# changelog

author: Andrew Hughes <gnu.andrew@redhat.com> - 1:13.0.0.33-3.rolling
changelog:
  - Obsolete javadoc-slowdebug and javadoc-slowdebug-zip packages via javadoc and javadoc-zip respectively.


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:13.0.0.33-3.rolling
changelog:
  - Drop unnecessary build requirement on gtk3-devel, as OpenJDK searches for Gtk+ at runtime.
  - Add missing build requirement for libXrender-devel, previously masked by Gtk3+ dependency
  - Add missing build requirement for libXrandr-devel, previously masked by Gtk3+ dependency
  - fontconfig build requirement should be fontconfig-devel, previously masked by Gtk3+ dependency


author: Petra Alice Mikova <pmikova@redhat.com> - 1:13.0.0.33-3.rolling
changelog:
  - synced up generate tarball script with other OpenJDK packages
  - dropped pr2126-synchronise_elliptic_curves_in_sun_security_ec_namedcurve_with_those_listed_by_nss.patch from the sources
  - regenerated sources with the updated script


author: Petra Alice Mikova <pmikova@redhat.com> - 1:13.0.1.9-2.rolling
changelog:
  - Fixed hardcoded major version in jdk13u to macro
  - added jdk8231405_guarantee_d_nonequals_null_failed_null_dominator_info.patch
  - added jdk8231583_fix_register_clash_in_sbsa_resolve_forwarding_pointer_borrowing.patch


author: Petra Alice Mikova <pmikova@redhat.com> - 1:13.0.2.8-1.rolling
changelog:
  - removed patch jdk8231405_guarantee_d_nonequals_null_failed_null_dominator_info.patch
  - removed patch jdk8231583_fix_register_clash_in_sbsa_resolve_forwarding_pointer_borrowing.patch
  - updated sources to the 13.0.2+8 tag


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:13.0.2.8-3.rolling
changelog:
  - add workaround for issues with build with GCC10 on s390x (see RHBZ#1799531)
  - fix issues with build with GCC10: JDK-8224851, -fcommon switch


author: Petra Alice Mikova <pmikova@redhat.com> - 1:14.0.0.36-1.rolling
changelog:
  - update to jdk 14+36 ga build
  - remove JDK-8224851 patch, as OpenJDK 14 already contains it
  - removed pack200 and unpack200 binaries, slaves, manpages and libunpack.so library
  - added listings for jpackage binary, manpages and added slave records to alternatives


author: Petra Alice Mikova <pmikova@redhat.com> - 1:14.0.0.36-2.rolling
changelog:
  - removed a whitespace causing fail of postinstall script
  - removed backslashes at the end of alternatives command


author: Petra Alice Mikova <pmikova@redhat.com> - 1:14.0.1.7-3.rolling
changelog:
  - introduce patch jdk8235833-posixplatform_cpp_should_not_include_sysctl_h to fix build issues in rawhide
  - rename and reorganize patch sections


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:14.0.1.7-4.rolling
changelog:
  - Re-introduce java-openjdk-src & java-openjdk-demo for system_jdk builds.
  - Fix accidental renaming of java-openjdk-devel to java-devel-openjdk.


author: Petra Alice Mikova <pmikova@redhat.com> - 1:14.0.2.12-1.rolling
changelog:
  - update to jdk 14.0.2.12 CPU version
  - remove upstreamed patch jdk8237879-make_4_3_build_fixes.patch
  - remove upstreamed patch jdk8235833-posixplatform_cpp_should_not_include_sysctl_h.patch
  - remove upstreamed patch jdk8243059-build_fails_when_with_vendor_contains_comma.patch


author: Petra Alice Mikova <pmikova@redhat.com> - 1:15.0.0.36-0.1.ea.rolling
changelog:
  - Update to jdk 15.0.0.36 tag
  - Modify rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
  - Update vendor version string to 20.9
  - jjs removed from packaging after JEP 372: Nashorn removal
  - rmic removed from packaging after JDK-8225319


author: Jiri Vanek <jvanek@redhat.com> - 1:15.0.0.36-3.rolling
changelog:
  - Build static-libs-image and add resulting files via -static-libs sub-package.
  - Disable stripping of debug symbols for static libraries part of the -static-libs sub-package.
  - JDK-8245832 increases the set of static libraries, so try and include them all with a wildcard.
  - Update static-libs packaging to new layout


author: Jiri Vanek <jvanek@redhat.com> - 1:15.0.1.9-2.rolling
changelog:
  - Create a copy of java as alt-java with alternatives and man pages
  - java-11-openjdk doesn't have a JRE tree, so don't try and copy alt-java there...


author: Jiri Vanek <jvanek@redhat.com> - 1:15.0.1.9-3.rolling
changelog:
  - added patch600, rh1750419-redhat_alt_java.patch, suprassing removed patch
  - no longer copying of java->alt-java as it is created by  patch600


author: Jiri Vanek <jvanek@redhat.com> - 1:15.0.1.9-4.rolling
changelog:
  - moved wrongly placed licenses to accompany other ones
  - this bad placement was killng parallel-installability and thus having bad impact to leapp if used


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:15.0.1.9-5.rolling
changelog:
  - introduced nm based check to verify alt-java on x86_64 is patched, and no other alt-java or java is patched
  - patch600 rh1750419-redhat_alt_java.patch amended to die, if it is used wrongly
  - introduced ssbd_arches with currently only valid arch of x86_64 to separate real alt-java architectures


author: Jiri Vanek <jvanek@redhat.com> - 1:15.0.1.9-6.rolling
changelog:
  - many cosmetic changes taken from more maintained jdk11
  - introduced debug_arches, bootstrap_arches, systemtap_arches, fastdebug_arches, sa_arches, share_arches, shenandoah_arches, zgc_arches
    instead of various hardcoded ifarches
  - updated systemtap
  - added requires excludes for debug pkgs
  - removed redundant logic around jsa files
  - added runtime requires of lksctp-tools and libXcomposite%
  - added and used Source15 TestSecurityProperties.java, but is made always positive as jdk15 now does not honor system policies
  - s390x excluded form fastdebug build


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:15.0.2.0.7-0.rolling
changelog:
  - Update to jdk-15.0.2.0+7
  - Add release notes for 15.0.1.0 & 15.0.2.0
  - Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly.
  - Still use 15.0.x rather than 15.0.x.0 for file naming, as the trailing zero is omitted from tags.
  - Cleanup debug package descriptions and version number placement.
  - Remove unused patch files.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:16.0.0.0.36-0.rolling
changelog:
  - Update to jdk-16.0.0.0+36
  - Update tarball generation script to use git following OpenJDK's move to github
  - Update tarball generation script to use PR3823 which handles JDK-8235710 changes
  - Use upstream default for version-pre rather than setting it to "ea" or ""
  - Drop libsunec.so which is no longer generated, thanks to JDK-8235710
  - Drop unnecessary compiler flags, dating back to work on GCC 6 & 10
  - Adapt RH1750419 alt-java patch to still apply after some variable re-naming in the makefiles
  - Update filever to remove any trailing zeros, as in the OpenJDK build, and use for source filename
  - Use system harfbuzz now this is supported.
  - Pass SOURCE_DATE_EPOCH to build for reproducible builds


author: Jiri Vanek <jvanek@redhat.com> - 1:16.0.0.0.36-1.rolling
changelog:
  - fixed suggests of wrong pcsc-lite-devel(loongarch-64) to correct pcsc-lite-libs(loongarch-64)
  - bumped buildjdkver to build by itself - 16


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:16.0.0.0.36-2.rolling
changelog:
  - Perform static library build on a separate source tree with bundled image libraries
  - Make static library build optional
  - Based on initial work by Severin Gehwolf


author: Jiri Vanek <jvanek@redhat.com> - 1:16.0.1.0.9-2.rolling
changelog:
  - adapted to debug handling  in newer cjc
  - The rest of the "rpm 4.17" patch must NOT be backported, as on rpm 4.16 and down, it would casue double execution
  - Disable copy-jdk-configs for Flatpak builds


author: Petra Alice Mikova <pmikova@redhat.com> - 1:17.0.0.0.26-0.0.ea.rolling
changelog:
  - update sources to jdk 17.0.0+26
  - set is_ga to 0, as this is early access build
  - change vendor_version_string
  - change path to the version-numbers.conf
  - removed rmid binary from files and from slaves
  - removed JAVAC_FLAGS=-g from make command, as it breaks the build since JDK-8258407
  - add lib/libsyslookup.so to files
  - renamed lib/security/blacklisted.certs to lib/security/blocked.certs
  - add lib/libsvml.so for intel
  - skip debuginfo check for libsyslookup.so on s390x


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.26-0.0.ea
changelog:
  - Rename as java-17-openjdk and bootstrap using boot JDK in local sources
  - Exclude x86 as this is not supported by OpenJDK 17
  - Resolves: rhbz#1959487


author: Petra Alice Mikova <pmikova@redhat.com> - 1:17.0.0.0.26-0.4.ea
changelog:
  - Fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch which made the SunPKCS provider show up again
  - Resolves: rhbz#1959487


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.26-0.5.ea
changelog:
  - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics.
  - Remove restriction on disabling product build, as debug packages no longer have javadoc packages.
  - Resolves: rhbz#1959487


author: Martin Balao <mbalao@redhat.com> - 1:17.0.0.0.33-0.1.ea
changelog:
  - Support the FIPS mode crypto policy (RH1655466)
  - Use appropriate keystore types when in FIPS mode (RH1818909)
  - Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use (RH1860986)
  - Related: rhbz#1995150


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.33-0.1.ea
changelog:
  - Update RH1655466 FIPS patch with changes in OpenJDK 8 version.
  - SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file.
  - Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg.
  - No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable.
  - Disable FIPS mode support unless com.redhat.fips is set to "true".
  - Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable).
  - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
  - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1915071)
  - Related: rhbz#1995150


author: Martin Balao <mbalao@redhat.com> - 1:17.0.0.0.33-0.2.ea
changelog:
  - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
  - Related: rhbz#1995150


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.33-0.2.ea
changelog:
  - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure.
  - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM.
  - Related: rhbz#1995150


author: Martin Balao <mbalao@redhat.com> - 1:17.0.0.0.33-0.3.ea
changelog:
  - Add patch to disable non-FIPS crypto in the SUN and SunEC security providers.
  - Resolves: rhbz#1995150


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.33-0.5.ea
changelog:
  - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access.
  - Resolves: rhbz#1996182


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.35-3
changelog:
  - Update to jdk-17+35, also known as jdk-17-ga.
  - Switch to GA mode.
  - Add JDK-8272332 fix so we actually link against HarfBuzz.
  - Resolves: rhbz#2003072
  - Resolves: rhbz#2004078


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.35-5
changelog:
  - Update release notes to document the major changes between OpenJDK 11 & 17.
  - Resolves: rhbz#2003072


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.35-6
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#1994661


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-1
changelog:
  - January 2022 security update to jdk 17.0.2+8
  - Rebase RH1995150 & RH1996182 patches following JDK-8275863 addition to module-info.java
  - Rename libsvml.so to libjsvml.so following JDK-8276025
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-3
changelog:
  - Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes (_heap->_heaps) and @JAVA_SPEC_VER@
  - Update icedtea_sync.sh with a VCS mode that retrieves sources from a Mercurial repository
  - Related: rhbz#2022822


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.2.0.8-5
changelog:
  - Replaced tabs by sets of spaces to make rpmlint happy
  - javadoc-zip gets its own provides next to plain javadoc ones
  - Resolves: rhbz#2022822


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-5
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Handle Fedora in distro conditionals that currently only pertain to RHEL.
  - Run OpenJDK normalizer script on the spec file to fix further rogue whitespace
  - Sync gdb test with java-1.8.0-openjdk and improve architecture restrictions.
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Need to support noarch for creating source RPMs for non-scratch builds.
  - Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
  - Support a HotSpot-only build so a freshly built libjvm.so can then be used in the bootstrap JDK.
  - Explicitly list JIT architectures rather than relying on those with slowdebug builds
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - Resolves: rhbz#2022822


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-6
changelog:
  - Fix FIPS issues in native code and with initialisation of java.security.Security
  - Resolves: rhbz#2023378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-7
changelog:
  - Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent
  - Resolves: rhbz#2051590


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.2.0.8-8
changelog:
  - alternatives creation moved to posttrans
  - Thus fixing the old reisntall issue:
  - https://bugzilla.redhat.com/show_bug.cgi?id=1200302
  - https://bugzilla.redhat.com/show_bug.cgi?id=1976053
  - Resolves: rhbz#2008200


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.2.0.8-10
changelog:
  - Storing and restoring alterntives during update manually
  - Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and select (as auto) system JDK/JRE
  -- The move of alternatives creation to posttrans to fix:
  -- Bug 1200302 - dnf reinstall breaks alternatives
  -- Had caused the alternatives to be removed, and then created again,
  -- instead of being added, and then removing the old, and thus persisting
  -- the selection in family
  -- Thus this fix, is storing the family of manually selected master, and if
  -- stored, then it is restoring the family of the master
  - Resolves: rhbz#2008200


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-12
changelog:
  - Detect NSS at runtime for FIPS detection
  - Turn off build-time NSS linking and go back to an explicit Requires on NSS
  - Resolves: rhbz#2051605


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:17.0.2.0.8-13
changelog:
  - Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
    secmod.db file as part of nss
  - Resolves: rhbz#2023536


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-15
changelog:
  - Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
  - Resolves: rhbz#2052070


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.1-0.1.ea
changelog:
  - Update to jdk-17.0.3.0+1
  - Update release notes to 17.0.3.0+1
  - Switch to EA mode for 17.0.3 pre-release builds.
  - Add JDK-8283911 to fix bad DEFAULT_PROMOTED_VERSION_PRE value
  - Related: rhbz#2050456


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.7-1
changelog:
  - April 2022 security update to jdk 17.0.3+7
  - Update to jdk-17.0.3.0+7 release tarball
  - Update release notes to 17.0.3.0+6
  - Add missing README.md and generate_source_tarball.sh
  - Switch to GA mode for release
  - JDK-8283911 patch no longer needed now we're GA...
  - Resolves: rhbz#2073577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.7-2
changelog:
  - Rebase FIPS patches from fips-17u branch and simplify by using a single patch from that repository
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - RH2023467: Enable FIPS keys export
  - RH2094027: SunEC runtime permission for FIPS
  - Resolves: rhbz#2023467
  - Resolves: rhbz#2094027


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.7-3
changelog:
  - Add rpminspect.yaml to turn off Java bytecode inspections
  - java-17-openjdk deliberately produces Java 17 bytecode, not the default Java 11 bytecode
  - Resolves: rhbz#2101524


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.7-4
changelog:
  - Update FIPS support to bring in latest changes
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Resolves: rhbz#2099840
  - Resolves: rhbz#2100674


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:17.0.3.0.7-5
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2007331


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.7-6
changelog:
  - Turn on system security properties as part of the build's install section
  - Move cacerts replacement to install section and retain original of this and tzdb.dat
  - Run tests on the installed image, rather than the build image
  - Introduce variables to refer to the static library installation directories
  - Use relative symlinks so they work within the image
  - Run debug symbols check during build stage, before the install strips them
  - Related: rhbz#2100674


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.7-6
changelog:
  - Sequence spec file sections as they are run by rpmbuild (build, install then test)
  - Related: rhbz#2100674


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:17.0.4.0.1-0.2.ea
changelog:
  - Fix issue where CheckVendor.java test erroneously passes when it should fail.
  - Add proper quoting so '&' is not treated as a special character by the shell.
  - Related: rhbz#2083316


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.7-0.1.ea
changelog:
  - Update to jdk-17.0.4.0+7
  - Update release notes to 17.0.4.0+7
  - Switch to EA mode for 17.0.4 pre-release builds.
  - Need to include the '.S' suffix in debuginfo checks after JDK-8284661
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Move EA designator check to prep so failures can be caught earlier
  - Make EA designator check non-fatal while upstream is not maintaining it
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Include a test in the RPM to check the build has the correct vendor information.
  - Resolves: rhbz#2083316


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.4.0.7-0.2.ea
changelog:
  - retutrned absolute symlinks
  - relative symlinks are breaking cjc, and deeper investigations are necessary
  -- why cjc intentionally skips relative symllinks
  - images have to be workarounded differently
  - Related: rhbz#2100674


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.7-0.2.ea
changelog:
  - Revert the following changes until copy-java-configs has adapted to relative symlinks:
  - * Move cacerts replacement to install section and retain original of this and tzdb.dat
  - * Run tests on the installed image, rather than the build image
  - * Introduce variables to refer to the static library installation directories
  - * Use relative symlinks so they work within the image
  - * Run debug symbols check during build stage, before the install strips them
  - The move of turning on system security properties is retained so we don't ship with them off
  - Related: rhbz#2100674


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.8-3
changelog:
  - Update to jdk-17.0.4.0+8
  - Update release notes to 17.0.4.0+8
  - Switch to GA mode for release
  - Resolves: rhbz#2106522


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-2
changelog:
  - Update to jdk-17.0.4.1+1
  - Update release notes to 17.0.4.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119531


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-3
changelog:
  - Update FIPS support to bring in latest changes
  - * RH2104724: Avoid import/export of DH private keys
  - * RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
  - * Build the systemconf library on all platforms
  - * RH2048582: Support PKCS#12 keystores
  - * RH2020290: Support TLS 1.3 in FIPS mode
  - Resolves: rhbz#2104724
  - Resolves: rhbz#2092507
  - Resolves: rhbz#2048582
  - Resolves: rhbz#2020290


author: Stephan Bergmann <sbergman@redhat.com> - 1:17.0.4.1.1-4
changelog:
  - Fix flatpak builds (catering for their uncompressed manual pages)
  - Fix flatpak builds by exempting them from bootstrap
  - Resolves: rhbz#2102734


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-5
changelog:
  - Switch to static builds, reducing system dependencies and making build more portable
  - Resolves: rhbz#2121263


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-6
changelog:
  - Backport JDK-8288985 to enable use of ChaCha20-Poly1305 with the PKCS11 provider
  - Upstream backport in progress: https://github.com/openjdk/jdk17u-dev/pull/650
  - Resolves: rhbz#2006351


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.5.0.1-0.2.ea
changelog:
  - Update to jdk-17.0.5+1
  - Update release notes to 17.0.5+1
  - Switch to EA mode for 17.0.5 pre-release builds.
  - Bump HarfBuzz bundled version to 4.4.1 following JDK-8289853
  - Bump FreeType bundled version to 2.12.1 following JDK-8290334
  - Related: rhbz#2130617


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.5.0.7-0.2.ea
changelog:
  - Update to jdk-17.0.5+7
  - Update release notes to 17.0.5+7
  - Drop JDK-8288985 patch that is now upstream
  - Resolves: rhbz#2130617


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.5.0.8-2
changelog:
  - Update to jdk-17.0.5+8 (GA)
  - Update release notes to 17.0.5+8 (GA)
  - Switch to GA mode for final release.
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - The stdc++lib, zlib & freetype options should always be set from the global, so they are not altered for staticlibs builds
  - Remove freetype sources along with zlib sources
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.5.0.8-5
changelog:
  - Update FIPS support to bring in latest changes
  - * Add nss.fips.cfg support to OpenJDK tree
  - * RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
  - * Remove forgotten dead code from RH2020290 and RH2104724
  - Drop local nss.fips.cfg.in handling now this is handled in the patched OpenJDK build
  - Resolves: rhbz#2117972


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.1-0.3.ea
changelog:
  - Update to jdk-17.0.6+1
  - Update release notes to 17.0.6+1
  - Switch to EA mode for 17.0.6 pre-release builds.
  - Re-enable EA upstream status check now it is being actively maintained.
  - Drop JDK-8294357 (tzdata2022d) & JDK-8295173 (tzdata2022e) local patches which are now upstream
  - Drop JDK-8275535 local patch now this has been accepted and backported upstream
  - Bump tzdata requirement to 2022e now the package is available in RHEL
  - Related: rhbz#2150195


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.9-0.3.ea
changelog:
  - Update to jdk-17.0.6+9
  - Update release notes to 17.0.6+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150195


author: Stephan Bergmann <sbergman@redhat.com> - 1:17.0.6.0.9-0.4.ea
changelog:
  - Fix flatpak builds by disabling TestTranslations test due to missing tzdb.dat
  - Related: rhbz#2150195


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.9-0.4.ea
changelog:
  - Update FIPS support to bring in latest changes
  - * OJ1357: Fix issue on FIPS with a SecurityManager in place
  - Related: rhbz#2117972


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-3
changelog:
  - Update to jdk-17.0.6.0+10
  - Update release notes to 17.0.6.0+10
  - Switch to GA mode for release
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-4
changelog:
  - Replace build section with extraction of existing builds from portables
  - Rewrite ELF files so the source file path is correct and debugsources can be assembled
  - Resolves: rhbz#2150205


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-6
changelog:
  - Include the java-17-openjdk-portable.spec file with instructions on how to rebuild.
  - Related: rhbz#2189330


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
changelog:
  - Update to jdk-17.0.7.0+7
  - Update release notes to 17.0.7.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Update FIPS support against 17.0.7+6 and bring in latest changes:
  - * RH2134669: Add missing attributes when registering services in FIPS mode.
  - * test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
  - * RH1940064: Enable XML Signature provider in FIPS mode
  - * RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
  - Fix trailing '.' in tarball name
  - Use portablerelease in vendor version to avoid inclusion of dist tag
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2186834
  - Resolves: rhbz#2186826
  - Resolves: rhbz#2186830


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
changelog:
  - Following JDK-8005165, class data sharing can be enabled on all JIT architectures
  - Related: rhbz#2196908


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.1-0.1.ea
changelog:
  - Update to jdk-17.0.8+1 (EA)
  - Update release notes to 17.0.8+1
  - Switch to EA mode
  - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 17.0.8+1
  - Bump bundled LCMS version to 2.15 as in jdk-17.0.8+1.
  - Bump bundled HarfBuzz version to 7.0.1 as in jdk-17.0.8+1
  - Use tapsets from the misc tarball
  - Introduce 'prelease' for the portable release versioning, to handle EA builds
  - Make sure root installation directory is created first
  - Use in-place substitution for all but the first of the tapset changes
  - Related: rhbz#2217714


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.6-0.2.ea
changelog:
  - Update to jdk-17.0.11+6 (EA)
  - Sync java-17-openjdk-portable.specfile
  - Update buildjdkver to match the featurever
  - Use featurever macro to specify fips patch
  - Explain patchN syntax situation in a comment
  - generate_source_tarball.sh: Fix whitespace
  - generate_source_tarball.sh: Skip -ga tags
  - generate_source_tarball.sh: Get -ea suffix from version-numbers.conf
  - generate_source_tarball.sh: Use git archive to generate tarball
  - generate_source_tarball.sh: Update version in comment
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Require tzdata 2023d (JDK-8322725)
  - generate_source_tarball.sh: Add license
  - openjdk_news.sh: Use grep -E instead of egrep
  - Remove RH1649512 patch for libjpeg-turbo FAR macro
  - Move pcsc-lite-libs patch to in-need-of-upstreaming section
  - Related: RHEL-27137


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.7-0.2.ea
changelog:
  - Update to jdk-17.0.11+7 (EA)
  - Sync java-17-openjdk-portable.specfile
  - Sync java-17-openjdk-portable.specfile again to mention OPENJDK-2730
  - Related: RHEL-27137


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.9-2
changelog:
  - Update to jdk-17.0.11+9 (GA)
  - Add openjdk-17.0.11+9.tar.xz to .gitignore
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Update buildver from 7 to 9
  - Update portablerelease from 1 to 3
  - Change is_ga from 0 to 1 to enable GA mode for release
  - Update tzdata Requires comment to mention that 2024a is not yet in the buildroot
  - Update tzdata BuildRequires comment to mention that 2024a is not yet in the buildroot
  - Update tzdata BuildRequires fro 2023c to 2023d
  - Update sources from openjdk-17.0.11+7-ea.tar.xz to openjdk-17.0.11+9.tar.xz
  - Resolves: RHEL-27137
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - Update to jdk-17.0.12+6 (EA)
  - Add openjdk-17.0.12+6-ea.tar.xz to .gitignore
  - Set updatever to 12
  - Set buildver to 6
  - Set rpmrelease to 1
  - Set is_ga to 0
  - Update sources to openjdk-17.0.12+6-ea.tar.xz
  - Require tzdata-java 2024a at runtime and for build (JDK-8325150)
  - Update lcms2 bundled provides to 2.16.0
  - Add zlib 1.3.1 bundled provides and zlib-devel build requirement (OPENJDK-3065)
  - Use component in EPEL and Fedora bug URLs
  - Label as error a designator mismatch
  - Change a fix-me comment to a note instead
  - Sync generate_source_tarball.sh from Fedora rawhide


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Cleanup message issued when checkout already exists
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
  - Move maintenance scripts to a scripts subdirectory
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
  - generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
  - generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck


author: Anton Bobrov <abobrov@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - generate_source_tarball.sh: Use tar exclude options for VCS files
  - generate_source_tarball.sh: Improve VCS exclusion


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - Delete fips-17u-d63771ea660.patch
  - Add fips-17u-e893be00150.patch
  - Update fipsver to e893be00150


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - Add upstream patch that removes illegal RLO Unicode characters (JDK-8332174)
  - Sync the copy of the portable specfile with the latest update


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - Set portablerelease to 2
  - Related: RHEL-46638
  - Add debuginfo section to rpminspect.yaml (OPENJDK-2904)
  - Add unicode section to rpminspect.yaml (OPENJDK-2904)
  - Add contents of fips-17u-e893be00150.patch


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.7-2
changelog:
  - Update to jdk-17.0.12+7 (GA)
  - Update .gitignore to ignore openjdk-17.0.12+7.tar.xz
  - Sync java-17-openjdk-portable.specfile
  - Set buildver to 7
  - Set portablerelease 1
  - Set is_ga to 1
  - Update sources to openjdk-17.0.12+7.tar.xz
  - Resolves: RHEL-46638
  - Resolves: RHEL-46996
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.0.0.35-5
changelog:
  - cacerts symlink is resolved before passed to configure
  - https://issues.redhat.com/browse/OPENJDK-487
  - Disable FIPS mode detection using NSS in favour of using /proc/sys/crypto/fips_enabled for now, so we don't link against NSS
  -- effectively disabled Patch1008: rh1929465-improve_system_FIPS_detection.patch by settng --enable-sysconf-nss to --disable-sysconf-nss
  -- the enable-sysconf-nss was bringing in hard depndence on nss. Without nss, even in non fips, jvm had not even started


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.1.0.12-2
changelog:
  - Drop JDK-8272332/RH2004078 patch which is upstream in 17.0.1
  - October CPU update to jdk 17.0.1+12
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Add patch to allow plain key import.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:17.0.1.0.12-3
changelog:
  - Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
    secmod.db file as part of nss
  - Resolves: rhbz#2023537


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-1
changelog:
  - January 2022 security update to jdk 17.0.2+8
  - Rebase RH1995150 & RH1996182 patches following JDK-8275863 addition to module-info.java
  - Resolves: rhbz#2039366
  - Minor change to the OUTPUT_FILE value to separate the name from the version with '-'


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-5
changelog:
  - Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes (_heap->_heaps) and @JAVA_SPEC_VER@
  - Related: rhbz#2022822


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-9
changelog:
  - Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
  - Correction to previous changelog entry
  - Resolves: rhbz#2052070


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.6-1
changelog:
  - April 2022 security update to jdk 17.0.3+6
  - Update to jdk-17.0.3.0+6 pre-release tarball (17usec.17.0.3+5-220408)
  - Add JDK-8284548 regression fix missing from pre-release tarball but in jdk-17.0.3+6/jdk-17.0.3-ga
  - Update release notes to 17.0.3.0+6
  - Add missing README.md and generate_source_tarball.sh
  - Introduce tests/tests.yml, based on the one in java-11-openjdk
  - JDK-8283911 patch no longer needed now we're GA...
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073575


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.6-2
changelog:
  - Remove the patch jdk8283911-default_promoted_version_pre.patch which missed in previous commit
  - JDK-8275082 should be listed as also resolving JDK-8278008 & CVE-2022-21476
  - Related: rhbz#2073575


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.7-1
changelog:
  - April 2022 security update to jdk 17.0.3+7
  - Remove JDK-8284548 and JDK-8284920 they are upstreamed now
  - Resolves: rhbz#2073579


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:17.0.3.0.7-2
changelog:
  - Include BOOT_JDK for s390x for portable
  - BOOT_JDK downlaoded form hydra as
    java-17-temurin-17.0.3.7-0.private.ojdk17~upstream.hotspot.release.sdk.el7.s390x.tarxz
    and renamed
  - Added cosmetic changes to bypass a failure for s390x


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.3.0.7-4
changelog:
  - to pass aqa, fixing genuie failure in :
  - java/lang/SecurityManager/CheckAccessClassInPackagePermissions.java#CheckAccessClassInPackagePermissions
  - javax/xml/crypto/dsig/FileSocketPermissions.java#FileSocketPermissions
  - added and applied patch2001: aqaCheckSecurityAndProviderFileSocketPermissions.patch
  - this, properly named, patch must go to all our jdk17 builds, and to the fips repo


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.7-6
changelog:
  - Rebase FIPS patches from fips-17u branch and simplify by using a single patch from that repository
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - RH2023467: Enable FIPS keys export
  - RH2094027: SunEC runtime permission for FIPS
  - Resolves: rhbz#2029657
  - Resolves: rhbz#2096117


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.7-7
changelog:
  - Update FIPS support to bring in latest changes
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Resolves: rhbz#2099844
  - Resolves: rhbz#2100677


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:17.0.3.0.7-8
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2102433


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.1-0.1.ea
changelog:
  - Update to jdk-17.0.4.0+1
  - Update release notes to 17.0.4.0+1
  - Switch to EA mode for 17.0.4 pre-release builds.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Move EA designator check to prep so failures can be caught earlier
  - Make EA designator check non-fatal while upstream is not maintaining it
  - Related: rhbz#2084218


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:17.0.4.0.1-0.2.ea
changelog:
  - Fix issue where CheckVendor.java test erroneously passes when it should fail.
  - Add proper quoting so '&' is not treated as a special character by the shell.
  - Related: rhbz#2084779


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.8-1
changelog:
  - Update to jdk-17.0.4.0+8 (GA)
  - Update release notes to 17.0.4.0+8
  - Need to include the '.S' suffix in debuginfo checks after JDK-8284661
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-07-19 @ 1pm PT. **


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:17.0.4.0.8-1
changelog:
  - Commented out: fipsver f8142a23d0a which was from rhel-9-main
  - Picked 17.0.4+8 GA tag from rhel-9.0.0
  - For Jul 2022 CPU fipsver is 765f970aef1 on rhel-9.0.0


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-1
changelog:
  - Update to jdk-17.0.4.1+1
  - Update release notes to 17.0.4.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119532


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-2
changelog:
  - Update FIPS support to bring in latest changes
  - * RH2023467: Enable FIPS keys export
  - * RH2104724: Avoid import/export of DH private keys
  - * RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
  - * Build the systemconf library on all platforms
  - * RH2048582: Support PKCS#12 keystores
  - * RH2020290: Support TLS 1.3 in FIPS mode
  - Resolves: rhbz#2123579
  - Resolves: rhbz#2123580
  - Resolves: rhbz#2123581
  - Resolves: rhbz#2123583
  - Resolves: rhbz#2123584


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.5.0.8-1
changelog:
  - Update to jdk-17.0.5+8 (GA)
  - Update release notes to 17.0.5+8 (GA)
  - Switch to GA mode for final release.
  - * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.5.0.8-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - Related: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-1
changelog:
  - Update to jdk-17.0.6.0+10
  - Update release notes to 17.0.6.0+10
  - Re-enable EA upstream status check now it is being actively maintained.
  - Drop JDK-8294357 (tzdata2022d) & JDK-8295173 (tzdata2022e) local patches which are now upstream
  - Drop JDK-8275535 local patch now this has been accepted and backported upstream
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
  - Resolves: rhbz#2160111


author: Stephan Bergmann <sbergman@redhat.com> - 1:17.0.6.0.10-2
changelog:
  - Fix flatpak builds by disabling TestTranslations test due to missing tzdb.dat
  - Related: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-2
changelog:
  - Update FIPS support to bring in latest changes
  - * Add nss.fips.cfg support to OpenJDK tree
  - * RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
  - * Remove forgotten dead code from RH2020290 and RH2104724
  - * OJ1357: Fix issue on FIPS with a SecurityManager in place
  - Drop local nss.fips.cfg.in handling now this is handled in the patched OpenJDK build
  - Resolves: rhbz#2118493


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-4
changelog:
  - Separate JDK packaging into a separate function
  - Use variables to make it clearer what is going on
  - Use a package output directory as we do for building and installing
  - Workaround missing manpage directory in the JRE image


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-5
changelog:
  - Build with internal debuginfo as in RHEL and then create a stripped variant ourselves for the portable release build
  - Restore compiler flags to those used in RHEL
  - Drop unused static library patch
  - Drop syslookup workaround which was fixed by JDK-8276572 over a year ago


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-7
changelog:
  - Sync with existing RHEL 8 build, in order to start building portables on RHEL 8
  - Restore system bootstrap JDK (RHEL 8 has java-17-openjdk)
  - Remove use of devtoolset (RHEL 8 native compilers should be sufficient)
  - Explicitly exclude x86, as on RHEL RPMs


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
changelog:
  - Update to jdk-17.0.7.0+7
  - Update release notes to 17.0.7.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Reintroduce generate_source_tarball.sh from RHEL 9
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Update FIPS support against 17.0.7+6 and bring in latest changes:
  - * RH2134669: Add missing attributes when registering services in FIPS mode.
  - * test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
  - * RH1940064: Enable XML Signature provider in FIPS mode
  - * RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
  - Fix trailing '.' in tarball name
  - Use rpmrelease in vendor version to avoid inclusion of dist tag
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2134669
  - Resolves: rhbz#1940064
  - Resolves: rhbz#2173781


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.1-0.1.ea
changelog:
  - Update to jdk-17.0.8+1 (EA)
  - Update release notes to 17.0.8+1
  - Switch to EA mode
  - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 17.0.8+1
  - Bump bundled LCMS version to 2.15 as in jdk-17.0.8+1.
  - Bump bundled HarfBuzz version to 7.0.1 as in jdk-17.0.8+1


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.1-0.1.ea
changelog:
  - Re-enable SystemTap support and perform only substitutions possible without final NVR available
  - Depend on graphviz & pandoc for full documentation support
  - Fix typo which stops the EA designator being included in the build
  - Include tapsets in the miscellaneous tarball


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.7-1
changelog:
  - Update to jdk-17.0.8+7 (GA)
  - Update release notes to 17.0.8+7
  - Switch to GA mode for final release.
  - * This tarball is embargoed until 2023-07-18 @ 1pm PT. *


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.1.1-1
changelog:
  - Update to jdk-17.0.8.1+1 (GA)
  - Update release notes to 17.0.8.1+1
  - Add backport of JDK-8312489 already upstream in 17.0.10 (see OPENJDK-2095)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.9.0.9-1
changelog:
  - Update to jdk-17.0.9+9 (GA)
  - Update release notes to 17.0.9+9
  - Re-generate FIPS patch against 17.0.9+1 following backport of JDK-8209398
  - Bump libpng version to 1.6.39 following JDK-8305815
  - Bump HarfBuzz version to 7.2.0 following JDK-8307301
  - Bump freetype version to 2.13.0 following JDK-8306881
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Sync generate_tarball.sh with 11u version
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Use upstream release URL for OpenJDK source
  - Apply all patches using -p1
  - Temporarily turn off 'fresh_libjvm' due to removal of JVM_IsThreadAlive (JDK-8305425)
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.10.0.6-0.1.ea
changelog:
  - Update to jdk-17.0.10+6 (EA)
  - fips-17u-d63771ea660.patch: Regenerate from gnu-andrew branch
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Append -ea designator when required
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash
  - generate_source_tarball.sh: shellcheck: Double-quote variable references
  - generate_source_tarball.sh: shellcheck: Do not use -a
  - generate_source_tarball.sh: shellcheck: Do not use $ in expression
  - generate_source_tarball.sh: Remove temporary directory exit conditions


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.10.0.6-0.1.ea
changelog:
  - Update release notes to 17.0.10+6
  - Revert change to patch macro due to failure on RHEL 8
  - generate_source_tarball.sh: Add --sort=name to tar invocation for reproducibility


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.10.0.6-0.1.ea
changelog:
  - generate_source_tarball.sh: Add note on network usage of OPENJDK_LATEST
  - generate_source_tarball.sh: Remove unneeded fix-me


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.10.0.7-1
changelog:
  - Update to jdk-17.0.10+7 (GA)
  - Update release notes to 17.0.10+7
  - Move to -P<n> usage for patch macro which works on all RPM versions
  - Re-enable DEFAULT_PROMOTED_VERSION_PRE check disabled for the July 2023 release
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.1.ea
changelog:
  - NEWS: Add initial changes for 17.0.11
  - Sync whitespace and comments from java-21-openjdk.spec
  - Sync macro definition ordering from java-21-openjdk.spec
  - Correct rh1649512 patch name
  - Fix comment to match RHEL 9.2.0 branch
  - Fix icedteaver macro reference syntax
  - Remove extra slash in use_shenandoah_hotspot JAVA_HOME expansion
  - Explain patchN syntax situation in a comment
  - generate_source_tarball.sh: Fix whitespace
  - generate_source_tarball.sh: Skip -ga tags
  - generate_source_tarball.sh: Get -ea suffix from version-numbers.conf
  - generate_source_tarball.sh: Use git archive to generate tarball
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Default to without fresh_libjvm now that 17.0.9.0.9-1 is staged
  - double-build.bash: New file
  - Parallelize xz across all available cores
  - Remove ppc64le --with-jobs=1 workaround
  - Make JAR file and portable tarball modification times reproducible


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.11.0.1-0.1.ea
changelog:
  - BuildRequires javapackages-filesystem for _jvmdir macro
  - Automatically turn off building a fresh HotSpot first, if the bootstrap JDK is not the same major version as that being built
  - Update buildjdkver to match the featurever
  - Use featurever macro to specify fips patch
  - Check debug symbols in libnet.a static library as a smoke test
  - Introduce vm_variant global for consistency with future JDK builds
  - Related: rhbz#2203412
  - Introduce tar_opts to shorten tarball creation lines


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.11.0.1-0.1.ea
changelog:
  - generate_source_tarball.sh: Update version in comment
  - generate_source_tarball.sh: Remove trailing period in echo


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.1.ea
changelog:
  - Use --with-source-date=version (OPENJDK-2583, OPENJDK-2730)
  - Update freetype bundled provides version from 2.13.0 to 2.13.2
  - Update harfbuzz bundled provides version from 7.2.0 to 8.2.2
  - Update libpng bundled provides version from 1.6.39 to 1.6.40
  - Related: OPENJDK-2730


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.2.ea
changelog:
  - Bump rpmrelease to 2
  - Move _lto_cflags setting to match its java-21-openjdk location
  - Remove ExcludeArch to match java-21-openjdk
  - Update comment and whitespace to match java-21-openjdk
  - Update NEWS
  - Remove -T0 argument from systemtap tar invocation
  - Indent a line in buildjdk
  - Remove extra stripjdk from merge


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.2.ea
changelog:
  - Use RHEL-7 tar-1.26-compatible invocations for reproducible tarballs
  - On RHEL-7 default to building without a fresh libjvm.so


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.9-1
changelog:
  - Update to jdk-17.0.11+9 (GA)
  - Update NEWS for 17.0.11+9
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.9-2
changelog:
  - NEWS: Add CVEs
  - NEWS: Remove backed out items from changes section
  - NEWS: Remove release note for JDK-8225377, which was backed out


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.1-0.1.ea
changelog:
  - Update to jdk-17.0.12+1 (EA)
  - Update .gitignore to ignore openjdk-17.0.12+1-ea.tar.xz
  - Bump updatever to 12
  - Reset buildver to 1
  - Reset rpmrelease to 1
  - Reset is_ga to 0
  - Update sources to openjdk-17.0.12+1-ea.tar.xz
  - Update NEWS for 17.0.12+1
  - Fix fips-17u-d63771ea660.patch so that it applies to 17.0.12+1


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.1-0.1.ea
changelog:
  - Update lcms2 version location comment
  - Update lcms2 bundled provides to 2.16
  - Add zlib 1.3.1 bundled provides


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.2-0.1.ea
changelog:
  - Update to jdk-17.0.12+2 (EA)
  - Update .gitignore to ignore openjdk-17.0.12+2-ea.tar.xz
  - Update buildver to 2
  - Update sources to openjdk-17.0.12+2-ea.tar.xz
  - Update NEWS for 17.0.12+2
  - Add --enable-compatible-cds-alignment configure option (OPENJDK-3007)
  - Add remove-test-left-to-right-override-character.patch
  - Add remove-test-left-to-right-override-character.patch file
  - Remove tzdata build requires (OPENJDK-2843)


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.2-0.1.ea
changelog:
  - Use lcms2.h for bundled provides version reference
  - Use 2.16.0, not 2.16, for lcms2 version
  - Use zlib.h for bundled provides version reference
  - Use freetype.h for bundled provides version reference
  - Remove remove-test-left-to-right-override-character.patch


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.3-0.1.ea
changelog:
  - Update to jdk-17.0.12+3 (EA)
  - Update .gitignore to ignore openjdk-17.0.12+3-ea.tar.xz
  - Update buildver to 3
  - Update sources to openjdk-17.0.12+3-ea.tar.xz
  - Update NEWS for 17.0.12+3


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.4-0.1.ea
changelog:
  - Update to jdk-17.0.12+4 (EA)
  - Update .gitignore to ignore openjdk-17.0.12+4-ea.tar.xz
  - Update buildver to 4
  - Update sources to openjdk-17.0.12+4-ea.tar.xz
  - Update NEWS for 17.0.12+4


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.5-0.1.ea
changelog:
  - Update to jdk-17.0.12+5 (EA)
  - Update .gitignore to ignore openjdk-17.0.12+5-ea.tar.xz
  - Update buildver to 5
  - Update sources to openjdk-17.0.12+5-ea.tar.xz
  - Update NEWS for 17.0.12+5


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.5-0.2.ea
changelog:
  - Delete fips-17u-d63771ea660.patch
  - Use fips-17u-e893be00150.patch, rebased to jdk-17.0.12+2
  - fips-17u-e893be00150.patch was already committed with "Use 2.16.0...lcms2"
  - Update fipsver to e893be00150


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.12.0.5-0.3.ea
changelog:
  - Re-run jlink to regenerate the jmods directory and lib/modules with stripped libraries
  - Resolves: OPENJDK-3055


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - Update to jdk-17.0.12+6 (EA)
  - Update .gitignore to ignore openjdk-17.0.12+6-ea.tar.xz
  - Update buildver to 6
  - Reset rpmrelease to 1
  - Update sources to openjdk-17.0.12+6-ea.tar.xz
  - Update NEWS for 17.0.12+6
  - Remove --enable-compatible-cds-alignment configure option
  - Resolves: OPENJDK-3134


