# changelog

author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-1
changelog:
  - Rebase to 1.0.14 (#1299063)
  - Add support for Server Name Indication (SNI) (#1053327)
  - Use upstream method to not execute live tests as root (#1256887)
  - Always call SSL_ShutdownServerSessionIDCache() in ModuleKill
    (#1263301, #1296685)
  - Don't require NSSProxyNickname (#1280287)
  - Make link to libnssckbi.so an absolute link (#1288471)
  - Fail for colons in credentials with FakeBasicAuth (#1295970)
  - Don't ignore NSSProtocol when NSSFIPS is enabled (#1312491)
  - Check filesystem permissions on NSS database at startup (#1312583)
  - OpenSSL ciphers stopped parsing at +, CVE-2016-3099 (#1323913)
  - Patch to match available ciphers so tests pass (#1299063)
  - Patch to fix tests in brew (#1299063)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-6
changelog:
  - Check the NSS certificate database directory for read permissions
    by the Apache user. (#1312583)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-8
changelog:
  - Fail start start when there are invalid Protocols defined (#1389114)
  - Handle group membership when testing NSS database filesystem
    permissions (#1395300)
  - Add OCSP cache tuning directives (#1392582) 
  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-9
changelog:
  - Update nss_pcache.8 to drop directory and prefix options (#1382102)

  - Don't share mod_nss NSS database with nss_pcache (#1382102)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.14-12
changelog:
  - Correct URL and Source entries to point to pagure.io (#1502362)
  - Remove deprecated NSSSessionCacheTimeout from default config (#1257662)


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.3-14
changelog:
  - Bugzilla Bug #861999 - mod_revocator exec CLR URIs fail to load: unable to
    load Revocation module, NSS error -8187 - stephen.capstick64@gmail.com
    (mod_revocator-waitpid.patch)


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.3-16
changelog:
  - Bugzilla Bug #948875 - Man page scan results for mod_revocator
  - Moved 'ldapget' from %bindir to %sbindir (provided compatibility link)
  - Moved 'crlhelper' from %bindir to %libexecdir (provided compatibility link)


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.3-17
changelog:
  - Add the following explanation to the 'Brewtap results' textbox in rpmdiff:
    The '/etc/httpd/conf.d/revocator.conf' file does not require a man page
    because its parameters are sufficiently documented within the
    configuration file itself.
    The '/etc/httpd/conf.modules.d/11-revocator.conf' file does not require
    a man page because the file merely contains the line
    'LoadModule rev_module modules/mod_rev.so' to support httpd
    loading of Dynamic Shared Objects ('/etc/httpd/conf/httpd.conf').


author: Rob Crittenden <rcritten@redhat.com> - 1.0.3-20
changelog:
  - Clean up semaphore in crlhelper on shutdown (#1326840)
  - Update URL to https://fedorahosted.org/mod_revocator/


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-3
changelog:
  - Add some missing directives RHBZ #569360
  - Fix multipart/invalid part ruleset bypass issue (CVE-2012-4528)
    (RHBZ #867424, #867773, #867774)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-5
changelog:
  - Use conditional for loading mod_unique_id (rhbz #879264)
  - Fix syntax errors on httpd 2.4.x by using IncludeOptional (rhbz #879264, comment #2)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.3-2
changelog:
  - Fix NULL pointer dereference (DoS, crash) (CVE-2013-2765) (RHBZ #967615)
  - Fix a possible memory leak.


author: Daniel Kopecek <dkopecek@redhat.com> - 2.9.2-1
changelog:
  - RHEL-7.5 erratum
   - Update to 2.9.2
   - Fixed bogus dates in the spec file
   - Enabled mlogc subpackage
   - Enabled collection global lock to prevent collection
     removal failures
    Resolves: rhbz#1388656
    Resolves: rhbz#1139728
    Resolves: rhbz#1473420


author: Joe Orton <jorton@redhat.com> - 3.4-3
changelog:
  - use a NULL c->sbh pointer with httpd 2.4 (possible fix for #867276)
  - add logging for unexpected daemon process loss


author: Jan Kaluza <jkaluza@redhat.com> - 3.4-7
changelog:
  - compile with -fno-strict-aliasing to workaround Python
    bug http://www.python.org/dev/peps/pep-3123/


author: Peter Jones <pjones@redhat.com> - 11-0.1
changelog:
  - Update to 11-0.1 to match shim-11-1
    Related: rhbz#1310766
  - Fix regression in PE loader
    Related: rhbz#1310766
  - Fix case where BDS invokes us wrong and we exec shim again as a result
    Related: rhbz#1310766


author: Livy Ge <livy.ge@oracle.com> - 12-1.0.1
changelog:
  - New secure boot signing key
  - aarch64 is not supported by Oracle Linux thus aarch64 shim is not needed
  - Use redhat as efidir to maintain compatibility with RedHat
  - updated with shim.efi signed by Microsoft
  - shim update


author: Peter Jones <pjones@redhat.com> - 12-2
changelog:
  - Fix /boot/efi/... permissions to match the filesystem's requirements
    Related: rhbz#1512749
  - Minor .spec cleanups
    Related: rhbz#1512749


author: Livy Ge <livy.ge@oracle.com> - 15-1.0.1
changelog:
  - Pack files in efidir with disabled rpm verification
    [bug 27166040]
  - updated with shimia32.efi and shimx64.efi signed by Microsoft
  - Use redhat as efidir to maintain compatibility with RedHat


author: Livy Ge <livy.ge@oracle.com> - 15-1.0.1
changelog:
  - Pack files in efidir with disabled rpm verification
    [bug 27166040]
  - updated with shimia32.efi and shimx64.efi signed by Microsoft
  - New secure boot signing key
  - aarch64 is not supported by Oracle Linux thus aarch64 shim is not needed
  - Use redhat as efidir to maintain compatibility with RedHat
  - updated with shim.efi signed by Microsoft
  - shim update


author: Livy Ge <livy.ge@oracle.com> - 15-2.0.1
changelog:
  - updated BOOT*.CSV files to contain Oracle Linux
    [Orabug: 28073193]
  - Pack files in efidir with disabled rpm verification
    [bug 27166040]
  - updated with shimia32.efi and shimx64.efi signed by Microsoft
  - Use redhat as efidir to maintain compatibility with RedHat


author: Ilya Okomin <ilya.okomin@oracle.com> - 15-2.0.6
changelog:
  - removed shim{efiarchlc}-redhat.efi [Orabug: 31663209]
  - updated with shimia32.efi and shimx64.efi signed by Microsoft [Orabug: 31663209]
  - added oracle(grub2-sig-key) and oracle(kernel-sig-key) to package Requires [Orabug: 31663209]
  - added shim-{efiarchlc} to yum protected [Orabug: 31663209]


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-8
changelog:
  - mwm: do not see outline of window when moving (RHBZ#1080548)
    Clone of RHBZ#997241
  - Fixed rendering issues seen while scrolling window (RHBZ#1134365)
    (MotifZone bug #1654)


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-9
changelog:
  - Fixed motif issue while navigating drop down menus with arrow keys
    (RHBZ#1396514) (MotifZone bug #1564)


author: Carlos Soriano <csoriano@redhat.com> - 2.3.4-10
changelog:
  - Fix last commit that is actually MotifZone#1565 and removes that patch since
    it was causing more problems. Fixes MotifZone#1576.
    Resolves: rhbz#1448509


author: Carlos Soriano <csoriano@redhat.com> - 2.3.4-13
changelog:
  - Fix motifzone 1665. Motif was deactivating shorcuts in cascade menus when
    closing them by mouse.
    Resolves: RHBZ#1467303


author: Thomas Woerner <twoerner@redhat.com> 2.3.3-5
changelog:
  - dropped file requires for /usr/share/X11/XKeysymDB, not needed and not 
    available anymore
  - added flex-static build requirement, because of flex package split


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-1
changelog:
  - new version 2.3.4 with LGPL license
  - fixed some rpmlint warnings
  - new sub package for static libraries
  - added /etc/X11/mwm directory
  - removed defattrs


author: Thomas Woerner <twoerner@redhat.com> 2.3.4-2
changelog:
  - fixed requirements according to review (RHBZ#870049)
  - flex-static has been renamed to flex-devel with Fedora-18 and RHEL-7


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-8.1
changelog:
  - Fixed motif issue while navigating drop down menus with arrow keys
    (RHBZ#1415153) (RHBZ#1396514) (MotifZone bug #1564)


author: Colin Walters <walters@redhat.com> - 17.0.0-12
changelog:
  - Add patch for aarch64
  - Fix for aarch64 64k pagesize. BZ#1076181 (Mark Salter <msalter@redhat.com>)
  - Resolves: #1027067


author: Colin Walters <walters@redhat.com> - 17.0.0-16
changelog:
  - Add patch for aarch64 48bit VA limits
    This changes the API/ABI only on aarch64, and hence we also bump
    the soname solely on those architectures.  We do retain the same pkg-config
    file name though, so dependencies should only need a rebuild.
  - Resolves: #1324216


author: Yaakov Selkowitz <yselkowi@redhat.com> - 17.0.0-19.p1
changelog:
  - Switch to upstream aarch64 48bit VA patch
    This reverts the previous API/ABI break on aarch64, so dependencies
    must be rebuilt again.
  - Resolves: #1393548


author: Björn Esser <besser82@fedoraproject.org> - 52.5.0-3
changelog:
  - SpiderMonkey tests do not fail on any arch
  - Basic JIT tests are failing on s390 arches, only
  - Use macro for ppc64 arches
  - Run tests using Python2 explicitly
  - Simplify %check
  - Use the %{major} macro consequently
  - Replace %define with %global


author: Wim Taymans <wtaymans@redhat.com> - 1.23.8-3
changelog:
  - Remove pointless Enhances:
  - Fix splelling mistake
  - change package name from libs-devel to devel and add Obsolete:
  - see rhbz#1394147


author: Michal Schmidt <mschmidt@redhat.com> - 3.2-1
changelog:
  - Update to upstream version mpich-3.2 with patches from Fedora.
  - Keep 3.0.4 as 'mpich-3.0' for backwards compatibility.
  - Resolves: rhbz1091532
  - Resolves: rhbz1142117
  - Resolves: rhbz1148992


author: Michal Schmidt <mschmidt@redhat.com> - 3.2-2
changelog:
  - Remove bad rpath in two binaries in mpich-3.2.
  - Restore trimming of shebang lines in config files in mpich-3.0-devel.
  - Related: rhbz1091532


author: Jay Fenlason <fenlason@redhat.com> 3.2-10
changelog:
  - Add BuildRequires for libibmad-devel
  - Build against mpich, now that we have a mpi-3 version of it.
  - rebuild against new mvapich2
    Resolves: rhbz1011910, rhbz1011915


author: Michal Schmidt <mschmidt@redhat.com> - 4.1-1
changelog:
  - Update IMB to 4.1.
  - Update OSUMB to 5.3.
  - Add subpackages for new mpich and mvapich2 versions and variants.
  - Resolves: rhbz961885
  - Resolves: rhbz1093466


author: Michal Schmidt <mschmidt@redhat.com> - 5.4-1
changelog:
  - Update IMB to 2018.0.
  - Update OMB to 5.4.
  - Add builds for openmpi 3 and mvapich 2.3.
  - Build IMB NBC and RMA tests.
  - Build OSUMB collective async tests.
  - Add precise Requires.
  - Resolves: rhbz1358437


author: Honggang Li <honli@redhat.com> - 4.11.0-5
changelog:
  - Rebase to latest upstream release v4.11.0-5
  - mstconfig support for prio_tag and ttl_wa
  - Resolves: bz1694703


author: Doug Ledford <dledford@redhat.com> - 3.0-0.6.g6961daa.1
changelog:
  - Update to latest upstream version, which resovles some licensing issues
    on some of the source files


author: Michal Srb <msrb@redhat.com> - 1:2013.5.1-3
changelog:
  - Do not build module with unclear licensing (relames)
  - Replace %add_to_maven_depmap with %add_maven_depmap


author: Michal Sekletar <msekleta@redhat.com> - 2:0.85-3
changelog:
  - migrate from consolehelper to policykit (#1014074)
  - introduce grace period (#1014073)
  - query all ipv6 nameservers (#1014075)
  - add missing documentation (#949030)
  - enable hardened build (#1018907)
  - specfile cleanup


author: Dan Horák <dan[at]danny.cz> 1.3.12-5
changelog:
  - dropped debug output when tools are called with wrong number of arguments (#538403)
  - added patch to support DESTDIR for installing


author: Matej Muzila <mmuzila@redhat.com> 5:1.5.21-27
changelog:
  - Resolves #1388511 (System default CA bundle not set as default in compiled-in
    default or config)
  - Resolves #1388512 (mutt sends e-mail with broken "From" header, which has no
    host part)


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.21-29
changelog:
  - Fix IMAP header caching path traversal vulnerability
  - Resolves: #1608011
  - Resolves: CVE-2018-14355


author: Florian Müllner <fmuellner@redhat.com> - 3.24.3-11
changelog:
  - Prevent crash when removing workspace with on-all-workspaces windows
    present (like desktop icons)
  - Resolves: #1453065


author: Florian Müllner <fmuellner@redhat.com> - 3.26.2-7
changelog:
  - Fix crash during session saving
    Resolves: #1535080
  - Fix XWayland prevented from starting
    Resolves: #1540986


author: Carlos Garnacho <cgarnach@redhat.com> - 3.26.2-10
changelog:
  - Detect CLUTTER_TOUCHPAD_DEVICE on all Synaptics devices
    Resolves: #1499788
  - Fix tablet pressure curve configuration not being applied
    Resolves: #1543693


author: Kalev Lember <klember@redhat.com> - 3.28.3-1
changelog:
  - Update to 3.28.3
  - Apply HW cursor on-demand patches
  - Apply monitor transform regression patch
  - Resolves: #1569736


author: Jay Fenlason <fenlason@redhat.com> 1.8-1
changelog:
  - New upstream version, with man pages again.
    This fixes the following bugs:
    Related: rhbz739138
    Resolves: rhbz613696
    Resolves: rhbz625620
    Resolves: rhbz735954
    Resolves: rhbz782263


author: Jay Fenlason <fenlason@redhat.com> 1.8-2
changelog:
  - Add BuildRequires on flex and bison
  - Add "export AR=ar" to allow builds on RHEL-7 to work.
    Resolves: rhbz822527


author: Jay Fenlason <fenlason@redhat.com> 1.8-3
changelog:
  - Move the module files to the (correct for RHEL-7) mpi/ directory.
  - Add MANPATH to the module files.


author: Jay Fenlason <fenlason@redhat.com> 2.0a-1
changelog:
  - Add Build Requires on autoconf, automake, libtool,
    perl-Digest-MD5, hwloc-devel, and libibmad-devel.
  - remove build requires on java
  - New upstream version, edited so it can pass a license audit.
    Resolves: rhbz1001718


author: Kyle McMartin <kmcmarti@redhat.com> - 2.0a-3
changelog:
  - aarch64: add get_cycles implementation since <asm/timex.h> is not
    an exported header.
  - Resolves: #1100046


author: Michal Schmidt <mschmidt@redhat.com> - 2.2-0.1.rc1
changelog:
  - Update to 2.2rc1
  - Includes -psm2 variant for Intel OPA.
  - Still build the previous version for compatibility, as 2.0 subpackages.
  - Resolves: #948504
  - Resolves: #1093453
  - Resolves: #1173318


author: Jarod Wilson <jarod@redhat.com> - 2.2-1.5
changelog:
  - Update mvapich23 (TrueScale) bits to 2.3 release
  - Fix libmpi.a being built w/o -fPIC
  - Resolves: #1625672


author: Tom Lane <tgl@redhat.com> 1:5.1.17-5
changelog:
  - Switch to noarch (non-GCJ) build
  Resolves: #688937, #819139
  - Fix mysql-connector-java-jdbc-4.1.patch to cover both driver classes
  Related: #816696


author: Honza Horak <hhorak@redhat.com> - 5.2.5-1
changelog:
  - Update to 5.2.5
  - Enlarge buffer size for query string when getting info about tables
    Related: #948619


author: Marcin Juszkiewicz <mjuszkiewicz redhat com> - 5.2.5-4
changelog:
  - Build failed because whether to use lib64 or not is done by checking
    list of known 64-bit architectures. So added AArch64 to that list.
    Resolves: #1041348


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-2
changelog:
  - Enhance logic to detect oci instance [ OraBug 29241080]
  - Do not overwrite /etc/yun/vars/ociregion file.


author: Mathieu Bridon <bochecha@fedoraproject.org> - 1.2-2
changelog:
  - added comment explaining how the source is obtained (as it is modified from upstream)
  - temporary fix for RHBZ#490830 while not fixed upstream


author: Carlos Soriano <csoriano@redhat.com> 3.14.3-8
changelog:
  - Backport fix for jp2 images crashing nautilus
  - Apply downstream translations
    Resolves: #1271297 #1272881


author: Carlos Soriano <csoriano@redhat.com> 3.14.3-9
changelog:
  - Apply downstream translations
  - Restrict icons on desktop to the primary monitor
    Resolves: #1207646 #1046876 #1272881


author: Miroslav Lichvar <mlichvar@redhat.com> 5.9-8.20130126
changelog:
  - update to 20130126
  - clear scrollback buffer in clear (#815790)
  - make -base and -term subpackages noarch
  - make some dependencies arch-specific


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-21
changelog:
  - Fixed crash on reloading 'exec' configuration options (#1228893)
  - Fixed CVE-2014-3565, snmptrapd died when parsing certain traps (#1209361)
  - Fixed storageUseNFS functionality in hrStorageTable (#1193006)
  - Fixed forwarding of traps with RequestID=0 in snmptrapd (#1192511)
  - Fixed hrStorageTable to contain 31 bits integers (#1192221)
  - Fixed 'clientaddr' option for UDPv6 client messages (#1190679)
  - Fixed log level of SMUX messages (#1189393)
  - Fixed UDP-MIB::udpTable index on big-endian platforms (#1184433)
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1151310)
  - Fixed snmpd crash when failed to parse SMUX message headers (#1140236)
  - Added 'diskio' option to snmpd.conf, it's possible to monitor only
    selected devices in diskIOTable (#1092308)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-23
changelog:
  - Fixed parsing of invalid variables in incoming packets (#1248414)
  - Fixed HOST-RESOURCES-MIB::hrFSAccess flag when read-only filesystem
    becomes writable (#1241897)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-24
changelog:
  - Fixed lmSensorsTable not reporting sensors with duplicate names
    (#1252053)
  - Fixed close() overhead of extend commands (#1252048)
  - Fixed out-of-bounds write in python code (#1252034)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-27
changelog:
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1326850)
  - snmpd: Speed up ipAddressTable loading. (#1327240)
  - Fixed net-snmp segfault in netsnmp_copy_fd_set_to_large_fd_set (#1327200)
  - Fixed issue with net-snmp-perl dependency on net-snmp-devel (#1438875)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-29
changelog:
  - Move net-snmp-config from devel package to general package (#1486733)
  - Fix SCTP parser (#1329338)
  - Fix strstr() crash (#1428609)
  - Add support for TCP and UDP 64 bit counters (#1448082)
  - Fix documentation lack for includeFile, includeDir and includeSearch options (#1464485)
  - Fix wrong usage of structure iterator (#1461666)
  - Fix issue with statistics from autofs (#1501144)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-35
changelog:
  - Add fsync to prevet data lose on power failure (#1520761)
  - Add ZFS support (#1533943)
  - Fix man page (#1537460)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-39
changelog:
  - adjust logging of statfs (#1314610)
  - link libnetsnmptrapd against MYSQL LIBS (#1468084)
  - expand SNMPCONFPATH (#1514501)
  - remove date in mailheader (#1585940)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-44
changelog:
  - add support for glusterfs (#1316386)
  - change services to start after network-online.target (#1388118)
  - fix interface fadeout configuration (#1547355)
  - fix scanf pattern for ICMP stats (#1693547)
  - change buffer size in pass_common.c file (#1695363 and #1731357)
  - remove initial whitespace reading from scanf pattern of /sys/dev/block/../stat file (#1700494)
  - fix for CVE-2018-18066 (#1638911)
  - add Counter64 support for UCD-SNMP-MIB (#1703752)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-49
changelog:
  - add missing part of memory leak patch (#1794168)
  - fix if_inet6 messages floood (#1765449)
  - revert bz#1486733 (#1771050)
  - fix issue for process status when process name contains whitespace (#1782180)


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 1:5.7.2-49.0.1.2
changelog:
  - skip setting asp->index if already set in function netsnmp_wrap_up_request
    (nishant.nayan@oracle.com) [Orabug: 33054569]


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.18.20131004git
changelog:
  - Resolves: #1063913 - netstat doesn't list sctp servers in -A mode
  - Resolves: #1257549 - netstat tool does not throw correct exit code on wrong parameter
  - Resolves: #1392910 - ifconfig inaccurately rounds exabytes


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.25.20131004git
changelog:
  - Resolves: #1632905 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Laine Stump <laine@redhat.com> - 0.2.3-6
changelog:
  - resolves rhbz#961184
  - wait for IFF_UP and IFF_RUNNING after calling ifup
  - resolves rhbz#1020204
  - remove extraneous quotes from BONDING_OPTS
  - resolves rhbz#1044681
  - eliminate use of uninitialized data when getting mac
  - resolves rhbz#1046594
  - support systemd based netcf transaction


author: Laine Stump <laine@redhat.com> - 0.2.3-8
changelog:
  - resolves rhbz 1060076
  - Transform STP value from yes/no to on/off
  - resolves rhbz 1060317
  - Require bridge-utils for netcf-libs in the specfile


author: Laine Stump <laine@redhat.com> - 0.2.6-1
changelog:
  - resolves rhbz#1115176
   - rebase to upstream 0.2.6
   - allow interleaved elements in interface XML schema
   - allow <link> element in vlan and bond interfaces
   - report link state/speed in interface status
   - change DHCPv6 to DHCPV6C in ifcfg files
   - max vlan id is 4095, not 4096


author: - Laine Stump <laine@redhat.com> 0.2.6-2
changelog:
  - resolves rhbz#1138196
   - report file path and reason when aug_save fails
   - resolves rhbz#1147650
   - recognize IPADDR0/PREFIX0/NETMASK0/GATEWAY0
   - use git to apply patches to source tree


author: Laine Stump <laine@redhat.com> - 0.2.8-1
changelog:
  - Rebase to netcf-0.2.8
   - resolve rhbz#1165965 - CVE-2014-8119
   - resolve rhbz#1159000
   - support multiple IPv4 addresses in interface config (redhat driver)
   - resolve rhbz#1113983
   - allow static IPv4 config simultaneous with DHCPv4 (redhat driver)
   - resolve rhbz#1170941
   - remove extra quotes from IPV6ADDR_SECONDARIES (redhat+suse drivers)
   - resolve rhbz#1090011
   - limit names of new interfaces to IFNAMSIZ characters
   - resolve rhbz#761246
   - properly parse ifcfg files with comments past column 1


author: Paul Moore <pmoore@redhat.com> - 0.20-0
changelog:
  - Version bump to match latest upstream
  - Cleanups in the specfile due to changes in the upstream package


author: Paul Moore <pmoore@redhat.com> - 0.20-3
changelog:
  - Fix a problem when adding a CIPSO DOI with a large number of translations
  - Remove old patches
    Resolves: #1053687


author: Josef Ridky <jridky@redhat.com> - 10.79.00-4
changelog:
  - Resolves: #1523176 - add manual page for ppmtopga
  - Resolves: #1530606 - pbmtoepson command line option fix


author: Daniel Borkmann <dborkman@redhat.com> - 0.5.8-1
changelog:
  - Initial netsniff-ng spec file for RHEL, import of 0.5.8-rc1. Note that
    RHEL packaging differs significantly from Fedora as we only do a partial
    build and have a small fraction of dependencies that are available on
    RHEL.


author: Daniel Borkmann <dborkman@redhat.com> - 0.5.8-3
changelog:
  - Package Wrangler feedback from Thomas Graf
  - Note: 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches  }" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches  }" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro }"; export LDFLAGS; 
    [ "1" == 1 ] && [ "aarch64" == ppc64le ] && /usr/lib/rpm/redhat/libtool-handle-ppc64le.sh ; 
    for i in $(find . -name config.guess -o -name config.sub) ; do 
        [ -f /usr/lib/rpm/redhat/$(basename $i) ] && /usr/bin/rm -f $i && /usr/bin/cp -fv /usr/lib/rpm/redhat/$(basename $i) $i ; 
    done ; 
    ./configure --build=aarch64-redhat-linux-gnu --host=aarch64-redhat-linux-gnu \
  	--program-prefix= \
  	--disable-dependency-tracking \
  	--prefix=/usr \
  	--exec-prefix=/usr \
  	--bindir=/usr/bin \
  	--sbindir=/usr/sbin \
  	--sysconfdir=/etc \
  	--datadir=/usr/share \
  	--includedir=/usr/include \
  	--libdir=/usr/lib64 \
  	--libexecdir=/usr/libexec \
  	--localstatedir=/var \
  	--sharedstatedir=/var/lib \
  	--mandir=/usr/share/man \
  	--infodir=/usr/share/info does not work with upstream's build system here as CFLAGS
    will be overwritten. Changes would need to be proposed to upstream first.


author: Daniel Borkmann <dborkman@redhat.com> - 0.5.8-4
changelog:
  - GeoIP was added to RHEL7, so we can make use of that to enable
    astraceroute and features in netsniff-ng.
  - For this we also need zlib in order to make the updater work.


author: Eric Garver - 0.5.8-7
changelog:
  - netsniff-ng: add packet fanout support
  - doc: authors: add Michal as contributor
  - man: netsniff-ng: document fanout options
  - netsniff-ng: add example for fanout into man page


author: Daniel Borkmann <dborkman@redhat.com> - 0.5.8-3
changelog:
  - Package Wrangler feedback from Thomas Graf
  - Note: 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro }"; export LDFLAGS; 
    [ "1" == 1 ] && [ "x86_64" == ppc64le ] && /usr/lib/rpm/redhat/libtool-handle-ppc64le.sh ; 
    for i in $(find . -name config.guess -o -name config.sub) ; do 
        [ -f /usr/lib/rpm/redhat/$(basename $i) ] && /usr/bin/rm -f $i && /usr/bin/cp -fv /usr/lib/rpm/redhat/$(basename $i) $i ; 
    done ; 
    ./configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu \
  	--program-prefix= \
  	--disable-dependency-tracking \
  	--prefix=/usr \
  	--exec-prefix=/usr \
  	--bindir=/usr/bin \
  	--sbindir=/usr/sbin \
  	--sysconfdir=/etc \
  	--datadir=/usr/share \
  	--includedir=/usr/include \
  	--libdir=/usr/lib64 \
  	--libexecdir=/usr/libexec \
  	--localstatedir=/var \
  	--sharedstatedir=/var/lib \
  	--mandir=/usr/share/man \
  	--infodir=/usr/share/info does not work with upstream's build system here as CFLAGS
    will be overwritten. Changes would need to be proposed to upstream first.


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-5
changelog:
  - Fixed SHA-3 implementation to conform to final standard (#1252936)
  - Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
    in secp256r1 and secp384r1 calculations (#1314374)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-8
changelog:
  - Use a cache-silent version of mpz_powm to prevent cache-timing
    attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.13-1
changelog:
  - add support for changing colors in individual labels, scrollbars, entries,
    textboxes and scales, add custom colorsets 
  - add support for NEWT_COLORS and NEWT_COLORS_FILE variables (#689903)
  - allow resizing of form
  - fix errors found by coverity
  - fix va_list usage (Gwenole Beauchesne)
  - fix building and installing on Mac OS X (#652479)
  - check for slang.h header, support DESTDIR variable, add --without-python
    option (Otavio Salvador)
  - add Persian, Low German translations


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.14-1
changelog:
  - fix returning strings in whiptail and whiptcl (#752818)
  - fix configure to work with multiple python versions (#737998)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.15-1
changelog:
  - fix errors found by gcc-with-cpychecker (#800075)
  - fix building with tcl8.6 (#902561)
  - add fallback to python-config (#783627)
  - replace tabs in snack.py (#870647)
  - compile snackmodule.c with flag -fPIC (Kang Kai)
  - include new translations from transifex
  - allow newtWinMenu and newtWinEntries with no buttons or items
  - don't draw scale when not mapped
  - build with large-file support for stat64
  - remove unused variables in test code
  - update FSF address
  - remove obsolete macros
  - make some dependencies arch-specific


author: Steve Dickson <steved@redhat.com> 1.3.0-0.40
changelog:
  - gssd: ensure that preferred_realm is non-NULL (bz 1432643)
  - mountstats: handle KeyError in accumulate_iostats() (bz 1400106)
  - mount: RPC_PROGNOTREGISTERED should not be a permanent error (bz 1404121)
  - sm-notify: ending the grace period early should be configurable (bz 1424599)
  - Fixed a couple typos that effected the '--mounts' nfsstat option (bz 1425956)
  - Manual page bug: two inaccuracies in nfsd(7) (bz 1432750)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.41
changelog:
  - nfsdcltrack: silence some expected errors (bz 1443176)
  - Conditionally restart gssproxy now that config file is installed (bz 1440887)
  - systemd: NFS server services should use network-online (bz 1409012)
  - Cleaned up some fuzzy patches (bz 1409012)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.43
changelog:
  - mount: explicit v4 mounts should not roll back to v3 (bz 1447849)
  - spec: Use reload-or-try-restart to restart gssproxy (bz 1440887)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.48
changelog:
  - exportfs: fix path comparison in unexportfs_parsed() (bz 1389046)
  - Correctly set the minor version when set in nfsmount.conf (1458504)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.49
changelog:
  - mount: handle EACCES during version negotiation (bz 1479573)
  - mount: Fix problems with parsing minorversion= (bz 1489262)
  - mountstats:  Remove a shebang (bz 987031)
  - nfsdcltrack: remove a warning (bz 1475462)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.50
changelog:
  - rpc.nfsd: Do not fail when all address families are not support (bz 1450528)
  - mount.nfs: merge in vers= and nfsvers= options (bz 1496822)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.51
changelog:
  - systemd: add a generator for the rpc_pipefs mountpoint (bz 1358333)
  - nfsdcltrack: return an non-zero value for invalid options (bz 1461349)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.52
changelog:
  - nfs(5): update some version information (bz 1452461)
  - nfsiostat: avoid parsing "no device mounted ..." line (bz 1508046)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.55
changelog:
  - mountstats: use correct RDMA terminology (bz 1527938)
  - nfs-server: restart gssproxy when the server is restarted. (bz 1527653)
  - nfsd: Set default minor versions (bz 1436977)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.56
changelog:
  - exportfs: move ro/rw option back to secinfo_flag_displaymap table (bz 1532688)
  - nfsdcltrack: getopt_long() fails on a non x86_64 archs (bz 1551903)
  - Fixed typo in nfsmount.conf (bz 1592235)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.57
changelog:
  - rpc.gssd: truncates 32-bit UIDs/GIDs to 16 bits architectures (bz 1602836)
  - Added back lockd vars to nfs-utils_env.sh and sysconfig (bz 1413272)
  - Document nfs v4 mounts will use Kerberos we available (bz 1334510)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.63
changelog:
  - nfs.conf: Fixed manage-gids option typo (bz 1677403)
  - sm-notify: Added -f flag to nfs.conf parsing (bz 1688932)
  - Add nfs.conf equivalent for the statd --no-notify cmdline option (bz 1688918)
  - nfs-server: Use reload not restart to start gssproxy (bz 1644169)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.67
changelog:
  - rpc.gssd: removed a number memory leaks (bz 1807110)
  - mount: Report correct error in the fall_back cases (bz 1752329)
  - gssd: daemonize earlier (bz 1645083)


author: Steve Dickson <steved@redhat.com> 0.3.3-15
changelog:
  - Allow spaces in group principal names (bz 1284597)
  - Fixed FD leak in edit_ACL() (bz 1284608)
  - Added RELRO check (bz 1092556)


author: Steve Dickson <steved@redhat.com> 0.3.3-15
changelog:
  - Allow spaces in group principal names (bz 1284597)
  - Fixed FD leak in edit_ACL() (bz 1284608)
  - Added the RELRO check (bz 1092556)


author: Phil Sutter <psutter@redhat.com> [0.6-3.el7]
changelog:
  - nftables.spec: Require at least libnftnl-1.0.6-4 (Phil Sutter) [1358705]
  - evaluate: Fix datalen checks in expr_evaluate_string() (Phil Sutter) [1360240]
  - netlink_delinearize: Avoid potential null pointer deref (Timothy Redaelli) [1360257]
  - src: use new range expression for != [a,b] intervals (Phil Sutter) [1358705]


author: Phil Sutter <psutter@redhat.com> [0.6-4.el7]
changelog:
  - evaluate: Avoid undefined behaviour in concat_subtype_id() (Phil Sutter) [1360789]
  - src: Interpret OP_NEQ against a set as OP_LOOKUP (Phil Sutter) [1440011]
  - include: refresh uapi/linux/netfilter/nf_tables.h copy (Phil Sutter) [1440011]
  - datatype: time_type should send milliseconds to userspace (Phil Sutter) [1427114]
  - meta: fix memory leak in tc classid parser (Phil Sutter) [1380326]
  - src: meta priority support using tc classid (Phil Sutter) [1380326]
  - src: simplify classid printing using x instead of 04x (Phil Sutter) [1380326]
  - src: rename datatype name from tc_handle to classid (Phil Sutter) [1380326]
  - payload: don't update protocol context if we can't find a description (Timothy Redaelli) [1446534 1399764]
  - evaluate: reject: Have a generic fix for missing network context (Timothy Redaelli) [1360354]


author: Phil Sutter <psutter@redhat.com> [0.8-6.el7]
changelog:
  - netlink_linearize: exthdr op must be u32 (Phil Sutter) [1524246]
  - src: fix protocol context update on big-endian systems (Phil Sutter) [1523016]


author: Phil Sutter <psutter@redhat.com> [0.8-9.el7]
changelog:
  - evaluate: explicitly deny concatenated types in interval sets (Phil Sutter) [1576426]
  - Deprecate add/insert rule 'position' argument (Phil Sutter) [1571968]
  - doc: reword insert position, this expects rule handle to insert, not a relative postition (Phil Sutter) [1571968]
  - nft.8: Fix reject statement documentation (Phil Sutter) [1571938]
  - netlink_delinearize: Fix resource leaks (Phil Sutter) [1504157]
  - netlink: Complain if setting O_NONBLOCK fails (Phil Sutter) [1504157]
  - hash: Fix potential null-pointer dereference in hash_expr_cmp() (Phil Sutter) [1504157]
  - evaluate: Fix memleak in stmt_reject_gen_dependency() (Phil Sutter) [1504157]
  - erec: Avoid passing negative offset to fseek() (Phil Sutter) [1504157]
  - cli: Drop pointless check in cli_append_multiline() (Phil Sutter) [1504157]
  - monitor: Make JSON/XML output respect output_fp (Phil Sutter) [1504157]
  - monitor: Make trace events respect output_fp (Phil Sutter) [1504157]
  - Review switch statements for unmarked fall through cases (Phil Sutter) [1504157]


author: Phil Sutter <psutter@redhat.com> [0.8-11.el7]
changelog:
  - src: Reject 'export vm json' command (Phil Sutter) [1646336]
  - monitor: Drop fake XML support (Phil Sutter) [1646336]
  - src: bail out when exporting ruleset with unsupported output (Phil Sutter) [1646336]


author: Phil Sutter <psutter@redhat.com> [0.8-13.el7]
changelog:
  - doc: Add minimal description of (v)map statements (Phil Sutter) [1628974]
  - nft.8: Update meta pkt_type value description (Phil Sutter) [1628694]


author: Daiki Ueno <dueno@redhat.com> - 3.020-1
changelog:
  - new upstream release
  - update the priority
    nhn-nanum-fonts -> 65-0, un-core-fonts -> 65-1, baekmuk-ttf-fonts -> 65-2


author: Michal Hlavinka <mhlavink@redhat.com> - 2:6.40-5
changelog:
  - ncat should try to connect to all resolved addresses, not only the first one (#1192143)
  - do not print debug messages during normal use (#1134412)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-2
changelog:
  - Restore previously used s390x patch as it isn't upstream yet
  - Related: rhbz#1031465 - CVE-2013-5607


author: Elio Maldonado <emaldona@redhat.com> 4.10.6-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1126243 - Ensure nspr is built for 64 bit on ppc64le


author: Elio Maldonado <emaldona@redhat.com> - 4.10.6-3
changelog:
  - Restore s390x related patch as it hasn't been applied upstream yet
  - Resolves: Bug 1103250 - Rebase RHEL 7.1 to NSPR 4.10.6 (for FF 31)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269363 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-3
changelog:
  - Make sure 32bit nss-pem always be installed with 32bit nss in
    multlib environment, patch by Kamil Dudka
  - Enable new algorithms supported by the new nss-softokn


