# changelog

author: Tao Liu <ltao@redhat.com> - 2.0.26-2
changelog:
  - Rebase makedumpfile to upstream latest(8e8b8814be1)
  - Show how much time kdump has waited for the network to be ready
  - Tell nmcli to not escape colon when getting the path of connection profile


author: Tao Liu <ltao@redhat.com> - 2.0.26-3
changelog:
  - Rebase makedumpfile to v1.7.3
  - kdumpctl: lower the log level in reset_crashkernel_for_installed_kernel


author: Tao Liu <ltao@redhat.com> - 2.0.26-4
changelog:
  - kdumpctl: Add basic UKI support
  - kdumpctl: Move temp file in get_kernel_size to global temp dir
  - kdumpctl: Move get_kernel_size to kdumpctl
  - kdump-lib: fix prepare_cmdline
  - mkdumprd: call dracut with --add-device to install the drivers needed by /boot partition automatically for FIPS


author: Tao Liu <ltao@redhat.com> - 2.0.26-5
changelog:
  - Add lvm thin provision to kdump supported-kdump-targets.txt
  - mkdumprd: Use the correct syntax to redirect the stderr to null


author: Tao Liu <ltao@redhat.com> - 2.0.26-6
changelog:
  - kdumpctl: Fix the matching of plus symbol by grep's EREs
  - kdump-lib: Evaluate the memory consumption by smmu and mlx5 separately
  - kdump-lib: add support for 64K aarch64
  - kdump-lib: Introduce parse_kver_from_path() to get kernel version from its path name
  - kdump-lib: Introduce a help function _crashkernel_add()
  - Simplify the management of the kernel parameter crashkernel
  - kdump-lib: fix the matching pattern for debug-kernel
  - kdump-lib: always specify version in is_squash_available


author: Tao Liu <ltao@redhat.com> - 2.0.26-7
changelog:
  - kdumpctl: Fix temporary directory location
  - kdump-lib: Match 64k debug kernel in prepare_kdump_bootinfo()


author: EL Errata <el-errata_ww@oracle.com> - 2.0.26-8.0.1
changelog:
  - backport of upstream crash hotplug support [Orabug: 35884469]
  - Insert new udev rules for crash hotplug into 98-kexec.rules [Orabug: 35801595]
  - Handle xen_netfront in dracut module setup [Orabug: 35615400]
  - Update UEK aarch64 reserved sizes for UEK7 kernels [Orabug: 34663083]
  - Correct UEK reserved size for x86_64 [Orabug: 34391412]
  - Update UEK reserved sizes [Orabug: 34240246]
  - fix saving vmcore-dmesg.txt failed on aarch64 with UEK7 [Orabug: 34003037]
  - include OL8 patch for sysconfig, its needed on OL9 [Orabug: 33512440]
  - Update makedumpfile to 1.7.2 [Orabug: 34219368]
  - kdump: skip lvm private devices [Orabug: 33822070] [Orabug: 33574003]
  - Added dracut module setup patches [Orabug: 29518713] [Orabug: 22780125]
  - Added orabug30352094-makedumpfile-Mark-mem-usage-option-unsupported-for-a.patch [Orabug: 30352094]
  - Added orabug30822387.kdumpctl-arm64-fast-boot.patch [Orabug: 30822387]
  - Added orabug30832988.kdump.sysconfig.iommu_off.x86_64.aarch64.patch [Orabug: 30832988]
  - Added orabug30928441.kdumpctl.no_timer_check.patch [Orabug: 30928441]
  - Added orabug32127375-kdump.sysconfig.no.double.s.patch [Orabug: 32127375]
  - Added orabug32258986-arm64-support-more-than-one-crash-kernel-regions.patch [Orabug: 32258986]
  - Removed orabug32258986-arm64-support-more-than-one-crash-kernel-regions.patch [Orabug: 32258986]
  - Removed orabug34003037-arm64-crashdump-deduce-paddr-of-_text-based-on-kerne.patch [Orabug: 34003037]
  - Removed orabug34003037-arm64-make-phys_offset-signed.patch [Orabug: 34003037]
  - Removed orabug34003037-arm64-crashdump-unify-routine-to-get-page_offset.patch [Orabug: 34003037]
  - Removed orabug34003037-arm64-read-VA_BITS-from-kcore-for-52-bits-VA-kernel.patch [Orabug: 34003037]
  - Removed orabug34003037-arm64-fix-PAGE_OFFSET-calc-for-flipped-mm.patch [Orabug: 34003037]
  - Removed orabug34003037-kdump-kexec-fix-saving-vmcore-dmesg.txt-failed-on-aa.patch [Orabug: 34003037]
  - Fix formatting for orabug33822070-kdump-skip-lvm-private-devices.patch [Orabug: 33822070]
  - Rework orabug34663083-Update-UEK-reserved-sizes.patch [Orabug: 34240246]


author: EL Errata <el-errata_ww@oracle.com> - 28-9.0.1
changelog:
  - weak-modules: Fix add_kernel to handle suffix [Orabug: 34623248] (Todd Vierling)
  - add weak-modules patch for [Orabug: 26672773]


author: Julien Rische <jrische@redhat.com> - 1.20.1-1
changelog:
  - Make tests compatible with sssd-client
    Resolves: rhbz#2151513
  - Remove invalid password expiry warning
    Resolves: rhbz#2121099
  - Update error checking for OpenSSL CMS_verify
    Resolves: rhbz#2063838
  - New upstream version (1.20.1)
    Resolves: rhbz#2016312
  - Fix integer overflows in PAC parsing (CVE-2022-42898)
    Resolves: rhbz#2140971


author: Julien Rische <jrische@redhat.com> - 1.20.1-4
changelog:
  - Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf
  - Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf
    Resolves: rhbz#2068535


author: Julien Rische <jrische@redhat.com> - 1.20.1-5
changelog:
  - Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled
  - Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode
    Resolves: rhbz#2162461


author: Julien Rische <jrische@redhat.com> - 1.20.1-9
changelog:
  - Do not disable PKINIT if some of the well-known DH groups are unavailable
    Resolves: rhbz#2187722
  - Make PKINIT CMS SHA-1 signature verification available in FIPS mode
    Resolves: rhbz#2155607
  - Allow to set PAC ticket signature as optional
    Resolves: rhbz#2178298


author: Julien Rische <jrische@redhat.com> - 1.21.1-1
changelog:
  - New upstream version (1.21.1)
  - Fix double-free in KDC TGS processing (CVE-2023-39975)
  - Add support for "pac_privsvr_enctype" KDB string attribute
    Resolves: rhbz#2060421


author: Honza Horak <hhorak@redhat.com> - 590-1
changelog:
  - Update to the version 590
  - Also solves the "message overlay" in the terminal
    Resolves: #2062188


author: Karel Zak <kzak@redhat.com> 2.37.4-6
changelog:
  - fix #2094216 - lslogins reports incorrect "Password is locked" status
  - fix #2117203 - loop-overlay test failed


author: Karel Zak <kzak@redhat.com> 2.37.4-10
changelog:
  - fix #2165981 - fstrim -av fails to trim root filesystem on Red Hat Coreos
  - fix #2141970 - add --cont-clock feature for libuuid and uuidd
  - fix #2133385 - uuidd returns time-based UUIDs when asked for random UUIDs.
  - fix #2156946 - agetty does not handle the \l sequence in /etc/issue correctly
  - fix #2166653 - last(1) should be more robust with work with strings
  - fix #2120246 - use {_tmpfilesdir} also in install section
  - fix #2134143 - publish libsmartcols-devel subpackages to C9S yum repos


author: Karel Zak <kzak@redhat.com> 2.37.4-12
changelog:
  - fix #2133396 - Internal testsuite for cramfs fails on s390x
  - fix #2174748 - enable uuidd cont-clock by default
  - fix #2182169 - lscpu: backport ARM human-readable names from upstream
  - fix #2189947 - libuuid - downport cache related patch
  - fix #2203324 - zram module does not have algorithms mentioned in zramctl command
  - fix #2209267 - Add additional documentation on devices being auto-mounted if a device exists within fstab.
  - fix #2215082 - For the 'sfdisk' man page to further clarify the expected behavior and intended use of the -d option


author: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 2.48-9
changelog:
  - Fix integer overflow in _libcap_strdup() (CVE-2023-2603)
    Resolves: rhbz#2210638
  - Correctly check pthread_create() return value to avoid memory leak (CVE-2023-2602)
    Resolves: rhbz#2222198


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Fix a crash when clearing COMPS_ObjRTree (RhBug:1888343)
  - Fix memory leaks and resource leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.67.0-1
changelog:
  - Fix handling transaction id in resolveTransactionItemReason (RhBug:2010259,2053014)
  - Remove deprecated assertions (RhBug:2027383)
  - Skip rich deps for autodetection of unmet dependencies (RhBug:2033130, 2048394)
  - Increase required rpm version since we use `rpmdbCookie()`
  - Add 'loongarch' support
  - Use dnf solv userdata to check versions and checksum (RhBug:2027445)
  - context: Substitute all repository config options (RhBug:2076853)


author: Lukas Hrazky <lhrazky@redhat.com> - 0.67.0-2
changelog:
  - Add obsoletes to filtering for advisory candidates
  - advisory upgrade: filter out advPkgs with different arch


author: Lukas Hrazky <lhrazky@redhat.com> - 0.69.0-1
changelog:
  - Update to 0.69.0
  - Expose librepo max_downloads_per_mirror configuration
  - Fix listing a repository without cpeid (RhBug:2066334)
  - Gracefully handle failure to open repo primary file
  - context: Fix doc dnf_context_install/remove/update/distrosync
  - context: dnf_context_remove accepts `<package-spec>` as dnf, unify code
  - dnf-context: Disconnect signal handler before dropping file monitor ref


author: EL Errata <el-errata_ww@oracle.com> - 0.69.0-6.0.1
changelog:
  - Replaced bugzilla.oracle.com references [Orabug: 34202300]
  - Update OL9 dnf to recognize UEK7(kernel-uek-core & kernel-uek-modules) as installonlypkgs package [Orabug: 33861607]
  - Replaced bugzilla.redhat.com with bugzilla.oracle.com in config [Orabug: 29656932]
  - Add support for apps that use libdnf to access yum url with 'ociregion' variable [Orabug: 30121584]
  - Update OL8 dnf to recognise kernel-uek as installonlypkgs package [Orabug: 31018668]
  - Disable rhsm [Orabug: 29901202]


author: DJ Delorie <dj@redhat.com> - 3.4.2-8
changelog:
  - Use /etc/sysconfig/libffi-force-shared-memory-check-first to
    override selinux permissions check for shared memory access (#2152228)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-4
changelog:
  - Backport ppc hardware flags detection (#2051307)
  - Disable PKCS#1.5 encryption in FIPS mode (#2061328)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-5
changelog:
  - Allow signature verification with smaller RSA keys (#2083846)
  - Allow short salt for KDF (#2114870)
  - Reseed the kernel DRBG by using GRND_RANDOM (#2118695)
  - Address FIPS review comments around selftests (#2118695)
  - Disable RSA-OAEP in FIPS mode (#2118695)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-6
changelog:
  - Fix SHA3 digests with large inputs (#2129150)
  - Fix FIPS RSA PCT (#2128455)
  - Fix RSA FIPS Keygen that non-deterministically fails (#2130275)
  - Get max 32B from getrandom in FIPS mode (#2130275)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-7
changelog:
  - Properly enforce KDF limits in FIPS mode (#2130275)
  - Fix memory leak in large digest test (#2129150)
  - Fix function name FIPS service indicator by disabling PK encryption and decryption (#2130275)
  - Skip RSA encryption/decryption selftest in FIPS mode (#2130275)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-8
changelog:
  - Fix unneeded PBKDF2 passphrase length limitation in FIPS mode
  - Enforce HMAC key lengths in MD API in FIPS mode


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-9
changelog:
  - Avoid usage of invalid arguments sizes for PBKDF2 in FIPS mode
  - Do not allow large salt lengths with RSA-PSS padding
  - Disable X9.31 key generation in FIPS mode
  - Update the FIPS integrity checking code to upstream version
  - Update cipher modes FIPS indicators for AES WRAP and GCM
  - Disable jitter entropy generator