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.12.0.6-0.2.ea
changelog:
  - NEWS: Import 21 entries for JDK-8256660, JDK-8326891, JDK-8325496,
    JDK-8281658, and JDK-8315503, use 21 formatting for JDK-8256660,
    JDK-8316138


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.7-1
changelog:
  - Update to jdk-17.0.12+7 (GA)
  - Update .gitignore to ignore openjdk-17.0.12+7.tar.xz
  - Update NEWS for 17.0.12+7 (GA)
  - Set buildver to 7
  - Set rpmrelease to 1
  - Set is_ga to 1
  - Update sources to openjdk-17.0.12+7.tar.xz
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.11.0.9-4
changelog:
  - Sync release notes with upstream version: https://bit.ly/openjdk17011
  - Turn off 'fresh_libjvm' until jdk-17.0.9 or later is in the CentOS buildroot


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.12.0.7-1
changelog:
  - Default to without fresh_libjvm now that java-17-openjdk-17.0.11.0.9-2.el9 is in c9s-pending
  - Related: CS-2390


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.1-0.1.ea
changelog:
  - Update to jdk-17.0.13+1 (EA)
  - Update .gitignore to ignore openjdk-17.0.13+1-ea.tar.xz
  - Set updatever to 13
  - Set buildver to 1
  - Set is_ga to 0
  - Update sources to openjdk-17.0.13+1-ea.tar.xz
  - Update NEWS for 17.0.13+1 (EA)
  - Remove 0001-8332174-Remove-2-unpaired-RLO-Unicode-characters-in-.patch
  - Related: OPENJDK-2904


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.9-0.1.ea
changelog:
  - Update to jdk-17.0.13+9 (EA)
  - Add to .gitignore openjdk-17.0.13+9-ea.tar.xz
  - Set buildver to 9
  - Set rpmrelease to 1
  - Update sources to openjdk-17.0.13+9-ea.tar.xz
  - Update NEWS for jdk-17.0.13+9


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.10-0.1.ea
changelog:
  - Update to jdk-17.0.13+10 (EA)
  - Add to .gitignore openjdk-17.0.13+10-ea.tar.xz
  - Set buildver to 10
  - Update sources to openjdk-17.0.13+10-ea.tar.xz
  - Update NEWS for jdk-17.0.13+10


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.11-1
changelog:
  - Update to jdk-17.0.13+11 (GA)
  - Add to .gitignore openjdk-17.0.13+11.tar.xz
  - Set buildver to 11
  - Set is_ga to 1
  - Update sources to openjdk-17.0.13+11.tar.xz
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.14.0.1-0.1.ea
changelog:
  - Update to jdk-17.0.14+1 (EA)
  - Add to .gitignore openjdk-17.0.14+1-ea.tar.xz
  - Set updatever to 14
  - Set buildver to 1
  - Set is_ga to 0
  - Update sources to openjdk-17.0.14+1-ea.tar.xz
  - Update NEWS for jdk-17.0.14+1 (EA)
  - Double percent signs consistently throughout comments
  - Set bundled giflib provide version to 5.2.2
  - Set bundled libpng provide version to 1.6.43
  - Warn about bundled provide version bumps and backouts in openjdk_news.sh
  - Support two digit suffixes in portablename macro sed expressions
  - Remove 0001-8332174-Remove-2-unpaired-RLO-Unicode-characters-in-.patch file
  - Revert: Use component in EPEL and Fedora bug URLs


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.14.0.1-0.1.ea
changelog:
  - Move unstripped, misc and doc tarball handling into normal build / no suffix blocks
  - Resolves: OPENJDK-3218
  - Limit Java only tests to one architecture using jdk_test_arch
  - Resolves: OPENJDK-3185


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.14.0.7-1
changelog:
  - Update to jdk-17.0.14+7 (GA)
  - Add to .gitignore openjdk-17.0.14+7.tar.xz
  - Set buildver to 7
  - Set is_ga to 1
  - Update sources to openjdk-17.0.14+7.tar.xz
  - Sync NEWS from private-gnu_andrew-rhel-8.5-vanilla
  - ** This tarball is embargoed until 2025-01-21 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.10.0.6-0.1.ea
changelog:
  - generate_source_tarball.sh: Add note on network usage of OPENJDK_LATEST
  - generate_source_tarball.sh: Remove unneeded FIXME


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-1
changelog:
  - Update to jdk-17.0.7.0+7
  - Update release notes to 17.0.7.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Reintroduce generate_source_tarball.sh from RHEL 9
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Update FIPS support against 17.0.7+6 and bring in latest changes:
  - * RH2134669: Add missing attributes when registering services in FIPS mode.
  - * test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
  - * RH1940064: Enable XML Signature provider in FIPS mode
  - * RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2134669
  - Resolves: rhbz#1940064
  - Resolves: rhbz#2173781


author: Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.0.0.37-1
changelog:
  - Update to ea version of jdk18
  - Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
changelog:
  - Update to jdk-18.0.2 release
  - Update release notes to actually reflect OpenJDK 18
  - Support JVM variant zero following JDK-8273494 no longer installing Zero's libjvm.so in the server directory
  - Rebase FIPS patches from fips-18u branch
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Automatically turn off building a fresh HotSpot first, if the bootstrap JDK is not the same major version as that being built
  - Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
  - Switch bootjdkver to java-21-openjdk
  - Disable tzdata tests until we are on the latest JDK and things are back in sync
  - Drop bootstrap JDKs and use the java-21-openjdk-rhel7 build
  - Related: rhbz#2192749


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.1.0.10-1
changelog:
  - Update to jdk-19.0.2 release
  - Update release notes to 19.0.2
  - Rebase FIPS patches from fips-19u branch
  - Remove references to sample directory removed by JDK-8284999
  - Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
  - Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
  - Related: rhbz#2192749


author: Jiri Vanek <jvanek@redhat.com> - 1:20.0.0.0.36-1
changelog:
  - Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
  - Adapted rh1750419-redhat_alt_java.patch
  - Related: rhbz#2192749


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.2.0.9-1.1
changelog:
  - Update to jdk-20.0.2+9
  - Update release notes to 20.0.2+9
  - Update system crypto policy & FIPS patch from new fips-20u tree
  - Update generate_tarball.sh ICEDTEA_VERSION
  - Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
  - Related: rhbz#2192749


author: Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
changelog:
  - Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
  - Related: rhbz#2192749


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
changelog:
  - Update to jdk-21.0.0+35
  - Update release notes to 21.0.0+35
  - Update documentation (README.md)
  - Update system crypto policy & FIPS patch from new fips-21u tree
  - Update generate_tarball.sh to sync with upstream vanilla script inc. no more ECC removal
  - Drop fakefeaturever now it is no longer needed
  - Hardcode buildjdkver while the build JDK is not yet 21
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Use upstream release URL for OpenJDK source
  - Re-enable tzdata tests now we are on the latest JDK and things are back in sync
  - Fix trailing '.' in tarball name
  - Use rpmrelease in vendor version to avoid inclusion of dist tag
  - Replace alt-java patch with a binary separate from the JDK
  - Drop stale patches that are of little use any more:
  - * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work
  - * No accessibility subpackage to warrant RH1648242 patch any more
  - * No use of system libjpeg turbo to warrant RH649512 patch any more
  - Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
changelog:
  - Update to jdk-21.0.1.0+12 (GA)
  - Update release notes to 21.0.1.0+12
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Synchronise bundled versions with 21u sources (FreeType, LCMS, HarfBuzz, libpng)
  - Sync generate_tarball.sh with 11u & 17u version
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Fix upstream release URL for OpenJDK source
  - Update buildjdkver to match the featurever
  - Re-enable SystemTap support and perform only substitutions possible without final NVR available
  - Fix typo which stops the EA designator being included in the build
  - Include tapsets in the miscellaneous tarball
  - Drop unused globals for tapset installation
  - Rebuild jmods using the stripped binaries in release builds
  - Make sure the unstripped JDK is customised by the installjdk function


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.11-1
changelog:
  - Update to jdk-21.0.2+11 (GA)
  - Update release notes to 21.0.2+11
  - Bump libpng version to 1.6.40 following JDK-8316030
  - Bump HarfBuzz version to 8.2.2 following JDK-8313643
  - Drop local JDK-8311630 patch which is now upstream
  - Locally patch versioning to be 21.0.2 released on 2014-01-16
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.12-1
changelog:
  - Update to jdk-21.0.2+12 (GA)
  - Update release notes to 21.0.2+12
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
changelog:
  - Update to jdk-21.0.2+13 (GA)
  - Update release notes to 21.0.2+13
  - Drop no longer needed local patch to fix versioning
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
changelog:
  - Update to jdk-21.0.3+1 (EA)
  - Update release notes to 21.0.3+1
  - Switch to EA mode
  - Require tzdata 2023d due to upstream inclusion of JDK-8322725
  - Bump FreeType version to 2.13.2 following JDK-8316028


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
changelog:
  - Invoke xz in multi-threaded mode
  - Remove ppc64le with-jobs=1 workaround
  - Make portable tarball modification times reproducible
  - Use RHEL-7 tar-1.26-compatible invocations for reproducible tarballs


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
changelog:
  - Introduce tar_opts to avoid repetition of lengthy tar creation options
  - Add module build path to stripped directories to catch jpackageapplauncher files
  - Move alt-java man page to the misc tarball so it is not in the JDK image
  - Resolves: OPENJDK-2820
  - Resolves: OPENJDK-2821


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
changelog:
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Append -ea designator when required
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Fix -ea logic to add dash
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Fix whitespace
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Remove -T0 argument from systemtap tar invocation


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
changelog:
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Cleanup message issued when checkout already exists
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
  - Move maintenance scripts to a scripts subdirectory
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
  - generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
  - Vary reproducible tar creation by version of tar detected
  - Set OPENJDK_UPSTREAM_TAG_EPOCH & VERSION_FILE at start of build section as in 17u
  - generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
changelog:
  - Update to jdk-21.0.3+7 (EA)
  - Update release notes to 21.0.3+7
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Drop JDK-8009550 which is now available upstream
  - Re-generate FIPS patch against 21.0.3+7 following backport of JDK-8325254


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
changelog:
  - Update to jdk-21.0.3+9 (GA)
  - Update release notes to 21.0.3+9
  - Switch to GA mode.
  - Change --with-source-date value to 'version' to match Temurin builds
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: OPENJDK-2585


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.9-2
changelog:
  - createtar: Add exclude option
  - packagejdk: Exclude debuginfo when creating jdkarchive and jrearchive tarballs
  - Resolves: OPENJDK-2995


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-3
changelog:
  - Re-run jlink to regenerate the jmods directory and lib/modules with stripped libraries
  - Rebuild CDS archives against the updated lib/modules
  - Resolves: OPENJDK-2829


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
changelog:
  - Update to jdk-21.0.4+1 (EA)
  - Update release notes to 21.0.4+1
  - Switch to EA mode
  - Bump LCMS 2 version to 2.16.0 following JDK-8321489
  - Add zlib build requirement or bundled version (1.3.1), depending on system_libs setting
  - Resolves: OPENJDK-3060
  - Resolves: OPENJDK-3063


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
changelog:
  - Update to jdk-21.0.4+5 (EA)
  - Update release notes to 21.0.4+5
  - Move unstripped, misc and doc tarball handling into normal build / no suffix blocks
  - Limit Java only tests to one architecture using jdk_test_arch
  - Drop unneeded tzdata-java build dependency following 3e3cf8fa2df7bac2f6a60a0ddd596ec39228a3e1
  - Resolves: OPENJDK-3132
  - Resolves: OPENJDK-3194
  - Resolves: OPENJDK-3181
  - Resolves: OPENJDK-3189


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
changelog:
  - Update to jdk-21.0.4+7 (GA)
  - Update release notes to 21.0.4+7
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
  - Resolves: OPENJDK-2756
  - Resolves: OPENJDK-3163


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.1-0.1.ea
changelog:
  - Update to jdk-21.0.5+1 (EA)
  - Update release notes to 21.0.5+1
  - Switch to EA mode
  - Bump giflib version to 5.2.2 following JDK-8328999
  - Bump libpng version to 1.6.43 following JDK-8329004
  - Turn off fresh_libjvm following JDK-8329088 which changes jdk.internal.vm.StackChunk in CDS archive
  - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
  - Make build scripts executable


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-1
changelog:
  - Update to jdk-21.0.5+10 (GA)
  - Update release notes to 21.0.5+10
  - Switch to GA mode.
  - Revert JDK-8327501 & JDK-8328366 backport until more mature.
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
  - Resolves: OPENJDK-3327
  - Resolves: OPENJDK-3084


author: Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.0.0.37-1
changelog:
  - Update to ea version of jdk18
  - Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
  - Related: rhbz#2192749


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
changelog:
  - Update to jdk-18.0.2 release
  - Update release notes to actually reflect OpenJDK 18
  - Support JVM variant zero following JDK-8273494 no longer installing Zero's libjvm.so in the server directory
  - Rebase FIPS patches from fips-18u branch
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Automatically turn off building a fresh HotSpot first, if the bootstrap JDK is not the same major version as that being built
  - Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
  - Switch bootjdkver to java-21-openjdk
  - Disable tzdata tests until we are on the latest JDK and things are back in sync
  - Related: rhbz#2192749


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
changelog:
  - Update to jdk-21.0.0+35
  - Update release notes to 21.0.0+35
  - Update system crypto policy & FIPS patch from new fips-21u tree
  - Update generate_tarball.sh to sync with upstream vanilla script inc. no more ECC removal
  - Drop fakefeaturever now it is no longer needed
  - Hardcode buildjdkver while the build JDK is not yet 21
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Use upstream release URL for OpenJDK source
  - Re-enable tzdata tests now we are on the latest JDK and things are back in sync
  - Related: rhbz#2192749


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-2
changelog:
  - Update documentation (README.md, add missing JEP to release notes)
  - Replace alt-java patch with a binary separate from the JDK
  - Drop stale patches that are of little use any more:
  - * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work
  - * No accessibility subpackage to warrant RH1648242 patch any more
  - * No use of system libjpeg turbo to warrant RH649512 patch any more
  - Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
  - Related: rhbz#2192749


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-3
changelog:
  - Re-enable SystemTap support and perform only substitutions possible without final NVR available
  - Depend on graphviz & pandoc for full documentation support
  - Fix typo which stops the EA designator being included in the build
  - Include tapsets in the miscellaneous tarball
  - Drop unused globals for tapset installation


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-4
changelog:
  - Rebuild jmods using the stripped binaries in release builds
  - Make sure the unstripped JDK is customised by the installjdk function
  - Resolves: OPENJDK-1974


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
changelog:
  - Update to jdk-21.0.1.0+12 (GA)
  - Update release notes to 21.0.1.0+12
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Synchronise bundled versions with 21u sources (FreeType, LCMS, HarfBuzz, libpng)
  - Sync generate_tarball.sh with 11u & 17u version
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Fix upstream release URL for OpenJDK source
  - Update buildjdkver to match the featurever


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.1.0.12-2
changelog:
  - Invoke xz in multi-threaded mode
  - Remove ppc64le with-jobs=1 workaround
  - Make portable tarball modification times reproducible


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-2
changelog:
  - Use a devkit to build on architectures where we have one (s390x, aarch64, ppc64le, x86_64)
  - Use a dynamic libstdc++ on s390x to workaround failure with static libstdc++
  - Use the devkit tools during the check stage so they can understand the generated binaries
  - Use eu-readelf on devkit and non-devkit builds as debug symbol tests rely on its behaviour
  - Use system gdb for both builds as devkit version fails (needs devkit libraries, then JDK segfaults with them)
  - Filter out annobin plugin when using the devkit
  - Drop static libstdc++ build dependency on devkit builds as it should come from the devkit
  - Introduce tar_opts to avoid repetition of lengthy tar creation options


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
changelog:
  - Update to jdk-21.0.2+13 (GA)
  - Update release notes to 21.0.2+13
  - Bump libpng version to 1.6.40 following JDK-8316030
  - Bump HarfBuzz version to 8.2.2 following JDK-8313643


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
changelog:
  - Update to jdk-21.0.3+1 (EA)
  - Update release notes to 21.0.3+1
  - Switch to EA mode
  - Require tzdata 2023d due to upstream inclusion of JDK-8322725
  - Bump FreeType version to 2.13.2 following JDK-8316028
  - Add module build path to stripped directories to catch jpackageapplauncher files
  - Move alt-java man page to the misc tarball so it is not in the JDK image
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Cleanup message issued when checkout already exists
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
  - Move maintenance scripts to a scripts subdirectory
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
  - generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
  - generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
  - Vary reproducible tar creation by version of tar detected
  - Set OPENJDK_UPSTREAM_TAG_EPOCH & VERSION_FILE at start of build section as in 17u
  - Change --with-source-date value to 'version' to match Temurin builds
  - Re-run jlink to regenerate the jmods directory and lib/modules with stripped libraries
  - Rebuild CDS archives against the updated lib/modules
  - Require openjdk-devkit 1.0-4 to bring in fixes for .comment section and deterministic archives
  - Bump devkit requirement to 1.0-5 to bring in the bootstrapped version
  - Set LD_LIBRARY_PATH when calling gcc to build alt-java
  - Set LD_LIBRARY_PATH when calling configure
  - Set LD_LIBRARY_PATH when calling make
  - Bump devkit requirement to 1.0-6 to bring in the AS=<path>/as fix
  - Resolves: OPENJDK-2820
  - Resolves: OPENJDK-2821
  - Resolves: OPENJDK-2585
  - Resolves: OPENJDK-3138


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.1.ea
changelog:
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Append -ea designator when required
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Fix -ea logic to add dash
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Fix whitespace
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Remove -T0 argument from systemtap tar invocation
  - Use RHEL-7 tar-1.26-compatible invocations for reproducible tarballs
  - createtar: Add exclude option
  - packagejdk: Exclude debuginfo when creating jdkarchive and jrearchive tarballs
  - Resolves: OPENJDK-2995


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
changelog:
  - Update to jdk-21.0.3+9 (GA)
  - Update release notes to 21.0.3+9
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
changelog:
  - Update to jdk-21.0.4+1 (EA)
  - Update release notes to 21.0.4+1
  - Switch to EA mode
  - Bump LCMS 2 version to 2.16.0 following JDK-8321489
  - Add zlib build requirement or bundled version (1.3.1), depending on system_libs setting
  - Resolves: OPENJDK-3061
  - Resolves: OPENJDK-3064


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
changelog:
  - Update to jdk-21.0.4+5 (EA)
  - Update release notes to 21.0.4+5
  - Move unstripped, misc and doc tarball handling into normal build / no suffix blocks
  - Limit Java only tests to one architecture using jdk_test_arch
  - Drop unneeded tzdata-java build dependency following 3e3cf8fa2df7bac2f6a60a0ddd596ec39228a3e1
  - Resolves: OPENJDK-3133
  - Resolves: OPENJDK-3237
  - Resolves: OPENJDK-3182
  - Resolves: OPENJDK-3190


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
changelog:
  - Update to jdk-21.0.4+7 (GA)
  - Update release notes to 21.0.4+7
  - Switch to GA mode.
  - Sync with RHEL 7 portable build:
    - Conditionally define __os_install_post, dtsversion & pkgos only on RHEL 7
    - Use ExclusiveArch over ExcludeArch
    - Depend on devtoolset only on RHEL 7
    - Use javapackages-filesystem rather than manually defining _jvmdir
    - Restrict pandoc dependency to RHEL/CentOS 8
    - Drop unused component macro
  - Sync ExclusiveArch with devkit_arches on RHEL only
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
  - Resolves: OPENJDK-2756
  - Resolves: OPENJDK-3163


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-1
changelog:
  - Update to jdk-21.0.5+11 (GA)
  - Update release notes to 21.0.5+11
  - Remove local JDK-8327501 & JDK-8328366 backport as this is now upstream.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-2
changelog:
  - Bump devkit requirement to 1.0-8 to bring in the gcc with --enable-linker-build-id
  - Related: OPENJDK-3068


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-1
changelog:
  - Update to jdk-21.0.6+7 (GA)
  - Update release notes to 21.0.6+7
  - Build with DWARF 4 debuginfo for compatibility with older toolchains
  - Check for CentOS being defined to determine use of devkit
  - Bump devkit requirement to 1.0-9 to bring in updated sysroot
  - Drop workaround of building s390x with dynamic libstdc++
  - Turn on fresh_libjvm now 21.0.5 with JDK-8329088 is released
  - ** This tarball is embargoed until 2025-01-21 @ 1pm PT. **
  - Resolves: OPENJDK-3556
  - Resolves: OPENJDK-3590
  - Related: OPENJDK-3070


author: - Jiri Vanek <jvanek@redhat.com> - 0.32.92-1
changelog:
  - first update ever
  - to newest wrapper 32.92 with faith to fix some issues
  - added build requirments of gtk3-devel, at-spi2-atk-devel and at-spi2-core-devel
  - introduced libver macro to avoid duplicated entry


author: Michael Simacek <msimacek@redhat.com> - 0:6.1.3-1
changelog:
  - Update to upstream version 6.1.3
  - Use new upstream location
  - Generate scripts with jpackage_script


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 3.18.1-1
changelog:
  - Update to upstream version 3.18.1
  - Remove workaround for rpm bug, can be removed in F-18
  - Update to current packaging guidelines


author: Orion Poplawski <orion@nwra.com> - 0.19-3
changelog:
  - Use autoreconf -f to remove rpath
  - Use --disable-static to disable static builds
  - Use current make macros


author: Michael Simacek <msimacek@redhat.com> - 2.0.6-12
changelog:
  - Repack tarball without bundled jars
  - The repacked jar contains slightly different source (force push by upstream?)
  - Correct license tag


author: Michal Srb <msrb@redhat.com> - 0-0.14.20090319svn
changelog:
  - Install license file with javadoc subpackage (Resolves: rhbz#975411)
  - Add file containing link to CC-BY license text


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.10.1.el8_9]
changelog:
  - pNFS/filelayout: treat GETDEVICEINFO errors as layout failure (Scott Mayhew) [RHEL-16407 RHEL-4969]
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Chris Leech) [RHEL-12082 RHEL-8992] {CVE-2023-2162}
  - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress (Chris Leech) [RHEL-12082 RHEL-8992] {CVE-2023-2162}
  - KVM: x86/mmu: Fix an sign-extension bug with mmu_seq that hangs vCPUs (Peter Xu) [RHEL-15121 RHEL-7210]
  - netfilter: conntrack: Fix gre tunneling over ipv6 (Florian Westphal) [RHEL-15259 RHEL-12497]
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Florian Westphal) [RHEL-8443 RHEL-8444] {CVE-2023-42753}
  - tcp: enforce receive buffer memory limits by allowing the tcp window to shrink (Felix Maurer) [RHEL-15096 RHEL-15023]
  - redhat: change builder image to rhel-8.9 (Michael Hofmann)
  - net: openvswitch: add support for l4 symmetric hashing (Antoine Tenart) [RHEL-12746 RHEL-10498]
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16388 RHEL-2574] {CVE-2023-4622}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.11.1.el8_9]
changelog:
  - redhat: fix to be able to build with rpm 4.19.0 (Denys Vlasenko)
  - blk-mq: enforce op-specific segment limits in blk_insert_cloned_request (Ming Lei) [RHEL-14718 RHEL-14504]
  - KVM: x86: Add SBPB support (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - KVM: x86: Add IBPB_BRTYPE support (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/retpoline: Document some thunk handling aspects (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Remove unnecessary semicolon (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/rethunk: Use SYM_CODE_START[_LOCAL]_NOALIGN macros (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Disentangle rethunk-dependent options (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Move retbleed IBPB check into existing 'has_microcode' code block (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/bugs: Remove default case for fully switched enums (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Remove 'pred_cmd' label (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Unexport untraining functions (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Improve i-cache locality for alias mitigation (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix vulnerability reporting for missing microcode (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Print mitigation for retbleed IBPB case (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Print actual mitigation if requested mitigation isn't possible (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix SBPB enablement for (possible) future fixed HW (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/alternatives: Remove faulty optimization (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix SBPB enablement for spec_rstack_overflow=off (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Don't probe microcode in a guest (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Set CPUID feature bits independently of bug or mitigation status (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix srso_show_state() side effect (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Fix amd_check_microcode() declaration (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/CPU/AMD: Remove amd_get_topology_early() (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Correct the mitigation status when SMT is disabled (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Explain the untraining sequences a bit more (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/cpu/kvm: Provide UNTRAIN_RET_VM (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Cleanup the untrain mess (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Rename original retbleed methods (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Clean up SRSO return thunk mess (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/alternative: Make custom return thunk unconditional (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - objtool/x86: Fix SRSO mess (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/cpu: Fix __x86_return_thunk symbol type (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Disable the mitigation on unaffected configurations (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/CPU/AMD: Fix the DIV(0) initial fix attempt (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - driver core: cpu: Fix the fallback cpu_show_gds() name (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86: Move gds_ucode_mitigated() declaration to header (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/speculation: Add cpu_show_gds() prototype (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - driver core: cpu: Make cpu_show_not_affected() static (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix build breakage with the LLVM linker (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - Documentation/srso: Document IBPB aspect and fix formatting (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - driver core: cpu: Unify redundant silly stubs (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/CPU/AMD: Do not leak quotient data after a division by 0 (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Tie SBPB bit setting to microcode patch detection (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add a forgotten NOENDBR annotation (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Fix return thunks in generated code (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add IBPB on VMEXIT (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add IBPB (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add SRSO_NO support (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add IBPB_BRTYPE support (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/srso: Add a Speculative RAS Overflow mitigation (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/retbleed: Add __x86_return_thunk alignment checks (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/retbleed: Fix return thunk alignment (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/alternative: Optimize returns patching (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/microcode/AMD: Load late on both threads too (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86/returnthunk: Allow different return thunks (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - x86: Sanitize linker script (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - objtool: Fix .return_sites generation (Waiman Long) [RHEL-14115 RHEL-9298] {CVE-2023-20569}
  - drm/amdgpu: Fix possible null pointer dereference (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/amdgpu: Fix possible null pointer dereference (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Keep a gem reference to user bos in surfaces (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: fix typo of sizeof argument (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Fix possible invalid drm gem put calls (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Fix shader stage validation (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: remove unused vmw_overlay function (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Fix Legacy Display Unit atomic drm support (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Print errors when running on broken/unsupported configs (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Drop mksstat_init_record fn as currently unused (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Fix src/dst_pitch confusion (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Replace one-element array with flexible-array member (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Do not drop the reference to the handle too soon (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Stop accessing buffer objects which failed init (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Make the driver work without the dummy resources (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Stop using raw ttm_buffer_object's (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Abstract placement selection (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Rename dummy to is_iomem (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Cleanup the vmw bo usage in the cursor paths (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Simplify fb pinning (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Rename vmw_buffer_object to vmw_bo (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Remove the duplicate bo_free function (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/vmwgfx: Use the common gem mmap instead of the custom code (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/radeon: handle NULL bo->resource in move callback (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/qxl: handle NULL bo->resource in move callback (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/gem-vram: handle NULL bo->resource in move callback (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/ttm: prevent moving of pinned BOs (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/ttm: stop allocating a dummy resource for pipelined gutting (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/ttm: stop allocating dummy resources during BO creation (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/ttm: clear the ttm_tt when bo->resource is NULL (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - drm/i915/ttm: audit remaining bo->resource (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - Revert "drm/vmwgfx: Stop accessing buffer objects which failed init" (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - Revert "drm/vmwgfx: Do not drop the reference to the handle too soon" (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}
  - Revert "drm/vmwgfx: Fix Legacy Display Unit atomic drm support" (Jocelyn Falempe) [RHEL-14509 RHEL-14510] {CVE-2023-5633}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.12.1.el8_9]
changelog:
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve (Davide Caratti) [RHEL-16858 RHEL-14032] {CVE-2023-4623}
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Davide Caratti) [RHEL-16858 RHEL-14032] {CVE-2023-4623}
  - net: sched: sch_qfq: Use non-work-conserving warning handler (Davide Caratti) [RHEL-14423 RHEL-14032] {CVE-2023-4921}
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (Davide Caratti) [RHEL-14423 RHEL-14032] {CVE-2023-4921}
  - net/tls: Remove the context from the list in tls_device_down (Jay Shin) [RHEL-17813 RHEL-17301]
  - tls: Fix context leak on tls_device_down (Jay Shin) [RHEL-17813 RHEL-17301]
  - igb: set max size RX buffer when store bad packet is enabled (Wander Lairson Costa) [RHEL-15187 RHEL-15188] {CVE-2023-45871}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.13.1.el8_9]
changelog:
  - Fix double fget() in vhost_net_set_backend() (Jon Maloy) [RHEL-13212 RHEL-7162] {CVE-2023-1838}
  - can: af_can: fix NULL pointer dereference in can_rcv_filter (Ricardo Robaina) [RHEL-19462 RHEL-6429] {CVE-2023-2166}
  - RDMA/core: Update CMA destination address on rdma_resolve_addr (Kamal Heib) [RHEL-19328 RHEL-1032] {CVE-2023-2176}
  - RDMA/core: Refactor rdma_bind_addr (Kamal Heib) [RHEL-19328 RHEL-1032] {CVE-2023-2176}
  - net: fix net device address assign type (Michal Schmidt) [RHEL-17296 RHEL-6383]
  - net: add check for current MAC address in dev_set_mac_address (Michal Schmidt) [RHEL-17296 RHEL-6383]
  - perf/core: Fix potential NULL deref (Wander Lairson Costa) [RHEL-18004 RHEL-14982] {CVE-2023-5717}
  - perf: Disallow mis-matched inherited group reads (Wander Lairson Costa) [RHEL-18004 RHEL-14982] {CVE-2023-5717}
  - drivers: net: slip: fix NPD bug in sl_tx_timeout() (Michal Schmidt) [RHEL-18583 RHEL-6655] {CVE-2022-41858}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.14.1.el8_9]
changelog:
  - nfp: fix use-after-free in area_cache_get() (Ricardo Robaina) [RHEL-19452 RHEL-6567] {CVE-2022-3545}
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (David Marlin) [RHEL-18999 RHEL-1231] {CVE-2023-40283}
  - md/raid5: release batch_last before waiting for another stripe_head (Nigel Croxon) [RHEL-12284 RHEL-9875]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.15.1.el8_9]
changelog:
  - IB/ipoib: Fix mcast list locking (Daniel Vacek) [RHEL-19699 RHEL-19244]
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join (Daniel Vacek) [RHEL-19699 RHEL-19244]
  - x86/sev: Check for user-space IOIO pointing to kernel space (Wander Lairson Costa) [RHEL-18014 RHEL-14978] {CVE-2023-46813}
  - x86/sev: Check IOBM for IOIO exceptions from user-space (Wander Lairson Costa) [RHEL-18014 RHEL-14978] {CVE-2023-46813}
  - x86/sev: Disable MMIO emulation from user mode (Wander Lairson Costa) [RHEL-18014 RHEL-14978] {CVE-2023-46813}
  - x86/sev-es: Fix SEV-ES OUT/IN immediate opcode vc handling (Wander Lairson Costa) [RHEL-18014 RHEL-14978] {CVE-2023-46813}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.16.1.el8_9]
changelog:
  - tracing/timerlat: Add user-space interface (Chris White) [RHEL-20362 RHEL-15142]
  - tracing/osnoise: Skip running osnoise if all instances are off (Chris White) [RHEL-20362 RHEL-15142]
  - tracing/osnoise: Switch from PF_NO_SETAFFINITY to migrate_disable (Chris White) [RHEL-20362 RHEL-15142]
  - tracing/timerlat: Always wakeup the timerlat thread (Chris White) [RHEL-20362 RHEL-15142]
  - tracing/osnoise: Fix notify new tracing_max_latency (Chris White) [RHEL-20362 RHEL-15142]
  - tracing/timerlat: Notify new max thread latency (Chris White) [RHEL-20362 RHEL-15142]
  - trace/osnoise: make use of the helper function kthread_run_on_cpu() (Chris White) [RHEL-20362 RHEL-15142]
  - kthread: add the helper function kthread_run_on_cpu() (Chris White) [RHEL-20362 RHEL-15142]
  - x86/apic: Mark _all_ legacy interrupts when IO/APIC is missing (Prarit Bhargava) [RHEL-7238 RHEL-4244]
  - HID: check empty report_list in hid_validate_values() (Desnes Nunes) [RHEL-19274 RHEL-19237] {CVE-2023-1073}
  - s390/dasd: print copy pair message only for the correct error (Tobias Huschle) [RHEL-9444 RHEL-2831]
  - blk-mq: don't count completed flush data request as inflight in case of quiesce (Ming Lei) [RHEL-19111 RHEL-18055]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.17.1.el8_9]
changelog:
  - redhat: rewrite genlog and support Y- tags (Jan Stancek)
  - smb: client: fix OOB in smbCalcSize() (Scott Mayhew) [RHEL-21662 RHEL-18990] {CVE-2023-6606}
  - s390/qeth: Don't call dev_close/dev_open (DOWN/UP) (Tobias Huschle) [RHEL-17884 RHEL-2410]
  - blk-mq: use quiesced elevator switch when reinitializing queues (Ming Lei) [RHEL-21785 RHEL-19944]
  - lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly (Ming Lei) [RHEL-20232 RHEL-8128]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.18.1.el8_9]
changelog:
  - net: tls, update curr on splice as well (Sabrina Dubroca) [RHEL-22091 RHEL-19065] {CVE-2024-0646}
  - smb: client: fix potential OOB in smb2_dump_detail() (Scott Mayhew) [RHEL-21672 RHEL-19144] {CVE-2023-6610}
  - smb: client: fix potential OOB in cifs_dump_detail() (Scott Mayhew) [RHEL-21672 RHEL-19144] {CVE-2023-6610}
  - nvmet-tcp: Fix the H2C expected PDU len calculation (Maurizio Lombardi) [RHEL-22299 RHEL-22637 RHEL-22641 RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - nvmet-tcp: remove boilerplate code (Maurizio Lombardi) [RHEL-22299 RHEL-22637 RHEL-22641 RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - nvmet-tcp: fix a crash in nvmet_req_complete() (Maurizio Lombardi) [RHEL-22299 RHEL-22637 RHEL-22641 RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length (Maurizio Lombardi) [RHEL-22299 RHEL-22637 RHEL-22641 RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - net-sysfs: add check for netdevice being present to speed_show (Michal Schmidt) [RHEL-20924 RHEL-16007]
  - netfilter: nft_set_pipapo: skip inactive elements during set walk (Florian Westphal) [RHEL-20698 RHEL-19721] {CVE-2023-6817}


author: Jeff Moyer <jmoyer@redhat.com> - 1.101-4
changelog:
  - Build for x86_64 as well.  Kdump support doesn't work there, but users
    should be able to use kexec.


author: Jeff Moyer <jmoyer@redhat.com> - 1.101-8
changelog:
  - Fix the service stop case.  It was previously unloading the wrong kernel.
  - Implement the "restart" function.
  - Add the "irqpoll" option as a default kdump kernel commandline parameter.
  - Create a default kernel command line in the sysconfig file upon rpm install.


author: Thomas Graf <tgraf@redhat.com> - 1.101-10
changelog:
  - kdump7.patch
     o Remove elf32 core headers support for x86_64
     o Fix x86 prepare elf core header routine
     o Fix ppc64 kexec -p failure for gcc 4.10
     o Fix few warnings for gcc 4.10
     o Add the missing --initrd option for ppc64
     o Fix ppc64 persistent root device bug
  - Remove --elf32-core-headers from default configuration, users
    may re-add it via KEXEC_ARGS.
  - Remove obsolete KEXEC_HEADERS


author: Thomas Graf <tgraf@redhat.com> - 1.101-15
changelog:
  - Don't add kdump service by default, let the user manually add it to
    avoid everyone seeing a warning.


author: Neil Horman <nhorman@redhat.com> - 1.101-45
changelog:
  - fixed typo in mkdumprd for bz 202983
  - fixed typo in mkdumprd for bz 203053
  - clarified docs in kdump.conf with examples per bz 203015


author: Jarod Wilson <jwilson@redhat.com> - 1.101-46
changelog:
  - ppc64 fixups:
    - actually build ppc64 binaries (bug 203407)
    - correct usage output
    - avoid segfault in command-line parsing
  - install kexec man page
  - use regulation Fedora BuildRoot


author: Neil Horman <nhorman@redhat.com> - 1.101-58
changelog:
  - Updating kdump.init and mkdumprd with most recent RHEL5 fixes
  - Fixing BuildReq to require elfutils-devel-static


author: Neil Horman <nhorman@redhat.com> - 1.102pre-1
changelog:
  - Bumping kexec version to latest horms tree (bz 257201)
  - Adding trigger to remove initrds when a kernel is removed


author: Neil Horman <nhorman@redhat.com> - 1.102pre-3
changelog:
  - Fix ARCH placement in kdump init script (bz 427201)
  - Fix BuildRequires
  - Fix Makedumpfile to build with new libelf


author: Neil Horman <nhorman@redhat.com> - 1.102pre-6
changelog:
  - Bringing rawhide up to date with bugfixes from RHEL5
  - Adding patch to prevent kexec buffer overflow on ppc (bz 428684)


author: Neil Horman <nhorman@redhat.com> 2.0.0-18
changelog:
  - Updated initscript to use mkdumprd2 if manifest is present
  - Updated spec to require dash
  - Updated sample manifest to point to correct initscript
  - Updated populate_std_files helper to fix sh symlink


author: CAI Qian <caiqian@redhat.com> - 2.0.0-34
changelog:
  - Massive forward-port from RHEL6
  - Update kexec-kdump-howto.txt
  - Update docs to reflect use of ext4
  - Update mkdumprd to pull in all modules needed
  - Fix mkdumprd typo
  - Removed universal add of ata_piix from mkdumprd
  - Fix infinite loop from modprobe changes
  - Fixed kexec-kdump-howto.doc for RHEL6
  - Update makedumpfile to 1.3.5
  - Improved mkdumprd run time
  - Cai's fix for broken regex
  - Fixing crashkernel syntax parsing
  - Fix initscript to return proper LSB return codes
  - Fixed bad call to resolve_dm_name
  - Added poweroff option to mkdumprd
  - Fixed readlink issue
  - Fixed x86_64 page_offset specifictaion
  - Fixed lvm setup loop to not hang
  - Added utsname support to makedumpfile for 2.6.32
  - Fix critical_disks list to exclude cciss/md
  - Add help info for -b option
  - Add ability to handle firmware hotplug events
  - Update mkdumprd to deal with changes in busybox fsck
  - Vitaly's fix to detect need for 64 bit elf
  - Fix major/minor numbers on /dev/rtc
  - Fix ssh id propogation w/ selinux
  - Add blacklist feature to kdump.conf
  - Removed rhpl code from firstboot
  - Fixed firstboot enable sense
  - Remove bogus debug comment from mkdumprd.
  - Handle SPARSEMEM properly
  - Fix scp monitoring script
  - Fix firstboot to find grub on EFI systems
  - Fixed mkdumprd to remove dup insmod
  - Fixed kdump fsck pause
  - Fixed kdump option handling
  - fixed raid5 module detection


author: Cong Wang <xiyou.wangcong@gmail.com> - 2.0.3-42
changelog:
  - get ip addr with getent
  - spec: depends on dracut-network
  - Handle net option for nfs in kdump.conf correctly


author: Dave Young <dyoung@redhat.com> - 2.0.3-44
changelog:
  - update ppc64 sysconfig, resolve bug 811449
  - deal with nic rename issue, resolve bug 810107
  - update x86_64 sysconfig, resolve bug 813711


author: Dave Young <ruyang@redhat.com> - 2.0.3-46
changelog:
  - mkdumprd: Start using --hostonly and --add kdumpbase while calling dracut
  - get_mp function cleanup
  - move kdump script order to the end of pre pivot
  - port raw dump from rhel6
  - remove multi dump


author: Dave Young <ruyang@redhat.com> - 2.0.3-48
changelog:
  - do_default_action cleanup, Resolves: bz805773
  - add rhcrashkernel-param for anaconda use, Resolves: bz707441
  - Basic iscsi target dump support (software initiator), Resolves bz822701
  - Static ip configuratio support, Resolves: bz822739
  - udev rules fix, Resolves: bz808817


author: Dave Young <ruyang@redhat.com> - 2.0.3-49
changelog:
  - cleanup DUMP_INSTRUCTION handling
  - final reboot behavior fix
  - dump_rootfs for default target fix
  - add vlan support
  - fix and refactor bond handling code
  - fix and refactor bridge handling code
  - core_collector doc basic fix
  - omit plymouth module, Resolves: bz821997
  - mkdumprd manpage cleanup manpage
  - mkdumprd: remove --debug
  - mkdumprd: remove noconf
  - makedumprd: remove -d
  - kdump.conf add sshkey
  - kdump.conf remove disk_timeout
  - kdump.conf make path uncommented
  - kdump.conf.5 add default poweroff
  - kdump.conf default shell fix
  - kdump.conf default default action fix
  - kdump.conf.5 remove module option
  - kdump.conf remove kdump_pre/kdump_post
  - kdump.conf: remove link_delay


author: Dave Young <ruyang@redhat.com> - 2.0.3-50
changelog:
  - add blacklist option, Resolves: bz805774
  - Add kdump_post and kdump_pre support, Resolves: bz805773
  - Port check_config from rhel6, Resolves: bz805778
  - raw core_collector fix
  - ssh core_collector fix
  - drcut-kdump.sh: cleanup kdump.conf check


author: Dave Young <ruyang@redhat.com> - 2.0.3-51
changelog:
  - add s390x netdev setup
  - Add s390x support
  - Cleanup temp file leaved at /tmp/
  - add check_size function for fs dump
  - add ssh check_size
  - blacklist patch apply fix
  - Respect bonding mode
  - Support dump over vlan tagged bonding


author: Dave Young <ruyang@redhat.com> - 2.0.3-53
changelog:
  - refactor net option
  - use fstab-sys to mount nfs
  - rename function dump_localfs
  - dump_localfs error path fix
  - update kexec-kdump-howto.txt about systemctl commands
  - ssh propagate alert message fix
  - remove useless dracut cmdline '-c /dev/null'
  - remove useless dracut cmdline for kernel-modules and kdumpbase
  - install core_collector in module-setup.sh
  - install extra_bins in module-setup.sh
  - remove busybox dependency
  - improve warning message of space checking
  - do not mount root twice
  - do not add fstab-sys module in dracut cmdline
  - omit dash module
  - network dns config fix
  - shell exit value fix