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-4
changelog:
  - Utilize CKA_NSS_MOZILLA_CA_POLICY attribute, patch by Kai Engert
  - Backport changes adding SSL alert callbacks from upstream
  - Add nss-check-policy-file.patch from Fedora
  - Install policy config in /etc/pki/nss-legacy/nss-rhel7.config


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-5
changelog:
  - Switch default hash algorithm used by tools from SHA-1 to SHA-256
  - Avoid race condition in nssSlot_IsTokenPresent()
  - Enable SHA-2 and AES in pk12util
  - Disable RSA-PSS for now


author: Daiki Ueno <dueno@redhat.com> - 3.28.4-3
changelog:
  - Reorder ChaCha20-Poly1305 cipher suites, as suggested in:
    https://bugzilla.redhat.com/show_bug.cgi?id=1373158#c9


author: Daiki Ueno <dueno@redhat.com> - 3.33.0-1
changelog:
  - Rebase to NSS 3.33
  - Disable TLS 1.3, temporarily disable failing gtests (Skip13Variants)
  - Temporarily disable race.patch and nss-3.16-token-init-race.patch,
    which causes a deadlock in newly added test cases
  - Remove upstreamed patches: moz-1320932.patch,
    nss-tstclnt-optspec.patch,
    nss-1334976-1336487-1345083-ca-2.14.patch, nss-alert-handler.patch,
    nss-tools-sha256-default.patch, nss-is-token-present-race.patch,
    nss-pk12util.patch, nss-ssl3gthr.patch, and nss-transcript.patch


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-7
changelog:
  - Backport upstream fix for CVE-2018-12384
  - Remove nss-lockcert-api-change.patch, which turned out to be a
    mistake (the symbol was not exported from libnss)


author: Daiki Ueno <dueno@redhat.com> - 3.43.0-7
changelog:
  - Don't override date in man-pages
  - Revert the change to use XDG basedirs (mozilla#818686)
  - Enable SSL2 compatible ClientHello by default
  - Disable SSL3 and RC4 by default


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-1
changelog:
  - Rebase to NSS 3.44
  - Restore fix-min-library-version-in-SSLVersionRange.patch to keep
    SSL3 supported in the code level while it is disabled by policy
  - Skip TLS 1.3 tests under FIPS mode


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-2
changelog:
  - Skip sysinit gtests properly
  - Fix shell syntax error in tests/ssl/ssl.sh
  - Regenerate manual pages


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
  - Disable TLS 1.3 under FIPS mode
  - Disable RSASSA-PKCS1-v1_5 in TLS 1.3
  - Fix post-handshake auth transcript calculation if
    SSL_ENABLE_SESSION_TICKETS is set


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-6
changelog:
  - back out out-of-bounds patch (patch for nss-softokn).
  - Fix segfault on empty or malformed ecdh keys (#1777712)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-7
changelog:
  - Increase timeout on ssl_gtest so that slow platforms can complete when
     running on a busy system.


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-5
changelog:
  - Fix pkix name constraints processing to only process the common name if the
    certusage you are checking is IPSEC or SSL Server.


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-3
changelog:
  - Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
  - Explicitly enable upgradedb/sharedb test cycles


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - revert sql default language in man pages
  - fix SEC_PKCS12EnableCipher so python-nss tests will still work.


author: Jakub Hrozek <jhrozek@redhat.com> 0.8.13-8
changelog:
  - Fix a potential use-after-free in nsswitch module
  - Resolves: rhbz#1036030 - New defect found in nss-pam-ldapd-0.8.13-4.el7


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-9
changelog:
  - Resolves: rhbz#1420576 - 'systemctl status nslcd' always returns FAILURE
                             status even though the service is stopped with
                             'systemctl stop nslcd


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-10
changelog:
  - Resolves: rhbz#1357493 - In RHEL 7, authentication failing when using
                             nslcd + pam_ldap where user has different in
                             nis/passwd and ldap.


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-11
changelog:
  - Resolves: rhbz#1497761 - Incorrect password tries to bind to all domain
                             controllers and locks user out


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-12
changelog:
  - Resolves: rhbz#1425790 - Unable to authenticate with 64 character password
                             using nss-pam-ldapd


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-14
changelog:
  - Resolves: rhbz#1288429 - /etc/tmpfiles.d/nss-pam-ldapd.conf shipped when
                             /etc/tmpfiles.d is reserved for the local
                             administrator


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-15
changelog:
  - Resolves: rhbz#1204202 - fix doc to describe actual uri format in
                             nslcd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-16
changelog:
  - Resolves: rhbz#1151675 - NSLCD WRAPS LDAP USER UIDNUMBER > 2^31 SO UID
                             IS WRONG (AND A NEGATIVE NUMBER)


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-18
changelog:
  - Resolves: rhbz#1612543 - Password expiration notification is not sent if
                             the LDAP user doesn't have the objectClass shadowAccount.


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-20
changelog:
  - Resolves: rhbz#1714763 - [RHEL7] Correct startup dependencies for cgcred service for nslcd/LDAP clients


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-21
changelog:
  - Resolves: rhbz#1618558 - AD authentication on RHEL using nslcd fails
                             with error "pwdLastSet: password changed in the
                             future"


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-22
changelog:
  - Do not enable the password expiration controls by default
  - Document the option and its default
  - Resolves: rhbz#1612543 - Password expiration notification is not sent
                             if the LDAP user doesn't have the objectClass
                             shadowAccount.


author: Tomas Halman <thalman@redhat.com> - 0.8.13-22.1
changelog:
  - Extend password buffer length to allow modern hashes
  - Resolves: rhbz#1819648 - Truncated shadowPasswords in nslcd 0.8.13


author: Tomas Halman <thalman@redhat.com> - 0.8.13-23
changelog:
  - Extend password buffer length to allow modern hashes
  - Resolves: rhbz#1773506 - Truncated shadowPasswords in nslcd 0.8.13


author: Tomas Halman <thalman@redhat.com> - 0.8.13-24
changelog:
  - Extend dns name buffers to allow long dns names
  - Resolves: rhbz#1685610 - nslcd aborts when rhost is large and UseDNS is true


author: Tomas Halman <thalman@redhat.com> - 0.8.13-24
changelog:
  - Unify password expire message
  - Resolves: rhbz#1771439 - Different password expiration message for LDAP users
                             with and without ObjectClass ShadowAccount


author: Nalin Dahyabhai <nalin@redhat.com> 0.8.12-4
changelog:
  - in %post, attempt to rewrite any instances of "map group uniqueMember ..."
    to be "map group member ..." in nslcd.conf, as the attribute name changed
    in 0.8.4 (via freeipa ticket #3589)


author: Nalin Dahyabhai <nalin@redhat.com> 0.8.13-4
changelog:
  - compile nslcd/log.c with -fPIC instead of the current hardened-build default
    of -fPIE, which doesn't seem to avoid relocations for its thread-local
    variables on s390x (#1002834)


author: Jakub Hrozek <jhrozek@redhat.com> 0.8.13-6
changelog:
  - Change the error messages the tests expect to those printed on RH based
    systems
  - Resolves: rhbz#1044482


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-14
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-2
changelog:
  - Update to NSS 3.28.3
  - Remove upstreamed patches for the previous FIPS validation
  - Package lowkeyi.h and lowkeyti.h in freebl-devel
  - Pick up a patch in the Fedora package to fix build issue


author: Bob Relyea <rrelyea@redhat.com> - 3.28.3-4
changelog:
  - include new PKCS12 NSS specific mechanisms.
  - alias CKM_TLS_KDF to CKM_TLS_MAC to preserve ABI
  - add RSA PSS oid to decrypting PKCS #5 key blobs.
  - move ec public key check from softokn to freebl so apps like Java can benefit.


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-5
changelog:
  - fix login handling for FIPS slots, patch from rhbz#1390154
  - backport upstream fix for CVE-2017-5462 (DRBG leak)


author: Ilya Okomin <ilya.okomin@oracle.com> - 3.28.3-8.0.1
changelog:
  - Add fips140-2 DSA Known Answer Test fix [Orabug 26679337]
  - Add fips140-2 ECDSA/RSA/DSA Pairwise Consistency Test fix [Orabug 26617814],
    [Orabug 26617879], [Orabug 26617849]
  - Add fips140-2 ECDSA Known Answer Test fix [Orabug 26679353]


author: Daiki Ueno <dueno@redhat.com> - 3.33.0-1
changelog:
  - Update to NSS 3.33.0
  - Remove upstreamed patches: nss-softokn-basicutil-dependency.patch,
    nss-softokn-pss-modulus-bits.patch, nss-softokn-pkcs12-sha2.patch,
    nss-softokn-pkcs12-rsa-pss.patch,
    nss-softokn-ec-derive-pubkey-check.patch, and nss-softokn-fix-drbg.patch


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-0.1.beta
changelog:
  - Update to NSS 3.36 BETA
  - Remove upstreamed nss-softokn-3.16-add_encrypt_derive.patch
  - Remove upstreamed nss-softokn-3.28-fix-fips-login.patch
  - Remove upstreamed nss-softokn-fix-ecc-post.patch


author: EL Errata <el-errata_ww@oracle.com> - 3.44.0-5.0.1
changelog:
  - Add fips140-2 DSA Known Answer Test fix [Orabug: 26679337]
  - Add fips140-2 ECDSA/RSA/DSA Pairwise Consistency Test fix [Orabug: 26617814],
    [Orabug: 26617879], [Orabug: 26617849]


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-3
changelog:
  - include patches for CVE-2020-6829, CVE-2020-12400,
    and CVE-2020-12401 from upstream (ECC constant time issues).
  - include patches for CVE-2020-12403 from upstream
    (CHACHA issues).
  - include self-tests for kdfs and cmac.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn of ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn off ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - Include softoken specific patches required by the NSS 3.67
    release including:
  -  sdb timeout fixes.
  -  coverity patch.
  -  fixing private key macing


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
changelog:
  - Rebase to NSS 3.79.
  - add reader/writer lock on encrypted attribute access
  - skip attribute verification on attributes with default values
  - don't export trust objects if they are default trust objects from dbm


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297940 - Rebase RHEL 7.3 to NSS-util 3.21 in preparation for Firefox 45


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-4
changelog:
  - Manual merge from the rhel-7.2 branch
  - Fix one alias for naming compatibility with prior release
  - Remove an unused patch


author: Daiki Ueno <dueno@redhat.com> - 3.21.3-1
changelog:
  - Rebase to nss-3.21.3
  - Remove patch for CVE-2016-1950, which is included in the release
  - Related: Bug 1347908


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-19
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-20
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems (CVE-2015-3405)
  - add option to set Differentiated Services Code Point (DSCP) (#1202828)
  - add nanosecond support to SHM refclock (#1117702)
  - allow creating all SHM segments with owner-only access (#1122012)
  - allow different thresholds for forward and backward step (#1193154)
  - allow symmetric keys up to 32 bytes again (#1191111)
  - don't step clock for leap second with -x option (#1191122)
  - don't drop packets with source port below 123 (#1171640)
  - retry joining multicast groups (#1207014)
  - increase memlock limit again (#1053569)
  - warn when monitor can't be disabled due to limited restrict (#1191108)
  - use larger RSA exponent in ntp-keygen (#1191116)
  - fix crash in ntpq mreadvar command (#1180721)
  - move sntp kod database to allow SELinux labeling (#1082934)
  - fix typos in ntpd man page (#1195211)
  - improve documentation of restrict command (#1213953)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-24
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - check key ID in packets authenticated with symmetric key (CVE-2015-7974)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix infinite loop in ntpq/ntpdc (CVE-2015-8158)
  - fix resetting of leap status (#1242553)
  - extend rawstats log (#1242877)
  - report clock state changes related to leap seconds (#1242935)
  - allow -4/-6 on restrict lines with mask (#1304492)
  - explain synchronised state in ntpstat man page (#1309594)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25
changelog:
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25.el7_3.1
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-28
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)
  - add Spectracom TSYNC driver (#1491797)
  - fix initialization of system clock status (#1493452)
  - fix typos in ntpd man page (#1420453)
  - use SHA1 request key by default (#1442083)
  - use network-online target in ntpdate and sntp services (#1466947)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29
changelog:
  - fix CVE-2016-7429 patch to restore default ttl configuration (#1550637)
  - fix buffer overflow in parsing of address in ntpq and ntpdc (CVE-2018-12327)
  - fix crash in parsing of received address in ntpq (#1616250)
  - avoid reading freed memory after disabling netlink socket (#1555401)
  - don't disable netlink socket on ENOBUFS error (#1555413)
  - replace ntpstat with shell script using ntpq and supporting chrony (#1592871)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29.el7_8.2
changelog:
  - don't update transmission time on invalid response (CVE-2020-11868)
  - randomize transmit timestamp in client requests (CVE-?, #1813787)


author: Jan Setje-Eilers <jan.setjeeilers@oracle.com> 4.2.6p5-29.0.3.el7_8.2
changelog:
  - Add OL specific patch to allow suppression of real-time-clock updates despite running ntpd [Orabug: 33793295]


author: Tomas Tomecek <ttomecek@redhat.com> - 1:1.7.1-3
changelog:
  - Update License
  - Fix rpmlint warnings
  - Increase verbosity level of tests
  - Disable python 3 build
  - Fix rhbz#987032 (SCL related: wrong shebang)


author: Ade Lee <alee@redhat.com> - 1.0.1-10
changelog:
  - Resolves: rhbz#1117072 -  ppc64le is missing from ExcludeArch
  - reverted the previous change.  ppc64le now removed from ExcludeArch


author: Ade Lee <alee@redhat.com> 1.0.2-1
changelog:
  - Allow passwords to be retrieved post-init phase
  - Fix null termination issue on returned stored passwords


author: Ade Lee <alee@redhat.com> 1.0.3-5.1
changelog:
  - Resolves: rhbz#1503753 - nuxwdog is cutting off long ExeArgs
  - Resolves: rhbz#1534030 - add option to set process uid


author: Dogtag Team <pki-devel@redhat.com> 1.0.5-1
changelog:
  - Resolves: rhbz #1509040 - nuxwdog spec file has outdated
    source for tarballs (dmoluguw)
  - Rebase to upstream nuxwdog 1.0.5-1


author: Edward Leung <edward.leung@oracle.com> - 1.9-2.el7
changelog:
  - Added Build requirement for libuuid-devel (Edward Leung)  
  - Bump release: rebuild with libuuid-devel (Lukas Lemes)


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-6.el7
changelog:
  - vendor: rhel: remove redhat-lsb* dependency (Junxiao Bi)  
  - scandisk: remove unnecessary scansysfs op (Junxiao Bi)


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-8.el7
changelog:
  - BUILDINFO: commit=f0e130273b7eed12385e1d0aa7704b414bceeff0
  - vendor: rhel5: fix build failure (Junxiao Bi)  
  - tunefs.ocfs2: fix double free bug (Junxiao Bi)  
  - fsck.ocfs2: the members of 'o2fsck_state' need to be freed at the end of main() (Jun Piao)  
  - fsck.ocfs2: fix the mistake of clearing valid flag in o2fsck_check_blocks() (Jun Piao)  
  - mkfs.ocfs2: disable append-dio feature by default (Junxiao Bi)  
  - fsck.ocfs2: support append direct io incompat feature (Joseph Qi)  
  - tunefs.ocfs2: support append direct io incompat feature (Joseph Qi)  
  - mkfs.ocfs2: support append direct io incompat feature (Joseph Qi)  
  - mkfs.ocfs2: clean up deadcode in is_cluster_info_valid() (Jun Piao)  
  - fsck.ocfs2: return error if o2fsck_check_journals fails (Joseph Qi)  
  - ocfs2: fix cluster unlocked if journal is replayed (Joseph Qi)  
  - fsck.ocfs2: close ost_fs in case of check superblock fails (Joseph Qi)  
  - mkfs.ocfs2: fix a potential segment fault in main() (Jun Piao)  
  - fsck.ocfs2: clean up useless assignment in dup_insert() (piaojun)  
  - o2info: clean up useless branch in o2info_append_task() (piaojun)  
  - tunefs.ocfs2: fix the parameter misuse of tunefs_dlm_lock (Weiwei Wang)  
  - debugfs.ocfs2: encode 'M' lockname with generation only for sysfile (piaojun)  
  - mkfs.ocfs2: fix memory leak problems in main() (piaojun)  
  - tunefs.ocfs2: fix memory leak problems in tunefs_journal_check() and parse_options() (piaojun)  
  - o2image: fix a memory leak problem in ocfs2_image_free_bitmap() (piaojun)  
  - debugfs.ocfs2: fix NULL pointer dereference risk in dump_dir_entry (Joseph Qi)  
  - o2image: clean up unused variable 'install_flag' in o2image_initialize() (piaojun)  
  - libocfs2: close fd if read fails in create_generation (Joseph Qi)  
  - o2image: Free 'filepath' before return in prompt_image_creation() (Jun Piao)  
  - libocfs2: fix risk of using uninitialized variables (Joseph Qi)  
  - mkfs.ocfs2: fix command line segfault (Valentin Vidic)  
  - debugfs.ocfs2: fix command line segfault (Valentin Vidic)  
  - Update udev rule for newer kernels (Valentin Vidic)  
  - ocfs2-tools: add support for vd devices (Valentin Vidić)  
  - fsck.ocfs2: Free 'ci' in each cycle of for loop in check_journal_walk (Jun Piao)


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-9.el7
changelog:
  - BUILDINFO: commit=8b8e9d3b017f6e9bb23bd137878669831eec0f4d
  - o2cb.service: drop unknown lvalue ExecRestart (Junxiao Bi)


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-12.el7
changelog:
  - ocfs2-tools: to support aarch64 on ol8 (Shuning Zhang)  [Orabug: 30317888] 
  - tunefs.ocfs2: read journal superblock even for online operations (Ashish Samant)  [Orabug: 28804934] 
  - ocfs2-tools: added spec rhel8 for jenkins (Shuning Zhang)  [Orabug: 29292163] 
  - ocfs2-tools: added support for rhel8 rpm package build (Shuning Zhang)  [Orabug: 29292163] 
  - ocfs2-tools: fix the conflict of gcc option in Makefile (Shuning Zhang)  [Orabug: 29292163] 
  - tunefs.ocfs2: fix format security warning (Shuning Zhang)  [Orabug: 29292163] 
  - o2image: fix unknown type name 'loff_t' (Shuning Zhang)  [Orabug: 29292163] 
  - mounted.ocfs2: use <sys/sysmacros.h> include for makedev (Valentin Vidic)  [Orabug: 29292163] 
  - fsck.ocfs2: fix compile error when glibc upgrade (Gang He)  [Orabug: 29292163] 
  - ocfs2-libocfs2: fix unknown type name 'loff_t' (Shuning Zhang)  [Orabug: 29292163]


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-10.el7
changelog:
  - ocfs2-tools: added spec rhel8 for jenkins (Shuning Zhang)  [Orabug: 29292163] 
  - ocfs2-tools: added support for rhel8 rpm package build (Shuning Zhang)  [Orabug: 29292163] 
  - ocfs2-tools: fix the conflict of gcc option in Makefile (Shuning Zhang)  [Orabug: 29292163] 
  - tunefs.ocfs2: fix format security warning (Shuning Zhang)  [Orabug: 29292163] 
  - o2image: fix unknown type name 'loff_t' (Shuning Zhang)  [Orabug: 29292163] 
  - mounted.ocfs2: use <sys/sysmacros.h> include for makedev (Valentin Vidic)  [Orabug: 29292163] 
  - fsck.ocfs2: fix compile error when glibc upgrade (Gang He)  [Orabug: 29292163] 
  - ocfs2-libocfs2: fix unknown type name 'loff_t' (Shuning Zhang)  [Orabug: 29292163]


author: Ashish Samant <ashish.samant@oracle.com> - 1.8.6-11.el7
changelog:
  - tunefs.ocfs2: read journal superblock even for online operations (Ashish
    Samant)  [Orabug: 28804934]


author: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com> - 1.8.6-15.el7
changelog:
  - fsck.ocfs2: Avoid taking all available physical pages for cache (Gautham
    Ananthakrishna)  [Orabug: 34497901]


author: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com> - 1.8.6-17.el7
changelog:
  - libocfs2: fix non-zero value in Next Leaf field in the rightmost leaf metadata
    block (Gautham Ananthakrishna)  [Orabug: 36975814]


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-1
changelog:
  - mkfs.ocfs2: fix default slots number in man doc [Orabug 20443780]
  - o2cb: fix systemd o2cb.service failure [Orabug 21071245]


author: Junxiao Bi <junxiao.bi@oracle.com> - 1.8.6-2.el7
changelog:
  - tools: up to 1.8.6-2 (Junxiao Bi)  
  - ocfs2-tools: mount not showing fully resolved path (Srinivas Eeda)


author: Nalin Dahyabhai <nalin@redhat.com> 0.31.2-2
changelog:
  - add missing requires(post) on killall, which we use to poke the message
    bus daemon to get it to reload its configuration, spotted by rcritten


author: Nalin Dahyabhai <nalin@redhat.com> 0.31.3-2
changelog:
  - use %systemd_postun_with_restart instead of plain old %systemd_postun,
    because we can be restarted in the %postun


author: Nalin Dahyabhai <nalin@redhat.com> 0.31.4-1
changelog:
  - add an [Install] section containing WantedBy=sysinit.target to the systemd
    unit file (#963722), allowing it to actually be "enabled"


author: Nalin Dahyabhai <nalin@redhat.com> 0.31.5-1
changelog:
  - add man(5) pages for the configuration files that we include which get
    included by others, just to be tidy (#884552)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.31.5-4
changelog:
  - correctly check the error returned from getpwnam_r(), so that we don't
    miss an ERANGE error (#1098616, part of #1108398)
  - add a note to pam_oddjob_mkhomedir's manual pointing to where the
    configuration would actually go (part of #1108398)
  - stop overriding the system-wide UMASK default in our default
    oddjobd-mkhomedir.conf file (#995097,#1123860), and stop using its
    proprocessor-input file as a reference, since we're patching it now


author: Jakub Jelen <jjelen@redhat.com> - 3.5-2
changelog:
  - icsf token does not validate data length for verify operation for ECDSA (#1344383)
  - Create lock and log directories from opencryptoki (#1343671)
  - Create log directory with appropriate permissions (#1185421)
  - Added support for rc=8, reasoncode=2028 in icsf token (#1348803)
  - Fix for session handle not set in session issue (#1348804)
  - Fix memory leak in icsf specific code


author: Sinny Kumari <skumari@redhat.com> - 3.5-6
changelog:
  - RHBZ#1371095: coverity scan fixes - memory leak and variable initialization
  - RHBZ#1372188: fix illegal instruction on pkcscca tool


author: Sinny Kumari <skumari@redhat.com> - 3.6.2-1
changelog:
  - Rebase opencryptoki to 3.6.2
  - Remove patches from spec file applied during 3.5 release
  - Resolves: #1391559, #1380784, #1417905


author: Sinny Kumari <skumari@redhat.com> - 3.10.0-1
changelog:
  - Rebase to 3.10.0
  - Resolves: #1519383 - openCryptoki token for EP11 - crucial enhancements for s390x
  - Remove opencryptoki-3.4-fix-root-checks.patch, fixed in 3.9.0
  - Remove opencryptoki-3.2-conditional-manpages.patch, fixed in 3.9.0


author: Than Ngo <than@redhat.com> - 3.11.0-1
changelog:
  - Resolves: #1063763 - opencryptoki tools should inform the user that he is not in pkcs11 group 
  - Resolves: #1641027 - enhanced IBM z14 functions
  - Resolves: #1641026 - support m_*Single functions from ep11 lib
  - Resolves: #1641025 - rebase to 3.11.0
  - Resolves: #1519386 - use CPACF hashes in ep11 token
  - Resolves: #1373833 - lock file directory is %ghost now


author: Than Ngo <than@redhat.com> - 3.11.0-3
changelog:
  - Resolves: #1688891 - C_EncryptInit fails with CKR_KEY_TYPE_INCONSISTENT. on ep11 token when using imported RSA public key


author: Jakub Jelen <jjelen@redhat.com> 3.4.1-3
changelog:
  - Few more issues reported by Coverity
  - Fix Segfault when trace in enabled in api_interface.c
  - Fix the misleading indentation
  - Fix memory leak by closing the lock file descriptor in C_Final


author: Paul Wouters <pwouters@redhat.com> - 1.4.6-2
changelog:
  - Changed conf.xml to reference softhsm at /usr/lib64/pkcs11/libsofthsm2.so
  - Updated Requires: to softhsm >= 2.0.0b1-2


author: Dan Horák <dhorak@redhat.com> - 3.7.0-1
changelog:
  - rebased to 3.7.0 (#1507619)
  - fix test-suite run under root (#1267928)
  - Resolves: #1507619, #1267928


author: Matus Honek <mhonek@redhat.com> - 2.4.44-5
changelog:
  - fix CVE-2017-9287 openldap: Double free vulnerability in servers/slapd/back-mdb/search.c (#1458210)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-10
changelog:
  - Drop update-ppolicy-schema.sh scriptlet's output (#1487857)
  - Fix issues in MozNSS compatibility layer (#1400578)
    + Force write file with fsync to avoid race conditions
    + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix
    + Allow missing cert and key which is a valid usecase
    + Create extraction folder only in /tmp to simplify selinux rules
    + Fix Covscan issues


author: Matus Honek <mhonek@redhat.com> - 2.4.44-11
changelog:
  - MozNSS Compat. Layer: Enable usage of NSS DB with PEM cert/key (#1525485)
    + Fix a possible invalid dereference (covscan)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-12
changelog:
  - MozNSS Compat. Layer: Ensure consistency of a PEM dir before usage (#1516409)
    + Warn just before use of a PIN about key file extraction


author: Matus Honek <mhonek@redhat.com> - 2.4.44-13
changelog:
  - MozNSS Compat. Layer: fix recursive directory deletion (#1516409)
  - MozNSS Compat. Layer: fix PIN disclaimer not always shown (#1516409)
  - MozNSS Compat. Layer: fix incorrect parsing of CACertDir (#1533955)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-17
changelog:
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1575549)
  - Reset OPTIND in libexec/functions for getopts to work in subsequent calls (#1564382)
  - MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1543451)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-18
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1543955)
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1471039)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-22
changelog:
  - Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-23
changelog:
  - Fix CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd (#1895328)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-25
changelog:
  - Fix CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation (#2040539)
  - Fix CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input (#2040538)


author: Matus Honek <mhonek@redhat.com> - 2.4.40-10
changelog:
  - fix: slapd fails to start on boot (#1315958)
  - fix: id_query option is not available after rebasing openldap to 2.4.39 (#1311832)
  - Include sha2 module (#1292568)
  - Compile AllOp together with other overlays (#990893)
  - Missing mutex unlock in accesslog overlay (#1261003)
  - ITS#8337 fix missing olcDbChecksum config attr (#1292590)
  - ITS#8003 fix off-by-one in LDIF length (#1292619)


author: Matus Honek <mhonek@redhat.com> - 2.4.40-12
changelog:
  - fix: slapd crash in do_search (#1316450)
  - fix: Setting olcTLSProtocolMin does not change supported protocols (#1249093)


author: Matus Honek <mhonek@redhat.com> - 2.4.40-13
changelog:
  - fix: Bad log levels in check_password module
  - fix: We can't search expected entries from LDAP server
  - fix: OpenLDAP ciphersuite parsing doesn't match OpenSSL ciphers man page
    + Add TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 to list of ciphers
    + Add DH cipher string parsing option
    + Correct handling kECDH ciphers with aRSA or aECDSA


author: Jan Synáček <jsynacek@redhat.com> - 0.4.2-3
changelog:
  - Correctly fill FSCreationClassName and FSName
  - Replace thread-unsafe functions
  - Resolves: rhbz#1042843 rhbz#1050841


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.4.2-4
changelog:
  - Fix service methods report success before the action is actually finished
  - Add description to service methods
  - Fan provider made thread-safe
  - Resolves: rhbz#1049819 rhbz#1049816 rhbz#1031650


author: Radek Novacek <rnovacek@redhat.com> 0.2.2-3
changelog:
  - Fix LMI_IPElementSettingData refering bridging master setting instead of slave setting
  - Support connections that has interface-name option specified
  - Fix that bond slave names are not going above 2
  - allow virtual device name change for bonds
  - Resolves: #1064215, #1064324, #1064280, #1064334


author: Radek Novacek <rnovacek@redhat.com> 0.2.2-4
changelog:
  - Fix IPv6Type property of LMI_IPAssignmentSettingData class for DHCPv6
  - React to IP configuration change
  - Resolves: #1066853, #1069169


author: Jan Safranek <jsafrane@redhat.com> - 0.7.0-8
changelog:
  - Added dist tag to Release.
  - Removed unimplemented classed from MOF files (#1042743).
  - Fixed LMI_MDRAIDElementCapabilities.GetInstance call (#1043932).


author: Jan Safranek <jsafrane@redhat.com> - 0.7.1-2
changelog:
  - Fix CreateOrModifyStoragePool exception (#1054144).
  - Fixed reloading of blivet after mount (#1054177).


author: Jan Safranek <jsafrane@redhat.com> - 0.7.1-3
changelog:
  - The provider now removes physical volume metadata from all member devices
    when a volume group is destroyed (#1057692).
  - Fixed listing of mounts of MD RAID volumes (#1057666).


author: Peter Hatina <phatina@redhat.com> - 0.9-21
changelog:
  - CWD is by default appended in search path
  - introduced CLI option --cwd-first-in-path which prepends
    CWD in search path
  - Related: #1072252


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 1.5-3
changelog:
  - Drop obex_test program, as it is just for testing purposes
    and has some problems with multiple stack overflows etc.
    Resolves: #521663


author: Tomas Hozza <thozza@redhat.com> - 1.5-6
changelog:
  - changing not working Source0 URL and some minor changes in %prep
  - new source archive openobex-1.5.0-Source.zip


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-2.20170227git
changelog:
  - Add support for CardOS 5.3
  - Fix coverity issues
  - Provide simple tool to swith PKCS#11 library in NSS DB


