053)
  - units: restore Before dependencies for systemd-vconsole-setup.service (#1754053)
  - core: reduce the number of stalled PIDs from the watched processes list when possible (#1501796)
  - timedate: use gmtime_r() and localtime_r() (#1694605)
  - sd-bus: stop using the result of an assignment as an operand of && (#1694605)
  - journal-upload: add asserts that snprintf does not return an error (#1694605)
  - analyze: actually select longest activated-time of services (#1694605)
  - pid1: remove unnecessary error reassignment (#1694605)
  - core: drop unnecessary condition (#1694605)
  - import: drop unnecessary condition (#1694605)
  - journal-verify: add comment and silence LGTM warning (#1694605)
  - journal: drop redundant condition (#1694605)
  - lldp: set correct state for processing (#1694605)
  - sd-bus: fix implicit downcast of bitfield reported by LGTM (#1694605)
  - tree-wide: use 'signed int' instead of 'int' for bit field variables (#1694605)
  - machinectl: check correct FD for a return value (#1694605)
  - shared/install: avoid overwriting 'r' counter with a partial result (#1694605)
  - systemctl: set_put() can't return (-)EEXIST (#1694605)
  - systemctl: remove dead check (#1694605)
  - journal-gateway: explicitly declare local variables (#1694605)
  - journal-gateway: use localStorage["cursor"] only when it has valid value (#1694605)
  - lgtm: ignore files dropped in upstream (#1694605)
  - lgtm: suppress several constant comparisons (#1694605)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-71
changelog:
  - core: add a new unit_needs_console() call (#1524359)
  - core: rework how we count the n_on_console counter (#1524359)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-72
changelog:
  - service: introduce protocol error type (#1733998)
  - service: fix main processes exit behavior for type notify services (#1733998)
  - service: go through stop_post on failure (#4770) (#1733998)
  - Call getgroups() to know size of supplementary groups array to allocate (#1743230256 KB)
  - udev: introduce CONST key name (#1748051)


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 219-73.0.1
changelog:
  - enable and start the pstore service [Orabug: 30950903]
  - fix to generate the systemd-pstore.service file [Orabug: 30235241]
  - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.2
changelog:
  - core: when restarting services, don't close fds (#1803802)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1803802)
  - tests: add basic journal test (#1803802)
  - tests: add regression test for `systemctl restart systemd-journald` (#1803802)
  - tests: add test that journald keeps fds over termination by signal (#1803802)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.4
changelog:
  - mount: don't propagate errors from mount_setup_unit() further up (#1809159)
  - mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1809159)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.5
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1810576)
  - core: rework StopWhenUnneeded= logic (#1810576)
  - fix the fix for #1691511 (#1809159)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.6
changelog:
  - sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1817504)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1820073)
  - sd-journal: remove the dead code and actually fix #14695 (#1820073)
  - swap: adjust swap.c in a similar way to what we just did to mount.c (#1821261)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1821261)


author: EL Errata <el-errata_ww@oracle.com> - 219-73.0.1
changelog:
  - udev rules: fix memory hot add and remove [Orabug: 31309730]
  - enable and start the pstore service [Orabug: 30950903]
  - fix to generate the systemd-pstore.service file [Orabug: 30235241]
  - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]


author: EL Errata <el-errata_ww@oracle.com> - 219-73.0.1.el7_8.8
changelog:
  - backport upstream pstore tmpfiles patch (Eric DeVolder) [Orabug: 31414539]
  - udev rules: fix memory hot add and remove [Orabug: 31309730]
  - enable and start the pstore service [Orabug: 30950903]
  - fix to generate the systemd-pstore.service file [Orabug: 30235241]
  - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]


author: systemd maintenance team <systemd-maint@redhat.com> - 219-74
changelog:
  - sd-bus: bump message queue size again (#1770158)
  - unit: fix potential use of cgroup_path after free() when freeing unit (#1760149)
  - add test for ExecStopPost (#1733998)
  - core: when restarting services, don't close fds (#1757704)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1757704)
  - tests: add basic journal test (#1757704)
  - tests: add regression test for `systemctl restart systemd-journald` (#1757704)
  - tests: add test that journald keeps fds over termination by signal (#1757704)
  - nss-util: silence warning about deprecated RES_USE_INET6 (#1799002)
  - journal: do not trigger assertion when journal_file_close() get NULL (#1786046)
  - mount: don't propagate errors from mount_setup_unit() further up (#1804757)
  - mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1804757)
  - fix the fix for #1691511 (#1804757)
  - v3: Properly parsing SCSI Hyperv devices (#8509) (#1809053)
  - Consider smb3 as remote filesystem (#1811700)
  - mount: don't add Requires for tmp.mount (#1813270)
  - sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1769928)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1812889)
  - sd-journal: remove the dead code and actually fix #14695 (#1812889)
  - swap: adjust swap.c in a similar way to what we just did to mount.c (#1749621)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749621)
  - core: add a new unit file setting CollectMode= for tweaking the GC logic (#1817576)
  - run: add "-G" as shortcut for "--property=CollectMode=inactive-or-failed" (#1817576)
  - core: clarify that the CollectMode bus property is constant (#1817576)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1814028)
  - logind: check PolicyKit before allowing VT switch (#1797672)
  - timer: don't use persietent file timestamps from the future (#6823) (#1769923)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766477)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798503)
  - journal-remote: split-mode=host, remove port from journal filename (#1244691)
  - core: downgrade log message about inability to propagate cgroup release message (#1679934)
  - units: move Before deps for quota services to remote-fs.target (#5627) (#1693374)
  - set kptr_restrict=1 (#1689344)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
  - core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
  - core: coldplug possible nop_job (#1829754)
  - core: make sure to restore the control command id, too (#1828953)


author: Tianyue Lan <tianyue.lan@oracle.com> - 219-78.0.1
changelog:
  - Backport upstream patches related to private-tmp (Sushmita Bhattacharya) [Orabug: 31561883]
  - backport upstream pstore tmpfiles patch (Eric DeVolder) [Orabug: 31414539]
  - udev rules: fix memory hot add and remove [Orabug: 31309730]
  - enable and start the pstore service [Orabug: 30950903]
  - fix to generate the systemd-pstore.service file [Orabug: 30235241]
  - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]


author: Eric DeVolder <eric.devolder@oracle.com> - 219-78.0.1.el7.1 [Orabug 31414539]
changelog:
  - Change to have file tmpfiles.d/systemd-pstore.conf installe on upon
    initial installation, not on rpm update.


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.1
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793527)
  - device: don't emit PropetiesChanged needlessly (#1793527)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.2
changelog:
  - core: don't update unit description if it is already set to the same value (#1793527)
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1793527)
  - core: fix unnecessary fallback to the rescue mode caused by initrd-switch-root.service's exit status judgment error (#1825232)


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 219-78.0.1.el7_9.2
changelog:
  - Change to have file tmpfiles.d/systemd-pstore.conf installed on upon
    initial installation, not on rpm update. [Orabug 31414539]
  - Backport upstream patches related to private-tmp (Sushmita Bhattacharya) [Orabug: 31561883]
  - backport upstream pstore tmpfiles patch (Eric DeVolder) [Orabug: 31414539]
  - udev rules: fix memory hot add and remove [Orabug: 31309730]
  - enable and start the pstore service [Orabug: 30950903]
  - fix to generate the systemd-pstore.service file [Orabug: 30235241]
  - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.4
changelog:
  - test: add a test/reproducer for BZ#1989245 (#1989245)
  - strv: fix buffer size calculation in strv_join_quoted() (#1989245)
  - install: refactor find_symlinks() and don't search for symlinks recursively (#1828758)


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 219-78.0.9.el7_9.7
changelog:
  - Core: explicitly trigger changing udev systemd_wants property [Orabug: 31858125]
  - Disable unprivileged BPF by default [Orabug: 32871008]
  - Resolve missing installation files for systemd-pstore [Orabug 32497787]
  - Change to have file tmpfiles.d/systemd-pstore.conf installed on upon
  	initial installation, not on rpm update. [Orabug 31414539]
  - Backport upstream patches related to private-tmp (Sushmita Bhattacharya) [Orabug: 31561883]
  - backport upstream pstore tmpfiles patch (Eric DeVolder) [Orabug: 31414539]
  - udev rules: fix memory hot add and remove [Orabug: 31309730]
  - enable and start the pstore service [Orabug: 30950903]
  - fix to generate the systemd-pstore.service file [Orabug: 30235241]
  - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
  - daemon reload race fix [Orabug: 34205619]


author: Eric DeVolder <eric.devolder@oracle.com> - 219-78.0.10.el7_9.7
changelog:
  - Backport upstream pstore dmesg fix [Orabug: 34845435]
  - Fix pstore StateDirectory error message [Orabug: 34852549]