author: Dave Young <ruyang@redhat.com> - 2.0.3-54
changelog:
  - pass raw device as dracut argument
  - iscsi setup fix
  - firstboot: add automatic and manual memory reservation for rhel
  - firstboot: remove unnecessary underline shortkey
  - firstboot: fix gtk warning about non-zero page size
  - firstboot: update all kernels config in grubbyCmd
  - firstboot: add actual reserved memory widget
  - firstboot code cleanup
  - rhcrashkernel-param: echo crashkernel=auto for rhel7
  - Remove the kernel-kdump handling
  - s390x firstboot fix
  - remove elilo support
  - grub2 fix in firstboot
  - Take closing the reboot dialog as no
  - Handle new crashkernel= syntax in firstboot
  - Fix a localized string in firstboot
  - Configure kdump in firstboot
  - fix firstboot to ensure kdump svc is disabled properly
  - firstboot text domain fix
  - Update to use systemctl instead of sysv chkconfig
  - port force_rebuild kdump.conf option
  - Change return value to indicate the result of dump_raw() correctly.
  - call dracut function for default shell


author: Dave Young <ruyang@redhat.com> - 2.0.3-56
changelog:
  - Pull vmcore-dmesg patches from vivek
  - ppc/ppc64: compile purgatory with gcc option msoft-float
  - Update to support f18 grub2 efi config file
  - pass persistent name to dracut --device
  - pass persistent name to dracut --mount
  - use persistent name in kdump.conf of initramfs
  - mkdumprd: add function get_persistent_dev
  - remove useless uuid and label handling


author: Dave Young <ruyang@redhat.com> - 2.0.3-59
changelog:
  - Enable kdump service after installation
  - get MEM_RESERVED from sysfs attribute
  - get_ssh_size: use -n to redirect stdin from /dev/null
  - add random feeding code for ssh dump
  - kdump option space checking improvement
  - kdumpctl: multi dump target checking fix


author: Dave Young <ruyang@redhat.com> - 2.0.3-60
changelog:
  - makedumpfile 1.5.1
  - Update po tar.gz
  - Add a notes for zanata process
  - Add two xmls file for po zanata translation
  - Cleanup and recreate po files


author: Dave Young <ruyang@redhat.com> - 2.0.3-62
changelog:
  - Pull translated po files from zanata
  - Optimize redundent code fetching server of network dump
  - change the dump dir format to be more readable


author: Dave Young <ruyang@redhat.com> - 2.0.3-63
changelog:
  - revert explictly handling of PIPESTATUS
  - enable pipefail bash option
  - wrong ssh key fix
  - build fix: Update 3 po files: po/gu.po po/or.po po/zh_CN.po


author: Dave Young <ruyang@redhat.com> - 2.0.3-65
changelog:
  - Add support for team devices
  - Update translation file po/it.po
  - remove wait for net ok function
  - add bootdev cmdline param
  - kdumpnic cmdline file name cleanup


author: Dave Young <ruyang@redhat.com> - 2.0.3-66
changelog:
  - Spec: remove kdump image when a corresponding kernel is removed
  - Merge an upstream patch for fix a ppc64 makedumpfile bug


author: Baoquan He <bhe@redhat.com> - 2.0.3-67
changelog:
  - Remove comma which is redundant
  - Modify codes related to dump dir to make it clearer
  - Rectify the get_host_ip implementation
  - Revert: Merge an upstream patch for fix a ppc64 makedumpfile bug with with CONFIG_SPARSEMEM_EXTREME
  - pull makedumpfile 1.5.3


author: Baoquan He <bhe@redhat.com> - 2.0.3-68
changelog:
  - tune sysconfig to save memory usage
  - Remove useless codes related to LOGGER in kdumpctl
  - kdumpctl:print out the service status
  - Return to start() function when check_ssh_target failed
  - use findmnt instead of blkid in mkdumprd
  - check dump target mounting earlier
  - kdumpctl: rename function name check_config
  - add function to check kdump config file
  - dracut-module-setup.sh: remove UUID/LABEL quotes before using it
  - Change dump_to_rootfs to be a default option and reboot to be default action
  - Remove "-F" in CORE_COLLECTOR when dump_to_rootfs


author: Baoquan He <bhe@redhat.com> - 2.0.4-1
changelog:
  - Delete several patches which have been merged into kexec-tools-2.0.4
  - Revert: Release 2.0.3-72
  - Release 2.0.3-72
  - Pull kexec-tools-2.0.4
  - Check if block device as dump target is resettable
  - mkdumprd: add function perror_exit
  - Deprecate blacklist option


author: Baoquan He <bhe@redhat.com> - 2.0.4-2
changelog:
  - kdump: Save vmcore-dmesg.txt before saving vmcore
  - Remove "ip=" overwrite to 40ip.conf
  - Add support for bridge over bond/team/vlan.
  - Fix bonding options syntax and get all specified options from ifcfg file.
  - add dracut_args option to kdump.conf
  - kexec-tools.spec: Add ethtool to dependency.
  - error out if dump target is encrypted


author: Baoquan He <bhe@redhat.com> - 2.0.4-3
changelog:
  - mkdumprd: remove -M option for dracut
  - kdumpctl: add selinux relabel when service startup
  - depends on dracut selinux module
  - dracut-kdump.sh: umount rootfs after dump_to_rootfs
  - kdump.sysconfig: append "panic=10" to kdump cmdline
  - kexec-kdump-howto: grubby is suggested modifing kernel cmdline
  - kexec-tools.spec: removes kexec udev rules for s390
  - kdump.sysconfig: Add option action_on_fail and set its default as continue
  - Add tab key as delimiter for core_collector in kdump.conf
  - redirect stdout to stderr


author: Baoquan He <bhe@redhat.com> - 2.0.4-4
changelog:
  - dracut-module-setup.sh: improve the approach to get a bridged interface list
  - dracut-module-setup.sh: cleanup - use kdump_get_mac_addr() function
  - dracut-module-setup.sh: use kernel exported mac address in kdump_get_mac_addr()
  - dracut-module-setup.sh: use perm addr of slaves to setup bonding network
  - kdump: Do not output debug messages by default
  - dracut-module-setup.sh: kdump module depends on drm module
  - mkdumprd: return error if no write permission on save path of server for ssh


author: Baoquan He <bhe@redhat.com> - 2.0.4-5
changelog:
  - monitor-dd-progress fix
  - rawdump: only show dd progress bar when core_collector is not makedumpfile
  - kexec-tools.spec: replaces scriptlets with new systemd macros
  - dracut-kdump.sh: umount fs right before kdump exit
  - dracut-kdump.sh: recursively umount fs and its submounts
  - dracut-kdump.sh: cleanup - using local variable names instead of $1/$2 in functions
  - dracut-kdump.sh: name the invalid vmcore to vmcore-incomplete
  - dracut-kdump.sh: Output top level information about the kdump progress.
  - kexec-kdump-howto: Add a section for debugging tips


author: Baoquan He <bhe@redhat.com> - 2.0.4-6
changelog:
  - add snappy build
  - add lzo build
  - pull makedumpfile-1.5.4
  - mkdumprd: check return value of subshell
  - mkdumprd: get_persistent_dev() return original dev if no persistent dev exists.
  - dracut-kdump.sh: Merge dump_to_rootfs() to dump_fs()
  - dracut-kdump.sh: explicitly sync after each dump
  - Correct wrong weekday of changelog
  - kexec-tools.spec: Remove incorrect description in changelog


author: Baoquan He <bhe@redhat.com> - 2.0.4-7
changelog:
  - dracut-kdump.sh: add do_dump() and error out if dump vmcore fails
  - dracut-module-setup.sh: setup correct system time and time zone in 2nd kernel.
  - kernel cmdline: Remove hugepage allocations
  - Use /lib/dracut/no-emergency-shell to control action on fail
  - Revert: kdump.sysconfig: Add option action_on_fail and set its default as continue
  - dracut-kdump.sh: Redirect kdump script stdout/stderr to /dev/console
  - makedumpfile: Add vmap_area_list definition for ppc/ppc64.


author: Baoquan He <bhe@redhat.com> - 2.0.4-9
changelog:
  - Strip inline comments from the kdump config file before use
  - kdump-lib.sh: add common function strip_comments
  - Introduce kdump-lib.sh for kdump shared functions
  - kdump.service: Start kdump after network is online and remote fs is mounted
  - dracut-module-setup: _dev to be a local variable
  - kdumpctl: Run multiple kdumpctl instances one by one in serial order


author: WANG Chao <chaowang@redhat.com> - 2.0.4-12
changelog:
  - fix sadump format phys_base calculating error
  - kdump, x86: Process multiple Crash kernel in /proc/iomem
  - makedumpfile: wrong cyclic buffer size recalculation causes bitmap data corruption
  - Fix max_mapnr issue on system has over 44-bit addressing.


author: WANG Chao <chaowang@redhat.com> - 2.0.4-14
changelog:
  - Add rd.memdebug in kdump module
  - kdumpctl: Avoid leaking fd to subshell
  - makedumpfile: Understand >= v3.11-rc4 dmesg
  - makedumpfile, ppc: Support to filter dump for kernels that use CONFIG_SPARSEMEM_VMEMMAP.


author: WANG Chao <chaowang@redhat.com> - 2.0.4-18
changelog:
  - update translation files
  - makedumpfile: default to lzo compression
  - makedumpfile: add makedumpfile.conf.sample and its manpage


author: WANG Chao <chaowang@redhat.com> - 2.0.4-20
changelog:
  - vmcore-dmesg: fix timestamp error in vmcore-dmesg.txt
  - makedumpfile: re-enable mmap() and introduce --non-mmap
  - kdump.conf uncomment default core_collector line
  - fix an issue when 'ssh' directive appearing in kdump.conf, the rest part of
    lines in this file are ignored


author: WANG Chao <chaowang@redhat.com> - 2.0.4-21
changelog:
  - makedumpfile: Improve progress information for huge memory system
  - s390: use nr_cpus=1 instead of maxcpus=1


author: WANG Chao <chaowang@redhat.com> - 2.0.4-23
changelog:
  - ssh dump: create random-seed manually
  - makedumpfile: memset() in cyclic bitmap initialization introduce segment fault.
  - Add acpi_no_memhotplug to kdump kernel
  - Add fence kdump support


author: WANG Chao <chaowang@redhat.com> - 2.0.4-24
changelog:
  - add kdump-in-cluster-environment.txt to rpm pkg
  - Secure Boot status check warning
  - Some watchdog driver support


author: WANG Chao <chaowang@redhat.com> - 2.0.4-25
changelog:
  - Pass disable_cpu_apicid to kexec of capture kernel
  - Relax restriction of dumping on encrypted target
  - regression fix on wdt kernel drivers instal


author: WANG Chao <chaowang@redhat.com> - 2.0.6-1
changelog:
  - Rebase kexec-tools-2.0.6
  - fix an issue when dump path is mounted on nfs
  - vmcore-dmesg: stack smashing fix
  - get_ssh_size fix for localized df output


author: WANG Chao <chaowang@redhat.com> - 2.0.6-4
changelog:
  - generate kdump service dependencies on the fly
  - kdump.conf: a standalone path directive becomes a relative path to it's backed disk.


author: WANG Chao <chaowang@redhat.com> - 2.0.7-5
changelog:
  - rework of kdump error handling
  - add fadump support
  - add static route support
  - systemd will take care of shutdown and umount filesystems


author: WANG Chao <chaowang@redhat.com> - 2.0.7-8
changelog:
  - use absolute path for executable in systemd service
  - update to kdump-anaconda-addon-003
  - remove dead kdump firstboot module and po files


author: Baoquan He <bhe@redhat.com> - 2.0.7-9
changelog:
  - kdumpctl: Use kexec file based syscall for secureboot enabled machines
  - kdumpctl: Use kexec file based mode to unload kdump kernel
  - kdumpctl: Do not redirect error messages to /dev/null
  - kexec: Provide an option to use new kexec system call


author: WANG Chao <chaowang@redhat.com> - 2.0.7-10
changelog:
  - Enable ppc64le arch.
  - Rebase makedumpfile-1.5.7
  - add sample eppic scripts to kexec-tools-eppic package
  - Restart kdump service on cpu ADD/REMOVE events


author: WANG Chao <chaowang@redhat.com> - 2.0.8-5
changelog:
  - remove panic_on_warn kernel param in 2nd kernel
  - remove sysctl.conf to restore sysctl default values in 2nd kernel
  - fix a core_collector issue in ssh and raw dump case
  - update to kdump-anaconda-addon-005-2-g86366ae.tar.gz
  - some cleanups


author: WANG Chao <chaowang@redhat.com> - 2.0.8-6
changelog:
  - mount fail if its mount point doesn't exist in /sysroot
  - rebuild initrd dependency during kdump restart
  - fix a dump path issue


author: Dave Young <dyoung@redhat.com> - 2.0.8-8
changelog:
  - execute kdump_post after do_default_action
  - update kdump anaconda addon (translations/help text issus)


author: Baoquan He <bhe@redhat.com> -2.0.8-9
changelog:
  - Revert "execute kdump_post after do_default_action"
  - dracut-module-setup.sh: change the insecure use of /tmp/*$$* filenames
  - make kdump saving directory name consistent with RHEL6


author: Baoquan He <bhe@redhat.com> -2.0.8-10
changelog:
  - add fPIC to makefumpfile CFLAGS to support hardening
  - dracut-module-setup: Enhance kdump to support the bind mounted feature in Atomic
  - Fix the warning if the target path is bind mount in Atomic
  - Get the mount point correctly, if the device has several mount point
  - kdump-lib: Add new function to judge the system is Atomic or not
  - kdump-lib: Add the new function to enhance bind mounted judgement
  - Remove duplicate slash in save path


author: Baoquan He <bhe@redhat.com> -2.0.8-11
changelog:
  - make kdump work when kernel crash after shutdown
  - Disable transparent hugepages in second kernel
  - Filtered out "noauto" options in 2nd kernel fstab


author: Dave Young <dyoung@redhat.com> - 2.0.9-1
changelog:
  - Rebase kexec-tools 2.0.9
  - Rebase makedumpfile 1.5.8
  - revert 6347630 since ipv6 patches has not been reviewed.


author: Dave Young <dyoung@redhat.com> - 2.0.9-2
changelog:
  - Resolve bug 1236456, kexec load fail because koji add extra gcc flags.
  - Remove -FPIC for makedumpfile since it is not necessary without harden build


author: Dave Young <dyoung@redhat.com> - 2.0.10-1
changelog:
  - Rebase kexec-tools 2.0.10
  - Rebase eppic git tree 050615
  - Enhance kdump.conf "default" parameters check


author: Dave Young <dyoung@redhat.com> - 2.0.10-3
changelog:
  - Update kdump addon icon
  - Revert static route corner case patches per bhe. He discussed with Marc
    it is just a corner case.


author: Dave Young <dyoung@redhat.com> - 2.0.10-4
changelog:
  - ipv6 support (except for link scope addresses)
  - Apply the manual DNS to the 2nd kernel
  - load iTCO_wdt early in cmdline hook


author: Baoquan He <bhe@redhat.com> - 2.0.10-6
changelog:
  - mkdumprd: Remove ifcfg from dracut's modules
  - module-setup: Choose the first matched gateway in kdump_static_ip
  - module-setup: Add permanent option to detect static ip address or not


author: Dave Young <dyoung@redhat.com> - 2.0.11-3
changelog:
  - use "systemctl reboot -f" for reboot action
  - Remove kernel param "quiet" from kdump kernel cmdline
  - kdump.sysconfig: add KDUMP_COMMANDLINE_REMOVE
  - Add missing prefixes in default sysconfig file
  - fix bogus date in changelog


author: Dave Young <dyoung@redhat.com> - 2.0.12-4
changelog:
  - update kdump anaconda addon to add mem range in tui 
  - .gitignore: Update to make it more generic
  - kdumpctl: check_rebuild improvement 
  - kdumpctl: Do not rebuild initramfs when $KDUMP_BOOTDIR is read only


author: Dave Young <dyoung@redhat.com> - 2.0.12-5
changelog:
  - kdump-lib: Add get_ifcfg_filename() to get the proper ifcfg file
  - module-setup: Use get_ifcfg_filename() to get the proper ifcfg file


author: Dave Young <dyoung@redhat.com> - 2.0.12-9
changelog:
  - Update kdump anaconda addon
  - makedumpfile: Support _count -> _refcount rename in struct page
  - module-setup: Don't handle iBFT in kdump


author: Dave Young <dyoung@redhat.com> - 2.0.13-5
changelog:
  - Fix bug 1373958 for system boot without initrd
  - Do not depend on /etc/fstab in kdumpctl in case it does not exist


author: Dave Young <dyoung@redhat.com> - 2.0.13-8
changelog:
  - kexec/arch/i386: Add support for KASLR memory randomization
  - Update kdump anaconda addon
  - fadump: restore default initrd when fadump mode is disabled
  - kdump/fadump: fix network interface name when switching from fadump to kdump
  - kdumpctl: filter 'root' kernel parameter when running in live images
  - Documentation: step by step guide on confiuring kdump in live images


author: Dave Young <dyoung@redhat.com> - 2.0.13-9
changelog:
  - rename function kdump_to_udev_name
  - Raw dump: use by-id as persistent policy in 2nd kernel
  - drop dracut duplicate functions
  - dracut-kdump: use POSIX shell syntax
  - Correct two typos in kdumpctl and kdump.conf


author: Dave Young <dyoung@redhat.com> - 2.0.14-4
changelog:
  - drop kdump script rhcrashkernel-param in kexec-tools repo
  - kdumpctl: sanity check of nr_cpus for x86_64 in case running out of vectors
  - kdumpctl: change prepare_cmdline() to operate KDUMP_COMMANDLINE directly
  - use --hostonly-i18n for dracut


author: Dave Young <dyoung@redhat.com> - 2.0.14-5
changelog:
  - kdump-lib.sh: fix incorrect usage with pipe as input for grep -q in is_pcs_fence_kdump()
  - Document: fix incorrect link in fadump-how.txt


author: Dave Young <dyoung@redhat.com> - 2.0.14-7
changelog:
  - kdump-emergency: fix "Transaction is destructive" emergency failure
  - mkdumprd: reduce lvm2 memory under kdump


author: Dave Young <dyoung@redhat.com> - 2.0.14-8
changelog:
  - kdumpctl: fix status check when CONFIG_CRASH_DUMP is not enabled in kernel
  - kdumpctl: fix a bug in remove_cmdline_param()
  - kdumpctl: remove "root=X" for kdump boot
  - Revert "kdumpctl: filter 'root' kernel parameter when running in live images"


author: Dave Young <dyoung@redhat.com> - 2.0.14-9
changelog:
  - kdump: Introduce 'force_no_rebuild' option
  - kdump-lib-initramfs.sh: ignore the failure of echo
  - kdump.sysconfig/x86_64: Add nokaslr to kdump kernel cmdline


author: Dave Young <dyoung@redhat.com> - 2.0.14-10
changelog:
  - kdumpctl: improve "while read" time for /etc/kdump.conf
  - kdumpctl: update check_dump_fs_modified() to use "lsinitrd -f"
  - kdumpctl: improve check_wdt_modified()
  - kdumpctl: remove is_mode_switched()
  - kdumpctl: bail out earlier in case of no reserved memory


author: Dave Young <dyoung@redhat.com> - 2.0.14-11
changelog:
  - kdumpctl: change the shebang header to use /bin/bash
  - kdumpctl: call strip_comments only when necessary to speedup
  - Revert "kdumpctl: improve "while read" time for /etc/kdump.conf" (rhbz1449801)


author: Dave Young <dyoung@redhat.com> - 2.0.14-13
changelog:
  - kexec-tools.spec: Fix whitespace errors
  - dracut-module-setup: Fix test for inclusion of DRM modules
  - kdump.conf.5: clarify the fence_kdump_nodes option


author: Dave Young <dyoung@redhat.com> - 2.0.15-3
changelog:
  - module-setup: fix 99kdumpbase network dependency
  - mkdumprd: omit dracut modules in case of network dumping
  - mkdumprd: omit dracut modules in case of no dm target
  - mkdumprd: omit crypt when there is no crypt kdump target
  - kdumpctl: use generated rd.lvm.lv=X
  - mkdumprd: change for_each_block_target() to use get_kdump_targets()
  - kdump-lib.sh: introduce get_kdump_targets()
  - kdump-lib.sh: fix improper get_block_dump_target()
  - kdumpctl: fix infinite loop caused by running under bash


author: Dave Young <dyoung@redhat.com> - 2.0.15-10
changelog:
  - Improve 'cpu add' udev rules
  - module-setup: suppress the early iscsi error messages
  - mkdumprd: use 300s as the default systemd unit timeout for kdump mount


author: Dave Young <dyoung@redhat.com> - 2.0.15-13
changelog:
  - dracut-module-setup.sh: eliminate redundant kdump_get_mac_addr call
  - mkdumprd: use --quiet dracut argument to speedup initramfs build
  - mkdumprd: fix patterns to modify mount options
  - fadump: rebuild default initrd with dump capture capability
  - module-setup: remove software iscsi cmdline generated by dracut
  - kdumpctl: remove some cmdline inheritage from 1st kernel
  - mkdumprd: apply dracut "--hostonly-cmdline" and "--no-hostonly-default-device"
  - Change dump_to_rootfs to use "--mount" instead of "root=X"
  - kdumpctl: move is_fadump_capable() to kdump-lib.sh
  - Revert "kdumpctl: use generated rd.lvm.lv=X"
  - Revert "mkdumprd: omit crypt when there is no crypt kdump target"
  - Revert "mkdumprd: omit dracut modules in case of no dm target"
  - Revert "mkdumprd: omit dracut modules in case of network dumping"
  - update bogus date in rpm spec


author: Dave Young <dyoung@redhat.com> - 2.0.16-2
changelog:
  - dracut-module-setup.sh: check whether to include multipath-hostonly or not
  - Revert "kdumpctl: sanity check of nr_cpus for x86_64 in case running out of vectors"
  - kdumpctl: skip selinux-relabel for dracut_args --mount dump target


author: Dave Young <dyoung@redhat.com> - 2.0.16-6
changelog:
  - kdump.sysconfig.ppc64(le): remove "root=" param from ppc64(le) 2nd kernel
  - kdumpctl: Check the modification time of core_collector
  - dracut-module-setup.sh: pass correct ip= param for ipv6


author: Kairui Song <kasong@redhat.com> - 2.0.17-14
changelog:
  - Add support to supply 'kaslr-seed' to secondary kernel
  - kexec-tools.spec: Drop kexec-tools-2.0.3-disable-kexec-test.patch


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-16
changelog:
  - dracut-module-setup: Enable dracut squash module
  - dracut-module-setup: Fix DRM module inclusion test for hyper-v


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-17
changelog:
  - Update help text to indicate --mem-usage is supported on archs other than x86_64
  - Fix 'makedumpfile --split' error ("Can't read the buffer of struct page") on x86_64


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-19
changelog:
  - Add aarch64 specific kdump.sysconfig and use 'nr_cpus' instead of 'maxcpus'
  - Add missing usage info
  - Throttle kdump reload request triggered by udev event
  - Rewrite kdump's udev rules
  - kdumpctl: Add reload support


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-20
changelog:
  - makedumpfile: Fix failure of detection of SPARSEMEM EXTREME in case of -x VMLINUX
  - makedumpfile: ppc64: increase MAX_PHYSMEM_BITS to 128TB
  - kdumpctl: Rebuild initramfs if loaded kernel modules changed


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-21
changelog:
  - makedumpfile: Support newer kernels
  - kdump-lib-initramfs.sh: using -force option when poweroff
  - kexec-tools/vmcore-dmesg: fix infinite loop if log buffer wraps around
  - makedumpfile: sadump: fix failure of reading 640 KB backup region if at over 4GB location
  - Make udev reload rules quiet during bootup


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-24
changelog:
  - makedumpfile/arm64: Fix 'info->page_offset' calculation for both KASLR and non-KASLR cases
  - makedumpfile: Prepare paddr_to_vaddr() for arch-specific p2v conversion


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-26
changelog:
  - earlykdump: fix kexec fails to load the early kdump kernel
  - makedumpfile/x86_64: fix an unnecessary message with --mem-usage option


author: Pingfan Liu <piliu@redhat.com> - 2.0.17-27
changelog:
  - Revert "kdumpctl, earlykdump: Don't use kexec_file_load when secure boot is enabled"
  - mkdumprd: refine regex on dropping mount options


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-1
changelog:
  - kexec-tools: rebasing to 2.0.19
  - makedumpfile: upgrade to 1.6.5
  - kexec-tools: x86: Introduce a new option --reuse-video-type
  - makedumpfile: exclude pages that are logically offline
  - earlykdump: Fix failure when earlykdump is included by dracut
  - Update man page for new kdumpctl command: reload / rebuild
  - kdumpctl: add rebuild support
  - rhel-only/kexec.rules: create dedicated udev rules for ppc64


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-2
changelog:
  - kdumpctl: Detect block device driver change for initramfs rebuild
  - Revert "kdumpctl: Rebuild initramfs if loaded kernel modules changed"
  - mkdumprd: allow spaces after 'path' config phrase with network dump setting
  - kexec.rules: create dedicated udev rules for ppc64
  - Revert "rhel-only/kexec.rules: create dedicated udev rules for ppc64"
  - rh-only makedumpfile/arm64: Add support for ARMv8.2-LVA (52-bit user-space VA support)


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-3
changelog:
  - earlykdump: Add a note of final_action option to avoid crash loop
  - Add final_action option to kdump.conf
  - Add failure_action as alias of default and make default obsolete
  - earlykdump: warn when installed kernel version differs from dracut target
  - earlykdump: add more sanity check when generating initramfs
  - fadump: use the original initrd to rebuild fadump initrdfrom


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-4
changelog:
  - kexec-kdump-howto.txt: Add document about encrypted targets
  - kexec-kdump-howto.txt: Add document about initramfs rebiuld
  - kexec-kdump-howto: Add note on setting correct value of kptr_restrict
  - doc: fix dead links in the file kexec-kdump-howto.txt
  - earlykdump: provide a prompt message after the rebuilding of kdump initramfs.
  - Get rid of duplicated strip_comments when reading config
  - mkdumprd: Improve the config reading logic
  - kdumpctl: don't always rebuild when extra_modules is set
  - kdumpctl: follow symlink when checking for modified files
  - fadump: leverage kernel support to re-regisgter FADump


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-5
changelog:
  - kdumpctl: check for ssh path availability when rebuild
  - kdumpctl: Check kdump.conf for error when rebuild is called
  - makedumpfile: x86_64: Add support for AMD Secure Memory Encryption
  - aarch64/kdump.sysconfig: Make config options similar to x86_64


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-9
changelog:
  - kexec/arm64: Add support for handling zlib compressed (Image.gz) image
  - kexec/kexec-zlib.h: Add 'is_zlib_file()' helper function
  - kexec-uImage-arm64.c: Fix return value of uImage_arm64_probe()
  - kexec/kexec.c: Add the missing close() for fd used for kexec_file_load()


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-12.3
changelog:
  - Limit the size of vmcore-dmesg.txt to 2G
  - makedumpfile: x86_64: Fix incorrect exclusion by -e option with KASLR
  - mkdumprd: ensure ssh path exists before check size


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-12.4
changelog:
  - dracut-module-setup.sh: Don't use squash module for fadump
  - Don't mount the dump target unless needed
  - dracut-module-setup: fix bond ifcfg processing
  - Doc: amend the man page of kdump.conf


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-5
changelog:
  - Don't execute final_action if failure_action terminates the system
  - module-setup: re-fix 99kdumpbase network dependency
  - kdumpctl: bail out immediately if host key verification failed
  - kdumpctl: echo msg when waiting for connection
  - kdumpctl: distinguish the failed reason of ssh
  - kdumpctl: wait a while for network ready if dump target is ssh
  - dracut-module-setup: filter out localhost for generic_fence_kdump
  - dracut-module-setup: get localhost alias by manual


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-6
changelog:
  -rhel-8.2.0, origin/rhel-8.2.0) Increase SECTION_MAP_LAST_BIT to 4
  - spec: move binaries from /sbin to /usr/sbin
  - As /etc/kdump.conf timestamp is updated do not compare it when doing rpm --verify
  - kdumpctl: make reload fail proof


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-10
changelog:
  - arm64: kdump: deal with a lot of resource entries in /proc/iomem
  - arm64: kexec: allocate memory space avoiding reserved regions
  - kexec: add variant helper functions for handling memory regions


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-19
changelog:
  - dracut-module-setup.sh: improve get_alias()
  - fadump: update fadump-howto.txt with some troubleshooting help
  - Append both nofail and x-systemd.before to kdump mount target
  - Partially Revert "Don't mount the dump target unless needed"
  - Don't unmount the dump target just after saving vmcore


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-20
changelog:
  - Update docs for the new noauto dump target support
  - kexec-kdump-howto.txt: Add some format to the document
  - mkdumprd: generate usable kdump initramfs even target is not mounted
  - Use get_mount_info to replace findmnt calls
  - kdump-lib.sh: add fstab failback helper for getting mount info
  - Allow calling mkdumprd from kdumpctl even if targat not mounted
  - Add a is_mounted helper
  - Introduce get_kdump_mntpoint_from_target and fix duplicated /
  - Doc: Improves the early-kdump-howto.txt document in several points
  - Doc: Add --force option to step 2 in early-kdump-howto.txt
  - Doc: Fix typo in early-kdump-howto.txt
  - Remove adjust_bind_mount_path call
  - No longer treat atomic/silverblue specially
  - mkdumprd: Simplify handling of user specified target
  - mkdumprd: Use get_save_path instead of parsing config
  - Remove is_dump_target_configured
  - Always use get_save_path to get the 'path' option
  - kdump-lib: Don't abuse echo, and clean up
  - mkdumprd: Fix dracut args parsing
  - mkdumprd: simplify dracut args parsing


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-21
changelog:
  - Don't inherit swiotlb parameter form 1st kernel by default
  - Add a new option 'rd.znet_ifname' in order to use it in udev rules
  - kdump.sysconfig: Remove the option 'log_buf_len' from kdump command line
  - kdump-error-handler.service: Remove ExecStopPost
  - module-setup.sh: Add "rd.neednet" parameter if network is needed


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-25
changelog:
  - kdump.conf: Specify /etc/kdump/{pre.d,post.d}interface
  - dracut-kdump.sh: Execute the binary and script filesin /etc/kdump/{pre.d,post.d}
  - kdumpctl: Check the update of the binary and script files in /etc/kdump/{pre.d,post.d}
  - dracut-module-setup.sh: Install files under /etc/kdump/{pre.d,post.d} into kdump initramfs


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-26
changelog:
  - Fix kdump failure when mount target specified by dracut_args
  - mkdumprd: Fix dracut error on multiple extra_modules


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-28
changelog:
  - mkdumprd: Fix nfs detection in to_mount
  - Always wrap up call to dracut get_persistent_dev function
  - man: improve description about /etc/kdump/{pre.d,post.d}interface


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-30
changelog:
  - x86_64: enable the kexec file load by default
  - Revert "kdump-lib: switch to the kexec_file_load() syscall on x86_64 by default"


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-31
changelog:
  - ppc64/kdump: use kexec_file_load when secureboot is enabled
  - kdump_pre: make notes more precise
  - dracut-kdump.sh: exit shell when machine reboot
  - kdump.conf: fix a grammar issue
  - kdumpctl: detect modification of scripts by its directory's timestamp
  - module-setup.sh: suppress false alarm
  - kexec-tools.spec: make the existence of pre.d and post.d mandatory


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-35
changelog:
  - module-setup.sh: Instead of drop journalctl log, just don't read kmsg
  - s390x: enable the kexec file load by default
  - increase makdumpfile default message level to 7
  - Rework check_config and warn on any duplicated option
  - kdumpctl: Error out if path is set more than once.
  - Don't drop journalctl content if failure action is "shell"
  - dracut-module-install: Move systemd conf install code to a function
  - kdump-lib.sh: Remove is_atomic
  - Refactor kernel image and initrd detection code
  - early-kdump: Use consistent symbol link for kernel and initramfs
  - kdump-lib: strip grub device from kdump_bootdir
  - kdumpctl: fix driver change detection on latest Fedora
  - Revert "kdump-lib: disable efifb if hyperv_fb is in use"
  - kdump-lib.sh: detect secure boot on s390
  - Add a kernel install hook to clean up kdump initramfs


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-36
changelog:
  - arm64: Enable 'kexec_file_load' by default
  - Fix, Add a kernel install hook to clean up kdump initramfs


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-37
changelog:
  - Doc: improve the usage documentation of the logger
  - Update the kdump sysconfig
  - Capitalize the configuration name of log level
  - Add the rd.kdumploglvl option to control log level in the second kernel
  - Appropriately converts logger numeric level to syslog log level
  - Remove unused log levels for kdump logger
  - Add sanity checks for the log levels
  - Add code comments to help better understanding
  - Doc: add a documentation for the usage of logger
  - Improve debugging in the kdump kernel
  - kdumpctl: add the '-d' option to enable the kexec loading debugging messages
  - kdump.sysconfig: add the kdump logger configurations
  - enable the logger for kdump
  - introduce the kdump logger from the dracut


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-38
changelog:
  - Don's try to restart dracut-initqueue if it's already failed
  - fadump-howto: update about 'nocma' and 'off' options for 'fadump=' parameter
  - dracut-module-setup.sh: use auto6 for ipv6
  - module-setup.sh: enable vlan on team interface
  - Fix rootfs detection in dump_fs
  - Remove RHEL-only patch: kexec-tools-2.0.18-makedumpfile-arm64-Add-support-for-ARMv8.2-LVA-52-bi.patch
  - Rebase to makedumpfile-1.6.8 (step1)


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-43
changelog:
  - Always include watchdog-modules
  - mkdumprd: Ensure kdumpbase is added
  - Move watchdog detect and install code to module-setup.sh
  - Add a helper to omit non-mandatory dracut module
  - Move some dracut module dependencies checks to module-setup.sh
  - Set watchdog's pretimeout to zero in kdump kernel
  - kdump-lib.sh: Use a more generic helper to detect omitted dracut module
  - Fix the watchdog drivers detection code
  - Add a helper for detecting watchdog drivers
  - Remove a redundant nfs check
  - kdumpctl: split the driver detection from fs dection function
  - kdump.service: use ConditionKernelCommandLine=crashkernel
  - Revert "Append both nofail and x-systemd.before to kdump mount target"
  - Revert "Don's try to restart dracut-initqueue if it's already failed"
  - Fix dump_fs mount point detection and fallback mount
  - kdump.conf: Update doc about core_collector for ssh target
  - Save the final failure information to log file if saving vmcore failed
  - Doc: Improve the kdump sysconfig document
  - kdumpctl: fix a variable expansion in check_fence_kdump_config()
  - Fedora 33 rhpkg build bug


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-44
changelog:
  - module-setup.sh: don't polute the namespace unnecessarily
  - module-setup.sh: don't source $dracutfunctions
  - logger: source the logger file individually
  - dracut-module-setup.sh: enable ForwardToConsole=yes in fadump mode


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-45
changelog:
  - origin/rhel-8.4.0) Revert "Revert "Append both nofail and x-systemd.before to kdump mount target""
  - kdump.conf: add ipv6 example for nfs and ssh dump
  - fix kdump failure of saving vmcore with the scp + ipv6 method


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-47
changelog:
  - Implement IP netmask calculation to replace "ipcalc -m"
  - kdumpctl: fix check_config error when kdump.conf is empty
  - Fix incorrect vmcore permissions when dumped through ssh
  - Fix incorrect permissions on kdump dmesg file


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-48
changelog:
  - kdumpctl: Add kdumpctl estimate
  - mkdumprd: make use of the new get_luks_crypt_dev helper
  - kdump-lib.sh: introduce a helper to get all crypt dev used by kdump
  - kdump-lib.sh: introduce a helper to get underlying crypt device
  - RHEL-only: keep total memory size coherent to RHEL-only kernel patch
  - Show write byte size in report messages
  - Add shorthand --show-stats option to show report stats
  - Add --dry-run option to prevent writing the dumpfile
  - kdump-lib.sh: introduce functions to return recommened mem size


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-50
changelog:
  - rd.route should use the name from kdump_setup_ifname
  - get kdump ifname once in kdump_install_netdev


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-51
changelog:
  - Stop reloading kdump service on CPU hotplug event for FADump
  - fadump: improve fadump-howto.txt about remote dump target setup


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-52
changelog:
  - Write to `/var/lib/kdump` if $KDUMP_BOOTDIR not writable
  - Iterate /sys/bus/ccwgroup/devices to tell if we should set up rd.znet
  - mkdumprd: display the absolute path of dump location in the check_user_configured_target()


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-53
changelog:
  - check for invalid physical address of /proc/kcore when making ELF dumpfile
  - check for invalid physical address of /proc/kcore when finding max_paddr
  - fix format issue in find_online_znet_device
  - check the existence of /sys/bus/ccwgroup/devices before trying to find online network device
  - kdump-lib.sh: fix a warning in prepare_kdump_bootinfo()


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-54
changelog:
  - kdump/ppc64: rebuild initramfs image after migration
  - Check the existence of /sys/bus/ccwgroup/devices/*/online beforehand
  - kdump.sysconfig.s390: Remove "prot_virt" from kdump kernel cmdline


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-59
changelog:
  - makedumpfile: printk: use committed/finalized state values
  - makedumpfile: printk: add support for lockless ringbuffer
  - kexec-tools: printk: Use %zu to format size_t
  - kexec-tools: printk: Use ULL suffix for 64-bit constants
  - kexec-tools: printk: add support for lockless ringbuffer


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-60
changelog:
  - fadump-init: clean up mount points properly
  - fadump: kdumpctl should check the modules used by the fadump initramfs
  - fadump: isolate fadump initramfs image within the default one
  - mkdumprd: Use xz for squash image compression


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-66
changelog:
  - kdump/ppc64: suppress the error message "Could not find a registered notification tool" from servicelog_notify
  - Enable zstd compression for makedumpfile in kexec-tools.spec


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-69
changelog:
  - s390: add support for --reuse-cmdline
  - use slurp_proc_file() in get_command_line()
  - add slurp_proc_file()
  - s390: use KEXEC_ALL_OPTIONS
  - s390: add variable command line size
  - util_lib/elf_info: harden parsing of printk buffer
  - print error when reading with unsupported compression
  - use cycle detection when parsing the prink log_buf
  - use pointer arithmetics for dump_dmesg
  - add generic cycle detection


author: Pingfan Liu <piliu@redhat.com> - 2.0.24-1
changelog:
  - kdumpctl: sync the $TARGET_INITRD after rebuild
  - Avoid false-positive mem_section validation with vmlinux
  - Rebase kexec-tools to 2.0.24
  - Rebase makedumpfile to 1.7.1


author: Pingfan Liu <piliu@redhat.com> - 2.0.24-6
changelog:
  - kdump-lib: Add the CoreOS kernel dir to the boot_dirlist
  - kdump-lib: attempt to fix BOOT_IMAGE detection
  - kdump-lib: change how ostree based systems are detected
  - kdump-lib: clear up references to Atomic/CoreOS


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-2
changelog:
  - mkdumprd: Improve error messages on non-existing NFS target directories
  - fadump: avoid non-debug kernel use for fadump case


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-3
changelog:
  - kdump.conf: use a simple generator script to maintain
  - Reduce kdump memory consumption by not letting NetworkManager manage unneeded network interfaces


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-4
changelog:
  - Don't check fs modified when dump target is lvm2 thinp
  - Add dependency of dracut lvmthinpool-monitor module
  - lvm.conf should be check modified if lvm2 thinp enabled
  - Add lvm2 thin provision dump target checker
  - Fix the sync issue for dump_fs


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-5
changelog:
  - dracut-module-setup: Fix invalid rd.znet command line entry
  - dracut-module-setup: Fix persistent nic name on s390


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-6
changelog:
  - dracut-module-setup.sh: skip installing driver for the loopback interface
  - Reduce kdump memory consumption by only installing needed NIC drivers


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-8
changelog:
  - mkdumprd: Use the correct syntax to redirect the stderr to null
  - mkdumprd: call dracut with --add-device to install the drivers needed by /boot partition automatically for FIPS
  - Add NICs that handle DNS queries to the allowlist


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-11
changelog:
  - powerpc: update kdumpctl to load kernel signing key for fadump
  - powerpc: update kdumpctl to remove deletion of kernel signing key once loaded


author: Pingfan Liu <piliu@redhat.com> - 2.0.26-13
changelog:
  - dracut-module-setup.sh: also install the driver of physical NIC for Hyper-V VM with accelerated networking


author: Youling Tang <tangyouling@loongson.cn> - 2.0.26-14.0.1.1
changelog:
  - Add LoongArch support
  - Add doc sub package (wb-zh951434@alibaba-inc.com)
  - Fix kexec error for kexec -s (xiangzao@linux.alibaba.com)
  - Reimplement loongarch64 support
  - Add pstore segment (xiangzao@linux.alibaba.com)
  - Fix loongarch kexec issue cause by pstore segment. (wangming01@loongson.cn)
  - Fix loongarch build faild issue. (wangming01@loongson.cn)


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-16
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1778889


author: Jon Masters <jcm@jonmasters.org> - 2-3
changelog:
  - Update package incorporating fixes from initial review feedback
  - Cleaups to SPEC, rpath, documentation, library and binary locations


author: Jon Masters <jcm@jonmasters.org> - 3-1
changelog:
  - Update to latest upstream (adds new depmod replacement utility)
  - For the moment, use the "kmod" utility to test the various functions


author: Kay Sievers <kay@redhat.com> - 5-1
changelog:
  - Update to version 5
  - replace the module-init-tools package and provide all tools
    as compatibility symlinks


author: Kay Sievers <kay@redhat.com> - 5-3
changelog:
  - temporarily add fake-provides to be able to bootstrap
    the new udev which pulls the old udev into the buildroot


author: Harald Hoyer <harald@redhat.com> 5-6
changelog:
  - add upstream patch to fix "modprobe --ignore-install --show-depends"
    otherwise dracut misses a lot of modules, which are already loaded


author: Kay Sievers <kay@redhat.com> - 7-1
changelog:
  - update to version 7
    - fix issue with --show-depends, where built-in
      modules of the running kernel fail to include
      loadable modules of the kernel specified


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-5
changelog:
  - weak-modules: handle versions with + and other special regex symbols
  - weak-modules: fix misleading message when cannot find dracut.
    Resolves: rhbz#1609372.


author: Eugene Syromiatnikov <esyr@redhat.com> - 25-6
changelog:
  - weak-modules: check also for /lib/modules/$krel/symvers.gz as a possible
    symvers file path.
    Resolves: rhbz#1614119.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-7
changelog:
  - weak-modules: use is_kernel_installed wrapper in update_modules_for_krel.
  - weak-modules: more abstract symvers search implementation.
  - weak-modules: use additional paths for System.map file.
    Resolves: rhbz#1621306.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-8
changelog:
  - weak-modules: fix initial state creation for dry-run
  - weak-modules: check compatibility in a temporary directory
    Resolves: rhbz#1622990.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-10
changelog:
  - weak-modules: group modules on add-kernel
  - weak-modules: do not make groups if there are no extra modules
    Resolves: rhbz#1649211


author: Julien Rische <jrische@redhat.com> - 1.18.2-21
changelog:
  - Backport fix of memory use after free during libkrad cleanup
  - Backport support for larger RADIUS attributes in libkrad
  - Resolves: rhbz#2103125


author: Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
changelog:
  - started changelog (previous package from zedz.net)
  - updated existing 1.0.5 RPM from Eos Linux to krb5 1.0.6
  - added --force to makeinfo commands to skip errors during build


author: Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
changelog:
  - backed out ncurses and makeshlib patches
  - update for krb5-1.1
  - add KDC rotation to rc.boot, based on ideas from Michael's C version


author: Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
changelog:
  - clean up init script for server, verify that it works [jlkatz]
  - clean up rotation script so that rc likes it better
  - add clean stanza