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-6.20170227git
changelog:
  - Use label from certificate DN if there is none (#1448555)
  - Use Cardholder name in the token label (#1449740)
  - Avoid infinite loop when reading CAC cards (#1473335)
  - Workaround for CAC Alt tokens (#1473418)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-8.20170227git
changelog:
  - Copy labels from certificate (#1448555)
  - Avoid infinite loop in CAC driver when reading non-CAC cards (#1473335)
  - Properly parse Simple TLV structures in CAC driver (#1473418)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-9.20170227git
changelog:
  - make ECPoint behavior standards compliant by default (#1562572)
  - allow mechanism to be specified in hexadecimal (#1562572)
  - Disable pinpad by default (#1547117, #1547744)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-1
changelog:
  - Rebase to new upstream release (#1656791)
    - Add Support for HID Crescendo 144K (#1612372)
    - Add Support for CAC Alt tokens (#1645581)
    - Fix usage detection from certificates (#1672898)
    - Fix security issues:
      - CVE-2018-16391
      - CVE-2018-16392
      - CVE-2018-16393
      - CVE-2018-16418
      - CVE-2018-16419
      - CVE-2018-16420
      - CVE-2018-16421
      - CVE-2018-16422
      - CVE-2018-16423
      - CVE-2018-16426
      - CVE-2018-16427


author: Martin Preisler <mpreisle@redhat.com> - 1.2.12-1
changelog:
  - Upgrade to the latest upstream release
  - improved HTML report by referencing links
  - fixed validity errors in ARF files
  - fixed CVE parsing
  - fixed injecting xccdf:check-content-ref references in ARF results
  - fixed oscap-docker incompliance reporting (#1387248)
  - fixed oscap-docker man page (#1387166)


author: Martin Preisler <mpreisle@redhat.com> - 1.2.13-1
changelog:
  - Upgrade to the latest upstream release
  - Added --thin-results CLI override to oscap xccdf eval
  - Added --without-syschar CLI override to oscap xccdf eval
  - Remediations are not filtered by applicability
  - Fixed segmentation faults in XCCDF and OVAL processing
  - Added a warning on generating an ARF from XCCDF 1.1


author: Jan Černý <jcerny@redhat.com> - 1.2.14-1
changelog:
  - Upgrade to the latest upstream release
  - Detailed information about ARF files in 'oscap info'
  - Generating remediation scripts from ARF
  - HTML report UX improvements
  - Fixed CPE dictionary to identify RHEVH as RHEL7 (#1420038)
  - Fixed systemd probes crashes inside containers (#1431186)
  - Fixed output on terminals with white background (#1365911)
  - Error handling in oscap-vm (#1391754)
  - Fixed SCE stderr stalling (#1420811)
  - Fixed absolute filepath parsing in OVAL (#1312831, #1312824)
  - Fixed segmentation faults in RPM probes (#1414303, #1414312)
  - Fixed missing header in result-oriented Ansible remediations


author: Martin Preisler <mpreisle@redhat.com> - 1.2.14-2
changelog:
  - RPM probes to return not applicable on non-rpm systems (#1447629)
  - fixed sysctl tests on s390x architecture (#1447649)
  - Revert warning by default in oscap tool, our message categories are not ready for it (#1447341)


author: EL Errata <el-errata_ww@oracle.com> - 1.2.14-2.0.1
changelog:
  - [Orabug 24285365] fix linux family check for Oracle in cpe oval configuration file
  - [Orabug 22143829] add Oracle Linux product


author: Jan Černý <jcerny@redhat.com> - 1.2.15-1
changelog:
  - upgrade to the latest upstream release
  - short profile names can be used instead of long IDs
  - new option --rule allows to evaluate only a single rule
  - new option --fix-type in "oscap xccdf generate fix" allows choosing
    remediation script type without typing long URL
  - "oscap info" shows profile titles
  - OVAL details in HTML report are easier to read
  - HTML report is smaller because unselected rules are removed
  - HTML report supports NIST 800-171 and CJIS
  - remediation scripts contain headers with useful information (#1439813)
  - remediation scripts report progress when they run
  - basic support for Oracle Linux (CPEs, runlevels)
  - remediation scripts can be generated from datastreams that contain
    multiple XCCDF benchmarks
  - basic support for OVAL 5.11.2 (only schemas, no features)
  - enabled offline RPM database in rpminfo probe
  - added Fedora 28 CPE
  - fixed oscap-docker with Docker >= 2.0
  - fixed behavior of sysctl probe to be consistent with sysctl tool
  - fixed generating remediation scripts
  - severity of tailored rules is not discarded
  - fixed errors in RPM probes initialization
  - oscap-docker shows all warnings reported by oscap
  - fixed pkgconfig file


author: Matěj Týč <matyc@redhat.com> - 1.2.16-1
changelog:
  - upgrade to the latest upstream release
  - moved oscap-chroot to openscap-scanner because it's a thin wrapper script with no dependencies


author: Matěj Týč <matyc@redhat.com> - 1.2.16-2
changelog:
  - moved oscap-docker to newly created openscap-containers.
  - moved man of oscap-chroot to oscap-scanner.


author: Matěj Týč <matyc@redhat.com> - 1.2.17-6
changelog:
  - Enabled the virtual '(all)' profile support for the scanner (RHBZ#1769272).
  - Enabled the '(all)' profile support for oscap-ssh (RHBZ#1769272).


author: Jan Černý <jcerny@redhat.com> - 1.2.17-10
changelog:
  - Fix segfault in systemdunitdependency probe (RHBZ#1478285)
  - Build and ship HTML manual (RHBZ#1465661)
  - Fix oscap-ssh with --sudo (RHBZ#1803114)
  - Change category of verbose message (RHBZ#1640522)
  - Fix segfault in CVRF module (RHBZ#1642283)


author: David Sloboda <david.x.sloboda@oracle.com> - 1.2.17-11.0.1
changelog:
  - Remove subpkg openscap-containers and its deps [Orabug: 30525588]
  - Added bug30138845-remove-upstream-references.patch [Orabug: 30138845]
  - Obsolete openscan-containers < 1.2.17-9.0.1 for openscap-utils [Orabug: 31126771]


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 1.2.17-13.0.1
changelog:
  - Add OL8 CPE name to OpenSCAP dictionary [Orabug: 31956860]
  - Remove subpkg openscap-containers and its deps [Orabug: 30525588]
  - Added bug30138845-remove-upstream-references.patch [Orabug: 30138845]
  - Obsolete openscan-containers < 1.2.17-9.0.1 for openscap-utils [Orabug: 31126771]


author: Marcus Burghardt <maburgha@redhat.com> - 1.2.17-14
changelog:
  - Fix memory leaks in probe-api (RHBZ#1861793)
  - Prevent duplicate variables in Ansible Playbooks (RHBZ#1944683)
  - Fix trailing whitespace in Ansible Playbooks
  - Fix inconsistent result from security_patches_up_to_date (RHBZ#1858502)
  - Fix multiple segfaults and broken test (RHBZ#1911999)
  - Improve --stig-viewer output when there is no 1:1 connection between rules
  - Lower memory limits and improve their checking (RHBZ#1932833)


author: EL Errata <el-errata_ww@oracle.com> - 1.2.17-15.0.1
changelog:
  - Fix for image tests failing with explicit entrypoint [Orabug: 33993652]
  - Replace argument --disable-atomic with --enable-atomic [JIRA: OLDIS-82]
  - Change logic to silently use disabled atomic by default [JIRA: OLDIS-82]
  - Backport non-atomic oscap-docker functionality [JIRA: OLDIS-82]
  - Add support for Oracle Linux container-cve for oscap-docker [JIRA: OLDIS-82]
  - Adapt some new code to python2 [JIRA: OLDIS-82]
  - Enable back openscap-containers [JIRA: OLDIS-82]
  - Add OL8 CPE name to OpenSCAP dictionary [Orabug: 31956860]
  - Remove subpkg openscap-containers and its deps [Orabug: 30525588]
  - Added bug30138845-remove-upstream-references.patch [Orabug: 30138845]
  - Obsolete openscan-containers < 1.2.17-9.0.1 for openscap-utils [Orabug: 31126771]


author: Matěj Týč <matyc@redhat.com> - 1.2.17-1
changelog:
  - Rebased to the 1.2.17 upstream release (#1564900).
  - Fixed the offline scanning (#1547107, #1556988).
  - HTML Guide user experience improvements.
  - New options in HTML report "Group By" menu.
  - oscap-ssh supports --oval-results.
  - For more news, see https://github.com/OpenSCAP/openscap/releases/tag/1.2.17


author: Jan Černý <jcerny@redhat.com> - 1.2.17-3
changelog:
  - Fix unwanted recursion into mounted remote filesystems (#1655943)
  - Evaluate SCAP 1.3 datastreams without downloading remote data (#1709423)


author: EL Errata <el-errata_ww@oracle.com> - 1.2.17-9.0.1
changelog:
  - Remove subpkg openscap-containers and its deps [Orabug: 30525588]
  - Added bug30138845-remove-upstream-references.patch [Orabug: 30138845]


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1:2.0.0-8
changelog:
  - Fix a heap-based buffer overflow vulnerability leading to
    remote code execution, CVE-2019-5544
    Resolves: #1781701


author: Doug Ledford <dledford@redhat.com> - 3.3.15-2
changelog:
  - More tweaks to systemd setup (proper scriptlets now)
  - More tweaks to old sysv init script support (fix Requires)


author: Doug Ledford <dledford@redhat.com> - 3.3.15-5
changelog:
  - Drop the old sysv init script
  - Fix opensm-launch to restart opensm in a loop.  This works around the
    fact that systemd starts opensm so early that we very well might not have
    sync on the link yet.  Without the physical link being up, opensm exits
    immediately.  This way opensm will get restarted every 30 seconds until
    sync is active on the link or until the opensm service is stopped.
  - Always install the newly generated opensm-%{version}.conf as opensm.conf
  - Make the launch work properly in the event that no GUIDs are set and
    there are no numbered config files


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-1 + 0.10.3-1
changelog:
  - Rebase to openssh 7.4 and pam_ssh_agent_auth 0.10.3 (#1341754)
  - detach -cavs subpackage
  - enable seccomp filter for sandboxed child


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-2 + 0.10.3-1
changelog:
  - Fix coverity scan results
  - Adjust FIPS algorithms list (#1420910)
  - Revert problematic feature for chroot(#1418062)
  - Fix CBC weakness in released OpenSSH 7.5


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-3 + 0.10.3-1
changelog:
  - Do not completely disable SHA-1 key exchange methods in FIPS (#1324493)
  - Remove wrong coverity patches


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-5 + 0.10.3-1
changelog:
  - Fix the default key exchange proposal in FIPS mode (#1438414)
  - Remove another wrong coverity chunk to unbreak gsskex (#1438414)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
changelog:
  - Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
  - Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
  - Do not segfault in audit code during cleanup (#1488083)
  - Add WinSCP 5.10+ compatibility (#1496808)
  - Clatch between ClientAlive and rekeying timeouts (#1480510)
  - Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
  - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
changelog:
  - invalidate supplemental group cache used by temporarily_use_uid()
    when the target uid differs (#1583735)


author: Herbert van den Bergh <herbert.van.den.bergh@oracle.com> - 7.4p1-21.0.1
changelog:
  - enlarge format buffer size for certificate serial
    number so the log message can record any 64-bit integer without
    truncation (openssh bz#3012) [Orabug: 30448895]


author: Kaylin Devchand <kaylin.devchand@oracle.com> - 7.4p1-23.0.3
changelog:
  - add KEX_INITIAL flag [Orabug: 36160445] 
  - implement "strict key exchange" [CVE-2023-48795][Orabug: 36160445]


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-50
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-52
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-55
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-56
changelog:
  - fix 1-byte memory leak in pkcs12 parse (#1312112)
  - document some options of the speed command (#1312110)
  - fix high-precision timestamps in timestamping authority
  - enable SCTP support in DTLS 
  - use correct digest when exporting keying material in TLS1.2 (#1289620)
  - fix CVE-2016-0799 - memory issues in BIO_printf
  - add support for setting Kerberos service and keytab in
    s_server and s_client


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-57
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-60
changelog:
  - fix CVE-2016-2177 - possible integer overflow
  - fix CVE-2016-2178 - non-constant time DSA operations
  - fix CVE-2016-2179 - further DoS issues in DTLS
  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
  - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
  - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
  - fix CVE-2016-6304 - unbound memory growth with OCSP status request
  - fix CVE-2016-6306 - certificate message OOB reads
  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    112 bit effective strength


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-4
changelog:
  - add support for additional STARTTLS protocols to s_client
    original backported patch by Robert Scheck (#1396209)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
changelog:
  - fix CVE-2017-3737 - incorrect handling of fatal error state
  - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
changelog:
  - add S390x assembler updates
  - make CA name list comparison function case sensitive (#1548401)
  - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
  - fix CVE-2018-0732 - large prime DH DoS of TLS client
  - fix CVE-2018-0737 - RSA key generation cache timing vulnerability
  - fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
  - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
  - fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16.1
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 - EC signature local timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
    timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
  - fix CVE-2018-0734 - DSA signature local timing side channel
  - fix CVE-2019-1559 - 0-byte record padding oracle
  - close the RSA decryption One & done EM side channel (#1619558)


author: Ilya Okomin <ilya.okomin@oracle.com> 1.0.2k-21.0.1
changelog:
  - Fix DH self-test to add shared secret comparison [Orabug: 32467026]
  - Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467059]
  - Add TLS KDF self-test [Orabug: 32467193]
  - Add EC keys pairwise consistency test [Orabug: 32467059]


author: Ilya Okomin <ilya.okomin@oracle.com> 1.0.2k-21.0.3
changelog:
  - Revert "Fix DH self-test to add shared secret comparison" [Orabug: 32849192]
  - Revert "Add DH support changes for SP 800-56A rev3 requirements" [Orabug: 32849192]
  - Revert "Add TLS KDF self-test" [Orabug: 32849192]
  - Revert "Add EC keys pairwise consistency test" [Orabug: 32849192]


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2j-2
changelog:
  - deprecate and disable verification of insecure hash algorithms
  - add support for /etc/pki/tls/legacy-settings also for minimum DH length
    accepted by SSL client
  - compare the encrypt and tweak key in XTS as required by FIPS


author: William Cohen <wcohen@redhat.com> - 0.9.9-17
changelog:
  - Define some  Intel broadwell default unit masks by names
  - Add support for Harrisonville (Denverton SoC)
  - Add support for Skylake-SP server
  - Add support for Kabylake-U/Y
  - Add support for Kabylake-H/S
  - Make Nehalem, Westmere, and Haswell event names unique.


author: William Cohen <wcohen@redhat.com> - 0.9.9-22
changelog:
  - Update ppc64/ppc64le support. rhbz1385007
  - Add recognition check for POWER8NV and POWER8NVL. rhbz1426426


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-3
changelog:
  - Use https for OCI yum mirror repositories  [OraBug: 31220677]
  - Use IMDS v2 for OCI.
  - Updated repository name to fix duplicate repository name [Orabug: 30425667]


author: Jingdong Lu <jingdong.lu@oracle.com> - 70.0.3-4.0.3
changelog:
  - Replace kde-splash/RHEL7/Preview.png
  - Update anaconda backgrounds with Oracle images
  - Restore anaconda banners


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 70.0.3-4.0.9
changelog:
  - Remove orcl_linux_em12c_750x120.png as it has been replaced with generic image [bug 27681288]
  - Regenerate backgrounds/*.jpg from backgrounds/default.png to remove black dot [bug 21375206]


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 70.7.0-1.0.2
changelog:
  - Replaced with Oracle images:
        fedora/fedora_logo.svg
        fedora/fedora_darkbackground.svg
        icons/hicolor/scalable/apps/xfce4_xicon1.svg
        pixmaps/fedora-logo-sprite.svg
  - Added:
        icons/hicolor/22x22/apps/system-logo-icon.png
        icons/hicolor/256x256/apps/system-logo-icon.png
  - Removed unneeded subdirectories in anaconda.


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 70.7.0-1.0.3
changelog:
  - Pickup change to anaconda/Makefile from 70.0.3 to make sure rnotes images are picked up
    [Orabug: 30096672]


author: Alan Steinberg <alan.steinberg@oracle.com> - 70.7.0-1.0.7
changelog:
  - Fixe incorrect logo on the GDM login screen [Orabug: 31598155]
  - Added missing wallpapers from settings app [Orabug: 31598176]


author: Keshav Sharma <keshav.sharama@oracle.com> 1.0-6
changelog:
  - Added olcne version 1.2 repository [OraBug: 32201021]
  - Enable olcne version 1.1 repository by default [OraBug: 32201021]


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-4
changelog:
  - Enhance logic to detect oci instance [ OraBug 29241080]
  - Do not overwrite /etc/yun/vars/ociregion file.
  - Exit ol_yum_configure.sh if another yum command running


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-13
changelog:
  - Added OL7 Beta repositories [OraBug: 31482423]
  - Enable UEKR6 and disable UEKR5 repositories [OraBug: 31482423]


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-13.1
changelog:
  - Enable UEKR6 and disable UEKR5 repositories [OraBug: 31482423]
  - Remove beta repositories
  - Added 7.9 repositories [OraBug: 31957552]


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-14
changelog:
  - Add ocidomain as yum variable [ OraBug: 31840501]
  - Added 7.9 repositories [OraBug: 31957552]
  - Enable UEKR6 and disable UEKR5 repositories [OraBug: 31482423]


author: Keshav Sharma <keshav.sharma@oracle.com> 1.0-17
changelog:
  - Added Oracle Linux 7.8 security validation repository.
  - Fixed architecture for ol7_ociyum_config repository [OraBug: 32754445]


author: Wim Taymans <wtaymans@redhat.com> - 0.4.22-2
changelog:
  - Don't run tests during build
  - add new source
  - remove old patches, add new patch
  - Resolves: #1174391


author: Wim Taymans <wtaymans@redhat.com> - 0.4.22-5
changelog:
  - Run backup functions on s390x instead of emulation
  - Fix load of parameters smaller than 64 bits
  - Related: rhbz#1249506


author: Jan Grulich <jgrulich@redhat.com> - 1:0.20.0-10
changelog:
  - Add check for user UID when connecting to pipe (#1005261)
  - Add length check in stunEncodeMessage (#1005218)
  - Add sign and overflow checks (#1005219)
  - Remove hardcoded username and password (#1005216)


author: rmarshall@redhat.com - 1.58-6
changelog:
  - Adding handling to skip probing extended dos partitions
    Resolves: rhbz#1322957
  - Improve Windows detection for dual boot and support Windows 10
    Resolves: rhbz#1322956
  - Suppress non-blocking dmraid sector size warning message
    Resolves: rhbz#1198918


author: rmarshall@redhat.com - 1.58-7
changelog:
  - Do not resolve device mapper links when generating stanzas
    for bootloader.
    Resolves: rhbz#1300262


author: rmarshall@redhat.com - 1.58-8
changelog:
  - Resolve some coverity concerns with how the previous patch detected
    whether or not a partition was a device mapper device.
    Related: rhbz#1300262


author: rmarshall@redhat.com - 1.58-9
changelog:
  - Fix regular expression that missed a corner case when detecting
    extended dos partitions.
    Resolves: rhbz#1322957


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.7-6
changelog:
  - Specify the name of the help content file
    Resolves: rhbz#1254884
  - Skip files unrecognized by the 'oscap info' command
    Resolves: rhbz#1255075
  - Only allow DS and XCCDF ID selection if it makes sense
    Resolves: rhbz#1254876


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.7-9
changelog:
  - Use the System hub category provided by Anaconda
    Resolves: rhbz#1269211
  - Wait for Anaconda to settle before evaluation
    Resolves: rhbz#1265552
  - Make the changes overview scrollable and smaller
    Related: rhbz#1263582
  - Make the list of profiles scrollable
    Resolves: rhbz#1263582
  - Do not try to create a single file multiple times
    Related: rhbz#1263315
  - Avoid crashes on extraction errors
    Resolves: rhbz#1263315
  - Disable GPG checks when installing content to the system
    Resolves: rhbz#1263216
  - Allow fixing root password in graphical installations
    Resolves: rhbz#1265116
  - Enforce the minimal root password length
    Resolves: rhbz#1238281
  - Just report misconfiguration instead of crashing in text mode
    Resolves: rhbz#1263207
  - Do not verify SSL if inst.noverifyssl was given
    Resolves: rhbz#1263257
  - Also catch data_fetch.DataFetchError when trying to get content
    Resolves: rhbz#1263239
  - Use new method signature with payload class
    Related: rhbz#1288636


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.7-11
changelog:
  - Don't require blank stderr when running the oscap tool
    Resolves: rhbz#1360765
  - Beware of the invalid profiles
    Resolves: rhbz#1365130
  - Properly set the seen property for root passwords
    Resolves: rhbz#1357603


author: Martin Preisler <mpreisle@redhat.com> - 0.7-13
changelog:
  - Avoid long delay before a GeoIP related timeout in case internet is not available
    Resolves: rhbz#1379479


author: Watson Sato <wsato@redhat.com> - 0.8-2
changelog:
  - Add japanese translation
  - Update other translations
    Resolves: rhbz#1481190
  - Fix selection of RHEL datastream
    Resolves: rhbz#1520358


author: Watson Yuuma Sato <wsato@redhat.com> - 0.9-1
changelog:
  - Rebase to the upstream version 0.9
  - Drop patch that fixed selection of RHEL Alternate Architecture datastream
    Resolves: rhbz#1564903
  - Update project URL
    Resolves: rhbz#1502379


author: Jan Černý <jcerny@redhat.com> - 0.9-3
changelog:
  - Enable translation of title 'SECURITY POLICY' at Installation Summary screen
    Resolves: rhbz#1543318


author: EL Errata <el-errata_ww@oracle.com> - 20170423-2.0.1
changelog:
  - Update Oracle Linux OS info [bug 26135475]
  - Add Oracle Linux OS info [bug 18501468]
  - Pack ol.xml into tarball [bug 20410527]
  - Update libosinfo to add all Oracle linux OS release/updates information [bug 26135475]


author: Felipe Borges <feborges@redhat.com> - 20170813-1
changelog:
  - Update source URL to Pagure
   - Drop the rhel-7.4 data patch
   - Update to new release
   - Resolves: rhbz#1479731


author: EL Errata <el-errata_ww@oracle.com> - 20170813-6.0.1
changelog:
  - add win2016 support in 'osinfo-query os' [bug 27210429]
  - osinfo-query command error with OL7U5 [bug 27700001]
  - Update OL7U5 osinfo-db to add OL7U5 release support [bug 27700063]
  - add ol7.4 os info [bug 27175558]
  - Update Oracle Linux OS info [bug 26135475]
  - Add Oracle Linux OS info [bug 18501468]
  - Pack ol.xml into tarball [bug 20410527]
  - Update libosinfo to add all Oracle linux OS release/updates information [bug 26135475]


author: EL Errata <el-errata_ww@oracle.com> - 20180531-1.0.1
changelog:
  - add ol7.6 os info
  - add ol5 ol6 ol7 os type [orabug 27932947]
  - add win2016 support in 'osinfo-query os' [bug 27210429]
  - osinfo-query command error with OL7U5 [bug 27700001]
  - Update OL7U5 osinfo-db to add OL7U5 release support [bug 27700063]
  - add ol7.4 os info [bug 27175558]
  - Update Oracle Linux OS info [bug 26135475]
  - Add Oracle Linux OS info [bug 18501468]
  - Pack ol.xml into tarball [bug 20410527]
  - Update libosinfo to add all Oracle linux OS release/updates information [bug 26135475]


author: Fabiano Fidêncio <fidencio@redhat.com> - 20190805-1
changelog:
  - Resolves: rhbz#1737367 - Update to latest upstream release
  - Resolves: rhbz#1737369 - Add 7.8 to the osinfo-db which will be used on 7.8


author: Fabiano Fidêncio <fidencio@redhat.com> - 20190805-2
changelog:
  - Resolves: rhbz#1750807 - Fedora/RHEL/CentOS JeOS kickstart files for
                             unattended installation are broken


author: Fabiano Fidêncio <fidencio@redhat.com< - 20200529-1
changelog:
  - Resolves: rhbz#1839905 - [RHEL7.9] "virt-install --os-variant rhel7.9"i
                             fails with error
  - Resolves: rhbz##1840085 - Rebase to the latest upstream release


author: EL Errata <el-errata_ww@oracle.com> - 20200529-1.0.1
changelog:
  - Added Oracle OS info for OL7.9.
  - Update Oracle os info files - Add OL8.2 template [Orabug: 31395425]
  - Update Oracle os info files - Add OL8.1 template [Orabug: 30596927]
  - Add Oracle os info files


author: Pravin Satute <psatute AT redhat DOT com> - 2.1-1
changelog:
  - Resolves: rhbz#1284772 - Upstream new release with ttfautohint
  - Changed url to https://github.com/RedHatBrand/overpass/, https://overpassfont.org looks dead.
  - Add Light variant font.
  - Add metainfo file to show this font in gnome-software.


author: Rex Dieter <rdieter@fedoraproject.org> 1.1.1-2
changelog:
  - workaround anaconda main menu not visible in F18 Beta TC2 KDE Live (#864058)
  - -DENABLE_INNER_SHADOWS_HACK=0


author: Stef Walter <stefw@redhat.com> - 0.20.7-1
changelog:
  - Update to upstream stable 0.20.7 release
  - Expose pkcs11x.h header and defines for attached extensions rhbz#1142305


author: Daiki Ueno <dueno@redhat.com> - 0.23.5-3
changelog:
  - Avoid reference to thread-unsafe strerror rhbz#1378947
  - Fix PKCS#11 OAEP interface rhbz#1191209
  - Update documentation to follow RFC7512 rhbz#1165977


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-4
changelog:
  - Add support for container bundles
  - Treat systemd reloading state as monitor success
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1436696


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-5
changelog:
  - Keep man pages compressed
  - Bugfixes for container bundles
  - Resolves: rhbz#1410886
  - Resolves: rhbz#1432722


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-7
changelog:
  - Avoid fencing old DC if it is shutting down while another node is joining
  - Improve crmd's handling of repeated fencing failures
  - Correct behavior when guest created by bundle has a node attribute
  - Show Red Hat bugzilla URL rather than upstream when generating cluster report
  - Resolves: rhbz#1430112
  - Resolves: rhbz#1432722


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-9
changelog:
  - Allow cleanup of guest nodes when guest is unmanaged
  - Allow bundles to run on Pacemaker Remote nodes
  - Handle slow IPC clients better
  - Update crmd throttle information when CPUs are hot-plugged in
  - Order pacemaker systemd unit after resource-agents-deps target
  - Resolves: rhbz#1303742
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1435067
  - Resolves: rhbz#1444728
  - Resolves: rhbz#1446669


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.16-10
changelog:
  - Fix issues when running bundles on Pacemaker Remote nodes
  - Reap orphaned processes when running Pacemaker Remote as pid 1
  - Order remote actions after remote connection recovery
    (fixes regression in RHEL 7.3)
  - Avoid local resource manager daemon (lrmd) crash when an
    in-flight systemd operation is cancelled
  - Resolves: rhbz#1432722
  - Resolves: rhbz#1441603
  - Resolves: rhbz#1448772
  - Resolves: rhbz#1451170


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-4
changelog:
  - Rebase to upstream 1a4ef7d180e77bcd6423f342d62e05e516c4e852 (1.1.18-rc4)
  - Resolves: rhbz#1381754
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1499217
  - Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-5
changelog:
  - Properly clean up primitive inside bundle
  - Scalability improvements
  - Resolves: rhbz#1499217
  - Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-6
changelog:
  - Rebase to upstream 2b07d5c5a908998891c3317faa30328c108d3a91 (1.1.18)
  - If on-fail=ignore, migration-threshold should also be ignored
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1507344


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-7
changelog:
  - Avoid node attribute write delay when corosync.conf has only IP addresses
  - Fix regressions in "pcs resource cleanup" behavior
  - Restore ordering of unfencing before fence device starts
  - Ensure --wait options work when bundles are in use
  - Fix possible invalid transition with bundle ordering constraints
  - Resolves: rhbz#1454960
  - Resolves: rhbz#1508350
  - Resolves: rhbz#1517796
  - Resolves: rhbz#1519812
  - Resolves: rhbz#1522822


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-10
changelog:
  - Always trigger transition when quorum changes
  - Match clone names correctly with crm_resource --cleanup
  - Fix pcs resource --wait timeout when bundles are used
  - Observe colocation constraints correctly with bundles in master role
  - Resolves: rhbz#1464068
  - Resolves: rhbz#1508350
  - Resolves: rhbz#1519812
  - Resolves: rhbz#1527072


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-11.1
changelog:
  - Do not schedule notifications for unrunnable actions
  - Do not expire remote failures if fencing is pending
  - Do not consider attribute order difference as CIB change in crm_diff
  - Resolves: rhbz#1563345
  - Resolves: rhbz#1566533
  - Resolves: rhbz#1568720


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-13
changelog:
  - Pull latest upstream 1.1 branch fixes
  - Resolves: rhbz#1478451
  - Resolves: rhbz#1501505
  - Resolves: rhbz#1514492
  - Resolves: rhbz#1550829
  - Resolves: rhbz#1564536
  - Resolves: rhbz#1576148
  - Resolves: rhbz#1577300


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-1
changelog:
  - Rebase to upstream 29ac12ad21f73524f69c0580798e07cdf1fe3fa0 (1.1.19-rc1)
  - Allow crm_node to work on Pacemaker Remote nodes
  - Implement new --validate option to stonith_admin
  - Support .path, .mount, and .timer systemd unit files as resources
  - Handle INFINITY fail count correctly in crm_failcount
  - Resolves: rhbz#1374175
  - Resolves: rhbz#1434936
  - Resolves: rhbz#1562255
  - Resolves: rhbz#1590483
  - Resolves: rhbz#1591045


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-2
changelog:
  - Ensure resource agent meta-data actions can get local node name
  - Do not record pending clone notifications in CIB
  - Resolves: rhbz#1374175
  - Resolves: rhbz#1570130


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-4
changelog:
  - Fix srpm build on ppc64le systems with libservicelog-devel, OpenIPMI-devel
  - Resolves: rhbz#1478451


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-7
changelog:
  - Shutdown corosync locally if fenced
  - Count start failure once
  - Resolves: rhbz#1448221
  - Resolves: rhbz#1549576


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-8.1
changelog:
  - Route remote clone notifications through correct cluster node
  - Allow clean-up of managed guest nodes and bundle nodes
  - Allow use of guest nodes and bundles in clusters with sbd fencing
  - Resolves: rhbz#1646347
  - Resolves: rhbz#1646350
  - Resolves: rhbz#1646872


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-8.3
changelog:
  - Fix regression in crm_resource --refresh
  - Order resource moves after remote connection starts
  - Resolves: rhbz#1664242
  - Resolves: rhbz#1664243


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-1
changelog:
  - pcs status now shows when a standby node still has active resources
  - Allow clean-up of guest nodes and bundles without unmanaging first
  - pcs status now shows pending and failed fence actions by default
  - Improve pcs status display when disconnected from cluster
  - Ensure node attributes are recorded if attrd writer is shutting down
  - Synchronize fencing history across all nodes
  - Add stonith_admin option to clear fencing history
  - Don't schedule unneeded bundle actions when connection is on different node
  - Allow use of sbd in clusters with guest nodes and bundles
  - Schedule bundle clone notifications correctly when connection is moving
  - Rebase on upstream 1.1.20-rc1 version
  - Avoid unneeded resource restarts when remote connection fails to start
  - Allow crm_resource --move to work when a previous move had a lifetime
  - Wait for all replies when refreshing a resource
  - Don't schedule clone notifications for a stopped bundle
  - Allow option to crm_resource --clear to clear only expired constraints
  - Fix result reporting when cleanup is done while an operation is in-flight
  - Resolves: rhbz#1419548
  - Resolves: rhbz#1448467
  - Resolves: rhbz#1461964
  - Resolves: rhbz#1486869
  - Resolves: rhbz#1535221
  - Resolves: rhbz#1555938
  - Resolves: rhbz#1595422
  - Resolves: rhbz#1627948
  - Resolves: rhbz#1638593
  - Resolves: rhbz#1644076
  - Resolves: rhbz#1644864
  - Resolves: rhbz#1648507
  - Resolves: rhbz#1648620
  - Resolves: rhbz#1652053
  - Resolves: rhbz#1652752
  - Resolves: rhbz#1658650
  - Resolves: rhbz#1665343


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-2
changelog:
  - Assume unprivileged ACL if unable to get user information from host
  - Delay 2 seconds before re-attempting a failed node attribute write
  - SNMP alert sample script now sends all OIDs with every alert
  - Recover dependent resources correctly with asymmetric ordering
  - Rebase on upstream 1.1.20 final version
  - Resolves: rhbz#1596125
  - Resolves: rhbz#1597695
  - Resolves: rhbz#1608979
  - Resolves: rhbz#1628966
  - Resolves: rhbz#1644864


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-3
changelog:
  - Support more than 64KB of fence agent output
  - Avoid unnecessary recovery of group member
  - Improve IPC clients' authentication of servers (CVE-2018-16877)
  - Improve pacemakerd authentication of running subdaemons (CVE-2018-16878)
  - Fix use-after-free with potential information disclosure (CVE-2019-3885)
  - Resolves: rhbz#1549366
  - Resolves: rhbz#1609453
  - Resolves: rhbz#1694556
  - Resolves: rhbz#1694559
  - Resolves: rhbz#1694907


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-4
changelog:
  - Update security patches
  - Resolves: rhbz#1694556
  - Resolves: rhbz#1694559
  - Resolves: rhbz#1694907


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.21-1
changelog:
  - Recover from quiesced DC disk
  - Avoid timeouts and excessive stonithd CPU usage at start-up in large clusters
  - Default serialized order constraints to symmetrical=false
  - Avoid fence loops due to incorrect Pacemaker Remote ordering
  - Default concurrent-fencing to true
  - Harden GnuTLS priorities
  - Rebase on upstream 1.1.21 final version
  - Resolves: rhbz#1596125
  - Resolves: rhbz#1625671
  - Resolves: rhbz#1672225
  - Resolves: rhbz#1704870
  - Resolves: rhbz#1710422
  - Resolves: rhbz#1727280
  - Resolves: rhbz#1731189


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.21-3
changelog:
  - Avoid invalid transition when guest node's host is unclean but can't be fenced
  - Resolves: rhbz#1755659


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.22-1
changelog:
  - Show correct disabled resource count in status display
  - Run-time option for Pacemaker Remote bind address
  - Avoid restart loop when migration is left dangling
  - Improve help for clean-up option
  - Do not overweight group colocation scores
  - Rebase on upstream 1.1.22+63d2d79
  - Resolves: rhbz#1458953
  - Resolves: rhbz#1743373
  - Resolves: rhbz#1757951
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1760669
  - Resolves: rhbz#1792492


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.23-1
changelog:
  - Improve help for clean-up option
  - Avoid pending DC fencing getting "stuck" in status display
  - Rebase on upstream 1.1.23-rc1
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1787749
  - Resolves: rhbz#1792492


author: Naveen Kumar <nkumar@redhat.com> - 3.0-8
changelog:
  - add ur-in, ur-pk & pa-pk locale-specific overrides rule in 67-paktype-naskh-basic.conf
  - add ur-in, ur-pk & pa-pk locale-specific overrides rule in 67-paktype-naskh-basic-sa.conf
  - resolves bug #586789


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-9
changelog:
  - fix CVE-2014-2583: potential path traversal issue in pam_timestamp
  - pam_pwhistory: call the helper if SELinux enabled


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-11
changelog:
  - be tolerant to corrupted opasswd file
  - audit the module names that granted access
  - pam_userdb: correct the example in man page (#1078784)
  - pam_limits: check whether the utmp login entry is valid (#1080023)
  - pam_console_apply: do not print error if console.perms.d is empty
  - pam_limits: nofile refers to open file descriptors (#1111220)
  - apply PIE and full RELRO to all binaries built