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 219-78.0.10.el7_9.8
changelog:
  - Backport upstream pstore dmesg fix [Orabug: 34845435]
  - Fix pstore StateDirectory error message [Orabug: 34852549]
  - Core: explicitly trigger changing udev systemd_wants property [Orabug: 31858125]
  - Disable unprivileged BPF by default [Orabug: 32871008]
  - Resolve missing installation files for systemd-pstore [Orabug 32497787]
  - Change to have file tmpfiles.d/systemd-pstore.conf installed on upon
  	initial installation, not on rpm update [Orabug 31414539]
  - Backport upstream patches related to private-tmp (Sushmita Bhattacharya) [Orabug: 31561883]
  - backport upstream pstore tmpfiles patch (Eric DeVolder) [Orabug: 31414539]
  - udev rules: fix memory hot add and remove [Orabug: 31309730]
  - enable and start the pstore service [Orabug: 30950903]
  - fix to generate the systemd-pstore.service file [Orabug: 30235241]
  - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
  - daemon reload race fix [Orabug: 34205619]


author: Codrin Pruteanu <codrin.pruteanu@oracle.com> - 219-78.0.10.el7_9.9
changelog:
  - Backport upstream pstore dmesg fix [Orabug: 34845435]
  - Fix pstore StateDirectory error message [Orabug: 34852549]
  - Core: explicitly trigger changing udev systemd_wants property [Orabug: 31858125]
  - Disable unprivileged BPF by default [Orabug: 32871008]
  - Resolve missing installation files for systemd-pstore [Orabug 32497787]
  - Change to have file tmpfiles.d/systemd-pstore.conf installed on upon
      initial installation, not on rpm update [Orabug 31414539]
  - Backport upstream patches related to private-tmp (Sushmita Bhattacharya) [Orabug: 31561883]
  - backport upstream pstore tmpfiles patch (Eric DeVolder) [Orabug: 31414539]
  - udev rules: fix memory hot add and remove [Orabug: 31309730]
  - enable and start the pstore service [Orabug: 30950903]
  - fix to generate the systemd-pstore.service file [Orabug: 30235241]
  - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
  - daemon reload race fix [Orabug: 34205619]
  - Backport upstream pstore dmesg fix [Orabug: 34845435]
  - Fix pstore StateDirectory error message [Orabug: 34852549]


author: Sushmita Bhattacharya <sushmita.bhattacharya@oracle.com> - 219-78.0.13
changelog:
  - Add an extra timeout, configurable through env, before udev kills workers. Set to 10 min [Orabug: 35909317]


author: David Kubat <david.kubat@oracle.com> - 219-78.0.7.5
changelog:
  - Core: explicitly trigger changing udev systemd_wants property [Orabug: 31858125]
  - Disable unprivileged BPF by default [Orabug: 32871008]
  - Resolve missing installation files for systemd-pstore [Orabug 32497787]
  - Change to have file tmpfiles.d/systemd-pstore.conf installed on upon
    initial installation, not on rpm update. [Orabug 31414539]
  - Backport upstream patches related to private-tmp (Sushmita Bhattacharya) [Orabug: 31561883]
  - backport upstream pstore tmpfiles patch (Eric DeVolder) [Orabug: 31414539]
  - udev rules: fix memory hot add and remove [Orabug: 31309730]
  - enable and start the pstore service [Orabug: 30950903]
  - fix to generate the systemd-pstore.service file [Orabug: 30235241]
  - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
  - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
  - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [22224874]
  - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
  - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]


author: David Smith <dsmith@redhat.com> - 3.1-3
changelog:
  - Added patches for:
  - rhbz1425568 task_dentry_path() fix
  - rhbz1431263 arm64 hardware breakpoint crash fix
  - rhbz1430828 replace task_exe_file() with current_exe_file()
  - rhbz1436845 adapt stapdyn to the dyninst 9.3.1 library search model
  - rhbz1433391 workaround parser issue in nfs_proc.stp
  - rhbz1428120 update lookup_bad_addr()


author: Frank Ch. Eigler <fche@redhat.com> - 3.2-3
changelog:
  - rhbz1506230 (netif_receive_skb_internal probing)
  - rhbz1490862 (f2fs tracepoint header workarounds)


author: Frank Ch. Eigler <fche@redhat.com> - 3.3-2
changelog:
  - Enable BPF build (rhbz1544689, rhbz1311586) (x86-64 only)
  - Fix vfs.add_to_page_cache probe (rhbz1547238)
  - Fix foreach_limit.exp compilability (rhbz1591267)


author: Serhei Makarov <smakarov@redhat.com> - 3.3-3
changelog:
  - Add BPF left-operand fix (rhbz1560044) (x86-64 only)
  - Add stap.1 note on missing stapbpf.8 (rhbz1560044)
  - Fix RHEL-ALT build (rhbz1544689)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 5.1.2-9
changelog:
  - Add patch to fix CVE-2010-2642, CVE-2011-0433 (afm-fix patch)
  - New version of patch for CVE-2011-0764, also fixes CVE-2011-1552,
    CVE-2011-1553, CVE-2011-1554 (type1-inv-rw-fix patch)
    Resolves: rhbz#772899
  - Add explicit NVR requires to apps subpackage (consumes libt1(x).so)
  - Fix rpmlint warning (mixed-use-of-spaces-and-tabs)


author: Rex Dieter <rdieter@fedoraproject.org> 1.8-1
changelog:
  - taglib-1.8

  -* Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.2-2
  -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild


author: gil cattaneo <puntogil@libero.it> 0:1.2.1-1
changelog:
  - Upgraded to 1.2.1
  - remove ant-nodeps reference
  - changed group in javadoc sub package (from Development/Documentation in Documentation)
  - add maven metadata
  - add manual
  - Adapt to current guidelines.


author: Nathaniel McCallum <npmccallum@redhat.com> - 4-1
changelog:
  - Import SRPM from Fedora (tang-4-3.fc26)
  - Remove nagios dependency
  - Adjust http-parser version for RHEL


author: Petr Machata <pmachata@redhat.com> - 4.1-2.20130314
changelog:
  - Fix mfence patch.  Since the __TBB_full_memory_fence macro was
    function-call-like, it stole () intended for function invocation.


author: Petr Machata <pmachata@redhat.com> - 4.1-6.20130314
changelog:
  - Drop ExclusiveArch altogether. TBB has a fallback code that works
    irrespective of the architecture.


author: Brian Pepple <bpepple@fedoraproject.org> - 0.6.0-1
changelog:
  - Update to 0.6.0
  - Drop python subpackage. gobject-introspection is used now.
  - Drop unnecessary buildroot cleaning in install section.
  - Update BR for farstream02-devel.


author: Kalev Lember <klember@redhat.com> - 0.24.1-1
changelog:
  - Update to 0.24.1
  - Fix the build with glib 2.46 and later
  - Rebuild against gobject-introspection 1.54
  - Resolves: #1507813


author: Debarshi Ray <rishi@fedoraproject.org> - 1:5.14.1-5
changelog:
  - Add %check to run the upstream test suite on each build (Red Hat #1000705)
  - Resort to using chrpath for removing rpaths instead of hacking libtool


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.1-5
changelog:
  - Fix upstream test failure in Pod-Simple-Texinfo
    Resolves: #970986
  - Fix @enumerate does not support start numbers greater than nine
    Resolves: #1134160


author: Than Ngo <than@redhat.com> - 2:2012-34.20130427_r30134
changelog:
  - Resolves: bz#1064453, add missing texlive-metapost and groff.enc
    Resolves: bz#948532, add missing manpages for pdfxmltex, xmltex
    Resolves: bz#1213886, tex4ht-bin requires latex
    Resolves: bz#1217556, port for poppler-0.26.5
    Resolves: bz#1035679, scriptlet errors when installing texlive packages
    Resolves: bz#1184987, add texlive-titling


author: Than Ngo <than@redhat.com> - 2:2012-39.20130427_r30134
changelog:
  - Resolves: #1320337 - dependiency on texlive-xetex-def
  - Resolves: #1350485 - updmap from texlive-tetex-bin cannot be executed
  - Resolves: #1337925 - scriptlet errors
  - Resolves: #1186825 - add coreutils for post/unpost


author: EL Errata <el-errata_ww@oracle.com> - 102.10.0-2.0.1
changelog:
  - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js
  - Enabled aarch64 build


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: EL Errata <el-errata_ww@oracle.com> - 68.12.0-1.0.1
changelog:
  - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js
  - Build with rust-toolset 1.43


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-6
changelog:
  - Kill session after user logs out
    Resolves: bz#1259757

    Build against Xorg 1.20
    Resolves: bz#1564061


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-14
changelog:
  - Fix rendering on big endian system
    Resolves: bz#1618777

    Do not automatically kill sessions
    Resolves: bz#1646889


author: Sushmita Bhattacharya <sushmita.bhattacharya@oracle.com> - 1.8.0-19.0.3
changelog:
  - Service definition update patch not reqd because of the vncserver wrapper script, removed
    [Orabug: 31159449]


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-20
changelog:
  - Fix stack buffer overflow in CMsgReader::readSetCursor
    Resolves: bz#1791773

  - Fix heap buffer overflow in DecodeManager::decodeRect
    Resolves: bz#1791768

  - Fix heap buffer overflow in TightDecoder::FilterGradient
    Resolves: bz#1791763

  - Fix heap-based buffer overflow triggered from CopyRectDecoder
    Resolves: bz#1791747

  - Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
    Resolves: bz#1791759

  - Add option to fallback to empty port when the specified one is taken
    Resolves: bz#1791996


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-23
changelog:
  - Rebuild for xorg-x11-server CVEs
    Resolves: CVE-2022-4283 (bz#2154267)
    Resolves: CVE-2022-46340 (bz#2154261)
    Resolves: CVE-2022-46341 (bz#2154264)
    Resolves: CVE-2022-46342 (bz#2154262)
    Resolves: CVE-2022-46343 (bz#2154265)
    Resolves: CVE-2022-46344 (bz#2154266)


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-26
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
    Resolves: RHEL-15235
  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15223


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-27
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18415
  - CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18427


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-28
changelog:
  - Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18415


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-29
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20436
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20427
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20587
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21212


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-30
changelog:
  - Don't try to get pointer position when the pointer becomes a floating device
    Resolves: RHEL-20436


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-31
changelog:
  - Fix use after free related to CVE-2024-21886
    Resolves: RHEL-20436
  - Fix copy/paste error in the DeviceStateNotify
    Resolves: RHEL-20587


author: Codrin Pruteanu <codrin.pruteanu@oracle.com> - 1.8.0-31.0.1
changelog:
  - Dropped xorg-CVE-2023-5367.patch, xorg-CVE-2023-6816.patch, xorg-CVE-2023-6377.patch, xorg-CVE-2023-6478.patch,
    xorg-CVE-2024-0229-1.patch, xorg-CVE-2024-0229-2.patch, xorg-CVE-2024-0229-3.patch, xorg-CVE-2024-21885.patch,
    xorg-CVE-2024-21886-1.patch, xorg-CVE-2024-21886-2.patch, xorg-dix-fix-use-after-free-in-input-device-shutdown.patch


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-32
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-31006
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30976
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30993


author: Codrin Pruteanu <codrin.pruteanu@oracle.com> - 1.8.0-33.0.1
changelog:
  - Dropped xorg-CVE-2023-5367.patch, xorg-CVE-2023-6816.patch, xorg-CVE-2023-6377.patch, xorg-CVE-2023-6478.patch,
    xorg-CVE-2024-0229-1.patch, xorg-CVE-2024-0229-2.patch, xorg-CVE-2024-0229-3.patch, xorg-CVE-2024-21885.patch,
    xorg-CVE-2024-21886-1.patch, xorg-CVE-2024-21886-2.patch, xorg-dix-fix-use-after-free-in-input-device-shutdown.patch,
    xorg-CVE-2024-31080.patch, xorg-CVE-2024-31081.patch, xorg-CVE-2024-31082.patch, xorg-CVE-2024-31083.patch,
    xorg-CVE-2024-31083-followup.patch