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch around TIOCGTLC defined on alpha and remove warnings from libpty.h
  - add installation of info docs
  - remove krb4 compat patch because it doesn't fix workstation-side servers


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak server init script to automatically extract kadm5 keys if
    /var/kerberos/krb5kdc/kadm5.keytab doesn't exist yet
  - adjust package descriptions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - apply Mike Friedman's patch to fix format string problems
  - don't strip off argv[0] when invoking regular rsh/rlogin


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Correct copyright: it's exportable now, provided the proper paperwork is
    filed with the government.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't enable the server by default.
  - Compress info pages.
  - Add defaults for the PAM module to krb5.conf


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge krb5-configs back into krb5-libs.  The krb5.conf file is marked as
    a %config file anyway.
  - Make krb5.conf a noreplace config file.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653)
  - change Requires: for/in subpackages to include %{version}


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch ksu man page because the -C option never works
  - add access() checks and disable debug mode in ksu
  - modify default ksu build arguments to specify more directories in CMD_PATH
    and to use getusershell()


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix double-free in the kdc (patch merged into MIT tree)
  - include convert-config-files script as a documentation file


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove setuid bit on v4rcp and ksu in case the checks previously added
    don't close all of the problems in ksu
  - apply patches from Jeffrey Schiller to fix overruns Chris Evans found
  - reintroduce configs subpackage for use in the errata
  - add PreReq: sh-utils


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change a LINE_MAX to 1024, fix from Ken Raeburn
  - add fix for login vulnerability in case anyone rebuilds without krb4 compat
  - add tweaks for byte-swapping macros in krb.h, also from Ken
  - add xinetd config files
  - make rsh and rlogin quieter
  - build with debug to fix credential forwarding
  - add rsh as a build-time req because the configure scripts look for it to
    determine paths


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - use %{_infodir} to better comply with FHS
  - move .so files to -devel subpackage
  - tweak xinetd config files (bugs #11833, #11835, #11836, #11840)
  - fix package descriptions again


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - apply second set of buffer overflow fixes from Tom Yu
  - fix from Dirk Husung for a bug in buffer cleanups in the test suite
  - work around possibly broken rev binary in running test suite
  - move default realm configs from /var/kerberos to %{_var}/kerberos


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - patch mkdir/rmdir problem in ftpcmd.y
  - add condrestart option to init script
  - split the server init script into three pieces and add one for kpropd


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to the 1.2 release
  - ditch a lot of our patches which went upstream
  - enable use of DNS to look up things at build-time
  - disable use of DNS to look up things at run-time in default krb5.conf
  - change ownership of the convert-config-files script to root.root
  - compress PS docs
  - fix some typos in the kinit man page
  - run condrestart in server post, and shut down in preun


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Tom Yu's patch to fix compatibility between 1.2 kadmin and 1.1.1 kadmind
  - pull out 6.2 options in the spec file (sonames changing in 1.2 means it's not
    compatible with other stuff in 6.2, so no need)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.1
  - back out Tom Yu's patch, which is a big chunk of the 1.2 -> 1.2.1 update
  - start using the official source tarball instead of its contents


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move condrestarts to postun
  - make xinetd configs noreplace
  - add descriptions to xinetd configs
  - add /etc/init.d as a prereq for the -server package
  - patch to properly truncate $TERM in krlogind


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable servers by default to keep linuxconf from thinking they need to be
    started when they don't


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix summaries and descriptions
  - switched the default transfer protocol from PORT to PASV as proposed on
    bugzilla (#16134), and to match the regular ftp package's behavior


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix credential forwarding problem in klogind (goof in KRB5CCNAME handling)
    (#11588)
  - fix heap corruption bug in FTP client (#14301)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make krb5-libs obsolete the old krb5-configs package (#18351)
  - don't quit from the kpropd init script if there's no principal database so
    that you can propagate the first time without running kpropd manually
  - don't complain if /etc/ld.so.conf doesn't exist in the -libs %post


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix krb5-send-pr (#18932) and move it from -server to -workstation
  - buildprereq libtermcap-devel
  - temporariliy disable optimization on alphas
  - gettextize init scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.2, which fixes some bugs relating to empty ETYPE-INFO
  - re-enable optimization on Alpha


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add patch to support "ANY" keytab type (i.e.,
    "default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab"
    patch from Gerald Britton, #42551)
  - build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697)
  - patch ftpd to use long long and %lld format specifiers to support the SIZE
    command on large files (also #30697)
  - don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965)
  - implement reload in krb5kdc and kadmind init scripts (#41911)
  - lose the krb5server init script (not using it any more)


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.2-14
changelog:
  - rename the krb5-libs package to krb5 (naming a subpackage -libs when there
    is no main package is silly)
  - move defaults for PAM to the appdefaults section of krb5.conf -- this is
    the area where the krb5_appdefault_* functions look for settings)
  - disable statglue (warning: breaks binary compatibility with previous
    packages, but has to be broken at some point to work correctly with
    unpatched versions built with newer versions of glibc)


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.3-1
changelog:
  - rename the krb5 package back to krb5-libs; the previous rename caused
    something of an uproar
  - update to 1.2.3, which includes the FTP and telnetd fixes
  - configure without --enable-dns-for-kdc --enable-dns-for-realm, which now set
    the default behavior instead of enabling the feature (the feature is enabled
    by --enable-dns, which we still use)
  - reenable optimizations on Alpha
  - support more encryption types in the default kdc.conf (heads-up from post
    to comp.protocols.kerberos by Jason Heiss)


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.6-2
changelog:
  - remove hashless key types from the default kdc.conf, they're not supposed to
    be there, noted by Sam Hartman on krbdev


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - install src/krb524/README as README.krb524 in the -servers package,
    includes information about converting for AFS principals


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - increase the maximum name length allowed by kuserok() to the higher value
    used in development versions


author: Jakub Jelinek <jakub@redhat.com> 1.2.7-2
changelog:
  - always #include <errno.h> to access errno, never do it directly
  - enable LFS on a bunch of other 32-bit arches


author: Nalin Dahyabhai <nalin@redhat.com> 1.3-0.beta.4
changelog:
  - test update to 1.3 beta 4
  - ditch statglue build option
  - krb5-devel requires e2fsprogs-devel, which now provides libss and libcom_err


author: Nalin Dahyabhai <nalin@redhat.com> 1.3-2
changelog:
  - pull fix for non-compliant encoding of salt field in etype-info2 preauth
    data from 1.3.1 beta 1, until 1.3.1 is released.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add more etypes (arcfour) to the default enctype list in kdc.conf
  - don't apply previous patch, refused upstream


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-5
changelog:
  - include profile.d scriptlets in krb5-devel so that krb5-config will be in
    the path if krb5-workstation isn't installed, reported by Kir Kolyshkin


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-6
changelog:
  - fix bug in patch to make rlogind start login with a clean environment a la
    netkit rlogin, spotted and fixed by Scott McClung


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-8
changelog:
  - when iterating over lists of interfaces which are "up" from getifaddrs(),
    skip over those which have no address (#113347)


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.1-9
changelog:
  - remove patch to set TERM in klogind which, combined with the upstream fix in
    1.3.1, actually produces the bug now (#114762)


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.3-2
changelog:
  - re-enable large file support, fell out in 1.3-1
  - patch rcp to use long long and %lld format specifiers when reporting file
    sizes on large files


author: Nalin Dahyabhai <nalin@redhat.com> 1.3.4-3
changelog:
  - incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
    (MITKRB5-SA-2004-002, #130732)
  - incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of
    supported keytypes in kdc.conf -- they produce exactly the same keys as
    rc4-hmac:normal because rc4 string-to-key ignores salts
  - nuke kdcrotate -- there are better ways to balance the load on KDCs, and
    the SELinux policy for it would have been scary-looking
  - update to 1.3.5, mainly to include MITKRB5SA 2004-002 and 2004-003


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - silence compiler warning in kprop by using an in-memory ccache with a fixed
    name instead of an on-disk ccache with a name generated by tmpnam()


author: Nalin Dahyabhai <nalin@redhat.com> 1.4-1
changelog:
  - update to 1.4
    - v1.4 kadmin client requires a v1.4 kadmind on the server, or use the "-O"
      flag to specify that it should communicate with the server using the older
      protocol
    - new libkrb5support library
    - v5passwdd and kadmind4 are gone
    - versioned symbols
  - pick up $KRB5KDC_ARGS from /etc/sysconfig/krb5kdc, if it exists, and pass
    it on to krb5kdc
  - pick up $KADMIND_ARGS from /etc/sysconfig/kadmin, if it exists, and pass
    it on to kadmind
  - pick up $KRB524D_ARGS from /etc/sysconfig/krb524, if it exists, and pass
    it on to krb524d *instead of* "-m"
  - set "forwardable" in [libdefaults] in the default krb5.conf to match the
    default setting which we supply for pam_krb5
  - set a default of 24h for "ticket_lifetime" in [libdefaults], reflecting the
    compiled-in default


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add draft fix from Tom Yu for slc_add_reply() buffer overflow (CAN-2005-0469)
  - add draft fix from Tom Yu for env_opt_add() buffer overflow (CAN-2005-0468)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-1
changelog:
  - update to 1.4.1, incorporating fixes for CAN-2005-0468 and CAN-2005-0469
  - when starting the KDC or kadmind, if KRB5REALM is set via the /etc/sysconfig
    file for the service, pass it as an argument for the -r flag


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-3
changelog:
  - prevent spurious EBADF in krshd when stdin is closed by the client while
    the command is running (#151111)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-4
changelog:
  - fix double-close in keytab handling
  - add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175)
    (#157104)
  - apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-5
changelog:
  - fix telnet client environment variable disclosure the same way NetKit's
    telnet client did (CAN-2005-0488) (#159305)
  - keep apps which call krb5_principal_compare() or krb5_realm_compare() with
    malformed or NULL principal structures from crashing outright (Thomas Biege)
    (#161475)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.2-2
changelog:
  - change the default configured encryption type for KDC databases to the
    compiled-in default of des3-hmac-sha1 (#57847)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.2-3
changelog:
  - add an xinetd configuration file for encryption-only telnetd, parallelling
    the kshell/ekshell pair (#167535)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - login: don't truncate passwords before passing them into crypt(), in
    case they're significant (#149476)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-3
changelog:
  - rebuild properly when pthread_mutexattr_setrobust_np() is defined but not
    declared, such as with recent glibc when _GNU_SOURCE isn't being used


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-4
changelog:
  - give a little bit more information to the user when kinit gets the catch-all
    I/O error (#180175)


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-6
changelog:
  - adjust the patch which removes the use of rpath to also produce a
    krb5-config which is okay in multilib environments (#190118)
  - make the name-of-the-tempfile comment which compile_et adds to error code
    headers always list the same file to avoid conflicts on multilib installations
  - strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes
  - strip GSS_SIZEOF_LONG out of gssapi.h so that it doesn't conflict on mulitlib
    boxes


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.3-7
changelog:
  - further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit
    architectures, to avoid multilib conflicts; other changes will conspire to
    strip out the -L flag which uses this, so it should be harmless (#192692)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-4
changelog:
  - ensure that the gssapi library's been initialized before walking the
    internal mechanism list in gss_release_oid(), needed if called from
    gss_release_name() right after a gss_import_name() (#198092)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-10
changelog:
  - rename krb5.sh and krb5.csh so that they don't overlap (#210623)
  - way-late application of added error info in kadmind.init (#65853)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-11
changelog:
  - don't bail from the KDC init script if there's no database, it may be in
    a different location than the default (fenlason)
  - remove the [kdc] section from the default krb5.conf -- doesn't seem to have
    been applicable for a while


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update backport of the preauth module interface
  - add proposed patches 4566, 4567
  - add proposed edata reporting interface for KDC
  - add temporary placeholder for module global context fixes


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-14
changelog:
  - apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456)
  - apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-18
changelog:
  - make use of install-info more failsafe (Ville Skyttä, #223704)
  - preserve timestamps on shell scriptlets at %install-time


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - initial update to 1.6, pre-package-reorg
  - move workstation daemons to a new subpackage (#81836, #216356, #217301), and
    make the new subpackage require xinetd (#211885)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.5-20
changelog:
  - temporarily back out %post changes, fix for #143289 for security update
  - add preliminary patch to correct unauthorized access via krb5-aware telnet


author: Nalin Dahyabhai <nalin@redhat.com> 1.5-22
changelog:
  * Thu Mar 15 2007 Nalin Dahyabhai <nalin@redhat.com> 1.5-21
  - add preliminary patch to fix buffer overflow in krb5kdc and kadmind
    (#231528, CVE-2007-0957)
  - add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-2
changelog:
  - add buildrequires: on keyutils-libs-devel to enable use of keyring ccaches,
    dragging keyutils-libs in as a dependency


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-3
changelog:
  - add patch to correct unauthorized access via krb5-aware telnet
    daemon (#229782, CVE-2007-0956)
  - add patch to fix buffer overflow in krb5kdc and kadmind
    (#231528, CVE-2007-0957)
  - add patch to fix double-free in kadmind (#231537, CVE-2007-1216)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move the default acl_file, dict_file, and admin_keytab settings to
    the part of the default/example kdc.conf where they'll actually have
    an effect (#236417)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-4
changelog:
  - fix an uninitialized length value which could cause a crash when parsing
    key data coming from a directory server
  - correct a typo in the krb5.conf man page ("ldap_server"->"ldap_servers")


author: Nalin Dahyabhai <nalin@redhat.com> 1.6-6
changelog:
  - omit dependent libraries from the krb5-config --libs output, as using
    shared libraries (no more static libraries) makes them unnecessary and
    they're not part of the libkrb5 interface (patch by Rex Dieter, #240220)
    (strips out libkeyutils, libresolv, libdl)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - kadmind.init: don't fail outright if the default principal database
    isn't there if it looks like we might be using the kldap plugin
  - kadmind.init: attempt to extract the key for the host-specific kadmin
    service when we try to create the keytab


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-1
changelog:
  - update to 1.6.1
    - drop no-longer-needed patches for CVE-2007-0956,CVE-2007-0957,CVE-2007-1216
    - drop patch for sendto bug in 1.6, fixed in 1.6.1


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-2
changelog:
  - pull patch from svn to undo unintentional chattiness in ftp
  - pull patch from svn to handle NULL krb5_get_init_creds_opt structures
    better in a couple of places where they're expected


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - switch man pages to being generated with the right paths in them
  - drop old, incomplete SELinux patch
  - add patch from Greg Hudson to make srvtab routines report missing-file errors
    at same point that keytab routines do (#241805)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - preprocess kerberos.ldif into a format FDS will like better, and include
    that as a doc file as well


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - perform PAM account / session management in krshd (#182195,#195922)
  - perform PAM authentication and account / session management in ftpd
  - perform PAM authentication, account / session management, and password-
    changing in login.krb5 (#182195,#195922)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-8
changelog:
  - incorporate fixes for MITKRB5-SA-2007-004 (CVE-2007-2442,CVE-2007-2443)
    and MITKRB5-SA-2007-005 (CVE-2007-2798)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.2-6
changelog:
  - incorporate updated fix for CVE-2007-3999 (CVE-2007-4743)
  - fix incorrect call to "test" in the kadmin init script (#252322,#287291)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.2-7
changelog:
  - also perform PAM session and credential management when ftpd accepts a
    client using strong authentication, missed earlier
  - also label kadmind log files and files created by the db2 plugin


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.2-9
changelog:
  - apply the fix for CVE-2007-4000 instead of the experimental patch for
    setting ok-as-delegate flags


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make krb5.conf %verify(not md5 size mtime) in addition to
    %config(noreplace), like /etc/nsswitch.conf (#329811)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-1
changelog:
  - update to 1.6.3, dropping now-integrated patches for CVE-2007-3999
    and CVE-2007-4000 (the new pkinit module is built conditionally and goes
    into the -pkinit-openssl package, at least for now, to make a buildreq
    loop with openssl avoidable)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-3
changelog:
  - allocate space for the nul-terminator in the local pathname when looking up
    a file context, and properly free a previous context (Jose Plans, #426085)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-4
changelog:
  - some init script cleanups
    - drop unquoted check and silent exit for "$NETWORKING" (#426852, #242502)
    - krb524: don't barf on missing database if it looks like we're using kldap,
      same as for kadmin
    - return non-zero status for missing files which cause startup to
      fail (#242502)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-5
changelog:
  - enable patch for key-expiration reporting
  - enable patch to make kpasswd fall back to TCP if UDP fails (#251206)
  - enable patch to make kpasswd use the right sequence number on retransmit
  - enable patch to allow mech-specific creds delegated under spnego to be found
    when searching for creds


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-7
changelog:
  - drop netdb patch
  - kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that
    the DISALLOW_ALL_TIX flag is set on an entry, for better interop with Fedora,
    Netscape, Red Hat Directory Server (Simo Sorce)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - in login, allow PAM to interact with the user when they've been strongly
    authenticated
  - in login, signal PAM when we're changing an expired password that it's an
    expired password, so that when cracklib flags a password as being weak it's
    treated as an error even if we're running as root


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove a patch, to fix problems with interfaces which are "up" but which
    have no address assigned, which conflicted with a different fix for the same
    problem in 1.5 (#200979)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add patch to suppress double-processing of /etc/krb5.conf when we build
    with --sysconfdir=/etc, thereby suppressing double-logging (#231147)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-8
changelog:
  - ftp: add patch to fix "runique on" case when globbing fixes applied
  - stop adding a redundant but harmless call to initialize the gssapi internals


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-9
changelog:
  - rework file labeling patch to not depend on fragile preprocessor trickery,
    in another attempt at fixing #428355 and friends


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-10
changelog:
  - add fixes from MITKRB5-SA-2008-001 for use of null or dangling pointer
    when v4 compatibility is enabled on the KDC (CVE-2008-0062, CVE-2008-0063,
    - add fixes from MITKRB5-SA-2008-002 for array out-of-bounds accesses when
    high-numbered descriptors are used (CVE-2008-0947, #433596)
  - add backport bug fix for an attempt to free non-heap memory in
    libgssapi_krb5 (CVE-2007-5901, #415321)
  - add backport bug fix for a double-free in out-of-memory situations in
    libgssapi_krb5 (CVE-2007-5971, #415351)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-11
changelog:
  - libgssapi_krb5: properly export the acceptor subkey when creating a lucid
    context (Kevin Coffman, via the nfs4 mailing list)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-12
changelog:
  - stop exporting kadmin keys to a keytab file when kadmind starts -- the
    daemon's been able to use the database directly for a long long time now
  - belatedly add aes128,aes256 to the default set of supported key types


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-15
changelog:
  - build with -fno-strict-aliasing, which is needed because the library
    triggers these warnings
  - don't forget to label principal database lock files
  - fix the labeling patch so that it doesn't break bootstrapping


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - clear fuzz out of patches, dropping a man page patch which is no longer
    necessary
  - quote %{__cc} where needed because it includes whitespace now
  - define ASN1BUF_OMIT_INLINE_FUNCS at compile-time (for now) to keep building


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - if we successfully change the user's password during an attempt to get
    initial credentials, but then fail to get initial creds from a non-master
    using the new password, retry against the master (#432334)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-19
changelog:
  - libgssapi_krb5: backport fix for some errors which can occur when
    we fail to set up the server half of a context (CVE-2009-0845)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-100
changelog:
  - turn off krb4 support (it won't be part of the 1.7 release, but do it now)
  - use triggeruns to properly shut down and disable krb524d when -server and
    -workstation-servers gets upgraded, because it's gone now
  - move the libraries to /%{_lib}, but leave --libdir alone so that plugins
    get installed and are searched for in the same locations (#473333)
  - clean up buildprereq/prereqs, explicit mktemp requires, and add the
    ldconfig for the -server-ldap subpackage (part of #225974)
  - escape possible macros in the changelog (part of #225974)
  - fixup summary texts (part of #225974)
  - take the execute bit off of the protocol docs (part of #225974)
  - unflag init scripts as configuration files (part of #225974)
  - make the kpropd init script treat 'reload' as 'restart' (part of #225974)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-101
changelog:
  - add patches for read overflow and null pointer dereference in the
    implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845)
  - add patch for attempt to free uninitialized pointer in libkrb5
    (CVE-2009-0846)
  - add patch to fix length validation bug in libkrb5 (CVE-2009-0847)
  - put the krb5-user .info file into just -workstation and not also
    -workstation-clients


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-103
changelog:
  - fix a typo in a ksu error message (Marek Mahut)
  - "rev" works the way the test suite expects now, so don't disable tests
    that use it


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.3-104
changelog:
  - extend PAM support to ksu: perform account and session management for the
    target user
  - pull up and merge James Leddy's changes to also set PAM_RHOST in PAM-aware
    network-facing services


author: Nalin Dahyabhai <nalin@redhat.com> 1.7-1
changelog:
  - update to 1.7
    - no need to work around build issues with ASN1BUF_OMIT_INLINE_FUNCS
    - configure recognizes --enable/--disable-pkinit now
    - configure can take --disable-rpath now
    - no more libdes425, krb524d, krb425.info
    - kadmin/k5srvutil/ktutil are user commands now
    - new kproplog
    - FAST encrypted-challenge plugin is new
  - drop static build logic
  - drop pam_krb5-specific configuration from the default krb5.conf
  - drop only-use-v5 flags being passed to various things started by xinetd
  - put %{krb5prefix}/sbin in everyone's path, too (#504525)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - compile with %{?_smp_mflags} (Steve Grubb)
  - drop the bit where we munge part of the error table header, as it's not
    needed any more


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix a type mismatch in krb5_copy_error_message()
  - ftp: fix some odd use of strlen()
  - selinux labeling: use selabel_open() family of functions rather than
    matchpathcon(), bail on it if attempting to get the mutex lock fails


author: Nalin Dahyabhai <nalin@redhat.com> 1.7-3
changelog:
  - switch buildrequires: and requires: on e2fsprogs-devel into
    buildrequires: and requires: on libss-devel, libcom_err-devel, per
    sandeen on fedora-devel-list


author: Nalin Dahyabhai <nalin@redhat.com> 1.7-4
changelog:
  - try to merge and clean up all the large file support for ftp and rcp
    - ftpd no longer prints a negative length when sending a large file
      from a 32-bit host


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - simplify the man pages patch by only preprocessing the files we care about
    and moving shared configure.in logic into a shared function
  - catch the case of ftpd printing file sizes using %i, when they might be
    bigger than an int now


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - if the init script fails to start krb5kdc/kadmind/kpropd because it's already
    running (according to status()), return 0 (part of #521772)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-8
changelog:
  - specify the location of the subsystem lock when using the status() function
    in the kadmind and kpropd init scripts, so that we get the right error when
    we're dead but have a lock file - requires initscripts 8.99 (#521772)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-10
changelog:
  - move /etc/pam.d/ksu from krb5-workstation-servers to krb5-workstation,
    where it's actually needed (#538703)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-11
changelog:
  - ksu: move account management checks to before we drop privileges, like
    su does (#540769)
  - selinux: set the user part of file creation contexts to match the current
    context instead of what we looked up
  - configure with --enable-dns-for-realm instead of --enable-dns, which isn't
    recognized any more


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move man pages that live in the -libs subpackage into the regular
    %{_mandir} tree where they'll still be found if that package is the
    only one installed (#529319)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-15
changelog:
  - add upstream patch for KDC crash during referral processing (CVE-2009-3295),
    via Tom Yu (#545002)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-16
changelog:
  - use %global instead of %define
  - pull up proposed patch for creating previously-not-there lock files for
    kdb databases when 'kdb5_util' is called to 'load' (#551764)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-17
changelog:
  - put the conditional back for the -devel subpackage
  - back down to the earlier version of the patch for #551764; the backported
    alternate version was incomplete


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-18
changelog:
  - add upstream patch for integer underflow during AES and RC4 decryption
    (CVE-2009-4212), via Tom Yu (#545015)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-19
changelog:
  - use portreserve to make sure the KDC can always bind to the kerberos-iv
    port, kpropd can always bind to the krb5_prop port, and that kadmind can
    always bind to the kerberos-adm port (#555279)
  - correct inadvertent use of macros in the changelog (rpmlint)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-20
changelog:
  - krb5_get_init_creds_password: check opte->flags instead of options->flags
    when checking whether or not we get to use the prompter callback (#555875)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-21
changelog:
  - suppress warnings of impending password expiration if expiration is more than
    seven days away when the KDC reports it via the last-req field, just as we
    already do when it reports expiration via the key-expiration field (#556495)
  - link with libtinfo rather than libncurses, when we can, in future RHEL


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-22
changelog:
  - use portreserve correctly -- portrelease takes the basename of the file
    whose entries should be released, so we need three files, not one


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-1
changelog:
  - update to 1.7.1
    - don't trip AD lockout on wrong password (#542687, #554351)
    - incorporates fixes for CVE-2009-4212 and CVE-2009-3295
    - fixes gss_krb5_copy_ccache() when SPNEGO is used
  - move sim_client/sim_server, gss-client/gss-server, uuclient/uuserver to
    the devel subpackage, better lining up with the expected krb5/krb5-appl
    split in 1.8
  - drop kvno,kadmin,k5srvutil,ktutil from -workstation-servers, as it already
    depends on -workstation which also includes them


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-3
changelog:
  - pull up the change to make kpasswd's behavior better match the docs
    when there's no ccache (#563431)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-4
changelog:
  - move the package changelog to the end to match the usual style (jdennis)
  - scrub out references to $RPM_SOURCE_DIR (jdennis)
  - include a symlink to the readme with the name LICENSE so that people can
    find it more easily (jdennis)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-6
changelog:
  - fix a null pointer dereference and crash introduced in our PAM patch that
    would happen if ftpd was given the name of a user who wasn't known to the
    local system, limited to being triggerable by gssapi-authenticated clients by
    the default xinetd config (Olivier Fourdan, #569472)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.8-1
changelog:
  - update to 1.8
    - temporarily bundling the krb5-appl package (split upstream as of 1.8)
      until its package review is complete
    - profile.d scriptlets are now only needed by -workstation-clients
    - adjust paths in init scripts
    - drop upstreamed fix for KDC denial of service (CVE-2010-0283)
    - drop patch to check the user's password correctly using crypt(), which
      isn't a code path we hit when we're using PAM


author: Nalin Dahyabhai <nalin@redhat.com> - 1.8-2
changelog:
  - pull up patch to get the client libraries to correctly perform password
    changes over IPv6 (Sumit Bose, RT#6661)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.8-4
changelog:
  - remove the krb5-appl bits (the -workstation-clients and -workstation-servers
    subpackages) now that krb5-appl is its own package
  - replace our patch for #563431 (kpasswd doesn't fall back to guessing your
    principal name using your user name if you don't have a ccache) with the
    one upstream uses


author: Nalin Dahyabhai <nalin@redhat.com> - 1.8-5
changelog:
  - add upstream fix for denial-of-service in SPNEGO (CVE-2010-0628, #576325)
  - kdc.conf: no more need to suggest keeping keys with v4-compatible salting


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - drop patch to suppress key expiration warnings sent from the KDC in
    the last-req field, as the KDC is expected to just be configured to either
    send them or not as a particular key approaches expiration (#556495)


author: Nalin Dahyabhai <nalin@redhat.com> 1.8.1-1
changelog:
  - update to 1.8.1
    - no longer need patches for #555875, #561174, #563431, RT#6661, CVE-2010-0628
  - replace buildrequires on tetex-latex with one on texlive-latex, which is
    the package that provides it now


author: Nalin Dahyabhai <nalin@redhat.com> 1.8.1-5
changelog:
  - add patch to correct GSSAPI library null pointer dereference which could be
    triggered by malformed client requests (CVE-2010-1321, #582466)


author: Nalin Dahyabhai <nalin@redhat.com> 1.8.1-6
changelog:
  - make krb5-server-ldap also depend on the same version-release of krb5-libs,
    as the other subpackages do, if only to make it clearer than it is when we
    just do it through krb5-server
  - drop explicit linking with libtinfo for applications that use libss, now
    that readline itself links with libtinfo (as of readline-5.2-3, since
    fedora 7 or so)
  - go back to building without strict aliasing (compiler warnings in gssrpc)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - ksu: move session management calls to before we drop privileges, like
    su does (#596887), and don't skip the PAM account check for root or the
    same user (more of #540769)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull up fix for upstream #6745, in which the gssapi library would add the
    wrong error table but subsequently attempt to unload the right one


author: Nalin Dahyabhai <nalin@redhat.com> 1.8.2-2
changelog:
  - libgssapi: pull in patch from svn to stop returning context-expired errors
    when the ticket which was used to set up the context expires (#605366,
    upstream #6739)


author: Nalin Dahyabhai <nalin@redhat.com> 1.8.2-3
changelog:
  - tell krb5kdc and kadmind to create pid files, since they can
  - add logrotate configuration files for krb5kdc and kadmind (#462658)
  - fix parsing of the pidfile option in the KDC (upstream #6750)


author: Nalin Dahyabhai <nalin@redhat.com> 1.8.3-1
changelog:
  - update to 1.8.3
    - drop backports of fixes for gss context expiration and error table
      registration/deregistration mismatch
    - drop patch for upstream #6750


author: Nalin Dahyabhai <nalin@redhat.com> 1.8.3-3
changelog:
  - build with -fstack-protector-all instead of the default -fstack-protector,
    so that we add checking to more functions (i.e., all of them) (#629950)
  - also link binaries with -Wl,-z,relro,-z,now (part of #629950)


author: Nalin Dahyabhai <nalin@redhat.com> 1.8.3-4
changelog:
  - fix reading of keyUsage extensions when attempting to select pkinit client
    certs (part of #629022, RT#6775)
  - fix selection of pkinit client certs when one or more don't include a
    subjectAltName extension (part of #629022, RT#6774)


author: Nalin Dahyabhai <nalin@redhat.com> 1.8.3-6
changelog:
  - pull down patches from trunk to implement k5login_authoritative and
    k5login_directory settings for krb5.conf (#539423)


author: Nalin Dahyabhai <nalin@redhat.com> 1.8.3-8
changelog:
  - incorporate upstream patch to fix uninitialized pointer crash in the KDC's
    authorization data handling (CVE-2010-1322, #636335)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-0.beta1.0
changelog:
  - start moving to 1.9 with beta 1
    - drop patches for RT#5755, RT#6762, RT#6774, RT#6775
    - drop no-longer-needed backport patch for #539423
    - drop no-longer-needed patch for CVE-2010-1322
  - if WITH_NSS is set, built with --with-crypto-impl=nss (requires NSS 3.12.9)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-2
changelog:
  - pkinit: when verifying signed data, use the CMS APIs for better
    interoperability (#636985, RT#6851)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-4
changelog:
  - add upstream patches to fix standalone kpropd exiting if the per-client
    child process exits with an error (MITKRB5-SA-2011-001), a hang or crash
    in the KDC when using the LDAP kdb backend, and an uninitialized pointer
    use in the KDC (MITKRB5-SA-2011-002) (CVE-2010-4022, #664009,
    CVE-2011-0281, #668719, CVE-2011-0282, #668726, CVE-2011-0283, #676126)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-5
changelog:
  - krb5kdc init script: prototype some changes to do a quick spot-check
    of the TGS and kadmind keys and warn if there aren't any non-weak keys
    on file for them (to flush out parts of #651466)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-6
changelog:
  - turn on NSS as the backend for libk5crypto, adding nss-devel as a build
    dependency when that switch is flipped


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - throw in a not-applied-by-default patch to try to make pkinit debugging
    into a run-time boolean option named "pkinit_debug"


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-7
changelog:
  - turn off NSS as the backend for libk5crypto for now to work around its
    DES string2key not working (#679012)
  - add revised upstream patch to fix double-free in KDC while returning
    typed-data with errors (MITKRB5-SA-2011-003, CVE-2011-0284, #674325)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - override INSTALL_SETUID at build-time so that ksu is installed into
    the buildroot with the right permissions (part of #225974)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't discard the error code from an error message received in response
    to a change-password request (#658871, RT#6893)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-9
changelog:
  - kadmind: add upstream patch to fix free() on an invalid pointer (#696343,
    MITKRB5-SA-2011-004, CVE-2011-0285)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-1
changelog:
  - update to 1.9.1:
    - drop no-longer-needed patches for CVE-2010-4022, CVE-2011-0281,
      CVE-2011-0282, CVE-2011-0283, CVE-2011-0284, CVE-2011-0285


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - incorporate a fix to teach the file labeling bits about when replay caches
    are expunged (#576093)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-3
changelog:
  - pull a fix from SVN to get libgssrpc clients (e.g. kadmin) authenticating
    using the old protocol over IPv4 again (RT#6920)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-4
changelog:
  - apply upstream patch by way of Burt Holzman to fall back to a non-referral
    method in cases where we might be derailed by a KDC that rejects the
    canonicalize option (for example, those from the RHEL 2.1 or 3 era) (#715074)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-5
changelog:
  - pull a fix from SVN to try to avoid triggering a PTR lookup in getaddrinfo()
    during krb5_sname_to_principal(), and to let getaddrinfo() decide whether or
    not to ask for an IPv6 address based on the set of configured interfaces
    (#717378, RT#6922)
  - pull a fix from SVN to use AI_ADDRCONFIG more often (RT#6923)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-6
changelog:
  - backport fixes to teach libkrb5 to use descriptors higher than FD_SETSIZE
    to talk to a KDC by using poll() if it's detected at compile-time (#701446,
    RT#6905)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-7
changelog:
  - kadmind.init: drop the attempt to detect no-database-present errors (#723723),
    which is too fragile in cases where the database has been manually moved or
    is accessed through another kdb plugin


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-8
changelog:
  - build shared libraries with partial RELRO support (#723995)
  - filter out potentially multiple instances of -Wl,-z,relro from krb5-config
    output, now that it's in the buildroot's default LDFLAGS
  - pull in a patch to fix losing track of the replay cache FD, from SVN by
    way of Kevin Coffman


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-9
changelog:
  - override the default build rules to not delete temporary y.tab.c files,
    so that they can be packaged, allowing debuginfo files which point to them
    do so usefully (#729044)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-10
changelog:
  - handle an assertion failure that starts cropping up when the patch for
    using poll (#701446) meets servers that aren't running KDCs or against
    which the connection fails for other reasons (#727829, #734172)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-12
changelog:
  - pull in upstream patch for RT#6952, confusion following referrals for
    cross-realm auth (#734341)
  - pull in build-time deps for the tests


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-16
changelog:
  - kadmin.service: fix #723723 again
  - kadmin.service,krb5kdc.service: remove optional use of $KRB5REALM in command
    lines, because systemd parsing doesn't handle alternate value shell variable
    syntax
  - kprop.service: add missing Type=forking so that systemd doesn't assume simple
  - kprop.service: expect the ACL configuration to be there, not absent
  - handle a harder-to-trigger assertion failure that starts cropping up when we
    exit the transmit loop on time (#739853)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-17
changelog:
  - pull in patch from trunk to rename krb5int_pac_sign() to krb5_pac_sign() and
    make it public (#745533)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9.1-18
changelog:
  - apply upstream patch to fix a null pointer dereference with the LDAP kdb
    backend (CVE-2011-1527, #744125), an assertion failure with multiple kdb
    backends (CVE-2011-1528), and a null pointer dereference with multiple kdb
    backends (CVE-2011-1529) (#737711)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10-0.alpha1.0
changelog:
  - update to 1.10 alpha 1
  - on newer releases where we can assume NSS >= 3.13, configure PKINIT to build
    using NSS
  - on newer releases where we build PKINIT using NSS, configure libk5crypto to
    build using NSS
  - rename krb5-pkinit-openssl to krb5-pkinit on newer releases where we're
    expecting to build PKINIT using NSS instead
  - during %check, run check in the library and kdc subdirectories, which
    should be able to run inside of the build system without issue


author: Nalin Dahyabhai <nalin@redhat.com> 1.10-0.alpha1.2
changelog:
  - apply upstream patch to fix a null pointer dereference when processing
    TGS requests (CVE-2011-1530, #753748)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10-0.alpha1.3
changelog:
  - pull in patch for RT#7046: tag a ccache containing credentials obtained via
    S4U2Proxy with the principal name of the proxying principal (part of #761317)
    so that the default principal name can be set to that of the client for which
    it is proxying, which results in the ccache looking more normal to consumers
    of the ccache that don't care that there's proxying going on
  - pull in patch for RT#7047: allow tickets obtained via S4U2Proxy to be cached
    (more of #761317)
  - pull in patch for RT#7048: allow PAC verification to only bother trying to
    verify the signature with keys that it's given (still more of #761317)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10-0.alpha2.2
changelog:
  - modify the deltat grammar to also tell gcc (4.7) to suppress
    "maybe-uninitialized" warnings in addition to the "uninitialized" warnings
    it's already being told to suppress (RT#7080)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10-2
changelog:
  - add patch to accept keytab entries with vno==0 as matches when we're
    searching for an entry with a specific name/kvno (#230382/#782211,RT#3349)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10-5
changelog:
  - when removing -workstation, remove our files from the info index while
    the file is still there, in %preun, rather than %postun, and use the
    compressed file's name (#801035)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.1-1
changelog:
  - update to 1.10.1
    - drop the KDC crash fix
    - drop the KDC lookaside cache fix
    - drop the fix for kadmind RPC ACLs (CVE-2012-1012)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.1-2
changelog:
  - change back dns_lookup_kdc to the default setting (Stef Walter, #805318)
  - comment out example.com examples in default krb5.conf (Stef Walter, #805320)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.1-3
changelog:
  - have -server require /usr/share/dict/words, which we set as the default
    dict_file in kdc.conf (#817089)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.2-1
changelog:
  - update to 1.10.2
    - when building the new label for a file we're about to create, also mix
      in the current range, in addition to the current user
    - also package the PDF format admin, user, and install guides
    - drop some PDFs that no longer get built right
  - add a backport of Stef's patch to set the client's list of supported
    enctypes to match the types of keys that we have when we are using a
    keytab to try to get initial credentials, so that a KDC won't send us
    an AS reply that we can't encrypt (RT#2131, #748528)
  - don't shuffle around any shared libraries on releases with no-separate-/usr,
    since /usr/lib is the same place as /lib
  - add explicit buildrequires: on 'hostname', for the tests, on systems where
    it's in its own package, and require net-tools, which used to provide the
    command, everywhere


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.2-2
changelog:
  - back out this labeling change (dwalsh):
    - when building the new label for a file we're about to create, also mix
      in the current range, in addition to the current user


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.2-3
changelog:
  - backport a fix to allow a PKINIT client to handle SignedData from a KDC
    that's signed with a certificate that isn't in the SignedData, but which
    is available as an anchor or intermediate on the client (RT#7183)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.2-5
changelog:
  - add upstream patch to fix freeing an uninitialized pointer and dereferencing
    another uninitialized pointer in the KDC (MITKRB5-SA-2012-001, CVE-2012-1014
    and CVE-2012-1015, #844779 and #844777)
  - fix a thinko in whether or not we mess around with devel .so symlinks on
    systems without a separate /usr (sbose)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.2-6
changelog:
  - go back to not messing with library file paths on Fedora 17: it breaks
    file path dependencies in other packages, and since Fedora 17 is already
    released, breaking that is our fault


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.2-7
changelog:
  - selinux: hang on to the list of selinux contexts, freeing and reloading
    it only when the file we read it from is modified, freeing it when the
    shared library is being unloaded (#845125)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-2
changelog:
  - undo rename from krb5-pkinit-openssl to krb5-pkinit on EL6
  - version the Obsoletes: on the krb5-pkinit-openssl to krb5-pkinit rename
  - reintroduce the init scripts for non-systemd releases
  - forward-port %{?_rawbuild} annotations from EL6 packaging


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-3
changelog:
  - backport patch to disable replay detection in krb5_verify_init_creds()
    while reading the AP-REQ that's generated in the same function (RT#7229)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-4
changelog:
  - cut down the number of times we load SELinux labeling configuration from
    a minimum of two times to actually one (more of #845125)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - on EL6, conflict with libsmbclient before 3.5.10-124, which is when it
    stopped linking with a symbol which we no longer export (#771687)
  - pull up patch for RT#7063, in which not noticing a prompt for a long
    time throws the client library's idea of the time difference between it
    and the KDC really far out of whack (#773496)
  - add a backport of more patches to set the client's list of supported enctypes
    when using a keytab to be the list of types of keys in the keytab, plus the
    list of other types the client supports but for which it doesn't have keys,
    in that order, so that KDCs have a better chance of being able to issue
    tickets with session keys of types that the client can use (#837855)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-5
changelog:
  - add patch based on one from Filip Krska to not call poll() with a negative
    timeout when the caller's intent is for us to just stop calling it (#838548)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-7
changelog:
  - tag a couple of other patches which we still need to be applied during
    %{?_rawbuild} builds (zmraz)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.11 alpha 1
    - drop backported patch for RT #7406
    - drop backported patch for RT #7407
    - drop backported patch for RT #7408
    - the new docs system generates PDFs, so stop including them as sources
    - drop backported patch to allow deltat.y to build with the usual
      warning flags and the current gcc
    - drop backported fix for disabling use of a replay cache when verifying
      initial credentials
    - drop backported fix for teaching PKINIT clients which trust the KDC's
      certificate directly to verify signed-data messages that are signed with
      the KDC's certificate, when the blobs don't include a copy of the KDC's
      certificate
    - drop backported patches to make keytab-based authentication attempts
      work better when the client tells the KDC that it supports a particular
      cipher, but doesn't have a key for it in the keytab
    - drop backported fix for avoiding spurious clock skew when a TGT is
      decrypted long after the KDC sent it to the client which decrypts it
    - move the cross-referenced HTML docs into the -libs package to avoid
      broken internal links
    - drop patches to fixup paths in man pages, shouldn't be needed any more


author: Nalin Dahyabhai <nalin@redhat.com> 1.11-0.alpha1.0
changelog:
  - move the rather large pile of html and pdf docs to -workstation, so
    that just having something that links to the libraries won't drag
    them onto a system, and we avoid having to sort out hard-coded paths
    that include %{_libdir} showing up in docs in multilib packages
  - actually create %{_var}/kerberos/kdc/user, so that it can be packaged
  - correct the list of packaged man pages
  - don't dummy up required tex stylesheets, require them
  - require pdflatex and makeindex


author: Nalin Dahyabhai <nalin@redhat.com> 1.11-0.alpha1.1
changelog:
  - handle releases where texlive packaging wasn't yet as complicated as it
    is in Fedora 18
  - fix an uninitialized-variable error building one of the test programs