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-14
changelog:
  - pam_unix: add no_pass_expiry option for ignoring password
    expiration in crond and sshd with public key authentication
  - add manual page for environment(5) (#1110257)
  - pam_loginuid: log if auditd not detected
  - always ignore audit error when -EPERM is returned (#1287800)
  - pam_lastlog: fix possible NULL dereference when localtime fails (#1313537)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-19
changelog:
  - pam_access: (group) match syntax is prioritized over network@netgroup
    match (#1358881), add support for additional /etc/security/access.d/*.conf
    files, improve documentation (#1421735)
  - pam_lastlog: fix pt_BR translation (#1185697)
  - pam_faillock: support admin_group with users equivalent to root in
    faillock handling (#1285550)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-23
changelog:
  - pam_get_authtok_verify: ensure no double verification happens
  - manual page fixes for pam_tty_audit and pam_wheel
  - pam_unix: lower the excessive maximum number of closed fd descriptors
    when spawning handlers
  - pam_loginuid: do not prevent login in unprivileged containers


author: Nalin Dahyabhai <nalin@redhat.com> - 2.4.6-1
changelog:
  - handle ccache creation correctly for users who are mapped to principal
    names in realms other than the default (#999604)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.4.7-1
changelog:
  - drop some no-longer-necessary code to cede ownership of keyring ccaches
    to an unprivileged user at login-time to work better with upcoming changes
    to libkrb5's keyring ccache support (libkrb5: #991148, this one's #1005376)
  - if we don't have a ccname_template, if we're built against a libkrb5 that
    provides interfaces for reading its configuration files, try to read the
    default_ccache_name value from the [libdefaults] section before falling
    back to the default we've set at compile-time (#more of #1005376)
  - stop specifying a default ccache location at compile-time on F21 and later,
    to make our unconfigured default better line up with libkrb5's unconfigured
    default


author: Nalin Dahyabhai <nalin@redhat.com> - 2.4.8-4
changelog:
  - fix to only prompt for passwords when obtaining credentials for performing
    password changes by toggling the subsequent_prompt default to off when
    called to perform a password change (#1063933)


author: Bob Relyea <rrelyea@redhat.com> 0.6.2-22
changelog:
  - Don't rebuild documentation for each platform. Doing so creates unique 
  document files which are shared and conflict on multilib installations.


author: Bob Relyea <rrelyea@redhat.com> 0.6.2.29
changelog:
  - Coverity and compilier warning fixes
  - Use the PKIX validator
  - Fix crash when ldap connection fails and debugging is enabled.


author: Akira TAGOH <tagoh@redhat.com> - 1.34.1-2
changelog:
  - Fix duplicate file list for modules.cache
  - s/%define/%global/g
  - Fix bogus date in %changelog
  - Do not suppress the detailed build log.


author: William Cohen <wcohen@redhat.com> - 5.2.0-15
changelog:
  - Update papi L1 cache events on POWER7
  - Prevent papi-testsuite segfaults
  - Identify kernels that support rdpmc
  - Correct papi-testsuite byte_profile and sprofile tests on ppc64le
  - Update PAPI_L1_TCM event on Haswells


author: William Cohen <wcohen@redhat.com> - 5.2.0-25
changelog:
  - Update IBM Power 9 events. rhbz1510684
  - Make lmsensor dynamically size internal array. rhbz1510497


author: Akira TAGOH <tagoh@redhat.com> - 0.6.8-23
changelog:
  - the spec file cleanup
  - Fix the undefined symbol issue in libpaps.so.0
  - Correct FSF address in the COPYING.LIB


author: Nathan Scott <nathans@redhat.com> - 0.4.0-5
changelog:
  - Use RPM macros to ease dropwizard metrics enablement.
  - Correct the dependency on systems.uom:systems-unicode-java8


author: Brian C. Lane <bcl@redhat.com> 3.1-21
changelog:
  - Backport fix for 1 sector logical partition separation from start of extended
    Resolves: rhbz#1212323


author: Brian C. Lane <bcl@redhat.com> 3.1-22
changelog:
  - Use 512b sector size when communicating with device-mapper
    Resolves: rhbz#1188431
  - Add a test to make sure partitions are the correct size on device-mapper
    Related: rhbz#1188431


author: Brian C. Lane <bcl@redhat.com> 3.1-23
changelog:
  - libparted: Use read only when probing devices on linux
    Resolves: rhbz#1245144
  - tests: Use wait_for_dev_to_ functions
    Related: rhbz#1245144


author: Brian C. Lane <bcl@redhat.com> 3.1-24
changelog:
  - tests: Add udevadm settle to wait_for_ loop
    Related: rhbz#1260664
  - tests: Add-wait-to-t9042
    Resolves: rhbz#1257415
  - tests: Fix t1700 failing on a host with a 4k xfs file
    Related: rhbz#1260664


author: Brian C. Lane <bcl@redhat.com> 3.1-25
changelog:
  - docs: Add list of filesystems for fs-type
    Resolves: rhbz#1311596
  - libparted: Remove fdasd geometry code from alloc_metadata
    Resolves: rhbz#1244833


author: Brian C. Lane <bcl@redhat.com> - 3.1-29
changelog:
  - Add support for NVMe devices
    Resolves: rhbz#1316239
  - Backport partition resize command
    Resolves: rhbz#1423357


author: Brian C. Lane <bcl@redhat.com> - 3.1-30
changelog:
  - partprobe: always close dev when probing disks
    Resolves: rhbz#1551411
  - tests: Add t4201 to test partprobe with 1025 devices
    Related: rhbz#1551411


author: Brian C. Lane <bcl@redhat.com> - 3.1-31
changelog:
  - Backport patches for dasd on virtio
    fdasd: geometry handling updated from upstream s390-tools
    dasd: enhance device probing
    parted: fix build error on s390
    fdasd.c: Safeguard against geometry misprobing
    Resolves: rhbz#1676604
  - Add part-label documentation to mkpart command
    Resolves: rhbz#1686659


author: Tomas Mraz <tmraz@redhat.com> 0.78.99-1
changelog:
  - use better (auditable) libselinux calls for checking
    the access to passwd (#518268)
  - add support for the -e option as seen on Debian passwd
  - make the binary PIE and full RELRO (#784483)


author: Jiri Kucera <jkucera@redhat.com> - 0.79-5
changelog:
  - Backport ca46cac (allow passwords longer than 79 characters)
    Backport Steve Grubb's patches
    - stop double auditing, use appropriate record types, update op field in
      audit events, don't audit status check, fix password aging logging
    Backport 02d4478 (better document -S option)
    Fix URL and Source tags
    Resolves: #1276570, #1489086, #1638105, #1145256, #1472567


author: Jiri Kucera <jkucera@redhat.com> - 0.79-6
changelog:
  - Fix incorrect -S output when password field in /etc/passwd is empty but the
    password information in /etc/shadow is set
    Resolves: #1686436


author: Than Ngo <than@redhat.com> - 2.7.1-11
changelog:
  - Fixed CVE-2016-10713 - Out-of-bounds access in pch_write_line function 
  - Fixed CVE-2018-6952 - Double free of memory
  - Resolves: #1626473, honor new file mode 100755 when applying patches
  - Resolves: #1653294, Added virtual provides for bundled gnulib library


author: Tim Waugh <twaugh@redhat.com> 2.7-1
changelog:
  - 2.7.  No longer need sigsegv, get-arg, CVE-2010-4651,
    backup-if-mismatch or coverity-leak patches.


author: Hans de Goede <hdegoede@redhat.com> - 2.0-8
changelog:
  - Add a patch fixing various crashes due to referencing freed memory (#1133339)
  - Cherry-pick some other fixes from upstream git


author: Kalev Lember <kalevlember@gmail.com> - 3.0-1
changelog:
  - Update to 3.0
  - Use license macro for the LICENCE file
  - Use desktop-file-validate instead of desktop-file-install


author: Dave Brolley <brolley@redhat.com> - 3.10.5-3
changelog:
  - Update with missing package dependency for pmda-lustrecomm.
  - Rebuild to pickup bintils fix (BZ 1238469)


author: Nathan Scott <nathans@redhat.com> - 3.10.6-1
changelog:
  - Export the softnet_stat kernel networking metrics (BZ 1190912)
  - Latest upstream PCP, dropping all earlier patches (BZ 1200584)
  - Re-enable the pcp-pmda-jsonpointer package build (BZ 1238134)
  - Fix failing test cases and bugs from Red Hat QE (BZ 1241591)
  - pcp2graphite support for exporting from archives (BZ 1242622)
  - Remove percpu interrupt metrics from default set (BZ 1243809)
  - pcp-collector meta-package enables pmcd+pmlogger (BZ 1249090)


author: Nathan Scott <nathans@redhat.com> - 3.10.6-2
changelog:
  - Fixes targetting several QE reported test failures (BZ 1241591)
  - Remove tool-specific interval settings for pmlogconf (BZ 1243809)


author: Nathan Scott <nathans@redhat.com> - 3.11.2-1
changelog:
  - Improve PMAPI python clients signal handling (BZ 1238550)
  - Fix issues in postfix PMDA search for mail log (BZ 1252308)
  - Fix local_sock() souble free error in perl API (BZ 1258860)
  - Fix sigsegv in pcp-uptime(1) --archive option (BZ 1262721)
  - Update to current stable PCP version (BZ 1284307)
  - Fix pcp-compat dependency drawing in many packages (BZ 1293466)
  - Support for per-processor softnet kernel metrics (BZ 1316085)
  - Fix GFS2 PMDA Install script PMNS parsing error (BZ 1320591)
  - Report Docker version 1.10+ container information (BZ 1327737)


author: Nathan Scott <nathans@redhat.com> - 3.11.3-1
changelog:
  - Latest upstream PCP, dropping all earlier patches (BZ 1284307)
  - Minimal package dependencies for PMAPI applications (BZ 1298993)
  - Resolve perl Net:SNMP pmdasnmp dependency problem (BZ 1332624)
  - Improve time taken to detect pmcd startup failure (BZ 1336210)
  - Fix cron service stopping disabled pmie/pmlogger (BZ 1336792)
  - Fix instance domain handling in derived metrics (BZ 1337212)
  - Include latest Oracle database PMDA enhancements (BZ 1340430)
  - Workaround valgrind failure for pmmgr test case (BZ 1343319)


author: Nathan Scott <nathans@redhat.com> - 3.11.3-3
changelog:
  - Install the missing /etc/pcp/nssdb directory (BZ 1360206)
  - pcp-pmda-ds389 requires perl-LDAP dependency (BZ 1357605)
  - Switch pcp-pmda-ds389log to the dirsrv user (BZ 1357607)
  - pcp-pmda-ds389log requires perl-Date-Manip (BZ 1354055)
  - Remove multi-archive loglabel timezone check (BZ 1351223)


author: Nathan Scott <nathans@redhat.com> - 3.11.8-2
changelog:
  - Drop pcp-pmda-nutcracker package, missing deps (BZ 1425880)
  - Incorporate several fixes from Coverity scan review.


author: Nathan Scott <nathans@redhat.com> - 3.11.8-4
changelog:
  - Enable collecting POWER9 NEST PMU perf metrics (BZ 1419490)
  - SELinux policy updates (BZs 1381301,1432086,1433271,1443632)
  - zeroconf package added (BZs 1211432, 1371950)


author: Lukas Berk <lberk@redhat.com> - 3.12.2-1
changelog:
  - Selinux policy updates (BZs 1459165,1460131,1488116,1447585,1449671)
  - PCP bash completions not working (BZ 1482605)
  - pmdabash man page fix (BZ 1459907)


author: Lukas Berk <lberk@redhat.com> - 3.12.2-2
changelog:
  - Selinux policy updates (BZs 1517655,1517656,1480447,1505888,1515928,1517281,1517862)
  - Multilib corrections (BZ 1513503)


author: Nathan Scott <nathans@redhat.com> - 3.12.2-3
changelog:
  - Update Source2 for external grafana webapp (BZ 1516933)
  - Remove an unhelpful log metadata diagnostic (BZ 1472153)


author: Lukas Berk <lberk@redhat.com> - 3.12.2-5
changelog:
  - Correction to spec file and selinux policy (BZ 1488116)
  - Show all perfevent metrics in pcpatop (BZ 1525864)
  - Multilib corrections (BZ 1537623)


author: Nathan Scott <nathans@redhat.com> - 4.0.2-1
changelog:
  - Ensure sans font dependency resolved for webapps (BZ 1568109)
  - Ensure sans font dependency resolved for pmchart (BZ 1546640)
  - Update to latest PCP sources (BZ 1565370).


author: Nathan Scott <nathans@redhat.com> - 4.0.2-3
changelog:
  - Resolve rpm verification problem on /var/run/pcp (BZ 1533154)
  - Fix device mapper PMDA histogram metrics sigsegv (BZ 1569854)
  - Fix pmlogger_daily log rotation open port issue (BZ 1579881)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-1
changelog:
  - Numerous fixes in pmlogger daily scripts (BZs 1677848, 1697182, 1579881, 1603143)
  - Update PCP selinux policy rules (BZs 1692305, 1695066)
  - Adjust spec file /var/run/pcp settings (BZ 1533154)
  - Fix pmdaproc kernel process misreporting (BZ 1673250)
  - Fix pmdalinux SYSV IPC metric scalability (BZ 1699232)
  - Ensure pmdaroot reaps all of its children (BZ 1698517)
  - Corrections to python version dependencies (BZ 1676867)
  - Fix pcp-atopsar(1) -A (all) option handling (BZ 1673996)
  - Update to a more recent PCP bug fix release (BZ 1647308)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-2
changelog:
  - Rework the pcp-libs ldconfig post-op (BZ 1705362)
  - Resolve a QA file permissions diagnostic issue


author: Nathan Scott <nathans@redhat.com> - 4.3.2-4
changelog:
  - Fix a pmdaproc memory leak (BZ 1721107)
  - Rebuild with selinux runtime dependency update (BZ 1714101)
  - Update selinux-policy to latest upstream (BZs 1699830, 1700989)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-7
changelog:
  - Fix hugepage metrics in pmdalinux (BZ 1730107)
  - Fix NUMA nodes instance domain in pmdalinux (BZ 1730492)
  - Several selinux policy fixes (BZs 1749870, 1756252, 1760750)
  - Fix pcp-atopsar sample count command line argument (BZ 1764748)
  - Fix pcp-atop sigsegv with certain process state changes (BZ 1765641)
  - Add pcp-zeroconf pmieconf rule to enable per-thread logging (BZ 1775373)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-8
changelog:
  - Fix rpm %post privilege escalation CVEs (BZs 1815249, 1815528)
  - Resolve an selinux policy issue with pmlogger (BZ 1792859)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-13
changelog:
  - Fix pcp-atopsar memory allocation problem with some options (BZ 1857580)
  - Fix __pmGetArchiveEnd_ctx sigsegv with corrupt PCP archives (BZ 1878754)


author: Sagar Sagar <sagar.sagar@oracle.com> - 4.3.2-13.0.15
changelog:
  - Fixed pipe Error with pcp python utilities [Orabug: 35081709]
  - Fixed python exception with ps utility issue [Orabug: 35087942]
  - PCP python utilities man pages fix and update [Orabug: 35574702]
  - PCP free utility enhancement to view free memory in terabytes [Orabug: 35574708]
  - Fixed Initial archive file is unreadable by mpstat utility issue [Orabug: 35564281]


author: Sagar Sagar <sagar.sagar@oracle.com> - 4.3.2-13.0.21
changelog:
  - Fixed IO error in pcp-meminfo [Orabug: 36542360]
  - Fixed error message in pcp-ps  [Orabug: 36542360]
  - Fixed derived metric rollback issue in libpcp [Orabug: 36542360]


author: Nathan Scott <nathans@redhat.com> - 1.5.8-2
changelog:
  - Update to latest PCP GUI sources.
  - Build fix when building against older PCP headers.
  - Force PCP_PMSNAPCONTROL_PATH to the preferred location.


author: Nathan Scott <nathans@redhat.com> - 1.5.9-1
changelog:
  - Fix problems with pmchart Samples/Visible History (BZ 968825)
  - Fix pmchart startup handling lack of metrics source (BZ 957007)
  - Fix missing metric handling for archive View files (BZ 981140)
  - UX improvements for the New/Edit Chart Apply button (BZ 957669)
  - Resolve packaging issue where /usr/bin was installed (BZ 988176)
  - Improve pmchart show-/hide-time-control mechanism (BZ 957002)
  - Add a close button to pmchart Preferences dialog (BZ 922198)
  - Fix pmchart Preferences dialog color scheme sigsegv (BZ 963505)


author: Nathan Scott <nathans@redhat.com> - 1.5.10-1
changelog:
  - Updates to the PCP Users and Administrators Guide.
  - Updates to the PCP Programmers Guide.
  - Install a known-good pdf version of each book (BZ 990303).
  - Improve pmchart hostname reporting via pmGetContextHostName.


author: Nathan Scott <nathans@redhat.com> - 1.5.11-1
changelog:
  - Updates to the PCP Programmers Guide.
  - Fix pmchart value/units reporting issue on chart selection.


author: Petr Pisar <ppisar@redhat.com> - 8.32-13
changelog:
  - Disable unsupported JIT mode on little-endian 64-bit PowerPC platform
    (bug #1125642)
  - Raise optimization level to 3 on little-endian 64-bit PowerPC (bug #1123498)


author: Petr Pisar <ppisar@redhat.com> - 8.32-15
changelog:
  - Fix compiling expression where start-anchored character with more than one
    other case follows circumflex in multiline UTF mode (bug #1110621)
  - Fix character class with a literal quotation (bug #1111091)
  - Fix empty-matching possessive zero-repeat groups in interpreted mode
    (bug #1119320)
  - Fix compiler crash for zero-repeated groups with a recursive back reference
    (bug #1119356)
  - Reset non-matched groups within capturing group up to forced match
    (bug #1161597)
  - Fix static linking (bug #1217111)
  - Package pcredemo.c as a documentation for pcre-devel (bug #1217118)


author: Petr Pisar <ppisar@redhat.com> - 8.32-16
changelog:
  - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive
    reference in a group with indefinite repeat) (bug #1330509)
  - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to
    duplicate group number) (bug #1330509)
  - Fix CVE-2015-8386 (buffer overflow caused by lookbehind assertion)
    (bug #1330509)
  - Fix CVE-2015-3217 (stack overflow caused by mishandled group empty match)
    (bug #1330509)
  - Fix CVE-2015-5073 and CVE-2015-8388 (buffer overflow for forward reference
    within backward assertion with excess closing parenthesis) (bug #1330509)
  - Fix CVE-2015-8391 (inefficient posix character class syntax check)
    (bug #1330509)
  - Fix CVE-2016-3191 (workspace overflow for (*ACCEPT) with deeply nested
    parentheses) (bug #1330509)


author: Petr Pisar <ppisar@redhat.com> - 8.32-17
changelog:
  - Let [:graph:], [:print:], and [:punct:] POSIX classes to handle Unicode
    characters in UCP mode to match Perl behavior (bug #1400267)
  - Fix matching Unicode ranges in JIT mode (bug #1402288)


author: Petr Pisar <ppisar@redhat.com> - 10.22-7
changelog:
  - Fix pcre2-config --libs-posix output (upstream bug #1924)
  - Fix a memory leak and a typo in a documentation (upstream bug #1973)
  - Fix a buffer overflow in partial match test for CRLF in an empty buffer
    (upstream bug #1975)
  - Fix a crash in pcre2test when displaying a wide character with a set locate
    (upstream bug #1976)


author: Petr Pisar <ppisar@redhat.com> - 10.22-8
changelog:
  - Fix a crash when doing an extended substitution for \p, \P, or \X
    (upstream bug #1977)
  - Fix a crash in substitution if starting offest was specified beyond the
    subject end (upstream bug #1992)


author: Petr Pisar <ppisar@redhat.com> - 10.23-2
changelog:
  - Handle memmory allocation failures in pcre2test tool
  - Fix a crash when finding a Unicode property for a character with a code
    point greater than 0x10ffff in UTF-32 library while UTF mode is disabled
    (upstream bug #2052)


author: Ivan Devat <idevat@redhat.com> - 0.9.157-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1362493 rhbz#1315627 rhbz#1378742 rhbz#1334429 rhbz#1402374 rhbz#1389941 rhbz#1303969 rhbz#1415080 rhbz#1328882 rhbz#1434972 rhbz#1413958


author: Ivan Devat <idevat@redhat.com> - 0.9.158-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1447702 rhbz#1176018 rhbz#1433016 rhbz#1303969 rhbz#1386114 rhbz#1386512 rhbz#1390609 rhbz#1165821 rhbz#1315992 rhbz#1373614 rhbz#1422667 rhbz#1254984


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.158-2
changelog:
  - Fixed crash of the `pcs cluster setup` command when the `--force` flag was used
  - Fixed crash of the `pcs cluster destroy --all` command when the cluster was not running
  - Fixed crash of the `pcs config restore` command when restoring pacemaker authkey
  - Fixed "Error: unable to get cib" when adding a node to a stopped cluster
  - Resolves: rhbz#1176018


author: Ivan Devat <idevat@redhat.com> - 0.9.158-3
changelog:
  - Added option to create not hardened cluster with the `pcs cluster setup` command using the `--no-hardened` flag
  - Added option to create not hardened cluster from web UI
  - Fixed a crash in the `pcs cluster node add-remote` command when an id conflict occurs
  - Fixed creating a new cluster from the web UI
  - `pcs cluster node add-guest` now works with the flag `--skipp-offline`
  - `pcs cluster node remove-guest` can be run again when the guest node was unreachable first time
  - Fixed "Error: Unable to read /etc/corosync/corosync.conf" when running `pcs resource create`([rhbz#1386114])
  - Binary data are stored in corosync authkey
  - Resolves: rhbz#1284404 rhbz#1373614 rhbz#1165821 rhbz#1176018 rhbz#1386114


author: Ivan Devat <idevat@redhat.com> - 0.9.158-4
changelog:
  - Added support for enable and disable in bundles
  - New clusters are created with corosync encryption disabled by default
  - Flag `--master` is backward compatible in `pcs resource create`
  - Resolves: rhbz#1165821 rhbz#1433016 rhbz#1458153


author: Ivan Devat <idevat@redhat.com> - 0.9.158-5
changelog:
  - `pcs cluster setup` uses existing pacemaker authkey if it exists
  - `pcs resource create` shows only warning when case of remote node is detected
  - Resolves: rhbz#1459503


author: Ivan Devat <idevat@redhat.com> - 0.9.158-6
changelog:
  - It is now possible to disable, enable, unmanage and manage bundle resources and set their meta attributes
  - Fixed timeout when cluster setup takes long time in web UI
  - It is now mandatory to specify container type in the "resource bundle create" command
  - Resolves: rhbz#1447910 rhbz#1284404


author: Ivan Devat <idevat@redhat.com> - 0.9.160-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1499749 rhbz#1443647 rhbz#1432283 rhbz#1421702 rhbz#1443418 rhbz#1464781 rhbz#1435697 rhbz#1441673 rhbz#1420437 rhbz#1388783 rhbz#1463327 rhbz#1418199 rhbz#1341582 rhbz#1489682 rhbz#1491631 rhbz#1213946


author: Ivan Devat <idevat@redhat.com> - 0.9.161-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1499749 rhbz#1415197 rhbz#1501274 rhbz#1502715 rhbz#1230919 rhbz#1503110


author: Ondrej Mular <omular@redhat.com> - 0.9.162-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1389943 rhbz#1389209 rhbz#1506220 rhbz#1508351 rhbz#1415197 rhbz#1506864 rhbz#1367808 rhbz#1499749


author: Ivan Devat <idevat@redhat.com> - 0.9.162-2
changelog:
  - Changed snmp agent logfile path
  - It is now possible to set the `action` option of stonith devices in GUI by using force
  - Do not crash when `--wait` is used in `pcs stonith create`
  - A warning is displayed in `pcs status` and a stonith device detail in web UI  when a stonith device has its `method` option set to `cycle`
  - Resolves: rhbz#1367808 rhbz#1421702 rhbz#1522813 rhbz#1523378


author: Ivan Devat <idevat@redhat.com> - 0.9.162-3
changelog:
  - Pcs now properly exits with code 1 when an error occurs in pcs cluster node add-remote and pcs cluster node add-guest commands
  - Fixed a crash in the pcs booth sync command
  - Resolves: rhbz#1464781 rhbz#1527530


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5
changelog:
  - Fixed `pcs cluster auth` in a cluster when not authenticated and using a non-default port
  - Fixed `pcs cluster auth` in a cluster when previously authenticated using a non-default port and reauthenticating using an implicit default port
  - Resolves: rhbz#1415197


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.1
changelog:
  - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
  - Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
  - Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb
  - Resolves: rhbz#1557253


author: EL Errata <el-errata_ww@oracle.com> - 0.9.162-5.0.3.el7_5.1
changelog:
  - Unlike RHEL we DO have corosync/pacemaker for aarch64 on EL7
  - replace logo pcsd/public/favicon.ico in tarball
  - remove Source1 HAM-logo.png


author: Ivan Devat <idevat@redhat.com> - 0.9.165-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1572886 rhbz#1581150 rhbz#1579911 rhbz#1533849 rhbz#1557252 rhbz#1568353 rhbz#1574898 rhbz#1427273 rhbz#1475318 rhbz#1476862 rhbz#1535967 rhbz#1566382 rhbz#1588667 rhbz#1590533 rhbz#1403832 rhbz#1517333 rhbz#1529508


author: Ivan Devat <idevat@redhat.com> - 0.9.165-2
changelog:
  - Fixed validation for an unaccessible resource inside a bundle 
  - Fixed test of watchdog devices
  - Fixed command `pcs cluster node add-outside`
  - Fixed large key files distribution
  - Resolves: rhbz#1462248 rhbz#1475318 rhbz#1599758 rhbz#1600169


author: Ondrej Mular <omular@redhat.com> - 0.9.165-5
changelog:
  - Fixed `pcs stonith sbd watchdog test` error messages
  - Fixed avaliable watchdog devices listing
  - Resolves: rhbz#1475318


author: Ondrej Mular <omular@redhat.com> - 0.9.165-6
changelog:
  - Fix instance attributes setting for fence agents `fence_compute` and
    `fence_evacuate`
  - Resolves: rhbz#1623181


author: EL Errata <el-errata_ww@oracle.com> - 0.9.165-6.0.1
changelog:
  - Revert the prior change to disable aarch64 build
  - Unlike RHEL we DO have corosync/pacemaker for aarch64 on EL7
  - replace logo pcsd/public/favicon.ico in tarball
  - remove Source1 HAM-logo.png


author: Ivan Devat <idevat@redhat.com> - 0.9.165-6.el7_6.1
changelog:
  - `pcs` no longer spawns unnecessary processes for reading node tokens
  - Fixed a bug causing most of the messages not being logged into pcsd.log
  - Lower load caused by periodical config files syncing in pcsd by making it sync less frequently
  - Improve logging of periodical config files syncing in pcsd
  - Resolves: rhbz#1683959 rhbz#1683957 rhbz#1683958


author: Ivan Devat <idevat@redhat.com> - 0.9.167-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1649732 rhbz#1554302 rhbz#1447349 rhbz#1647640 rhbz#1594738 rhbz#1676956 rhbz#1474747 rhbz#1679534 rhbz#1642514 rhbz#1389140 rhbz#1522858 rhbz#1676944 rhbz#1638376 rhbz#1515021 rhbz#1598197


author: Edward Leung <edward.leung@oracle.com> - 0.9.167-3.0.1
changelog:
  - remove change for favicon.ico from replace-favicon.patch
  - replace logo pcsd/public/favicon.ico in tarball
  - remove Source1 HAM-logo.png


author: Ivan Devat <idevat@redhat.com> - 0.9.168-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1730747 rhbz#1725849 rhbz#1551663 rhbz#1595444 rhbz#1671174 rhbz#1712315 rhbz#1619253 rhbz#1710750 rhbz#1466088 rhbz#1558063 rhbz#1665898 rhbz#1500012 rhbz#1673829


author: Ivan Devat <idevat@redhat.com> - 0.9.168-2
changelog:
  - Do not generate custom DH key if it was not requested by setting its custom length
  - Resolves: rhbz#1760434


author: Ivan Devat <idevat@redhat.com> - 0.9.168-3
changelog:
  - More fixes for the case when PATH environment variable is not set
  - Pcsd no longer sends Server HTTP header
  - Empty constraint option are not allowed in pcs constraint order and pcs constraint colocation add commands
  - Resolves: rhbz#1500012 rhbz#1765606 rhbz#1671174


author: Ondrej Mular <omular@redhat.com> - 0.9.168-4
changelog:
  - Added command 'pcs resource relations'
  - Added command 'pcs resource safe-disable'
  - Resolves: rhbz#1770975 rhbz#1770973


author: Ivan Devat <idevat@redhat.com> - 0.9.169-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1822078 rhbz#1759269 rhbz#1448569


author: Ivan Devat <idevat@redhat.com> - 0.9.169-2
changelog:
  - Keep autogenerated IDs of set constraints reasonably short
  - Use fixed version of python module subprocess (package python2-subprocess32)
  - Resolves: rhbz#1820813 rhbz#1824206


author: Ivan Devat <idevat@redhat.com> - 0.9.169-3
changelog:
  - Added option: pcs resource [safe-]disable --simulate` has a new option `--brief` to print only a list of affected resources
  - Fixed race-condition when removing multiple resources from web UI
  - Resolves: rhbz#1833115 rhbz#1843593


author: Ivan Devat <idevat@redhat.com> - 0.9.169-3.el7_3.1
changelog:
  - Explicitly close libcurl connections to prevent stalled TCP connections in CLOSE-WAIT state
  - Added support for loading DH keys from a file
  - Resolves: rhbz#1870551 rhbz#1888479


author: Robert Relyea <rrelyea@redhat.com> - 1.8.8-7
changelog:
  - Don't hang if the daemon is blocked by systemd
  - Make sure we have a new enough systemd-devel to have the udev headers


author: Robert Relyea <rrelyea@redhat.com - 1.4.10-13
changelog:
  - Add support for missing readers (broadcom, cherry).
  - mark deprecated readers as unsupported and needing an update


author: Jarod Wilson <jarod@redhat.com> - 3.0-6
changelog:
  - Update to upstream 3.0-3.1.gb36a595 tarball for upstream fixes
  - Add in manpages
  - Related: rhbz#1365750
  - Resolves: rhbz#948476


author: Jarod Wilson <jarod@redhat.com> - 3.0-7
changelog:
  - Address a myriad more coverity/clang warnings
  - Add raw_ethernet_* man page symlinks
  - Related: rhbz#1273176
  - Related: rhbz#948476


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-284
changelog:
  - Use a macro to cover all 64-bit PowerPC architectures (bug #1061792)
  - Declare dependencies for cpan tool (bug #1122368)
  - Use stronger algorithm needed for FIPS in t/op/crypt.t (bug #1084796)
  - Make *DBM_File desctructors thread-safe (bug #1107542)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-286
changelog:
  - Remove CPU-speed-sensitive test in Benchmark test (bug #1238567)
  - Rebuild with corrected binutils to fix systemtap support (bug #1238472)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-288
changelog:
  - Fix CRLF conversion in ASCII FTP upload (bug #1263734)
  - Don't leak the temp utf8 copy of namepv (bug #1063330)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-291
changelog:
  - Backported and sub-packaged libraries historically supplied with Perl 4
    into perl-Perl4-CoreLibs


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-293
changelog:
  - Add SSL support to Net::SMTP (bug #1557574)
  - Do not overload ".." in Math::BigInt (bug #1497734)
  - Provide perl(:VERSION) and perl-interpreter RPM symbols (bug #1410347)


author: Paul Howarth <paul@city-fan.org> - 2.05.03-3
changelog:
  - Don't BR: perl(LWP::Simple) for optional tests when bootstrapping; this is a
    cleaner fix than nobbling perl-URI's runtime dependencies


author: Paul Howarth <paul@city-fan.org> - 20081208-8
changelog:
  - Clean up for modern rpmbuild:
    - Drop BuildRoot specification
    - Drop %clean section
    - Don't bother cleaning buildroot in %install section
    - Make %files list more explicit
    - Use DESTDIR rather than PERL_INSTALL_ROOT
    - Use %{_fixperms} macro rather than our own chmod incantation
    - Replace provides filter with version that works with rpm ≥ 4.9
  - Include tests as %doc since they're referred to by examples/README


author: Paul Howarth <paul@city-fan.org> - 20120719-1
changelog:
  - Update to 20120719:
    - Support using data from RangeMessage.xml, so you can use the latest data
      from ISBN without updating this module
  - Fix shellbang and permissions of make_data.pl script to placate rpmlint
  - Filter dependency on perl(LWP::Simple), required only by make_data.pl script,
    not in normal operation
  - Don't need to remove empty directories from the buildroot
  - BR: perl(Carp), perl(File::Spec::Functions) and perl(Test::Manifest) ≥ 1.14
  - BR: at least version 1.00 of perl(Test::Pod)


author: Paul Howarth <paul@city-fan.org> - 20120719.001-1
changelog:
  - Update to 20120719.001:
    - Require Test::More ≥ 0.95 for subtest support
    - No code or feature changes
  - Bump Test::Manifest version requirement to 1.21
  - Bump Test::More version requirement to 0.95
  - Drop redundant buildreq perl(Test::Prereq)


author: Paul Howarth <paul@city-fan.org> - 0.008-7
changelog:
  - Run the extra tests in a separate test run, and only when not bootstrapping
  - Don't BR: perl(Test::Spelling) with RHEL ≥ 7 as we don't have the other
    dependencies needed do the spell check test


author: Paul Howarth <paul@city-fan.org> - 0.008-12
changelog:
  - Never BR: perl(Test::Version) for EL builds as perl(version) is too old
    prior to EL-7 and this package is included in RHEL ≥ 7 but Test::Version
    is only in EPEL


author: Paul Howarth <paul@city-fan.org> - 0.19-7
changelog:
  - New upstream re-release of 0.19 by DROLSKY
    - The load_class() subroutine now returns the class name on success
      (CPAN RT#76931)
    - Exceptions and errors from Class::Load no longer contain references to line
      numbers in Class::Load or Module::Runtime; this applies to exceptions
      thrown by load_class, load_first_existing_class, and load_optional_class,
      as well as the error returned by try_load_class
    - Exceptions are now croaked properly so they appear to come from the calling
      code, not from an internal subroutine; this makes the exceptions look more
      like the ones thrown by Perl's require (CPAN RT#68663)
  - This release by DROLSKY -> update source URL
  - BR: perl(Scalar::Util) for the module
  - BR: perl(lib) for the test suite
  - Drop buildreqs perl(strict) and perl(warnings) - not dual-lived


author: Paul Howarth <paul@city-fan.org> - 2.055-1
changelog:
  - Update to 2.055
    - Fix misuse of magic in API (CPAN RT#78080)
  - Drop redundant explicit requires for perl(Exporter) and perl(File::Temp)


author: Paul Howarth <paul@city-fan.org> - 2.058-1
changelog:
  - Update to 2.058
    - Compress::Raw::Bzip2 needs to use PERL_NO_GET_CONTEXT (CPAN RT#80318)
    - Install to 'site' instead of 'perl' when perl version is 5.11+
      (CPAN RT#79811)
    - Update to ppport.h that includes SvPV_nomg_nolen (CPAN RT#78080)


author: Paul Howarth <paul@city-fan.org> - 2.058-1
changelog:
  - Update to 2.058
    - Compress::Raw::Zlib needs to use PERL_NO_GET_CONTEXT (CPAN RT#80319)
    - Install to 'site' instead of 'perl' when perl version is 5.11+
      (CPAN RT#79812)
    - Update to ppport.h that includes SvPV_nomg_nolen (CPAN RT#78079)


author: Paul Howarth <paul@city-fan.org> - 2.061-1
changelog:
  - Update to 2.061
    - Include zlib 1.2.8 source
    - Typo fix (CPAN RT#85431)
    - Silence compiler warning by making 2nd parameter to DispStream a const char*


author: Paul Howarth <paul@city-fan.org> - 0.64-3
changelog:
  - Remove circular BR: perl(Net::SSL) provided by this package
  - Placate rpmlint regarding file permissions
  - Don't need to remove empty directories from the buildroot


author: Marcela Mašláňová <mmaslano@redhat.com> 1.34-1
changelog:
  - update by Fedora::App::MaintainerTools 0.006
  - updating to latest GA CPAN version (1.34)
  - replaced old BR on perl(Test::Simple) with Test::More
  - added a new req on perl(DBI) (version 1.21)