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-1
changelog:
  - Update to 1.7.1
    Resolves: bz#1388620
    Resolves: bz#1343899
    Resolves: bz#1410164
    Resolves: bz#1415547
    Resolves: bz#1418945
    Resolves: bz#1416290
    Resolves: bz#1342956
  - Fix shared memory leakage
    Resolves: bz#1358090
  - Added systemd unit file for xvnc
    Resolves: bz#1393971


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-2
changelog:
  - Be more restrictive with shared memory mode bits
    Resolves: bz#1152552
    Limit max username/password size in SSecurityPlain [CVE-2017-7394]
    Resolves: bz#1438737
    Fix crash from integer overflow in SMsgReader::readClientCutText [CVE-2017-7395]
    Resolves: bz#1438742


author: Jan Grulich <jgrulich@redhat.com> - 1.7.1-3
changelog:
  - Delete underlying ssecurity in SSecurityVeNCrypt [CCVE-2017-7392]
    Resolves: bz#1439127
    Prevent double free by crafted fences [CVE-2017-7393]
    Resolves: bz#1439134


author: Avesh Agarwal <avagarwa@redhat.com> - 0.8.3-8
changelog:
  - Fix build failure in fedora rawhide. It was caused due to 
    removal of CMAKE_INSTALL_LIBDIR macro from /etc/rpm/cmake.macros 
    that was present in previous fedora releases.


author: Avesh Agarwal <avagarwa@redhat.com> - 0.8.3-12
changelog:
  - Fixes for rhbz #985785 to fix crash issue in Filecert manager
    in platidimv.
  - Fixed crashing of attestation imv so while loading due to
    wrong static initialization order in attestation imv.
  - Fixes some coverity scan errors.
  - Fixed comilation when sysconf dir variable is not defined on a
    local system. Added some messaging outputs during compilations.
  - Fixed erroneous data type conversion issues causing wrong outputs
    and with potential for data corruption.
  - Fixes tncutil build issue from upstream commit
  - Fixes typo in assignment in platidimv from upstream commit
  - Fixes Fix typo in variable declaraction in hostscannerimv
    from upstream commit
  - Fixes imcv shared library build issue from upstream commit


author: Avesh Agarwal <avagarwa@redhat.com> - 0.8.3-13
changelog:
  - Implemented support for dlopen
  - Removed libtool support
  - Fixed imv and imc build issues arising from a
    previous upstream patch
  - Fixed a few coverity scan error issues


author: Stephen Gallagher <sgallagh@redhat.com> - 2:2.12.1-15
changelog:
  - Generate SSL certificates with x509v3 and CA:FALSE
  - Automatically import self-signed certificates into local trust-store
  - Move SSL certificate generation into the systemd service file
  - Resolves: #1041555


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-1
changelog:
  - Fix packaging of tmpfiles
    Resolves: #1180993
  - Add install Platform_LINUX_XSCALE_GNU.h, Linkage.h and CIMListener.h to -devel
    because of lmiwbem (CIMListener class), add symlink to libpeglistener.so.1
    Resolves: #1120701
  - Update to upstream version 2.14.1
    Resolves: #1097187, #1039050, #1007386
  - Fix sending of SNMPv3 traps
    Resolves: #1218954


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-2
changelog:
  - Remove files created in %check
    Resolves: #1232341
  - Fix setupSDK in -devel
    Resolves: #1127399
  - Add snmp tests to the -test rpm and enable them, configure snmptrapd
    in test setup phase
    Related: #1218954


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-4
changelog:
  - Fix ppc64le SDK
    Resolves: #1266235
  - Move SSL certificates to more convenient place, update related scripts
    and README.RedHat.SSL
    Resolves: #1308809
  - Change repository update to get rid of warning messages during cleanup
    Resolves: #1257085
  - Remove TESTID environment variable which breaks automatic testing in Beaker
    Resolves: #1266655
  - Add CIMEnumerationContext.h and UintArgs.h to -devel
    Resolves: #1335873
  - Fix wrong formatting in cimconfig man page
    Resolves: #1263895
  - Add missing description of httpSessionTimeout to cimconfig man page
    Resolves: #1263894


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-2
changelog:
  - Resolves: rhbz#1459747 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
  - Resolves: rhbz#1441481 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-3
changelog:
  - Resolves: rhbz#1498343 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws
  - Resolves: rhbz#1495655 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning
  - Resolves: rhbz#1470597 CVE-2017-5647 Add follow up revision


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-5
changelog:
  - Resolves: rhbz#1485453 man page uid and gid mismatch for service accounts
  - Resolves: rhbz#1505762 Problem to start tomcat with a user whose group has a name different to the user


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-9
changelog:
  - Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
  - Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
  - Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
  - Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
  - Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
  - Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
  - Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
  - Resolves: rhbz#1455483 Add support for characters "<" and ">" to the possible whitelist values


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-12
changelog:
  - Resolves: rhbz#1367492 harden package permissions
  - Resolves: rhbz#1523112 tomcat systemd does not cope with - in service names
  - Resolves: rhbz#1629162 tomcat-dbcp.jar is missing from tomcat package
  - Resolves: rhbz#1822453 Tomcat parses a request having an absolute URI path incorrectly and returns 404 Not Found
  - Resolves: rhbz#1795645 connection leak with StatementCache, SlowQueryReport or StatementDecoratorInterceptor
  - Resolves: CVE-2019-17563 tomcat: session fixation when using FORM authentication


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
  - Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
  - Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
  - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
  - Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-9
changelog:
  - Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368122


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-1
changelog:
  - Update to 3.14.3
  - Re-add opensubtitles plugin, as it doesn't depend on PyXDG anymore
  Resolves: #1174589


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-4
changelog:
  - Remove Python3 plugins, they're mostly accessory plugins,
    and RHEL 7.2 only support Python2 for now
  Resolves: #1259643


author: Ray Strode <rstrode@redhat.com> 3.14.3-5
changelog:
  - Add more goo to the compat desktop file to prevent them
    from exposing in control-center
  Related: #1259292


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1.3.9-3
changelog:
  - Fix garbage being printed in tpm_version output
  - backport spec file cleanups
  Resolves: rhbz#1654985


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-2
changelog:
  - Removed BuildRequires for gcc
  - Move tpm2-abrmd systemd service to /usr/lib/systemd/system
  - Added scriptlet for tpm2-abrmd systemd service
  - Use autoreconf instead of bootstrap


author: Sun Yunying <yunying.sun@intel.com> - 1.1.0-4
changelog:
  - Rename and relocate udev rules file to _udevrulesdir
  - Update scriptlet to add service name after systemd_postrun


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1.1.0-11
changelog:
  - Fix Requires to be against tpm2-tss instead of tpm2-tss-devel
  - Add BuildRequires to specify version tpm2-tss-devel needed
  - Add Requires to tpm2-abrmd-devel for tpm2-tss-devel
  resolves: rhbz#1627827


author: Sun Yunying <yunying.sun@intel.com> - 1.0-2
changelog:
  - Remove global macro pkg_version to avoid duplicate of version
  - Use ExclusiveArch instead of ExcludeArch
  - Use less wildcard in %files section to be more specific
  - Add trailing slash at end of added directory in %file section
  - Remove autoconf/automake/pkgconfig(cmocka) from BuildRequires
  - Increase release version to 2


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1.0-3
changelog:
  - Add systemd unit for resourcemgr
  - Add utils subpackage
  - Add Makefile.am patch to install test programs
  - Add patch to swap out AX_PTHREAD for different check
  - Increase release version to 3
  resolves: rhbz#1275027 - Add TPM 2.0 System API (SAPI) library


author: Felipe Borges <feborges@redhat.com> -1.10.5-3
changelog:
  - Add osinfo ontology to the default TrackerNamespace
  - Whitelist "openat" sys call in seccomp
  - Resolves: #1435340


author: Carlos Garnacho <cgarnach@redhat.com> - 1.10.5-4
changelog:
  - Remove WITHOUT ROWID optimizations from fts5 to preserve compat with sqlite 3.7.x
  - Resolves: #1451669


author: Carlos Garnacho <cgarnach@redhat.com> - 1.10.5-5
changelog:
  - Update to upstream 1.10.6, backporting all fixes as of yet for UNIQUE constraint nie:url errors
  - Resolves: #1430769


author: Carlos Garnacho <cgarnach@redhat.com> - 1.10.5-6
changelog:
  - Backport 1.10.6 nie:url UNIQUE constraint fixes to 1.10.5
  - Fix the previous changelog entry
  - Resolves: #1430769


author: Kamil Dudka <kdudka@redhat.com> - 1:3.2.5d-11
changelog:
  - install man pages using the correct file name suffix
  - provide the fig2ps2tex.sh man page as a symlink


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.10.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1546598
    - IRQ affinity handled by scheduler plugin
      resolves: rhbz#1590937


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.10.0-3
changelog:
  - realtime-virtual-guest/host: start/stop rt-entsk daemon on
    initialization/shutdown
    resolves: rhbz#1616043


author: James Cheng <james.cheng@oracle.com> - 2.10.0-6.0.1.el7_6.3
changelog:
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: EL Errata <el-errata_ww@oracle.com> - 2.10.0-6.0.3
changelog:
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.9.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1467576
    - added recommend.d functionality
      resolves: rhbz#1459146
    - recommend: added support for matching of processes
      resolves: rhbz#1461838
    - cpu-partitioning: used tuned instead of tuna for cores isolation
      resolves: rhbz#1442229
    - bootloader: splitted string for removal from cmdline
      resolves: rhbz#1461279
    - network-latency: added skew_tick=1 kernel command line parameter
      resolves: rhbz#1451073
    - bootloader: accepted only certain values for initrd_remove_dir
      resolves: rhbz#1455161
    - increased udev monitor buffer size, made it configurable
      resolves: rhbz#1442306
    - bootloader: don't add nonexistent overlay image to grub.cfg
      resolves: rhbz#1454340
    - plugin_cpu: don't log error in execute() if EPB is not supported
      resolves: rhbz#1443182
    - sap-hana: fixed description of the sap-hana profiles
      resolves: rhbz#1482005
    - plugin_systemd: on full_rollback notify about need of initrd regeneration
      resolves: rhbz#1469258
    - don't log errors about missing files on verify with ignore_missing set
      resolves: rhbz#1451435
    - plugin_scheduler: improved logging
      resolves: rhbz#1474961
    - improved checking if we are rebooting or not
      resolves: rhbz#1475571
    - started dbus exports after a profile is applied
      resolves: rhbz#1443142
    - sap-hana: changed force_latency to 70
      resolves: rhbz#1501252
    - plugin_video: added support for the 'dpm' power method
    - list available profiles on 'tuned-adm profile'