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - when building with our bundled copy of libverto, package it in with -libs
    rather than with -server (#886049)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-1
changelog:
  - update to 1.11.1
    - drop patch for noticing negative timeouts being passed to the poll()
      wrapper in the client transmit functions


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-2
changelog:
  - prebuild PDF docs to reduce multilib differences (internal tooling, #884065)
  - drop the kerberos-iv portreserve file, and drop the rest on systemd systems
  - escape uses of macros in comments (more of #884065)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix a version comparison to expect newer texlive build requirements when
    %{_rhel} > 6 rather than when it's > 7


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-5
changelog:
  - pull up Simo's patch to mark the correct mechanism on imported GSSAPI
    contexts (RT#7592)
  - go back to using reconf to run autoconf and autoheader (part of #925640)
  - add temporary patch to use newer config.guess/config.sub (more of #925640)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-6
changelog:
  - create and own /var/kerberos/krb5/user instead of /var/kerberos/kdc/user,
    since that's what the libraries actually look for
  - add buildrequires on nss-myhostname, in an attempt to get more of the tests
    to run properly during builds
  - pull in Simo's patch to recognize "client_keytab" as a key type which can
    be passed in to gss_acquire_cred_from() (RT#7598)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-7
changelog:
  - when testing the RPC library, treat denials from the local portmapper the
    same as a portmapper-not-running situation, to allow other library tests
    to be run while building the package


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.1-9
changelog:
  - move the compiled-in default ccache location from the previous default of
    FILE:/tmp/krb5cc_%{uid} to DIR:/run/user/%{uid}/krb5cc (part of #949588)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-1
changelog:
  - update to 1.11.2
    - drop pulled in patch for RT#7586, included in this release
    - drop pulled in patch for RT#7592, included in this release
  - pull in fix for keeping track of the message type when parsing FAST requests
    in the KDC (RT#7605, #951843) (also #951965)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-3
changelog:
  - pull the changing of the compiled-in default ccache location to
    DIR:/run/user/%{uid}/krb5cc back into F19, in line with SSSD and
    the most recent pam_krb5 build


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-6
changelog:
  - pull in upstream fix to start treating a KRB5CCNAME value that begins
    with DIR:: the same as it would a DIR: value with just one ccache file
    in it (RT#7172, #965574)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-7
changelog:
  - backport fix for not being able to verify the list of transited realms
    in GSS acceptors (RT#7639, #959685)
  - backport fix for not being able to pass an empty password to the
    get-init-creds APIs and have them actually use it (RT#7642, #960001)
  - add backported proposed fix to use the unauthenticated server time
    as the basis for computing the requested credential expiration times,
    rather than the client's idea of the current time, which could be
    significantly incorrect (#961221)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-8
changelog:
  - pull in patches from master to not test GSSRPC-over-UDP and to not
    depend on the portmapper, which are areas where our build systems
    often give us trouble, too


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.2-9
changelog:
  - don't forget to set the SELinux label when creating the directory for
    a DIR: ccache
  - pull in proposed fix for attempts to get initial creds, which end up
    following referrals, incorrectly trying to always use master KDCs if
    they talked to a master at any point (should fix RT#7650)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-1
changelog:
  - update to 1.11.3
    - drop patch for RT#7605, fixed in this release
    - drop patch for CVE-2002-2443, fixed in this release
    - drop patch for RT#7369, fixed in this release
  - pull upstream fix for breaking t_skew.py by adding the patch for #961221


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-2
changelog:
  - special-case /run/user/0, attempting to create it when resolving a
    directory cache below it fails due to ENOENT and we find that it doesn't
    already exist, either, before attempting to create the directory cache
    (maybe helping, maybe just making things more confusing for #961235)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-3
changelog:
  - specify dependencies on the same arch of krb5-libs by using the %{?_isa}
    suffix, to avoid dragging 32-bit libraries onto 64-bit systems (#980155)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-4
changelog:
  - use (a bundled, for now, copy of) nss_wrapper to let us run some of the
    self-tests at build-time in more places than we could previously (#978756)
  - cover inconsistencies in whether or not there's a local caching nameserver
    that's willing to answer when the build environment doesn't have a
    resolver configuration, so that nss_wrapper's faking of the local
    hostname can be complete


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-6
changelog:
  - tweak configuration files used during tests to try to reduce the number
    of conflicts encountered when builds for multiple arches land on the same
    builder


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-8
changelog:
  - drop a patch we weren't not applying (build tooling)
  - wrap kadmind and kpropd in scripts which check for the presence/absence
    of files which dictate particular exit codes before exec'ing the actual
    binaries, instead of trying to use ConditionPathExists in the unit files
    to accomplish that, so that we exit with failure properly when what we
    expect isn't actually in effect on the system (#800343)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-9
changelog:
  - take another stab at accounting for UnversionedDocdirs for the -libs
    subpackage (spotted by ssorce)
  - switch to just the snapshot of nss_wrapper we were using, since we
    no longer need to carry anything that isn't in the cwrap.org repository
    (ssorce)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-10
changelog:
  - incorporate Simo's backport of his persistent-keyring changes (#991148)
  - restore build-time default DEFCCNAME on Fedora 21 and later and EL, and
    instead set default_ccache_name in the default krb5.conf's [libdefaults]
    section (#991148)
  - on releases where we expect krb5.conf to be configured with a
    default_ccache_name, add it whenever we upgrade from an older version of
    the package that wouldn't have included it in its default configuration
    file (#991148)


author: Nalin Dahyabhai <nalin@redhat.com> 1.11.3-11
changelog:
  - don't let comments intended for one scriptlet become part of the "script"
    that gets passed to ldconfig as part of another one (Mattias Ellert, #1005675)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - only apply the patch to autocreate /run/user/0 when we're hard-wiring the
    default ccache location to be under it; otherwise it's unnecessary


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-15
changelog:
  - add explicit build-time dependency on a version of keyutils that's new
    enough to include keyctl_get_persistent() (more of #991148)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-16
changelog:
  - back out setting default_ccache_name to the new default for now, resetting
    it to the old default while the kernel/keyutils bits get sorted (sgallagh)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-19
changelog:
  - configure --without-krb5-config so that we don't pull in the old default
    ccache name when we want to stop setting a default ccache name at configure-
    time


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-20
changelog:
  - pull up fix for not calling a kdb plugin's check-transited-path
    method before calling the library's default version, which only knows
    how to read what's in the configuration file (RT#7709, #1013664)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-21
changelog:
  - switch to the version of persistent-keyring that was just merged to
    master (RT#7711), along with related changes to kinit (RT#7689)
  - go back to setting default_ccache_name to a KEYRING type


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-24
changelog:
  - backport the callback to use the libkrb5 prompter when we can't load PEM
    files for PKINIT (RT#7590, includes part of #965721/#1016690)
  - extract the rest of the fix #965721/#1016690 from the changes for RT#7680


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-25
changelog:
  - pull up fix for importing previously-exported credential caches in the
    gssapi library (RT# 7706, #1019420)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-alpha1.0
changelog:
  - initial update to alpha1
    - drop backport of persistent keyring support
    - drop backport for RT#7689
    - drop obsolete patch for fixing a use-before-init in a test program
    - drop obsolete patch teaching config.guess/config.sub about aarch64-linux
    - drop backport for RT#7598
    - drop backport for RT#7172
    - drop backport for RT#7642
    - drop backport for RT#7643
    - drop patches from master to not test GSSRPC-over-UDP and to not
      depend on the portmapper, which are areas where our build systems
      often give us trouble, too; obsolete
    - drop backports for RT#7682
    - drop backport for RT#7709
    - drop backport for RT#7590 and partial backport for RT#7680
    - drop OTP backport
    - drop backports for RT#7656 and RT#7657
  - BuildRequires: libedit-devel to prefer it
  - BuildRequires: pkgconfig, since configure uses it


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-27
changelog:
  - add some minimal description to the top of the wrapper scripts we use
    when starting krb5kdc and kadmind to describe why they exist (tooling)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-28
changelog:
  - drop patch to add additional access() checks to ksu - they add to breakage
    when non-FILE: caches are in use (#1026099), shouldn't be resulting in any
    benefit, and clash with proposed changes to fix its cache handling


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-29
changelog:
  - incorporate upstream patch for remote crash of KDCs which serve multiple
    realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800,


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.3-30
changelog:
  - check more thoroughly for errors when resolving KEYRING ccache names of type
    "persistent", which should only have a numeric UID as the next part of the
    name (#1029110)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.4-1
changelog:
  - update to 1.11.4
    - drop patch for RT#7650, obsoleted
    - drop patch for RT#7706, obsoleted as RT#7723
    - drop patch for CVE-2013-1418/CVE-2013-6800, included in 1.11.4


author: Nalin Dahyabhai <nalin@redhat.com> - 1.11.4-2
changelog:
  - pull in fix to store KDC time offsets in keyring credential caches (RT#7768,
    - pull in fix to set expiration times on credentials stored in keyring
    credential caches (RT#7769, #1031724)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-beta2.0
changelog:
  - update to beta2
    - drop obsolete backports for storing KDC time offsets and expiration times
      in keyring credential caches


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-2
changelog:
  - pull in fix from master to return a NULL pointer rather than allocating
    zero bytes of memory if we read a zero-length input token (RT#7794, part of
    - pull in fix from master to ignore an empty token from an acceptor if
    we've already finished authenticating (RT#7797, part of #1043962)
  - pull in fix from master to avoid a memory leak when a mechanism's
    init_sec_context function fails (RT#7803, part of #1043962)
  - pull in fix from master to avoid a memory leak in a couple of error
    cases which could occur while obtaining acceptor credentials (RT#7805, part
    of #1043962)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update a test wrapper to properly handle things that the new libkrad does,
    and add python-pyrad as a build requirement so that we can run its tests


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-5
changelog:
  - pull in fix from master to make reporting of errors encountered by
    the SPNEGO mechanism work better (RT#7045, part of #1043962)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-8
changelog:
  - add patch from Dhiru Kholia for the AES-NI implementations to allow
    libk5crypto to be properly marked as not needing an executable stack
    on arches where they're used (#1045699, and so many others)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-9
changelog:
  - grab a more-commented version of the most recent patch from upstream
    master
  - make a guess at making the 32-bit AES-NI implementation sufficiently
    position-independent to not require execmod permissions for libk5crypto
    (more of #1045699)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-10
changelog:
  - amend the PIC patch for iaesx86.s to also save/restore ebx in the
    functions where we modify it, because the ELF spec says we need to


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12-11
changelog:
  - update the PIC patch for iaesx86.s to not use ELF relocations to the version
    that landed upstream (RT#7815, #1045699)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-1
changelog:
  - update to 1.12.1
    - drop patch for RT#7794, included now
    - drop patch for RT#7797, included now
    - drop patch for RT#7803, included now
    - drop patch for RT#7805, included now
    - drop patch for RT#7807, included now
    - drop patch for RT#7045, included now
    - drop patches for RT#7813 and RT#7815, included now
    - add patch to always retrieve the KDC time offsets from keyring caches,
      so that we don't mistakenly interpret creds as expired before their
      time when our clock is ahead of the KDC's (RT#7820, #1030607)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-2
changelog:
  - pull in multiple changes to allow replay caches to be added to a GSS
    credential store as "rcache"-type credentials (RT#7818/#7819/#7836,


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add currently-proposed changes to teach ksu about credential cache
    collections and the default_ccache_name setting (#1015559,#1026099)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-4
changelog:
  - pull in patch from master to move the default directory which the KDC uses
    when computing the socket path for a local OTP daemon from the database
    directory (/var/kerberos/krb5kdc) to the newly-added run directory
    (/run/krb5kdc), in line with what we're expecting in 1.13 (RT#7859, more
    of #1040056 as #1063905)
  - add a tmpfiles.d configuration file to have /run/krb5kdc created at
    boot-time
  - own /var/run/krb5kdc


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-5
changelog:
  - spnego: pull in patch from master to restore preserving the OID of the
    mechanism the initiator requested when we have multiple OIDs for the same
    mechanism, so that we reply using the same mechanism OID and the initiator
    doesn't get confused (#1066000, RT#7858)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-9
changelog:
  - pull in changes from upstream which add processing of the contents of
    /etc/gss/mech.d/*.conf when loading GSS modules (#1102839)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-10
changelog:
  - pull in fix for denial of service by injection of malformed GSSAPI tokens
    (CVE-2014-4341, CVE-2014-4342, #1116181)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.1-12
changelog:
  - gssapi: pull in proposed fix for a double free in initiators (David
    Woodhouse, CVE-2014-4343, #1117963)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-1
changelog:
  - update to 1.12.2
    - drop patch for RT#7820, fixed in 1.12.2
    - drop patch for #231147, fixed as RT#3277 in 1.12.2
    - drop patch for RT#7818, fixed in 1.12.2
    - drop patch for RT#7836, fixed in 1.12.2
    - drop patch for RT#7858, fixed in 1.12.2
    - drop patch for RT#7924, fixed in 1.12.2
    - drop patch for RT#7926, fixed in 1.12.2
    - drop patches for CVE-2014-4341/CVE-2014-4342, included in 1.12.2
    - drop patch for CVE-2014-4343, included in 1.12.2
    - drop patch for CVE-2014-4344, included in 1.12.2
    - drop patch for CVE-2014-4345, included in 1.12.2
  - replace older proposed changes for ksu with backports of the changes
    after review and merging upstream (#1015559, #1026099, #1118347)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.13-0.alpha1.2
changelog:
  - kpropd hasn't bothered with -S since 1.11; stop trying to use that flag
    in the systemd unit file


author: Roland Mainz <rmainz@redhat.com> - 1.13-0.alpha1.3
changelog:
  - fix for CVE-2014-5351 (#1145425) "krb5: current keys returned when
    randomizing the keys for a service principal"


author: Roland Mainz <rmainz@redhat.com> - 1.13-1
changelog:
  - Update from krb5-1.13-alpha1 to final krb5-1.13
  - Removed patch for CVE-2014-5351 (#1145425) "krb5: current
    keys returned when randomizing the keys for a service principal" -
    now part of upstream sources
  - Use patch for glibc |eventfd()| prototype mismatch (#1147887) only
    for Fedora > 20


author: Roland Mainz <rmainz@redhat.com> - 1.13-2
changelog:
  - Bump 1%{?dist} to 2%{?dist} to workaround RPM sort issue
    which would lead yum updates to treat the last alpha as newer
    than the final version.


author: Roland Mainz <rmainz@redhat.com> - 1.13-5
changelog:
  - fix for kinit -C loops (#1184629, MIT/krb5 issue 243, "Do not
    loop on principal unknown errors").
  - Added "python-sphinx-latex" to the build requirements
    to fix build failures on F22 machines.


author: Roland Mainz <rmainz@redhat.com> - 1.13-7
changelog:
  - Remove "python-sphinx-latex" and "tar" from the build requirements
    to fix build failures on F22 machines.
  - Minor spec cleanup


author: Roland Mainz <rmainz@redhat.com> - 1.13-8
changelog:
  - fix for CVE-2014-5352 (#1179856) "gss_process_context_token()
    incorrectly frees context (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial
    deserialization results (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9422 (#1179861) "kadmind incorrectly
    validates server principal name (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9423 (#1179863) "libgssrpc server applications
    leak uninitialized bytes (MITKRB5-SA-2015-001)"


author: Roland Mainz <rmainz@redhat.com> - 1.13.1-1
changelog:
  - Update to krb5-1.13.1
    - drop patch for CVE_2014_5353_fix_LDAP_misused_policy_name_crash, fixed in krb5-1.13.1
    - drop patch for kinit -C loops (MIT/krb5 bug #243), fixed in krb5-1.13.1
    - drop patch for CVEs { 2014-9421, 2014-9422, 2014-9423, 2014-5352 }, fixed in krb5-1.13.1
  - Minor spec cleanup


author: Roland Mainz <rmainz@redhat.com> - 1.13.1-2
changelog:
  - fix for CVE-2014-5355 (#1193939) "krb5: unauthenticated
    denial of service in recvauth_common() and others"


author: Roland Mainz <rmainz@redhat.com> - 1.13.1-3
changelog:
  - Add temporay workaround for RH bug #1204646 ("krb5-config
    returns wrong -specs path") which modifies krb5-config post
    build so that development of krb5 dependicies gets unstuck.
    This MUST be removed before rawhide becomes F23 ...


author: Roland Mainz <rmainz@redhat.com> - 1.13.1-4
changelog:
  - fix for CVE-2015-2694 (#1216133) "requires_preauth bypass
    in PKINIT-enabled KDC".
    In MIT krb5 1.12 and later, when the KDC is configured with
    PKINIT support, an unauthenticated remote attacker can
    bypass the requires_preauth flag on a client principal and
    obtain a ciphertext encrypted in the principal's long-term
    key.  This ciphertext could be used to conduct an off-line
    dictionary attack against the user's password.


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-0
changelog:
  - Update to krb5-1.13.2
    - drop patch for krb5-1.13.2-CVE_2015_2694_requires_preauth_bypass_in_PKINIT_enabled_KDC, fixed in krb5-1.13.2
    - drop patch for krb5-1.12.1-CVE_2014_5355_fix_krb5_read_message_handling, fixed in krb5-1.13.2
  - Add script processing for upcoming Zanata l10n support
  - Minor spec cleanup


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-1
changelog:
  - Add fix for RedHat Bug #1164304 ("Upstream unit tests loads
    the installed shared libraries instead the ones from the build")


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-2
changelog:
  - Add patch to fix Redhat Bug #1227542 ("[SELinux] AVC denials may appear
    when kadmind starts"). The issue was caused by an unneeded |htons()|
    which triggered SELinux AVC denials due to the "random" port usage.


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-5
changelog:
  - Remove Zanata test glue and related workarounds
    - Bug #1234292 ("IPA server cannot be run in container due to incorrect /usr/sbin/_kadmind")
    - Bug #1234326 ("krb5-server introduces new rpm dependency on ksh")


author: Roland Mainz <rmainz@redhat.com> - 1.13.2-6
changelog:
  - Use system nss_wrapper and socket_wrapper for testing.
    Patch by Andreas Schneider <asn@redhat.com>


author: Robbie Harwood <rharwood@redhat.com> - 1.13.2-7
changelog:
  - Support config snippets in /etc/krb5.conf.d/ and /usr/share/krb5.conf.d/
    (#1225792, #1146370, #1145808)


author: Robbie Harwood <rharwood@redhat.com> - 1.13.2-8
changelog:
  - Remove dependency on systemd-sysv which is no longer needed for fedora > 20
    This also fixes a fail-to-build issue.
  - Miscalaneous spec cleanup fixes


author: Robbie Harwood <rharwood@redhat.com> - 1.14-9
changelog:
  - Upstream release.  No actual change from beta, just version bump
  - Clean up unused parts of spec file


author: Robbie Harwood <rharwood@redhat.com> - 1.14-11
changelog:
  - Backport interposer fix (#1284985)
  - Drop workaround pwsize initialization patch (gcc has been fixed)


author: Robbie Harwood <rharwood@redhat.com> - 1.14-14
changelog:
  - Remove WITH_NSS macro (always false)
  - Remove WITH_SYSTEMD macro (always true)
  - Remove WITH_LDAP macro (always true)
  - Remove WITH_OPENSSL macro (always true)


author: Robbie Harwood <rharwood@redhat.com> - 1.14-19
changelog:
  - Replace _kadmin/_kprop with systemd macros
  - Remove traces of upstart from fedora package per policy
  - Resolves: #1290185


author: Robbie Harwood <rharwood@redhat.com> - 1.14-21
changelog:
  - Adjust dependency on crypto-polices to be just the file we want
  - Patch courtesy of lslebodn
  - Resolves: #1308984


author: Robbie Harwood <rharwood@redhat.com> - 1.14.1-1
changelog:
  - New rawhide, new upstream version
  - Drop CVE patches
  - Rename fix_interposer.patch to acquire_cred_interposer.patch
  - Update acquire_cred_interposer.patch to apply to new source


author: Robbie Harwood <rharwood@redhat.com> - 1.14.4-3
changelog:
  - Switch to using autosetup macro.
    - Patches come from git, so it is easiest to just make a git repo


author: Robbie Harwood <rharwood@redhat.com> - 1.15.1-5
changelog:
  - Automatically add includedir where not present
  - Try removing sleep statement to see if it is still needed
  - Resolves: #1433083


author: Robbie Harwood <rharwood@redhat.com> - 1.15.1-22
changelog:
  * Mon Aug 07 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.1-21
  - Display an error message if ocsp pkinit is requested


author: Robbie Harwood <rharwood@redhat.com> - 1.16-6
changelog:
  - Fix a leak in the previous commit
  - Restore dist macro that was accidentally removed
  - Resolves: #1540939


author: Robbie Harwood <rharwood@redhat.com> - 1.16-15
changelog:
  - Add SPAKE support
  - Improve protections on internal sensitive buffers
  - Improve internal hex encoding/decoding


author: Robbie Harwood <rharwood@redhat.com> - 1.18-1
changelog:
  - New upstream version (1.18)
  - Resolves: #1802334
  - Resolves: #1820311
  - Resolves: #1791062
  - Resolves: #1784655


author: Robbie Harwood <rharwood@redhat.com> - 1.18.2-3
changelog:
  - Match Heimdal behavior for channel bindings
  - Code hygiene + test stability fix included
  - Resolves: #1840518


author: Julien Rische <jrische@redhat.com> - 1.18.2-27
changelog:
  - Fix memory leak in GSSAPI interface
    Resolves: RHEL-27250
  - Fix memory leak in PMAP RPC interface
    Resolves: RHEL-27244
  - Make TCP waiting time configurable
    Resolves: RHEL-17131


author: Julien Rische <jrische@redhat.com> - 1.18.2-29
changelog:
  - CVE-2024-37370 CVE-2024-37371
    Fix vulnerabilities in GSS message token handling
    Resolves: RHEL-45398 RHEL-45386


author: Julien Rische <jrische@redhat.com> - 1.18.2-30
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: RHEL-50253
  - Remove RSA protocol for PKINIT
    Resolves: RHEL-17616


author: Julien Rische <jrische@redhat.com> - 1.18.2-31
changelog:
  - Prevent overflow when calculating ulog block size (CVE-2025-24528)
    Resolves: RHEL-78248
  - kdb5_util: fix DB entry flags on modification
    Resolves: RHEL-56060


author: Tomas Smetana <tsmetana@redhat.com> 20070328-2
changelog:
  - fix wrong exit status of spawned process after SIGSTOP
  - fix building of debuginfo package, add %{?dist} to release
  - fix handling of SIGTTOU in non-interactive shell
  - remove useless builtins


author: Tomas Smetana <tsmetana@redhat.com> 20071105-2
changelog:
  - fix #405381 - ksh will not handle $(xxx) when typeset -r IFS
  - fix #386501 - bad group in spec file


author: Michal Hlavinka <mhlavink@redhat.com> - 20100309-4
changelog:
  - fix infinite loop when whence builtin is used with -q option (#587127)
  - fix stdin for double command substitution (#584007)


author: Michal Hlavinka <mhlavink@redhat.com> - 20100924-2
changelog:
  - disable only known to be broken builtins, let other enabled
  - skip regression tests if /dev/fd is missing


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-4
changelog:
  - bind Home, End, Delete,... key correctly for emacs mode
  - do not crash when executed from deleted directory


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-5
changelog:
  - ksh could not enter directories with path containing /.something (#889748)
  - file name autocomplete prevented following numeric input (#889745)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-19
changelog:
  - fix segfault in job list code
  - do not resend signal on termination (#1092132)
  - fix brace expansion on/off
  - fix incorrect rounding of numsers 0.5 < |x| <1.0 in printf (#1080940)
  - fix parser errors related to the end of the here-document marker
  - ksh hangs when command substitution fills out the pipe buffer
  - using typeset -l with a restricted variabled caused segmentation fault
  - monitor mode was documented incorrectly
  - do not crash when unsetting running function from another one (#1105139)
  - should report an error when trying to cd into directory without execution bit
  - job locking mechanism did not survive compiler optimization
  - reading a file via command substitution did not work when any of stdin,
    stdout or stderr were closed (#1070308)
  - fix lexical parser crash


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-24
changelog:
  - cd builtin could break IO redirection
  - fix segfault when handling a trap
  - exporting fixed with variable corrupted its data
  - and more fixes


author: Robert Scheck <robert@fedoraproject.org> 1.2.76-13
changelog:
  - Replace patch from openSUSE by the Debian one to not only build
    kyotocabinet with GCC >= 6 but also with GCC >= 7 (#1307706 #c15)


author: Tomas Orsava <torsava@redhat.com> - 2.6.0-5
changelog:
  - Require the Python interpreter directly instead of using the package name
  - Resolves: rhbz#1633617


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-7
changelog:
  - Resolves: rhbz#1634268 - ECP signature check fails with
                             LASSO_DS_ERROR_SIGNATURE_NOT_FOUND when
                             assertion signed instead of response


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-8
changelog:
  - Resolves: rhbz#1730018 - lasso includes "Destination" attribute in SAML
                             AuthnRequest populated with SP
                             AssertionConsumerServiceURL when ECP workflow
                             is used which leads to IdP-side errors


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-9
changelog:
  - Resolves: rhbz#1888195 - [RFE] release (built) python3-lasso pkg (coming
                             from lasso)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-10
changelog:
  - Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping
                             vulnerability when parsing SAML responses [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-11
changelog:
  - Bump release to force the package through OSCI as the previous
    build reached CI just in time for an outage
  - Related: rhbz#1888195 - [RFE] release (built) python3-lasso pkg (comingfrom lasso)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-12
changelog:
  - Fix a dead code issue in the signature wrapping patch
  - Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping
                             vulnerability when parsing SAML responses [rhel-8]


author: Rex Dieter <rdieter@fedoraproject.org> - 2.7-4
changelog:
  - %files: less globs, use %license
  - tighten subpkg deps
  - -devel: use %doc
  - use %version in Source URL
  - simplify %setup
  - %check: make check


author: Petr Menšík <pemensik@redhat.com> - 1.7.0-14
changelog:
  - Add only extra flags to default RPM LDFLAGS
  - Fix multilib conflict of ldns-config (#1463423)
  - Make primary python3 in primary build, python2 in optional


author: Paul Wouters <paul@xelerance.com> 1.0.0-6
changelog:
  - added a make clean for 2.3.3 since .o files were left behind upstream,
    causing failure on ppc platform


author: Paul Wouters <paul@xelerance.com> 1.0.1-3
changelog:
  - Fixed changelog typo in date
  - Rebuild requested for PT_GNU_HASH support from gcc
  - Did not upgrade to 1.1.0 due to compile issues on x86_64


author: Paul Wouters <paul@xelerance.com> 1.2.0-2
changelog:
  - Own the /usr/include/ldns directory (bug #233858)
  - Removed obsoleted patch
  - Remove files form previous libtool run accidentally packages by upstream


author: Paul Wouters <paul@xelerance.com> 1.2.0-10
changelog:
  - Added sha256 DS record patch to ldns-key2ds
  - Minor tweaks for proper doc/man page installation.
  - Workaround for parallel builds


author: Paul Wouters <paul@xelerance.com> 1.2.0-11
changelog:
  - Patch for ldns-key2ds to write to stdout
  - Again remove extra set of man pages from doc
  - own /usr/include/ldns (bug 233858)


author: Paul Wouters <paul@xelerance.com> - 1.5.1-4
changelog:
  - Memory management bug when generating a sha256 key, see:
    https://bugzilla.redhat.com/show_bug.cgi?id=493953


author: Paul Wouters <paul@xelerance.com> - 1.6.0-3
changelog:
  - Added patch to compile with --without-ssl
  - Removed openssl dependancies
  - Recompiled with --without-ssl


author: Paul Wouters <paul@xelerance.com> - 1.6.1-2
changelog:
  - Added openssl dependancy back in, since we get more functionality
   when using openssl. Especially in 'drill'.


author: Paul Wouters <paul@xelerance.com> - 1.6.2-1
changelog:
  - Upgraded to 1.6.2. This fixes various bugs.
    (upstream released mostly to default with sha2 for the imminent
     signed root, but we already enabled that in our builds)


author: Paul Wouters <paul@xelerance.com> - 1.6.4-2
changelog:
  - Fix missing _ldns.so causing ldns-python to not work
  - Patch for installing ldns-python files
  - Patch for rpath in ldns-python
  - Don't install .a file for ldns-python


author: Paul Wouters <paul@xelerance.com> - 1.6.10-2
changelog:
  - Fix for losing nameserver when it drops UDP fragments in
    ldns_resolver_send_pkt [Willem Toorop <willem@NLnetLabs.nl>]
  - Added ldnsx module (to be merged into ldns soon)
    http://git.xelerance.com/cgi-bin/gitweb.cgi?p=ldnsx.git;a=summary


author: Paul Wouters <paul@xelerance.com> - 1.6.11-2
changelog:
  - Updated to 1.6.11, fixes rhbz#741026 which is CVE-2011-3581
  - Python goes into sitearch, not sitelib
  - Fix source link and spelling errors in description


author: Paul Wouters <pwouters@redhat.com> - 1.6.13-1
changelog:
  - Upgraded to 1.6.13, bugfix release
  - Added --disable-ecdsa as ECC is still banned
  - Removed --with-sha2 - it is always enabled and option was removed


author: Paul Wouters <pwouters@redhat.com> - 1.6.13-2
changelog:
  - Added reworked ldns-read-zone patch from trunk
    (adds -p for SOA padding, and -o for zeroizing timestamps/sigs)


author: Paul Wouters <pwouters@redhat.com> - 1.6.14-1
changelog:
  - [pulled before release]
  - Updated to 1.6.14
  - Removed merged in patch
  - Added new dependancy on ca-certificates for ldns-dane PKIX validation


author: Paul Wouters <pwouters@redhat.com> - 1.6.16-1
changelog:
  - Updated to 1.6.16
  - Addresses bug in 1.6.14 and 1.6.15 that affects opendnssec
    (if you have empty non-terminals and use NSEC3)


author: Tomas Hozza <thozza@redhat.com> - 1.6.16-5
changelog:
  - Fix compiler warnings and one uninitialized value
  - make ldns-config multilib clean
  - Fix man pages and usages errors


author: Paul Wouters <pwouters@redhat.com> - 1.6.17-1
changelog:
  - Updated to 1.6.17
  - Enable perl bindings via new ldns-perl sub-package
  - Enable ECDSA/GOST which is now allowed in Fedora
  - Removed patches merged upstream, ported multilib patch to 1.6.17


author: Tomas Hozza <thozza@redhat.com> - 1.6.17-2
changelog:
  - Fix error causing ldns to sometimes produce faulty DSA sign (#1077776)
  - Fix FTBFS due to perl modules


author: Paul Wouters <pwouters@redhat.com> - 1.6.17-3
changelog:
  - CVE-2014-3209 ldns: ldns-keygen generates keys with world readable permissions
  - Fix 1017958 - 32 and 64 bit ldns conflicts on some manual pages
  - Fix rhbz#1062874 - cannot install ldns.x86_64 in parallel to ldns.i686
  - Incorporate fixes from Tuomo Soini <tis@foobar.fi>
  - hardened build
  - fix ldns internal provides and requires filter
  - fix perl-ldns requirement to include %_isa
  - setup filters for perl and python bindings for internal stuff
  - split utils to separate package


author: Paul Wouters <pwouters@redhat.com> - 1.6.17-4
changelog:
  - Rename ldns-python to python-ldns
  - Rename ldns-perl to perl-ldns
  - Ensure ldns-utils is dragged it so an upgrade does not remove utils


author: Paul Wouters <pwouters@redhat.com> - 1.6.17-11
changelog:
  - Only cond_without sets "with ", so use underscores
  - multilib.patch was setting LIBDIR_SEC once without leading /


author: Rex Dieter <rdieter@fedoraproject.org> - 1.7.0-3
changelog:
  - explicitly track library soname (so bumps aren't a surprise)
  - use %license, drop dup'd README in -devel
  - BR: openssl-devel >= 1.1.0 (required for DANE verification)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.7.0-8
changelog:
  - Python 2 binary package renamed to python2-ldns
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Jan Macku <jamacku@redhat.com> - 0.97-1
changelog:
  - update to 0.97 (#2159588)
  - drop downstream patch - ipmi: avoid error messages on non-dell platforms


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Update to v346
  - Update download URL
  - use the configure marcro
  - strip binary
  - fix up lesspipe stuff (Bug #8750 and a couple of non-reported bugs)
    (Karsten, did I mention I'll kill you when you return from SAP? ;) )


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Fix up messed output if a user outputs anything in ~/.bashrc or the
    likes (Bug #9443)
  - handle RPM_OPT_FLAGS


author: Karsten Hopp <karsten@redhat.de>
changelog:
  - update URLs
  - Copyright -> License
  - fix #43348 (crashes when searching for /<)
  - fix #39849 (
    _ ignores LESSCHARDEF in displaying characters,
    _ prefaces sequences of one or "high" characters with a capital "A")


author: Karsten Hopp <karsten@redhat.de>
changelog:
  - less-378
  - added some debian patches
  - show image info instead of binary garbage when viewing images


author: Karsten Hopp <karsten@redhat.de> 378-5
changelog:
  - removed older, unused patches
  - add patch from Yukihiro Nakai to fix display of japanese text
    (#79977)


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - fix korean #79977
  - add new less.sh from #89780, s/ko/korean/ and write .csh script
  - add patch from #91661: /japanses/japanese-euc/


author: Jindrich Novy <jnovy@redhat.com> 394-2
changelog:
  - apply better fix for #120916 from Avi Kivity (#177819)
    to avoid flickering when '>' is pressed multiple times


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 436-8
changelog:
  - The new "--old-bot" option is not documented in the man page (#510724)
  - Fix descriptions of some options in online help
    (#578289, patch by Jeff Bastian <jbastian@redhat.com> [IT603793])


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 436-11
changelog:
  - Clean lesspipe.sh script
  - Split case for compressed and plain troff files
  - Add support for *.xz and *.lzma man pages (#676057)
  - Add support for reading UTF-16 and UTF-32 files (#638312)
  - Don't require correct exit status from LESSOPEN scripts until
    it gets accepted by upstream (preserve backward compatibility) (#666084, #676057)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 443-1
changelog:
  - Rebase to 443
  - Foption patch made applicable against 443
  - Manpage extra line patch removed; fixed upstream (#697451)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 444-4
changelog:
  - Avoid some unnecessary stat calls and commands in lesspipe.sh,
    patch by Ville Skyttä (#741440)
  - Use `groff' instead of `man -s' for rendering manpages to prevent
    options incompatibility between man and man-db packages (#718498)
  - Add groff to Requires


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 444-7
changelog:
  - Fix less.sh not to override user-defined LESSOPEN variable (#802757)
  - Use POSIX regcomp instead of PCRE - revert 406-11, commit 4b961c7 (#643233)
  - Merge Foption changes by Colin Guthrie to Foption.v2.patch (#805735)


author: Martin Briza <mbriza@redhat.com> - 451-1
changelog:
  - Rebase to 451 (#835802)
  - Removed the empty-lessopen-pipe patch as the issue is now fixed upstream.


author: Fridolin Pokorny <fpokorny@redhat.com> - 458-3
changelog:
  - Expanded lessecho usage (#948597)
  - Added lessfilter info to man (#948597)
  - Expanded lesskey usage (#948597)
  - Added --old-bot to help (#948597)


author: Jozef Mlich <jmlich@redhat.com> - 458-5
changelog:
  - Resolves #1036326 fixing command line parsing in lesskey
  - changed day of week in order to avoid bogus date in changelog


author: Jozef Mlich <jmlich@redhat.com> - 458-8
changelog:
  - (lesspipe) the groff was used just in case of gzipped man pages
  - (lesspipe) the exit $? should be used directly after command; 
    otherwise may return unexpected value.
  - (lesspipe) not preprocessed output was returning 1


author: Jozef Mlich <jmlich@redhat.com> - 458-10
changelog:
  - (lesspipe) better handling of exit status
    fixing regression of #186931 - turns over the lesspipe exit behavior


author: Jozef Mlich <jmlich@redhat.com> - 458-11
changelog:
  - rollback of previous problem. See explanation of upstream.
    http://greenwoodsoftware.com/less/faq.html#profileout
  - fixing exit status values (the $? should be used as soon
    as possible)


author: Viktor Jancik <vjancik@redhat.com> - 479-2
changelog:
  - Updated spec file to comply with current Fedora Packaging Guidelines
    Added missing documentation files
  - Fixed less profile.d scripts
  - Fixed preprocessing of man pages with special characters (#1241543)


author: Peter Hutterer <peter.hutterer@redhat.com> - 3.5.13-8
changelog:
  - Fix CVE-2022-46285: infinite loop on unclosed comments (#2160230)
  - Fix CVE-2022-44617: runaway loop with width of 0 (#2160232)
  - Fix CVE-2022-4883: compression depends on $PATH (#2160242)


author: José Expósito <jexposit@redhat.com> - 3.5.13-9
changelog:
  - CVE-2023-43786 libX11: stack exhaustion from infinite recursion
    in PutSubImage()
  - CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to
    a heap overflow
  - CVE-2023-43788 libXpm: out of bounds read in XpmCreateXpmImageFromBuffer()
  - CVE-2023-43789 libXpm: out of bounds read on XPM with corrupted colormap


author: Dodji Seketeli <dodji@seketeli.org> - 1.5-2
changelog:
  - Apply patches
    Support-having-several-debuginfo-search-dirs-for-a-b.patch and
    Add-a-fail-no-debug-info-to-abidiff.patch


author: Mathieu Bridon <bochecha@daitauha.fr> - 1.5-4
changelog:
  - Remove unnecessary dependencies: python3-unittest2 and wget which
    was referred to twice.
  - Better group dependencies: Many dependencies are only required for
    fedabipkgdiff, so let's put them under the right conditional.
  - Split fedabipkgdiff to its own subpackage
      This tool is very specific, and only useful to Fedora developers,
      not all developers.  It also has lots of dependencies which aren't
      required by the other tools.  Splitting it to its own specialized
      package makes the main package, with its library and utilities,
      much lighter.


author: Dodji Seketeli <dodji@redhat.com> - 1.6-1
changelog:
  - Update to upstream 1.6
  - Removed patches that are now upstream
    Support-having-several-debuginfo-search-dirs-for-a-b.patch
    Add-a-fail-no-debug-info-to-abidiff.patch


author: Dodji Seketeli <dodji@redhat.com> - 1.8-1
changelog:
  - Update to upstream 1.8
  - Add "make check-self-compare" to the regression tests
  - Add BuildRequires python3-koji


author: Dodji Seketeli <dodji@redhat.com> - 1.8.1-1
changelog:
  - Update to upstream fixes up to libabigail-1.8.1
      This encompasses this fixes, compared to the last 1.8 release:
        ir: Add better comments to types_have_similar_structure
        mainpage: Update web page for 1.8 release
        Bug 26992 - Try harder to resolve declaration-only classes
        Bug 27204 -  potential loss of some aliased ELF function symbols
        Ignore duplicated functions and those not associated with ELF symbols
        Bug 27236 - Pointer comparison wrongly fails because of typedef change
        Bug 27233 - fedabipkgdiff fails on package gnupg2 from Fedora 33
        Bug 27232 - fedabipkgdiff fails on gawk from Fedora 33
        dwarf-reader: Support fast DW_FORM_line_strp string comparison
        gen-changelog.py: Update call to subprocess.Popen & cleanup
        Bug 27255 - fedabipkgdiff fails on nfs-utils on Fedora 33
        abidiff: support --dump-diff-tree with --leaf-changes-only
        ir: Arrays are indirect types for type structure similarity purposes
        Add qualifier / typedef / array / pointer test
        abg-ir: Optimize calls to std::string::find() for a single char.
        abipkgdiff: Address operator precedence warning