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-10
changelog:
  - Provide FIPS indicators for MD and HMACs
  - Improve PCT tests for ECDSA and always run them after key is generated
  - Add missing guards for FIPS status in md_sign/verify function
  - Provider FIPS indicators for public key operation flags


author: Richard Hughes <richard@hughsie.com> 0.3.8-1
changelog:
  - New upstream version
  - Add new API requested by fwupd
  - Add the GUsbEndpoint methods to the docs
  - Fix hotplug handling and signal emission during enumerate
  - Do not double-reference USB devices
  - Resolves: rhbz#1965885


author: Jeff Law <law@redhat.com> - 2.3.0-3
changelog:
  - Touch a couple autoconf related files to prevent undesired rebuilding
    if %configure changes one or more configure files.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127510 - Rebase SSSD for RHEL 9.2
  - Resolves: rhbz#1507035 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#1766490 - Use negative cache better and domain checks for lookup by SIDs
  - Resolves: rhbz#1964121 - RFE: Add an option to sssd config to convert home directories to lowercase (or add a new template for the 'override_homedir' option)
  - Resolves: rhbz#2074307 - reduce debug level in case well_known_sid_to_name() fails
  - Resolves: rhbz#2096031 - SSSD: sdap_handle_id_collision_for_incomplete_groups debug message missing a new line
  - Resolves: rhbz#2103325 - Supported AD group types should be explained in the docs
  - Resolves: rhbz#2111388 - authenticating against external IdP services okta (native app) with OAuth client secret failed
  - Resolves: rhbz#2115171 - SSSD: duplicate dns_resolver_* option in man sssd.conf
  - Resolves: rhbz#2127492 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2128840 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2128883 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2136791 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139837 - Analyzer: Optimize and remove duplicate messages in verbose list


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127510 - Rebase SSSD for RHEL 9.2
  - Resolves: rhbz#1608496 - sssd failing to register dynamic DNS addresses against an AD server due to unnecessary DNS search
  - Resolves: rhbz#2110091 - SSSD doesn't handle changes in 'resolv.conf' properly (when started right before network service)
  - Resolves: rhbz#2136791 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139684 - [sssd] RHEL 9.2 Tier 0 Localization
  - Resolves: rhbz#2139837 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142794 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144893 - changing password with ldap_password_policy = shadow does not take effect immediately
  - Resolves: rhbz#2148737 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2160001 - Reference to 'sssd-ldap-attributes' man page is missing in 'sssd-ldap', etc man pages
  - Resolves: rhbz#2143159 - automount killed by SIGSEGV


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167837 - Rebase SSSD for RHEL 9.3
  - Resolves: rhbz#1765354 - [RFE] - Show password expiration warning when IdM users login with SSH keys
  - Resolves: rhbz#1913839 - filter_groups doesn't filter GID from 'id' output: AD + 'ldap_id_mapping = True' corner case
  - Resolves: rhbz#2100789 - [Improvement] sssctl config-check command does not show an error when we don't have id_provider in the domain section
  - Resolves: rhbz#2152177 - [RFE] Add support for ldapi:// URLs
  - Resolves: rhbz#2164852 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2166627 - Improvement: sss_client: add 'getsidbyusername()' and 'getsidbygroupname()' and corresponding python bindings
  - Resolves: rhbz#2166943 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2167728 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190415 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167837 - Rebase SSSD for RHEL 9.3
  - Resolves: rhbz#2196816 - [RHEL9] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2162552 - sssd client caches old data after removing netgroup member on IDM
  - Resolves: rhbz#2189542 - [sssd] RHEL 9.3 Tier 0 Localization
  - Resolves: rhbz#2133854 - [RHEL9] In some cases when `sdap_add_incomplete_groups()` is called with `ignore_group_members = true`, groups should be treated as complete
  - Resolves: rhbz#1765354 - [RFE] - Show password expiration warning when IdM users login with SSH keys


author: Richard Hughes <richard@hughsie.com> 0.1.6-1
changelog:
  - New upstream release
  - Fall back to the AliasId for validation
  - Fix jcat_context_verify_blob() to use self verify for checksums


author: Sahana Prasad <sahana@redhat.com> - 1.2.1-1
changelog:
  - Update to upstream version 1.2.1
  - Remove patch fix MSG_MORE uasge as it is added upstream
  - Remove cppcheck dependency for rhel bz#1931518
  - Add a patch to fix fuzz tests


author: Wen Liang <wenliang@redhat.com> - 1.26.0-2
changelog:
  - Add Conflicts tag because the bash-completion scripts moved from the main package
    to the utils sub package causing a file conflict on multilib systems between the
    old 32 bit main package and the new 64 bit utils sub package.


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.1-1
changelog:
  - Release 2.11.1
  - Ignore Packager documents when running ModuleIndex.update_from_*()
  - Add python overrides for XMD in PackagerV3
  - Add python override to ignore the GType return when reading packager files
  - Add PackagerV3.get_mdversion()


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.2-1
changelog:
  - Release 2.11.2
  - Extend read_packager_[file|string]() to support overriding the module name
    and stream.


author: Stephen Gallagher <sgallagh@redhat.com> - 2.11.2-2
changelog:
  - Fix issue with ModuleIndex when input contains only Obsoletes documents
  - Fix import issue when built with Python 2 support


author: Hangbin Liu <haliu@redhat.com> - 1.8-1
changelog:
  - 1.8 release (rhbz#1958933)
  - libndp,ndptool: use poll() instead of select()
  - libndp: avoid static buffer for debug string in ndp_sock_recv()
  - ndptool: avoid static buffer for string in ndptool
  - libndp: use thread local variables for static return arguments
  - ndptool: don't use static variable for local context in msgrcv_handler_func()
  - ndptool: fix printing dnssl lifetime in ndptool
  - ndptool: fix potential memory leak caused by strdup
  - ndptool: add -D dest support
  - libndp: fix nd_msg typo when setting target address
  - libndp: close sockfd after using to avoid handle leak
  - ndptool: fix target parameter typo
  - ndptool: add -T target support


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-102
changelog:
  - resolves: rhbz#2169980 - Fix winbind memory leak
  - resolves: rhbz#2156056 - Fix Samba shares not accessible issue


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.4-101
changelog:
  - resolves: rhbz#2216712 - Fix broken symlink for libwbclient
  - resolves: rhbz#2214327 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
  - resolves: rhbz#2211605 - Fix access of Samba share with veto files = /.*/
  - resolves: rhbz#2207692 - Fix Python tarfile extraction to avoid a warning


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-100
changelog:
  - resolves: rhbz#2222895 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-100
changelog:
  - related: rhbz#2190415 - Update to version 4.18.6
  - resolves: rhbz#2211617 - Fix the rpcclient dfsgetinfo command


author: Phil Sutter <psutter@redhat.com> - 1.0.9-1
changelog:
  - expect/conntrack: Avoid spurious covscan overrun warning
  - conntrack: fix build with kernel 5.15 and musl
  - New version 1.0.9


author: Steve Dickson <steved@redhat.com> 2.5.4-11
changelog:
  - nfs.man: adding new mount option max_connect (bz 2106848)
  - systemd: Fix format-overflow warning (bz 2106896)


author: Steve Dickson <steved@redhat.com> 2.5.4-12
changelog:
  - idmapd: Fix error status when nfs-idmapd exits (bz 2001764)
  - mount.nfs Fix error reporting for already mounted shares (bz 2054300)
  - rpcctl - fix failure when setting xprt offline and online (bz 2081934)
  - rpc-pipefs-generator: allocate enough space (bz 2109420)


author: Steve Dickson <steved@redhat.com> 2.5.4-15
changelog:
  - Fix uninstall warnings (bz 2048023)
  - rpc-statd.service: Stop rpcbind and rpc.stat in an exit race (bz 2112941)


author: Steve Dickson <steved@redhat.com> 2.5.4-16
changelog:
  - nfsd.man: Explain that setting nfsv4=n turns off all v4 versions (bz 2042362)
  - mount.nfs: fix NULL pointer derefernce in nfs_parse_square_bracket (bz 2136807)


author: Steve Dickson <steved@redhat.com> 2.5.4-19
changelog:
  - Don't allow junction tests to trigger automounts (bz 2148353)
  - Fix typo in man page nfs.conf.man (bz 2203092)


author: Nikola Forró <nforro@redhat.com> - 2:1.6.37-10
changelog:
  - Remove the aarch64 test workaround, the patches causing the failures
    have been dropped in zlib-1.2.11-25


author: Tomáš Mráz <tmraz@redhat.com> 1.4.3-1
changelog:
  - Multiple translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-2
changelog:
  - Resolves rhbz#1919026 libpwquaily rpm requires cracklib-dict to function but RPM missing requirement


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.0-1
changelog:
  - Update to 1.14.0
  - Reposync does not re-download unchanged packages (RhBug:1931904)
  - Return "calculated" checksum if requested w/caching
  - Fixed memory leaks and segfault


author: Lukas Hrazky <lhrazky@redhat.com> - 1.14.5-1
changelog:
  - Update to 1.14.5
  - Detailed error message when using non-existing TMPDIR (RhBug:2019993)
  - Make error messages about repodata and rpm mismatch more user friendly


author: EL Errata <el-errata_ww@oracle.com> - 2.15.2-6.0.1
changelog:
  - Update workflow xml for Oracle [Orabug: 18945470]
  - Add oracle-enterprise.patch and oracle-enterprise-po.patch
  - Remove libreport-plugin-rhtsupport and libreport-rhel
  - Added orabug20390725.patch to remove redhat reference [Orabug: 20390725]
  - Added Bug20357383.patch to remove redhat reference [Orabug: 20357383]
  - Removed libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla
  - Remove options interacting with Bugzilla [Orabug: 32895080]


author: Neal Gompa <ngompa13@gmail.com> - 2.4.2-2
changelog:
  - Modernize spec
  - Backport fix for missing __SNR_ppoll symbol (#1777889)
  - Refresh patch to build on aarch64 with upstream version


author: Petr Lautrbach <plautrba@redhat.com> - 3.3-3
changelog:
  - allow spaces in user/group names (#2049665)
  - Fall back to semanage_copy_dir when rename() fails (#2068085)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.22-1
changelog:
  - Update to 0.7.22
  - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
  - support zstd compressed control files in debian packages
  - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20)
  - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata
  - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck
  - support solv files with an idarray block
  - allow accessing the toolversion at runtime
  - support parsing of Debian's Multi-Arch indicator
  - fix segfault on conflict resolution when using bindings
  - fix split provides not working if the update includes a forbidden vendor change
  - reworked choice rule generation to cover more usecases
  - support SOLVABLE_PREREQ_IGNOREINST in the ordering code


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.24-1
changelog:
  - Update to 0.7.24
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Norbert Pocs <npocs@redhat.com> - 0.10.4-3
changelog:
  - Enable pkcs11 support
  - Fix broken libsofthsm path on i686
  - Add missing bugzilla references from the rebase commit
  - Related: rhbz#2026449
  - Resolves: rhbz#1977913, rhbz#1975500


author: Norbert Pocs <npocs@redhat.com> - 0.10.4-4
changelog:
  - Move loglevel closer to openssh loglevel
  - Add openssh config feature of +,-,^ for algorithm lists
  - Fix memory leaks of bignum
  - Prevent multiple expansion of escape characters
  - Resolves: rhbz#2132407, rhbz#2137839, rhbz#2144795, rhbz#2136824


author: Norbert Pocs <npocs@redhat.com> - 0.10.4-6
changelog:
  - Fix covscan error
  - Remove unwanted test with yet unimplemented feature
  - Related: rhbz#2137839, rhbz#2136824


author: Norbert Pocs <npocs@redhat.com> - 0.10.4-9
changelog:
  - Fix CVE-2023-1667 and CVE-2023-2283
  - Fix issues found by cosvcan
  - Resolves: rhbz#2182252, rhbz#2189740


author: Christopher Engelhard <ce@lcts.de> - 2.1.1-1
changelog:
  - Update to 2.1.1
  - Remove all patches merged upstream
  - Switched build to autotools
  - Include upstream pkgconfig module
  - Sysfsutils no longer includes /usr/bin/get_module


author: Hangbin Liu <haliu@redhat.com> - 1.31-8
changelog:
  - Build util team2bond in teamd rpm [1986788]
  - Add some cautions to util team2bond [1986788]
  - Add team2bond man doc [1986788]


author: Long Xin <lxin@redhat.com> - 1.31-16
changelog:
  - fix the Requires package name for teamd-devel
  - teamd: stop iterating callbacks when a loop restart is requested (rhbz#2148852)


author: Steve Dickson <steved@redhat.com> - 1.3.3-1
changelog:
  - bindresvport.c: fix a potential resource leakage (bz 2135405)
  - clnt_raw.c: fix a possible null pointer dereference (bz 2138317)


author: Mike FABIAN <mfabian@redhat.com> - 0.9.10-12
changelog:
  - Fix memory leak in vasnprint. Resolves: rhbz#1938800
    (Backported from upstream: https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4d288a80bf7ebe29334b9805cdcc70eacb6059c1)


author: Benjamin Berg <bberg@redhat.com> - 1.0.25-1
changelog:
  - Update to 1.0.25
  - Fix a crash after libusb_exit API has been misused
  - Add patchset to fix covscan reports
    Resolves: #1938801


author: Benjamin Berg <bberg@redhat.com> - 1.0.26
changelog:
  - Pull in new upstream libusb containing important regression fixes
    Resolves: #2058730
    Resolves: #1938801


author: David King <dking@redhat.com> - 2.9.10-12
changelog:
  - Fix CVE-2021-3516 (#1956969)
  - Fix CVE-2021-3517 (#1957002)
  - Fix CVE-2021-3518 (#1957029)
  - Fix CVE-2021-3537 (#1957285)