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.135.07-240
changelog:
  - update the version to override the module from perl.srpm
  - bump release to override sub-package from perl.spec


author: Paul Howarth <paul@city-fan.org> - 0.107-3
changelog:
  - package LICENSE file
  - run test suite even when bootstrapping, as it should still pass
  - run release tests too
  - enhance %description so it makes sense
  - BR: perl(Test::More)


author: Paul Howarth <paul@city-fan.org> - 0.107-4
changelog:
  - drop -tests subpackage (general lack of interest in this), but include
    them as documentation for the main package
  - drop redundant %{?perl_default_filter}
  - don't use macros for commands
  - can't find any dependency cycle so drop %{?perl_bootstrap} usage
  - drop ExtUtils::MakeMaker version requirement to 6.30, actual working minimum


author: Petr Pisar <ppisar@redhat.com> - 2:1.04-6
changelog:
  - Restore object after failed truncate() call (bug #1095111)
  - Add 2015-06-30 and 2016-12-31 leap seconds (bug #1353509)


author: Petr Pisar <ppisar@redhat.com> - 1.70-1
changelog:
  - 1.70 bump (bug #1101251)
  - Regenerate Perl code from timezone sources (bug #1101251)
  - Update time zone data to Olson 2017b (bug #1101251)


author: Paul Howarth <paul@city-fan.org> - 1:2.08-8
changelog:
  - Spec clean-up:
    - Use DESTDIR rather than PERL_INSTALL_ROOT
    - BR: perl(Carp)
    - BR: perl(Test::Pod) and perl(Test::Pod::Coverage) if not bootstrapping
    - Use %{_fixperms} macro instead of our own chmod incantation
    - Make %files list more explicit


author: Petr Pisar <ppisar@redhat.com> - 2.51-6
changelog:
  - Rebuild against "file" package fixed by Jan Kaluza to correct run-time
    dependencies (bug #1048910)


author: Paul Howarth <paul@city-fan.org> - 1:0.17020-1
changelog:
  - Update to 0.17020
    - Change to Shlomi Fish's new E-mail and web address
    - Clarify the licence of lib/Error/Simple.pm (CPAN RT#81277)
    - Correct typos (CPAN RT#85023)
  - Don't use macros for commands
  - Don't need to remove empty directories from the buildroot
  - Make %files list more explicit
  - Drop %defattr, redundant since rpm 4.4
  - Avoid provides/requires from examples


author: Petr Šabata <contyk@redhat.com> - 2.46-1
changelog:
  - 2.46 bump
  - Specify all dependencies
  - Drop command macros
  - Modernize the spec and clean whitespace


author: Paul Howarth <paul@city-fan.org> - 3.20-10
changelog:
  - Clean up spec file for modern rpmbuild:
    - Drop BuildRoot definition
    - Drop %defattr
    - Drop %clean section
    - Drop cleaning of buildroot in %install
    - Use DESTDIR rather than PERL_INSTALL_ROOT
    - Use %{_fixperms} macro rather than our own chmod incantation
    - Don't use macros for commands
  - Break build dependency loop by only using perl(Test::Pod) if we're not
    bootstrapping
  - BR: perl(Test::More)


author: Paul Howarth <paul@city-fan.org> - 1:5.02-4
changelog:
  - Don't BR: perl(Test::LeakTrace) when bootstrapping
  - Don't use macros for commands
  - Don't need to remove empty directories from the buildroot
  - Drop explicit provides for perl(HTML::Tree) now that CPAN and RPM versions
    are back in sync


author: Petr Pisar <ppisar@redhat.com> 6.00-1
changelog:
  - Specfile autogenerated by cpanspec 1.78.
  - Remove BuildRoot stuff
  - Conflicts with perl-libwww-perl-5* and older


author: Petr Pisar <ppisar@redhat.com> - 0.033-2
changelog:
  - Croak on failed write into a file (bug #1031096)
  - Do not use already existing temporary files (bug #1031096)


author: Paul Howarth <paul@city-fan.org> - 2.055-1
changelog:
  - Update to 2.055
    - FAQ: added a few paragraphs on how to deal with pbzip2 files
      (CPAN RT#77743)
    - Compress::Zip: speed up compress, uncompress, memGzip and memGunzip
      (CPAN RT#77350)
  - BR: perl(lib)
  - Drop BR: perl(Test::Builder) and perl(Test::More) as they're bundled
  - Drop BR: perl(Config), perl(Fcntl), perl(File::Copy), perl(File::Glob),
    perl(POSIX) and perl(Symbol) as they're not dual-lived
  - Drop redundant explicit require for perl(Exporter)
  - Don't use macros for commands


author: Paul Howarth <paul@city-fan.org> - 2.058-1
changelog:
  - Update to 2.058
    - IO::Compress::Zip
      - Allow member name and Zip Comment to be "0"
    - IO::Compress::Base::Common
      - Remove "-r" test - the file open will catch this
      - IO::Compress::Base::Common returned that it could not read readable files
        in NFS (CPAN RT#80855)
    - Install to 'site' instead of 'perl' when perl version is 5.11+
      (CPAN RT#79820)
    - General performance improvements
    - Fix failing 01misc.t subtest introduced in 2.057 (CPAN RT#81119)
  - Explicitly install to 'perl' directories


author: Paul Howarth <paul@city-fan.org> - 2.059-1
changelog:
  - Update to 2.059
    - IO::Compress::Base
      - Added "Encode" option (fixes the encoding half of CPAN RT#42656)


author: Paul Howarth <paul@city-fan.org> - 2.060-1
changelog:
  - Update to 2.060
    - Updated POD
      - CPAN RT#82138: Example code not clear - gunzip() takes filenames!
    - IO::Compress::Base
      - Remove the flush call when opening a filehandle


author: Paul Howarth <paul@city-fan.org> - 2.061-1
changelog:
  - Update to 2.061
    - zipdetails (1.06)
      - Get it to cope with Android 'zipalign' non-standard extra fields; these
        are used to make sure that a non-compressed member starts on a 4 byte
        boundary
    - unzip example with IO::Uncompress::Unzip (CPAN RT#84647)


author: Paul Howarth <paul@city-fan.org> - 2.66-1
changelog:
  - Update to 2.66
    - Fix inet_pton/inet_ntop import warnings (CPAN RT#55901)
    - Fix listening on :: or 0.0.0.0 (CPAN RT#54656)
    - Add test listen_port_only.t
    - Solved problems with multihomed and family order (CPAN RT#57676)
    - Fix select timeout issue in t/io_multihomed6.t
    - Fix t/io_multihomed6.t on systems with broken getaddrinfo() (CPAN RT#58198)
    - Made the "use Socket" call import constants selectively, and not rely on
      @EXPORT's whims


author: Paul Howarth <paul@city-fan.org> - 2.69-1
changelog:
  - Update to 2.69:
    - Solved symbol clashes in t/io_multihomed6.t (CPAN RT#72769)
    - Fix the imports on t/io_multihomed6.t (CPAN RT#72769)
    - Update the link to the repository in Build.PL
  - BR: perl(IO::Socket)
  - BR: perl(Socket)
  - Use %{_fixperms} macro instead of our own chmod incantation


author: Paul Howarth <paul@city-fan.org> - 1.91-1
changelog:
  - Update to 1.91
    - Added IO::Socket::SSL::Utils for easier manipulation of certificates and
      keys
    - Moved SSL interception into IO::Socket::SSL::Intercept and simplified it
      using IO::Socket::SSL::Utils
    - Enhance meta information in Makefile.PL
  - Bump openssl version requirement to 0.9.8a
  - Need at least version 6.58 of ExtUtils::MakeMaker (CPAN RT#85739)


author: Paul Howarth <paul@city-fan.org> - 1.92-1
changelog:
  - Update to 1.92
    - Intercept: use sha1-fingerprint of original cert for id into cache unless
      otherwise given
    - Fix pod error in IO::Socket::SSL::Utils (CPAN RT#85733)


author: Paul Howarth <paul@city-fan.org> - 1.93-1
changelog:
  - Update to 1.93
    - Need at least OpenSSL version 0.9.8 now, since last 0.9.7 was released 6
      years ago; remove code to work around older releases
    - Changed AUTHOR in Makefile.PL from array back to string, because the array
      feature is not available in MakeMaker shipped with 5.8.9 (CPAN RT#85739)
  - Set openssl version requirement to 0.9.8
  - Drop ExtUtils::MakeMaker version requirement back to 6.46


author: Paul Howarth <paul@city-fan.org> - 1.94-1
changelog:
  - Update to 1.94
    - Makefile.PL reported wrong version of openssl if Net::SSLeay was not
      installed, instead of reporting a missing dependency of Net::SSLeay


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.94-4
changelog:
  - Respect OpenSSL default ciphers and protocol versions (bug #1127322)
  - Fix typo in Utils.pm (bug #1097710)


author: Paul Howarth <paul@city-fan.org> 2.110-17
changelog:
  - spec clean-up:
    - nobody else likes macros for commands
    - use DESTDIR rather than PERL_INSTALL_ROOT
    - add buildreqs for core perl modules, which may be dual-lived


author: Paul Howarth <paul@city-fan.org> 2.110-18
changelog:
  - don't build-require modules that this package provides (problem stupidly
    introduced in previous release)
  - don't need to remove empty directories from buildroot
  - drop %defattr, redundant since rpm 4.4


author: Paul Howarth <paul@city-fan.org> - 2.27200-241
changelog:
  - BR: perl(base), perl(constant) and perl(lib)
  - Install to vendor directories
  - Drop %defattr, redundant since rpm 4.4
  - Don't need to remove empty directories from the buildroot


author: Petr Šabata <contyk@redhat.com> - 2.27200-242
changelog:
  - Correct the URL
  - Add a few missing buildtime dependencies
  - Drop Getopt::Long dep; json_pp isn't tested


author: Paul Howarth <paul@city-fan.org> - 2.27202-1
changelog:
  - Update to 2.27202
    - Fix test failures due to hash iterator randomization in perl 5.17.6 onwards
      (CPAN RT#83421)


author: Petr Pisar <ppisar@redhat.com> - 1:0.56-3
changelog:
  - Do not set SSL ciphers at all by default (bug #1091316)
  - Pass actual length to syswrite() instead of default 1500 B (bug #1104243)


author: Petr Pisar <ppisar@redhat.com> 6.01-1
changelog:
  - Specfile autogenerated by cpanspec 1.78.
  - Remove BuildRoot stuff
  - Conflicts with perl-libwww-perl 5* and older


author: Paul Howarth <paul@city-fan.org> - 0.33-1
changelog:
  - Update to 0.33
    - Updated can_xs to fix a bug in it
  - Reinstate compatibility with old distributions like EL-5
  - Drop Test::More version requirement to 0.42
  - BR: perl(ExtUtils::MakeMaker)
  - BR: perl(Test::LeakTrace) except on EL-4/EL-5 where it's not available
  - BR: perl(Pod::Simple), perl(Test::CPAN::Meta), perl(Test::MinimumVersion)
    (if we're not bootstrapping) and perl(Test::Pod), and run the developer tests
    too
  - Don't use macros for commands
  - Use %{_fixperms} macro rather than our own chmod incantation
  - Make %files list more specific
  - Use tabs


author: Paul Howarth <paul@city-fan.org> - 0.33-7
changelog:
  - BR:/R: perl(Carp)
  - BR: perl(constant), perl(Exporter) and perl(ExtUtils::CBuilder)
  - Add commentary regarding non-use of Test::LeakTrace for EL-7 builds
  - Use Test::LeakTrace for EL-5 builds
  - Drop support for EL-4 builds since it was EOL-ed ages ago
  - Drop %defattr, redundant since rpm 4.4
  - Don't need to remove empty directories from the buildroot
  - Remove more command macros


author: Petr Šabata <contyk@redhat.com> - 0.39-7.1
changelog:
  - Add a few more missing build-time deps
  - Correct the licence tag
  - Modernize the spec a bit
  - Package the example scripts in their directory


author: Paul Howarth <paul@city-fan.org> - 2.8.0-3
changelog:
  - Fix broken POD (CPAN RT#86060)
  - Work around test suite failures with Net::DNS ≥ 0.68 (CPAN RT#78214)


author: Paul Howarth <paul@city-fan.org> - 2.08-3
changelog:
  - Use DESTDIR rather than PERL_INSTALL_ROOT
  - One buildreq per line for readability
  - Add buildreqs for core perl modules, which might be dual-lived


author: Paul Howarth <paul@city-fan.org> - 2.09-1
changelog:
  - Update to 2.09
    - Remove dependency to Test::Pod by moving 99pod.t from t/ to xt/
      (CPAN RT#69918)
  - BR: perl(Net::Domain) ≥ 1.05 and perl(Net::SMTP) ≥ 1.03
  - Explicitly run xt/ tests


author: Paul Howarth <paul@city-fan.org> 2.10-1
changelog:
  - Update to 2.10
    - Mail::Mailer::smtp set from address twice (CPAN RT#77161)
    - Mail::Mailer::smtps did not support the From option (CPAN RT#77161)
    - Mail::Util::mailaddress has now an optional parameter to set the returned
      value explicitly (CPAN #75975)
  - BR: perl(base)
  - Drop BR: perl(Config) and perl(POSIX), not dual-lived
  - Drop %defattr, redundant since rpm 4.4
  - Don't need to remove empty directories from the buildroot


author: Paul Howarth <paul@city-fan.org> 2.12-1
changelog:
  - Update to 2.12
    - Default for Mail::Header::new(Modify) is 'false', not 'true'
      (CPAN RT#79985)
    - Mail::Address take username with rindex(), a bit better than index() but
      still poor (CPAN RT#82056)
    - Check for bad folding of header lines (CPAN RT#79993)
    - Add a note about better to avoid Mail::Address->name() (CPAN RT#81459)
  - Drop UTF8 patch, no longer needed


author: Paul Howarth <paul@city-fan.org> - 0.03-3
changelog:
  - Incorporate feedback from package review (#788258)
    - Correct License tag, which should be Artistic 2.0
    - BR: perl(lib) for test suite
    - Explicitly require perl(Carp), not automatically detected


author: Paul Howarth <paul@city-fan.org> - 0.04-1
changelog:
  - Update to 0.04
    - This module no longer installs an _implementation() subroutine in callers;
      instead, you can call Module::Implementation::implementation_for($package)
      to get the implementation used for a given package
  - Update patch for building with old Test::More versions


author: Paul Howarth <paul@city-fan.org> - 0.05-1
changelog:
  - Update to 0.05
    - Make Test::Taint an optional dependency; it requires XS, and requiring a
      compiler for Module::Implementation defeats its purpose (CPAN RT#74817)
  - BR: perl(Test::Requires)
  - Update patch for building with old Test::More versions


author: Paul Howarth <paul@city-fan.org> - 0.06-3
changelog:
  - Drop %defattr, redundant since rpm 4.4
  - Don't need to remove empty directories from buildroot
  - Add commentary regarding conditionalized buildreqs


author: Paul Howarth <paul@city-fan.org> - 1.000012-1
changelog:
  - Update to 1.000012
    - Improved package detection heuristics
    - Fix ->contains_pod (CPAN RT#84932)
    - Fix detection of pod after __END__ (CPAN RT#79656)
  - This release by ETHER -> update source URL
  - Package new upstream README file


author: Paul Howarth <paul@city-fan.org> - 1.000014-1
changelog:
  - Update to 1.000014
    - Fix reliance on recent Test::Builder
    - Make tests perl 5.6 compatible
  - This release by BOBTFISH -> update source URL


author: Paul Howarth <paul@city-fan.org> - 1.000016-1
changelog:
  - Update to 1.000016
    - Re-release to fix prereqs and other metadata
  - This release by ETHER -> update source URL
  - Specify all dependencies


author: Paul Howarth <paul@city-fan.org> - 1.000018-1
changelog:
  - Update to 1.000018
    - Re-release of de-tainting fix without unstated non-core test dependencies
  - Drop BR: perl(Test::Fatal)


author: Paul Howarth <paul@city-fan.org> - 0.68-5
changelog:
  - BR: perl(constant), perl(Data::Dumper) and perl(lib)
  - Don't need to remove empty directories from the buildroot
  - Drop %defattr, redundant since rpm 4.4


author: Paul Howarth <paul@city-fan.org> - 0.69-1
changelog:
  - Update to 0.69
    - Support for gpg under these alternate names: gpg gpg2 gnupg gnupg2
  - This release by AUDREYT -> update source URL
  - BR:/R: perl(Text::Diff)
  - Include Andreas Koenig's GPG key in the SRPM and import it in %prep so
    that we don't need to get it from a keyserver in %check


author: Paul Howarth <paul@city-fan.org> - 0.73-1
changelog:
  - Update to 0.73
    - Constrain the user-specified digest name to /^\w+\d+$/
    - Only allow loading Digest::* from absolute paths in @INC (CVE-2013-2145)


author: Paul Howarth <paul@city-fan.org> - 1.51-1
changelog:
  - update to 1.51
    - fixed a problem where SSL_set_SSL_CTX is not available with
      OpenSSL < 0.9.8f (CPAN RT#81940)
  - fix bogus date in spec changelog


author: Paul Howarth <paul@city-fan.org> - 1.52-1
changelog:
  - update to 1.52
    - rebuild package with gnu format tar, to prevent problems with unpacking on
      other systems such as old Solaris


author: Paul Howarth <paul@city-fan.org> - 1.54-1
changelog:
  - update to 1.54
    - added support for SSL_export_keying_material where present (i.e. in OpenSSL
      1.0.1 and later)
    - changed t/handle/external/50_external.t to use www.airspayce.com instead of
      perldition.org, who no longer have an https server
    - patch to fix a crash: P_X509_get_crl_distribution_points on an X509
      certificate with values in the CDP extension that do not have an ia5 string
      would cause a segmentation fault when accessed
    - change in t/local/32_x509_get_cert_info.t to not use
      Net::SSLeay::ASN1_INTEGER_get, since it works differently on 32 and 64 bit
      platforms
    - updated author and distribution location details to airspayce.com
    - improvement to test 07_sslecho.t so that if set_cert_and_key fails we can
      tell why


author: Paul Howarth <paul@city-fan.org> - 1.55-1
changelog:
  - update to 1.55
    - added support for TLSV1_1 and TLSV1_2 methods with SSL_CTX_tlsv1_1_new(),
      SSL_CTX_tlsv1_2_new(), TLSv1_1_method() and TLSv1_2_method(), where
      available in the underlying openssl
    - added CRL support functions X509_CRL_get_ext(), X509_CRL_get_ext_by_NID(),
      X509_CRL_get_ext_count()
    - fixed a problem that could cause content with a value of '0' to be
      incorrectly encoded by do_httpx3 and friends (CPAN RT#85417)
    - added support for SSL_get_tlsa_record_byname() required for DANE support in
      openssl-1.0.2 and later
    - testing with openssl-1.0.2-stable-SNAP-20130521
    - added X509_NAME_new and X509_NAME_hash


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.55-6
changelog:
  - Deleted support for SSL_get_tlsa_record_byname (bug #1422435)
  - Removed tests which fails due to changes openssl 1.0.1h and later


author: Paul Howarth <paul@city-fan.org> - 4.064-1
changelog:
  - Update to 4.064
    - Updated GPL v2.0 text and address in all modules
    - Added support for rfc3021 /31 networks to hostenum
  - Update UTF8 patch


author: Paul Howarth <paul@city-fan.org> - 4.067-1
changelog:
  - Update to 4.067
    - Improved diagnostic message for "die" with bad mask for hostenum,
      hostenumref, split, splitref, rsplit, rsplitref
  - Include new docfile About-NetAddr-IP.txt


author: Paul Howarth <paul@city-fan.org> - 4.069-1
changelog:
  - Update to 4.069
    - Add proper pod encoding in Lite.pm
    - Changed Makefile.PL to check for config.h when building for XS with 'gcc',
      try building with 'cc', and check again; if config.h is not found, force
      Pure Perl mode
    - Kill XS in winduhs and Darwin, both of which misbehave when compiling XS
      code
  - Drop UTF8 patch, no longer needed


author: Paul Howarth <paul@city-fan.org> - 0.12-1
changelog:
  - Update to 0.12:
    - Fix tests to pass with Carp 1.25 (CPAN RT#75520)
  - BR: perl(Test::Spelling), aspell-en
  - Add patch to accept "deprecations" as a valid dictionary word
  - Update patches to apply cleanly
  - Don't need to remove empty directories from buildroot
  - Don't use macros for commands
  - Drop EPEL-4 support:
    - Drop patch supporting build with ExtUtils::MakeMaker < 6.30


author: Paul Howarth <paul@city-fan.org> - 0.13-1
changelog:
  - Update to 0.13:
    - Fix dist.ini to not add Test::Spelling as a requirement
  - Drop %defattr, redundant since rpm 4.4
  - Test::Requires available on all supported distributions


author: Paul Howarth <paul@city-fan.org> - 0.32-1
changelog:
  - Update to 0.32
    - Bring the behavior of has_symbol for nonexistant scalars into line with the
      XS version
    - Invalid package names (for instance, Foo:Bar) are not allowed
    - Invalid stash entry names (anything containing ::) are not allowed
  - Update patches to apply cleanly
  - Bump perl(Package::Stash::XS) version requirement to 0.24


author: Paul Howarth <paul@city-fan.org> - 0.33-6
changelog:
  - Drop EPEL-4 support
    - Drop %defattr, redundant since rpm 4.4
    - Test::LeakTrace, Test::Requires and Test::Script are now universally available
    - A suitably recent version of ExtUtils::MakeMaker is now universally available
  - Don't need to remove empty directories from the buildroot


author: Paul Howarth <paul@city-fan.org> - 0.34-1
changelog:
  - Update to 0.34
    - Support anonymous stashes on newer perl versions
    - Prevent harmful effects from invalid settings for
      $ENV{PACKAGE_STASH_IMPLEMENTATION}
    - Switch to Module::Implementation
  - BR: perl(Module::Implementation) ≥ 0.06
  - BR: perl(base) for test suite
  - Bump Package::Stash::XS version requirement to 0.26
  - Explicitly run extra tests (except on RHEL ≥ 7, where the necessary
    build dependencies may not be available)
  - Update patch for building with old Test::More version in EPEL-5


author: Paul Howarth <paul@city-fan.org> - 0.25-1
changelog:
  - Update to 0.25
    - Invalid package names (for instance, Foo:Bar) are not allowed
    - Invalid stash entry names (anything containing ::) are not allowed
  - Update patches to apply cleanly


author: Paul Howarth <paul@city-fan.org> - 0.25-6
changelog:
  - Drop EPEL-4 support
    - Test::LeakTrace now universally available
    - Suitably recent version of ExtUtils::MakeMaker now universally available
    - Drop %defattr, redundant since rpm 4.4
  - BR: perl(File::Temp)
  - Don't need to remove empty directories from the buildroot


author: Paul Howarth <paul@city-fan.org> - 0.26-1
changelog:
  - Update to 0.26
    - Internal refactorings to support Package::Anon stashes
  - BR: perl(base) and perl(Test::Requires) for test suite
  - Update patch for old distro compatibility
  - Explicitly run the release/author tests


author: Ralf Corsépius <corsepiu@fedoraproject.org> - 1.08-1
changelog:
  - Upstream update.
  - Update patch.
  - Update BRs.
  - Add %bcond --with network.
  - Fix up %changelog dates.


author: Paul Howarth <paul@city-fan.org> - 1.002-241
changelog:
  - Drop %defattr, redundant since rpm 4.4
  - Don't need to remove empty directories from the buildroot
  - Don't delete the extra tests when bootstrapping, but don't run them either


author: Paul Howarth <paul@city-fan.org> - 1.003-1
changelog:
  - Update to 1.003
    - Fixed detection of VOS; $^O reports 'vos', not 'VOS'
    - Additional release tests
  - BR: perl(File::Spec::Functions), perl(List::Util),
    perl(Perl::Critic::Policy::Lax::ProhibitStringyEval::ExceptForRequire),
    perl(Pod::Wordlist::hanekomu), perl(Test::MinimumVersion),
    perl(Test::Perl::Critic), perl(Test::Spelling) and perl(Test::Version)
  - Identify purpose of each build requirement
  - Update patches for building on old distributions
  - Don't run extra tests for EPEL-5/6 builds


author: Petr Pisar <ppisar@redhat.com> 0.003-1
changelog:
  - Specfile autogenerated by cpanspec 1.78.
  - Do not build-require File::Find, Socket, and warnings::register which are
    not exercised by tests
  - Sort provides by English rules


author: Petr Pisar <ppisar@redhat.com> - 0.54-4
changelog:
  - Support cpu_type on ARM and AArch64 (bug #1093266)
  - Accept undefined cpu_clock on ARM and AArch64 (bug #1093266)


author: Daniel P. Berrangé <berrange@redhat.com> - 4.5.0-2
changelog:
  - Fix typed parameter memory handling (rhbz#1613227)
  - Fix missing NWFilterBinding module (rhbz#1608755)


author: Petr Pisar <ppisar@redhat.com> - 2.30-17
changelog:
  - Modernize spec file
  - Specify all dependencies
  - Change license to "(Copyright only) and (Artistic or GPL+)" because of
    ppport.h


author: Petr Pisar <ppisar@redhat.com> - 1.48-3
changelog:
  - Clarify license (bug #1065946)
  - Remove run-time dependency on Test::Builder::Tester (bug #1065944)
  - Declare run-time dependency on File::Find (bug #1066006)


author: Paul Howarth <paul@city-fan.org> - 0.98-241
changelog:
  - Merge tests sub-package back into main package
  - Don't need to remove empty directories from the buildroot
  - Drop %defattr, redundant since rpm 4.4
  - Make %files list more explicit
  - Don't use macros for commands
  - Mark Tutorial.pod as %doc
  - Drop explicit dependency on perl-devel


author: Jitka Plesnikova <jplesnik@redhat.com> - 0.04-18
changelog:
  - Update dependencies
  - Use DESTDIR rather than PERL_INSTALL_ROOT
  - Remove build root cleaning, BuildRoot definition and %defattr


author: Jitka Plesnikova <jplesnik@redhat.com> - 1:1.20-10
changelog:
  - Remove perl(base) from BR
  - Package README and ChangeLog
  - Replace PERL_INSTALL_ROOT with DESTDIR
  - Remove deleting empty directories


author: Paul Howarth <paul@city-fan.org> - 0.11-4
changelog:
  - BR: perl(Carp)
  - Don't need to remove empty directories from buildroot
  - Don't use macros for commands
  - Drop redundant %{?perl_default_filter}
  - Enhance %description
  - Reinstate EPEL-5 compatibility:
    - Define buildroot
    - Clean buildroot in %install and %clean
  - Use tabs


author: Paul Howarth <paul@city-fan.org> - 1.59-3
changelog:
  - Break build dependency loop by only using perl(Business::ISBN) if we're not
    bootstrapping
  - BR: perl(Carp) and perl(Exporter)
  - Make %files list more explicit
  - Use DESTDIR rather than PERL_INSTALL_ROOT
  - Use %{_fixperms} macro rather than our own chmod incantation
  - Don't use macros for commands


author: Paul Howarth <paul@city-fan.org> - 1.60-1
changelog:
  - Update to 1.60
    - Do not reverse the order of new parameters
    - Avoid test failure if the local hostname is 'foo' (CPAN RT#75519)
    - Work around a stupid join bug in 5.8.[12] (CPAN RT#59274)
    - Updated repository URL
  - Don't need to remove empty directories from buildroot
  - BR: perl(constant)


author: Paul Howarth <paul@city-fan.org> - 1.60-8
changelog:
  - Retain runtime dependency of perl(Business::ISBN) when bootstrapping; a
    better fix for the build dependency cycle was to drop LWP::Simple as a
    buildreq of perl-Business-ISBN (needed only for optional tests) when
    bootstrapping


author: Petr Pisar <ppisar@redhat.com> - 1:2.0016-1
changelog:
  - 2.0016 bump (disable XML_PARSE_HUGE by default to prevent from
    CVE-2003-1564, a recursive XML entity expansion leads to memory exhaustion
    in a XML parser)


author: Jitka Plesnikova <jplesnik@redhat.com> - 2.41-8
changelog:
  - Update dependencies and summary
  - Remove pre-RPM-4.9 filters
  - Remove deleting empty directories
  - Update REC-xml-19980210.xml to match new encoding


author: Paul Howarth <paul@city-fan.org> - 0.99-3
changelog:
  - Drop redundant runtime dependencies on perl(XML::LibXML) and
    perl(XML::LibXML::Common), which cause circular build dependencies (#720974)
  - Simplify provides and requires filters
  - Don't need to remove empty directories from buildroot
  - Mark POD files as %doc


author: Jitka Plesnikova <jplesnik@redhat.com> - 0.99-7
changelog:
  - Update dependencies and summary
  - Remove xmltest.xml due to copyright
  - Replace PERL_INSTALL_ROOT with DESTDIR


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.08-6
changelog:
  - Update dependencies
  - Replace PERL_INSTALL_ROOT with DESTDIR
  - Update description and summary
  - Remove deleting empty directories
  - Remove dist.ini from %doc


author: Petr Šabata <contyk@redhat.com> - 0.621-1
changelog:
  - 0.621 bump
  - Lots of bugfixes
  - Packaging examples
  - Fixing build-time deps and removing unneeded lines
  - Fixing changelog issues


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.13-17
changelog:
  - 680418 - missing man page for xpath
  - applied debian patch, which added POD into xpath code, but also fix debian bug(#185292)


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.13-22
changelog:
  - revert the patch. It breaks backward compatibility for some apps. 
  - the xpath has still man page installed.
  - Resolves: rhbz#1067903


author: Paul Howarth <paul@city-fan.org> - 0.81-2
changelog:
  - R: perl(Carp) and perl(Data::Dumper)
  - BR: perl(Carp), perl(constant) and perl(Exporter)
  - Release tests no longer shipped, so drop buildreqs for them and don't bother
    setting AUTOMATED_TESTING; run tests even when bootstrapping


author: Paul Howarth <paul@city-fan.org> - 0.84-2
changelog:
  - Haven't needed to fix documentation character encoding since 0.79
  - Drop Test::Base build dependency again to avoid a BR loop (#215637)
  - Filter private provides perl(yaml_mapping), perl(yaml_scalar) and
    perl(yaml_sequence)
  - Don't need to remove empty directories from the buildroot
  - This release by MSTROUT -> update source URL


author: Petr Šabata <contyk@redhat.com> - 1.05-26.2
changelog:
  - Fix the package for el7
  - Modernize the spec
  - Correct a bogus date in changelog
  - Unify spec whitespace


author: Petr Šabata <contyk@redhat.com> - 0.08-18
changelog:
  - Correct buildtime dependencies
  - Correct the licence tag
  - Update the provides filter
  - Drop command macros
  - Modernize spec


author: Marcela Mašláňová <mmaslano@redhat.com> - 1:0.225-4
changelog:
  - Install to vendor directories rather than perl core directories so as to
    avoid conflicts between our debuginfo and the main perl-debuginfo package


author: Paul Howarth <paul@city-fan.org> - 1:0.225-6
changelog:
  - Reinstate compatibility with old distributions like EL-5
    - Add back buildroot definition and cleaning
  - Use DESTDIR rather than PERL_INSTALL_ROOT
  - Make %files list more explicit
  - Drop redundant %{?perl_default_filter}
  - Don't use macros for commands
  - Use tabs


author: Paul Howarth <paul@city-fan.org> - 1:0.225-242
changelog:
  - Don't need to remove empty directories from the buildroot
  - Drop %defattr, redundant since rpm 4.4