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.110-12.el8
changelog:
  - Pass in the distro-provided CFLAGS and LFLAGS. (Jeff Moyer)
  - Get rid of -nostartfiles -nostdlib (Jeff Moyer)
  - Resolves: rhbz#1630578


author: Richard Hughes <richard@hughsie.com> 0.7.16-1
changelog:
  - Update to 0.7.15
  - Add UPL short name to SPDX conversion
  - Allow parsing desktop files using as_app_parse_data()
  - Do not preserve restrictive permissions when installing AppStream files
  - Modernize the validation requirements
  - Remove relative path from icon names
  - Support loading YAML from as_store_from_bytes()
  - Update list of allowed metadata licences
  - Update the SPDX license list to v3.5


author: Richard Hughes <richard@hughsie.com> 0.7.17-1
changelog:
  - New upstream release
  - Add "icon-theme" as recognised component type
  - Fix CI by moving 'future' back a bit
  - Make default content rating values match OARS semantics
  - Properly initialize unique_id_mutex


author: Richard Hughes <richard@hughsie.com> 0.7.18-1
changelog:
  - New upstream release
  - Add content rating system APIs from gnome-software
  - Add "validate-version" command
  - Allow timestamp in the future in validate-relax
  - Don't ignore localized strings that are the same as original
  - Fix crash with invalid children of <ul/>
  - Properly initialize mutexes
  - Test launchable tags in validation


author: Richard Hughes <richard@hughsie.com> 0.1.1-1
changelog:
  - New upstream release
  - Add an 'api-version' property to AsStore
  - Add the new AsUrlKind's and <architectures> from API 0.6
  - Support old-style markup-less <description> tags
  - Support the 'origin' attribute on the root node
  - Do not crash when using getting an unset description
  - Do not depend on functions introduced in Glib 2.39.1
  - Fix parsing incompletely translated AppData files


author: Richard Hughes <richard@hughsie.com> 0.1.2-1
changelog:
  - New upstream release
  - Add more API for gnome-software to use
  - Reduce the number of small attr key allocations
  - Use gperf to generate a perfect hash for the tag names
  - Use the full ID for the AsStore hash


author: Richard Hughes <richard@hughsie.com> 0.1.3-1
changelog:
  - New upstream release
  - Add new API required by gnome-software
  - Ignore settings panels when parsing desktop files
  - Load AppStream files assuming literal text strings


author: Richard Hughes <richard@hughsie.com> 0.1.4-1
changelog:
  - New upstream release
  - Add some more API for createrepo_as and gnome-software
  - Add tool appstream-util


author: Richard Hughes <richard@hughsie.com> 0.1.5-1
changelog:
  - New upstream release
  - Add some more API for createrepo_as and gnome-software
  - Be less strict with the case of the XML header
  - Check the licenses against the SPDX list when validating
  - Support AppData version 0.6 files too


author: Richard Hughes <richard@hughsie.com> 0.1.6-1
changelog:
  - New upstream release
  - Add some more API for createrepo_as and gnome-software
  - Also support validating .appdata.xml.in files
  - Correctly parse the localized descriptions from AppData files
  - Fix validation of old-style AppData files without screenshot sizes
  - Only autodetect the AsAppSourceKind when unknown
  - Only require <project_licence> when being strict
  - Only show the thumbnail when creating the HTML status page
  - Retain comments in .desktop and .appdata.xml files when required


author: Richard Hughes <richard@hughsie.com> 0.1.7-1
changelog:
  - New upstream release
  - Add <extends> from the draft AppStream 0.7 specification
  - Add support for the 'dbus' AsProvideKind
  - Add support for validating metainfo.xml files
  - Allow 'appstream-util validate' to validate multiple files
  - Do not log a critical warning in as_store_to_xml()
  - Fix a crash when we try to validate <p></p>
  - Support the non-standard X-Ubuntu-Software-Center-Name


author: Richard Hughes <richard@hughsie.com> 0.2.0-1
changelog:
  - New upstream release
  - Accept slightly truncated SPDX IDs
  - Allow any SPDX license when validating in relaxed mode
  - Allow as_node_get_attribute_as_int() to parse negative numbers
  - Allow dumping .desktop, .appdata.xml and .metainfo.xml files in appstream-util
  - Do not add addons that are packaged in the parent package
  - Do not require a content license to be included into the metadata
  - This is the first release that merges the createrepo_as project.
  - Validate the <developer_name> tag values


author: Richard Hughes <richard@hughsie.com> 0.2.1-1
changelog:
  - New upstream release
  - Add an 'appstream-util upgrade' command to convert version < 0.6 metadata
  - Add packages recursively when using appstream-builder --packages-dir
  - Allow empty URL sections
  - Fix the xmldir in the APPSTREAM_XML_RULES m4 helper


author: Richard Hughes <richard@hughsie.com> 0.2.2-1
changelog:
  - New upstream release
  - Add two new builder plugins to add kudos on KDE applications
  - Assume local files are untrusted when parsing
  - Do not allow NoDisplay=true applications to ever be in the metadata
  - Never scale up small screenshots
  - Never upscale icons, either pad or downscale with sharpening
  - Sharpen resized screenshots after resizing with a cubic interpolation
  - Write metadata of the failed applications


author: Richard Hughes <richard@hughsie.com> 0.2.3-1
changelog:
  - New upstream release
  - Add oxygen-icon-theme when an application depends on kde-runtime
  - Add some simple filtering in the status.html page
  - Be more careful with untrusted XML data
  - Do not allow duplicates to be added when using as_app_add_kudo_kind()
  - Do not fail to build packages with invalid KDE service files
  - Record if distro metadata and screenshots are being used
  - Show any package duplicates when generating metadata
  - Show the builder progress in a ncurses-style panel


author: Richard Hughes <richard@hughsie.com> 0.2.4-1
changelog:
  - New upstream release
  - Add an installed tests to validate appdata
  - Add support for <source_pkgname> which will be in AppStream 0.8
  - Add the <dbus> provide for applications automatically
  - Do not load applications with NoDisplay=true when loading local
  - Do not pad the compressed AppStream metadata with NUL bytes
  - Do not treat app-install metadata as installed
  - Markup errors should not be fatal when assembling a store


author: Richard Hughes <richard@hughsie.com> 0.2.5-1
changelog:
  - New upstream release
  - Add check-root to appstream-util
  - Add some validation rules for metainfo files
  - Allow desktop->addon demotion with an AppData file
  - Allow different source roots to define addons
  - Do not require sentence case when validating with relaxed settings
  - Fix up legacy license IDs when tokenizing
  - Metadata licenses like 'CC0 and CC-BY-3.0' are valid content licenses
  - Never add duplicate <extends> tags


author: Richard Hughes <richard@hughsie.com> 0.3.0-1
changelog:
  - New upstream release
  - Add a new kudo for high contrast icons
  - A keyword search match is better than the project name
  - Allow desktop->addon demotion with an AppData file
  - Allow translated keywords
  - Conform to the actual SPDX 2.0 license expression syntax
  - Ignore AppData screenshots with xml:lang attributes
  - Metadata licenses like 'CC0 and CC-BY-3.0' are content licenses
  - Update the SPDX license list to v1.20


author: Richard Hughes <richard@hughsie.com> 0.3.1-1
changelog:
  - New upstream release
  - Add an --enable-hidpi argument to appstream-builder
  - Add AS_ICON_KIND_EMBEDDED and AS_ICON_KIND_LOCAL
  - Add more applications to the blacklist
  - Allow application with NoDisplay=true and an AppData file
  - Allow AppStream files to be upgraded using appstream-util
  - Install AppStream files with correct permissions
  - Monitor the XML and icons path for changes
  - Relax validation requirements for font metainfo files


author: Richard Hughes <richard@hughsie.com> 0.3.2-1
changelog:
  - New upstream release
  - Add a simple 'search' command to appstream-util
  - Add some more valid metadata licenses
  - Do not generate metadata with an icon prefix
  - Obsolete the appdata-tools package
  - Show the kudo stats on the status page


author: Richard Hughes <richard@hughsie.com> 0.3.3-1
changelog:
  - New upstream release
  - Allow filtering addons in the status html pages
  - Detect missing parents in the old metadata
  - Do not fail to load all the desktop files if one is bad
  - Improve appdata-xml.m4 deprecation notice


author: Richard Hughes <richard@hughsie.com> 0.3.4-1
changelog:
  - New upstream release
  - Add more applications to the blacklist
  - Add show-search-tokens subcommand to appstream-util
  - Add some new API for gnome-software to use
  - Add the matrix-html subcommand to appstream-util
  - Add the VCS information to the AppStream metadata
  - Assume <image>foo</image> is a source image kind for AppData files
  - Assume that stock icons are available in HiDPI sizes
  - Blacklist the 40 most common search tokens
  - Check if the search entries are valid before searching
  - Check screenshots are a reasonable size
  - Fall back to the dumb tokenizer for keywords with special chars
  - Set an error if an XML file contains font markup
  - Show the offending text when validation fails


author: Richard Hughes <richard@hughsie.com> 0.3.5-1
changelog:
  - New upstream release
  - Add new API required for firmware support
  - Add new API required for OSTree and xdg-app support


author: Richard Hughes <richard@hughsie.com> 0.3.6-1
changelog:
  - New upstream release
  - Add a 'replace-screenshots' command to appstream-util
  - Always upscale screenshots if they are too small
  - Assume the INF DriverVer is UTC
  - Remove the gtk3 dep from libappstream-glib
  - Use the correct image URL for HiDPI screenshots


author: Richard Hughes <richard@hughsie.com> 0.4.0-1
changelog:
  - New upstream release
  - Add a mirror-screenshots command to appstream-util
  - Check for duplicate screenshots when adding fonts
  - Detect recolorable symbolic icons
  - Fix a crash for an invalid AppData file
  - Remove all networking support when building metadata
  - Remove overzealous blacklisting entry


author: Richard Hughes <richard@hughsie.com> 0.4.1-1
changelog:
  - New upstream release
  - Add am 'incorporate' command to appstream-util
  - Add a 'mirror-local-firmware' and 'compare' commands to appstream-util
  - Add extra flags for use when building metadata
  - Be less strict when loading incorrect AppData files
  - Do not duplicate <location> tags within a release
  - Do not expect the INF ClassGuid to be the ESRT GUID
  - Don't crash when parsing a <release> with no description
  - Update the SPDX licence list to v2.0


author: Richard Hughes <richard@hughsie.com> 0.5.0-1
changelog:
  - New upstream release
  - Add support for the flashed firmware provide kind
  - Make the DriverVer in the .inf file optional
  - Show a better error message when there's not enough text


author: Richard Hughes <richard@hughsie.com> 0.5.1-1
changelog:
  - New upstream release
  - Add a few applications that have changed desktop ID
  - Add support for release urgency
  - Do not blacklist the 'desktop' token
  - Don't show mangled version numbers as negatives
  - Ignore empty AppStream XML files
  - Support SPDX IDs with the LicenseRef prefix


author: Kalev Lember <klember@redhat.com> 0.5.1-2
changelog:
  - Backport a patch to fix icons in gnome-software for apps without AppData
  - Use license macro for COPYING


author: Richard Hughes <richard@hughsie.com> 0.5.2-1
changelog:
  - New upstream release
  - Accept a '0x' hexidecimal prefix when parsing a version
  - Add multi-guid cabinet firmware support
  - Add support for AppStream <size> metadata
  - Fix crash in validator when processing '<li></li>'
  - Remove the long-obsolete appdata-validate tool
  - Require AppData files to be present in the AppStream metadata
  - Use g_set_object() to fix potential crash when adding pixbufs


author: Richard Hughes <richard@hughsie.com> 0.5.3-1
changelog:
  - New upstream release
  - Return the correct error when the desktop file has no group
  - Strip Win32 and Linux paths when decompressing firmware


author: Richard Hughes <richard@hughsie.com> 0.5.4-1
changelog:
  - New upstream release
  - Add as_utils_version_from_uint16()
  - Generate GUID values according to RFC4122


author: Richard Hughes <richard@hughsie.com> 0.5.5-1
changelog:
  - New upstream release
  - Add as_utils_license_to_spdx()
  - Add the package name as another application search token
  - Fix a crash when tokenizing a NULL string
  - Log when we auto-add kudos or keywords
  - Support live updates


author: Richard Hughes <richard@hughsie.com> 0.5.6-1
changelog:
  - New upstream release
  - Accept various 'or later' metadata content licenses
  - Check the project_group when validating
  - Cull the application blacklist now we depend on AppData files
  - Fix things up for xdg-app use
  - Install gettext ITS rules


author: Richard Hughes <richard@hughsie.com> 0.5.8-1
changelog:
  - New upstream release
  - Add a modify command to appstream-util
  - Add support for per-user and system-wide xdg-app installed stores
  - Reject an invalid project group when parsing
  - Support multi-line copyright statements
  - Support the QT translation system
  - Support <translation> tags in AppData files


author: Richard Hughes <richard@hughsie.com> 0.5.9-1
changelog:
  - New upstream release
  - Accept FSFAP as a valid metadata license
  - Fix a validation error for metainfo files with descriptions
  - Pick up newly added appinfo dirs for xdg-app remotes
  - Update the SPDX license list


author: Richard Hughes <richard@hughsie.com> 0.5.10-1
changelog:
  - New upstream release
  - Add an application prefix to the ID for certain install scopes
  - Add a 'split-appstream' command to appstream-util
  - Add support for getting the SDK and runtime from the bundle
  - Improve the application search tokenizing and filtering
  - Load AppStream stores in a predictable order


author: Richard Hughes <richard@hughsie.com> 0.5.12-1
changelog:
  - New upstream release
  - Add a merge-appstream command to appstream-util
  - Add new API required for GNOME Software
  - Add support for content ratings
  - Split up AudioVideo into two categories


author: Richard Hughes <richard@hughsie.com> 0.5.13-1
changelog:
  - New upstream release
  - Enforce the requirement of AppData for 'Categories=DesktopSettings'
  - Also filter YAML apps before adding to the store
  - Always veto anything with X-Unity-Settings-Panel
  - Do not hardcode x86_64 when searching for xdg-app metadata
  - Support more DEP11 YAML markup


author: Richard Hughes <richard@hughsie.com> 0.5.14-1
changelog:
  - New upstream release
  - Add new API for gnome-software 3.21
  - Add search-pkgname to appstream-cmd
  - Fall back to searching in as_store_get_app_by_pkgname()
  - Ignore desktop files with X-AppStream-Ignore
  - Search /usr/share/metainfo for local files


author: Richard Hughes <richard@hughsie.com> 0.5.15-1
changelog:
  - New upstream release
  - Add all applications for all architectures when loading Flatpak apps
  - Add new API for gnome-software
  - Ignore files with invalid suffixes when building installed stores
  - Omit timestamp from gzip compressed files
  - Rename the xdg-app support to the new name: Flatpak
  - Sort archive contents by name for repeatable results


author: Richard Hughes <richard@hughsie.com> 0.5.16-1
changelog:
  - New upstream release
  - Add elementary to list of project groups
  - Allow setting the id prefix and origin using a symlink name
  - Correctly detect new AppStream apps in new directories
  - Do not rename a category ID in AsApp
  - Load metainfo files if present
  - Never allow NULL to be added to AsApp string array


author: Richard Hughes <richard@hughsie.com> 0.5.17-1
changelog:
  - New upstream release
  - Add external (X-*) keys of an app's desktop file as metadata AsApp
  - Correct disabling of timestamps for gzip
  - Do not add multiple categories for apps with AudioVideo
  - Do not emit a warning when flatpak user directory doesn't exist
  - Fall back to the country code in as_app_get_language()
  - Use libstemmer for keyword stemming


author: Richard Hughes <richard@hughsie.com> 0.5.18-1
changelog:
  - New upstream release
  - Add Sugar as a valid desktop environment
  - Add the translate URL kind
  - Do not split up the main AudioVideo category
  - Don't redundantly monitor files
  - No validation failure for lots of releases


author: Richard Hughes <richard@hughsie.com> 0.6.1-1
changelog:
  - New upstream release
  - Add new API for latest AppStream specification level
  - Add some more validation checks for keywords
  - Add support for AppStream merge components
  - Add support for Google .PAK files
  - Allow multiple components with the same ID in the AsStore
  - Convert all current component-type names
  - Do not save the 'X-' prefixed keys to the AppStream metadata
  - Ensure predictable output order of XML attributes
  - Port away from intltool
  - Remove specific support for flatpak
  - Restrict addons to the same scope and bundle kind


author: Richard Hughes <richard@hughsie.com> 0.6.2-1
changelog:
  - New upstream release
  - Add API for gnome-software
  - Do not merge all LangPack entries
  - Do not require an icon from LOCALIZATION kind
  - Do not use the prefix check when parsing YAML
  - Ignore system datadirs that are actually per-user
  - Invalidate the unique-id if any of the parts are changed
  - Make upgrade check for SPDX license string
  - Pay attention to errors from libyaml


author: Richard Hughes <richard@hughsie.com> 0.6.3-1
changelog:
  - New upstream release
  - Add a component kind of 'driver'
  - Add an easy way to add a language to an existing file
  - Add an easy way to add a modalias to an existing file
  - Support components with merge=replace rules


author: Richard Hughes <richard@hughsie.com> 0.6.4-1
changelog:
  - New upstream release
  - Add more API used by gnome-software master branch
  - Add support for AppImage bundles
  - Don't show a critical warning on invalid yaml file
  - Fix a small memory leak when parsing yaml files
  - Fix building metadata on repos with mixed architecture content
  - Fix setting the origin for Flatpak user repos
  - Fix the CSM rating age calculation
  - Never inhierit Name and Comment when using appstream-compose


author: Richard Hughes <richard@hughsie.com> 0.6.5-1
changelog:
  - New upstream release
  - Add app-removed, app-added and app-changed signals to AsStore
  - Add a 'watch' command to appstream-util
  - Allow only loading native languages when parsing AppStream
  - Allow the client to control what search fields are indexed
  - Always copy the state when replacing AppData with AppStream
  - Do not sent a REMOVED signal when deleting a transient temp file
  - Ensure the component scope is set when loading yaml files
  - Handle files being moved into monitored AppStream directories
  - Load the search token blacklist into a hash table
  - Monitor missing AppStream directories
  - Only transliterate when the locale requires it
  - Process file changes when an attribute changes


author: Richard Hughes <richard@hughsie.com> 0.6.6-1
changelog:
  - New upstream release
  - Add Geary to the app id fallbacks
  - Deduplicate the AsNode attribute key and value using a hash table
  - Detect invalid files in the libyaml read handler
  - Do not absorb core addons into the main application
  - Do not add <kudos>, <languages>, <provides> or <releases> for addons
  - Do not save the attributes if the node or parent node is ignored
  - Set a better icon for codecs


author: Richard Hughes <richard@hughsie.com> 0.6.7-1
changelog:
  - New upstream release
  - Add AsRequire as a way to store runtime requirements
  - Add support for "+" at the end of SPDX license identifiers
  - Allow loading application XPM icons
  - Fix a crash when using as_release_get_location_default()
  - Fix dep extraction when multiple versions are available
  - Only fail to validate <icon> in AppData desktop components
  - Scan /usr/share/metainfo as well when building appstream-data
  - Update the SPDX licence list to v2.5


author: Richard Hughes <richard@hughsie.com> 0.6.9-1
changelog:
  - New upstream release
  - Do not set the AsApp state using the AsRelease state
  - Fail to validate if any release is in the future or in the wrong order


author: Richard Hughes <richard@hughsie.com> 0.6.11-1
changelog:
  - New upstream release
  - Add initial support for Mozilla .xpi translations
  - Fix a problem with appstream-compose with older AppData files
  - Make content_rating required for any component with a 'Game' category
  - Parse small version numbers correctly
  - Show a warning if a desktop file is not found when required


author: Richard Hughes <richard@hughsie.com> 0.6.12-1
changelog:
  - New upstream release
  - Validate kudos in AppData and AppStream files
  - Copy hash table keys to avoid a common crash on Ubuntu
  - Fix the predicate comparison when using globs in metainfo files


author: Richard Hughes <richard@hughsie.com> 0.6.13-1
changelog:
  - New upstream release
  - Add a 'check-component' command to appstream-util
  - Add new API for gnome-software and fwupd
  - Add support for icon scaling and <launchable>
  - Allow using the app origin as a search keyword
  - Casefold all stemmed entries
  - Support non-numeric version numbers correctly


author: Richard Hughes <richard@hughsie.com> 0.7.0-1
changelog:
  - New upstream release
  - Add the limits in the validation output messages
  - Do not enforce that the project is a valid environment_id
  - Don't cast gsize to guint32 when getting file length
  - Remove the cache-id functionality
  - Show a warning if adding keywords after the cache creation
  - Switch to the meson build system


author: Richard Hughes <richard@hughsie.com> 0.7.1-1
changelog:
  - New upstream release
  - Add <id> kinds for application provides
  - Fail to validate if AppData screenshots are duplicated
  - Install appdata-xml.m4
  - Skip loading desktop data from Snap directory
  - Update the SPDX license list to 2.6
  - Validate the <id> format according to the spec


author: Richard Hughes <richard@hughsie.com> 0.7.2-1
changelog:
  - New upstream release
  - Allow remote icon types for desktop AppData files
  - Do not check the suffix of <id> tags
  - Prefer /usr/share/metainfo as default path for metainfo files


author: Richard Hughes <richard@hughsie.com> 0.7.3-1
changelog:
  - New upstream release
  - Add new API required by fwupd
  - Do not assign "flatpak" as an app's origin when no origin was found
  - Fix the inode mode to be sane on extracted files
  - Prefer /usr/share/metainfo as default path for metainfo files
  - Write XML for newer AppStream specification versions


author: Richard Hughes <richard@hughsie.com> 0.7.5-1
changelog:
  - New upstream release
  - Add more GObject Introspection annotations for Python
  - Do not try to extract duplicate files in the icon theme packages
  - Don't expect an enum when really passing a bitfield
  - Fix a crash when calling as_release_add_location() directly
  - Fix appstream-compose when using new-style desktop IDs
  - Fix compile with GCab v1.0
  - Fix the arithmetic when fitting an image in 16:9
  - Generate icons and samples for emoji fonts
  - Never change the default screenshot when processing AppData
  - Support OARS v1.1 additions
  - Use pngquant to make the application icons take up less space


author: Richard Hughes <richard@hughsie.com> 0.7.7-1
changelog:
  - New upstream release
  - Add custom metadata key for shell extension uuid
  - Always resize AppStream icons to fit the destination size
  - Correctly validate files using OR in the metadata_license
  - Do not fail to validate if the timestamps are out of order
  - Don't abort the build if pngquant fails
  - Update the SPDX license list to v3.0


author: Richard Hughes <richard@hughsie.com> 0.7.8-1
changelog:
  - New upstream release
  - Add as_version_string() for fwupd
  - Add support for component agreements
  - Correctly compare version numbers like '1.2.3' and '1.2.3a'
  - Don't include the path component in the name when parsing the package filename
  - If the launchable is specified don't guess it when composing
  - Never add more than one component to the AppStream store when composing


author: Richard Hughes <richard@hughsie.com> 0.7.9-1
changelog:
  - New upstream release
  - Convert local icons found in metainfo files
  - Follow the Debian tilde usage when ordering versions
  - Use the launchable to find the desktop filename


author: Richard Hughes <richard@hughsie.com> 0.7.10-1
changelog:
  - New upstream release
  - Do not parse firmware files anymore
  - Do not require a release transaction when validating in relaxed mode
  - Extract release descriptions and agreement sections for translation


author: Richard Hughes <richard@hughsie.com> 0.7.11-1
changelog:
  - New upstream release
  - Add AS_APP_QUIRK_DEVELOPER_VERIFIED
  - Escape quotes in attributes
  - Provide async variants of store load functions


author: Richard Hughes <richard@hughsie.com> 0.7.13-1
changelog:
  - New upstream release
  - Do not restrict the maximum number of releases allowed
  - Throw an error when a launchable desktop-id is invalid


author: Richard Hughes <richard@hughsie.com> 0.7.14-1
changelog:
  - New upstream release
  - Add new API for gnome-software
  - Set the AppStream ID from the X-Flatpak desktop key


author: Richard Hughes <richard@hughsie.com> 0.7.18-5
changelog:
  - Backport a patch from upstream to fix handling unknown tags in AppStream metadata
  - Resolves: #RHEL-34564


author: Liwei Ge <geliwei@openanolis.org> - 7.6.2-3.0.2
changelog:
  - Spec: sync loongson patch and modify in spec (XueZhixin)
    Patch :0001-libatomic_ops-7.6.2-add-loongarch.patch


author: Vojtech Trefny <vtrefny@redhat.com> - 2.3-1
changelog:
  - Fix memory leak in bs_size_new_from_str (vtrefny)
  - Translated using Weblate (Turkish) (oguzersen)
  - add translation platform widget (jean-baptiste)
  - Update translation files (noreply)
  - Do not regenerate POT file during 'make release' (vtrefny)
  - Remove Zanata from our build and release processes (vtrefny)
  - Add PO files to git (vtrefny)
  - Sync spec with downstream (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 2.4-1
changelog:
  - Add Travis build status badge (vtrefny)
  - Add Travis CI config and Dockerfiles for running tests (vtrefny)
  - Add ansible playbook for installing test dependencies (vtrefny)
  - remove msgcat dependency (Aduskett)
  - Translated using Weblate (Bengali (India)) (akarshan.biswas)
  - Update translation files (noreply)
  - Added translation using Weblate (Bengali (India)) (akarshan.biswas)
  - Fix library version in pkgconfig file (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 2.5-1
changelog:
  - Translated using Weblate (Hebrew) (sh.yaron)
  - Added translation using Weblate (Hebrew) (sh.yaron)
  - Add support to ppc64le for debian build (74309971+gururajrkatti)
  - Translated using Weblate (Finnish) (ricky.tigg)
  - tools: Read input from stdin when not running in a tty (vtrefny)
  - travis: Print logs after failed tests (vtrefny)
  - tests: Run pylint and pycodestyle on bscalc (vtrefny)
  - bscalc: Add option to print only single "human readable" result (vtrefny)
  - travis: Add --nogpgcheck when using dnf on Fedora (vtrefny)
  - Translated using Weblate (Asturian) (fitoschido)
  - Update translation files (noreply)
  - Translated using Weblate (Spanish) (fitoschido)
  - Sync spec with downstream (vtrefny)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Make inline function __comps_objmrtree_all also static (RhBug:1793424)
  - Fix memory leaks and resource leaks
  - Fix: Check result "comps_parse_parsed_init()"


author: Filip Januš <fjanus@redhat.com> 5.3.28-42
changelog:
  - Apply the previous change only on aarch64 to limit the risk of unwanted impact
  - Resolves: #1992402


author: Richard W.M. Jones <rjones@redhat.com> - 1.14-1
changelog:
  - Rebase to 1.14.
  - Use newer upstream fork at https://github.com/ofalk/libdnet
  - Drop multilib fix now uptream (RHBZ#342001 RHBZ#1915838).
  - Drop unapplied shrext patch, no longer needed.


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-8
changelog:
  - Substitute all repository config options (fixes substitution of baseurl)
  - Use solvfile userdata to store and check checksums and solv versions
  - Fix handling transaction id in resolveTransactionItemReason
  - Set short action for Reason Change


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-10
changelog:
  - Do not print errors on failovermethod repo option
  - the dnf_context_remove() function accepts `<package-spec>`, doc updates
  - advisory upgrade: filter out advPkgs with different arch


author: Liu Xiaoping <lxp01404969@alibaba-inc.com> - 0.63.0-17.0.1
changelog:
  - Disable rhsm support in Anolis (geliwei@openanolis.org)
  - rebrand: fix platform compatibility (geliwei@openanolis.org)
  - Add loongarch64 to arch_map (liwei.glw@alibaba-inc.com)


author: Jaroslav Mracek <jmracek@redhat.com> - 0.10.1-1
changelog:
  - Update to 0.10.1
  - It improves query performance with name and arch filters. Also nevra filter will now
    handle string with or without epoch.
  - Additionally for python bindings it renames NEVRA._has_just_name() to NEVRA.has_just_name() due
    to movement of code into c part of library.
  - Resolves: rhbz#1260242 - --exclude does not affect dnf remove's removal of requirements
  - Resolves: rhbz#1485881 - DNF claims it cannot install package, which have been already installed
  - Resolves: rhbz#1361187 - [abrt] python-ipython-console: filter_updown(): python3.5 killed by SIGABRT


author: Jaroslav Mracek <jmracek@redhat.com> - 0.11.1-1
changelog:
  - Rerelease of 0.11.1-1
  - Improvement query performance
  - Run file query in hy_subject_get_best_solution only for files (arguments that start with ``/`` or
    ``*/``)
  - Resolves: rhbz#1498207 - DNF crash during upgrade installation F26 -> F27


author: Daniel Mach <dmach@redhat.com> - 0.16.1-1
changelog:
  - [module] Implement 'module_hotfixes' conf option to skip filtering RPMs from hotfix repos.
  - [goal] Fix distupgrade filter, allow downgrades.
  - [context] Allow to set module platform in context.
  - [module] Introduce proper modular dependency solving.
  - [module] Platform pseudo-module based on /etc/os-release.
  - [goal] Add Goal::listSuggested().
  - [l10n] Support for translations, add gettext build dependency.


author: Daniel Mach <dmach@redhat.com> - 0.17.0-1
changelog:
  - [conf] Add module_platform_id option.
  - [module] Add ModulePackageContainer class.
  - [module] Add ModulePersistor class.
  - [sack] Module filtering made available in python API
  - [sack] Module auto-enabling according to installed packages


author: Daniel Mach <dmach@redhat.com> - 0.17.1-1
changelog:
  - [module] Solve a problem in python constructor of NSVCAP if no version.
  - [translations] Update translations from zanata.
  - [transaction] Fix crash after using dnf.comps.CompsQuery and forking the process in Anaconda.
  - [module] Support for resetting module state.
  - [output] Introduce wrapper for smartcols.


author: Daniel Mach <dmach@redhat.com> - 0.17.2-2
changelog:
  - [module] Create /etc/dnf/modules.d if it doesn't exist.
  - [module] Forward C++ exceptions to bindings.


author: Daniel Mach <dmach@redhat.com> - 0.18.0-1
changelog:
  - [repo] Implement GPG key import
  - [repo] Introduce Repo class replacing dnf.repo.Repo
  - [context] Fix memory corruption in dnf_context
  - [rhsm] Fix: RHSM don't write .repo file with same content (RhBug:1600452)
  - [module] Create /etc/dnf/modules.d if it doesn't exist.
  - [module] Forward C++ exceptions to bindings.


author: Jaroslav Mracek <jmracek@redhat.com> - 0.19.0-1
changelog:
  - [query] Reldeps can contain a space char (RhBug:1612462)
  - [transaction] Avoid adding duplicates via Transaction::addItem()
  - Fix compilation errors on gcc-4.8.5
  - [module] Make available ModuleProfile using SWIG
  - [module] Redesign module disable and reset


author: Jaroslav Mracek <jmracek@redhat.com> - 0.19.1-1
changelog:
  - Fix compilation errors on gcc-4.8.5
  - [module] Allow module queries on disabled modules (RhBug:1627081)


author: Jaroslav Mracek <jmracek@redhat.com> - 0.20.0-1
changelog:
  - [module] Report module solver errors
  - [module] Enhance module commands and errors
  - [transaction] Fixed several problems with SWDB
  - Remove unneeded regex URL tests (RhBug:1598336)
  - Allow quoted values in ini files (RhBug:1624056)
  - Filter out not unique set of solver problems (RhBug:1564369)
  - Resolves: rhbz#1614531 - dnf 3.2 does not depsolve correctly
  - Resolves: rhbz#1614346 - dnf rollback doesn't work after install/downgrade/upgrade
  - bug 1605274 - DNF crashes on * in installation repository URL
  - Resolves: rhbz#1623383 - dnf.exceptions.ConfigError: Error parsing ...


author: Jaroslav Mracek <jmracek@redhat.com> - 0.22.0-1
changelog:
  - Fix segfault in repo_internalize_trigger (RhBug:1375895)
  - Change sorting of installonly packages (RhBug:1627685)
  - [swdb] Fixed pattern searching in history db (RhBug:1635542)
  - Check correctly gpg for repomd when refresh is used (RhBug:1636743)
  - [conf] Provide additional VectorString methods for compatibility with Python list.
  - [plugins] add plugin loading and hooks into libdnf


author: Jaroslav Mracek <jmracek@redhat.com> - 0.22.0-2
changelog:
  - Add patch Modify-solver_describe_decision-to-report-cleaned-RhBug1486749
  - Add patch swdb-create-persistent-WAL-files-RhBug1640235
  - Add patch Relocate-ModuleContainer-save-hook-RhBug1632518
  - Add patch Test-if-sack-is-present-and-run-save-module-persistor-RhBug1632518


author: Jaroslav Mracek <jmracek@redhat.com> - 0.22.3-1
changelog:
  - Permanently disable Python2 build for Fedora 30+
  - Update to 0.22.3
  - Modify solver_describe_decision to report cleaned (RhBug:1486749)
  - [swdb] create persistent WAL files (RhBug:1640235)
  - Relocate ModuleContainer save hook (RhBug:1632518)
  - [transaction] Fix transaction item lookup for obsoleted packages (RhBug: 1642796)
  - Fix memory leaks and memory allocations
  - [repo] Possibility to extend downloaded repository metadata


author: Daniel Mach <dmach@redhat.com> - 0.22.4-1
changelog:
  - Enhance LIBDNF plugins support
  - [repo] Check whether metadata cache is expired (RhBug:1539620,1648274)
  - [sack] Implement dnf_sack_get_rpmdb_version()


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.33.0-1
changelog:
  - Update to 0.33.0
  - Enhance sorting for module list (RhBug:1590358)
  - [DnfRepo] Add methods for alternative repository metadata type and download (RhBug:1656314)
  - Remove installed profile on module enable or disable (RhBug:1653623)
  - Enhance modular solver to handle enabled and default module streams differently (RhBug:1648839)
  - Add support of wild cards for modules (RhBug:1644588)
  - Exclude module pkgs that have conflict
  - Enhance config parser to preserve order of data, and keep comments and format
  - Improve ARM detection
  - Add support for SHA-384
  - Return empty query if incorrect reldep (RhBug:1687135)
  - ConfigParser: Improve compatibility with Python ConfigParser and dnf-plugin-spacewalk (RhBug:1692044)
  - ConfigParser: Unify default set of string represenation of boolean values
  - Fix segfault when interrupting dnf process (RhBug:1610456)
  - Installroot now requires absolute path
  - Support "_none_" value for repo option "proxy" (RhBug:1680272)
  - Add support for Module advisories
  - Add support for xml:base attribute from primary.xml (RhBug:1691315)
  - Improve detection of Platform ID (RhBug:1688462)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.35.1-1
changelog:
  - Update to 0.35.1
  - Skip invalid key files in "/etc/pki/rpm-gpg" with warning (RhBug:1644040)
  - Enable timestamp preserving for downloaded data (RhBug:1688537)
  - Fix 'database is locked' error (RhBug:1631533)
  - Replace the 'Failed to synchronize cache' message (RhBug:1712055)
  - Fix 'no such table: main.trans_cmdline' error (RhBug:1596540)
  - Fix: skip_if_unavailable=true for local repositories (RhBug:1716313)
  - Add support of modular FailSafe (RhBug:1623128)
  - Add support of DNF main config file in context; used by PackageKit and
    microdnf (RhBug:1689331)
  - Exit gpg-agent after repokey import (RhBug:1650266)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.35.1-4
changelog:
  - Fix typo in error message (RhBug:1726661)
  - Update localizations from zanata (RhBug:1689991)
  - Don't disable nonexistent but required repositories (RhBug:1689331)
  - Ignore trailing blank lines of multiline value (RhBug:1722493)
  - Re-size includes map before re-computation (RhBug:1725213)


author: Ales Matej <amatej@redhat.com> - 0.35.5-1
changelog:
  - Update to 0.35.5
  - Make libdnf own its plugin directory (RhBug:1714265)
  - Set priority of dnf.conf.d drop-ins
  - Fix toString() to not insert [] (RhBug:1584442)
  - Fix handling large number of filenames on input (RhBug:1690915)
  - Detect armv7 with crypto extension only on arm version >= 8
  - A new standardized User-Agent field consisting of the libdnf and OS version
    (including the variant) (RhBug:1156007)
  - Add basic countme support (RhBug:1647454)
  - Fix crash in PackageKit (RhBug:1636803)
  - Do not create @System.solv files (RhBug:1707995)
  - Set LRO_CACHEDIR so zchunk works again (RhBug:1739867)
  - Improve detection of extras packages by comparing (name, arch) pair instead
    of full NEVRA (RhBuh:1684517)
  - Improve handling multilib packages in the history command (RhBug:1728637)
  - Repo download: use full error description into the exception text (RhBug:1741442)
  - Properly close hawkey.log (RhBug:1594016)
  - Fix dnf updateinfo --update to not list advisories for packages updatable
    only from non-enabled modules
  - Apply modular filtering by package name (RhBug:1702729)


author: Ales Matej <amatej@redhat.com> - 0.38.1-1
changelog:
  - Update to 0.38.1
  - Change the best option default to false
  - Use more descriptive message when failed to retrieve GPG key (RhBug:1605117)
  - Add removeMetadataTypeFromDownload function to the API
  - Context part of libdnf can now read vars (urlvars) from dirs and environment
  - Throw exception immediately if file cannot be opened
  - Add test when there is no primary metadata in compatible format (RhBug:1744960)
  - Various improvements to countme features
  - Don't abort on rpmdb checksum calculation failure
  - Enable module dependency trees when using set_modules_enabled_by_pkgset() (RhBug:1762314)
  - Resolve problem with --best and search in provides (RhBug:1737469)
  - New method "Query::filterSubject()", replaces Solution::getBestSolution()
  - The Solution class was removed
  - Add query argument into get_best_query and get_best_solution
  - Add module reset function into dnf_context
  - Add method to get all repository metadata locations
  - Catch NoModuleException in case of not existent value was used in persistor (RhBug:1761773)


author: Ales Matej <amatej@redhat.com> - 0.39.1-1
changelog:
  - Update to 0.39.1
  - Report reason how package was excluded (RhBug:1649754)
  - Additional Arm detection improvements (RhBug:1691430)
  - Set skip_if_unavailable for media repos to skip their update (RhBug:1716067)
  - Add support of xml:base for remote and local url in context (RhBug:1734350,1717865)


author: Ales Matej <amatej@redhat.com> - 0.39.1-3
changelog:
  - Add two new query filters: obsoletes_by_priority, upgrades_by_priority (RhBug:1769466)
  - [context] Add wildcard support in dnf_context_repo_set_data (RhBug:1781420)
  - Remove killGpgAgent function (RhBug:1781601)


author: Ales Matej <amatej@redhat.com> - 0.47.0-1
changelog:
  - Update to 0.47.0
  - Allow excluding packages with "excludepkgs" and globs
  - Make parsing of reldeps more strict (RhBug:1788107)
  - Add expanding solvable provides for dependency matching (RhBug:1534123)
  - DnfRepo: fix module_hotfixes keyfile priority level
  - Add custom exceptions to libdnf interface
  - Port to libmodulemd-2 API (RhBug:1693683)
  - Add prereq_ignoreinst & regular_requires properties for pkg (RhBug:1543449)
  - Reset active modules when no module enabled or default (RhBug:1767351)
  - Add comment option to transaction (RhBug:1773679)
  - Baseurl is not exclusive with mirrorlist/metalink (RhBug:1775184)
  - Add new function to reset all modules in C API (dnf_context_reset_all_modules)
  - Handle situation when an unprivileged user cannot create history database (RhBug:1634385)
  - Add query filter: latest by priority
  - Add setter for running kernel protection setting
  - Add DNF_NO_PROTECTED flag to allow empty list of protected packages
  - Config options: only first empty value clears existing (RhBug:1788154)
  - [conf] Set useful default colors when color is enabled
  - [context] Use installonly_limit from global config (RhBug:1256108)
  - [context] Add API to get/set "install_weak_deps"
  - [context] Adds support for includepkgs in repository configuration.
  - [context] Adds support for excludepkgs, exclude, includepkgs, and disable_excludes in main configuration.
  - [context] Added function dnf_transaction_set_dont_solve_goal
  - [context] Added functions dnf_context_get/set_config_file_path
  - [context] Respect "plugins" global conf value
  - [context] Add API to disable/enable plugins
  - [context] Create new repo instead of reusing old one (RhBug:1795004)
  - [context] Error when main config file can't be opened (RhBug:1794864)
  - [context] Add function function dnf_context_is_set_config_file_path
  - [context] Support repositories defined in main configuration file


author: Nicola Sella <nsella@redhat.com> - 0.48.0-1
changelog:
  - Update to 0.48.0
  - swdb: Catch only SQLite3 exceptions and simplify the messages
  - MergedTransaction list multiple comments (RhBug:1773679)
  - Modify CMake to pull *.po files from weblate
  - Optimize DependencyContainer creation from an existing queue
  - fix a memory leak in dnf_package_get_requires()
  - Fix memory leaks on g_build_filename()
  - Fix memory leak in dnf_context_setup()
  - Add `hy_goal_favor` and `hy_goal_disfavor`
  - Define a cleanup function for `DnfPackageSet`
  - dnf-repo: fix dnf_repo_get_public_keys double-free
  - Do not cache RPMDB
  - Use single-quotes around string literals used in SQL statements
  - SQLite3: Do not close the database if it wasn't opened (RhBug:1761976)
  - Don't create a new history DB connection for in-memory DB
  - transaction/Swdb: Use a single logger variable in constructor
  - utils: Add a safe version of pathExists()
  - swdb: Handle the case when pathExists() fails on e.g. permission
  - Repo: prepend "file://" if a local path is used as baseurl
  - Move urlEncode() to utils
  - utils: Add 'exclude' argument to urlEncode()
  - Encode package URL for downloading through librepo (RhBug:1817130)
  - Replace std::runtime_error with libdnf::RepoError
  - Fixes and error handling improvements of the File class
  - [context] Use ConfigRepo for gpgkey and baseurl (RhBug:1807864)
  - [context] support "priority" option in .repo config file (RhBug:1797265)


author: Nicola Sella <nsella@redhat.com> - 0.48.0-3
changelog:
  - Add log file level main config option (RhBug:1802074)
  - Accept '==' as an operator in reldeps (RhBug:1847946)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-1
changelog:
  - Add vendor to dnf API (RhBug:1876561)
  - Add formatting function for solver error
  - Add error types in ModulePackageContainer
  - Implement module enable for context part
  - Improve string formatting for translation
  - Remove redundant printf and change logging info to notice (RhBug:1827424)
  - Add allow_vendor_change option (RhBug:1788371) (RhBug:1788371)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-3
changelog:
  - Avoid multilib file conflict in config.h (RhBug:1918818)
  - [modules] Add special handling for src artifacts (RhBug:1809314)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-4
changelog:
  - [context] improve retrieving repository configuration
  - Allow loading incomplete cache and loading ext solv files without its repodata


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-1
changelog:
  - Update to 0.62.0
  - Hardening: add signature check with rpmcliVerifySignatures (RhBug:1932079)
  - Support allow_vendor_change setting in dnf context API
  - Add a new option module_obsoletes
  - Add new API applyObsoletes() function to apply modular obsoletes
  - Do not allow 1 as installonly_limit value (RhBug:1926261)
  - Add a config option to check TLS certificate revocation status (using OCSP stapling), defaults to false (RhBug:1814383)
  - Swdb: Add a method to get the current transaction
  - [context,API] Functions for accessing main/global configuration options
  - [context,API] Function for adding setopt
  - Add getter for modular obsoletes from ModuleMetadata
  - Add ModulePackage.getStaticContext() and getRequires()
  - Fix modular queries with the new solver
  - Fix: Fully set ssl in newHandle function
  - [conf] Add options for working with certificates used with proxy
  - Modify module NSVCA parsing - context definition (RhBug:1926771)
  - [context] Fix: dnf_package_is_installonly (RhBug:1928056)
  - Add getApplicablePackages to advisory and isApplicable to advisorymodule
  - Keep isAdvisoryApplicable to preserve API
  - [context] Support config file option "proxy_auth_method", defaults "any"
  - Support main config file options "installonlypkgs" and "protected_packages". Changes behaviour of microdnf and PackageKit.
  - Properly handle multiple collections in updateinfo.xml (RhBug:1804234)
  - Fix a crash when [media] section in .treeinfo is missing for bootable media (RhBug:1946024)
  - Add new dnf_context_module_install() C API


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-2
changelog:
  - Fix: dnf_context_module_install: memory leaks
  - covscan: remove unused vars, mark private func static, return values
  - DNF does not fail on non UTF-8 file names in a package


author: Jaroslav Rohel <jrohel@redhat.com> - 0.63.0-18
changelog:
  - filterAdvisory: match installed_solvables sort with lower_bound (RhBug:2212838, RHEL-1244)
  - Avoid reinstalling installonly packages marked for ERASE (RhBug:2163474, RHEL-1253)


author: Liu Xiaoping <lxp01404969@alibaba-inc.com> - 0.63.0-19.0.1
changelog:
  - Disable rhsm support in Anolis (geliwei@openanolis.org)
  - rebrand: fix platform compatibility (geliwei@openanolis.org)
  - Add loongarch64 to arch_map (liwei.glw@alibaba-inc.com)
  - cherry-pick `add sw arch #9c8c414fae68cb1faed14be823ab34eb6ff00028`. (nijie@wxiat.com)


author: Jerry James <loganjerry@gmail.com> - 3.1-23.20170329cvs
changelog:
  - Add gcc BR
  - Build verbosely
  - Drop obsolete --enable-widec configure option
  - Fix "unused direct shared library dependency" warning from rpmlint again
  - Fix man page error due to BSD nroff macro that is not available on Linux
  - Drop explicit R on pkgconfig from the -devel package, autogenerated


author: DJ Delorie <dj@redhat.com> - 3.1-24
changelog:
  - Use /etc/sysconfig/libffi-force-shared-memory-check-first to
    override selinux permissions check for shared memory access (#2014228)


author: Hans de Goede <hdegoede@redhat.com> - 1.1.2-3
changelog:
  - Pass --with-fontrootdir to ./configure so that libfontenc can find the
    encoding files (rhbz#1046341)


author: Parag Nemade <paragn AT fedoraproject DOT org> - 1.1.3-13
changelog:
  - ant-nodeps is dropped from ant-1.9.0-2 build in rawhide
  - Drop buildroot, %clean, %defattr and removal of buildroot in %install