author: Richard Hughes <richard@hughsie.com> 0.3.0-1
changelog:
  - New upstream release
  - Add a new object to contain query context data
  - Allow collapsing empty XML tags if no children or text
  - Allow marking elements as tokenized from xb-tool
  - Allow optimized searching when comparing tokens
  - Cancel the GFileMonitor before unreffing it
  - Do not allocate a 128Mb buffer for each xb_builder_source_ctx_get_bytes()
  - Do not error when creating a query if the element doesn’t exist
  - Fix a parse failure for a double comment
  - Fix various errors or missing annotations in docs
  - Make handling of single-result queries more robust
  - Support mmap()ing the source file to get bytes
  - Support query caching with xb_silo_lookup_query()
  - Support UTF-8 for upper-case() and lower-case()
  - Use g_str_match_string() for non-ASCII search queries
  - Write search tokens into the built silo


author: Richard Hughes <richard@hughsie.com> 0.3.3-1
changelog:
  - New upstream release
  - Add locking for file monitors
  - Add support for LZMA decompression
  - Clarify GMainContext usage and signal emission
  - Respect XB_BUILDER_NODE_FLAG_IGNORE when exporting
  - Use the chosen chunk size when reading from a stream
  - Use the correct pkgconfig export package name in the GIR file
  - Always run xb-tool queries with the optimizer
  - Ensure tokens handling works when XbOpcode is not zero-inited
  - Use stack-allocated XbStack instances for running a machine
  - Resolves: rhbz#1965891


author: Neal Gompa <ngompa@centosproject.org> - 0.3.10-1
changelog:
  - New upstream release
  - Fix dumping and exporting multiple files from the CLI
  - Watch files before loading them into the builder
  - Fix potential double free when filtering by language
  - Fix the crash for when the root tree has no children
  - Fix the crash when getting the element for the [empty] root
  - Install xb-tool into bindir
  - Ensure reproducible results when importing a node
  - Ignore all hidden files when using _WATCH_DIRECTORY
  - Show the value bindings when using XB_SILO_PROFILE_FLAG_XPATH
  - Ensure _IS_TOKENIZED is set if tokens are added manually
  - Ensure we never add too many tokens to the silo
  - Put tail after the node when exporting XbBuilderNode
  - Remove the G_ALIGNOF checks to fix compile with old GLib versions
  - Add a flag to require the XbBuilderSource to have no siblings
  - Add iterator for XbNode attributes and children
  - Allow removing XbBuilderNode text
  - Allow stripping builder node inner text
  - Resolves: rhbz#2134794


author: John Eckersberg <jeckersb@redhat.com> - 0.2.5-4
changelog:
  - Add BuildRequires for make
    (re: https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot)


author: Michel Alexandre Salim <salimma@centosproject.org> - 1.5.1-1
changelog:
  - Rebase to the latest upstream version
  - Enable optional gz, xz/lzma, and lz4 support in the zstd tool
  - Disable amd64 assembly on non-x86_64 architectures (rhbz#2035802)
    this should avoid the issue where an executable stack is created
  - Re-enable CET protections (rhbz#2039353)
    Resolves: rhbz#2039488


author: Kamil Dudka <kdudka@redhat.com> - 3.18.0-4
changelog:
  - make `renamecopy` and `copytruncate` override each other (#1934601)
  - unify documentation of copy/copytruncate/renamecopy (#1934629)
  - fix resource leaks reported by Coverity


author: DJ Delorie <dj@redhat.com> - 1:4.3-5
changelog:
  - Allow users to build with or without guile support as desired.
  - Allow derivative downstreams to default to disabling guile support.


author: Xiao Ni <xni@redhat.com> - 4.2-7
changelog:
  - Update to latest upstream and keep udev rule close to upstream
  - Resolves rhbz#2107147, rhbz#2129087, rhbz#2126428


author: Xiao Ni <xni@redhat.com> - 4.2-8
changelog:
  - Update to latest upstream
  - Resolves rhbz#2127101, rhbz#2139789, rhbz#2149292, rhbz#2151209, rhbz#2148945


author: Xiao Ni <xni@redhat.com> - 4.2-9
changelog:
  - Update to latest upstream and fix mdcheck service bug
  - Resolves rhbz#2159923, rhbz#2150865, rhbz#2124071, rhbz#2203859


author: Nicola Sella <nsella@redhat.com> - 3.6.0-1
changelog:
  - Update to 3.6.0
  - spec: Sync summary and description from openSUSE
  - Add support for setting a platform module ID
  - Add dependency for DNF configurations skeleton
  - Add support for setting allow_vendor_change


author: Nicola Sella <nsella@redhat.com> - 3.7.1-1
changelog:
  - Update to 3.7.1
  - [download] fix: unwanted dependency on newer glib 
  - [download] Support for "--resolve" and "--alldeps" arguments 
  - [download] New get_packages_query function
  - Support "--setopt=keepcache=0/1"
  - [download] Support "--archlist=" argument
  - [download] Move package download code to "download_packages" function
  - [download] several optimizations
  - Don't set default value of "assumeyes" to TRUE 
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Extend "--setopt" to support repository options 
  - Added alias "update" to "upgrade" command
  - Command "update" renamed to "upgrade"
  - Add support for command aliases
  - dnf-data requirement only for Fedora and future RHEL
  - Relicense to GPLv2+ [errata corrige: not in 3.5.1-1]
  - Sync summary and description from openSUSE [errata corrige: not in 3.6.0-1]


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - distrosync: Fix style issues and plugin build with Meson 
  - Add distro-sync subcommand
  - Add "makecache" command


author: Lukas Hrazky <lhrazky@redhat.com> - 3.9.1-1
changelog:
  - Update to 3.9.1
  - leaves: Treat recommends as dependencies when install_weak_deps=True
  - Add leaves command
  - Remove non-breaking space from "Size" column (RhBug:2010676)


author: Nicola Sella <nsella@redhat.com> - 3.9.1-2
changelog:
  - Revert: leaves: Treat recommends as dependencies when install_weak_deps=True
  - Revert: Add leaves command


author: Tomas Popela <tpopela@redhat.com> - 0.26-27
changelog:
  - Don't prune bind mounts on ostree based systems, prune the deployments folder
    there to avoid duplications.
  - Fixes: https://github.com/fedora-silverblue/issue-tracker/issues/76


author: Peter Jones <pjones@redhat.com> - 2:0.5.0-3
changelog:
  - Add support for "mokutil --list-sbat-revocations" and
    "mokutil --set-sbat-policy"
    Related: CVE-2022-28737


author: Pavel Cahyna <pcahyna@redhat.com> - 4.0.26-4
changelog:
  - Add dependency on glibc-gconv-extra
    mtools need codepage 850, which was split from glibc into a subpackage.
    (Fedora bug #2021637, RHEL bug #2073843)


author: Robert Scheck <robert@fedoraproject.org> - 2:0.94-1
changelog:
  - Rebase to 0.94 (#1742473, #1840079)
  - Drop policykit wrapper for xmtr due to libcap (#1488417, #1488418)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.2-9.20210508
changelog:
  - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491)
  - ignore TERMINFO and HOME environment variables if running as root (#2211666)


author: Phil Sutter <psutter@redhat.com> [1.0.4-2.el9]
changelog:
  - intervals: Do not sort cached set elements over and over again (Phil Sutter) [1917398]
  - intervals: do not empty cache for maps (Phil Sutter) [1917398]
  - intervals: do not report exact overlaps for new elements (Phil Sutter) [1917398]
  - rule: collapse set element commands (Phil Sutter) [1917398]
  - tests: shell: runtime set element automerge (Phil Sutter) [1917398]


author: Phil Sutter <psutter@redhat.com> [1.0.4-8.el9]
changelog:
  - monitor: Sanitize startup race condition (Phil Sutter) [2130721]
  - evaluate: set eval ctx for add/update statements with integer constants (Phil Sutter) [2094894]
  - src: allow anon set concatenation with ether and vlan (Phil Sutter) [2094887]
  - evaluate: search stacked header list for matching payload dep (Phil Sutter) [2094887]
  - netlink_delinearize: also postprocess OP_AND in set element context (Phil Sutter) [2094887]
  - tests: add a test case for ether and vlan listing (Phil Sutter) [2094887]
  - debug: dump the l2 protocol stack (Phil Sutter) [2094887]
  - proto: track full stack of seen l2 protocols, not just cumulative offset (Phil Sutter) [2094887]
  - netlink_delinearize: postprocess binary ands in concatenations (Phil Sutter) [2094887]
  - netlink_delinearize: allow postprocessing on concatenated elements (Phil Sutter) [2094887]
  - intervals: check for EXPR_F_REMOVE in case of element mismatch (Phil Sutter) [2115627]
  - intervals: fix crash when trying to remove element in empty set (Phil Sutter) [2115627]
  - scanner: don't pop active flex scanner scope (Phil Sutter) [2113874]
  - parser: add missing synproxy scope closure (Phil Sutter) [2113874]
  - tests/py: Add a test for failing ipsec after counter (Phil Sutter) [2113874]
  - doc: Document limitations of ipsec expression with xfrm_interface (Phil Sutter) [1806431]


author: Phil Sutter <psutter@redhat.com> [1.0.4-9.el9]
changelog:
  - tests: add a test case for map update from packet path with concat (Phil Sutter) [2094894]
  - netlink_linearize: fix timeout with map updates (Phil Sutter) [2094894]
  - netlink_delinearize: fix decoding of concat data element (Phil Sutter) [2094894]


author: Phil Sutter <psutter@redhat.com> [1.0.4-10.el9]
changelog:
  - netlink_delinearize: Sanitize concat data element decoding (Phil Sutter) [2160049]
  - optimize: Clarify chain_optimize() array allocations (Phil Sutter) [2160049]
  - optimize: Do not return garbage from stack (Phil Sutter) [2160049]
  - netlink: Fix for potential NULL-pointer deref (Phil Sutter) [2160049]
  - meta: parse_iso_date() returns boolean (Phil Sutter) [2160049]
  - mnl: dump_nf_hooks() leaks memory in error path (Phil Sutter) [2160049]
  - owner: Fix potential array out of bounds access (Phil Sutter) [2160049]


author: Phil Sutter <psutter@redhat.com> [1.0.4-11.el9]
changelog:
  - rule: check address family in set collapse (Phil Sutter) [RHEL-5908]
  - spec: Rename variables to avoid a clash (Phil Sutter) [INTERNAL]


author: Ashish Samant <ashish.samant@oracle.com> - 1.8.6-11
changelog:
  - tunefs.ocfs2: read journal superblock even for online operations (Ashish
    Samant)  [Orabug: 28804934]


author: Than Ngo <than@redhat.com> - 3.18.0-1
changelog:
  - Resolves: #2044179, rebase to 3.18.0
  - Resolves: #2068091, pkcsconf -t failed with Segmentation fault in FIPS mode
  - Resolves: #2066763, Dilithium support not available
  - Resolves: #2064697, OpenSSL 3.0 Compatibility for IBM Security Libraries and Tools
  - Resolves: #2044181, support crypto profiles
  - Resolves: #2044180, add crypto counters


author: Than Ngo <than@redhat.com> - 3.18.0-4
changelog:
  - Related: #2044179, do not touch opencryptoki.conf if it is in place already and even if it is unchanged


author: Than Ngo <than@redhat.com> - 3.19.0-1
changelog:
  - Resolves: #2126294, opencryptoki fails after generating > 500 RSA keys
  - Resolves: #2110314, rebase to 3.19.0
  - Resolves: #2110989, openCryptoki key generation with expected MKVP only on CCA and EP11 tokens
  - Resolves: #2110476, openCryptoki ep11 token: master key consistency
  - Resolves: #2018458, openCryptoki ep11 token: vendor specific key derivation


author: Than Ngo <than@redhat.com> - 3.21.0-3
changelog:
  - Resolves: #2110497, concurrent MK rotation for cca token
  - Resolves: #2110498, concurrent MK rotation for ep11 token
  - Resolves: #2110499, ep11 token: PKCS #11 3.0 - support AES_XTS
  - Resolves: #2111010, cca token: protected key support 
  - Resolves: #2160061, rebase to 3.21.0
  - Resolves: #2160105, pkcsslotd hardening
  - Resolves: #2160107, p11sak support Dilithium and Kyber keys
  - Resolves: #2160109, ica and soft tokens: PKCS #11 3.0 - support AES_XTS


author: Than Ngo <than@redhat.com> - 3.21.0-8
changelog:
  - Resolves: #2222592, p11sak tool: slot option does not accept argument 0 for slot index 0
  - Resolves: #2222596, p11sak fails as soon as there reside non-key objects


author: Simon Pichugin <spichugi@redhat.com> - 2.4.59-2
changelog:
  - Enable BIND_NOW to prevent GOT overwrite attacks.
  - Ignore badfuncs error in rpminspect because it's a false positive
    Related: rhbz#2002747


author: Simon Pichugin <spichugi@redhat.com> - 2.6.2-1
changelog:
  - Update to new major release OpenLDAP 2.6.2
  - The client tools parameters '-h' and '-p' are officially deprecated,
    please, use '-H' parameter instead.
    Related: rhbz#2094159


author: Jakub Jelen <jjelen@redhat.com> - 0.22.0-2
changelog:
  - Unbreak detection of unentrolled smart cards (#2007029)
  - Enable file caching by default except for pkcs15-init (#2000626)