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.9.0-0.2.rc2
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1467576
    - fixed expansion of the variables in the 'devices' section
      related: rhbz#1490399
    - cpu-partitioning: add no_rebalance_cores= option
      resolves: rhbz#1497182


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.10.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1546598
    - script: show stderr output in the log
    - realtime-virtual-host: script.sh: add error checking
    - man: improved tuned-profiles-cpu-partitioning.7
    - bootloader: check if grub2_cfg_file_name is None in _remove_grub2_tuning()
    - plugin_scheduler: whitelist/blacklist processed also for thread names
    - bootloader: patch all GRUB2 config files
    - profiles: added mssql profile
    - tuned-adm: print log excerpt when changing profile
    - cpu-partitioning: use no_balance_cores instead of no_rebalance_cores
    - sysctl: support assignment modifiers as other plugins do
    - oracle: fixed ip_local_port_range parity warning
      resolves: rhbz#1527219
    - Fix verifying cpumask on systems with more than 32 cores
      resolves: rhbz#1528368
    - oracle: updated the profile to be in sync with KCS 39188
      resolves: rhbz#1447323


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-7
changelog:
  - plugin_sysctl: fixed traceback when assignments modifiers ('<', '>')
    are used with sysctl and the current sysctl value is the same as
    the new value
    Resolves: rhbz#1739418


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-9
changelog:
  - Fixed SIGHUP handling
    Resolves: rhbz#1702724
  - Tune irqbalance service
    Resolves: rhbz#1720042
  - Added netcat requirement
    Resolves: rhbz#1746436
  - sysctl: made reapply_sysctl ignore configs from /usr
    Resolves: rhbz#1776149
  - profiles: define variables before use
    Resolves: rhbz#1781664


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-10
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1852253


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 2.11.0-10.0.1
changelog:
  - Remove subdirectories under /var/lib/tuned/ before uninstall [Orabug: 31528377]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not use python-dmidecode [Orabug: 30119620]
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: James Cheng <james.cheng@oracle.com> - 2.11.0-10.0.3
changelog:
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - Fix issues with hotplug and more queue pairs [Orabug: 32153315]


author: EL Errata <el-errata_ww@oracle.com> - 2.11.0-11.0.1
changelog:
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - Fix issues with hotplug and more queue pairs [Orabug: 32153315]
  - Remove subdirectories under /var/lib/tuned/ before uninstall [Orabug: 31528377]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not use python-dmidecode [Orabug: 30119620]
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1643654
    - disable KSM only once, re-enable it only on full rollback
      resolves: rhbz#1622239
    - functions: reworked setup_kvm_mod_low_latency to count with kernel changes
      resolves: rhbz#1649408
    - updated virtual-host profile
      resolves: rhbz#1569375
    - added log message for unsupported parameters in plugin_net
      resolves: rhbz#1533852
    - added range feature for cpu exclusion
      resolves: rhbz#1533908
    - make a copy of devices when verifying tuning
      resolves: rhbz#1592743
    - fixed disk plugin/plugout problem
      resolves: rhbz#1595156
    - fixed unit configuration reading
      resolves: rhbz#1613379
    - reload profile configuration on SIGHUP
      resolves: rhbz#1631744
    - use built-in functionality to apply system sysctl
      resolves: rhbz#1663412


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1643654
    - used dmidecode only on x86 architectures
      resolves: rhbz#1688371
    - recommend: fixed to work without tuned daemon running
      resolves: rhbz#1687397


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-5.1
changelog:
  - plugin_sysctl: fixed traceback when assignments modifiers ('<', '>')
    are used with sysctl and the current sysctl value is the same as
    the new value
    Resolves: rhbz#1739563


author: EL Errata <el-errata_ww@oracle.com> - 2.11.0-5.0.2
changelog:
  - Do not use python-dmidecode [Orabug: 30119620]
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: James Cheng <james.cheng@oracle.com> - 2.11.0-8.0.2
changelog:
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM


author: EL Errata <el-errata_ww@oracle.com> - 2.11.0-9.0.1
changelog:
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not use python-dmidecode [Orabug: 30119620]
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-1
changelog:
  - new release
    - rebase tuned to latest upstream
      resolves: rhbz#1388454
    - cpu-partitioning: enabled timer migration
      resolves: rhbz#1408308
    - cpu-partitioning: disabled kvmclock sync and ple
      resolves: rhbz#1395855
    - spec: muted error if there is no selinux support
      resolves: rhbz#1404214
    - units: implemented instance priority
      resolves: rhbz#1246172
    - bootloader: added support for initrd overlays
      resolves: rhbz#1414098
    - cpu-partitioning: set CPUAffinity early in initrd image
      resolves: rhbz#1394965
    - cpu-partitioning: set workqueue affinity early
      resolves: rhbz#1395899
    - scsi_host: fixed probing of ALPM, missing ALPM logged as info
      resolves: rhbz#1416712
    - added new profile cpu-partitioning
      resolves: rhbz#1359956
    - bootloader: improved inheritance
      resolves: rhbz#1274464
    - units: mplemented udev-based regexp device matching
      resolves: rhbz#1251240
    - units: introduced pre_script, post_script
      resolves: rhbz#1246176
    - realtime-virtual-host: accommodate new ktimersoftd thread
      resolves: rhbz#1332563
    - defirqaffinity: fixed traceback due to syntax error
      resolves: rhbz#1369791
    - variables: support inheritance of variables
      resolves: rhbz#1433496
    - scheduler: added support for cores isolation
      resolves: rhbz#1403309
    - tuned-profiles-nfv splitted to host/guest and dropped unneeded dependency
      resolves: rhbz#1413111
    - desktop: fixed typo in profile summary
      resolves: rhbz#1421238
    - with systemd don't do full rollback on shutdown / reboot
      resolves: rhbz#1421286
    - builtin functions: added virt_check function and support to include
      resolves: rhbz#1426654
    - cpulist_present: explicitly sorted present CPUs
      resolves: rhbz#1432240
    - plugin_scheduler: fixed initialization
      resolves: rhbz#1433496
    - log errors when applying a profile fails
      resolves: rhbz#1434360


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-2
changelog:
  - respin
    related: rhbz#1388454
  - systemd: added support for older systemd CPUAffinity syntax
    resolves: rhbz#1441791
  - scheduler: added workarounds for low level exceptions from
    python-linux-procfs
    resolves: rhbz#1441792
  - bootloader: workaround for adding tuned_initrd to new kernels on restart
    resolves: rhbz#1441797
  - cpu-partitioning: use tuna for cores isolation
    related: rhbz#1403309


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
  - Rebase to tzdata-2022d
    - Palestine's DST transition will be on October 29, 2022,
      not October 28, 2022.
    - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Petr Menšík <pemensik@redhat.com> - 1.6.6-1
changelog:
  - Rebase to 1.6.6
  - Enable RFC 8145 Trust Anchor Signaling to help the root zone get keytag statistics
  - Enable ipsecmod support


author: Martin Osvald <mosvald@redhat.com> - 1.6.6-2
changelog:
  - Do not search for DNSSEC info when domain-insecure is set
    for stub zone (#1678550)
  - Remove KSK-2010 from configuration files - it has been revoked (#1665503)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.6.6-4
changelog:
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839172 (CVE-2020-12662), rhbz#1840258 (CVE-2020-12663)


author: David Tardon <dtardon@redhat.com> - 0.4-6
changelog:
  * Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4-5
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild


author: Richard Hughes <rhughes@redhat.com> - 0.9.20-1
changelog:
  - New upstream release
  - Factor out the Logitech Unifying support to support other devices
  - Fix batteries which report current energy but full charge
  - Fix several small memory leaks


author: Richard Hughes <rhughes@redhat.com> - 0.9.20-7
changelog:
  - Mark the devel-docs subpackage as noarch to silence a rpmdiff false positive.
  - Resolves: #1070661


author: Bastien Nocera <bnocera@redhat.com> - 0.99.7-1
changelog:
  - Update to 0.99.7
  - Add Bluetooth LE battery support
  - Fix critical action after resume from hibernate
    Resolves: #1584245


author: Rakesh Pandit <rakesh@fedoraproject.org> 0.7.5-1
changelog:
  - Upgrade to 0.7.5:
  -  Improved docs
  -  Test suite
  - 0.7.4
  -  Cleaned up code and fixed memory leaks
  - 0.7.3
  -  Builds for Cygwin, minor bug fix
  -  Changes in build system.
  -  Added: Qt Assistant documentation output
  - 0.7.2
  -  Improved and cleaned API


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 20170801-1
changelog:
  - rebase to 20170801 version
  - removed urw-* string from subpackages
  - fontconfig priority value updated to 35
  - error messages from 'xset fp rehash' suppressed (bug #1466254)
  - AppStream files added into (sub)packages
  - fontconfig files added into (sub)packages
  - fixed fonts path during %install
  - source location updated to point at github.com