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
changelog:
  - make only_urandom a default in non-presence of configuration file
  - run the full FIPS selftests only when the library is called from
    application


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-3
changelog:
  - add CMAC selftest for FIPS POST
  - add continuous FIPS entropy test
  - disable non-approved FIPS hashes in the enforced FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
changelog:
  - new upstream version 1.8.5
  - AES performance improvements backported from master branch
  - FIPS module is implicit with kernel FIPS flag
  - always run the FIPS selftests if FIPS module is installed


author: Jakub Jelen <jjelen@redhat.com> - 1.8.5-6
changelog:
  - Fix for CVE-2021-40528 (#1971421)
  - Enable HW optimizations in FIPS (#1976137)
  - Performance enchancements for ChaCha20 and Poly1305 (#1855231)


author: Kalev Lember <klember@redhat.com> - 0.12.2-2
changelog:
  - Remove no longer needed ldconfig_scriptlets macro call
  - Remove explicit byte compilation as the automatic works for flatpak builds now


author: Brian C. Lane <bcl@redhat.com> - 0.26.4-1
changelog:
  - Update to libgit2-glib-0.26.4
  - Switch to using meson build system
  - Disable SSH so that libssh2 is not required
  - Add README.rhel8 explaining why SSH is disabled


author: Alexander Larsson <alexl@redhat.com> - 0.4.2-1
changelog:
  - update to 0.4.2
  - Change %description to reflect newer features
  - Remove TODO file from %doc as it's not included anymore
  - Explicitly disable the python bindings, they are in the python-gpod package in
    Extras until the Core/Extras merge


author: Todd Zullinger <tmz@pobox.com> - 0.5.2-1
changelog:
  - update to 0.5.2
  - replace %makeinstall with %{__make} DESTDIR=%{buildroot} install
  - build python bindings, merging python-gpod package from extras
  - make %setup quiet
  - patch to fixup building of the python docs, BR libxslt
  - update license tag


author: Todd Zullinger <tmz@pobox.com> - 0.6.0-2
changelog:
  - add the NEWS file, which contains some info on getting newer iPods working
  - split out API docs into a separate package
  - set %defattr for python-gpod


author: Todd Zullinger <tmz@pobox.com> - 0.6.0-8
changelog:
  - The -devel package should require gtk2-devel as well
  - Add gdk-pixbuf-2.0 to the pkg-config file requirements


author: Todd Zullinger <tmz@pobox.com> - 0.6.0-10
changelog:
  - Fix path to hal callout (this should help setup the SysInfoExtended
    file automagically)
  - Use /var/run/hald as mount dir for hal callout
  - Require hal
  - Require main package for the -doc subpackage


author: Todd Zullinger <tmz@pobox.com> - 0.7.2-1
changelog:
  - Update to 0.7.2
  - Make doc subpackage noarch (on Fedora >= 10)
  - Drop --with-hal-callouts-dir from configure, the upstream default works now


author: Todd Zullinger <tmz@pobox.com> - 0.7.90-1
changelog:
  - Update to 0.7.90
  - Adjust default hal callout path (#547049)
    (Temporaily use --with-hal-callouts-dir=%{_libexecdir}/scripts)


author: Todd Zullinger <tmz@pobox.com> - 0.7.93-1
changelog:
  - Update to 0.7.93
  - Drop upstreamed mount-dir location patch
  - Fix temp mount dir configure option typo
  - Drop duplicate libimobiledevice-devel BR
  - Remove pointless %{__$command} macros


author: Christian Krause <chkr@fedoraproject.org> - 0.8.0-5
changelog:
  - Change patch to fix 32 bit issues in the mono bindings
    (Itdb_Track data structure contained wrong values on x86 systems)


author: Christian Krause <chkr@fedoraproject.org> - 0.8.2-1
changelog:
  - Update to 0.8.2
  - Drop upstreamed patches
  - Prevent python-gpod from advertising _gpod.so in its Provides


author: Rex Dieter <rdieter@fedoraproject.org> - 0.8.2-7
changelog:
  - libgpod.pc Requires: libimobiledevice-1.0 ... overlinking (#818594)
  - tighten subpkg deps (via %_isa)
  - omit -devel deps that (should) get autodetected already


author: Christophe Fergeau <cfergeau@redhat.com> 0.8.3-1
changelog:
  - Update to libgpod 0.8.3, this is a bugfix release which should fix
    rhbz#921831 rhbz#925750 rhbz#951167


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.8.3-20
changelog:
  - Python 2 binary package renamed to python2-gpod
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Richard Hughes <richard@hughsie.com> 0.2.10-1
changelog:
  - New upstream version
  - Correctly detect removed devices when rescanning
  - Fix a memory leak when using control tranfers
  - Fix symbol version table up to version 0.2.9


author: Kalev Lember <klember@redhat.com> - 1.1.90-2
changelog:
  - Update to 1.1.90 and libhandy 1 ABI, based on earlier libhandy1 packaging
  - Obsolete separate libhandy1 and libhandy1-devel packages


author: Mike FABIAN <mfabian@redhat.com> - 60.2-4
changelog:
  - Add negative-daylight-savings.patch from upstream.
    (see http://bugs.icu-project.org/trac/ticket/13566 and
    http://bugs.icu-project.org/trac/changeset/40954)


author: Parag Nemade <pnemade AT redhat DOT com> - 60.2-7
changelog:
  - Resolves:rh#1602551 - Fix specfile by adding compile options
  - also add BuildRequires for gcc and gcc-c++
  - Correct the upstream URL


author: Mike FABIAN <mfabian@redhat.com> - 60.3-1
changelog:
  - Update to 60.3 maintenance release including support for new Japanese era Reiwa (令和).
  - Resolves: rhbz#1677093


author: Mike FABIAN <mfabian@redhat.com> - 60.3-2
changelog:
  - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch
  - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch
  - Resolves: rhbz#1808238


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.2.11-24
changelog:
  - Python 2 binary package renamed to python2-libieee1284
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Bastien Nocera <bnocera@redhat.com> - 1.2.1-0.1
changelog:
  + libimobiledevice-1.2.1-0.1
  - Add support for newer devices
  - This is a snapshot of the in-development 1.2.1 version


author: Peter Hutterer <peter.hutterer@redhat.com> 1.12.3-3
changelog:
  - Allow for the tablet mode quirk to apply to touchpads (#1664225)
  - Add a quirk for the Asus VivoBook Flip to keep the
    keyboard and touchpad working in tablet mode


author: Robert Scheck <robert@fedoraproject.org> 1.5.2-5
changelog:
  - Don't ship API docs twice (devel and doc subpackages)
  - Reworked spec file to build libisoburn1 for RHEL >= 8


author: Adam Tkac <atkac redhat com> 0.0.93-6
changelog:
  - improve package description a little (#600243)
  - include example.c as %doc in the -devel subpackage


author: Adam Tkac <atkac redhat com> 1.0.0-1
changelog:
  - update to 1.0.0
  - patches merged
    - libjpeg-turbo-programs.patch
    - libjpeg-turbo-nosimd.patch
  - add libjpeg provides to the main package to workaround problems with broken
    java-1.6.0-openjdk package


author: Petr Hracek <phracek@redhat.com> - 1.3.1-1
changelog:
  - New upstream version
  - Remove upstreamed patches, add missing jpegint.h
  - Clean up SPEC file
  - Disable --static subpackage
  - Remove libjpeg obsolency, removed in Fedora 13


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-16_1
changelog:
  - [RHEL] Apply 'Add missing dependencies to the tests package'
  - [RHEL] Apply 'Update patch from upstream'


author: Sahana Prasad <sahana@redhat.com> - 1.1.5-3
changelog:
  - Enables building on old kernels [sync fix in Fedora from omosnance].
  - This is required for covscans as they run on RHEL7 machines.


author: Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.3
changelog:
  - Move libraries to /%{_lib} instead of %{_libdir}, which is useful
    during boot when the library might be needed before a potentially
    seperate /usr partition is mounted


author: Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.8
changelog:
  - Move the kcapi-hasher binary to -replacements package, since it is
    not of much use without the linked invocation names and saves the
    extra Requires on the -tools package


author: Björn Esser <besser82@fedoraproject.org> - 1.0.3-2
changelog:
  - Decrease optmem_max preset to 40960
  - Let the build fail, if the minimum kernel version cannot be met
  - Conditionalize the sysctl.d tweak on version of the kernel
  - Conditionalize the name of README.distro on the distro


author: Björn Esser <besser82@fedoraproject.org> - 1.0.3-10
changelog:
  - Replace single patches with a monolitic one from upstream
  - Obsolete replacements subpackage
  - Ignore failing tests on %{power64} temporarily


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-5
changelog:
  - Skip CLang static analysis in RHEL
  - Revert "Skip CLang static analysis in RHEL"
  - Use own sha512hmac and fipscheck


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-7_1
changelog:
  - [RHEL] Sync with the Fedora branch
  - [RHEL] Fixup specfile
  - [RHEL] Rebase the disable-AEAD-tests patch


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-8
changelog:
  - Add more Coverity fixes from upstream
  - Add patch to fix AEAD fuzz test for BE arches
  - Fixup specfile


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-14_2
changelog:
  - [RHEL] Re-enable AEAD tests and ignore test result
  - [RHEL] Drop the ppc64 ignore-failures workaround


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-1
changelog:
  - Update to new upstream release 1.4.0
    Resolves: RHEL-5366
  - Add a patch to fix auxiliary tests in FIPS mode
    Resolves: RHEL-2406
  - Add a patch to zeroize kcapi-hasher for FIPS 140-3
    Resolves: RHEL-15290
  - Add a patch to allow overriding target file in kcapi-hasher
    Resolves: RHEL-15300


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-2
changelog:
  - Backport fixes for kcapi-hasher target option
    Related: RHEL-15300
  - Fix kcapi tests in FIPS mode
    Resolves: RHEL-2406


author: Phil Sutter <psutter@redhat.com> - 0.3-2
changelog:
  - Add missing build requirement: gcc.
  - Add source code patches to facilitate following changes.
  - Patches managed in git, so add git as another build requirement.
  - Respect build system compiler flags.
  - Use %make_build instead of plain make in %build.
  - Add %check target which performs unattended runtime test.
  - Use -D install flag instead of manual mkdir.


author: Phil Sutter <psutter@redhat.com> - 0.3-3
changelog:
  - Use %autosetup flag '-p1' instead of '-S git' to get rid of git dependency.
  - Use %license macro in %files section.
  - Added comment about included patches' upstream status.


author: Parag Nemade <pnemade AT redhat DOT com> - 1:0.2.7-11
changelog:
  - Resolves:rh#1615534: libkkc-data FTBFS for missing BuildRequires
  - moved this package to use python3


author: Stephen Gallagher <sgallagh@redhat.com> - 0.9.22-8
changelog:
  - Fixes from package review
  - Change Requires: on tools subpackage to be the exact version/release
  - Remove unnecessary BuildRoot directive


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.0-1
changelog:
  - New upstream release 1.0.0
  - SOname bump to account for module loading changes
  - Rename libldb-tools to ldb-tools to make upgrades easier


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.3-2
changelog:
  - Build and install API documentation
  - Build tdb_compat and ccan statically. They have no upstream releases to
    link against yet and their API is in flux. It is unsafe to make them
    public and shared at this time.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.3-3
changelog:
  - Add explicit mention of the bundled libreplace
  - https://fedorahosted.org/fpc/ticket/120
  - Add explicit mention of bundled libtdb_compat and libccan
  - https://fedorahosted.org/fpc/ticket/119


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.4-1
changelog:
  - New upstream release
  - Add ldb_module_error() routine
  - Fedora: work around unreliable configure check for pytevent
  - Drop patch to ignore --disable-silent-rules (included in tarball)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.6-1
changelog:
  - New upstream release 1.1.6
  - Drop upstream patches
  - Required for upcoming Samba 4 beta
  - Explicitly build with tdb1 support


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.8-1
changelog:
  - New upstream release 1.1.8
  - Required for latest Samba 4 beta
  - Fixes for pyldb
  - Revert to using tdb1 by default
  - Drop support for tdb_compat
  - CCAN is no longer built as a static library


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.9-1
changelog:
  - New upstream release 1.1.9
  - Required for Samba 4 Beta 5
  - Ensure rename target does not exist before deleting old record
  - Add parameter to avoid NULL format string flagged by -Werror=format


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.14-2
changelog:
  - Add patch by Stephen Gallagher to include manual pages for
    ldb_connect() and several other functions.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.24-1
changelog:
  - New upstream release 1.1.24
  - Resolves: rhbz#1292070 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [fedora-all]


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.1.29-5
changelog:
  - rhbz#1401172 - Missing symbol versioning provided by libldb.so with strict CFLAGS
  - Fix configure time detection with -Werror=implicit-function-declaration
    -Werror=implicit-int


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.2-1
changelog:
  - New upstream release 1.3.3
  - Resolves: rhbz#1574267 - libldb-1.3.3 is available
  - Backport a patch from samba upstream to not require rpc.h


author: Petr Viktorin <pviktori@redhat.com> - 1.4.0-3
changelog:
  - Use %{__python2}, not "python", as the Python2 interpreter
  - Add workaround to allow building with Python 2
  - Remove the lmdb dependency in RHEL


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.4-1
changelog:
  - Resolves: rhbz#1684582 - Rebase libldb to version 1.5.4 for Samba
  - Resolves: rhbz#1567115 - libldb: Drop Python 2 subpackages from RHEL 8
  - Resolves: rhbz#1597243 - libldb uses Python 2 to build.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.4-2
changelog:
  - Fix some python2-related upgrade issues
  - Related: rhbz#1567115 - libldb: Drop Python 2 subpackages from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 2.0.7-3
changelog:
  - Resolves: rhbz#1754423 - Rebase libldb to 2.0.7 version for samba
  - Related: rhbz#1754423 - Fix sssd tests (ldb)


author: Isaac Boukris <iboukris@redhat.com> - 2.2.0-1
changelog:
  - Resolves: rhbz#1878114 - Rebase libldb to the version required by Samba
  - Resolves: rhbz#1794349 - Build libldb with lmdb support


author: Andreas Schneider <asn@redhat.com> - 2.3.0-1
changelog:
  - resolves: rhbz#1945021 - Update to version 2.3.0
  - resolves: rhbz#1897082 - Fix libldb tests on aarch64


author: Ana Cabral <acabral@redhat.com> - 1.26.0-2
changelog:
  - Add Conflicts tag because the bash-completion scripts moved
    from the main package to the utils sub package causing a file
    conflict on multilib systems between the old 32 bit main
    package and the new 64 bit utils sub package.


author: Hangbin Liu <haliu@redhat.com> - 1.7-1
changelog:
  - Update to 1.7
  - libndp: apply filter to raw socket to only accept ND messages
  - libndp: move ndp_sock_{open,close}() after msg parsing functions
  - ndptool: Fix compilation on musl libc


author: Hangbin Liu <haliu@redhat.com> - 1.7-2
changelog:
  - ndptool: add -T target support (rhbz 1666194)
  - ndptool: fix target parameter typo (rhbz 1666194)
  - libndp: close sockfd after using to avoid handle leak (rhbz 1666194)
  - libndp: fix nd_msg typo when setting target address (rhbz 1666194)


author: Hangbin Liu <haliu@redhat.com> - 1.7-3
changelog:
  - ndptool: add -D dest support (rhbz 1697595)
  - ndptool: fix potential memory leak caused by strdup (rhbz 1697595)


author: Jiri Pirko <jpirko@redhat.com> - 1.2-1
changelog:
  - Update to 1.2
  - libndp: silently ignore packets with optlen 0
  - libndp: fix processing for larger options
  - libndp: do not fail on receiving non-ndp packets


author: Jiri Pirko <jpirko@redhat.com> - 1.2-2
changelog:
  - libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf() [1044084] [1091720]


author: Jiri Pirko <jiri@mellanox.com> - 1.6-1
changelog:
  - Update to 1.6
  - libndb: reject redirect and router advertisements from non-link-local
  - libndp: validate the IPv6 hop limit
  - libndp: revert API change for ndp_msg_send() and add ndp_msg_send_with_flags()
  - libndp: fix type of field "na" in "struct ndp_msgna"
  - ndptool: add option to send messages types
  - libndp: add option flags to send messages
  - Add SubmittingPatches howto


author: Adrian Reber <areber@redhat.com> - 1.2-5
changelog:
  - Repack tarball to remove problematic license from unused code
  - Apply fixes for warnings found by gcc -fanalyzer


author: Robert Scheck <robert@fedoraproject.org> 1.1.6-7
changelog:
  - Run autoreconf to recognize aarch64 (#925813)
  - Conditionalized usage of %{_lib} vs %{_libdir} for RHEL < 7
  - Tight run-time dependencies between sub-packages via %{?_isa}


author: Adrian Reber <areber@redhat.com> - 1.2-7
changelog:
  - Apply upstream patch to fix 3 findings from static application security testing
    Resolves: RHEL-27656


author: John H Terpstra <jht@samba.anu.edu.au>
changelog:
  - Many optimisations (some suggested by Manoj Kasichainula <manojk@io.com>
  - Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb
  - Compounded make line
  - Updated smb.init restart mechanism
  - Use compound mkdir -p line instead of individual calls to mkdir
  - Fixed smb.conf file path for log files
  - Fixed smb.conf file path for incoming smb print spool directory
  - Added a number of options to smb.conf file
  - Added smbadduser command (missed from all previous RPMs) - Doooh!
  - Added smbuser file and smb.conf file updates for username map


author: Erik Troan <ewt@redhat.com>
changelog:
  - made the %postun script a tad less agressive; no reason to remove
    the logs or lock file (after all, if the lock file is still there,
    samba is still running)
  - the %postun and %preun should only exectute if this is the final
    removal
  - migrated %triggerpostun from Red Hat's samba package to work around
    packaging problems in some Red Hat samba releases


author: Bill Nottingham <notting@redhat.com>
changelog:
  - add a mount.smb to make smb mounting a little easier.
  - smb filesystems apparently don't work on alpha. Oops.


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.0.5
  - fix mount.smb - smbmount options changed again.........
  - fix postun. oops.
  - update some stuff from the samba team's spec file.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - use cp rather than mv to preserve /etc/services perms (#4938 et al).
  - use mktemp to generate /etc/tmp.XXXXXX file name.
  - add prereqs on sed/mktemp/killall (need to move killall to /bin).
  - fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7")


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix yp_get_default_domain in autoconf
  - only link against readline for smbclient
  - fix log rotation (#9909)


author: Than Ngo <than@redhat.de>
changelog:
  - add initdir macro to handle the initscript directory
  - add a new macro to handle /etc/pam.d/system-auth


author: Bill Nottingham <notting@redhat.com>
changelog:
  - move initscript back
  - remove 'Using Samba' book from %doc 
  - move stuff to /etc/samba (#13708)
  - default configuration tweaks (#13704)
  - some logrotate tweaks


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix swat only_from line (#18726, others)
  - fix attempt to write outside buildroot on install (#17943)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - set a default CA certificate path in smb.conf (#19010)
  - require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file


author: Bill Nottingham <notting@redhat.com>
changelog:
  - i18n-ize initscript
  - add a sysconfig file for daemon options (#23550)
  - clarify smbpasswd man page (#23370)
  - build with LFS support (#22388)
  - avoid extraneous pam error messages (#10666)
  - add Urban Widmark's bug fixes for smbmount (#19623)
  - fix setgid directory modes (#11911)
  - split swat into subpackage (#19706)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak the PAM code some more to try to do a setcred() after initgroups()
  - pull in all of the optflags on i386 and sparc
  - don't explicitly enable Kerberos support -- it's only used for password
    checking, and if PAM is enabled it's a no-op anyway


author: Helge Deller <hdeller@redhat.de>
changelog:
  - updated to samba 2.2.0
  - moved codepages to %{_datadir}/samba/codepages
  - use all available CPUs for building rpm packages
  - use %{_xxx} defines at most places in spec-file
  - "License:" replaces "Copyright:"
  - dropped excludearch sparc
  - de-activated japanese patches 100 and 200 for now 
    (they need to be fixed and tested wth 2.2.0)
  - separated swat.desktop file from spec-file and added
    german translations
  - moved /etc/sysconfig/samba to a separate source-file
  - use htmlview instead of direct call to netscape in 
    swat.desktop-file


author: Helge Deller <hdeller@redhat.de>
changelog:
  - build as 2.2.0-1 release
  - skip the documentation-directories docbook, manpages and yodldocs
  - don't include *.sgml documentation in package
  - moved codepage-directory to /usr/share/samba/codepages
  - make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - (these changes are from the non-head version)
  - Don't include /usr/sbin/samba, it's the same as the initscript
  - unset TMPDIR, as samba can't write into a TMPDIR owned
    by root (#41193)
  - Add pidfile: lines for smbd and nmbd and a config: line
    in the initscript  (#15343)
  - don't use make -j
  - explicitly include /usr/share/samba, not just the files in it


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Use /var/cache/samba instead of /var/lock/samba 
  - Remove "domain controller" keyword from smb.conf, it's 
    deprecated (from #13704)
  - Sync some examples with smb.conf.default
  - Fix password synchronization (#16987)


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Don't include smbpasswd in samba, it's in samba-common (#51598)
  - Add a disabled "obey pam restrictions" statement - it's not
    active, as we use encrypted passwords, but if the admin turns
    encrypted passwords off the choice is available. (#31351)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-3
changelog:
  - Add "--with-utmp" to configure options (#55372)
  - Include winbind, pam_smbpass.so, rpcclient and smbcacls
  - start using /var/cache/samba, we need to keep state and there is
    more than just locks involved


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-5
changelog:
  - Teach smbadduser about "getent passwd" 
  - Fix more pid-file references
  - Add (conditional) winbindd startup to the initscript, configured in
    /etc/sysconfig/samba


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-6
changelog:
  - Move winbind files to samba-common. Add separate initscript for
    winbind 
  - Fixes for winbind - protect global variables with mutex, use
    more secure getenv


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.3a-3
changelog:
  - include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o
    (patch posted to samba-list by Ilia Chipitsine)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.5-7
changelog:
  - Enable VFS support and compile the "recycling" module (#69796)
  - more selective includes of the examples dir


author: Jay Fenlason <fenlason@redhat.com> 2.2.7a-3
changelog:
  - edited spec file to put .so files in the correct directories
    on 64-bit platforms that have 32-bit compatability issues
    (sparc64, x86_64, etc).  This fixes bugzilla #83782.
  - Added samba-2.2.7a-error.patch from twaugh.  This fixes
    bugzilla #82454.


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.7a-4
changelog:
  - relink libnss_wins.so with SHLD="%{__cc} -lnsl" to force libnss_wins.so to
    link with libnsl, avoiding unresolved symbol errors on functions in libnsl


author: Jay Fenlason <fenlason@redhat.com> 2.2.8-0
changelog:
  - Upgrade to 2.2.8
  - removed commented out patches.
  - removed old patches and .md5 files from the repository.
  - remove duplicate /sbin/chkconfig --del winbind which causes
    warnings when removing samba.
  - Fixed minor bug in smbprint that causes it to fail when called with
    more than 10 parameters: the accounting file (and spool directory
    derived from it) were being set wrong due to missing {}.  This closes
    bug #86473.
  - updated smb.conf patch, includes new defaults to close bug #84822.


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-1
changelog:
  - upgrade to 2.2.8a
  - remove old .md5 files
  - add "pid directory = /var/run" to the smb.conf file.  Fixes #88495
  - Patch from jra@dp.samba.org to fix a delete-on-close regression


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-2
changelog:
  - add libsmbclient.so for gnome-vfs-extras
  - Edit specfile to specify /var/run for pid files
  - Move /tmp/.winbindd/socket to /var/run/winbindd/socket


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-3beta3
changelog:
  - Merge from 3.0.0-2beta3.3E
  - (Correct log file names (#100981).)
  - (Fix pidfile directory in samab.log)
  - (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file)
  - (Move libsmbclient to the -common package (#99449))


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-15
changelog:
  - New 3.0.0 final release
  - merge nmbd-netbiosname and testparm patches from 3E branch
  - updated the -logfiles patch to work against 3.0.0
  - updated the pie patch
  - update the VERSION file during build
  - use make -j if avaliable
  - merge the winbindd_privileged change from 3E
  - merge the "rm /usr/lib" patch that allows Samba to build on 64-bit
    platforms despite the broken Makefile


author: Felipe Alfaro Solana <felipe_alfaro@linuxmail.org> 3.0.1-1
changelog:
  - Update to 3.0.1
  - Removed testparm patch as it's already merged
  - Removed Samba.7* man pages
  - Fixed .buildroot patch
  - Fixed .pie patch
  - Added new /usr/bin/tdbdump file


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-3rc2
changelog:
  - add %dir entries for %{_libdir}/samba and %{_libdir}/samba/charset
  - Upgrade to new upstream version
  - build mount.cifs for the new cifs filesystem in the 2.6 kernel.


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-5
changelog:
  - New upstream version: 3.0.2 final includes security fix for #114995
    (CAN-2004-0082)
  - Edit postun script for the -common package to restart winbind when
    appropriate.  Fixes bugzilla #114051.


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Change all requires lines to list an explicit epoch.  Closes #102715
  - Add an explicit Epoch so that %{epoch} is defined.


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-1.pre1
changelog:
  - New upstream version.
  - Updated -pie and -logfiles patches for 3.0.3pre1
  - add krb5-devel to buildrequires, fixes #116560
  - Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run
    "service smb status".  This fixes #116559


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-2.pre2
changelog:
  - New upstream version  
  - Updated configure line to remove --with-fhs and to explicitly set all
    the directories that --with-fhs was setting.  We were overriding most of
    them anyway.  This closes #118598


author: jay Fenlason <fenlason@redhat.com> 3.0.3-3.rc1
changelog:
  - New upstream version
  - updated spec file to make libsmbclient.so executable.  This closes
    bugzilla #121356


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-5
changelog:
  - Patch to allow password changes from machines patched with
    Microsoft hotfix MS04-011.
  - Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302
    and https://bugzilla.samba.org/show_bug.cgi?id=1309


author: Jay Fenlason <fenlason@redhat.com> 3.0.5.0pre1.0
changelog:
  - New upstream version
  - use % { SOURCE1 } instead of a hardcoded path
  - include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org)
    https://bugzilla.samba.org/show_bug.cgi?id=1315
    to make winbindd work against Windows versions that do not have
    128 bit encryption enabled.
  - Moved %{_bindir}/net to the -common package, so that folks who just
    want to use winbind, etc don't have to install -client in order to
    "net join" their domain.
  - New upstream version obsoletes the patches added in 3.0.3-5
  - Remove smbgetrc.5 man page, since we don't ship smbget.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-0.pre1.1
changelog:
  - Backport base64_decode patche to close CAN-2004-0500
  - Backport hash patch to close CAN-2004-0686
  - use_authtok patch from Nalin Dahyabhai <nalin@redhat.com>
  - smbclient-kerberos patch from Alexander Larsson <alexl@redhat.com>
  - passwd patch uses "*" instead of "x" for "hashed" passwords for
    accounts created by winbind.  "x" means "password is in /etc/shadow" to
    brain-damaged pam_unix module.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-2
changelog:
  - Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a
    security fix.
  - Include the 3.0.4-backport patch from the 3E branch.  This restores
    some of the 3.0.5pre1 and 3.0.5rc1 functionality.


author: Jason Vas Dias <jvdias@redhat.com> 3.0.5-3
changelog:
  - Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination
  - resulted in executables getting corrupt stacks, causing smbmnt to
  - get a SIGBUS in the mount() call (bug 127420).


author: Jay Fenlason <fenlason@redhat.com> 3.0.6-3
changelog:
  - New upstream version.
  - Include post 3.0.6 patch from "Gerald (Jerry) Carter" <jerry@samba.org>
    to fix a duplicate in the LDAP schema.
  - Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com)
    to allow correct timestamp handling on 64-bit platforms and fix #126109.
  - reenable the -pie patch.  Samba is too widely used, and too vulnerable
    to potential security holes to disable an important security feature
    like -pie.  The correct fix is to have the toolchain not create broken
    executables when programs compiled -pie are stripped.
  - Remove obsolete patches.
  - Modify this spec file to put libsmbclient.{a,so} in the right place on
    x86_64 machines.


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-3
changelog:
  - Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808
    This obsoletes the 3.0.6-schema patch.
  - Update BuildRequires line to include openldap-devel openssl-devel
    and cups-devel


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-4
changelog:
  - Update docs section to not carryover the docs/manpages directory
    This moved many files from /usr/share/doc/samba-3.0.7/docs/* to
    /usr/share/doc/samba-3.0.7/*
  - Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu)
    to correctly create libsmbclient.so.0 and to use %_initrddir instead
    of rolling our own.  This closes #132642
  - Add patch to default "use sendfile" to no, since sendfile appears to
    be broken
  - Add patch from Volker Lendecke <vl@samba.org> to help make
    ldapsam_compat work again.
  - Add patch from "Vince Brimhall" <vbrimhall@novell.com> for ldapsam_compat
    These two patches close bugzilla #132169


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies
    smbmnt to work with 32-bit uids.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.2
changelog:
  - Re-enable the x_fclose patch that was accidentally disabled
    in 3.0.8-0.pre1.1.  This closes #135832
  - include Nalin's -fqdn and -salt patches.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.3
changelog:
  - disable the -salt patch, because it causes undefined references in
    libsmbclient that prevent gnome-vfs from building.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-2
changelog:
  - New upstream version fixes CAN-2004-0930.  This obsoletes the
    disable-sendfile, salt, signing-shortkey and fqdn patches.
  - Add my <fenlason@redhat.com> ugly non-ascii-domain patch.
  - Updated the pie patch for 3.0.8.
  - Updated the logfiles patch for 3.0.8.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3
changelog:
  - Include the corrected docs tarball, and use it instead of the
    obsolete docs from the upstream 3.0.8 tarball.
  - Update the logfiles patch to work with the updated docs.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3.1
changelog:
  - Rescue the install.mount.smbfs patch from Juanjo Villaplana
    (villapla@si.uji.es) to prevent building the srpm from trashing your
    installed /usr/bin/smbmount


author: Than Ngo <than@redhat.com> 3.0.8-4
changelog:
  - fix unresolved symbols in libsmbclient which caused applications
    such as KDE's konqueror to fail when accessing smb:// URLs. #139894


author: Jay Fenlason <fenlason@redhat.com> 3.0.9-2
changelog:
  - New upstream release.  This obsoletes the -secret patch.
    Include my changetrustpw patch to make "net ads changetrustpw" stop
    aborting.  This closes #134694
  - Remove obsolete triggers for ancient samba versions.
  - Move /var/log/samba to the -common rpm.  This closes #76628
  - Remove the hack needed to get around the bad docs files in the
    3.0.8 tarball.
  - Change the comment in winbind.init to point at the correct pidfile.
    This closes #76641


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-2
changelog:
  - New upstream release that closes CAN-2004-1154  bz#142544
  - Include the -64bit patch from Nalin.  This closes bz#142873
  - Update the -logfiles patch to work with 3.0.10
  - Create /var/run/winbindd and make it part of the -common rpm to close
    bz#142242


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-4
changelog:
  - Update the -man patch to fix ntlm_auth.1 too.
  - Move pam_smbpass.so to the -common package, so both the 32
    and 64-bit versions will be installed on multiarch platforms.
    This closes bz#143617
  - Added new -delim patch to fix mount.cifs so it can accept
    passwords with commas in them (via environment or credentials
    file) to close bz#144198


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-3
changelog:
  - add -gcc4 patch to compile with gcc 4.
  - remove the now obsolete -smbclient-kerberos.patch
  - Include four upstream patches from
    http://samba.org/~jerry/patches/post-3.0.11/
    (Slightly modified the winbind_find_dc_v2 patch to apply easily with
    rpmbuild).


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-4
changelog:
  - Use the updated filter-requires-samba.sh file, so we don't accidentally
    pick up a dependency on perl(Crypt::SmbHash)


author: Jay Fenlason <fenlason@redhat.com> 3.0.13-2
changelog:
  - New upstream release
  - add my -quoting patch, to fix swat with strings that contain
    html meta-characters, and to use correct quote characters in
    lists, closing bz#134310
  - include the upstream winbindd_2k3sp1 patch
  - include the -smbclient patch.
  - include the -hang patch from upstream.


author: Jay Fenlason <fenlason@redhat.com> 3.0.14a-2
changelog:
  - New upstream release.
  - the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1,
    winbind_find_dc_v2 patches are now obsolete.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20-2
changelog:
  - New upstream release
    Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3,
      -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1
    This obsoletes the -pie and -delim patches
    the -warning and -gcc4 patches are obsolete too
    The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1
    Also, the -quoting patch was implemented differently upstream
    There is now a umount.cifs executable and manpage
    We run autogen.sh as part of the build phase
    The testprns command is now gone
    libsmbclient now has a man page
  - Include -bug106483 patch to close
    bz#106483 smbclient: -N negates the provided password, despite documentation
  - Added the -warnings patch to quiet some compiler warnings.
  - Removed many obsolete patches from CVS.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20b-2
changelog:
  - turn on -DLDAP_DEPRECATED to allow access to ldap functions that have
    been depricated in 2.3.11, but which don't have well-documented
    replacements (ldap_simple_bind_s(), for example).
  - Upgrade to 3.0.20b, which includes all the previous upstream patches.
  - Updated the -warnings patch for 3.0.20a.
  - Include  --with-shared-modules=idmap_ad,idmap_rid to close
    bz#156810 --with-shared-modules=idmap_ad,idmap_rid
  - Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close
    bz#170259 pam_stack is deprecated


author: Jay Fenlason <fenlason@redhat.com> 3.0.21b-2
changelog:
  - New upstream version.
  - Since the rawhide kernel has dropped support for smbfs, remove smbmount
    and smbumount.  Users should use mount.cifs instead.
  - Upgrade to 3.0.21b


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-0.RC3
changelog:
  - New upstream RC release.
  - Update the -logfiles, and -passwd patches for
    3.0.23rc3
  - Include the change to smb.init from Bastien Nocera <bnocera@redhat.com>)
    to close
    bz#182560 Wrong retval for initscript when smbd is dead
  - Update this spec file to build with 3.0.23rc3
  - Remove the -install.mount.smbfs patch, since we don't install
    mount.smbfs any more.


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-2
changelog:
  - New upstream release.
  - Use modified filter-requires-samba.sh from packaging/RHEL/setup/
    to get rid of bogus dependency on perl(Unicode::MapUTF8)
  - Update the -logfiles and -smb.conf patches to work with 3.0.23


author: Jay Fenlason <fenlason@redhat.com> 3.0.23a-3
changelog:
  - Fix the -logfiles patch to close
    bz#199607 Samba compiled with wrong log path.
    bz#199206 smb.conf has incorrect log file path


author: Simo Sorce <ssorce@redhat.com> 3.0.24-2.fc7
changelog:
  - New upstream release
  - Fix packaging issue wrt idmap modules used only by smbd
  - Addedd Vista Patchset for compatibility with Windows Vista
  - Change default of "msdfs root", it seem to cause problems with
    some applications and it has been proposed to change it for
    3.0.25 upstream


author: Simo Sorce <ssorce@redhat.com> 3.0.24-3.fc7
changelog:
  - Directories reorg, tdb files must go to /var/lib, not
    to /var/cache, add migration script in %post common
  - Split out libsmbclient, devel and doc packages
  - Remove libmsrpc.[h|so] for now as they are not really usable
  - Remove kill -HUP from rotate, samba use -HUP for other things
    noit to reopen logs


author: Simo Sorce <ssorce@redhat.com> 3.0.24-5.fc7
changelog:
  - actually use the correct samba.pamd file not the old samba.pamd.stack file
  - fix logifles and use upstream convention of log.* instead of our old *.log
    Winbindd creates its own log.* files anyway so we will be more consistent
  - install our own (enhanced) default smb.conf file
  - Fix pam_winbind acct_mgmt PAM result code (prevented local users from
    logging in). Fixed by Guenther.
  - move some files from samba to samba-common as they are used with winbindd
    as well


author: Simo Sorce <ssorce@redhat.com> 3.0.24-6.fc7
changelog:
  - do not put comments inline on smb.conf options, they may be read
    as part of the value (for example log files names)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-7.fc7
changelog:
  - make winbindd start earlier in the init process, at the same time
    ypbind is usually started as well
  - add a sepoarate init script for nmbd called nmb, we need to be able
    to restart nmbd without dropping al smbd connections unnecessarily


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - remove patch for bug 106483 as it introduces a new bug that prevents
    the use of a credentials file with the smbclient tar command
  - move the samba private dir from being the same as the config dir
    (/etc/samba) to /var/lib/samba/private


author: Simo Sorce <ssorce@redhat.com> 3.0.24-9.fc7
changelog:
  - integrate most of merge review proposed changes (bug #226387)
  - remove libsmbclient-devel-static and simply stop shipping the
    static version of smbclient as it seem this is deprecated and
    actively discouraged


author: Simo Sorce <ssorce@redhat.com> 3.0.24-10.fc7
changelog:
  - set passdb backend = tdbsam as default in smb.conf
  - remove samba-docs dependency from swat, that was a mistake
  - put back COPYING and other files in samba-common
  - put examples in samba not in samba-docs
  - leave only stuff under docs/ in samba-doc


author: Guenther Deschner <gdeschner@redhat.com> 3.0.24-11.fc7
changelog:
  - enable PAM and NSS dlopen checks during build
  - fix unresolved symbols in libnss_wins.so (bug #198230)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-12.fc7
changelog:
  - fixes in smb.conf
  - advice in smb.conf to put scripts in /var/lib/samba/scripts
  - create /var/lib/samba/scripts so that selinux can be happy
  - fix Vista problems with msdfs errors


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - fixes in the spec file
  - moved to 3.0.25rc1
  - addedd patches (merged upstream so they will be removed in 3.0.25rc2)


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - update to 3.0.25a as it contains many fixes
  - add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut.


author: Simo Sorce <ssorce@redhat.com> 3.2.0-0.pre1.fc9
changelog:
  - New major relase, minor switched from 0 to 2
  - License change, the code is now GPLv3+
  - Numerous improvements and bugfixes included
  - package libsmbsharemodes too
  - remove smbldap-tools as they are already packaged separately in Fedora
  - Fix bug 245506


author: Simo Sorce <ssorce@redhat.com> - 3.2.0-0.pre1.3
changelog:
  - Try to fix GCC 4.3 build
  - Add --with-dnsupdate flag and also make sure other flags are required just to
    be sure the features are included without relying on autodetection to be
    successful


author: Guenther Deschner <gdeschner@redhat.com> - 3.3.0-0.25
changelog:
  - Update to 3.3.0 final
  - Add upstream fix for ldap connections to AD (Bug #6073)
  - Remove bogus perl dependencies (resolves: #473051)


author: Simo Sorce <ssorce@redhat.com> - 3.3.1-0.29
changelog:
  - Make the talloc and ldb packages optionsl and disable their build within
    the samba3 package, they are now built as part of the samba4 package
    until they will both be released as independent packages.


author: Simo Sorce <ssorce@redhat.com> - 3.3.2-0.33
changelog:
  - Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the
    configuration
  - Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on
    startup, causing your own machine not to show up in the network for 5 minutes
    if it was the only client in that workgroup (fix committed upstream)


author: Guenther Deschner <gdeschner@redhat.com> - 3.4.0-0.41
changelog:
  - Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX)
  - Specify required talloc and tdb version for BuildRequires


author: Simo Sorce <ssorce@redhat.com> - 3.4.2-47
changelog:
  - Spec file cleanup
  - Fix sources upstream location
  - Remove conditionals to build talloc and tdb, now they are completely indepent
    packages in Fedora
  - Add defattr() where missing
  - Turn all tabs into 4 spaces
  - Remove unused migration script
  - Split winbind-clients out of main winbind package to avoid multilib to include
    huge packages for no good reason


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.3-60
changelog:
  - Update to 3.5.3
  - Make sure nmb and smb initscripts return LSB compliant return codes
  - Fix winbind over ipv6


author: Andreas Schneider <asn@redhat.com> - 2:3.6.5-88
changelog:
  - Move tmpfiles.d config to common package as it is needed for smbd and
    winbind.
  - Make sure tmpfiles get created after installation.


author: Ville Skyttä <ville.skytta@iki.fi> - 2:3.6.6-92
changelog:
  - Call ldconfig at libwbclient and -winbind-clients post(un)install time.
  - Fix empty localization files, use %find_lang to find and %lang-mark them.
  - Escape macros in %changelog.
  - Fix source tarball URL.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.0-154.rc3
changelog:
  - Update to 4.0.0rc3.
  - resolves: #805562 - Unable to share print queues.
  - resolves: #863388 - Unable to reload smbd configuration with systemctl.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.0-160.rc3
changelog:
  - resolves: #867893 - Move /var/log/samba to samba-common package for
                        winbind which requires it.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.2-1
changelog:
  - Update to Samba 4.0.2.
  - Fixes CVE-2013-0213.
  - Fixes CVE-2013-0214.
  - resolves: #906002
  - resolves: #905700
  - resolves: #905704
  - Fix conn->share_access which is reset between user switches.
  - resolves: #903806
  - Add missing example and make sure we don't introduce perl dependencies.
  - resolves: #639470


author: Andreas Schneider <asn@redhat.com> - 2:4.0.3-1
changelog:
  - Update to Samba 4.0.3.
  - resolves: #907544 - Add unowned directory /usr/lib64/samba.
  - resolves: #906517 - Fix pidl code generation with gcc 4.8.
  - resolves: #908353 - Fix passdb backend ldapsam as module.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.4-3
changelog:
  - resolves: #919405 - Fix and improve large_readx handling for broken clients.
  - resolves: #924525 - Don't use waf caching.


author: Andreas Schneider <asn@redhat.com> - 2:4.0.5-1
changelog:
  - Update to Samba 4.0.5.
  - Add UPN enumeration to passdb internal API (bso #9779).
  - resolves: #928947 - samba-doc is obsolete now.
  - resolves: #948606 - LogRotate should be optional, and not a hard "Requires".


author: Andreas Schneider <asn@redhat.com> - 2:4.0.7-2
changelog:
  - resolves: #972692 - Build with PIE and full RELRO.
  - resolves: #884169 - Add explicit dependencies suggested by rpmdiff.
  - resolves: #981033 - Local user's krb5cc deleted by winbind.
  - resolves: #984331 - Fix samba-common tmpfiles configuration file in wrong
                        directory.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.2
changelog:
  - resolves: #985985 - Fix file conflict between samba and wine.
  - resolves: #985107 - Add support for new default location for Kerberos
                        credential caches.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.7
changelog:
  - related: #985609 - Update to Samba 4.1.0rc3.
  - resolves: #1005422 - Add support for KEYRING ccache type in pam_winbindd.


author: Andreas Schneider <asn@redhat.com> - 2:4.1.0-0.8
changelog:
  - related: #985609 - Update to Samba 4.1.0rc4.
  - resolves: #1010722 - Split out a samba-winbind-modules package.


author: Andreas Schneider <asn@redhat.com> - 4.1.0-2
changelog:
  - resolves: #1018856 - Fix installation of pam_winbind after upgrade.
  - related: #1010722 - Split out a samba-winbind-modules package.
  - related: #985609


author: Andreas Schneider <asn@redhat.com> - 4.1.0-4
changelog:
  - related: #884169 - Add direct dependency to samba-libs in the
                       glusterfs package.
  - resolves: #996567 - Fix userPrincipalName composition.
  - related: #884169 - Fix memset call with zero length in in ntdb.


author: Andreas Schneider <asn@redhat.com> - 4.1.3-1
changelog:
  - Update to Samba 4.1.3.
  - resolves: #1039454 - CVE-2013-4408.
  - resolves: #1039500 - CVE-2012-6150.


author: Andreas Schneider <asn@redhat.com> - 4.2.0-0.3.rc2
changelog:
  - resolves: #1174412 - Build VFS Ceph module.
  - resolves: #1169067 - Move libsamba-cluster-support.so to samba-libs package.
  - resolves: #1016122 - Move smbpasswd to samba-common package.


author: Michael Adam <madam@redhat.com> - 4.2.0-0.2.rc3
changelog:
  - Improve dependencies of vfs-glusterfs and vfs-cephfs.
  - Remove unused python_libdir.
  - Fix malformed changelog entries.


author: Andreas Schneider <asn@redhat.com> - 4.2.0-2
changelog:
  - Fix the AD build.
  - Create samba-client-libs subpackage.
  - Fix multiarch issues by splitting the samba-common package.