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-1
changelog:
  - Rebase to latest 0.23.0 release (#2100409)
  - Use separate OpenSSL context to work better from inside of OpenSSL providers


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-2
changelog:
  - Fix regression in handling OpenPGP cards
  - Fix CVE-2023-2977: buffer overrun in pkcs15init for cardos


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-26
changelog:
  - Fix one-byte overflow in SSH banner processing
    Resolves: rhbz#2138345
  - Fix double free() in error path
    Resolves: rhbz#2138347


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-28
changelog:
  - Do not try to use SHA1 for host key ownership proof when we don't support it server-side
    Resolves: rhbz#2088750


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-30
changelog:
  - Some non-terminating processes were listening on ports.
    Resolves: rhbz#2177768
  - On sshd startup, we check whether signing using the SHA1 for signing is
    available and don't use it when it isn't.
  - On ssh private key conversion we explicitly use SHA2 for testing RSA keys.
  - In sshd, when SHA1 signatures are unavailable, we fallback (fall forward :) )
    to SHA2 on host keys proof confirmation.
  - On a client side we permit SHA2-based proofs from server when requested SHA1
    proof (or didn't specify the hash algorithm that implies SHA1 on the client
    side). It is aligned with already present exception for RSA certificates.
  - We fallback to SHA2 if SHA1 signatures is not available on the client side
    (file sshconnect2.c).
  - We skip dss-related tests (they don't work without SHA1).
    Resolves: rhbz#2070163
  - FIPS compliance efforts for dh, ecdh and signing
    Resolves: rhbz#2091694


author: Norbert Pocs <npocs@redhat.com> - 8.7p1-31
changelog:
  - Fix minor issues with openssh-8.7p1-evp-fips-compl-dh.patch:
  - Check return values
  - Use EVP API to get the size of DH
  - Add some log debug lines
  - Related: rhbz#2091694


author: Norbert Pocs <npocs@redhat.com> - 8.7p1-32
changelog:
  - Fix pkcs11 issue with the recent changes
  - Delete unnecessary log messages from previous compl-dh patch
  - Add ssh_config man page explanation on rhbz#2068423
  - Resolves: rhbz#2207793, rhbz#2209096


author: Sahana Prasad <sahana@redhat.com> - 1:3.0.7-16
changelog:
  - Upload new upstream sources without manually hobbling them.
  - Remove the hobbling script as it is redundant. It is now allowed to ship
    the sources of patented EC curves, however it is still made unavailable to use
    by compiling with the 'no-ec2m' Configure option. The additional forbidden
    curves such as P-160, P-192, wap-tls curves are manually removed by updating
    0011-Remove-EC-curves.patch.
  - Enable Brainpool curves.
  - Apply the changes to ec_curve.c and  ectest.c as a new patch
    0010-Add-changes-to-ectest-and-eccurve.patch instead of replacing them.
  - Modify 0011-Remove-EC-curves.patch to allow Brainpool curves.
  - Modify 0011-Remove-EC-curves.patch to allow code under macro OPENSSL_NO_EC2M.
    Resolves: rhbz#2130618, rhbz#2188180


author: Clemens Lang <cllang@redhat.com> - 1:3.0.7-19
changelog:
  - Re-enable DHX keys in FIPS mode, disable FIPS 186-4 parameter validation and generation in FIPS mode
    Resolves: rhbz#2169757


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-20
changelog:
  - Fix possible DoS translating ASN.1 object identifiers
    Resolves: CVE-2023-2650
  - Release the DRBG in global default libctx early
    Resolves: rhbz#2211340


author: John Mcwalters <john.mcwalters@oracle.com> - 9-4.0.1
changelog:
  - Add redhat-indexhtml to Obsoletes and Provides [Orabug: 34124784]
  - Replaced upstream references [Orabug: 34032132]


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-8
changelog:
  - Added Oracle Linux 9.1 Repositories [ OraBug: 34662258 ]
  - Removed Oracle Linux 9 developer preview repositories [ OraBug: 34662258 ]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 1.0-9
changelog:
  - Update post scripts to support new self-service DNS hostnames [JIRA: OLDIS-22726]
  - Modified repositories for developer preview [Orabug: 35260780]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 1.0-10
changelog:
  - Added Oracle Linux 9.2 Repositories [Orabug: 35264224]
  - Removed Oracle Linux 9 developer preview repositories [OraBug: 35264224]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 1.0-12
changelog:
  - Enabled Oracle Linux 9.3 Repositories [Orabug: 35981276]
  - Removed Pre-GA Oracle Linux 9.3 Repositories [Orabug: 35981276]


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.23.22-1
changelog:
  - Release 0.23.22 (Daiki Ueno)
  - Follow-up to arithmetic overflow fix (David Cook)
  - Check for arithmetic overflows before allocating (David Cook)
  - Check attribute length against buffer size (David Cook)
  - Fix bounds check in p11_rpc_buffer_get_byte_array (David Cook)
  - Fix buffer overflow in log_token_info (David Cook)
  - common: Don't assume __STDC_VERSION__ is always defined (Daiki Ueno)
  - compat: getauxval: correct compiler macro for FreeBSD (Daiki Ueno)
  - compat: fdwalk: add guard for Linux specific local variables (Daiki Ueno)
  - meson: Add missing libtasn1 dependency (Daiki Ueno)
  - travis: Add freebsd build (Daiki Ueno)
  - anchor: Prefer persistent format when storing anchor (Daiki Ueno)
  - travis: Run "make check" along with "make distcheck" for coverage (Daiki Ueno)
  - travis: Use python3 as the default Python interpreter (Daiki Ueno)
  - travis: Route to Ubuntu 20.04 base image (Daiki Ueno)
  - meson: Set -fstack-protector for MinGW64 cross build (Daiki Ueno)
  - meson: expand ternary operator in function call for compatibility (Daiki Ueno)
  - meson: Use custom_target for generating external XML entities (Daiki Ueno)
  - meson: Allow building manpages without gtk-doc (Jan Alexander Steffens (heftig))
  - Rename is_path_component to is_path_separator (Alexander Sosedkin)
  - Use is_path_component in one more place (Alexander Sosedkin)
  - Remove more duplicate separators in p11_path_build (Alexander Sosedkin)
  - common: Fix infloop in p11_path_build (Daiki Ueno)
  - proxy: C_CloseAllSessions: Make sure that calloc args are non-zero (Daiki Ueno)
  - build: Use calloc in a consistent manner (Daiki Ueno)
  - meson: Allow override of default bashcompdir. Fixes meson regression (issue #322).  Pass -Dbashcompdir=/xxx to meson. (John Hein)
  - common: Check for a NULL locale before freeing it (Tavian Barnes)
  - p11_test_copy_setgid: Skip setgid tests on nosuid filesystems (Anders Kaseorg)
  - unix-peer: replace incorrect include1 (Rosen Penev)
  - test-compat: Skip getprogname test if BUILDDIR contains a symlink (Daiki Ueno)
  - add trust-extract-compat into EXTRA-DIST (Xℹ Ruoyao)
  - meson: install trust-extract-compat (Xℹ Ruoyao)
  - rename trust-extract-compat.in to trust-extract-compat (Xℹ Ruoyao)


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.24.0-1
changelog:
  - common: Only check strndup behavior when replacement is used (Daiki Ueno)
  - Release 0.24.0 (Daiki Ueno)
  - Release 0.23.22 (Daiki Ueno)
  - rpc: Tighten attribute array check with manual enumeration (Daiki Ueno)
  - Check for SUN_LEN and provide fallback (Claes Nästén)
  - Do not define _XOPEN_SOURCE in compat.c on Solaris (Claes Nästén)
  - make autogen.sh a bit more portable (Claes Nästén)
  - rpc-server: Disable parsing CKF_ARRAY_ATTRIBUTE (Daiki Ueno)
  - Update README.md (Daiki Ueno)
  - README.md: Suggest using only meson sub-commands instead of ninja (Daiki Ueno)
  - p11-kit: Add missing <limits.h> include for SIZE_MAX (Daiki Ueno)
  - packit: drop synced_files (Tomas Tomecek)
  - packit: fedora renamed master branch to rawhide (Tomas Tomecek)
  - Fix minor typo (Yuri Chornoivan)
  - po: Add trust/trust.c to POTFILES.in (Daiki Ueno)
  - po: Update POTFILES.in (Daiki Ueno)
  - trust: Make more strings translatable (Daiki Ueno)
  - p11-kit: Make more strings translatable (Daiki Ueno)
  - common: Enable message translation in p11_tool_main (Daiki Ueno)
  - meson: Make sure to set PROJECT_NAME and ENABLE_NLS for 'nls' option (Daiki Ueno)
  - build: Add fuzz/meson.build in the distribution (Daiki Ueno)
  - fuzz: Move the directory out of build/ (Daiki Ueno)
  - Release all library/mock resources before exit (David Cook)
  - Add separate oss-fuzz Makefile target (David Cook)
  - Add build targets for future additional fuzzers (David Cook)
  - Build fuzzer target from meson/ninja (David Cook)
  - Explicit dependency for virtual-fixed-generated.h (David Cook)
  - Build fuzzer target from automake (David Cook)
  - rpc_fuzzer: Clean up buffer before exit (David Cook)
  - New set of fuzzer seeds (David Cook)
  - github: Remove unnecessary SRCDIR envvar (Daiki Ueno)
  - github: Use runuser instead of su for building and testing (Daiki Ueno)
  - github: Use composite action to simplify the main recipe (Daiki Ueno)
  - github: Use pre-built container image for building (Daiki Ueno)
  - README.md: Add GitHub workflow status (Daiki Ueno)
  - travis: Remove configurations other than FreeBSD (Daiki Ueno)
  - autotools: Fix for VPATH build (Daiki Ueno)
  - github actions: Initial CI setup (Anderson Toshiyuki Sasaki)
  - modules: p11_kit_initialize_module: Remove redundant module unref (Daiki Ueno)
  - server: Account for NUL byte at the end of Unix domain socket path (Daiki Ueno)
  - compat: Expose FreeBSD specific issetugid, getresuid, and getresgid (Daiki Ueno)
  - compat: Remove <unistd.h> inclusion from compat.h (Daiki Ueno)
  - compat: Avoid unused variables warning in fdwalk emulation (Daiki Ueno)
  - compat: Pacify ASan complaints on intentionally leaked buffer (Daiki Ueno)
  - meson: Link trust/client modules explicitly to -ldl (Daiki Ueno)
  - p11-kit/lists.c: Add stdint.h to fix compilation (Daniel Engberg)
  - Follow-up to arithmetic overflow fix (David Cook)
  - Check for arithmetic overflows before allocating (David Cook)
  - Check attribute length against buffer size (David Cook)
  - Fix bounds check in p11_rpc_buffer_get_byte_array (David Cook)
  - Fix buffer overflow in log_token_info (David Cook)
  - common: Don't assume __STDC_VERSION__ is always defined (Daiki Ueno)
  - compat: getauxval: correct compiler macro for FreeBSD (Daiki Ueno)
  - compat: fdwalk: add guard for Linux specific local variables (Daiki Ueno)
  - meson: Add missing libtasn1 dependency (Daiki Ueno)
  - travis: Add freebsd build (Daiki Ueno)
  - anchor: Prefer persistent format when storing anchor (Daiki Ueno)
  - travis: Run "make check" along with "make distcheck" for coverage (Daiki Ueno)
  - travis: Use python3 as the default Python interpreter (Daiki Ueno)
  - travis: Route to Ubuntu 20.04 base image (Daiki Ueno)
  - meson: Set -fstack-protector for MinGW64 cross build (Daiki Ueno)
  - meson: expand ternary operator in function call for compatibility (Daiki Ueno)
  - meson: Use custom_target for generating external XML entities (Daiki Ueno)
  - meson: Allow building manpages without gtk-doc (Jan Alexander Steffens (heftig))
  - Rename is_path_component to is_path_separator (Alexander Sosedkin)
  - Use is_path_component in one more place (Alexander Sosedkin)
  - Remove more duplicate separators in p11_path_build (Alexander Sosedkin)
  - common: Fix infloop in p11_path_build (Daiki Ueno)
  - Use inclusive language on certificate distrust (Daiki Ueno)
  - proxy: C_CloseAllSessions: Make sure that calloc args are non-zero (Daiki Ueno)
  - build: Use calloc in a consistent manner (Daiki Ueno)
  - meson: Allow override of default bashcompdir. Fixes meson regression (issue #322).  Pass -Dbashcompdir=/xxx to meson. (John Hein)
  - common: Check for a NULL locale before freeing it (Tavian Barnes)
  - p11_test_copy_setgid: Skip setgid tests on nosuid filesystems (Anders Kaseorg)
  - unix-peer: replace incorrect include1 (Rosen Penev)
  - test-compat: Skip getprogname test if BUILDDIR contains a symlink (Daiki Ueno)
  - add trust-extract-compat into EXTRA-DIST (Xℹ Ruoyao)
  - meson: install trust-extract-compat (Xℹ Ruoyao)
  - rename trust-extract-compat.in to trust-extract-compat (Xℹ Ruoyao)