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.42-2
changelog:
  - Add BR perl(File::Spec)
  - Replace PERL_INSTALL_ROOT with DESTDIR
  - Remove deleting empty directories
  - Remove defattr


author: Darren Archibald <darren.archibald@oracle.com> - 0.109-11.0.1
changelog:
  - RPM macro fix (Petr Benes)
  - updates for Oracle Linux test certificate (Alexey Petrenko)
  - update Oracle Linux certificates (Alexey Petrenko)


author: Remi Collet <rcollet@redhat.com> - 5.4.16-33
changelog:
  - core: use after free vulnerability in unserialize()
    CVE-2014-8142 and CVE-2015-0231
  - core: fix use-after-free in unserialize CVE-2015-2787
  - core: fix NUL byte injection in file name argument of
    move_uploaded_file() CVE-2015-2348
  - date: use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - exif: free called on unitialized pointer CVE-2015-0232
  - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
  - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.4.16-34
changelog:
  - fix memory corruption in fileinfo module on big endian
    machines #1082624
  - fix segfault in pdo_odbc on x86_64 #1159892
  - fix segfault in gmp allocator #1154760


author: Remi Collet <rcollet@redhat.com> - 5.4.16-35
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4025, CVE-2015-4026, #1213407
  - fileinfo: fix denial of service when processing a crafted
    file #1213442
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: fix type confusion through unserialize #1222538
  - apache2handler: fix pipelined request executed in deinitialized
    interpreter under httpd 2.4 CVE-2015-3330


author: Remi Collet <rcollet@redhat.com> - 5.4.16-38
changelog:
  - curl: add options to enable TLS #1291667
  - mysqli: fix segfault in mysqli_stmt::bind_result() when
    link is closed #1096800
  - fpm: fix incorrectly defined SCRIPT_NAME variable when
    using Apache #1138563
  - core: fix segfault when a zend_extension is loaded twice #1289457
  - openssl: change default_md algo from MD5 to SHA1 #1073388
  - wddx: fix segfault in php_wddx_serialize_var #1131979


author: Remi Collet <rcollet@redhat.com> - 5.4.16-41
changelog:
  - gd: fix integer overflow in _gd2GetHeader() resulting in
    heap overflow CVE-2016-5766
  - gd: fix integer overflow in gdImagePaletteToTrueColor()
    resulting in heap overflow CVE-2016-5767
  - mbstring: fix double free in _php_mb_regex_ereg_replace_exec
    CVE-2016-5768


author: Remi Collet <rcollet@redhat.com> - 5.4.16-43
changelog:
  - gd: fix DoS vulnerability in gdImageCreateFromGd2Ctx() CVE-2016-10167
  - gd: Signed Integer Overflow gd_io.c CVE-2016-10168


author: Remi Collet <rcollet@redhat.com> - 5.4.16-44
changelog:
  - fix php should provide php(httpd) #1215429
  - fpm: backport PHP-FPM's clear_env option from 5.4.27 #1410010
    default value is "yes", preserving previous behaviour
  - openssl: fix default_socket_timeout does not work with SSL #1378196


author: Remi Collet <rcollet@redhat.com> - 5.4.16-47
changelog:
  - fix stack-buffer-overflow while parsing HTTP response CVE-2018-7584
  - fix out-of-bounds read in base64_decode_xmlrpc CVE-2019-9024
  - fix reflected XSS in phar 404 page CVE-2018-5712
  - fix reflected XSS in phar 403 and 404 error pages CVE-2018-10547


author: Remi Collet <remi@fedoraproject.org> 1:1.9.4-14
changelog:
  - add explicit requires on all needed extensions (phpci)
  - fix pecl launcher (need ini to be parsed for some
    extenstions going to be build as shared, mainly simplexml)
  - add fix for new unpack format (php 5.5)


author: Remi Collet <remi@fedoraproject.org> - 3.0.7-5
changelog:
  - add patch for https://bugs.php.net/59602
    segfault in getExtendedStats
  - also provides php-memcache


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-1
changelog:
  - Require "nss >= 3.28.3" as a build and runtime requirement
  - Require "jss >= 4.4.0-4" as a build and runtime requirement
  - Require "tomcatjss >= 7.2.1-3" as a build and runtime requirement
  - dogtagpki Pagure Issue #2612 - Unable to clone due to pki pkcs12-cert-find
    failure (edewata)
  - ############################################################################
  - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4
  - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.4.x
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - ############################################################################
  - Common Criteria
  - ############################################################################
  - Bugzilla Bug #1419734 - CC: CMC: id-cmc-identityProofV2 feature
    implementation (cfu)
  - Bugzilla Bug #1419742 - CC: CMC: provide Proof of Possession for encryption
    cert requests (cfu)
  - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures
    (edewata)
  - Bugzilla Bug #1428020 - CC: CMC feature support: provided issuance
    protection cert mechanism (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-2
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1282504 - Installing pki-server in container reports
    scriptlet failed, exit status 1 (jpazdziora)
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1410650 - [RFE] Add SCP03 support
    for sc 7 g & d cards (RHEL) (jmagne)
  - Bugzilla Bug #1437591 - cli authentication using expired cert throws an
    exception (edewata)
  - Bugzilla Bug #1437602 - non-CA cli looks for CA in the instance during a
    request (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support
    for sc 7 g & d cards (RHCS) (jmagne)
  - ############################################################################
  - Common Criteria
  - ############################################################################
  - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures
    (edewata)
  - Bugzilla Bug #1417307 - CC: Audit Review /Searches (edewata)
  - Bugzilla Bug #1419737 - CC: CMC: id-cmc-popLinkWitnessV2 feature
    implementation (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-3
changelog:
  - ############################################################################
  - RHEL 7.4:
  - ############################################################################
  - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in
    conjuction with FreeIPA (ftweedal)
  - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the
    startTime parameter is not working as expected. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
  - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal)
  - Bugzilla Bug #1445088 - profile modification cannot remove existing config
    parameters (ftweedal)
  - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHEL) (alee)
  - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when
    pki CLI terminates SSL connection (edewata)
  - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata)
  - ############################################################################
  - RHCS 9.2:
  - ############################################################################
  - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption)
    (RHCS) (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-4
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when
    HSM is used. (alee)
  - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
  - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from
    the KRA (ftweedal)
  - Bugzilla Bug #1448204 - pkispawn of clone install fails with
    InvalidBERException (ftweedal)
  - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on
    thales hsm (alee)
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-5
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
  - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed)
    CMC with identity proof (cfu)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (mharmsen)
  - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when
    defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata)
  - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne)
  - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen)
  - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in
    ConnectorServlet. (edewata)
  - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata)
  - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED
    audit event. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-7
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1445519 - CA Server installation with HSM fails
    (jmagne)
  - Bugzilla Bug #1452617 - Unable to create IPA Sub CA
    (ftweedal)
  - Bugzilla Bug #1454471 - Enabling all subsystems on startup
    (edewata)
  - Bugzilla Bug #1455617 - Key recovery on token fails because
    key record is not marked encrypted (alee)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-8
changelog:
  - Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement
  - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS
    enabled system (edewata)
  - Bugzilla Bug #1447144 - CA brought down during separate KRA instance
    creation (edewata)
  - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure
    ACCESS_SESSION_ESTABLISH_FAILURE (edewata)
  - Bugzilla Bug #1454450 - SubCA installation failure with 2 step
    installation in fips enabled mode (edewata)
  - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import
    is asking for password when already provided (edewata)
  - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes)
  - Bugzilla Bug #1458043 - Key recovery using externalReg fails
    with java null pointer exception on KRA (alee)
  - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter
    (edewata)
  - Bugzilla Bug #1458429 - client-cert-import --ca-cert should
    import CA cert with trust bits "CT,C,C" (edewata)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-9
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC
    non-signing certificate requests (cfu)
  - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC
     revocation non-signing cert requests (cfu)
  - Bugzilla Bug #1458047 - change the way aes clients refer to
    aes keysets (alee)
  - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code
    (alee)
  - Bugzilla Bug #1460028 - In keywrap mode, key recovery on
    KRA with HSM causes KRA to crash (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-10
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1458043 - Key recovery on token fails with
    invalid public key error on KRA (alee)
  - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client
    authentication cert against CMC signer (cfu)
  - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after
    deleting the any of the subsystem certs from it (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-11
changelog:
  - Resolves: rhbz #1469432
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1469432 - CMC plugin default change
  - Resolves CVE-2017-7537
  - Fixes BZ #1470948


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-12
changelog:
  - Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing
    certificate requests (cfu)
    [PREVIOUS PATCH:  pki-core-beta.patch]
    [PREVIOUS PATCH:  pki-core-snapshot-4.patch]
  - Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause
    error (cfu)
    [PREVIOUS PATCH:  pki-core-post-beta.patch]
  - Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert
    against CMC signer (cfu)
    [PREVIOUS PATCH:  pki-core-CMC-check-HTTPS-client-authentication-cert.patch]
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-validation.patch]
  - Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal
    non-signing cert requests (cfu)
    [PREVIOUS PATCH:  pki-core-snapshot-1.patch]
    [pki-core-pre-signed-CMC-renewal-UniqueKeyConstraint.patch]
  - Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen)
    [pki-core-platform-dependent-python-import.patch]
  - Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with
    id-cmc-statusInfoV2 (cfu)
    [pki-core-CMC-id-cmc-statusInfoV2.patch]
  - Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option
    (dmoluguw)
    [pki-core-subsystem-cert-update-CLI-cert-option.patch]
  - Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03
    (jmagne)
    [pki-core-HSM-key-changeover-SCP03-support.patch]
  - Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system
    certificates (cfu)
    [pki-core-system-cert-CMC-enroll-profile.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-13
changelog:
  - Resolves: rhbz #1463350
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1463350 - Access banner validation (edewata)
    [pki-core-server-access-banner-retrieval-validation.patch]


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-14
changelog:
  - Require "jss >= 4.4.0-8" as a build and runtime requirement
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Resolves: rhbz #1486870,1485833,1487509,1490241,1491332
  - Bugzilla Bug #1486870 - Lightweight CA key replication fails (regressions)
    [RHEL 7.4.z] (ftweedal)
  - Bugzilla Bug #1485833 - Missing CN in user signing cert would cause error
    in cmc user-signed [rhel-7.4.z] (cfu)
  - Bugzilla Bug #1487509 - pki-server-upgrade fails when upgrading from
    RHEL 7.1 [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1490241 - PKCS12: upgrade to at least AES and SHA2 (FIPS)
    [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1491332 - TPS UI: need to display tokenType and tokenOrigin
    for token certificates on TPS UI Server [rhel-7.4.z] (edewata)
  - dogtagpki Pagure Issue #2764 - py3: pki.key.archive_encrypted_data:
    TypeError: ... is not JSON serializable (ftweedal)
  - ##########################################################################
  - RHCS 9.2:
  - ##########################################################################
  - Resolves: rhbz #1486870,1485833,1487509,1490241,1491332,1482729,1462271
  - Bugzilla Bug #1462271 - TPS incorrectly assigns "tokenOrigin" and
    "tokenType" certificate attribute for recovered certificates. (cfu)
  - Bugzilla Bug #1482729 - TPS UI: need to display tokenType and tokenOrigin
    for token certificates on TPS UI (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-16
changelog:
  - ###########################################################################
  - ## RHCS 9.2
  - ###########################################################################
  - #Bugzilla Bug #1439228 - externalRegRecover does not support multiple
    - #Bugzilla Bug #1507160 - TPS new configuration to allow the protocol of
    - #Bugzilla Bug #1471996 - Certificate Revocation Reasons not being updated
    - ###########################################################################
  - ## RHEL 7.4
  - ###########################################################################
  - Bugzilla Bug #1500499 - Certificate Revocation Reasons not being updated
    in some cases [rhel-7.4.z] (cfu)
  - Bugzilla Bug #1502527 - CA cert without Subject Key Identifier causes
    issuance failure [rhel-7.4.z] (ftweedal)
  - Bugzilla Bug #1492560 - ipa-replica-install --setup-kra broken on DL0
    [rhel-7.4.z] (ftweedal)
    NOTE: Check-ins for #1492560 all reference the dogtagpki Pagure Issue
          associated with Bugzilla Bug #1402280 - CA Cloning: Failed to
          update number range in few cases (which is not yet fully resolved)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-17
changelog:
  - ###########################################################################
  - ## RHCS 9.2
  - ###########################################################################
  - #Bugzilla Bug #1507160 - TPS new configuration to allow the protocol of


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-5
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage
    (jmagne)
  - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to
    setup with CMC signed certificates (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-6
changelog:
  - Updated jss, nuxwdog, and openssl dependencies
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in
    few cases (ftweedal)
  - Bugzilla Bug #1428021 - CC: shared token storage and retrieval
    mechanism (cfu)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false
    would cause error (cfu)
  - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog
     (alee)
  - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during
    pkispawn (alee)
  - Bugzilla Bug #1520526 - p12 admin certificate is missing when
    certificate is signed Externally (edewata)
  - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA
     instance (alee)
  - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to
    missing nextupdate field (ftweedal)
  - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen)
  - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords
    in several different files after installation completes (alee)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-7
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and
    audit event logging at startup (jmagne)
  - Bugzilla Bug #1523410 -  Unable to have non "pkiuser" owned CA instance
    (alee)
  - Bugzilla Bug #1525306 - CC: missing CMC request and response record
    (cfu)
  - Bugzilla Bug #1532933 - Installing subsystems with external CMC
    certificates in HSM environment shows import error (edewata)
  - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm
    (edewata)
  - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers
    permitted in fips mode (mharmsen)
  - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED
    outcomes. (edewata)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown
    revRequest.issuer (cfu)
  - Bugzilla Bug #1541853 - ProfileService: config values with
    backslashes have backslashes removed (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit
    - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-8
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1542210 - pki console configurations that involves ldap
    passwords leave the plain text password in debug logs (jmagne)
  - Bugzilla Bug #1543242 - Regression in lightweight CA key replication
    (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-9
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata)
  - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM
    and FIPS (edewata)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-10
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1550581 - CMCAuth throws
    org.mozilla.jss.crypto.TokenException: Unable to insert certificate into
    temporary database [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration
    and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers
    [rhel-7.5.z] (cheimes, mharmsen)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry
    in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled
    by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives
    StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1558919 - Not able to generate certificate request
    with ECC using pki client-cert-request [rhel-7.5.z] (akahat)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-11
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-12
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest,
    CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1572548 - IPA install with external-CA is failing when
    FIPS mode enabled. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue
    with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs
    improvement [rhel-7.5.z] (jmagne)
  - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in
    pkispawn configuration step [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong
    input class_id [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System
    9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-13
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd
    entry in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1585945 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1587826 - ExternalCA: Installation failed during
    csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor)
  - Bugzilla Bug #1588944 - Cert validation for installation with
    external CA cert [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access [rhel-7.5.z] (ftweedal, cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-14
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - Updated "tomcatjss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1593585 - Need proper default subjectDN for CMC request
    authenticated through SharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1594128 - CMC: Audit Events needed for failures in
    SharedToken scenario's [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1595606 - AuditVerify failure due to line breaks
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1596525 - Address ECC profile overrides [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1596551 - X500Name.directoryStringEncodingOrder overridden
    by CSR encoding [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a
    certifcate [rhel-7.5.z] (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-15
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1600905 - pki console configurations that involves ldap
    passwords leave the plain text password in signed audit logs
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1611245 - Certificate generation happens with partial
    attributes in CMCRequest file [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1611250 - Better understanding of
    NSS_USE_DECODED_CKA_EC_POINT for ECC [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1612880 - CMC Revocations throws exception with
    same reqIssuer & certissuer [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1614837 - ipa-replica-install --setup-kra broken on
    DL0 with latest version [rhel-7.5.z] (abokovoy)
  - Bugzilla Bug #1614839 - CC: Enable all config audit events
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1615266 - ECC keys not supported for signing audit
    logs [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1539933 - keyGen fails when only Identity


author: Dogtag Team <pki-devel@redhat.com> 10.5.0-1
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-7
changelog:
  - Require "tomcatjss >= 7.2.1-8" as a build and runtime requirement
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1632116 - CC: missing audit event for CS acting as
    TLS client [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632120 - Unsupported RSA_ ciphers should be
    removed from the default ciphers list [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632615 - Permit certain SHA384 FIPS ciphers to be
    enabled by default for RSA and ECC . . . [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1632616 - X500Name.directoryStringEncodingOrder
    overridden by CSR encoding (coverity changes) [rhel-7.6.z] (mharmsen)
  - Bugzilla Bug #1633104 - CMC: add config to allow non-clientAuth
    [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1636490 - Installation of CA using an existing CA fails
    [rhel-7.6.z] (edewata)
  - Bugzilla Bug #1643878 - pki cli command for RHCS doesn't prompt for
    a password [rhel-7.6.z] (edewata)
  - Bugzilla Bug #1643879 - CC: Identify version/release of pki-ca, pki-kra,
    pki-ocsp, pki-tks, and pki-tps remotely [RHEL] [rhel-7.6.z] (cfu, jmagne)
  - Bugzilla Bug #1643880 - PKI subsystem process is not shutdown when
    there is no space on the disk to write logs [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-8
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1645262 - pkidestroy may not remove all files [rhel-7.6.z]
    (dmoluguw)
  - Bugzilla Bug #1645263 - Auth plugins leave passwords in the access
    log and audit log using REST [rhel-7.6.z] (dmoluguw)
  - Bugzilla Bug #1645429 - pkispawn fails due to name collision with
    /var/log/pki/<instance> [rhel-7.6.z] (dmoluguw)
  - Bugzilla Bug #1655951 - CC: tools supporting CMC requests output
    keyID needs to be captured in file [rhel-7.6.z] (cfu)
  - Bugzilla Bug #1656297 - Unable to install with admin-generated keys
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-9
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1657922 - CC: CA/OCSP startup fail on SystemCertsVerification
    if enableOCSP is true [rhel-7.6.z] (jmagne)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-10
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1659939 - CC: Simplifying Web UI session timeout
    configuration [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,
    - # Added Batch Update Information to Product Version (mharmsen)


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-11
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1671245 - CC: unable to verify cert before import
    [rhel-7.6.z] (ascheel)
  - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL)
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-13
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1671245 - CC: unable to verify cert before import
    [rhel-7.6.z] [manpage] (ascheel)
  - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL)
    [rhel-7.6.z] (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-1
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1633422 - Rebase pki-core from 10.5.1 to 10.5.16 (RHEL) 
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-2
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1491453 - Need Method to Include SKI in CA Signing
    Certificate Request [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-3
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1638379 - PKI startup initialization process should not
    depend on LDAP operational attributes [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.16 in RHCS 9.5


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-4
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1743122 - RHCS-9 CA clone SSL server cert not issued with its
    custom SAN extension, RHEL-7.6 and HSM [rhel-7.7.z] (edewata)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-5
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1750277 - CC: missing audit event for CS acting as TLS client
    [rhel-7.7.z] (cfu)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-6
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1754845 - number range depletion when multiple clones
    created from same master (ftweedal)
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-3
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1638379 - PKI startup initialization process should not
    depend on LDAP operational attributes [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-1
changelog:
  - Updated jss, nuxwdog, and tomcatjss dependencies
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1733586 - Rebase pki-core from 10.5.16 to 10.5.17 (RHEL)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1718418 - Update RHCS version of CA, KRA, OCSP, and TKS so
    - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-2
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS
    client (cfu)
  - Bugzilla Bug #1597727 - CA - Unable to change a certificate’s revocation
    reason from superceded to key_compromised (rhcs-maint)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1470410 - TPS doesn't update revocation status when
    - # Bugzilla Bug #1470433 - Add supported transitions to TPS (rhcs-maint)
  - # Bugzilla Bug #1585722 - TMS - PKISocketFactory – Modify Logging to Allow
    - # Bugzilla Bug #1642577 - TPS – Revoked Encryption Certificates Marked as


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-3
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1445479 - KRATool does not support netkeyKeyRecovery
    attribute (dmoluguw)
  - Bugzilla Bug #1534013 - Attempting to add new keys using a PUT KEY APDU
    to a token that is loaded only with the default/factory keys (Key Version
    Number 0xFF) returns an APDU with error code 0x6A88. (jmagne)
  - Bugzilla Bug #1709585 - PKI (test support) for PKCS#11 standard
    AES KeyWrap for HSM support (cfu, ftweedal)
  - Bugzilla Bug #1748766 - number range depletion when multiple clones
    created from same master (ftweedal)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1520258 - TPS token search fails to find entries , LDAP filter
    - # Bugzilla Bug #1535671 - RFE to have the users be able to use the


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-5
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS client
    (cfu)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.17-6
changelog:
  - ##########################################################################
  - # RHEL 7.8:
  - ##########################################################################
  - Bugzilla Bug #1723008 - ECC Key recovery failure with
    CKR_TEMPLATE_INCONSISTENT (cfu)
  - Bugzilla Bug #1774282 - pki-server-nuxwdog template has pid file name with
    non-breakable space char encoded instead of 0x20 space char (ascheel)
  - ##########################################################################
  - # RHCS 9.6:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-3
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu)
  - Bugzilla Bug #1809273 - CRL generation performs an unindexed search (jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1549307 - No default TPS Auditor group (ascheel)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-4
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE
    additional support and touch-up (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1710975 - TPS - Searching the certificate DB for a brand new


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-6
changelog:
  - Patch for CMC Credential Error, RSA PSS typo, and new profile
    for directory-authentication-based Server-Side keygen
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1710109 - add RSA PSS support (jmagne)
  - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-7
changelog:
  - Patch for CMCResponse tool
  - Bugzilla Bug #1710109 - add RSA PSS support - fix CMCResponse tool (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-8
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1883639 - add profile caAuditSigningCert (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1710978 - TPS - Add logging to tdbAddCertificatesForCUID if
    - # Bugzilla Bug #1858860 - TPS - Update Error Codes returned to client
    - # Bugzilla Bug #1858861 - TPS - Server side key generation is not working
    - # Bugzilla Bug #1858867 - TPS does not check token cuid on the user


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-9
changelog:
  - Bugzilla Bug #1883639 - additional support on upgrade for audit
    cert profile and auditProfileUpgrade + auditProfileUpgrade part 2 (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-11
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-12
changelog:
  - Change variable 'TPS' to 'tps'
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-13
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1949136 - PKI instance creation failed with new 389-ds-base
    build (jmagne)
  - Bugzilla Bug 1949656 - CRMF requests with extensions other than SKID cannot
    be processed (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-14
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1911472 - Revoke via REST API not working when Agent
    certificate not issued by CA [rhel-7.9.z] (cfu)
  - Bugzilla Bug 1914587 - RHEL IPA PKI - Failed to read product version
    String.java.io.FileNotFoundException (ckelley)
  - Bugzilla Bug 1942687 - TPS not populating Token Policy, or switching
    PIN_RESET=YES to NO [rhel-7.9.z] (jmagne)
  - Bugzilla Bug 1955633 - Recovery of Keys migrated to latest version of KRA
    fail to recover and result in Null Point Exception [rhel-7.9.z] (jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-15
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission
    per LDAP group without immediate issuance [rhel-7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-16
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu]
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500:
    Non-2xx response from CA REST API: 500 [ftweedale, ckelley]
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1959937 - TPS Allowing Token Transactions while
    the CA is Down [cfu]
  - Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile
    Separation [cfu]


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 9):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-18
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 10):
  - ##########################################################################
  - Bugzillla Bug 1978345 - End Entity's List Certificates Page Back/Forward
    Buttons are Broken (ckelley, jonahon.d.parrish@mail.mil, mharmsen)
  - Bugzilla Bug 2008707 - pkispawn bails out too easily for things that could
    have been worked around after installation [RHEL 7.9.z] (cfu)
  - Bugzilla Bug 2016773 - Directory authentication plugin requires directory
    admin password just for user authentication (rhel-7.9.z)
    (awnuk@purestorage.com, jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-19
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 11):
  - ##########################################################################
  - Bugzilla Bug 1998597 - TPS RA Separation Issues (cfu)
  - Bugzilla Bug 2008319 - PKISpawn with ECC Signing Algorithms fail
    in FIPS Mode (cfu)
  - Bugzilla Bug 2018608 - Invalid certificates with creation of subCA
    (pkispawn single step) [rhel-7.9.0.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-20
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 14):
  - ##########################################################################
  - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
    debug level set to maximum [RHEL 7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-21
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 15):
  - ##########################################################################
  - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
    debug level set to maximum [RHEL 7.9.z] (cfu)
  - Bugzilla Bug #2082717 - SCEP manual approval failure (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-22
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-23
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-24
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-25
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 21):
  - ##########################################################################
  - Bugzilla Bug #2160355 - RA Separation by KeyType - Set Token Status
    [RHCS 9.7 bu 21] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 21):
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-26
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 22):
  - ##########################################################################
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 22):
  - ##########################################################################
  - Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
    a list of tokens [RHCS 9.7] (ckelley)
  - Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
  - Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-27
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 23):
  - ##########################################################################
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 23):
  - ##########################################################################
  - Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
    a list of tokens [RHCS 9.7] (ckelley)
  - Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
  - Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-28
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-29
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.1):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.1):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-30
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.2):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.2):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-31
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.3):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.3):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-32
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.4):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.4):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-1
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug #1774174 - Rebase pki-core from 10.5.17 to 10.5.18 (RHEL)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    - # Bugzilla Bug #1774181 - Update RHCS version of CA, KRA, OCSP, and TKS so


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-1
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1538311 - Using a Netmask produces an odd
    entry in a certifcate (ftweedal)
  - Bugzilla Bug #1544843 - ExternalCA: Installation failed during
    csr generation with ecc (rrelyea, gkapoor)
  - Bugzilla Bug #1557569 - Re-base pki-core from 10.5.1 to latest
    upstream 10.5.x (RHEL) (mharmsen)
  - Bugzilla Bug #1580394 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC (cfu)
  - Bugzilla Bug #1580527 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access (ftweedal, cfu)
  - Bugzilla Bug #1585866 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1588655 - Cert validation for installation with
    external CA cert (edewata)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-2
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1471935 - X500Name.directoryStringEncodingOrder overridden
    by CSR encoding (cfu)
  - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a
    certificate (ftweedal)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1550742 - Address ECC profile overrides (cfu)
  - Bugzilla Bug #1562841 - servlet profileSubmitCMCSimple throws NPE (cfu)
  - Bugzilla Bug #1572432 - AuditVerify failure due to line breaks (cfu)
  - Bugzilla Bug #1592961 - Need proper default subjectDN for CMC request
    authenticated through SharedToken (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-4
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1548203 - pki console configurations that involves ldap
    passwords leave the plain text password in signed audit logs (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1494591 - keyGen fails when only Identity


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-5
changelog:
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #1596629 - ipa-replica-install --setup-kra broken on DL0
    with latest version (abokovoy)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Dogtag Team <pki-devel@redhat.com> 10.5.9-6
changelog:
  - Updated nuxwdog dependencies
  - ##########################################################################
  - # RHEL 7.6:
  - ##########################################################################
  - Bugzilla Bug #673182 - ECC keys not supported for signing
    audit logs (cfu)
  - Bugzilla Bug #1593805 - Better understanding of
    NSS_USE_DECODED_CKA_EC_POINT for ECC (cfu)
  - Bugzilla Bug #1601071 - Certificate generation happens with
    partial attributes in CMCRequest file (cfu)
  - Bugzilla Bug #1601569 - CC: Enable all config audit events
    (cfu)
  - Bugzilla Bug #1608375 - CMC Revocations throws exception
    with same reqIssuer & certissuer (cfu)
  - ##########################################################################
  - # RHCS 9.4:
  - ##########################################################################
  - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.25.20140113
changelog:
  - Read OS string from PRETTY_NAME instead of REDHAT_BUGZILLA_PRODUCT
    again, this time munging it to get rid of parts we want to hide.
    Related: #911553
    Resolves: #1306543


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.26.20140113
changelog:
  - Fix color of text progress bar
    Related: #1167735
  - Fix escape key during media check of live image
    Resolves: #1167735


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.28.20140113
changelog:
  - Don't change file mode of boot.log.  Instead, remember what mode
    the admin set it to.
    Related: #916704
  - Don't unlink boot.log before opening it.
    Related: #916704


author: Ray Strode <rstrode@redhat.com> - 0.8.9-0.29.20140113
changelog:
  - Fall back to text mode if /dev/dri/card0 can't modeset
    Resolves: #1431141
  - Remove unnecessary post scripts that rpm -V output
    Resolves: #1266085


author: Tim Waugh <twaugh@redhat.com> - 1:1.04-19
changelog:
  - Consistent use of macros.
  - Removed ancient obsoletes tag.
  - Clean buildroot in install section not prep section.
  - Make setup quiet.
  - Use noreplace for config files.


author: Richard W.M. Jones <rjones@redhat.com> - 0.44-1
changelog:
  - New upstream version 0.44.
  - Fix incorrect use of File::Temp->tempfile (RHBZ#953066).
  - Tidy up the spec file.
  - po4a-build.conf.5 and po4a-runtime.7 man pages are no longer
    installed in the English version for some (unknown) reason.


author: Richard W.M. Jones <rjones@redhat.com> - 0.44-9
changelog:
  - Fix bang path /usr/bin/env perl -> /usr/bin/perl (RHBZ#987035).
  - Increase verbosity of po4a when building to help diagnose build errors.
  - +BR Pod::Parser.
  - Disable 24-tex.t which does not run and does not produce any
    useful diagnostics either.


author: Petr Lautrbach <plautrba@redhat.com> 2.5-9
changelog:
  - sandbox: create a new session for sandboxed processes - CVE-2016-7545
  - sandbox: do not try to setup directories without -X or -M


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-13
changelog:
  - hll/pp: Fix pp crash when processing base module (#1350806)
  - sepolicy: fix obtaining domain name in HTMLManPages (#1174744)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-14
changelog:
  - Fix export of fcontext socket entries (#1435100)
  - Fix checks whether a module name is passed to semanage-module (#1420527)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-15
changelog:
  - sepolicy: Do not fail when file_contexts.{homedirs,local} are not present (#1395778)
  - fixfiles - use quotes around "$FILEPATH" (#1241946)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-16
changelog:
  - Strip non-printable characters when parsing audit messages (#1406328)
  - Install seobject python module into arch specific path (#1061049)
  - restorecond: Decrease loglevel of termination message (#1422121)
  - semodule_package: do not fail with an empty fc file (#1390535)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-18
changelog:
  - semanage: Enable listing file_contexts.homedirs
  - semanage: Fix manpage author for ibpkey and ibendport pages.
  - semanage: Update man pages for infiniband
  - semanage: Update semanage to allow runtime labeling of ibendports
  - semanage: Update semanage to allow runtime labeling of Infiniband Pkeys
  - semanage: Improve semanage-port man page
  - fixfiles: do not dereference link files in tmp


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-20
changelog:
  - setfiles: Mention customizable types in restorecon man page (#1260238)
  - sepolicy: do not fail when file_contexts.local or .subs do not exist (#1512590)
  - semanage: Fix export of ibendport entries (#1471809)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-22
changelog:
  - semanage: Fix fcontext help message (#1499259)
  - semanage: Improve semanage-user.8 man page (#1079946)
  - semodule: Improve man page (#1337192)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-23
changelog:
  - Update translation files and remove empty ones (#1375915)
  - sepolicy: Fix sepolicy manpage (#1509383)
  - semanage/seobject: Fix moduleRecords.modify() (#1408331)
  - semodule: Improve man page and unify it with --help (#1320565)
  - setfiles: Improve description of -d switch (#1271327)
  - sepolgen: Try to translate SELinux contexts to raw (#1356149)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-24
changelog:
  - Stop rejecting SCTP and DCCP in sepolicy.info
  - semanage: Replace bare except with specific one (#1598444)
  - semanage: Fix logger class definition (#1598444)
  - semanage: Stop rejecting aliases in semanage commands (#1544793)
  - sepolicy: Stop rejecting aliases in sepolicy commands (#1600009)
  - semanage: Stop logging loginRecords changes (#1294663)
  - Use file_contexts.local in fixfiles restore (#1559808)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-30
changelog:
  - semanage/seobject: Fix listing boolean values (#1391605)
  - sepolicy: Make policy files sorting more robust
  - semanage: Fix setting alternative policy store (#1558033)
  - semanage: Load a store policy and set the store SELinux policy root
  - sepolicy: Add sepolicy.load_store_policy(store)
  - semanage: import sepolicy only when it's needed
  - semanage: move valid_types initialisations to class constructors
  - semanage/seobject: Fix indentation issues
  - scripts/fixfiles: Do not fail on file_contexts.local (#1647714)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-31
changelog:
  - semanage: Start exporting "ibendport" and "ibpkey" entries (#1657196)
  - semanage: Do not show "None" levels when using a non-MLS policy (#1400482)
  - semanage: Include MCS/MLS range when exporting local customizations (#1400482)


author: Miloslav Trmač <mitr@redhat.com> - 0.112-12
changelog:
  - Fix a memory leak in PolkitPermission.
    Patch by Rui Matos <tiagomatos@gmail.com>
    Resolves: #1433915


author: Rex Dieter <rdieter@fedoraproject.org> 0.99.0-3
changelog:
  - patch to bring polkit auth dialog to front
  - patch restart polkit-kde on crash 
  - patch to remove unimplimented 'remember authorization' checkbox


author: Miloslav Trmač <mitr@redhat.com> - 0.1-2
changelog:
  - Add a comment above License about SRPM-only licenses
  - Reword Summary: to avoid a rpmlint warning
  - Move INSTALL= to the %install section


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-33
changelog:
  - Only embed mime data for gray/rgb/cmyk colorspaces
  - if image decode map is identity
  - Resolves: #1636103


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-38
changelog:
  - Constrain number of cycles in rescale filter
  - Compute correct coverage values for box filter
  - Resolves: #1688417


author: Panu Matilainen <pmatilai@redhat.com> - 1.13-12
changelog:
  - Hack poptBadOption() to return something semi-meaningful on exec alias
    failures (#697435, #710267)
  - Run internal test-suite on build, minimal as it might be


author: Tim Waugh <twaugh@redhat.com> - 0.0.5-8
changelog:
  - Avoid a race during start-up if there are no configured ports (bug #1034139).
  - Moved tmpfiles configuration file to correct location.
  - Don't use %ghost in manifest for state directory, in order to make
    sure it is ready to use after installation.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.0-2
changelog:
  - Fixed systemd error message regarding chroot-update, patch provided
    by John Heidemann <johnh@isi.edu>
    Resolves: rhbz#917463


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.1-7
changelog:
  - Fixed haproxy with TLS
    Resolves: rhbz#1370455
  - Fixed documentation about canonical maps
    Resolves: rhbz#1381871
  - Fixed build with kernel-4.*
    Resolves: rhbz#1575658


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.10.1-9
changelog:
  - Compiled with USE_LDAP_SASL if both "ldap" and "sasl" options are enabled
    Resolves: rhbz#1733938


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.11-1
changelog:
  - update to 9.2.11 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-11.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.12-1
changelog:
  - update to 9.2.12 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-12.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.13-1
changelog:
  - update to 9.2.13 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-13.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.14-1
changelog:
  - update to 9.2.14 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-14.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Sourav Sharma <sourav.ss.sharma@oracle.com> - 9.2.24-9.0.3
changelog:
  - Fixes CVE-2024-10979 where environment variable mutations [Orabug: 37370704] 
  - are incorrectly allowed from trusted PL/Perl code


author: Tom Lane <tgl@redhat.com> 9.1.901-3
changelog:
  - Change BuildRequires: java-1.6.0-openjdk-devel to just java-devel.
    As of 9.1-901, upstream has support for JDBC4.1, so we don't have to
    restrict to JDK6 anymore, and Fedora is moving to JDK7
  Resolves: #796580