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 20170801-2
changelog:
  - urw-base35-fonts-20170801-000-split-urw-fallback.patch added
  - decrease the fontconfig priority/ordering value to 60 (bug #1494850)
  - set same priority value for urw-fallback.conf as for other files (bug #1495199)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> 20170801-3
changelog:
  - *-devel subpackage added
  - typos & syntax fixed for AppStream files
  - NimbusSansNarrow-BdOblique.* renamed to *-BoldOblique
  - *-nimbus-sans-narrow subpackage dropped
  - priority/ordering decreased [60->61]
  - ship *.otf format files as well


author: Daniel Kopeček <dkopecek@redhat.com> 0.7.0-7
changelog:
  - RHEL 7.5 erratum
    - Fixed usbguard-daemon on systems with kernel >= 4.13
    - Use distribution specific usbguard-daemon.conf instead
      of the upstream version
    Resolves: rhbz#1516930


author: Daniel Kopeček <dkopecek@redhat.com> 0.7.0-8
changelog:
  - RHEL 7.5 erratum
    - Require a lower version of libaudit during build-time
    Resolves: rhbz#1491313


author: Daniel Kopeček <dkopecek@redhat.com> - 0.7.4-1
changelog:
  - RHEL 7.6 erratum
    - Replaced asciidoctor dependency with asciidoc
    Resolves: rhbz#1508878 - Rebase USBGuard to latest upstream
    Resolves: rhbz#1487229 - [RFE] improve log error messages for invalid usbguard-daemon.conf values
    Resolves: rhbz#1487233 - invalid path for AuditFilePath in usbguard-daemon.conf is ignored


author: Daniel Kopeček <dkopecek@redhat.com> - 0.7.4-2
changelog:
  - RHEL 7.6 erratum
    - Restore old behavior for loading IPC access control files
    Resolves: rhbz#1487229 - [RFE] improve log error messages for invalid usbguard-daemon.conf values


author: Radovan Sroka <rsroka@redhat.com> - 0.7.4-3
changelog:
  - RHEL 7.8 erratum
    - "usbguard add-user" commands fails with "Error: parsed key is not in key set: 'RuleFile'"
    Resolves: rhbz#1689048


author: Hans de Goede <hdegoede@redhat.com> - 0.6-3
changelog:
  - Fix usbredirserver not listening for ipv6 connections (rhbz#957470)
  - Fix a few (harmless) coverity warnings


author: Hans de Goede <hdegoede@redhat.com> - 0.6-5
changelog:
  - Use the new libusb autodetach kernel driver functionality
  - Fix a usbredirparser bug which causes tcp/ip redir to not work (rhbz#1005015)


author: Victor Toso <victortoso@redhat.com> - 0.6-8
changelog:
  - Fix migration due lack of capabilities from source host
    Resolves: rhbz#1185167
  - New callback to drop isoc packets in order to avoid high memory
    consumption in the client
    Resolves: rhbz#1312913


author: Michal Hlavinka <mhlavink@redhat.com> - 1.6.2-20
changelog:
  - drop last man page change, that option is just for compatibility
  - fix NAME section of man pages to be whatis friendly


author: Michal Hlavinka <mhlavink@redhat.com> - 1.6.2-23
changelog:
  - drop uuid-pgsql subpackage, it is outdated and does not work, use 
    uuid-ossp module from postgresql-contrib instead


author: Mark Wielaard <mjw@redhat.com> - 3.12.0-8
changelog:
  - Add valgrind-3.12.0-powerpc-register-pair.patch (#1437030)
  - Add valgrind-3.12.0-ppc64-isa-3_00.patch (#1437032)


author: Mark Wielaard <mjw@redhat.com> - 3.13.0-9
changelog:
  - valgrind 3.13.0 (fedora).
  - Update description.
  - Drop all upstreamed patches.
  - Add valgrind-3.13.0-ppc64-check-no-vsx.patch
  - Add valgrind-3.13.0-epoll_pwait.patch (#1462258)
  - Add valgrind-3.13.0-ppc64-diag.patch
  - Add valgrind-3.13.0-arm64-hwcap.patch (#1464211)
  - Add valgrind-3.13.0-arm-index-hardwire.patch (#1466017)
  - Add valgrind-3.13.0-ucontext_t.patch
  - Add valgrind-3.13.0-gdb-8-testfix.patch
  - Add valgrind-3.13.0-disable-vgdb-child.patch
  - Add --error-exitcode=1 to /bin/true check.
  - Add valgrind-3.13.0-xml-socket.patch
  - Add valgrind-3.13.0-ppc64-vex-fixes.patch
  - Add valgrind-3.13.0-amd64-eflags-tests.patch
  - Add valgrind-3.13.0-suppress-dl-trampoline-sse-avx.patch
  - Add valgrind-3.13.0-static-tls.patch
  - Workaround gdb/python bug in testsuite (#1434601)


author: Mark Wielaard <mjw@redhat.com> - 3.13.0-11
changelog:
  - Make building of libmpi wrapper explicit (#1530219)
  - Add valgrind-3.13.0-debug-alt-file.patch
    and valgrind-3.13.0-build-id-phdrs.patch (#1589844)
  - Add valgrind-3.13.0-s390-cgijnl.patch (#1589848)
  - Add valgrind-3.13.0-ppc64-mtfprwa-constraint.patch (#1589852)


author: Mark Wielaard <mjw@redhat.com> - 3.13.0-13
changelog:
  - Improved valgrind-3.13.0-arm64-hwcap.patch (#1593686)
  - Add valgrind-3.13.0-arm64-ptrace.patch (#1593682)


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-20
changelog:
  - Rebase to fedora 3.11.0
    (#1316512 #1306844 #1305962 #1298888 #1296318 #1271754 #1265566 #1265557)


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-21
changelog:
  - Add valgrind-3.11.0-deduppoolalloc.patch (#1328347)
  - Add valgrind-3.11.0-ppc-bcd-addsub.patch (#1331738)
  - Add valgrind-3.11.0-ppc64-vgdb-vr-regs.patch (#1331774)


author: Fabiano Fidêncio <fidencio@redhat.com> 0.6.0.11
changelog:
  - Fix crash when connecting to a guest through VNC and typing a wrong
    password
    Resolves: rhbz#1159731


author: Fabiano Fidêncio <fidencio@redhat.com> 0.6.0.12
changelog:
  - Show a debug message instead of an error message when trying to
    connect to a non-existent guest using ovirt
    Resolves: rhbz#1168495


author: Fabiano Fidêncio <fidencio@redhat.com> 2.0-1
changelog:
  - Rebase to 2.0
    Resolves: rhbz#1181288
  - virt-viewer cannot connect to spice VM when libvirt uses tcp port
    with sasl encryption
    Resolves: rhbz#1167354
  - virt-viewer will core dump with -r option via ssh when destroying
    the guest
    Resolves: rhbz#1163647
  - virt-viewer cannot set zoom level in command line for vnc guest
    Resolves: rhbz#1170071
  - launching virt-viewer using --attach makes it crashes
    Resolves: rhbz#1196552
  - --attach doesn't work with SELinux
    Resolves: rhbz#1141228


author: Jonathon Jongsma <jjongsma@redhat.com> - 2.0-2
changelog:
  - Add 'admin' key to [ovirt] .vv file section
    Resolves: rhbz#1210248
  - Shortcuts missing from "Send key" menu when started using plugin
    Resolves: rhbz#1230602
  - Add minimum version check to rhev spice-client
    Resolves: rhbz#1223469


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.0-4
changelog:
  - set keepAlive on libvirt connection
    Resolves: rhbz#1164052
  - Rebase to 2.0: Add a missing bug
    Resolves: rhbz#1228759


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.0-5
changelog:
  - Allow to resize window to any size
    Resolves: rhbz#1242509
  - Upate virt-viewer-events.c to match libvirt-glib's event file
    Resolves: rhbz#1243228


author: Victor Toso <victortoso@redhat.com> - 2.0-6.1
changelog:
  - Utilize SSO to authenticate against oVirt engine for foreign menu support
    Resolves: rhbz#1344635


author: Pavel Grunt <pgrunt@redhat.com> - 2.0-6.2
changelog:
  - Adjust timer to refresh ovirt foreign menu
    Resolves: rhbz#1353627
  - Fix crash when disabling the last display
    Resolves: rhbz#1354283


author: Jiri Kucera <jkucera@redhat.com> - 0.3.9-9
changelog:
  - Backport ecef526 (Stop using crypt_get_error)
    Backport 23a1ff0 (Fix nonsensical error messages on missing keys)
    Fix License, URL and Source0 tags
    Resolves: #1502399, #1574988, #1593855, #1454358


author: Martin Sehnoutka <msehnout@redhat.com> - 3.0.2-13
changelog:
  - Resolves: #1148872 - The vsftpd doesn't remove failed upload when the
    delete_failed_uploads is enabled and the network cable is unplagged


author: Martin Sehnoutka <msehnout@redhat.com> - 3.0.2-15
changelog:
  - Resolves: #1147550 ssl_request_cert paragraph in the vsftpd.conf man page gets
    rendered incorrectly


author: Martin Sehnoutka <msehnout@redhat.com> - 3.0.2-20
changelog:
  - Resolves: #1147551 - Missing isolate_* options, incorrect default values of
    max_clients, max_per_ip in man vsftpd.conf


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.0.2-22
changelog:
  - Resolves: #1432054 - secure ftp stopped working with default TLS settings in the new vsftpd package


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-23
changelog:
  - Redefine VSFTP_COMMAND_FD to 1
  - Resolves: rhbz#1443055
  - Document the relationship of text_userdb_names and chroot_local_user
  - Resolves: rhbz#1508021
  - Document allow_writeable_chroot in the man page
  - Resolves: rhbz#1508022
  - Improve documentation of ascii_* options
  - Resolves: rhbz#1517227
  - Add new filename generation algorithm for STOU command
  - Resolves: rhbz#1479237


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-25
changelog:
  - Add config option log_die allowing to pass error messages to syslog
  - Add config option bind_retries allowing to change the max number
  - of attempts to find a listening port for the PASV/EPSV command
  - Resolves: rhbz#1318198


author: Artem Egorenkov <aegorenk@redhat.com> - 3.0.2-29
changelog:
  - Enable support for wide-character strings in logs
  - Replace unprintables with HEX code, not question marks
  - Resolves: rhbz#1922809


author: Debarshi Ray <rishi@fedoraproject.org> - 0.46.1-1
changelog:
  - Update to 0.46.1
  - Drop upstreamed patches
  - Drop workaround for old GTK+ bug (#1238315)
  - Rebase downstream patches
  Resolves: #1387056


author: Debarshi Ray <rishi@fedoraproject.org> - 0.46.1-2
changelog:
  - Restore gnome-pty-helper
  - Add git.mk and other dependencies to regenerate the build scripts
  Resolves: #1443504


author: Peter Lemenkov <lemenkov@gmail.com> 4.60.1-1
changelog:
  - Version 4.60.1 (bugfix release)
  - Added man-pages
  - The only patch was rebased
  - Small cosmetic spec-file cleanups


author: Tomas Popela <tpopela@redhat.com> - 2.16.6-6
changelog:
  - Don't strip debug info from bundled icu libraries, otherwise there
    will be conflicts between webkitgtk4-debuginfo and icu-debuginfo packages
  - Resolves: rhbz#1486771