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.24.1-1
changelog:
  - Release 0.24.1 (Daiki Ueno)
  - common: Support copying attribute array recursively (Daiki Ueno)
  - common: Add assert_ptr_cmp (Daiki Ueno)
  - gtkdoc: remove dependencies on custom target files (Eli Schwartz)
  - doc: Replace occurrence of black list with blocklist (Daiki Ueno)
  - build: Suppress cppcheck false-positive on array bounds (Daiki Ueno)
  - ci: Use Docker image from the same repository (Daiki Ueno)
  - ci: Integrate Docker image building to GitHub workflow (Daiki Ueno)
  - rpc: Fallback to version 0 if server does not support negotiation (Daiki Ueno)
  - build: Port e850e03be65ed573d0b69ee0408e776c08fad8a3 to meson (Daiki Ueno)
  - Link libp11-kit so that it cannot unload (Emmanuel Dreyfus)
  - trust: Use dngettext for plurals (Daiki Ueno)
  - rpc: Support protocol version negotiation (Daiki Ueno)
  - rpc: Separate authentication step from transaction (Daiki Ueno)
  - Meson: p11_system_config_modules instead of p11_package_config_modules (Issam E. Maghni)
  - shell: test -a|o is not POSIX (Issam E. Maghni)
  - Meson: Add libtasn1 to trust programs (Issam E. Maghni)
  - meson: optionalise glib's development files for gtk_doc (Đoàn Trần Công Danh)


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-14
changelog:
  - pam_lastlog: check localtime_r() return value. Resolves: #2130124
  - pam_faillock: clarify missing user faillock files after reboot. Resolves: #2126632
  - pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2126648


author: Brian C. Lane <bcl@redhat.com> - 3.4-4
changelog:
  - Fix issues that covscan classifies as important
    Resolves: rhbz#1938836
  - Work around a mkswap bug


author: Brian C. Lane <bcl@redhat.com> - 3.5-1
changelog:
  - Rebase to upstream release 3.5
  - Drop patches included in new upstream tar
  - Add upstream patches for new type command
  - Add upstream patch for swap flag on DASD
    Resolves: rhbz#1999333


author: Petr Pisar <ppisar@redhat.com> - 8.43-3
changelog:
  - Make erroroffset initializion in a POSIX wrapper thread-safe
    (upstream bug #2447)
  - Fix an integer overflow when parsing numbers after "(?C" (upstream bug #2463)
  - Fix shifting integer bits and a NULL pointer dereferce in pcretest tool
    (upstream bug #2380)


author: Lukas Javorsky <ljavorsk@redhat.com> - 10.37-1
changelog:
  - Rebase to the 10.37
  - libpcre2-posix.so.2* SONAME bump to libpcre2-posix.so.3*
  - Enable JIT for s390x arch
  - Patches upstreamed: Patch 1,2,3,4
  - Resolves: rhbz#1970765, BZ#1965025


author: Lukáš Lipinský <lukas.lipinsky@oracle.com> - 10.40-2.0.1
changelog:
  - Add install-time dependency on fixed selinux-policy to prevent
    "Regex version mismatch" log entry [Orabug: 34742224]


author: Jakub Jelen <jjelen@redhat.com> - 1.9.4-1
changelog:
  - Rebase to current version from Fedora (#2017828)
  - Use of upstrea polkit policy preventing unneeded prompts


author: Petr Lautrbach <plautrba@redhat.com> - 3.4-2
changelog:
  - gettext: handle unsupported languages properly (#2100378)
  - semodule: rename --rebuild-if-modules-changed to --refresh
  - python: Split "semanage import" into two transactions (#2063353)
  - selinux-autorelabel: Do not force reboot (#2093133)


author: Petr Lautrbach <plautrba@redhat.com> - 3.4-3
changelog:
  - Run autorelabel in parallel by default
    https://fedoraproject.org/wiki/Changes/SELinux_Parallel_Autorelabel


author: Petr Lautrbach <lautrbach@redhat.com> - 3.5-2
changelog:
  - Improve man pages (RHEL-672)
  - Unwrap strings - remove hard returns and initial white spaces from strings (RHEL-606)


author: Jan Rybar <jrybar@redhat.com> - 3.3.17-6
changelog:
  - free: backport new 'used' calculation
  - sysctl: backport support of systemd glob patterns
  - Resolves: rhbz#2003033
  - Resolves: rhbz#2052536


author: Jan Rybar <jrybar@redhat.com> - 3.3.17-7
changelog:
  - sysctl: backport - keys with dots instead of slashes again
  - Resolves: rhbz#2116977
  - Related: rhbz#2052536


author: Stephen Brennan <stephen.s.brennan@oracle.com> - 3.3.17-13.0.1
changelog:
  - ps: remove uptime integer conversion [Orabug: 35909347]
  - ps: improved three elapsed 'jiffies/tics' calculations [Orabug: 35909347]


author: Tomas Popela <tpopela@redhat.com> - 3.40.1-6
changelog:
  - Fix the multilib problems by backporting fixes done by mhroncok from Fedora:
  - Move pure Python modules to a noarch subpackage
  - Ensure Python bytecode installed in multilib packages is bit-to-bit identical
    Resolves: rhbz#1915764


author: Christian Heimes <cheimes@redhat.com> - 36.0.1-6
changelog:
  - Rebase to 36.0.1, related: rhbz#2059630, rhbz#2060787
  - OpenSSL 3.0 FIPS mode is now detected correctly, related: rhbz#2054785
  - Fix error check from EVP_PKEY_CTX_set_signature_md, related: rhbz#2060343
  - Block 3DES in FIPS mode, related: rhbz#2055209
  - Disable DSA tests in FIPS mode
  - Enable SHA1 signatures in test suite
  - Fix serialization of keyusage ext with no bits
  - Re-enable tests that are passing again


author: Christian Heimes <cheimes@redhat.com> - 36.0.1-3
changelog:
  - Fix CVE-2023-23931: Don't allow update_into to mutate immutable objects, resolves rhbz#2172399
  - Fix FTBFS due to failing test_load_invalid_ec_key_from_pem and test_decrypt_invalid_decrypt


author: Miro Hrončok <mhroncok@redhat.com> - 4.4.0-5
changelog:
  - Subpackage python2-decorator has been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: Rafael Jeffman <rjeffman@redhat.com> - 2.2.1-1
changelog:
  - Rebase to version 2.2.1
    Resolves: rhbz#2088661
  - Disable DNSSEC tests using SHA1 due to crypto policies
    Resolves: rhbz#2107651


author: Miro Hrončok <mhroncok@redhat.com> - 0.4-39
changelog:
  - Subpackage python2-iniparse has been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: Miro Hrončok <mhroncok@redhat.com> - 0.9.6-19
changelog:
  - Subpackages python2-inotify, python2-inotify-examples have been removed
    See https://fedoraproject.org/wiki/Changes/RetirePython2


author: John Kacur <jkacur@redhat.com> - 0.6.3-5
changelog:
  - various clean-ups including using 'with' context managers in try-except
  - Fix to ignore UnicodeDecodeError when it occurs
  Resolves: rhbz#2031717


author: Dan Radez <dradez@redhat.com> - 4.8.0-6
changelog:
  - adding workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1914843
  - while we wait for upstream fix: https://github.com/pexpect/pexpect/issues/669


author: Tomas Orsava <torsava@redhat.com> - 21.2.3-4
changelog:
  - Make the python-pip-wheel subpackage versioned (python3-pip-wheel),
    and move its contents to a versioned directory /usr/share/python3-wheels
  - Resolves: rhbz#1982668


author: Tomas Orsava <torsava@redhat.com> - 21.2.3-5
changelog:
  - Conflict with old Python versions that use the old unversioned wheel location
  - Resolves: rhbz#1982668


author: Miro Hrončok <mhroncok@redhat.com> - 0.6.0-8
changelog:
  - Subpackage python2-ptyprocess has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Tomas Orsava <torsava@redhat.com> - 53.0.0-5
changelog:
  - Provide the platform-python-setuptools name for backwards compatibility
    with RHEL 8
  - Related: rhbz#1891487


author: Tomas Orsava <torsava@redhat.com> - 53.0.0-7
changelog:
  - Make the python-setuptools-wheel subpackage versioned (python3-setuptools-wheel),
    and move its contents to a versioned directory /usr/share/python3-wheels
  - Resolves: rhbz#1982668


author: Miro Hrončok <mhroncok@redhat.com> - 234-11
changelog:
  - Subpackage python2-systemd has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Miro Hrončok <mhroncok@redhat.com> - 1.25.10-3
changelog:
  - Drop redundant BuildRequires for nose
  - Instead of the mock backport, use unittest.mock from the standard library


author: Karolina Surma <ksurma@redhat.com> - 1.26.5-1
changelog:
  - Update to 1.26.5
  - Fix for CVE-2021-33503 Catastrophic backtracking in URL authority parser
  Resolves: rhbz#1972639


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.14-1
changelog:
  - Update to 3.9.14
  - Security fixes for CVE-2020-10735 and CVE-2021-28861
  Resolves: rhbz#2120642, rhbz#1834423, rhbz#2128249


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.16-1
changelog:
  - Update to 3.9.16
  - Security fixes for CVE-2022-42919 and CVE-2022-45061
  Resolves: rhbz#2138705, rhbz#2144072


author: Florian Festi <ffesti@redhat.com> - 4.16.1.3-20
changelog:
  - Add bcond macros (#2129060)
  - Fix db queries with carets (#2129468)
  - Remove spurious Python rpm module (#2135731)
  - Handle SELinux log messages (#2123719)
  - Add --nocompression to rpm2archive (#2150804)


author: Florian Festi <ffesti@redhat.com> - 4.16.1.3-25
changelog:
  - Followup on #2166383
  - Add compat scripts calling external find-debug, sepdebugcrcfix and debugedit
  - Add %__find_debuginfo macro


author: Petr Lautrbach <lautrbach@redhat.com> - 4.4.3-1
changelog:
  - SETools 4.4.3 release
  - Improve man pages
  - seinfoflow: Add -r option to get flows into the source type.
  - seinfoflow.1: Remove references to sepolgen permission map.
  - AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy.
  - SELinuxPolicy: Add explicit cast for libspol message


author: Petr Pisar <ppisar@redhat.com> - 1:4.05-17
changelog:
  - Support grace period expirations past 2038 year for XFS
  - Add a synopsis for a project quota option in the quota tool
  - Add a --filesystem option to the quota tool
  - Complain that ext4 external quota files are deprecated


author: Petr Pisar <ppisar@redhat.com> - 1:4.06-2
changelog:
  - Remove a dead code from process_file() (upstream bug #54)
  - Fix a compilation warning in quotaops.c
  - Warn when kernel XFS large time stamp does fit into (32-bit) user-space
    time_t
  - Do not use a pointless compiler-internal __P() macro


author: Sumit Bose <sbose@redhat.com> - 0.17.0-8
changelog:
  - LDAP socket timeout, fix duplicated logs and new Samba command line options
    Resolves: rhbz#2038260
    Resolves: rhbz#2038268
    Resolves: rhbz#2028530


author: Alan Steinberg <alan.steinberg@oracle.com> - 9.3-0.5.0.1
changelog:
  - Removed Secure Boot Signing certs
  - Set the epoch to prevent upgrade conflict with OL7 version [Orabug: 20681742]
  - Remove Provides: system-release and base-module platform as this is provided by oraclelinux-release
  - Remove content provided by oraclelinux-release package


author: Fedora Release Engineering <releng@fedoraproject.org> - 1:0.4-0.44.b46
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
  - Use standard make_build and make_install macros in spec file.


author: Jeff Makey <jeff@makey.net> - 1:0.4-0.46.b47
changelog:
  - New upstream release 0.4b47
  - Update main URL.
  - Drop dump-glibc_xattr patch, now applied upstream.
  - Drop documentation conversion from ISO-8859-1 to UTF-8, now applied upstream.
  - Print correct name of archive table of contents file (#1727392).