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-4
changelog:
  - don't use removed macro %add_to_maven_depmap (#992816)
  - lint: trim-lines, reuse %{name} macro, fedora-review fixes
  - merge cleanup changes by Stano Ochotnicky


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-6
changelog:
  - fix incompatibility with 9.6+ (rhbz#1547424)
  - it's unnecessary to depend on whole java (rhbz#1406931)


author: Tom Lane <tgl@redhat.com> 09.01.0200-1
changelog:
  - Update to version 09.01.0200
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: <sshedmak@redhat.com> - 1.3.2-1
changelog:
  - Fixed FSType, Preferred Style, UinqueID and Fullname
  - Fixed Invalid Glyph Names reported by fontlint
  - with exceptions string added in License


author: Sandeep Shedmake <sshedmak@redhat.com> - 1.3.3-1
changelog:
  - Added Indian Rupee Sign (U+20B9)
  - Modified URL to fedorahosted.org domain
  - Updated Source0 link
  - Added BuildRequires fontforge
  - Modified doc section


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-5
changelog:
  - Fixed some possible unregistered parameters errors
    (by reg-net-param patch)
    Resolves: rhbz#1014662
  - Unlimit FDs (by unlimit-fds patch)
    Printed friendly error message if the system is running out
    of FDs (by fd-limit-err patch)
    Resolves: rhbz#1017668


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-8
changelog:
  - Fixed buffer overflow in cpufreq tunables on systems with many CPUs
    (by tunable-overflow-fix patch)
    Resolves: rhbz#1080191


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-9
changelog:
  - MSR read errors are no more fatal (by msr-check patch)
    Resolves: rhbz#1102088
  - Backported --auto-tune feature and added one-shot systemd service
    (by auto-tune patch)
    Resolves: rhbz#1143014
  - Improved handling of reporting filenames (by improve-reporting patch)
    Resolves: rhbz#1039822


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3-10
changelog:
  - Reintroduced -d, --dump option and added plain report mode,
    fixed parameters and manual page
    Resolves: rhbz#1333495


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-29
changelog:
  - make radius plugin config parser less strict
  - add creation of dip system group
  - resolves : #906913, #918296


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-30
changelog:
  - don't ship /var/lock/ppp in rpm payload and create it in %post instead
  - fix installation of tmpfiles.d configuration
  - enable hardened build
  - fix bogus dates in changelog
  - compile all binaries with hardening flags
  - fix possible NULL pointer dereferencing


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 2.4.5-34.0.2
changelog:
  - Userland headers should always appear before kernel - [Orabug: 27656836]
    (philip.copeland@oracle.com)


author: Paul Howarth <paul@city-fan.org> 1.7.2-13.2
changelog:
  - Add patch to fix highly-parallel build (e.g. -j16)
  - Add additional compiler warning flags to highlight questionable code
  - Add patch to fix comparisons between signed and unsigned integers
  - Add patch to fix const usage
  - Add patch to fix missing field initializers
  - Add patch to suppress warnings about possibly unused variables
  - Add patch to fix declarations that are not prototypes
  - Add patch to fix warnings about nested externs
  - Add patch to fix dubious typecasts that violate strict-aliasing rules
  - Update the FSF address references and GPLv2 license text
  - Use default optimization level (-O2) again


author: Paul Howarth <paul@city-fan.org> 1.7.2-14
changelog:
  - Build with warning-fix patches to address occasional segfaults (#749455)
  - Patches have all now been merged upstream


author: Paul Howarth <paul@city-fan.org> 1.7.2-17
changelog:
  - Add note in options.pptp about MPPE not being available in FIPS mode
    (#845112)
  - Add note in options.pptp about PPTP with MSCHAP-V2 being insecure


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-7
changelog:
  - Fixing sysinfo - devices with length exceeding 15 chars are not displayed in vmstat -d
  - Resolves: #1169349


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-9
changelog:
  - Fixes showing same cgroups for threads under process by adding format option
  - Resolves: rhbz#1284087


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-10
changelog:
  - Fixes sysinfo - devices with name longer than 20 chars are mistaken for partitions
  - Resolves: rhbz#1169349


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-28
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: manpage line about I/O blocked procs unclear
  - Resolves: rhbz#1624514, rhbz#1796043


author: Kaylin Devchand <kaylin.devchand@oracle.com> - 3.3.10-28.0.1
changelog:
  - ps: remove uptime integer conversion [Orabug: 35834625]
  - ps: improved three elapsed 'jiffies/tics' calculations [Orabug: 35834625]


author: Conrad Meyer <cemeyer@uw.edu> - 2.5.0-2
changelog:
  - Remove changelog history from before 2010
  - This spec already runs autoreconf -fi during %build, but bump build for
    rhbz #926374


author: Adrian Reber <areber@redhat.com> - 1.0.2-1
changelog:
  - new upstream release
  - split off protoc-c into protobuf-c-compiler to reduce runtime
    dependencies of the main package


author: Jaromir Capik <jcapik@redhat.com> - 22.20-6
changelog:
  - Fixing null pointer dereference introduced with namespaces
  - Fixing bogus dates in the changelog
  - Related: rhbz#980514


author: Jan Rybar <jrybar@redhat.com> 22.20-13
changelog:
  - fuser manpage: note about invisible other PIDs moved to RESTRICTIONS section
  - Resolves: rhbz#1400126


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.7-19
changelog:
  - Build with -D_FILE_OFFSET_BITS=64 to get stat64 in pth_high.c
  - Guard the ARM CFLAGS sed substitution.


author: Wim Taymans <wtaymans@redhat.com> - 6.0-4
changelog:
  - Add more Requires to avoid testing multiple versions
  - enable hardened build
  - Fix missing %endif
  - Resolves: #1174548


author: Rex Dieter <rdieter@fedoraproject.org> - 6.0-7
changelog:
  - better autostart.patch, handle case were autospawn is disabled
    (or otherwise doesn't work, like for root user)
  - Resolves: #1269104


author: Wim Taymans <wtaymans@redhat.com> - 10.0-4
changelog:
  - Add support for usb audio in the Dell dock TB16
  - Add patches to improve default sinks
  - Resolves: #1457385


author: Tomáš Mráz <tmraz@redhat.com> - 0.13-6
changelog:
  - Check for error returns which cause segfaults in FIPS mode
  - Fix missing error check and leak found by gcc-with-cpychecker (#800086)


author: Tomáš Mráz <tmraz@redhat.com> - 0.13.1-1
changelog:
  - new upstream release fixing a security issue with string
    formatting subjectAltName of a certificate


author: Tomáš Mráz <tmraz@redhat.com> - 0.13.1-4
changelog:
  - fix various testsuite failures
  - fix exception propagation from private key passphrase callback (#1227505)
  - add optional digest parameter to CRL.export method (#1523772)


author: John (J5) Palmieri <johnp@redhat.com> - 2.28.6-2
changelog:
  - disable introspection in anticipation of pygobject3
  - https://bugzilla.redhat.com/show_bug.cgi?id=731851
  - pygobject2 now becomes legacy for static binding support (e.g. PyGTK)


author: Colin Walters <walters@redhat.com> - 2.28.6-8
changelog:
  - Add various missing BuildRequires, switch to pkgconfig() syntax
  - Backport upstream patch which fixes a crasher in some applications


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.3-1
changelog:
  - New upstream release
  - Build a python3 subpackage
  - Run the test suite even though we ignore the output


author: Miloslav Trmač <mitr@redhat.com> - 0.3-5
changelog:
  - Disable -fstrict-aliasing (see http://www.python.org/dev/peps/pep-3123/ for
    rationale)
  - Don't ship .pyc files from the test suite in %doc, to avoid multilib
    conflicts


author: Chris Lumens <clumens@redhat.com> - 1.99.66.4-1
changelog:
  - transifex-client is no longer needed to build. (clumens)
  - Add kickstart docs to the source tree (clumens)
  - Add options for LVM cache specs to the 'logvol' command (vpodzime)


author: Chris Lumens <clumens@redhat.com> - 1.99.66.5-1
changelog:
  - Reorder the expected output in the clearpart CDL test. (clumens)
  - Fix whitespace error in clearpart --cdl test (#1232849) (sbueno+anaconda)
  - Add clearpart --cdl option. (#1232849) (sbueno+anaconda)
  - Avoid polluting generated kickstarts by unexpected reqpart commands (#1164660) (mkolman)
  - Don't allow using --fsprofile and --mkfsopts at the same time. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.99.66.7-1
changelog:
  - Add sshkey command to RHEL7 (#1311755) (bcl)
  - Add --sshkey to sshpw command (#1240410) (bcl)
  - Add %pre-install section to be used after mounting filesystems (bcl)
  - There is no F7_Key class - use RHEL5_Key instead. (clumens)
  - ostree repos can only be HTTP or HTTPS. (clumens)
  - Fix class inheritance in RHEL6_VolGroup (ccoyle)


author: Chris Lumens <clumens@redhat.com> - 1.99.66.11-1
changelog:
  - Document %traceback and %onerror. (clumens)
    Related: rhbz#1412538
  - Add an %onerror script section. (clumens)
    Related: rhbz#1412538
  - Add more test coverage around Group and Script objects. (clumens)
    Related: rhbz#1412538
  - Add --nohome option to autopart command. (#141) (vponcova)
    Related: rhbz#663099
  - Add --chunksize option to raid command. (#140) (vponcova)
    Related: rhbz#1332316


author: Chris Lumens <clumens@redhat.com> - 1.99.66.12-1
changelog:
  - Add documentation for the snapshot feature (jkonecny)
    Related: rhbz#1113207
  - Add tests for a new snapshot command (jkonecny)
    Related: rhbz#1113207
  - Add support of --when param to snapshot command (jkonecny)
    Related: rhbz#1113207
  - Add new snapshot KS command (jkonecny)
    Related: rhbz#1113207


author: EL Errata <el-errata_ww@oracle.com> - 1.99.66.12-1.0.1
changelog:
  - Make sure version is output properly for OL6/7 [bug 20440019]
  - Alter tools to recognize OL6 and OL7 version strings [bug 20440019]
  - enable oracle linux handlers


author: Chris Lumens <clumens@redhat.com> - 1.99.66.14-1
changelog:
  - Add timeout and retries options to %packages section (#1482912) (vponcova)
  - Add command hmc to support SE/HMC file access (#1498829) (vponcova)
  - Add tests for method command (vponcova)
  - Rewrite the method command. (vponcova)


author: Chris Lumens <clumens@redhat.com> - 1.99.66.15-1
changelog:
  - Fix import in the mount command (vponcova)
    Related: rhbz#1450922
  - Add a new 'mount' command (vpodzime)
    Related: rhbz#1450922


author: Chris Lumens <clumens@redhat.com> - 1.99.66.18-1
changelog:
  - Add tests for the new firewall option. (clumens)
    Related: rhbz#1526486
  - Use RHEL7_Firewall instead of F28_Firewall. (clumens)
    Related: rhbz#1526486
  - Port the F20 firewall test from master. (clumens)
    Related: rhbz#1526486
  - firewall: add --use-system-defaults arg to command (dusty)
    Resolves: rhbz#1526486


author: David Cantrell <dcantrell@redhat.com> - 1.99.66.19-1
changelog:
  - Add use action to nvdimm command. (rvykydal)
    Resolves: rhbz#1590319
  - Add nvdimm command (rvykydal)
    Resolves: rhbz#1590319


author: EL Errata <el-errata_ww@oracle.com> - 1.99.66.21-1.0.1
changelog:
  - Make sure version is output properly for OL6/7 [Orabug: 20440019]
  - Alter tools to recognize OL6 and OL7 version strings [Orabug: 20440019]
  - enable oracle linux handlers


author: Brian C. Lane <bcl@redhat.com> - 1.99.66.22-1
changelog:
  - travis-ci: Install libgnutls28-dev for pycurl (bcl)
    Related: rhbz#1790572
  - Switch to using Weblate for translations (bcl)
    Resolves: rhbz#1790572
  - po: Remove pykickstart.pot (bcl)
    Related: rhbz#1790572


author: David Cantrell <dcantrell@redhat.com> - 1:3.9-9
changelog:
  - Disable python-coverage tests on s390x
    Related: rhbz#1057626
  - Fix python-coverage tests (some disabled that are not working)
    Resolves: rhbz#1057626


author: David Cantrell <dcantrell@redhat.com> - 1:3.9-14
changelog:
  - Update URLs to point to github.com since that's where upstream lives
    these days
    Resolves: rhbz#1502389


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-52
changelog:
  - Workaround Python's threading library issue with non returning wait, for signals with timeout
  Resolves: rhbz#1368076


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-57
changelog:
  - Fix implicit declaration warnings of functions added by patches 147 and 265
  Resolves: rhbz#1441237


author: Petr Viktorin <pviktori@redhat.com> - 2.7.5-63
changelog:
  - Make it more likely for the system allocator to release free()d memory arenas
  Resolves: rhbz#1468410


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-65
changelog:
  - Fix hanging of all threads when trying to access an inaccessible NFS server.
  Resolves: rhbz#1520068


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-68
changelog:
  - Add Conflicts tag with old virtualenv versions due to new behaviour of
    httplib (patch 295)
  Resolves: rhbz#1483438


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-71
changelog:
  - Limit the number of CPU cores when building the package on power architectures
  Resolves: rhbz#1568974


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-72
changelog:
  - Fix CVE-2018-1060 and CVE-2018-1061
  Resolves: rhbz#1563454 and rhbz#1549192
  - Provide python2-libs from the python-libs subpackage
  Resolves: rhbz#1557460


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-74
changelog:
  - Fix OSERROR 17 due to _multiprocessing/semaphore.c assuming
    a one-to-one Pid -> process mapping
  Resolves: rhbz#1579432


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-79
changelog:
  - Moved the macros.python/2 files into their own packages python/2-rpm-macros
  Resolves: rhbz#1679221


author: Victor Stinner <vstinner@redhat.com> - 2.7.5-80
changelog:
  - Security fix for CVE-2019-5010: crash on parsing a specially crafted X509 certificate
    (resolves: rhbz#1666788)


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-91
changelog:
  - Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
  - Test fixes for the latest expat security release
  - Update the certificates utilized in the test suite
  Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494


author: Matt Domsch <mdomsch@fedoraproject.org> - 0.70-1
changelog:
  - Version 0.70 (2009-10-29)
    * New "major" version because it may break compatibility
    * Fix __cmp__(): IP('0.0.0.0/0') and IP('0.0.0.0') are not equal
    * Fix IP.net() of the network "::/0": "::" instead of "0.0.0.0".
      IPy 0.63 should fix this bug, but it wasn't.


author: Matt Domsch <mdomsch@fedoraproject.org> - 0.75-1
changelog:
  - Version 0.75 (2011-04-12)
   * IP('::/0').netmask() gives IP('::') instead of IP('0.0.0.0') (BZ#690625)
   * Fix tests for Python 3.1 and 3.2
   * ip.__nonzero__() and (ipa in ipb) return a bool instead of 0 or 1
   * IP('0.0.0.0/0') + IP('0.0.0.0/0') raises an error, fix written by Arfrever
   * Support Python 3: setup.py runs 2to3
   * Update the ranges for IPv6 IPs
   * Fix reverseName() and reverseNames() for IPv4 in IPv6 addresses
   * Drop support of Python < 2.5
   * Include examples and MANIFEST.in in source build (add them to MANIFEST.in)
   * Remove __rcsid__ constant from IPy module
   * Use xrange() instead of range()
   * Use isinstance(x, int) instead of type(x) == types.IntType
   * Prepare support of Python3 (use integer division: x // y)
   * Fix IP(long) constructor: ensure that the address is not too large
   * Constructor raise a TypeError if the type is not int, long, str or unicode
   * 223.0.0.0/8 is now public (belongs to APNIC)


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 2.0.0-2
changelog:
  - Use python2- prefix for Fedora dependencies if possible
  - Use parallel make to build documentation


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.0.0-3
changelog:
  - Remove examples-directory from Source tarball due to possible
    licensing issues
  - Append python-keyring bundled directory to search path where needed

    Resolves: rhbz#1511222


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.5.4-1
changelog:
  - Update to 1.5.4
  - Fix for python3 module and anydbm
  - Tried enabling unittests on python3 -- still no joy


author: Robert Kuska <rkuska@redhat.com> - 1.5.4-8
changelog:
  - Change beaker.session to use sha1 instead of md5 because of failures in fips mode
  Resolves: rhbz#996219


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 0.61.15.57-1
changelog:
  - Relax the blivet device name requirements. (dshea)
    Resolves: rhbz#1259491
  - Do not include both size and percent in kickstart logvol cmd. (dlehman)
    Resolves: rhbz#1269124
  - Ignore NVDIMMs at OS installation time. (dlehman)
    Resolves: rhbz#1334448


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 0.61.15.59-1
changelog:
  - Properly calculate thin pool's vgSpaceUsed (vpodzime)
    Related: rhbz#1374499
  - Remove cache and metadata space from pool for an LVRequest (vpodzime)
    Resolves: rhbz#1374499


author: David Lehman <dlehman@redhat.com> - 0.61.15.60-1
changelog:
  - Add a method to regenerate XFS' uuid (vpodzime)
    Related: rhbz#1413942
  - Properly unset mountpoint of a snapshot's format (vpodzime)
    Related: rhbz#1413942
  - Update the snapshot's format's exists flag on creation (vpodzime)
    Related: rhbz#1413942
  - Do not require origin to exist when creating snapshot (vpodzime)
    Resolves: rhbz#1413942
  - Make padding smaller for existing thin pools (vpodzime)
    Resolves: rhbz#1432012
  - Use all ancestors when adding RAID disks to exclusiveDisks (vtrefny)
    Resolves: rhbz#1327463
  - Fix detection of linear MD RAID (vtrefny)
    Resolves: rhbz#1372414
  - Allow custom chunk size specification for MDRaidArrayDevice (vtrefny)
    Resolves: rhbz#1405141
  - Remove the useless method requiredDiskLabelType (vponcova)
    Related: rhbz#1405141
  - FBA DASD should use the msdos disk label type (vponcova)
    Resolves: rhbz#1214407
  - Eliminate mountpoint symlinks when looking for mounted device (vtrefny)
    Resolves: rhbz#1322439


author: David Lehman <dlehman@redhat.com> - 0.61.15.62-1
changelog:
  - Don't pass unused mountpoint dict to preCommitFixup. (dlehman)
    Related: rhbz#1184945
  - Use the default md metadata version for everything except /boot/efi.
    (dlehman)
    Resolves: rhbz#1184945
  - Fix resolve_devspec to fully support raid devices (vponcova)
    Resolves: rhbz#1445723


author: David Lehman <dlehman@redhat.com> - 0.61.15.63-1
changelog:
  - Use the uuid module instead of the uuidgen tool (vpodzime)
    Related: rhbz#1413942
  - Respect thin pool's min size when setting its req_size (vpodzime)
    Resolves: rhbz#1449963
  - Add RAID chunk size to the generated kickstart file (vtrefny)
    Resolves: rhbz#1447343


author: David Lehman <dlehman@redhat.com> - 0.61.15.64-1
changelog:
  - Make sure an LV is deactivated before removal (vpodzime)
    Resolves: rhbz#1456821
  - Make sure the device is setup before formatting it (bcl)
    Resolves: rhbz#1368986
  - Round the recommended thpool metadata size to extents (vpodzime)
    Resolves: rhbz#1456528


author: David Lehman <dlehman@redhat.com> - 0.61.15.65-1
changelog:
  - Autoset metadata size on percent-based thin pools (vpodzime)
    Resolves: rhbz#1463198
  - Do not try to autoset MD size on a thin pool with no size (vpodzime)
    Related: rhbz#1463198


author: EL Errata <el-errata_ww@oracle.com> - 0.61.15.65-1.0.1
changelog:
  - Check for oracle-release file first when attempting to determine version [bug 18493611] (Kevin Lyons)


author: David Lehman <dlehman@redhat.com> - 0.61.15.66-1
changelog:
  - mkfs.ext4 no longer hangs on confirmation (japokorn)
    Resolves: rhbz#1461459
  - Stop enforcing obsolete limits on partition count. (dlehman)
    Resolves: rhbz#1460668
  - Do not try to use protected disks for autopart (vtrefny)
    Resolves: rhbz#1456409


author: David Lehman <dlehman@redhat.com> - 0.61.15.67-1
changelog:
  - fcoe: remove /etc/fcoe dir if it exists before copying configuration
    (rvykydal)
    Resolves: rhbz#1482512
  - Find and remove stale LVM metadata immediately after creating md array.
    (dlehman)
    Resolves: rhbz#1223564
  - Add ability to specify vg by uuid for vgremove. (dlehman)
    Related: rhbz#1223564


author: David Lehman <dlehman@redhat.com> - 0.61.15.68-1
changelog:
  - Catch lvm metadata lookup failure in md post create. (dlehman)
    Related: rhbz#1223564
    Resolves: rhbz#1543579


author: David Lehman <dlehman@redhat.com> - 0.61.15.70-1
changelog:
  - Deactivate incomplete VGs along with everything else. (dlehman)
    Resolves: rhbz#1554224
  - Work around udev timing issues. (dlehman)
    Resolves: rhbz#1592253
    Resolves: rhbz#1592191
  - nvdimm: don't crash on non-block devices (rvykydal)
    Related: rhbz#1280500
  - Add NVDIMM detection to "addUdevDiskDevice" (vtrefny)
    Related: rhbz#1558942
  - Add 'NVDIMMNamespaceDevice' device representing NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a function for identifying NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a singleton for NVDIMM namespaces management (vtrefny)
    Resolves: rhbz#1558942
  - Backport DependencyGuard from master (vtrefny)
    Related: rhbz#1558942
  - Ignore nvdimm devices unless configured in kickstart (rvykydal)
    Related: rhbz#1280500
  - Do not ignore nvdimm (pmemX) devices (rvykydal)
    Related: rhbz#1280500


author: David Lehman <dlehman@redhat.com> - 0.61.15.71-1
changelog:
  - Remove dependency on libblockdev-nvdimm (vtrefny)
    Resolves: rhbz#1601557
  - Do not try to load NVDIMM plugin on non-x86_64 architectures (vtrefny)
    Related: rhbz#1601557
  - Add version to the LUKS format (vtrefny)
    Resolves: rhbz#1607830


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.72-1
changelog:
  - Install ndctl when NVDIMMs are used. (dlehman)
    Related: rhbz#1600496
  - Escape dots in lvm filter devices (vtrefny)
    Resolves: rhbz#1614039


author: EL Errata <el-errata_ww@oracle.com> - 0.61.15.72-1.0.1
changelog:
  - Check for oracle-release file first when attempting to determine version [bug 18493611] (Kevin Lyons)
  - Add python-six as requirement (Jingdong Lu)


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.73-1
changelog:
  - Use --yes when calling pvresize (vtrefny)
    Related: rhbz#1657000
  - Fix typo in partitioning test cleanup. (dlehman)
    Related: rhbz#1657000
  - Remove selinux test that doesn't do anything meaningful. (dlehman)
    Related: rhbz#1657000
  - Improve parsing of mdadm detail output. (dlehman)
    Related: rhbz#1657000
  - Update btrfs tests to use sufficiently large loop devices. (dlehman)
    Related: rhbz#1657000
  - vfat labels apparently cannot contain lower case characters. (dlehman)
    Related: rhbz#1657000
  - Check label format regardless of mechanism used to set it. (dlehman)
    Related: rhbz#1657000
  - Adapt to presence or absence of python-mock. (dlehman)
    Related: rhbz#1657000
  - Fixed KS forcing zerombr onto RO disk (japokorn)
    Resolves: rhbz#1544425
  - Tell LVM to wipe cachepool metadata when attaching the cachepool (vtrefny)
    Resolves: rhbz#1643531
  - Add dependency on python-six (vtrefny)
    Resolves: rhbz#1647173


author: David Lehman <dlehman@redhat.com> - 0.61.15.74-1
changelog:
  - Handle exceptions raised from parted.Disk ctor. (dlehman)
    Related: rhbz#1677383
  - Recommend DASD disk label for disks with an existing DASD label (vtrefny)
    Resolves: rhbz#1677383


author: EL Errata <el-errata_ww@oracle.com> - 0.61.15.74-1.0.1
changelog:
  - Check for oracle-release file first when attempting to determine version [Orabug: 18493611] (Kevin Lyons)
  - Added bug30138855-remove-upstream-references.patch [Orabug: 30138855]


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.75-1
changelog:
  - Always set default key size to 512 bits for ciphers with XTS mode (vtrefny)
    Resolves: rhbz#1716674


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.76-1
changelog:
  - edd: Fix UnboundLocalError when trying to close fd in collect_mbrs (vtrefny)
    Related: rhbz#1879920
  - Close fd if it fails to read the device (nashok)
    Resolves: rhbz#1879920


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.4.6-4
changelog:
  - Append python-botocore and python-jmespath bundled directories to
    search path where needed

    Resolves: rhbz#1509439


author: Luke Macken <lmacken@redhat.com> - 4.7.0-2
changelog:
  - Merge a bunch of changes from Gareth Armstrong <gareth.armstrong@hp.com>
      - The src zip file should come either from http://www.voidspace.org.uk/
        downloads/ or http://code.google.com/p/configobj/ as the PyPI tarball is
        not complete.  No docs and no test code.
      - Added docs
      - Remove BR on python-setuptools-devel


author: Maurizio Lombardi <mlombard@redhat.com> - 1:1.1.fb23-4
changelog:
  - Fix failure when parsing parameters
  - Add 0003-Fix-failing-to-pasre-par-val-parameters.patch
  - Add 0004-Fix-failing-to-pasre-param-like-cfgstr-par-val.patch


author: Andy Grover <agrover@redhat.com> - 1:1.1.fb9-1
changelog:
  - New upstream release
  - Remove dependency on python-simpleparse in favor of pyparsing
  - Remove BuildRequires


author: Toshio Kuratomi <toshio@fedoraproject.org> - 3.5.3-2
changelog:
  - Patch from upstream for traceback when people use this with python2 and
    python3 in the same directory


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-1
changelog:
  - Update to 1.7.2
  - Disable pytest.deprecated_call() tests
  - Remove versioned pytest
  - Add build requirements pytz


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-1.1
changelog:
  - Ignore errors on OpenSSL's error stack when initializing, fixes RHBZ#1485896
  - Fix parsing of long OIDs, fixes RHBZ#1485898


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-2
changelog:
  - Ignore errors on OpenSSL's error stack when initializing, fixes RHBZ#1402235
  - Add depenency on python-setuptools, fixes RHBZ#1459947
  - Fix parsing of long OIDs, fixes RHBZ#1455755


author: Rahul Sundaram <sundaram@fedoraproject.org> - 1.5-1
changelog:
  - New upstream release
  - Fix UTF8 encoding correctly
  - Drop buildroot, clean, defattr and use macro for Source


author: Slavek Kabrda <bkabrda@redhat.com> - 1.11.1-1
changelog:
  - Rebase to version 1.11.1
  - Remove downstream patch that was merged upstream
  Resolves: rhbz#1112999


author: Slavek Kabrda <bkabrda@redhat.com> - 1.11.1-2.20140901git9329daf
changelog:
  - Rebase to latest upstream commit
  - Remove unnecessary sources and patches
  - Specfile cleanup
  Resolves: rhbz#1112999


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-2
changelog:
  - fix broken link to "Global Module Index", and add a %check, verifying the
  absence of broken links (rhbz#670493)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-2
changelog:
  - make link checking optional, to avoid needing to pull in linkchecker and
  its dependencies (rbhz#823930)


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.10-0.1.20120730svn7490
changelog:
  - Update to snapshot that's supposed to take care of the date directive unicode
    problem in a different way
  - Patch to fix PyXML conflict without using rpm conflicts


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.10-0.5.20120824svn7502
changelog:
  - Rebase to new snapshot with some fixes integrated
  - Reenable one test that I can't replicate the failure with.


author: David Sommerseth <davids@redhat.com> - 0.7-1
changelog:
  - Fixed several memory leaks (commit aa2c20e697af, abc7f912f66d)
  - Improved error checking towards NULL values(commit 4e928d62a8e3)
  - Fixed typo in pethtool --help (commit 710766dc722)
  - Only open a NETLINK connection when needed (commit 508ffffbb3c)
  - Added man page for pifconfig and pethtool (commit 9f0d17aa532, rhbz#638475)
  - Force NETLINK socket to close on fork() using FD_CLOEXEC (commit 1680cbeb40e)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 0.8-2
changelog:
  - Fixed reporting of more IPv4 addresses per interface
  Resolves: rhbz#1027685
  - Make get_active_devices() return IPv6-only devices, too
  Resolves: rhbz#1027678


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.2-1
changelog:
  - Reverted flawed patch for #1051427 (this reintroduces #1052102).
  - Spec cleanup (removed rhel < 7 specific stuff).
  - Update to 2.7.2.
  Resolves: rhbz#1052777


author: Miro Hrončok <mhroncok@redhat.com> - 2.7.2-3
changelog:
  - Replace lambda for 'dict' with dict itself to support all dict constructors
  Resolves: rhbz#1697237


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.2.4-1
changelog:
  - Upstream update 0.2.4
    - Changes i18n.easy_gettext_setup() to return lgettext functions when
      byte strings are requested.


author: Mike Bonnet <mikeb@redhat.com> - 1.0.90-1
changelog:
  - return the contents of the AP_REP message from rd_rep()
  - improved memory handling
  - removed use of KRB_PRIVATE


author: Matthew Barnes <mbarnes@redhat.com> - 0:2.4.15-2
changelog:
  - Add syncrepl_refreshdone() method to SyncreplConsumer class.
    Need by FreeIPA, subsequently accepted upstream.
  - Resolves: rhbz#1122495


author: John Kacur <jkacur@redhat.com> - 0.4.6-3
changelog:
  - procfs-Add-a-__contains__-method-to-dict-classes.patch
  - pidstat-Add-PF_NO_SETAFFINITY-const.patch
  - interrupts-Do-not-refrain-from-parsing-the-irq-affin.patch
  - pidstat-Fix-process_flags-method.patch
  - pidstat-Add-missing-PF_-flags.patch
  - pflags-Add-command-line-utility-to-print-processor-f.patch
  - pidstat-Support-COMM-names-with-spaces.patch
  Resolves: rhbz#1232394


author: Jeffrey Ollie <jeff@ocjtech.us> - 2.3.5-1
changelog:
  - Bugs fixed
  -
  -  * Crash when merging text nodes in element.remove().
  -  * Crash in sax/target parser when reporting empty doctype.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.0-1
changelog:
  - 3.0 (2012-10-08)
  - ================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * End-of-file handling was incorrect in iterparse() when reading from
  -   a low-level C file stream and failed in libxml2 2.9.0 due to its
  -   improved consistency checks.
  -
  - Other changes
  - -------------
  -
  - * The build no longer uses Cython by default unless the generated C files
  -   are missing.  To use Cython, pass the option "--with-cython".  To ignore
  -   the fatal build error when Cython is required but not available (e.g. to
  -   run special setup.py commands that do not actually run a build), pass
  -   "--without-cython".
  -
  -
  - 3.0beta1 (2012-09-26)
  - =====================
  -
  - Features added
  - --------------
  -
  - * Python level access to (optional) libxml2 memory debugging features
  -   to simplify debugging of memory leaks etc.
  -
  - Bugs fixed
  - ----------
  -
  - * Fix a memory leak in XPath by switching to Cython 0.17.1.
  -
  - * Some tests were adapted to work with PyPy.
  -
  - Other changes
  - -------------
  -
  - * The code was adapted to work with the upcoming libxml2 2.9.0 release.
  -
  -
  - 3.0alpha2 (2012-08-23)
  - ======================
  -
  - Features added
  - --------------
  -
  - * The .iter() method of elements now accepts tag arguments like "{*}name"
  -   to search for elements with a given local name in any namespace.  With
  -   this addition, all combinations of wildcards now work as expected:
  -   "{ns}name", "{}name", "{*}name", "{ns}*", "{}*" and "{*}*".  Note that
  -   "name" is equivalent to "{}name", but "*" is "{*}*".  The same change
  -   applies to the .getiterator(), .itersiblings(), .iterancestors(),
  -   .iterdescendants(), .iterchildren() and .itertext() methods,  the
  -   strip_attributes(), strip_elements() and strip_tags() functions as well
  -   as the iterparse() function.
  -
  - * C14N allows specifying the inclusive prefixes to be promoted to
  -   top-level during exclusive serialisation.
  -
  - Bugs fixed
  - ----------
  -
  - * Passing long Unicode strings into the feed() parser interface failed to
  -   read the entire string.
  -
  - Other changes
  - -------------
  -
  -
  - 3.0alpha1 (2012-07-31)
  - ======================
  -
  - Features added
  - --------------
  -
  - * Initial support for building in PyPy (through cpyext).
  -
  - * DTD objects gained an API that allows read access to their
  -   declarations.
  -
  - * xpathgrep.py gained support for parsing line-by-line (e.g.
  -   from grep output) and for surrounding the output with a new root
  -   tag.
  -
  - * E-factory in lxml.builder accepts subtypes of known data
  -   types (such as string subtypes) when building elements around them.
  -
  - * Tree iteration and iterparse() with a selective tag
  -   argument supports passing a set of tags.  Tree nodes will be
  -   returned by the iterators if they match any of the tags.
  -
  - Bugs fixed
  - ----------
  -
  - * The .find*() methods in lxml.objectify no longer use XPath
  -   internally, which makes them faster in many cases (especially when
  -   short circuiting after a single or couple of elements) and fixes
  -   some behavioural differences compared to lxml.etree.  Note that
  -   this means that they no longer support arbitrary XPath expressions
  -   but only the subset that the ElementPath language supports.
  -   The previous implementation was also redundant with the normal
  -   XPath support, which can be used as a replacement.
  -
  - * el.find('*') could accidentally return a comment or processing
  -   instruction that happened to be in the wrong spot.  (Same for the
  -   other .find*() methods.)
  -
  - * The error logging is less intrusive and avoids a global setup where
  -   possible.
  -
  - * Fixed undefined names in html5lib parser.
  -
  - * xpathgrep.py did not work in Python 3.
  -
  - * Element.attrib.update() did not accept an attrib of
  -   another Element as parameter.
  -
  - * For subtypes of ElementBase that make the .text or .tail
  -   properties immutable (as in objectify, for example), inserting text
  -   when creating Elements through the E-Factory feature of the class
  -   constructor would fail with an exception, stating that the text
  -   cannot be modified.
  -
  - Other changes
  - --------------
  -
  - * The code base was overhauled to properly use 'const' where the API
  -   of libxml2 and libxslt requests it.  This also has an impact on the
  -   public C-API of lxml itself, as defined in etreepublic.pxd, as
  -   well as the provided declarations in the lxml/includes/ directory.
  -   Code that uses these declarations may have to be adapted.  On the
  -   plus side, this fixes several C compiler warnings, also for user
  -   code, thus making it easier to spot real problems again.
  -
  - * The functionality of "lxml.cssselect" was moved into a separate PyPI
  -   package called "cssselect".  To continue using it, you must install
  -   that package separately.  The "lxml.cssselect" module is still
  -   available and provides the same interface, provided the "cssselect"
  -   package can be imported at runtime.
  -
  - * Element attributes passed in as an attrib dict or as keyword
  -   arguments are now sorted by (namespaced) name before being created
  -   to make their order predictable for serialisation and iteration.
  -   Note that adding or deleting attributes afterwards does not take
  -   that order into account, i.e. setting a new attribute appends it
  -   after the existing ones.
  -
  - * Several classes that are for internal use only were removed
  -   from the lxml.etree module dict:
  -   _InputDocument, _ResolverRegistry, _ResolverContext, _BaseContext,
  -   _ExsltRegExp, _IterparseContext, _TempStore, _ExceptionContext,
  -   __ContentOnlyElement, _AttribIterator, _NamespaceRegistry,
  -   _ClassNamespaceRegistry, _FunctionNamespaceRegistry,
  -   _XPathFunctionNamespaceRegistry, _ParserDictionaryContext,
  -   _FileReaderContext, _ParserContext, _PythonSaxParserTarget,
  -   _TargetParserContext, _ReadOnlyProxy, _ReadOnlyPIProxy,
  -   _ReadOnlyEntityProxy, _ReadOnlyElementProxy, _OpaqueNodeWrapper,
  -   _OpaqueDocumentWrapper, _ModifyContentOnlyProxy,
  -   _ModifyContentOnlyPIProxy, _ModifyContentOnlyEntityProxy,
  -   _AppendOnlyElementProxy, _SaxParserContext, _FilelikeWriter,
  -   _ParserSchemaValidationContext, _XPathContext,
  -   _XSLTResolverContext, _XSLTContext, _XSLTQuotedStringParam
  -
  - * Several internal classes can no longer be inherited from:
  -   _InputDocument, _ResolverRegistry, _ExsltRegExp, _ElementUnicodeResult,
  -   _IterparseContext, _TempStore, _AttribIterator, _ClassNamespaceRegistry,
  -   _XPathFunctionNamespaceRegistry, _ParserDictionaryContext,
  -   _FileReaderContext, _PythonSaxParserTarget, _TargetParserContext,
  -   _ReadOnlyPIProxy, _ReadOnlyEntityProxy, _OpaqueDocumentWrapper,
  -   _ModifyContentOnlyPIProxy, _ModifyContentOnlyEntityProxy,
  -   _AppendOnlyElementProxy, _FilelikeWriter, _ParserSchemaValidationContext,
  -   _XPathContext, _XSLTResolverContext, _XSLTContext,
  -   _XSLTQuotedStringParam, _XSLTResultTree, _XSLTProcessingInstruction