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-1
changelog:
  - Update to 2.20.4
  - Resolves: rhbz#1576544
  - WebKitWebProcess crashes when a11y is active
  - Resolves: rhbz#1591638


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-2
changelog:
  - webkitgtk4: Crash on Google login page when a11y is active
  - Resolves: rhbz#1503624
  - Revert patch causing rendering glitches


author: Tomas Popela <tpopela@redhat.com> - 2.20.5-1
changelog:
  - Update to 2.20.5 - technically it was not necessary as the only difference
    between 2.20.4 and .5 was the revert of one change, that we already reverted
    while building 2.20.4. But it's better to stay with upstream.
  - Update the labels patch with the version that was pushed upstream.
  - Resolves: rhbz#1576544


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-1
changelog:
  - Update to 2.14.7
  - Backport more of a11y fixes from upstream
  - Fix JSC crashes on big endian arches
  - Resolves: rhbz#1442160


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-2
changelog:
  - Fix a CLoop patch that was not correctly backported from upstream, causing
    crashes on big endian machines
  - Resolves: rhbz#1442160


author: Tomas Popela <tpopela@redhat.com> - 2.16.6-4
changelog:
  - Build wayland support
  - Backport fixes proposed by upstream to 2.16 branch
  - Remove accidentally committed workaround for rhbz#1486771
  - Resolves: rhbz#1496800


author: Tomas Popela <tpopela@redhat.com> - 2.16.6-5
changelog:
  - Update the bundled brotli and woff2 to the latest releases due to
    woff2's license incompatibility with WebKitGTK+ project
  - Resolves: rhbz#1499745
  - Drop unused patches


author: Peter Hatina <phatina@redhat.com> - 1.10.14-7
changelog:
  - Rebase some tvbuff API from upstream to 1.10.14
  - Fixes crash when tvb_length_remaining() is used
  - Related: CVE-2015-6244


author: Martin Sehnoutka <msehnout@redhat.com> - 1.10.14-12
changelog:
  - Fix wrong snaplen in man pages and help
  - Make the capture buffer bigger to prevent dropping packages


author: Michal Ruprich <mruprich@redhat.com> - 1.10.14-17
changelog:
  - Resolves: #1557212 - CVE-2018-7418 SIGCOMP dissector crash in packet-sigcomp.c
  - Resolves: #1588208 - CVE-2018-11362 Out-of-bounds Read in packet-ldss.c
  - Resolves: #1612146 - CVE-2018-14340 Multiple dissectors could crash
  - Resolves: #1613032 - CVE-2018-14341 DICOM dissector infinite loop
  - Resolves: #1613034 - CVE-2018-14368 Bazaar dissector infinite loop
  - Resolves: #1633330 - CVE-2018-16057 Radiotap dissector crash
  - Resolves: #1660148 - CVE-2018-19622 Infinite loop in the MMSE dissector


author: Michal Ruprich <mruprich@redhat.com> - 1.10.14-21
changelog:
  - Related: #1254543 - removing endian shift in packetlogger because it failed to recognize bluetooth hci packet


author: Petr Pisar <ppisar@redhat.com> - 3.0-18
changelog:
  - wnb requires a font to start
  - Move Tk browser to sub-package wordnet-browser
  - Move alternative manual pages to wordnet-doc package
  - Do not package INSTALL instructions and correct URL
  - Modernize spec file


author: Roland Grunberg <rgrunber@redhat.com> 0:0.5.2-1
changelog:
  - Update to 0.5.2.
  - Remove xmldb-api due to deprecation.
  - Fix ws-jaxme-ant-scripts.patch to apply cleanly.


author: Gerard Ryan <galileo@fedoraproject.org> - 0:1.6.2-5
changelog:
  - Fix file encoding for wsdl4j-MANIFEST.MF
  - Update Bundle-Version in OSGi manifest
  - Fix installation of jars in specfile
  - Clean up specfile - remove javadoc dir version; remove clean section


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.7.1-15
changelog:
  - Add NOTICE.txt file to subpackages
  - Remove bundled sources of other packages used to build javadocs


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:2.7.1-17
changelog:
  - Remove classpaths from manifests, resolves: rhbz#575635
  - Remove jlex from classpath
  - Fix source URL to archive.apache.org
  - Don't mix spaces and tabs in spec file
  - Fix end-of-line encoding of some documentation files


author: Thomas Moschny <thomas.moschny@gmx.de> - 0.3.8-2
changelog:
  - Specfile cleanups as suggested in the review.
  - Remove unneeded BR on pkgconfig.
  - Remove unneeded chrpath call.


author: Debarshi Ray <rishi@fedoraproject.org> - 1:2.8.8-19
changelog:
  - Use XDG_CONFIG_HOME instead of home for config files
    (http://sourceforge.net/p/xchat/bugs/1506/)
  - Use name and generic name correctly in desktop file
    (http://sourceforge.net/p/xchat/bugs/1397/)


author: Kalev Lember <kalev@smartlink.ee> - 3.1.1-1
changelog:
  - Update to 3.1.1
  - Dropped CVE-2009-1885 patch.
  - Use dos2unix -k instead of unrecognized option -U
  - Removed the multilib conflict workaround as Xerces_autoconf_config.hpp
    no longer contains the conflicting XERCES_SIZEOF_LONG define.


author: Eric Sandeen <sandeen@redhat.com> 3.1.3-2
changelog:
  - Preserve xattrs on multi-part stream restores (#1034014)
  - Prevent segfault on multi-part stream restores (#1034015)


author: Eric Sandeen <sandeen@redhat.com> 3.1.7-1
changelog:
  - Rebase to build against current RHEL7 xfsprogs headers
  - Fix race condition between lseek() and read()/write() (#1086532)


author: Pavel Reichl <preichl@redhat.com> - 3.1.7-4
changelog:
  - Batch fixing several issues
  - xfsrestore: Files from the backup go to orphanage dir because of xfsdump
  -      issue, Related: RHEL-10529
  - xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x,
  -      Related: RHEL-14912


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-13
changelog:
  - mkfs.xfs: clarify ftype defaults in manpage (#1488124)
  - mkfs.xfs: allow specification of 0 data stripe width (#1444166)
  - mkfs.xfs: Don't stagger AG for a single disk (#1492552)
  - xfs_db: xfs_db-update-buffer-size-when-new-type-is-set (#1458670)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-16
changelog:
  - xfs_db: fix the source command when passed as -c option (#1510279)
  - xfs_metadump: allow much larger extent counts (#1502927)
  - xfs_db: fix crash when field list selector has garbage (#1532271)
  - mkfs.xfs, others: don't stat non-block devices on startup (#1573974)
  - Update project URLs throughout the pkg, code and docs (#1550798)


author: EL Errata <el-errata_ww@oracle.com> - 4.5.0-18.0.1
changelog:
  - Disable crc, finobt by default for compatibility with UEK3 [orabug 22711906]
  - Add proper checking for size arguments (Guangyu Sun) [orabug 17613612]
  - Removed patch xfsprogs-default-disable-dirftype.patch [orabug 26176688]


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-20
changelog:
  - xfs_quota: fix errors if project flag is not set on regular files (#1663502)
  - xfs_repair: initialize non-leaf finobt blocks with correct magic (#1670154)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-21
changelog:
  - mkfs.xfs: make device discard interruptable, print notice (#1769786)
  - xfs_io: remove +/-x flag from chattr, not supported in kernel (#1630112)
  - xfs_metadump: fix symlink handling (#1693138)


author: EL Errata <el-errata_ww@oracle.com> - 4.5.0-22.0.1
changelog:
  - Disable crc, finobt by default for compatibility with UEK3 [Orabug: 22711906]
  - Add proper checking for size arguments (Guangyu Sun) [Orabug: 17613612]
  - Removed patch xfsprogs-default-disable-dirftype.patch [Orabug: 26176688]


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-8
changelog:
  - revert loff_t to off64_t change to preserve xfs.h behavior (#1366291)
  - accomodate lack of ustat() on some arches (#1373605)


author: Eric Sandeen <sandeen@redhat.com> 3.2.0-0.8.alpha2
changelog:
  - mkfs.xfs fix default log size for small filesystems (#1034003)
  - xfs_copy: partial fixups for CRC filesystems (#1043570)
  - xfs_logprint: Don't error out after split items lose context (#1043591)


author: Eric Sandeen <sandeen@redhat.com> 3.2.1-1
changelog:
  - New upstream release (#1119940)
  - xfs_copy: fix data corruption of target (#1105170)
  - mkfs.xfs: handle mkfs of file on 4k block device (#1101236)
  - xfs_copy: don't exit with error code on success (#1100376)


author: Eric Sandeen <sandeen@redhat.com> 3.2.1-2
changelog:
  - xfs_quota: fix segfault when reporting on nonexistant path (#1077826)
  - xfs_quota: fix reporting on symlinked paths (#1077841)


author: Eric Sandeen <sandeen@redhat.com> 3.2.1-6
changelog:
  - xfs_repair: fix maximum block offset test (#1173146)
  - xfs_copy: fix assert failure on 4k sector devices (#1162414)
  - xfs_quota: man page updates (#175133, #1175627)


author: Eric Sandeen <sandeen@redhat.com> 3.2.2-1
changelog:
  - Update to upstream v3.2.2, plus fixes from v3.2.3 (#1223991)
  - repair: fix unnecessary secondary scan if only last sb is corrupt (#1201238)
  - repair: check ino alignment value to avoid mod by zero (#1223444)


author: Ismael Olea <ismael@olea.org> 20051222-1
changelog:
  - updating to last version of sample-xsl-xhtml2fo.zip
  - fixing spec for contributing to Fedora and rpmlinting with 0.82


author: Peter Hutterer <peter.hutterer@redhat.com> 2.24-1
changelog:
  - xkeyboard-config 2.24 (#1564615)
  - Revert the high-keycode patches to avoid conflicts with xkbcomp < 1.4


author: Mat Booth <fedora@matbooth.co.uk> - 1.0-0.5.b3_xalan2.svn313293
changelog:
  - Link to local java API docs properly and fix requires on javadoc package.
  - Build with source and target levels of 1.5 so we don't have to require 1.6.