author: Josef Ridky <jridky@redhat.com> - 1:0.4-0.51.b47
changelog:
  - rename spec file to restore
  - add gating.yaml
  - changes between .47 and .51 had to be stripped due of wrong sync
    between centos and dist-git


author: Tomas Kasparek <tkasparek@redhat.com> 5.0.33-1
changelog:
  - fix rhnsd triggered upgrade of rhnsd on systemd systems
  - 1494389 - Revert "[1260527] RHEL7 reboot loop"
  - 1494389 - Revert "1260527 RHEL7 rhnsd reload doesn't work"


author: Pavel Raiskup <praiskup@redhat.com> - 1.6-1
changelog:
  - new upstream release
  - drop WITH_SELINUX knob and selinux patches, there's built-in support now
  - drop several patches which were incorporated upstream, except for
    changewarnSegv patch (did not apply, and not needed nowadays)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-3
changelog:
  - Adjust rngd-wake-threshold.service and post section so udevadm
    is not run in a container (bz 1965318)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-4.git.d207e0b6
changelog:
  - Update to the upstream v6.13 + tip of origin/master + onecpu
    branch + revert of 2ce93190 (bz 1965318)
  - Rebuild rng-tools against the latest jitterentropy library
    3.0.2-2.git.409828cf with fixes for an important issue
  - Adjust Source0 to a more proper one


author: Vladis Dronov <vdronov@redhat.com> - 6.15-1
changelog:
  - Update to the upstream v6.15 @ 172bf0e3 (bz 2075977)
  - Allow rngd process to drop privileges with "-D user:group"
  - Fix an error building with jitterentropy-3.4.0
  - Add a requirement for selinux-policy of a certain version
  - Fix a build failure on ppc64
  - Small edits in test scripts


author: Vladis Dronov <vdronov@redhat.com> - 6.15-2
changelog:
  - Update to the upstream v6.15 + tip of origin/master @ 6dcc9ec2 (bz 2124605)
  - Do not require selinux-policy if it is not present


author: Vladis Dronov <vdronov@redhat.com> - 6.15-3
changelog:
  - Update to the upstream v6.15 + tip of origin/master @ cb8cc624 (bz 2156554)
  - Fix a number of issues found by covscan code scanner
  - Add a jitter init timeout for tests
  - Add a start condition for the FIPS mode (bz 2154804)


author: Vladis Dronov <vdronov@redhat.com> - 6.16-1
changelog:
  - Update to the upstream v6.16 + tip of origin/master @ 0e560296 (bz 2174916)
  - Get rid of text relocations in -fPIE build
  - Add a hint for opensc package (bz 1845854)


author: Till Maas <opensource@till.name> - 8.1-26
changelog:
  - Sync in current files from bash package:
    https://src.fedoraproject.org/rpms/bash/c/739b272e5f5d10cf27a847a44d09eb7f4b6ec89b?branch=master
    https://src.fedoraproject.org/rpms/bash/c/329df36f8bbc303be618f06562ec2c4eebfd1d29?branch=master
    https://src.fedoraproject.org/rpms/bash/c/e3b3cd9cec4a3bd12a792536c0ea131f5ba5bd72?branch=master


author: Steve Dickson <steved@redhat.com> - 1.2.6-1
changelog:
  - Use sysconfig variable in service file (bz 1972094)
  - Make sure policycoreutils is installed before using it (bz 1972133)
  - Make sure /var/lib/rpcbind exists (bz 1972133)
  - Corrected the URL reference (bz 1972117)


author: Steve Dickson <steved@redhat.com> - 1.2.6-4
changelog:
  - Use 
  %setup       -q




  /usr/bin/cat /builddir/build/SOURCES/rpcbind-1.2.6-double-free.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.3-systemd-envfile.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.3-systemd-tmpfiles.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.4-runstatdir.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-1.2.6-systemd-service.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


  /usr/bin/cat /builddir/build/SOURCES/rpcbind-0.2.4-systemd-rundir.patch | 
  /usr/bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch


author: Michal Ruprich <mruprich@redhat.com> - 3.2.3-17
changelog:
  - Resolves: #2116669 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.15-1
changelog:
  - Add fs_delete_pstore_files() interface
  Resolves: rhbz#2181565
  - Add fs_read_pstore_files() interface
  Resolves: rhbz#2181565
  - Allow insights-client getsession process permission
  Resolves: rhbz#2214581
  - Allow insights-client work with pipe and socket tmp files
  Resolves: rhbz#2214581
  - Allow insights-client map generic log files
  Resolves: rhbz#2214581
  - Allow insights-client read unconfined service semaphores
  Resolves: rhbz#2214581
  - Allow insights-client get quotas of all filesystems
  Resolves: rhbz#2214581
  - Allow haproxy read hardware state information
  Resolves: rhbz#2164691
  - Allow cupsd dbus chat with xdm
  Resolves: rhbz#2143641
  - Allow dovecot_deliver_t create/map dovecot_spool_t dir/file
  Resolves: rhbz#2165863
  - Add none file context for polyinstantiated tmp dirs
  Resolves: rhbz#2099194
  - Add support for the systemd-pstore service
  Resolves: rhbz#2181565
  - Label /dev/userfaultfd with userfaultfd_t
  Resolves: rhbz#2175290
  - Allow collectd_t read proc_net link files
  Resolves: rhbz#2209650
  - Label smtpd with sendmail_exec_t
  Resolves: rhbz#2213573
  - Label msmtp and msmtpd with sendmail_exec_t
  Resolves: rhbz#2213573
  - Allow dovecot-deliver write to the main process runtime fifo files
  Resolves: rhbz#2211787
  - Allow subscription-manager execute ip
  Resolves: rhbz#2211566
  - Allow ftpd read network sysctls
  Resolves: rhbz#2175856


author: Nikola Knazekova <nknazeko@redhat.com> - 38.1.16-1
changelog:
  - Remove permissive from fdo
  Resolves: rhbz#2026795
  - Add the qatlib  module
  Resolves: rhbz#2080443
  - Add the fdo module
  Resolves: rhbz#2026795
  - Add the booth module to modules.conf
  Resolves: rhbz#2128833
  - Add policy for FIDO Device Onboard
  Resolves: rhbz#2026795
  - Create policy for qatlib
  Resolves: rhbz#2080443
  - Add policy for boothd
  Resolves: rhbz#2128833
  - Add list_dir_perms to kerberos_read_keytab
  Resolves: rhbz#2112729
  - Allow nsd_crond_t write nsd_var_run_t & connectto nsd_t
  Resolves: rhbz#2209973
  - Allow collectd_t read network state symlinks
  Resolves: rhbz#2209650
  - Revert "Allow collectd_t read proc_net link files"
  Resolves: rhbz#2209650
  - Allow insights-client execmem
  Resolves: rhbz#2207894
  - Label udf tools with fsadm_exec_t
  Resolves: rhbz#2039774


author: Nikola Knazekova <nknazeko@redhat.com> - 38.1.17-1
changelog:
  - Add the qatlib  module
  Resolves: rhbz#2080443
  - Add the fdo module
  Resolves: rhbz#2026795
  - Add the booth module to modules.conf
  Resolves: rhbz#2128833


author: Nikola Knazekova <nknazeko@redhat.com> - 38.1.18-1
changelog:
  - Boolean: Allow virt_qemu_ga create ssh directory
  Resolves: rhbz#2181402
  - Allow virt_qemu_ga_t create .ssh dir with correct label
  Resolves: rhbz#2181402
  - Set default ports for keylime policy
  Resolves: RHEL-594
  - Allow unconfined service inherit signal state from init
  Resolves: rhbz#2186233
  - Allow sa-update connect to systemlog services
  Resolves: rhbz#2220643
  - Allow sa-update manage spamc home files
  Resolves: rhbz#2220643
  - Label only /usr/sbin/ripd and ripngd with zebra_exec_t
  Resolves: rhbz#2213605
  - Add the files_getattr_non_auth_dirs() interface
  Resolves: rhbz#2076933
  - Update policy for the sblim-sfcb service
  Resolves: rhbz#2076933
  - Define equivalency for /run/systemd/generator.early
  Resolves: rhbz#2213516


author: Nikola Knazekova <nknazeko@redhat.com> - 38.1.19-1
changelog:
  - Allow qatlib to read sssd public files
  Resolves: rhbz#2080443
  - Fix location for /run/nsd
  Resolves: rhbz#2181600
  - Allow samba-rpcd work with passwords
  Resolves: rhbz#2107092
  - Allow rpcd_lsad setcap and use generic ptys
  Resolves: rhbz#2107092
  - Allow gpsd,oddjob,oddjob_mkhomedir rw user domain pty
  Resolves: rhbz#2223305
  - Allow keepalived to manage its tmp files
  Resolves: rhbz#2179212
  - Allow nscd watch system db dirs
  Resolves: rhbz#2152124


author: Nikola Knazekova <nknazeko@redhat.com> - 38.1.20-1
changelog:
  - Allow user_u and staff_u get attributes of non-security dirs
  Resolves: rhbz#2215507
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t
  Resolves: rhbz#2225418
  - Allow samba-dcerpc service manage samba tmp files
  Resolves: rhbz#2230365
  - Update samba-dcerpc policy for printing
  Resolves: rhbz#2230365
  - Allow sysadm_t run kernel bpf programs
  Resolves: rhbz#2229936
  - allow mon_procd_t self:cap_userns sys_ptrace
  Resolves: rhbz#2221986
  - Remove nsplugin_role from mozilla.if
  Resolves: rhbz#2221251
  - Allow unconfined user filetrans chrome_sandbox_home_t
  Resolves: rhbz#2187893
  - Allow pdns name_bind and name_connect all ports
  Resolves: rhbz#2047945
  - Allow insights-client read and write cluster tmpfs files
  Resolves: rhbz#2221631
  - Allow ipsec read nsfs files
  Resolves: rhbz#2230277
  - Allow upsmon execute upsmon via a helper script
  Resolves: rhbz#2228403
  - Fix labeling for no-stub-resolv.conf
  Resolves: rhbz#2148390
  - Add use_nfs_home_dirs boolean for mozilla_plugin
  Resolves: rhbz#2214298
  - Change wording in /etc/selinux/config
  Resolves: rhbz#2143153


author: Nikola Knazekova <nknazeko@redhat.com> - 38.1.21-1
changelog:
  - Allow logrotate_t to map generic files in /etc
  Resolves: rhbz#2231257
  - Allow insights-client manage user temporary files
  Resolves: rhbz#2224737
  - Make insights_client_t an unconfined domain
  Resolves: rhbz#2225526


author: Nikola Knazekova <nknazeko@redhat.com> - 38.1.22-1
changelog:
  - Allow qatlib  to modify hardware state information.
  Resolves: rhbz#2080443
  - Update policy for fdo
  Resolves: rhbz#2229722
  - Allow gpsd, oddjob and oddjob_mkhomedir_t write user_tty_device_t chr_file
  Resolves: rhbz#2223305
  - Allow svirt to rw /dev/udmabuf
  Resolves: rhbz#2223727
  - Allow keepalived watch var_run dirs
  Resolves: rhbz#2186759


author: Nikola Knazekova <nknazeko@redhat.com> - 38.1.23-1
changelog:
  - Allow cups-pdf connect to the system log service
  Resolves: rhbz#2234765
  - Update policy for qatlib
  Resolves: rhbz#2080443


author: Naoki Tanaka <naoki.tanaka@oracle.com> - 38.1.23-1.0.1
changelog:
  - Allow kdumpctl_t to execmem [Orabug: 35381156]
  - Allow NetworkManager_dispatcher_dhclient_t to execute shells without a domain transition [Orabug: 35091334]
  - Allow NetworkManager_dispatcher_dhclient_t to read the DHCP configuration files [Orabug: 35122619]
  - Label /var/log/kdump.log with kdump_log_t [Orabug: 33810371]
  - Allow rpm_t sys_admin capability [Orabug: 34250651]
  - Make systemd_tmpfiles_t MLS trusted for lowering the level of files [Orabug: 33841245]
  - Allow nfsd_t to list exports_t dirs [Orabug: 33844301]
  - Allow fsadm_t to get attributes of cgroup filesystems [Orabug: 33841268]
  - Label /var/run/tmpfiles.d/static-nodes.conf with kmod_var_run_t [Orabug: 33841205]
  - Allow tuned_t to read the process state of all domains [Orabug: 33520684]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]
  - Add boolean qemu-ga to run unconfined script
  Resolves: rhbz#2093355
  - Allow cloud-init manage gpg admin home content
  Resolves: rhbz#2203797


author: Martin Osvald <mosvald@redhat.com> - 2.13.7-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2066753)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#2066767)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#2026892)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.47-7
changelog:
  - Fix sg_inq parsing in rescan-scsi-bus.sh (#2036005,#2035362)
  - Fix rescan-scsi-bus.sh summary print (#2035382)
  - sg_readcap --zbc man page switch fix (#2036718)
  - Various Covscan fixes (#2044433)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-1
changelog:
  - Rebase to version 4.9. Resolves: #1989556
  - usermod: allow all group types with -G option. Resolves: #1975329
  - useradd: avoid generating an empty subid range
  - Clean spec file


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-3
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013015
  - useradd: generate home and mail directories with selinux user attribute. Resolves: #1993081
  - useradd: revert fix memleak of grp. Resolves: #2020238
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #2024834
  - pwck: fix segfault when calling fprintf()
  - newgrp: fix segmentation fault
  - Clean spec file: organize dependencies and move License location


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-4
changelog:
  - useradd: modify check ID range for system users. Resolves: #2004911
  - Fix release sources
  - Add subid requirement for subid-devel