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-5
changelog:
  - Require samba-common-tools in samba package
  - Require samba-common-tools in samba-client package
  - resolves: #1215631 - /usr/bin/net moved to samba-common-tools but the package is not required by samba


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-7
changelog:
  - Fix LSASD daemon
  - resolves: #1217346 - FreeIPA trusts to AD broken due to Samba 4.2 failure to run LSARPC pipe externally


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.1-8
changelog:
  - Fixes: #1219832: Samba 4.2 broke FreeIPA trusts to AD
  - Remove usage of deprecated API from gnutls


author: Andreas Schneider <asn@redhat.com> - 4.2.2-1
changelog:
  - resolves: #1227911 - Enable tar support for smbclient
  - resolves: #1234908 - Own the /var/lib/samba directory
  - Enable hardened build


author: Guenther Deschner <gdeschner@redhat.com> - 4.3.3-0
changelog:
  - Update to Samba 4.3.3
  - resolves: #1292069
  - CVE-2015-3223 Remote DoS in Samba (AD) LDAP server
  - CVE-2015-5252 Insufficient symlink verification in smbd
  - CVE-2015-5296 Samba client requesting encryption vulnerable to
                  downgrade attack
  - CVE-2015-5299 Missing access control check in shadow copy code
  - CVE-2015-7540 DoS to AD-DC due to insufficient checking of asn1
                  memory allocation


author: Guenther Deschner <gdeschner@redhat.com> - 4.4.0-0.7.rc4
changelog:
  - Update to Samba 4.4.0rc4
  - resolves: #1315942 - CVE-2015-7560 Incorrect ACL get/set allowed on symlink path


author: Guenther Deschner <gdeschner@redhat.com> - 4.4.2-1
changelog:
  - Update to Samba 4.4.2, fix badlock security bug
  - resolves: #1326453 - CVE-2015-5370
  - resolves: #1326453 - CVE-2016-2110
  - resolves: #1326453 - CVE-2016-2111
  - resolves: #1326453 - CVE-2016-2112
  - resolves: #1326453 - CVE-2016-2113
  - resolves: #1326453 - CVE-2016-2114
  - resolves: #1326453 - CVE-2016-2115
  - resolves: #1326453 - CVE-2016-2118


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.0-3
changelog:
  - auth/credentials: Always set the the realm if we set the principal from the ccache
  - resolves: #1430761 - credentials_crb5: use gss_acquire_cred for client-side GSSAPI use case


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.0-4
changelog:
  - Export arcfour_crypt_blob to Python as samba.crypto.arcfour_encrypt
  - Makes possible to run trust to AD in FreeIPA in FIPS mode


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-0.5.rc1
changelog:
  - Convert more rpc modules to python3
  - Explicitly specify Python artifacts in the spec to be able to catch unpackaged ones
  - Split 'make test' Python code into separate python2-samba-test/python3-samba-test sub-packages
  - Remove embedded python2-dns version, require python{2,3}-dns instead


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-0.6.rc1
changelog:
  - Use Python 2 explicitly for samba-tool and other Python-based tools
  - Install samba.service as it is required for the AD DC case


author: Guenther Deschner <gdeschner@redhat.com> - 4.7.0-12
changelog:
  - Update to Samba 4.7.0
  - resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-13
changelog:
  - Move /usr/lib{64,}/samba/libdsdb-garbage-collect-tombstones-samba4.so to samba-dc-libs
  - Rebuild in rawhide against new krb5 1.16 and docbook-xml


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.7.0-18
changelog:
  - Force samba-dc to use the same libldb version as LDB modules compiled
  - resolves: #1507420 - LDB / Samba module version mismatch


author: Guenther Deschner <gdeschner@redhat.com> - 4.8.0-7
changelog:
  - resolves: #1554754, #1554756 - Security fixes for CVE-2018-1050 CVE-2018-1057
  - resolves: #1555112 - Update to Samba 4.8.0


author: Petr Viktorin <pviktori@redhat.com> - 4.8.3-2
changelog:
  - Use %{__python2}, not "python", as the Python2 interpreter
  - Add workaround to allow building with Python 2
  - Change unversioned python macros to python2
  - Disable gluster temporarily


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc3-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc3
  - resolves: #1554753 - Fix CVE-2018-1050
  - resolves: #1617912 - Fix CVE-2018-10858
  - resolves: #1617913 - Fix CVE-2018-10918
  - resolves: #1617914 - Fix CVE-2018-10919
  - resolves: #1617915 - Fix CVE-2018-1139
  - resolves: #1612522 - Manpage fixes


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc5-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc5
  - resolves: #1610909 - Re-enable glubsterfs vfs module
  - resolves: #1624170 - Build with -fstack-protectore-strong if available
  - resolves: #1602685 - Fixed issues found by covscan


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.9.1-3
changelog:
  - Temporarily remove smbtorture from samba-test due to Python 2 linkage
  - related: #1609661 - samba-test package cannot be installed due to unresolved dependencies


author: Andreas Schneider <asn@redhat.com> - 4.9.1-5
changelog:
  - resolves: #1644327 - Segfault if wrong 'passdb backend' is configured
  - resolves: #1647959 - Segfault in the debug system with hardended build


author: Andreas Schneider <asn@redhat.com> - 4.9.1-6
changelog:
  - resolves: #1642092 - Harden [homes] share export
  - resolves: #1648846 - Fix out of bound array access in ctdb
  - resolves: #1657266 - Fix tmp directory creation in /run


author: Andreas Schneider <asn@redhat.com> - 4.9.1-7
changelog:
  - resolves: #1658690 - Add smbc_setOptionProtocols()
  - resolves: #1658678 - Fix spoolss client operations against Windows


author: Andreas Schneider <asn@redhat.com> - 4.10.4-0
changelog:
  - related: #1638001 - Rebase to Samba version 4.10.4
  - resolves: #1597298 - Build Samba with python3
  - resolves: #1658558 - Add 'net ads leave --keep-account' option
  - resolves: #1669004 - Fix systemd status notifications
  - resolves: #1672167 - Fix printing cache timeout in debug output
  - resolves: #1696525 - Fix CVE-2019-3880


author: Andreas Schneider <asn@redhat.com> - 4.10.4-1
changelog:
  - resolves: #1712378 - Fix smbspool CUPS backend
  - resolves: #1696612 - Fix 'net ads join -U admin@parentdomain'


author: Andreas Schneider <asn@redhat.com> - 4.10.4-100
changelog:
  - resolves: #1754575 - Avoid overlinking with librt and libpthread
  - resolves: #1755440 - Fix forest trusts enumeration
  - resolves: #1755445 - Fix CUPS username/password authentication with smbspool


author: Andreas Schneider <asn@redhat.com> - 4.11.2-1
changelog:
  - resolves: #1754409 - Rebase to Samba version 4.11.2
  - resolves: #1776312 - Winbind is not restarted on upgrade
  - resolves: #1764469 - Fix CVE-2019-10218
  - resolves: #1746241 - Fix CVE-2019-10197
  - resolves: #1710980 - Add support for KCM ccache in pam_winbind


author: Andreas Schneider <asn@redhat.com> - 4.11.2-4
changelog:
  - related: #1754409 - Add patch to avoid overlinking with libnsl and libsocket
  - related: #1754409 - Fix permissions for pidl
  - related: #1754409 - Fix logrotate script
  - related: #1754409 - Add missing README files


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.11.2-10
changelog:
  - resolves: #1790353 - Fix access check in DsRGetForestTrustInformation
  - resolves: #1791209 - Fix CVE-2019-14907


author: Andreas Schneider <asn@redhat.com> - 4.11.2-12
changelog:
  - related: #1781232 - Improve debug output of smbclient
  - resolves: #1794461 - Do not return bogus inode numbers in
                         cli_qpathinfo2()/cli_qpathinfo3() for SMB1
  - resolves: #1794442 - Fix segfault in smbd_do_qfilepathinfo()


author: Andreas Schneider <asn@redhat.com> - 4.12.3-0
changelog:
  - resolves: #1817557 - Rebase to version 4.12.3
  - resolves: #1813833 - Fix 'net ads join createupn='


author: Andreas Schneider <asn@redhat.com> - 4.12.3-1
changelog:
  - resolves: #1666737 - Add a new smbc_readdirplus2() function to libsmbclient
  - resolves: #1842844 - Fix GnuTLS priority list for TLS connections


author: Isaac Boukris <iboukris@redhat.com> - 4.12.3-4
changelog:
  - resolves: #1850980 - Add "additional dns hostname" to keytab
  - resolves: #1850981 - Add net-ads-join dnshostname=fqdn option


author: Andreas Schneider <asn@redhat.com> - 4.12.3-5
changelog:
  - resolves: #1823612 - Fix segfault in 'net ads dns gethostbyname'
  - resolves: #1792553 - Fix 'net ads join createcomputer=OU'


author: Andreas Schneider <asn@redhat.com> - 4.12.3-7
changelog:
  - resolves: #1855711 - Fix 'require_membership_of' documentation in
                         pam_winbind manpage


author: Andreas Schneider <asn@redhat.com> - 4.12.3-9
changelog:
  - related: #1817557 - Move DECRPC mdssvc data files to correct package
  - resolves: #1856676 - Fix lookuprids in winbind


author: Andreas Schneider <asn@redhat.com> - 4.13.2-1
changelog:
  - resolves: #1878109 - Rebase Samba to version 4.13.2
  - resolves: #1872833 - Add samba-winexe subpackage
  - resolves: #1891688 - Fix CVE-2020-14323
  - resolves: #1892633 - Fix CVE-2020-14318
  - resolves: #1892639 - Fix CVE-2020-14383
  - resolves: #1879835 - Fix CVE-2020-1472
  - resolves: #1888990 - Update smb.conf manpages to describe how to apply
                         config changes.
  - resolves: #1869702 - Fix %U substitution for 'valid users' option
  - resolves: #1818038 - Improve FIPS compliance


author: Andreas Schneider <asn@redhat.com> - 4.13.2-2
changelog:
  - related: #1869702 - Fix spoolss crash
  - resolves: #1896736 - Fix name lookups of FreeIPA users
  - resolves: #1899113 - Fix DFS links


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.14.4-2
changelog:
  - resolves: rhbz#1944657 - Update to version 4.14.4
  - resolves: rhbz#1949445 - Fix CVE-2021-20254
  - resolves: rhbz#1947945 - Fix libsmbldap.so.2 not being a symbolic link
  - resolves: rhbz#1908506 - Fix creating the gencache user directory
  - resolves: rhbz#1901029 - Build the vfs_io_uring module


author: Andreas Schneider <asn@redhat.com> - 4.14.4-0
changelog:
  - related: rhbz#1944657 - Update to version 4.14.5
  - resolves: rhbz#1969787 - Fix memory leak in RPC server
  - resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
  - resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
  - resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
  - resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags


author: Andreas Schneider <asn@redhat.com> - 4.14.4-1
changelog:
  - resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
  - resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message


author: Andreas Schneider <asn@redhat.com> - 4.14.4-3
changelog:
  - resolves: rhbz#2019662 - Fix CVE-2016-2124
  - resolves: rhbz#2019668 - Fix CVE-2021-23192
  - resolves: rbhz#2019674 - Fix CVE-2020-25717


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.2-1
changelog:
  - resolves: rhbz#2013596 - Rebase to version 4.15.2
  - resolves: rhbz#1999294 - Remove noisy error message in winbindd
  - resolves: rhbz#1958881 - Don't require winbind being online for krb5 auth
                             with one-way trusts
  - resolves: rhbz#2019461 - Fix deleting directories with dangling symlinks


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.3-1
changelog:
  - related: rhbz#2013596 - Rebase to version 4.15.3
  - resolves: rhbz#2028029 - Fix possible null pointer dereference in winbind
  - resolves: rhbz#1912549 - Winexe: Kerberos Auth is respected via --use-kerberos=desired


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.4-0
changelog:
  - Update to Samba 4.15.4
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2039153 - Fix CVE-2021-20316
  - resolves: rhbz#1912549 - Winexe: Kerberos flag not invoking Kerberos Auth
  - resolves: rhbz#2039157 - Fix CVE-2021-43566
  - resolves: rhbz#2038148 - Failed to authenticate users after upgrade samba package to release samba-4.14.5-7
  - resolves: rhbz#2035528 - [smb] Segmentation fault when joining the domain
  - resolves: rhbz#2038796 - filename_convert_internal: open_pathref_fsp [xxx] failed: NT_STATUS_ACCESS_DENIED


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-0
changelog:
  - Update to Samba 4.15.5
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2046127 - Fix CVE-2021-44141
  - resolves: rhbz#2046153 - Fix CVE-2021-44142
  - resolves: rhbz#2044404 - Printing no longer works on Windows 7
  - resolves: rhbz#2043154 - Fix systemd notifications
  - resolves: rhbz#2049602 - Disable NTLMSSP for ldap client connections (e.g. libads)


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-1
changelog:
  - resolves: #1995849 - [RFE] Change change password change prompt phrasing
  - resolves: #2029417 - virusfilter_vfs_openat: Not scanned: Directory or special file


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-6
changelog:
  - resolves: rhbz#2059151 - Fix username map for unix groups
  - resolves: rhbz#2065212 - Fix 'create krb5 conf = yes` when a KDC has a single IP address.


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.3-0
changelog:
  - related: rhbz#2077468 - Rebase Samba to 4.16.3
  - resolves: rhbz#2106672 - The pcap background queue process should not be stopped
  - resolves: rhbz#2106263 - Fix crash in rpcd_classic
  - resolves: rhbz#2100093 - Fix net ads info returns LDAP server and LDAP server name


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.4-1
changelog:
  - resolves: rhbz#2221594 - Fix broken symlink for libwbclient
  - resolves: rhbz#2221600 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
  - resolves: rhbz#2175385 - Fix access of Samba share with veto files = /.*/
  - resolves: rhbz#2218237 - Fix Python tarfile extraction to avoid a warning


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-0
changelog:
  - resolves: rhbz#2222894 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-1
changelog:
  - related: rhbz#2190417 - Update to version 4.18.6
  - resolves: rhbz#2232564 - Fix the rpc dsgetinfo command


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.6-2
changelog:
  - resolves: RHEL-11956
    Fix CVE-2023-3961 - smbd must check the pipename
  - resolves: RHEL-11956
    Fix CVE-2023-4091 - SMB clients can truncate files
  - resolves: RHEL-11956
    Fix CVE-2023-42669 - Remove rpcecho server


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.3-1
changelog:
  - resolves: RHEL-16483 - Update to version 4.19.3
  - resolves: RHEL-11361
              - Fix CVE-2023-3961 CVE-2023-4091 CVE-2023-42669
  - resolves: RHEL-2228  - Logging Format Enhancement
  - resolves: RHEL-1965  - Fix smbget issues with DFS shares
  - resolves: RHEL-2108  - Fix force user/group issues with 'allow trusted domains = yes'
  - resolves: RHEL-17122 - Fix memory corruption in libnss_winbind


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-2
changelog:
  - Fix error in PREIN scriptlet in rpm package samba-common
  - related: RHEL-16483 - Update to version 4.19.4


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el8]
changelog:
  - chain: Correctly check realloc() call (Phil Sutter) [1778952]
  - flowtable: Correctly check realloc() call (Phil Sutter) [1778952]
  - chain: Fix memleak in error path of nftnl_chain_parse_devs() (Phil Sutter) [1778952]
  - flowtable: Fix memleak in error path of nftnl_flowtable_parse_devs() (Phil Sutter) [1778952]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el8]
changelog:
  - set_elem: Introduce support for NFTNL_SET_ELEM_KEY_END (Phil Sutter) [1795223]
  - set: Add support for NFTA_SET_DESC_CONCAT attributes (Phil Sutter) [1795223]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795223]


author: Phil Sutter <psutter@redhat.com> [1.1.5-5.el8]
changelog:
  - set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754]
  - expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478]
  - set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478]


author: Tomas Hoger <thoger@redhat.com> - 0.1.13-11
changelog:
  - Add conditional for building with(out) gst010 / GStreamer 0.10 support.
  - Disable gst010 plugin by default.


author: Stefan Becker <chemobejk@gmail.com> - 0.1.14-3
changelog:
  - update to 0.1.14-70-gfb2f1f7 with alternate server fixes for SIPE
  - add autoreconf build step
  - remove examples subpackage as examples are no longer installed


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-4.20171128gitfb2f1f7
changelog:
  - enable make check again
  - make tests pass in Koji
  - disable test-new-dribble that sometimes hangs indefinitely
  - make tests compile on i686
  - make the package build on armv7hl
  - make the package build on Fedora 28
  - avoid build failure if gstreamer-plugins-base-devel is installed
  - move autoreconf invocation to %prep
  - use Name Version Release that explicitly identifies an SCM snapshot (#1541646)


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-6.20171128gitfb2f1f7
changelog:
  - temporarily make the upstream test-suite run on Intel arches only
  - disable test-send-recv, which fails in Koji


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-7.20180504git34d6044
changelog:
  - component: accept TURN in nice_component_verify_remote_candidate() (#1541646)
  - update to 0.1.14-85-g34d6044 (#1541646)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.3.0-4
changelog:
  - Python 2 binary package renamed to python2-libnl3
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Thomas Haller <thaller@redhat.com> - 1.8.28-1
changelog:
  - Update to 1.8.28 release
  - move org.gnome.nm-applet.gschema.xml from network-manager-applet to here.
  - introduce wireless security dialogs


author: Ana Cabral <acabral@redhat.com> - 1.8.36-1
changelog:
  - Update to 1.8.36 release (rh #2062686)
  - Include OWE wireless security (rh #2060327)
  - Fix OWE wireless security entry in Hidden Networks dialog (rh #2057514)


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Bastien Nocera <bnocera@redhat.com> - 1.22.0-6
changelog:
  + libpeas-1.22.0-6
  - Remove python2 loader, all GNOME apps using libpeas were ported to Python3
    when ported to GTK+ 3.x, and obsolete libpeas-loader-python
  - Resolves: #1559090


author: Dan Winship <danw@redhat.com> - 0.4.15-5.1
changelog:
  - Drop python2 subpackage (#1559092)
  - Drop PAC runner based on the "pacrunner" package (#1569023)
  - Replace pacrunner-crash-fix patch with version from RHEL7
  - Drop kde subpackage (#1538147)


author: kwizart < kwizart at gmail.com > - 0.2.3-2
changelog:
  - Rename binding-python to python
  - Add Requires: gecko-libs >= %{gecko_version}
  - Fix some descriptions
  - Add plugin-webkit package


author: kwizart < kwizart at gmail.com > - 0.2.3-3
changelog:
  - Move proxy.h to libproxy/proxy.h
    This will prevent it to be included in the default include path
  - Split main to libs and util and use libproxy to install all


author: kwizart < kwizart at gmail.com > - 0.2.3-7
changelog:
  - Disable Gnome/KDE default support via builtin modules.
   (it needs to be integrated via Gconf2/neon instead).


author: kwizart < kwizart at gmail.com > - 0.2.3-8
changelog:
  - Merge NetworkManager module into the main libproxy package
  - Main Requires the -python and -bin subpackage 
   (splitted for multilibs compliance).


author: Nicolas Chauvet <kwizart@fedoraproject.org> - 0.3.1-1
changelog:
  - Update to 0.3.1
  - Avoid dependecies on -python and -bin subpackages
  - Create -networkmanager sub-package.


author: Nathaniel McCallum <nathaniel@natemccallum.com> - 0.4.4-1
changelog:
  - Update to 0.4.4
  - Removed install workarounds (fixed upstream)
  - Removed patches (fixed upstream)
  - Moved -python to noarch
  - Downgrade cmake requirement (upstream change)
  - Disabled perl bindings
  - Run tests


author: Nicolas Chauvet <kwizart@gmail.com> - 0.4.5-2
changelog:
  - Update to 0.4.5
  - Disable mozjs on fedora >= 15
  - Disable webkit
  - Add libproxy bootstrap option to disable modules.


author: Nicolas Chauvet <kwizart@gmail.com> - 0.4.6-3
changelog:
  - Fix mozjs/webkit obsoletion - rhbz#656849
  - Workaround unreliable Version field in pkg-config - rhbz#656484


author: Nicolas Chauvet <kwizart@gmail.com> - 0.4.7-0.1svn20110412
changelog:
  - Update to 0.4.7 svn20110412
  - Add support for webkitgtk3
  - Add support for xulrunner 2.0
  - fix #683015 - libproxy fails with autoconfiguration
  - fix #683018 - libproxy needs BR: NetworkManager-glib-devel  (f14)
  - Manually fix libproxy-1.0.pc version field - #664781 / #674854


author: Peter Robinson <pbrobinson@fedoraproject.org> - 0.4.7-4
changelog:
  - Add upstream patches to use js rather than xulrunner
  - Add patch to fix FTBFS on gcc 4.7
  - Cleanup spec for latest updates and remove obsolete bits


author: Dan Winship <danw@redhat.com> - 0.4.11-7
changelog:
  - Fix file descriptor leak (#911066)
  - Fix crash when pacrunner fails (probably because of EMFILE...) (#998232)


author: David King <amigadave@amigadave.com> - 0.4.12-1
changelog:
  - Update to 0.4.12
  - Simplify conditional macros
  - Use isa macro when requiring base package
  - Use license macro for COPYING
  - Use pkgconfig for BuildRequires
  - Use javascriptcoregtk-4.0
  - Apply an upstream patch to pair new[] with delete[]
  - Fix slowdown in KDE plugin
  - Make the pacrunner subpackage depend on pacrunner (#1171679)
  - Install man page from Debian


author: Carl Byington <carl@five-ten-sg.com> 0.6.71-1
changelog:
  - fedora python naming scheme changes
  - Zachary Travis - Add support for the OST 2013 format, and
    Content-Disposition filename key fix for outlook compatibility


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.71-4
changelog:
  - Python 2 binary package renamed to python2-libpst
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tomáš Mráz <tmraz@redhat.com> 1.4.4-1
changelog:
  - Translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer
  - pam_pwquality: Abort the retry loop if user requests it
  - Allow setting retry, enforce_for_root, and local_users_only options
    in the pwquality.conf config file


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1919026 libpwquaily rpm requires cracklib to function but RPM missing requirement [updated]


author: Remi Collet <remi@remirepo.net> - 0.11.0-1
changelog:
  - update to 0.11.0
  - add patch to not install the static library, from
    https://github.com/alanxz/rabbitmq-c/pull/665


author: Nils Philippsen <nils@tiptoe.de> - 2.1.2-1
changelog:
  - version 2.1.2
  - tidy up spec file
  - use %license for license file
  - require same arch main from devel package


author: Nicola Sella <nsella@redhat.com> - 1.12.0-1
changelog:
  - Update to 1.12.0
  - Decode package URL when using for local filename (RhBug:1817130)
  - Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
  - Download sources work when at least one of specified is working (RhBug:1775184)
  - Enable building on OSX


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.0-1
changelog:
  - Update to 1.14.0
  - Fix the key string parsing in url_substitution
  - When zchunk enabled and not using HTTP/S protocol, download the whole file (RhBug:1886706)
  - Add an option LRO_SSLVERIFYSTATUS to check TLS certificate revocation status (using OCSP stapling) (RhBug:1814383)
  - Fix: lr_perform() - Avoid 100% CPU usage
  - Add support for working with certificates used with proxy
  - Reposync does not re-download unchanged packages (RhBug:1931904)
  - Fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.2-1
changelog:
  - Update to 1.14.2
  - Reduce time to load metadata
  - Fix resource leaks and memory leaks
  - Remove build dependency on python3-flask


author: Lukas Hrazky <lhrazky@redhat.com> - 1.14.2-4
changelog:
  - Fix termination of va_list in lr_metadatatarget_append_error()
  - Detailed error message when using non-existing TMPDIR


author: Tomas Mlcoch <tmlcoch@redhat.com> - 1.7.18-1
changelog:
  - Add new option LRO_FTPUSEEPSV
  - Update AUTHORS
  - downloader prepare_next_transfer(): simplify long line
  - downloader prepare_next_transfer(): add missing error check
  - downloader prepare_next_transfer(): cleanup error path
  - downloader prepare_next_transfer() - fix memory leak on error path (Alan Jenkins)
  - handle: Don't use proxy cache for downloads of metalink/mirrorlist
  - handle: Don't set CURLOPT_HTTPHEADER into curl handle immediately when specified
  - downloader: Implement logic for no_cache param in LrDownloadTarget (RhBug: 1297762)
  - Add no_cache param to LrDownloadTarget and lr_downloadtarget_new()
  - New test: always try to download from the fastest mirror (Alexander Todorov)
  - Doc: Fixed minor doc typo (Philippe Ombredanne)
  - Doc: Other updates
  - Doc: Update default values in doc to reflect reality


author: Tomas Mlcoch <tmlcoch@redhat.com> - 1.7.19-1
changelog:
  - Add yumrecord substitution mechanism (mluscon)
  - Fix a memory leak in signature verification (cwalters)


author: Tomas Mlcoch <tmlcoch@redhat.com> - 1.7.20-1
changelog:
  - Tests: Disable test_download_packages_with_resume_02 test
  - Update build utils to match new fedora spec schema


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.10.1-1
changelog:
  - Update to 1.10.1
  - Reduce download delays
  - Add an option to preserve timestamps of the downloaded files (RhBug:1688537)
  - Append the '?' part of repo URL after the path
  - Fix memory leaks


author: Ales Matej <amatej@redhat.com> - 1.10.6-1
changelog:
  - Update to 1.10.6
  - Imporove handling of xattr to re-download damadged files (RhBug:1690894)
  - Rephrase repository GPG check error message (RhBug:1741442)
  - Add sleep before next try when all mirrors were tried (RhBug:1741931)
  - Raise logging level of error messages (RhBug:1737709)
  - Handle webservers that don't support ranges when downloading zck
  - Define LRO_SUPPORTS_CACHEDIR only with zchunk (RhBug:1726141)
  - Allow to use mirrors multiple times for a target (RhBug:1678588)
  - Allow to try baseurl multiple times (RhBug:1678588)


author: Ales Matej <amatej@redhat.com> - 1.11.0-1
changelog:
  - Update to 1.11.0
   - Retry mirrorlist/metalink downloads several times (RhBug:1741931)
   - Improve variable substitutions in URLs and add ${variable} support


author: Ales Matej <amatej@redhat.com> - 1.11.3-1
changelog:
  - Update to 1.11.3
   - Prefer mirrorlist/metalink over baseurl (RhBug:1775184)
   - Fix calling Python API without holding GIL (RhBug:1788918) 
   - Do not unref LrErr_Exception on exit (RhBug:1778854)


author: Parag Nemade <paragn AT fedoraproject DOT org> - 1.1.3-9
changelog:
  - Fix bogus date in %changelog
  - ant-nodeps is dropped from ant-1.9.0-2 build in rawhide
  - Drop buildroot, %clean, %defattr and removal of buildroot in %install


author: Sergio Durigan Junior <sergiodj@redhat.com> - 0.0.4-12
changelog:
  - Resolves: rhbz#1786466 Do not use %{?_isa} for GDB dependency. Recommend
    GDB, instead of requiring it.


author: Nils Philippsen <nils@tiptoe.de> - 0.1.9-1
changelog:
  - version 0.1.9
  - change license to BSD (2-clause)
  - require gcc, alsa-lib-devel, fftw-devel for building


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10
changelog:
  - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function
    i2alaw_array in alaw (#1673085)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-11
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985028)


author: Ville Skyttä <ville.skytta@iki.fi> - 0:1.0.10-0.fdr.1
changelog:
  - Update to 1.0.10, update URLs, include ALSA support.
  - Disable dependency tracking to speed up the build.
  - Add missing ldconfig invocations.
  - Make -devel require pkgconfig.
  - Include developer docs in -devel.
  - Provide -octave in main package, own more related dirs.
  - Bring specfile up to date with current spec templates.


author: Andreas Thienemann <andreas@bawue.net> - 1.0.17-2
changelog:
  - Adding FLAC support to libsndfile courtesy of gentoo, #237575
  - Fixing CVE-2007-4974. Thanks to the gentoo people for the patch, #296221


author: Andreas Thienemann <andreas@bawue.net> - 1.0.17-6
changelog:
  - Removed spurious #endif in the libsndfile.h wrapper. Thx to Edward
    Sheldrake for finding it. Fixes #468508.
  - Fix build for autoconf-2.63


author: Orcan Ogetbil <oget[dot]fedora[at]gmail[dot]com> - 1.0.20-3
changelog:
  - Add FLAC/Ogg/Vorbis support (BR: libvorbis-devel)
  - Make build verbose
  - Remove rpath
  - Fix ChangeLog encoding
  - Move the big Changelog to the devel package


author: Orcan Ogetbil <oget[dot]fedora[at]gmail[dot]com> - 1.0.21-1
changelog:
  - Update to 10.0.21
  - Do not include the static library in the package (RHBZ#556074)
  - Remove BR on jack since sndfile-jackplay is not provided anymore


author: Ville Skyttä <ville.skytta@iki.fi> - 1.0.25-2
changelog:
  - Patch to use system libgsm instead of a bundled copy.
  - Make main package dep in -devel ISA qualified.
  - Drop -octave Provides (not actually built with octave > 3.0).
  - Don't build throwaway static lib.
  - Run test suite during build.


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.25-14
changelog:
  - fix CVE-2014-9496: 2 buffer overruns in sd2_parse_rsrc_fork (#1178840)
  - division by zero leading to denial of service in psf_fwrite (#1177254)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-1
changelog:
  - updated to 1.0.28
  - fix possible buffer overflow when parsing crafted ID3 tags (#1440758, CVE-2017-7586)
  - fix possible buffer overflow when parsing crafted flac file (#1440756, CVE-2017-7585)


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.17-1
changelog:
  - Update to 0.7.17
  - selected bug fixes:
    * repo_write: fix handling of nested flexarray
    * improve choicerule generation a bit more to cover more cases
    * harden testcase parser against repos being added too late
    * support python-3.10
    * check /var/lib/rpm macro in rpmdb code
  - new features:
    * handle default/visible/langonly attributes in comps parser
    * support multiple collections in updateinfo parser
    * add '-D' option in rpmdb2solv to set the dbpath


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.19-1
changelog:
  - Update to 0.7.19
  - repo_add_conda: add flag to skip v2 packages
  - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt
  - fix error handling in solv_xfopen_fd()
  - fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.20-5
changelog:
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Milan Crha <mcrha@redhat.com> - 2.62.2-1
changelog:
  - Update to 2.62.2
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c:get_cookies() on empty hostnames


author: Jeremy Katz <katzj@redhat.com> 0.7.4-3
changelog:
  - fix to not try to include non-existent doc files and remove all 
    unwanted files from the build
  - include api docs 
  - don't build the apache module


author: Jeremy Katz <katzj@redhat.com> 0.7.9-3
changelog:
  - better lib64 patch
  - fix building of libwsdl-build to use libtool so that it gets built 
    with -fPIC as needed


author: Jeremy Katz <katzj@redhat.com> 1.99.17-1
changelog:
  - rename package to libsoup
  - update to 1.99.17
  - don't obsolete soup for now, it's parallel installable


author: David Malcolm <dmalcolm@redhat.com> - 2.2.2-1
changelog:
  - update from 2.2.1 to 2.2.2
  - add explicit devel requirements on glib2-devel, pkgconfig, gtk-doc, gnutls-devel and libxml2-devel


author: David Malcolm <dmalcolm@redhat.com> - 2.2.5-1
changelog:
  - 2.2.5
  - Removed gnome-bug-306877-soup-connection-ntlm.c.patch (#160071) as this is 
    now in upstream tarball


author: Matthew Barnes <mbarnes@redhat.com> - 2.3.0-1
changelog:
  - Update to 2.3.0
  - Bump glib2 requirement to >= 2.15.3.
  - Clean up some redundant dependencies.
  - Remove patch for RH bug #327871 (fixed in glibc).


author: David King <amigadave@amigadave.com> - 2.51.3-1
changelog:
  - Update to 2.51.3
  - Update URL
  - Use pkgconfig for BuildRequires
  - Preserve timestamps during install


author: Tomas Popela <tpopela@redhat.com> - 2.62.3-6
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Backport upstream patch for CVE-2024-52530 - infinite loop while reading websocket data
  - Resolves: RHEL-67076
  - Resolves: RHEL-67067


author: Tomas Popela <tpopela@redhat.com> - 2.62.3-6
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Backport upstream patch for CVE-2024-52532 - infinite loop while reading websocket data
  - Resolves: RHEL-67076
  - Resolves: RHEL-67067


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-7
changelog:
  - Backport upstream patch for CVE-2024-52531 - buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict
    Resolves: RHEL-76376


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-2021-3634: Fix possible heap-buffer overflow when
    rekeying with different key exchange mechanism
  - Rebase to version 0.9.6
  - Rename SSHD_EXECUTABLE to SSH_EXECUTABLE in tests/torture.c
  - Resolves: rhbz#1896651, rhbz#1994600


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-6
changelog:
  - Enable client and server testing build time
  - Fix failing rekey test on arch s390x
  - Resolves: rhbz#2126342


author: Liwei Ge <liwei.glw@alibaba-inc.com> - 0.9.6-7
changelog:
  - NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)
  - authorization bypass in pki_verify_data_signature (CVE-2023-2283)


author: - Andreas Schneider <asn@redhat.com> - 0.6.1-1
changelog:
  - Update to version 0.6.1.
  - resolves: #1056757 - Fix scp mode.
  - resolves: #1053305 - Fix known_hosts heuristic.


author: Andreas Schneider <asn@redhat.com> - 0.6.5-1
changelog:
  - resolves: #1213775 - Security fix for CVE-2015-3146
  - resolves: #1218076 - Security fix for CVE-2015-3146


author: Andreas Schneider <asn@redhat.com> - 0.7.0-1
changelog:
  - Update to version 0.7.0
    * Added support for ed25519 keys
    * Added SHA2 algorithms for HMAC
    * Added improved and more secure buffer handling code
    * Added callback for auth_none_function
    * Added support for ECDSA private key signing
    * Added more tests
    * Fixed a lot of bugs
    * Improved API documentation


author: Andreas Schneider <asn@redhat.com> - 0.7.1-1
changelog:
  - Update to version 0.7.1
    * Fixed SSH_AUTH_PARTIAL auth with auto public key
    * Fixed memory leak in session options
    * Fixed allocation of ed25519 public keys
    * Fixed channel exit-status and exit-signal
    * Reintroduce ssh_forward_listen()


author: Andreas Schneider <asn@redhat.com> - 0.7.2-1
changelog:
  - Update to version 0.7.2
    * Fixed OpenSSL detection on Windows
    * Fixed return status for ssh_userauth_agent()
    * Fixed KEX to prefer hmac-sha2-256
    * Fixed sftp packet handling
    * Fixed return values of ssh_key_is_(public|private)
    * Fixed bug in global success reply
  - resolves: #1267346


author: Andreas Schneider <asn@redhat.com> - 0.7.3-1
changelog:
  - resolves: #1311259 - Fix CVE-2016-0739
  - resolves: #1311332 - Update to version 0.7.3
    * Fixed CVE-2016-0739
    * Fixed ssh-agent on big endian
    * Fixed some documentation issues
  - Enabled GSSAPI support


author: Andreas Schneider <asn@redhat.com> - 0.7.4-1
changelog:
  - Update to version 0.7.4
    * Added id_ed25519 to the default identity list
    * Fixed sftp EOF packet handling
    * Fixed ssh_send_banner() to confirm with RFC 4253
    * Fixed some memory leaks
  - resolves: #1419007


author: Rex Dieter <rdieter@fedoraproject.org> - 0.7.4-2
changelog:
  - BR: compat-openssl10-devel (f26+, #1423088)
  - use %license
  - -devel: drop hardcoded pkgconfig dep (let autodeps handle it)
  - %files: track library sonames, simplify -devel
  - %install: use 'install/fast' target
  - .spec cosmetics, drop deprecated %clean section


author: Anderson Sasaki <ansasaki@redhat.com> - 0.8.1-2
changelog:
  - Add Provides for libssh_threads.so to unbreak applications
  - Fix ABIMap detection to not depend on python to build


author: Anderson Sasaki <ansasaki@redhat.com> - 0.8.3-1
changelog:
  - Update to version 0.8.3
    * Added support for rsa-sha2 (#1610882)
    * Added support to parse private keys in openssh container format (other than
      ed25519) (#1622983)
    * Added support for diffie-hellman-group18-sha512 and
      diffie-hellman-group16-sha512 (#1610885)
    * Added ssh_get_fingerprint_hash()
    * Added ssh_pki_export_privkey_base64()
    * Added support for Match keyword in config file
    * Improved performance and reduced memory footprint for sftp
    * Fixed ecdsa publickey auth
    * Fixed reading a closed channel
    * Added support to announce posix-rename@openssh.com and hardlink@openssh.com
      in the sftp server
    * Use -fstack-protector-strong if possible (#1624135)


author: Anderson Sasaki <ansasaki@redhat.com> - 0.8.5-1
changelog:
  - Update to version 0.8.5
    * Fixed an issue where global known_hosts file was ignored (#1649321)
    * Fixed ssh_get_fd() to return writable file descriptor (#1649319)
    * Fixed regression introduced in known_hosts parsing (#1649315)
    * Fixed a regression which caused only the first algorithm in known_hosts to
      be considered (#1638790)


author: Anderson Sasaki <ansasaki@redhat.com> - 0.8.91-0.1
changelog:
  - Update to 0.9.0 pre release version (0.8.91)
  - Added default configuration files for client and server
  - Removed unused patch files left behind
  - Fixed issues found to run upstream test suite with SELinux


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.0-1
changelog:
  - Update to version 0.9.0
    https://www.libssh.org/2019/06/28/libssh-0-9-0/
  - Added explicit Requires for crypto-policies
  - Do not ignore known_hosts keys when SSH_OPTIONS_HOSTKEYS is set
  - Provide the configuration files in a separate libssh-config subpackage


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.0-3
changelog:
  - Add Obsoletes in libssh-config to avoid conflict with old libssh which
    installed the configuration files.


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.4-1
changelog:
  - Update to version 0.9.4
    https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
  - Fixed CVE-2019-14889 (#1781782)
  - Fixed CVE-2020-1730 (#1802422)
  - Create missing directories in the path provided for known_hosts files (#1733914)
  - Removed inclusion of OpenSSH server configuration file from
    libssh_server.config (#1821339)


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.4-2
changelog:
  - Do not return error when server properly closed the channel (#1849071)
  - Add a test for CVE-2019-14889
  - Do not parse configuration file in torture_knownhosts test


author: Sahana Prasad <sahana@redhat.com> - 0.9.4-3
changelog:
  - Fix CVE-2020-16135 NULL pointer dereference in sftpserver.c if
    ssh_buffer_new returns NULL (#1862646)


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-2021-3634: Fix possible heap-buffer overflow when
    rekeying with different key exchange mechanism (#1978810)


author: Kamil Dudka <kdudka@redhat.com> - 1.2.20-16
changelog:
  - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646)
  - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.18.2
changelog:
  - Obsolete the python2 packages on upgrade
  - Resolves: rhbz#1567138 - libtdb: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 1.4.2-2
changelog:
  - Resolves: rhbz#1754420 - Rebase libtdb 1.4.2 for samba
  - Related: rhbz#1754420 - Fix sssd tests (tdb)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.9-1
changelog:
  - New upstream bugfix release
  - Adds a new tdbrestore utility
  - Convert to new WAF build-system
  - Add python bindings in new python-tdb subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.9-7
changelog:
  - Let rpmbuild strip binaries, make build more verbose.
  - Original patch by Ville SkyttÃ¤ <ville.skytta@iki.fi>


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.10-15
changelog:
  - New upstream release 1.2.10
  - Remove upstreamed patches
  - Provides functionality for the upcoming Samba 4 beta


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.3.12-5
changelog:
  - rhbz#1401175 - Missing symbol versioning provided by libtdb.so
  - Fix configure time detection with -Werror=implicit-function-declaration
    -Werror=implicit-int
  - https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.3.13-1
changelog:
  - New upstream release 1.3.13
  - removed Group fields (new packaging policy)
  - %defattr() is no longer needed


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.16-1
changelog:
  - New upstream release 1.3.16
  - Use RHEL_ALLOW_PYTHON2_FOR_BUILD=1 until libtalloc uses waf3
  - Patch the waf script to explicitly call python2 as "env python" doesn't
    yield py2 anymore


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.18.1
changelog:
  - Resolves: rhbz#1684579 - Rebase libtdb to version 1.3.18 for Samba
  - Resolves: rhbz#1597319 - libtdb uses Python 2 to build
  - Resolves: rhbz#1567138 - libtdb: Drop Python 2 subpackage from RHEL 8


author: Xin Long <lxin@redhat.com> - 1.29-1
changelog:
  - man teamd.conf: update some parameter default values [1732587]
  - 1.29 release
  - teamd: add port_master_ifindex_changed for link_watch_port_watch_ops
  - initscripts: fix if/fi align
  - teamd: fix a json object memleak in get_port_obj() [1767685]
  - libteam: set netlink event socket as non-blocking [1684389]
  - libteam: double NETLINK_RCVBUF to fix -ENOMEM error
  - teamd: add a default value 1000 for link_watch.interval