author: Alexander Kurtakov <akurtako@redhat.com> 1:3.1.3-5
changelog:
  - Remove javax.xml.bind from osgi imports - it's part of the JVM now.
  - Drop the ws-jaxme dependency for the same reason.


author: Simo Sorce <simo@redhat.com> - 1.2.20-1
changelog:
  - New upstrema version with memleaks, crl checks and other fixes
  - enable make check during build
  - drop ecdsa patch as it has been included upstream


author: Tomas Halman <thalman@redhat.com> - 1.2.20-8
changelog:
  - xmlsec1 fails to validate XML signatures made using ECDSA algorithm in FIPS mode
  - Resolves: RHEL-3337


author: Ondrej Vasik <ovasik@redhat.com> - 0.0.24-1
changelog:
  - new release 0.0.24, basic support for docbook->epub
    conversion, use backend extensions by default
    (--noextensions) to disable it


author: Jason L Tibbitts III <tibbs@math.uh.edu> - 1.5-1
changelog:
  - Address review commentary https://bugzilla.redhat.com/show_bug.cgi?id=226569
  - Update to 1.5, solving license issue.  This adds a few new files and requires
    a pkgconfig dependency.
  - Add dependency on xml-common to fix unowned directory issue. 
  - Remove some bits (buildroot tag and cleaning) no longer required in Fedora.


author: Peter Hutterer <peter.hutterer@redhat.com> 0.22.0-3
changelog:
  - Provide xorg-x11-drv-synaptics. The actual content is now provided by
    xorg-x11-drv-synaptics-legacy (#1394836). For details, see
    https://fedoraproject.org/wiki/Changes/RetireSynapticsDriver


author: Peter Hutterer <peter.hutterer@redhat.com> 0.23.0-2
changelog:
  - Ignore LED updates for disabled devices, avoids a null-pointer dereference
    when an AccessX timeout is set


author: Peter Hutterer <peter.hutterer@redhat.com> 0.25.0-2
changelog:
  - Don't provide xorg-x11-drv-synaptics (#1413811)
  - Don't reassign libinput to wacom touchpads, that's left to the user
  - Don't assign to wacom tablets, tablets behave differently on RHEL7.4


author: Marc-Andre Lureau <mlureau@redhat.com> 0.1.1-12
changelog:
  - Try to fallback to previous working configuration if
    drmModeSetCrtc() failed.
    Resolves: rhbz#1127552


author: Marc-Andre Lureau <marcandre.lureau@redhat.com> - 0.1.1-16
changelog:
  - Fix glitches when restarting X server
    Resolves: rhbz#1102175
  - Fix restarting X server
    Resolves: rhbz#1185807


author: Christophe Fergeau <cfergeau@redhat.com> 0.1.1-17
changelog:
  - Fix freeze in xfig when entering space character
    Resolves: rhbz#1221909
  - Fix memory leak
    Resolves: rhbz#1222038
  - Fix cursor leak causing a crash when running RHEL6 anaconda in a VM
    Resolves: rhbz#1222040


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-2
changelog:
  - Add Pressure2K option for backwards-compatibility with applications that
    hardcode the previous pressure range (#1457024)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-3
changelog:
  - Fix hang after unplugging a device (#1496650)
  - Correct device flags for some Cintiqs and Intuos pros (#1496659)


author: Peter Hutterer <peter.hutterer@redhat.com> 7.2-11
changelog:
  - Require xorg-x11-font-utils >= 7.2-11 for font-utils 1.1.0
  - Fix bashism in spec file (&>)
  - Remove perl hack for DEFAULT_FONTS_DIR, fixed upstream 
  - Remove perl and autoconf requirement.
  - Create %ghost files {misc|705dpi|...}/fonts.scale.
  - Drop fontdir alias patches
  - Update a few fonts (well, all of them)
      - encodings-1.0.3
      - font-adobe-100dpi-1.0.1
      - font-adobe-75dpi-1.0.1
      - font-adobe-utopia-100dpi-1.0.2
      - font-adobe-utopia-75dpi-1.0.2
      - font-adobe-utopia-type1-1.0.2
      - font-alias-1.0.2
      - font-arabic-misc-1.0.1
      - font-bh-100dpi-1.0.1
      - font-bh-75dpi-1.0.1
      - font-bh-lucidatypewriter-100dpi-1.0.1
      - font-bh-lucidatypewriter-75dpi-1.0.1
      - font-bitstream-100dpi-1.0.1
      - font-bitstream-75dpi-1.0.1
      - font-bitstream-type1-1.0.1
      - font-cronyx-cyrillic-1.0.1
      - font-cursor-misc-1.0.1
      - font-daewoo-misc-1.0.1
      - font-dec-misc-1.0.1
      - font-isas-misc-1.0.1
      - font-jis-misc-1.0.1
      - font-micro-misc-1.0.1
      - font-misc-cyrillic-1.0.1
      - font-misc-ethiopic-1.0.1
      - font-misc-misc-1.1.0
      - font-mutt-misc-1.0.1
      - font-schumacher-misc-1.1.0
      - font-screen-cyrillic-1.0.2
      - font-sony-misc-1.0.1
      - font-sun-misc-1.0.1
      - font-winitzki-cyrillic-1.0.1
      - font-xfree86-type1-1.0.2


author: Jerome Glisse <jglisse@redhat.com> 0.5.0-3.20130401git81aadb8
changelog:
  - Remove comment rather than investigating Xorg mess as running ldconfig can't be harmfull.
  - Fix devel package dependency.


author: Adam Jackson <ajax@redhat.com> - 1.20.4-11
changelog:
  - Fix a crash when moving an animated cursor between screens
  - Be case-insentive when matching extension names to enable or disable


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.4-12
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872389), CVE-2020-14346 (#1872393),
    CVE-2020-14361 (#1872400), CVE-2020-14362 (#1872407)
  - Temporarily revert fixes from 1.20.4-11 build for delivery of CVE fixes


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-17
changelog:
  - CVE fix for: CVE-2021-4008 (#2030161), CVE-2021-4009 (#2030171),
    CVE-2021-4010 (#2030176), CVE-2021-4011 (#2030180)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-18
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2109031, rhbz#2109033


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.4-20
changelog:
  - CVE fix for: CVE-2022-4283 (#2151800), CVE-2022-46340 (#2151775),
    CVE-2022-46341 (#2151780), CVE-2022-46342 (#2151787),
    CVE-2022-46343 (#2151790), CVE-2022-46344 (#2151797)


author: José Expósito <jexposit@redhat.com> - 1.20.4-25
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18416
    Resolves: https://issues.redhat.com/browse/RHEL-18428


author: José Expósito <jexposit@redhat.com> - 1.20.4-26
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21205
    Resolves: https://issues.redhat.com/browse/RHEL-20578
    Resolves: https://issues.redhat.com/browse/RHEL-20426
    Resolves: https://issues.redhat.com/browse/RHEL-20437
    Resolves: https://issues.redhat.com/browse/RHEL-21192
    Resolves: https://issues.redhat.com/browse/RHEL-21201


author: José Expósito <jexposit@redhat.com> - 1.20.4-28
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
    Resolves: https://issues.redhat.com/browse/RHEL-31003
    Resolves: https://issues.redhat.com/browse/RHEL-30989
    Resolves: https://issues.redhat.com/browse/RHEL-30973
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: Victor Toso <victortoso@redhat.com> - 0.1.5-5
changelog:
  - Fix crash due uninitialized pointer
    Resolves: rhbz#1690453
  - Call LeaveVt on shutdown to avoid racy situations
    Resolves: rhbz#1640918


author: Hans de Goede <hdegoede@redhat.com> - 1.3.2-14
changelog:
  - Xclients: only try to start gnome classic session if installed
  - Resolves: rhbz#1078948
  - startx: Only specify vt argument automatically when run from a vt
  - Resolves: rhbz#1083188


author: Hans de Goede <hdegoede@redhat.com> - 1.3.4-1
changelog:
  - xinit 1.3.4
  - Drop xorg-x11-xinit-1.3.2-systemd-logind.patch (included upstream in 1.3.4)
  - Add patches from Fedora to fix automatically finding a free display-number
  - Resolves: rhbz#1194894


author: Peter Hutterer <peter.hutterer@redhat.com> 7.7-4
changelog:
  - xkbcomp: Fix generation of XKB directory listing, missing reset on file
    handler caused parse errors and incomplete directory listings


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:1.1.3.8-4
changelog:
  - Fix pom filenames (Resolves rhbz#655829)
  - Changes according to new guidelines (versionless jars)
  - Fix few packaging problems (post/postun deps)


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-13
changelog:
  - Fix remote code execution vulnerability
  - Resolves: CVE-2021-21344
  - Resolves: CVE-2021-21345
  - Resolves: CVE-2021-21346
  - Resolves: CVE-2021-21347
  - Resolves: CVE-2021-21350


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-15
changelog:
  - Fix remote code execution vulnerabilities
  - Resolves: CVE-2021-39139
  - Resolves: CVE-2021-39140
  - Resolves: CVE-2021-39141
  - Resolves: CVE-2021-39144
  - Resolves: CVE-2021-39145
  - Resolves: CVE-2021-39146
  - Resolves: CVE-2021-39147
  - Resolves: CVE-2021-39148
  - Resolves: CVE-2021-39149
  - Resolves: CVE-2021-39150
  - Resolves: CVE-2021-39151
  - Resolves: CVE-2021-39152
  - Resolves: CVE-2021-39153
  - Resolves: CVE-2021-39154


author: Tianyue Lan <tianyue.lan@oracle.com> - 31.6.0-2.0.1.el7_1
changelog:
  - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js
  - Removed XULRUNNER_VERSION from SOURCE21


author: Pavel Raiskup <praiskup@redhat.com> - 5.1.2-5alpha
changelog:
  - fix manual page inconsistencies with help output (private #948533)
  - enable/fix the 'xzgrep -h' (private #850898)


author: Mikolaj Izdebski <mizdebsk@redhat.com> 1.0-2
changelog:
  - Fix issues found during package review
  - Include missing COPYING files.
  - Add missing RPM group.
  - Comment on touching package-list.