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-7
changelog:
  - useradd: check if subid range exists for user. Resolves: #2179987
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #2179988


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.6-1.0.4
changelog:
  - Rebase to shim v15.6-1 [Orabug: 34821869]
  - Update vendor certs [Orabug: 34821869]
  - Update oracle(grub2-sig-key) [Orabug: 34821869]
  - Update shim-unsigned to v15.6-1.0.3 [Orabug: 34821869]


author: Ilya Okomin <ilya.okomin@oracle.com> - 15.7-1.0.3
changelog:
  - Update to shim-unsigned v15.7-1.0.2 [Orabug: 34821869]
  - Update shimx64.efi and shimaa64.efi signed by Microsoft [Orabug: 34821869]


author: Martin Gieseking <martin.gieseking@uos.de> - 1.1.8-1
changelog:
  - Updated to new release.
  - Dropped version-related patch which has been applied upstream (BZ #1527850).


author: Pavel Moravec <pmoravec@redhat.com> = 4.5.1-3
changelog:
  - Rebase on upstream 4.5.1
    Resolves: bz2175808
  - [microshift] Fix microshift get and add commands
    Resolves: bz2175650


author: Jan Jansky <jjansky@redhat.com> = 4.5.3-1
changelog:
  - [unpackaged] Print unpackaged symlinks instead of targets
    Resolves: bz2169684
  - [report] Ignore case when scrubbing via do_file_sub
    Resolves: bz2174254
  - [powerpc]: To collect lparnumascore logs
    Resolves: bz2177984


author: Darren Archibald <darren.archibald@oracle.com> - 4.5.5-2.0.1
changelog:
  - Modifying dnf history info transaction index [Orabug: 35497720]
  - Adding virsh guest cgroup configuration [Orabug: 35145501]
  - Adding virsh qemu-monitor info tree command [Orabug: 35148435]
  - Adding Plugin option support for ksplice and btrfs [Orabug: 35115193]
  - append .txt to .com domain named files [Orabug: 34527958]
  - Adding dmesg -T to show timestamp for syslog comparison [Orabug: 34250313]
  - Adding uptrack-uname to show effective ksplice kernel version [Orabug: 33553351]
  - Added sos-oraclelinux-vendor-vendorurl.patch
  - Fix patch for Orabug 31969352 [Orabug: 32822570]
  - [ovn_central] call podman exec without a timeout
    Resolves: bz1767359
  - Adjusted ksplice plugin patches for path change [Orabug: 32881277]
  - Fix os detect string for Oracle Linux [Orabug: 28674897]
  - Add ksplice plugin [Orabug: 30273666] (Philippe Vanhaesendonck)
  - Disable upload options for OracleLinux [Orabug: 31969352]
  - Replace RH_FTP_HOST and RH_API_HOST with "_none_" [Orabug: 31975601]
  - Allow a journal log size to be smaller than 100M [Orabug: 32454362]
  - Do not exit on unknown plugin [Orabug: 32556170]
  - Add in some btrfs commands [Orabug: 32727607]
  - Add /var/run/ksplice/debug to sos ksplice plugin [Orabug: 32618933]
  - Fix ksplice plugin does not show description [Orabug: 32886513]


author: Darren Archibald <darren.archibald@oracle.com> - 4.6.0-2.0.1
changelog:
  - Rebase sos to 4.6.0
    Resolves: bz2187407
    Resolves: bz2217906
    Resolves: bz2218873
    Resolves: bz2222134


author: Ondrej Dubaj <odubaj@redhat.com> - 3.34.0-1
changelog:
  - Updated to version 3.34.0 (https://sqlite.org/releaselog/3_34_0.html)
  - Enabled fts3conf.test on s390x and ppc64 architectures


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-3
changelog:
  - Address some issues reported by covscan (#1996691).
  - Replace 0141-tests-disable-sockopt-timestamp-on-new-glibc-with-__.patch
    with upstream v5.13-10-g0211fdc "tests: change sockopt-timestamp test
    to use syscall(__NR_recvmsg)"
    and 0154-tests-call-setsockopt-directly-in-sockopt-timestamp.patch.
  - Undo forceful injection of -m64 into CFLAGS/CPPFLAGS to avoid breaking
    mpers and its tests (#1996676).


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.18-2
changelog:
  - Fix the issues reported by covscan (#2103068).
  - Fix SELinux context matching for the deleted paths (#2087693).
  - Fix sloppy FD usage in the bpf test (#2103137).
  - Cater for RHEL 9 license requirement idiosyncrasies (#2103032).


author: Sahana Prasad <sahana@redhat.com> - 5.57-1
changelog:
  - New upstream release 5.57
  - Fixes #1925229 - client certificate not correctly verified
    when redirect and verifyChain options are used


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 5.58-4
changelog:
  - Stunnel cannot use an encrypted private key being built against OpenSSL 3.0
  - Resolves: rhbz#1976854


author: Clemens Lang <cllang@redhat.com> - 5.62-2
changelog:
  - Fix stunnel in FIPS mode
    Resolves: rhbz#2050617
  - Fail build if tests fail
    Resolves: rhbz#2051083


author: Matthew Miller <mattdm@fedoraproject.org> - 1.9.5p2-1
changelog:
  - rebase to 1.9.5p2
  Resolves: rhbz#1920611
  - fixed CVE-2021-3156 sudo: Heap buffer overflow in argument parsing
  Resolves: rhbz#1920618


author: Zoltan Fridrich <zfridric@redhat.com> - 1.9.5p2-2
changelog:
  - change ldap.conf to sudo-ldap.conf
  Resolves: rhbz#1908882
  - remove /usr/local/* from secure_path
  Resolves: rhbz#1908923
  - fixed CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhbz#1916655
  - fixed CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917039
  - fixed CVE-2021-3156 sudo: Heap buffer overflow in argument parsing
  Resolves: rhbz#1917735


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-5
changelog:
  RHEL 9 BETA
  - sync with rhel8 spec
  Resolves: rhbz#1908882
  Resolves: rhbz#1942383
  Resolves: rhbz#1946707
  Resolves: rhbz#1946709
  Resolves: rhbz#1981278


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-7
changelog:
  - utmp resource leak in sudo
  Resolves: rhbz#1986579
  - sudo does not list /etc/dnf/protected.d/sudo.conf in the rpm config files listing
  Resolves: rhbz#1997030
  - sudo uses Recommends for sudo-python-plugin(x86-64) = 1.9.5p2-2.el9 and vim-minimal
  Resolves: rhbz#1947908
  - review of important potential issues detected by static analyzers in sudo-1.9.5p2-2.el9
  Resolves: rhbz#1938879


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-8
changelog:
  RHEL 9.2.0 ERRATUM
  - sudo digest check fails incorrectly for certain file sizes (SHA512/SHA384)
  Resolves: rhbz#2115789


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-9
changelog:
  RHEL 9.2.0 ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161225


author: systemd maintenance team <systemd-maint@redhat.com> - 252-5
changelog:
  - nss-myhostname: fix inverted condition in (#2167468)
  - nss-myhostname: do not return empty result with NSS_STATUS_SUCCESS (#2167468)
  - sleep: rename hibernate_delay_sec -> _usec (#2151612)
  - sleep: fetch_batteries_capacity_by_name() does not return -ENOENT (#2151612)
  - sleep: drop unnecessary temporal vaiable and initialization (#2151612)
  - sleep: introduce SuspendEstimationSec= (#2151612)
  - sleep: coding style fixlets (#2151612)
  - sleep: simplify code a bit (#2151612)
  - sleep: fix indentation (#2151612)
  - sleep: enumerate only existing and non-device batteries (#2151612)
  - core: when isolating to a unit, also keep units running that are triggered by units we keep running (#1952378)
  - udev/net_id: introduce naming scheme for RHEL-9.2 (#2170500)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-6
changelog:
  - journalctl: actually run the static destructors (#2122500)
  - efi: drop executable-stack bit from .elf file (#2140646)
  - install: fail early if specifier expansion failed (#2138081)
  - test: add coverage for #26467 (#2138081)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-7
changelog:
  - test: add coverage for #24177 (#1985288)
  - logind-session: make stopping of idle session visible to admins (#2172401)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-14
changelog:
  - systemd: Support OOMPolicy in scope units (#2176918)
  - systemd: Default to OOMPolicy=continue for login session scopes (#2176918)
  - man: rework description of OOMPolicy= a bit (#2176918)
  - core,man: add missing integration of OOMPolicy= in scopes (#2176918)
  - meson: Store fuzz tests in structured way (#2176918)
  - meson: Generate fuzzer inputs with directives (#2176918)
  - oss-fuzz: include generated corpora in the final zip file (#2176918)
  - unit: In cgroupv1, gracefully terminate delegated scopes again (#2180120)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-15
changelog:
  - ci: trigger `differential-shellcheck` workflow on push (#2100440)
  - ci: workflow for gathering metadata for source-git automation (#2100440)
  - ci: first part of the source-git automation - commit linter (#2100440)
  - ci(Mergify): check CodeQL and build workflows based on changed files (#2100440)
  - ci: add NOTICE to also update regexp in `.mergify.yml` when updating `paths` property (#2100440)
  - Support /etc/system-update for OSTree systems (#2203133)
  - journal-def: fix type of signature to match the actual field in the Header structure (#2183546)
  - journal: use compound initialization for journal file Header structure (#2183546)
  - journald: fix log message (#2183546)
  - sd-journal: cache results of parsing environment variables (#2183546)
  - compress: introduce compression_supported() helper function (#2183546)
  - sd-journal: always use the compression algorithm specified in the header (#2183546)
  - sd-journal: allow to specify compression algorithm through env (#2183546)
  - test: add test case that journal file is created with the requested compression algorithm (#2183546)
  - rules: do not online CPU automatically on IBM platforms (#2143107)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-16
changelog:
  - ci: update permissions for source-git automation workflows (#2170883)
  - pstore: fixes for dmesg.txt reconstruction (#2170883)
  - pstore: explicitly set the base when converting record ID (#2170883)
  - pstore: avoid opening the dmesg.txt file if not requested (#2170883)
  - test: add a couple of tests for systemd-pstore (#2170883)
  - test: match all messages with the FILE field (#2170883)
  - test: build the SELinux test module on the host (#2170883)
  - test: make the stress test slightly less stressful on slower machines (#2170883)
  - coredump: use unaligned_read_ne{32,64}() to parse auxv (#2170883)
  - core/transaction: make merge_unit_ids() always return NUL-terminated string (#2170883)
  - core/transaction: make merge_unit_ids() return non-NULL on success (#2170883)
  - core/transaction: do not log "(null)" (#2170883)
  - ci: allow `RHEL-only` labels to mark downstream-only commits (#2170883)
  - elf-util: discard PT_LOAD segment early based on the start address. (#2215412)
  - elf-util: check for overflow when computing end of core's PT_LOAD segments (#2215412)
  - sulogin: use DEFINE_MAIN_FUNCTION() (#2169959)
  - sulogin: fix control lost of the current terminal when default.target is rescue.target (#2169959)
  - journal-vacuum: count size of all journal files (#2182632)
  - memory-util: add a concept for gcc cleanup attribute based array destruction (#2182632)
  - macro: introduce FOREACH_ARRAY() macro (#2182632)
  - journal-vacuum: rename function to match struct name (#2182632)
  - journal-vacuum: use CLEANUP_ARRAY (#2182632)
  - pam: add call to pam_umask (#2210145)
  - udev-builtin-net_id: align VF representor names with VF names (#2218886)
  - pam: add a call to pam_namespace (#2218184)
  - rules: online CPU automatically on IBM s390x platforms when configured (#2212612)
  - core/mount: escape invalid UTF8 char in dbus reply (#2208240)
  - Revert "user: delegate cpu controller, assign weights to user slices" (#2176899)
  - udev-rules: fix nvme symlink creation on namespace changes (#2172509)
  - rules: add whitespace after comma before the line continuation (#2172509)
  - udev: restore compat symlink for nvme devices (#2172509)
  - rules: drop doubled space (#2172509)
  - manager: don't taint the host if cgroups v1 is used (#2193456)
  - core/service: when resetting PID also reset known flag (#2210237)
  - ci: drop systemd-stable from advanced-commit-linter config (#2170883)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-17
changelog:
  - Revert "core/service: when resetting PID also reset known flag" (#2225667 #2210237)
  - ci: explicitly install python3-lldb-$COMPILER_VERSION (#2225667)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-18
changelog:
  - doc: add downstream CONTRIBUTING document (#2170883)
  - doc: improve CONTRIBUTING document (#2170883)
  - doc: use link with prefilled Jira issue (#2170883)
  - docs: link downstream CONTRIBUTING in README (#2170883)
  - bpf: fix restrict_fs on s390x (#2230364)
  - udev/net_id: use naming scheme for RHEL-9.3 (#2231845)
  - core/timer: Always use inactive_exit_timestamp if it is set (#2211065)
  - timer: Use dual_timestamp_is_set() in one more place (#2211065)
  - loginctl: list-users: also show state (#2209912)
  - loginctl: list-sessions: minor modernization (#2209912)
  - loginctl: list-sessions: also show state (#2209912)
  - test: add test for state in loginctl list-{users,sessions} (#2209912)
  - test: add a missing session activation (#2209912)
  - test: extend test for loginctl list-* (#2209912)
  - loginctl: shorten variable name (#2209912)
  - loginctl: use bus_map_all_properties (#2209912)
  - loginctl: show session idle status in list-sessions (#2209912)
  - loginctl: some modernizations (#2209912)
  - loginctl: list-sessions: fix timestamp for idle hint (#2209912)
  - loginctl: list-users: use bus_map_all_properties (#2209912)
  - loginctl: also show idle hint in session-status (#2209912)
  - memory-util: make ArrayCleanup passed to array_cleanup() const (#2190226)
  - static-destruct: several cleanups (#2190226)
  - static-destruct: introduce STATIC_ARRAY_DESTRUCTOR_REGISTER() (#2190226)
  - macro: support the case that the number of elements has const qualifier (#2190226)
  - shared/generator: apply similar config reordering of generated units (#2190226)
  - nulstr-util: make ret_size in strv_make_nulstr() optional (#2190226)
  - generator: teach generator_add_symlink() to instantiate specified unit (#2190226)
  - units: rework growfs units to be just a regular unit that is instantiated (#2190226)
  - fstab-generator: use correct targets when /sysroot is specificied in fstab only (#2190226)
  - fstab-generator: add SYSTEMD_SYSFS_CHECK env var (#2190226)
  - test: add fstab file support for fstab-generator tests (#2190226)
  - test-fstab-generator: also check file contents (#2190226)
  - test-fstab-generator: add tests for mount options (#2190226)
  - fstab-generator: split out several functions from parse_fstab() (#2190226)
  - fstab-generator: call add_swap() earlier (#2190226)
  - fstab-generator: refuse to add swap earlier if disabled (#2190226)
  - fstab-generator: refuse invalid mount point path in fstab earlier (#2190226)
  - fstab-generator: fix error code propagation in run_generator() (#2190226)
  - fstab-generator: support defining mount units through kernel command line (#2190226)
  - test: add test cases for defining mount and swap units from kernel cmdline (#2190226)
  - generators: change TimeoutSec=0 to TimeoutSec=infinity (#2190226)
  - units: change TimeoutSec=0 to TimeoutSec=infinity (#2190226)
  - fstab-generator: use correct swap name var (#2190226)
  - fstab-generator: add more parameter name comments (#2190226)
  - fstab-generator: unify initrd-root-device.target dependency handling code (#2190226)
  - fstab-util: add fstab_is_bind (#2190226)
  - fstab-generator: resolve bind mount source when in initrd (#2190226)
  - fstab-generator: rename 'initrd' flag to 'prefix_sysroot' (#2190226)
  - fstab-generator: fix target of /sysroot/usr (#2190226)
  - fstab-generator: add rd.systemd.mount-extra= and friends (#2190226)
  - fstab-generator: add a flag to accept entry for "/" in initrd (#2190226)
  - test-fstab-generator: extract core part as a function (#2190226)
  - test-fstab-generator: also test with SYSTEMD_IN_INITRD=no (#2190226)
  - test-fstab-generator: add more tests for systemd.mount-extra= and friends (#2190226)
  - fstab-generator: enable fsck for block device mounts specified in systemd.mount-extra= (#2190226)
  - core: use correct scope of looking up units (#2226980)
  - test: merge unit file related tests into TEST-23-UNIT-FILE (#2213521)
  - test: rename TEST-07-ISSUE-1981 to TEST-07-PID1 (#2213521)
  - test: merge TEST-08-ISSUE-2730 into TEST-07-PID1 (#2213521)
  - test: merge TEST-09-ISSUE-2691 into TEST-07-PID1 (#2213521)
  - test: merge TEST-10-ISSUE-2467 with TEST-07-PID1 (#2213521)
  - test: merge TEST-11-ISSUE-3166 into TEST-07-PID1 (#2213521)
  - test: merge TEST-12-ISSUE-3171 into TEST-07-PID1 (#2213521)
  - test: move TEST-23's units into a dedicated subfolder (#2213521)
  - test: merge TEST-47-ISSUE-14566 into TEST-07-PID1 (#2213521)
  - test: merge TEST-51-ISSUE-16115 into TEST-07-PID1 (#2213521)
  - test: merge TEST-20-MAINPIDGAMES into TEST-07-PID1 (#2213521)
  - test: abstract the common test parts into a utility script (#2213521)
  - test: add tests for JoinsNamespaceOf= (#2213521)
  - core/unit: drop doubled empty line (#2213521)
  - core/unit: make JoinsNamespaceOf= implies the inverse dependency (#2213521)
  - core/unit: search shared namespace in transitive relation of JoinsNamespaceOf= (#2213521)
  - core/unit: update bidirectional dependency simultaneously (#2213521)
  - resolvectl: fix type of ifindex D-Bus field, and make sure to initialize to zero in all code paths (#2161260)
  - resolved: add some line-breaks/comments (#2161260)
  - resolvectl: don't filter loopback DNS server from global DNS server list (#2161260)
  - blockdev-util: add simple wrapper around BLKSSZGET (#2170883)
  - loop-util: insist on setting the sector size correctly (#2170883)
  - dissect-image: add probe_sector_size() helper for detecting sector size of a GPT disk image (#2170883)
  - loop-util: always tell kernel explicitly about loopback sector size (#2170883)
  - Revert "Treat EPERM as "not available" too" (#2178222)
  - Revert "test: accept EPERM for unavailable idmapped mounts as well" (#2178222)


author: Tony Rodriguez <tony.rodriguez@oracle.com> - 252-18.0.1
changelog:
  - Remove upstream references  [Orabug: 33995357]
  - Disable unprivileged BPF by default [Orabug: 32870980]
  - udev rules: fix memory hot add and remove [Orabug: 31310273]
  - set "RemoveIPC=no" in logind.conf as default for OL7.2 [Orabug: 22224874]
  - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469]
  - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792]
  - shutdown: get only active md arrays. [Orabug: 34467234]
  - Removed unneeded patches from the systemd.spec
  - A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490]
  - B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490]
  - C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110]


author: Lukas Javorsky <ljavorsk@redhat.com> - 2:1.34-4
changelog:
  - added "padding with zeros" info message (#2089298)
  - do not report disk error as file shrank (#2089316)


author: Štěpán Horáček <shoracek@redhat.com> - 3.2.2-1
changelog:
  - Rebase to 3.2.2
  - Use systemd-sysusers to create user
    Resolves: CVE-2023-22745
    Resolves: rhbz#2095479
    Resolves: rhbz#2160307
    Resolves: rhbz#2162613


author: Leah Leshchinsky <lleshchi@redhat.com> - 0.18-6
changelog:
  - Update tuna command line interface
  - Move get_policy_and_rtprio call to parser level
  - Remove threads print statement
  Resolves: rhbz#2062865


author: Leah Leshchinsky <lleshchi@redhat.com> - 0.18-9
changelog:
  - Remove import and fix help message
  - Update manpages for argparse CLI changes
  Resolves: rhbz#2138692


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#2003838
    - tuned-gui: fixed creation of new profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.19.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2057609
    - fixed parsing of inline comments
    - added support for quotes in isolated_cores specification
    - spec: reduced weak dependencies
      resolves: rhbz#2093841
    - recommend: do not ignore syspurpose_role if there is no syspurpose
      resolves: rhbz#2030580
    - added support for initial autosetup of isolated_cores
      resolves: rhbz#2093847


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2133815
    - systemd: relax polkit requirement
    - sysvinit: fixed path
      resolves: rhbz#2118301
    - plugin_cpu: added support for pm_qos_resume_latency_us
      resolves: rhbz#2118786
    - do not exit on duplicate config lines
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - API: add support for moving devices between instances
      resolves: rhbz#2113925
    - D-Bus: send tracebacks through D-Bus only in debug mode
      resolves: rhbz#2159680
    - Makefile: added fix for python-3.12
    - throughput-performance: set net.core.somaxconn to at least 2048
    - plugin_scheduler: do not leak FDs from the perf
    - plugin_cpu: added support for intel_pstate scaling driver
      resolves: rhbz#2095829
    - added support for the API access through the Unix Domain Socket
      resolves: rhbz#2113900


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20.0-0.2.rc1
changelog:
  - post RC.1 fixes
    related: rhbz#2133815
  - fixed possible traceback on SIGHUP
    resolves: rhbz#2169712


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.21.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2182117
    - plugin_scheduler: fix perf fd leaks
      resolves: rhbz#2173938
    - allow skipping rollback when restarting TuneD or switching profile
      resolves: rhbz#2203142
    - function_calc_isolated_cores: no errors for offline CPUs
      resolves: rhbz#2217015


author: EL Errata <el-errata_ww@oracle.com> - 2.21.0-1.0.1
changelog:
  - Fix RPS/XPS and busy polling optimization not getting applied [Orabug: 32153315]
  - Fix error in uninstalling tuned [Orabug: 351528377]
  - Updated patch with the more recent version [Orabug: 30730976]
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
  - Rebase to tzdata-2022d
    - Palestine's DST transition will be on October 29, 2022,
      not October 28, 2022.
    - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Jakub Martisko <jamartis@redhat.com> - 6.0-56
changelog:
  - Use the C crc implementation instead of the asm (i686 only, other arches already use C)
  Related: rhbz#2045075


author: Sérgio Basto <sergio@serjux.com> - 2.6.0-3
changelog:
  - Use make macros (https://src.fedoraproject.org/rpms/usb_modeswitch/pull-request/1)
  - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro


author: Sérgio Basto <sergio@serjux.com> - 2.6.1-1
changelog:
  - Update usb_modeswitch to 2.6.1
  - Drop patch1, http://www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?f=2&t=2733
  - Drop BR jimtcl-devel, if we don't install dynlink-dispatcher


author: Jiri Kucera <jkucera@redhat.com> - 1.114-3
changelog:
  - Do not use fexecve
    Script executed via fexecve has a file descriptor number in
    argv[0]. This results in unexpected output: when displaying
    the script help, a user see "Usage: <number> [options]"
    instead of "Usage: <scriptname> [options]".
    Resolves: #1984417


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.12.1-5
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz# 1951223)
  - Added CI gating tests
  - Resolves: bz #1951223


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-12
changelog:
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c
  - CVE-2022-0443 vim: heap-use-after-free in enter_buffer() of src/buffer.c
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-16
changelog:
  - CVE-2022-0554 vim: Use of Out-of-range Pointer Offset in vim prior
  - CVE-2022-0943 vim: Heap-based Buffer Overflow occurs in vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-17
changelog:
  - CVE-2022-1154 vim: use after free in utf_ptr2char
  - CVE-2022-1420 vim: Out-of-range Pointer Offset


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-19
changelog:
  - CVE-2022-1785 vim: Out-of-bounds Write
  - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
  - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c


author: Davide Caratti <dcaratti@redhat.com> - 1:2.10-4
changelog:
  - Explicitly allow/disallow unsafe legacy renegotiation on configuration base.
    Resolves: rhbz#2077973


author: Pavel Reichl <preichl@redhat.com> - 3.1.12-3
changelog:
  - xfsdump: restoring inventory prevents non-directory files being restored from tape,
  - actually fixed by rebase to 3.1.12
  - related: bz#2166557
  - xfsrestore: Files from the backup go to orphanage dir because of xfsdump issue
  - related: bz#2034327


author: Pavel Reichl <preichl@redhat.com> - 5.19.0-1
changelog:
  - New upstream release
  - Tolerate tiny (<300MB) filesystems
  - Rename xfsprogs-5.12.0-default-bigtime-inobtcnt-on.patch to
      xfsprogs-5.19.0-disable-old-kernel-bigtime-inobtcnt-on.patch
      and amend it to reflect upstream changes
  - Backport all "Fixing" patches relevant to 5.19
    Related: rhbz#2142910


author: Jakub Martisko <jamartis@redhat.com> - 3.0-31
changelog:
  - Add the missing linker flags
  - Add the patch that allows to configure the linker flags from the spec file
    Resolves: rhbz #2044902


author: Jakub Martisko <jamartis@redhat.com> - 3.0-33
changelog:
  - Disable the asm implementation of some functions and use the C instead
  - This should fix some of the annocheck issues
    Related: rhbz#2044902


author: Jakub Martisko <jamartis@redhat.com> - 3.0-34
changelog:
  - Fix the regression introduced in 3.0-33 that caused some of the zip build flags to be dropped
  Resolves: rhbz#2162688


author: Jakub Martisko <jamartis@redhat.com> - 3.0-35
changelog:
  - Fix the annocheck issus from 3-0-33 without reintroducing the regression from 3.0-34
  Related: rhbz#2162688


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11-34
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-37
changelog:
  - Rebased Power 8 optimization patches
  - Fix for Unnecessary IFUNC resolver for crc32_z
  - Fix for python3.11 broken libxml2 and lxml on s390x