author: Daniel P. Berrange <berrange@redhat.com> - 2.0.4-1
changelog:
  - Update to 2.0.4 release (rhbz #845777)
  - Fix License tag to reflect change in 2.0.0 series from BSD to ISC


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-151
changelog:
  - Add repo-id to repomd timestamp error message.
  - Resolves: bug#1389816
  - Don't recommend makecache if just running.
  - Resolves: bug#1369389
  - Add logging of bad update notice duplicates.
  - Resolves: bug#1194915


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-153
changelog:
  - Filter duplicates when counting security updates.
  - Resolves: bug#1399628
  - sqlitesack: fix filelist queries for duplicate pkgs.
  - Resolves: bug#1391507


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-154
changelog:
  - Add payload_gpgcheck option.
  - Resolves: bug#1343690
  - Add hint about rm -rf for yum clean all.
  - Resolves: bug#1357083
  - Have "yum check" ignore self conflicts.
  - Resolves: bug#1370134
  - Detect installed virtual provide in install().
  - Resolves: bug#1352585
  - Fix reget problems with simple md filenames.
  - Resolves: bug#1397829


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-155
changelog:
  - Don't pollute stderr in FIPS mode.
  - Resolves: bug#1287610
  - Don't require enabled repos for URL installs.
  - Resolves: bug#1175315
  - installonlypkgs: add "installonlypkg(kernel)
  - Resolves: bug#1358492
  - Manpage fixes.
  - Resolves: bug#1386597
  - Resolves: bug#1411575


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.4.3-156
changelog:
  - Preload shared libs that we may dlopen().
  - Resolves: bug#1458841
  - Update payload_gpgcheck documentation.
  - Resolves: bug#1451817
  - Make exactarchlist support wildcards and add docs.
  - Resolves: bug#1361609
  - Add usercache config option.
  - Resolves: bug#1432319


author: EL Errata <el-errata_ww@oracle.com> - 3.4.3-158.0.1
changelog:
  - Remove Red Hat references [bug 24684777]
  - Remove Red Hat references [bug 22587848]
  - discard the patch for 12614512.
  - Bug13869 Fix the CVE duplicate entries problem. (leon.w.wang@oracle.com)
  - Add kernel-uek packages to install only list (john.haxby@oracle.com)
  - Add uln.patch to fix repository not found [bug 12614512] (leon.w.wang@oracle.com)
  - Add kernel-uek-firmware package to install only list [orabug 13535055]


author: Yinbo Wang <yinbo.wang@oracle.com> - 3.4.3-158.0.2
changelog:
  - Resolves: [Orabug 27942695] spacewalk reposync fails [Errno 14] HTTP Error 407-Proxy Authentication Required


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-159
changelog:
  - Retry on gpgkey timeout from MirrorManager
  - Resolves: bug#1520454
  - docs: baseurl: clarify multiple URLs
  - Resolves: bug#1509831
  - updateinfo: preload pkgSack
  - Resolves: bug#1528608
  - update(): honor multilib_policy for obsoletes
  - Resolves: bug#1477574
  - Print a disk usage summary on "yum clean all" and clarify docs
  - Resolves: bug#1481220
  - depsolve: filter out conflicting provider
  - Resolves: bug#1480065
  - Change 'size' option to 'maxsize' in yum.logrotate
  - Resolves: bug#1506890


author: EL Errata <el-errata_ww@oracle.com> - 3.4.3-161.0.1
changelog:
  - Resolves: [Orabug 27942695] spacewalk reposync fails [Errno 14] HTTP Error 407-Proxy Authentication Required
  - Remove Red Hat references [bug 24684777]
  - Remove Red Hat references [bug 22587848]
  - discard the patch for 12614512.
  - Bug13869 Fix the CVE duplicate entries problem. (leon.w.wang@oracle.com)
  - Add kernel-uek packages to install only list (john.haxby@oracle.com)
  - Add uln.patch to fix repository not found [bug 12614512] (leon.w.wang@oracle.com)
  - Add kernel-uek-firmware package to install only list [orabug 13535055]


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-162
changelog:
  - downloadonly: unlink .tmp files on ctrl-c
  - Resolves: bug#1410234
  - Fix calculation of uncleaned disk space after "yum clean all"
  - Resolves: bug#1645173
  - Speed up depsolving in Anaconda for large transactions
  - Resolves: bug#1600383


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-164
changelog:
  - Do not reinstall local installonly packages
  - Resolves: bug#1689025
  - Fix traceback when every provider conflicts with requiring package
  - Resolves: bug#1713649
  - Gracefully handle empty RPM error list during transaction test
  - Resolves: bug#1690376
  - Gracefully handle self-conflicts during reinstall
  - Resolves: bug#1564747
  - yumRepo: migrate more prints to logging
  - Resolves: bug#1510495


author: Michal Domonkos <mdomonko@redhat.com> - 3.4.3-166
changelog:
  - docs: yum command argument is not optional
  - Resolves: bug#1573154
  - updateinfo: suggest command for --verbose if bad duplicate
  - Resolves: bug#1645618


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.4.3-168
changelog:
  - Fix typo sig_typ -> sig_type
  - Resolves: bug#1778763
  - Check for revoked subkeys before checking the signature
  - Resolves: bug#1778784


author: David Sloboda <david.x.sloboda@oracle.com> - 3.4.3-168.0.1
changelog:
  - Resolves: [Orabug: 27942695] spacewalk reposync fails [Errno 14] HTTP Error 407-Proxy Authentication Required
  - Remove Red Hat references [Orabug: 24684777]
  - Remove Red Hat references [Orabug: 22587848]
  - discard the patch for [Orabug: 12614512].
  - Bug13869 Fix the CVE duplicate entries problem. (leon.w.wang@oracle.com)
  - Add kernel-uek packages to install only list (john.haxby@oracle.com)
  - Add uln.patch to fix repository not found [Orabug: 12614512] (leon.w.wang@oracle.com)
  - Add kernel-uek-firmware package to install only list [Orabug: 13535055]


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-40
changelog:
  - needs-restarting: rework reboothint logic.
  - Related: bug#1192946
  - needs-restarting: rebase patch for 1335587.
  - Related: bug#1335587


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-41
changelog:
  - yum-config-manager: only select exact matches from --setopt.
  - Resolves: bug#1403015
  - yum-plugin-verify: set exit status to 1 in case of problems.
  - Resolves: bug#1406891


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-43
changelog:
  - yumdownloader: fix crash on broken srpm metadata.
  - Resolves: bug#1458098
  - package-cleanup: don't remove required dupes.
  - Resolves: bug#1455318
  - fastestmirror: move the logic before MD retrieval.
  - Resolves: bug#1428210
  - yum-debug-dump: improve repo failure handling.
  - Resolves: bug#1445751


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-44
changelog:
  - Add pre-transaction-actions plugin.
  - Resolves: bug#1470647
  - yum-builddep: add --define option.
  - Resolves: bug#1437636
  - verifytree: handle no @core group gracefully.
  - Resolves: bug#1349433
  - verifytree: fix handling of missing comps.
  - Resolves: bug#1333353


author: EL Errata <el-errata_ww@oracle.com> - 1.1.31-46.0.1
changelog:
  - needs-restarting not checking kernel-uek for reboot message [Orabug 27189714]
  - add bug27596617.patch to remove upstream URL reference


author: Michal Domonkos <mdomonko@redhat.com> - 1.1.31-47
changelog:
  - repotrack: add --repofrompath option
  - Resolves: bug#1506205
  - reposync: check for .. in remote paths
  - Resolves: bug#1552328


author: Michal Domonkos <mdomonko@redhat.com> - 1.1.31-50
changelog:
  - yum-config-manager: additional fixes for --add-repo
  - Related: bug#1493489
  - repotrack: print error instead of traceback on unavailable --repofrompath
  - Related: bug#1506205
  - versionlock: note default value of show_hint in man page
  - Related: bug#1497351


author: Edward Leung <edward.leung@oracle.com> - 1.1.31-52.0.1
changelog:
  - needs-restarting not checking kernel-uek for reboot message [Orabug: 27189714]
  - add bug27596617.patch to remove upstream URL reference


author: Michal Domonkos <mdomonko@redhat.com> - 1.1.31-53
changelog:
  - repotrack: fix --repofrompath for non-root users
  - Related: bug#1659588
  - repotrack: copy local packages
  - Related: bug#1463723
  - needs-restarting: clarify exit code in help and man page
  - Related: bug#1630197


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-30
changelog:
  - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
  - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
  - fix stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)
  - avoid crash when copying empty hash table (CVE-2018-7549)
  - fix buffer overrun in xsymlinks (CVE-2017-18206)
  - fix NULL dereference in cd (CVE-2017-18205)
  - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)
  - fix buffer overflow for very long fds in >& fd syntax (CVE-2014-10071)


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-34
changelog:
  - make the chaselinks option work again (#1729997)
  - fix off-by-one error in buffer allocation to avoid stack smashing (#1722486)


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-9
changelog:
  - Fix covscan warning
  - "Variable "file" going out of scope leaks the storage it points to."
    has been introduced by the original version of 0001-fix-CVE-2018-7725.patch
  - Related: 1558596


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-11
changelog:
  - Fix CVE-2018-6541
  - Part of the original patch has already been applied in the past (CVE-2018-7726),
    so the bug should not be reproducible in a way described in the github 
    issue, even without this commit. Applying the rest of the original patch anyway.
  - https://github.com/gdraheim/zziplib/issues/16
  - Related: CVE-2018-6541


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-12
changelog:
  - Fix a directory traversal bug
  - unzip-mem should now strip all "../" prefixes from the archived files
  - Resolves: CVE-2018-17828