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.0.1-1
changelog:
  - 3.0.1 (2012-10-14)
  - Bugs fixed
  -
  -  * LP#1065924: Element proxies could disappear during garbage collection
  -    in PyPy without proper cleanup.
  -  * GH#71: Failure to work with libxml2 2.6.x.
  -  * LP#1065139: static MacOS-X build failed in Py3.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.1.0-1
changelog:
  - 3.1.0 (2013-02-10)
  - ==================
  -
  - Features added
  - --------------
  -
  - * GH#89: lxml.html.clean allows overriding the set of attributes that it
  -   considers 'safe'.  Patch by Francis Devereux.
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1104370: ``copy.copy(el.attrib)`` raised an exception.  It now returns
  -   a copy of the attributes as a plain Python dict.
  -
  - * GH#95: When used with namespace prefixes, the  ``el.find*()`` methods
  -   always used the first namespace mapping that was provided for each
  -   path expression instead of using the one that was actually passed
  -   in for the current run.
  -
  - * LP#1092521, GH#91: Fix undefined C symbol in Python runtimes compiled
  -   without threading support.  Patch by Ulrich Seidl.
  -
  - Other changes
  - -------------
  -
  -
  - 3.1beta1 (2012-12-21)
  - =====================
  -
  - Features added
  - --------------
  -
  - * New build-time option ``--with-unicode-strings`` for Python 2 that
  -   makes the API always return Unicode strings for names and text
  -   instead of byte strings for plain ASCII content.
  -
  - * New incremental XML file writing API ``etree.xmlfile()``.
  -
  - * E factory in lxml.objectify is callable to simplify the creation of
  -   tags with non-identifier names without having to resort to getattr().
  -
  - Bugs fixed
  - ----------
  -
  - * When starting from a non-namespaced element in lxml.objectify, searching
  -   for a child without explicitly specifying a namespace incorrectly found
  -   namespaced elements with the requested local name, instead of restricting
  -   the search to non-namespaced children.
  -
  - * GH#85: Deprecation warnings were fixed for Python 3.x.
  -
  - * GH#33: lxml.html.fromstring() failed to accept bytes input in Py3.
  -
  - * LP#1080792: Static build of libxml2 2.9.0 failed due to missing file.
  -
  - Other changes
  - -------------
  -
  - * The externally useless class ``_ObjectifyElementMakerCaller`` was
  -   removed from the module API of lxml.objectify.
  -
  - * LP#1075622: lxml.builder is faster for adding text to elements with
  -   many children.  Patch by Anders Hammarquist.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.2.0-1
changelog:
  - 3.2.0 (2013-04-28)
  - ==================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * LP#690319: Leading whitespace could change the behaviour of the string
  -   parsing functions in ``lxml.html``.
  -
  - * LP#599318: The string parsing functions in ``lxml.html`` are more robust
  -   in the face of uncommon HTML content like framesets or missing body tags.
  -   Patch by Stefan Seelmann.
  -
  - * LP#712941: I/O errors while trying to access files with paths that
  -   contain non-ASCII characters could raise ``UnicodeDecodeError`` instead
  -   of properly reporting the ``IOError``.
  -
  - * LP#673205: Parsing from in-memory strings disabled network access in the
  -   default parser and made subsequent attempts to parse from a URL fail.
  -
  - * LP#971754: lxml.html.clean appends 'nofollow' to 'rel' attributes instead
  -   of overwriting the current value.
  -
  - * LP#715687: lxml.html.clean no longer discards scripts that are explicitly
  -   allowed by the user provided whitelist.  Patch by Christine Koppelt.
  -
  - 3.1.2 (2013-04-12)
  - ==================
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1136509: Passing attributes through the namespace-unaware API of
  -   the sax bridge (i.e. the ``handler.startElement()`` method) failed
  -   with a ``TypeError``.  Patch by Mike Bayer.
  -
  - * LP#1123074: Fix serialisation error in XSLT output when converting
  -   the result tree to a Unicode string.
  -
  - * GH#105: Replace illegal usage of ``xmlBufLength()`` in libxml2 2.9.0
  -   by properly exported API function ``xmlBufUse()``.
  -
  - 3.1.1 (2013-03-29)
  - ==================
  -
  - Features added
  - --------------
  -
  - Bugs fixed
  - ----------
  -
  - * LP#1160386: Write access to ``lxml.html.FormElement.fields`` raised
  -   an AttributeError in Py3.
  -
  - * Illegal memory access during cleanup in incremental xmlfile writer.
  -
  - Other changes
  - -------------
  -
  - * The externally useless class ``lxml.etree._BaseParser`` was removed
  -   from the module dict.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.2.1-1
changelog:
  - 3.2.1 (2013-05-11)
  - ==================
  -
  - Features added
  - --------------
  -
  - * The methods ``apply_templates()`` and ``process_children()`` of XSLT
  -   extension elements have gained two new boolean options ``elements_only``
  -   and ``remove_blank_text`` that discard either all strings or
  -   whitespace-only strings from the result list.
  -
  - Bugs fixed
  - ----------
  -
  - * When moving Elements to another tree, the namespace cleanup mechanism
  -   no longer drops namespace prefixes from attributes for which it finds
  -   a default namespace declaration, to prevent them from appearing as
  -   unnamespaced attributes after serialisation.
  -
  - * Returning non-type objects from a custom class lookup method could lead
  -   to a crash.
  -
  - * Instantiating and using subtypes of Comments and ProcessingInstructions
  -   crashed.


author: pcpa <paulo.cesar.pereira.de.andrade@gmail.com> - 1.2.0-8
changelog:
  - Update fontconfig patch to apply issue found by upstream
  - Update fontconfig patch to apply issue with missing afm fonts (#896182)


author: pcpa <paulo.cesar.pereira.de.andrade@gmail.com> - 1.2.0-10
changelog:
  - Use stix fonts avoid problems with missing cm fonts (#908717)
  - Correct type mismatch in python3 font_manager (#912843, #928326)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.21-1
changelog:
  - New purely textual text interface (vpodzime)
  - Add dumb enableNetwork implementation to GraphicalIntf (vpodzime)
  - Destroy main window after running it (vpodzime)
  - Get rid of the accountManager and use new libreport API (vpodzime)
  - Add a way to override previously registered callback (vpodzime)
  - Allow callbacks marked as attachment only (vpodzime)
  - Add support for callbacks providing additional data (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.22-1
changelog:
  - Some more stuff for ABRT/libreport (#929181) (vpodzime)
  - Tell ABRT we are reporting a Python excetion (vpodzime)
  - Use named tuples instead of our magic tuples (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.23-1
changelog:
  - Use Sphinx syntax for docstrings (vpodzime)
  - Allow a change of the I/O functions (vpodzime)
  - Reword the 'Debug' button warning (#948256) (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.25-1
changelog:
  - Add and use the safe_string module and the SafeStr class (vpodzime)
  - Give translators hint about the cryptic strings (vpodzime)


author: Martin Kolman <mkolman@redhat.com> - 0.25.3-1
changelog:
  - Update translations
    Resolves: rhbz#1688260
  - Switch from Transifex to Zanata for pulling translations (mkolman)
    Related: rhbz#1688260


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.4.16-3
changelog:
  - Bundle python-keyring
  - Append python-keyring bundled directory to search path where needed

    Resolves: rhbz#1511228


author: John Eckersberg <jeckersb@redhat.com> - 0.7.5-1
changelog:
  - New upstream release 0.7.5
  - Updated summary and description to match upstream README
  - Updated URL and source to reflect upstream move to github


author: Jakub Hrozek <jhrozek@redhat.com> - 0.7.5-3
changelog:
  - Do not traceback on invalid IPNetwork input (upstream issues #2, #6, #5, #8)
  - Remove executable bit from documentation files to make rpmlint happy


author: Pavel Vomacka <pvomacka@redhat.com> - 0.7.5-8
changelog:
  - Resolves: #1438668 DNS forwarder address added during IPA installation
    shouldn't add IP-Address '0.0.0.0'


author: David Malcolm <dmalcolm@redhat.com> - 1.1.2-5
changelog:
  - rebuild for https://fedoraproject.org/wiki/Features/Python_3.3
  - disable selftests that fail under 3.3


author: John Dennis <jdennis@redhat.com> - 0.14-1
changelog:
  External Changes:
    -----------------

    The primary enhancements in this version is support of certifcate
    validation, OCSP support, and support for the certificate "Authority
    Information Access" extension.

    Enhanced certifcate validation including CA certs can be done via
    Certificate.verify() or Certificate.is_ca_cert(). When cert
    validation fails you can now obtain diagnostic information as to why
    the cert failed to validate. This is encapsulated in the
    CertVerifyLog class which is a iterable collection of
    CertVerifyLogNode objects. Most people will probablby just print the
    string representation of the returned CertVerifyLog object. Cert
    validation logging is handled by the Certificate.verify() method.
    Support has also been added for the various key usage and cert type
    entities which feature prominently during cert validation.


    * Certificate() constructor signature changed from

      Certificate(data=None, der_is_signed=True)

      to

      Certificate(data, certdb=cert_get_default_certdb(), perm=False, nickname=None)

      This change was necessary because all certs should be added to the
      NSS temporary database when they are loaded, but earlier code
      failed to to that. It's is not likely that an previous code was
      failing to pass initialization data or the der_is_signed flag so
      this change should be backwards compatible.

    * Fix bug #922247, PKCS12Decoder.database_import() method. Importing into
      a NSS database would sometimes fail or segfault.

    * Error codes and descriptions were updated from upstream NSPR & NSS.

    * The password callback did not allow for breaking out of a password
      prompting loop, now if None is returned from the password callback
      the password prompting is terminated.

    * nss.nss_shutdown_context now called from InitContext destructor,
      this assures the context is shutdown even if the programmer forgot
      to. It's still best to explicitly shut it down, this is just
      failsafe.

    * Support was added for shutdown callbacks.

    * The following classes were added:
      - nss.CertVerifyLogNode
      - nss.CertVerifyLog
      - error.CertVerifyError (exception)
      - nss.AuthorityInfoAccess
      - nss.AuthorityInfoAccesses


    * The following class methods were added:
      - nss.Certificate.is_ca_cert
      - nss.Certificate.verify
      - nss.Certificate.verify_with_log
      - nss.Certificate.get_cert_chain
      - nss.Certificate.check_ocsp_status
      - nss.PK11Slot.list_certs
      - nss.CertVerifyLogNode.format_lines
      - nss.CertVerifyLog.format_lines
      - nss.CRLDistributionPts.format_lines

    * The following class properties were added:
      - nss.CertVerifyLogNode.certificate
      - nss.CertVerifyLogNode.error
      - nss.CertVerifyLogNode.depth
      - nss.CertVerifyLog.count

    * The following module functions were added:
      - nss.x509_cert_type
      - nss.key_usage_flags
      - nss.list_certs
      - nss.find_certs_from_email_addr
      - nss.find_certs_from_nickname
      - nss.nss_get_version
      - nss.nss_version_check
      - nss.set_shutdown_callback
      - nss.get_use_pkix_for_validation
      - nss.set_use_pkix_for_validation
      - nss.enable_ocsp_checking
      - nss.disable_ocsp_checking
      - nss.set_ocsp_cache_settings
      - nss.set_ocsp_failure_mode
      - nss.set_ocsp_timeout
      - nss.clear_ocsp_cache
      - nss.set_ocsp_default_responder
      - nss.enable_ocsp_default_responder
      - nss.disable_ocsp_default_responder

    * The following files were added:
        src/py_traceback.h
        doc/examples/verify_cert.py
        test/test_misc.py

    * The following constants were added:
      - nss.KU_DIGITAL_SIGNATURE
      - nss.KU_NON_REPUDIATION
      - nss.KU_KEY_ENCIPHERMENT
      - nss.KU_DATA_ENCIPHERMENT
      - nss.KU_KEY_AGREEMENT
      - nss.KU_KEY_CERT_SIGN
      - nss.KU_CRL_SIGN
      - nss.KU_ENCIPHER_ONLY
      - nss.KU_ALL
      - nss.KU_DIGITAL_SIGNATURE_OR_NON_REPUDIATION
      - nss.KU_KEY_AGREEMENT_OR_ENCIPHERMENT
      - nss.KU_NS_GOVT_APPROVED
      - nss.PK11CertListUnique
      - nss.PK11CertListUser
      - nss.PK11CertListRootUnique
      - nss.PK11CertListCA
      - nss.PK11CertListCAUnique
      - nss.PK11CertListUserUnique
      - nss.PK11CertListAll
      - nss.certUsageSSLClient
      - nss.certUsageSSLServer
      - nss.certUsageSSLServerWithStepUp
      - nss.certUsageSSLCA
      - nss.certUsageEmailSigner
      - nss.certUsageEmailRecipient
      - nss.certUsageObjectSigner
      - nss.certUsageUserCertImport
      - nss.certUsageVerifyCA
      - nss.certUsageProtectedObjectSigner
      - nss.certUsageStatusResponder
      - nss.certUsageAnyCA
      - nss.ocspMode_FailureIsVerificationFailure
      - nss.ocspMode_FailureIsNotAVerificationFailure

    * cert_dump.py extended to print NS_CERT_TYPE_EXTENSION

    * cert_usage_flags, nss_init_flags now support optional repr_kind parameter

    Internal Changes:
    -----------------

    * Reimplement exception handling
      - NSPRError is now derived from StandardException instead of
        EnvironmentError. It was never correct to derive from
        EnvironmentError but was difficult to implement a new subclassed
        exception with it's own attributes, using EnvironmentError had
        been expedient.

      - NSPRError now derived from StandardException, provides:
        * errno (numeric error code)
        * strerror (error description associated with error code)
        * error_message (optional detailed message)
        * error_code (alias for errno)
        * error_desc (alias for strerror)

      - CertVerifyError derived from NSPRError, extends with:
        * usages (bitmask of returned usages)
        * log (CertVerifyLog object)

    * Expose error lookup to sibling modules

    * Use macros for bitmask_to_list functions to reduce code
      duplication and centralize logic.

    * Add repr_kind parameter to cert_trust_flags_str()

    * Add support for repr_kind AsEnumName to bitstring table lookup.

    * Add cert_type_bitstr_to_tuple() lookup function

    * Add PRTimeConvert(), used to convert Python time values
      to PRTime, centralizes conversion logic, reduces duplication

    * Add UTF8OrNoneConvert to better handle unicode parameters which
      are optional.

    * Add Certificate_summary_format_lines() utility to generate
      concise certificate identification info for output.

    * Certificate_new_from_CERTCertificate now takes add_reference parameter
      to properly reference count certs, should fix shutdown busy problems.

    * Add print_traceback(), print_cert() debugging support.


author: John Dennis <jdennis@redhat.com> - 0.14.0-2
changelog:
  - resolves: bug#1002589
  - resolves: bug#1003979

  - Rewrite setup_certs.py. No longer behaves like an expect script
    which was fragile. By default now creates a sql style database.
  - By default all examples & tests use new sql format for NSS database
  - db-name is now used instead of dbdir to provide distinction between
    the database directory and it's scheme (e.g. 'sql:')
  - all examples and tests now default db-name to 'sql:pki'
  - replaced legacy getopt & optparse command line argument handling
    with modern argparse.


author: John Dennis <jdennis@redhat.com> - 0.14.0-3
changelog:
  - resolves: bug#1003979
  - In coordination with QE with regards to bz 1019934 it was requested
    the unittest patches be enhanced with a more robust version of
    test_pkcs12, no actual bug, just better testing.


author: John Dennis <jdennis@redhat.com> - 0.15.0-1
changelog:
  - resolves: bug#1109769 rebase to 0.15.0
  - includes fixes for 1087031 and 1060314
    See doc/Changelog for details


author: John Dennis <jdennis@redhat.com> - 0.16.0-1
changelog:
  - resolves: bug#1155703 - Add API call for SSL_VersionRangeSet (rebase)
    rebased to 0.16.0
  - The primary enhancements in this version is adding support for the
    setting trust attributes on a Certificate, the SSL version range API,
    information on the SSL cipher suites and information on the SSL connection.

    * The following module functions were added:

      - ssl.get_ssl_version_from_major_minor
      - ssl.get_default_ssl_version_range
      - ssl.get_supported_ssl_version_range
      - ssl.set_default_ssl_version_range
      - ssl.ssl_library_version_from_name
      - ssl.ssl_library_version_name
      - ssl.get_cipher_suite_info
      - ssl.ssl_cipher_suite_name
      - ssl.ssl_cipher_suite_from_name

    * The following deprecated module functions were removed:

      - ssl.nssinit
      - ssl.nss_ini
      - ssl.nss_shutdown

    * The following classes were added:

      - SSLCipherSuiteInfo
      - SSLChannelInfo

    * The following class methods were added:

      - Certificate.trust_flags
      - Certificate.set_trust_attributes

      - SSLSocket.set_ssl_version_range
      - SSLSocket.get_ssl_version_range
      - SSLSocket.get_ssl_channel_info
      - SSLSocket.get_negotiated_host
      - SSLSocket.connection_info_format_lines
      - SSLSocket.connection_info_format
      - SSLSocket.connection_info_str
  	
      - SSLCipherSuiteInfo.format_lines
      - SSLCipherSuiteInfo.format

      - SSLChannelInfo.format_lines
      - SSLChannelInfo.format

    * The following class properties were added:

      - Certificate.ssl_trust_flags
      - Certificate.email_trust_flags
      - Certificate.signing_trust_flags

      - SSLCipherSuiteInfo.cipher_suite
      - SSLCipherSuiteInfo.cipher_suite_name
      - SSLCipherSuiteInfo.auth_algorithm
      - SSLCipherSuiteInfo.auth_algorithm_name
      - SSLCipherSuiteInfo.kea_type
      - SSLCipherSuiteInfo.kea_type_name
      - SSLCipherSuiteInfo.symmetric_cipher
      - SSLCipherSuiteInfo.symmetric_cipher_name
      - SSLCipherSuiteInfo.symmetric_key_bits
      - SSLCipherSuiteInfo.symmetric_key_space
      - SSLCipherSuiteInfo.effective_key_bits
      - SSLCipherSuiteInfo.mac_algorithm
      - SSLCipherSuiteInfo.mac_algorithm_name
      - SSLCipherSuiteInfo.mac_bits
      - SSLCipherSuiteInfo.is_fips
      - SSLCipherSuiteInfo.is_exportable
      - SSLCipherSuiteInfo.is_nonstandard

      - SSLChannelInfo.protocol_version
      - SSLChannelInfo.protocol_version_str
      - SSLChannelInfo.protocol_version_enum
      - SSLChannelInfo.major_protocol_version
      - SSLChannelInfo.minor_protocol_version
      - SSLChannelInfo.cipher_suite
      - SSLChannelInfo.auth_key_bits
      - SSLChannelInfo.kea_key_bits
      - SSLChannelInfo.creation_time
      - SSLChannelInfo.creation_time_utc
      - SSLChannelInfo.last_access_time
      - SSLChannelInfo.last_access_time_utc
      - SSLChannelInfo.expiration_time
      - SSLChannelInfo.expiration_time_utc
      - SSLChannelInfo.compression_method
      - SSLChannelInfo.compression_method_name
      - SSLChannelInfo.session_id

    * The following files were added:

      - doc/examples/cert_trust.py
      - doc/examples/ssl_version_range.py

    * The following constants were added:
      - nss.CERTDB_TERMINAL_RECORD
      - nss.CERTDB_VALID_PEER
      - nss.CERTDB_TRUSTED
      - nss.CERTDB_SEND_WARN
      - nss.CERTDB_VALID_CA
      - nss.CERTDB_TRUSTED_CA
      - nss.CERTDB_NS_TRUSTED_CA
      - nss.CERTDB_USER
      - nss.CERTDB_TRUSTED_CLIENT_CA
      - nss.CERTDB_GOVT_APPROVED_CA
      - ssl.SRTP_AES128_CM_HMAC_SHA1_32
      - ssl.SRTP_AES128_CM_HMAC_SHA1_80
      - ssl.SRTP_NULL_HMAC_SHA1_32
      - ssl.SRTP_NULL_HMAC_SHA1_80
      - ssl.SSL_CK_DES_192_EDE3_CBC_WITH_MD5
      - ssl.SSL_CK_DES_64_CBC_WITH_MD5
      - ssl.SSL_CK_IDEA_128_CBC_WITH_MD5
      - ssl.SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5
      - ssl.SSL_CK_RC2_128_CBC_WITH_MD5
      - ssl.SSL_CK_RC4_128_EXPORT40_WITH_MD5
      - ssl.SSL_CK_RC4_128_WITH_MD5
      - ssl.SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA
      - ssl.SSL_FORTEZZA_DMS_WITH_NULL_SHA
      - ssl.SSL_FORTEZZA_DMS_WITH_RC4_128_SHA
      - ssl.SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA
      - ssl.SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA
      - ssl.TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
      - ssl.TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DHE_DSS_WITH_DES_CBC_SHA
      - ssl.TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
      - ssl.TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DHE_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_DSS_WITH_DES_CBC_SHA
      - ssl.TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_DH_anon_EXPORT_WITH_RC4_40_MD5
      - ssl.TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_DH_anon_WITH_AES_128_CBC_SHA
      - ssl.TLS_DH_anon_WITH_AES_256_CBC_SHA
      - ssl.TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_DH_anon_WITH_DES_CBC_SHA
      - ssl.TLS_DH_anon_WITH_RC4_128_MD5
      - ssl.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_EMPTY_RENEGOTIATION_INFO_SCSV
      - ssl.TLS_FALLBACK_SCSV
      - ssl.TLS_NULL_WITH_NULL_NULL
      - ssl.TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
      - ssl.TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
      - ssl.TLS_RSA_EXPORT_WITH_RC4_40_MD5
      - ssl.TLS_RSA_WITH_3DES_EDE_CBC_SHA
      - ssl.TLS_RSA_WITH_AES_128_CBC_SHA256
      - ssl.TLS_RSA_WITH_AES_128_GCM_SHA256
      - ssl.TLS_RSA_WITH_AES_256_CBC_SHA256
      - ssl.TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
      - ssl.TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
      - ssl.TLS_RSA_WITH_DES_CBC_SHA
      - ssl.TLS_RSA_WITH_IDEA_CBC_SHA
      - ssl.TLS_RSA_WITH_NULL_MD5
      - ssl.TLS_RSA_WITH_NULL_SHA
      - ssl.TLS_RSA_WITH_NULL_SHA256
      - ssl.TLS_RSA_WITH_RC4_128_MD5
      - ssl.TLS_RSA_WITH_RC4_128_SHA
      - ssl.TLS_RSA_WITH_SEED_CBC_SHA
      - ssl.SSL_VARIANT_DATAGRAM
      - ssl.SSL_VARIANT_STREAM
      - ssl.SSL_LIBRARY_VERSION_2
      - ssl.SSL_LIBRARY_VERSION_3_0
      - ssl.SSL_LIBRARY_VERSION_TLS_1_0
      - ssl.SSL_LIBRARY_VERSION_TLS_1_1
      - ssl.SSL_LIBRARY_VERSION_TLS_1_2
      - ssl.SSL_LIBRARY_VERSION_TLS_1_3
      - ssl.ssl2
      - ssl.ssl3
      - ssl.tls1.0
      - ssl.tls1.1
      - ssl.tls1.2
      - ssl.tls1.3

     * The following methods were missing thread locks, this has been fixed.

       - nss.nss_initialize
       - nss.nss_init_context
       - nss.nss_shutdown_context


author: John Dennis <jdennis@redhat.com> - 0.16.0-3
changelog:
  - Resolves: #1225212
    Reads from file like objects actually only worked for file objects
  - Resolves: #1179573
    python-nss-doc package is missing the run_tests script
  - Resolves: #1194349
    test_pkcs12.py does not works in FIPS mode


author: John Dennis <jdennis@redhat.com> - 2.0.1-8
changelog:
  - add missing Obsoletes for prior python-oauthlib package,
    replaced by python2-oauthlib
    Resolves: rhbz#1401784


author: Pavel Cahyna <pcahyna@redhat.com> - 2.1.1-3
changelog:
  - Fix a security flaw (CVE-2018-7750) in Paramiko's server
    mode (emphasis on **server** mode; this does **not** impact *client* use!)
    Backported from 2.1.5.
    Resolves #1557142


author: Pavel Cahyna <pcahyna@redhat.com> - 2.1.1-4
changelog:
  - Add a dependency on python2-pyasn1. It used to be a dependency
    of python2-cryptography, but it is not the case with newer versions.
    (RHBZ #1559133)


author: Jake Hunsaker <jhunsake@redhat.com> - 2.1.1-9
changelog:
  - Fix a security flaw (CVE-2018-1000805) in Paramiko's server
    mode (does not effect client mode).
    Backported from 2.1.6
    Resolves rhbz#1637366


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.7.5.1-3
changelog:
  - Ugh.  Enable unittests and make a note that the python3 module is totally
    non-functional.  Open a bug for that for the actual package maintainers to
    make a decision on.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.7.5.1-4.20111221hg1498
changelog:
  - Tarball is missing files, use a snapshot to get those files and also pick up
    several bug fixes (one related to serving CGI scripts, another for http
    Continue requests, and a third regarding digest authentication and internet
    explorer)


author: Roman Rakus <rrakus@redhat.com> - 2.0.0-12
changelog:
  - Mark doc subpackage arch dependent. Docs are built depending on supported
    features, which are different across archs.
    Resolves: rhbz#987839


author: Charalampos Stratakis <cstratak@redhat.com> - 2.0.0-23gitd1c6db8
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042522


author: Tomas Orsava <torsava@redhat.com> - 9.0.1-12
changelog:
  - Switch macros to bcond's and make Python 2 optional to facilitate building
    the Python 2 and Python 3 modules


author: Miro Hrončok <mhroncok@redhat.com> - 9.0.3-2
changelog:
  - Allow to import pip10's main from pip9's /usr/bin/pip
  - Do not show the "new version of pip" warning outside of venv
  Resolves: rhbz#1569488
  Resolves: rhbz#1571650
  Resolves: rhbz#1573755


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-3
changelog:
  - Converting pip specfile from F28 to RHEL7
  - Disabled building of the Python 2 subpackage
  - Disabled building of docs, because we don't ship its build dependencies in
    RHEL7
  - Updated to a newer version of tests to match the package version
  - Backported Patch3 and Patch4 from Fedora
  Resolves: rhbz#1660573


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-6
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Ralph Bean <rbean@redhat.com> - 0.6.1-1
changelog:
  - New upstream version
  - Added support for python3
  - Included README, COPYING, and CHANGELOG in docs


author: Devrim Gündüz <devrim@gunduz.org> 2.5-1
changelog:
  - Update to 2.5, per changes described at:
    http://www.psycopg.org/psycopg/articles/2013/04/07/psycopg-25-released/


author: Jamie Nguyen <jamielinux@fedoraproject.org> - 0.1.6-1
changelog:
  - update to upstream release 0.1.6
  - update modules to 0.0.4
  - update description
  - add python3-pyasn1 subpackage
  - add versioned Requires for the module subpackages
  - add %check section


author: Eric Smith <brouhaha@fedoraproject.org> 2.09.1-3
changelog:
  - Run _build_tables.py to build the lextab.py and yacctab.py; otherwise
    they have to be regenerated at runtime for no benefit.


author: Eric Smith <brouhaha@fedoraproject.org> 2.09.1-4
changelog:
  - Upstream repository is now on github.
  - Fix rpmlint strange-permission complaint.
  - Rename patches, Source1 to all start with pycparser-{version}, to
    simplify updating patches for future upstream releases.


author: Eric Smith <brouhaha@fedoraproject.org> 2.09.1-5
changelog:
  - Renumbered Fedora-specific Patch1 to Patch100
  - Added new Patch1 to fix table generation when the build system
    already has a python-pycparser package installed.
  - Submitted Patch0 and Patch1 as upstream issues.
  - Added comments about patches.


author: Kamil Dudka <kdudka@redhat.com> - 7.19.0-15
changelog:
  - allow to return -1 from the write callback (#857875) 
  - remove the patch for curl-config --static-libs no longer needed
  - run the tests against the just built pycurl, not the system one


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.15-9
changelog:
  - The libudev library loaded in context to workaround cleanup problems
    Resolves: rhbz#1252833
  - Retry interrupted calls
    Resolves: rhbz#1108921


author: Michel Salim <salimma@fedoraproject.org> - 2.4.1-2
changelog:
  - Clean up spec, removing unnecessary declarations
  - Rename tool in %{_bindir} to the less ambiguous qrcode


author: Ralph Bean <rbean@redhat.com> - 1.1.0-1
changelog:
  - Latest upstream.
  - Relicense to ASL 2.0 with upstream.
  - Removed cookie handling patch (fixed in upstream tarball).
  - Updated cert unbundling patch to match upstream.
  - Added check section, but left it commented out for koji.


author: Ralph Bean <rbean@redhat.com> - 1.1.0-2
changelog:
  - Unbundled python-charade/chardet.  Using system python-chardet now.
  - Removed deprecated comments and actions against oauthlib unbundling.
    Those are no longer necessary in 1.1.0.
  - Added links to bz tickets over Patch declarations.


author: Ralph Bean <rbean@redhat.com> - 1.1.0-3
changelog:
  - Unbundled python-urllib3.  Using system python-urllib3 now.
  - Conditionally include python-ordereddict for el6.


author: Tomas Orsava <torsava@redhat.com> - 2.6.0-7
changelog:
  - Modify tests to run in pytest
  - Add a bcond online_tests to enable the tests
  Related: rhbz#1745417


author: Charalampos Stratakis <cstratak@redhat.com> - 2.6.0-9
changelog:
  - Bring back the requests.packages aliasing of its submodules
  Resolves: rhbz#1785607, rhbz#1785666, rhbz#1785696, rhbz#1787679


author: Charalampos Stratakis <cstratak@redhat.com> - 2.6.0-10
changelog:
  - Fix test_urllib3_retries by having it import urllib3 from the global namespace
  Resolves: rhbz#1771567


author: Tomas Orsava <torsava@redhat.com> - 2.6.0-7
changelog:
  - Modify tests to run in pytest
  - Add a bcond online_tests to enable the tests
  Related: rhbz#1754830


author: Charalampos Stratakis <cstratak@redhat.com> - 2.6.0-9
changelog:
  - Bring back the requests.packages aliasing of its submodules
  Resolves: rhbz#1811050, rhbz#1811057, rhbz#1811107, rhbz#1811113


author: Charalampos Stratakis <cstratak@redhat.com> - 2.6.0-9
changelog:
  - Bring back the requests.packages aliasing of its submodules
  Resolves: rhbz#1811051, rhbz#1811058, rhbz#1811108, rhbz#1811114


author: John Dennis <jdennis@redhat.com> - 0.8.0-5
changelog:
  - BuildRequires had python-requests but the Requires was still referencing
    python2-requests which is not yet provided in RHEL 7.4.,
    also add the missing version dependency on python-requests.
    Resolves: rhbz#1401783


author: Tomas Orsava <torsava@redhat.com> - 4.14.0-1
changelog:
  - Rebase to rpm 4.14.0 final (http://rpm.org/wiki/Releases/4.14.0)
  - Re-synchronize version/release macros with the rpm Fedora package


author: Tomas Orsava <torsava@redhat.com> - 6-2
changelog:
  - Modifying python-rpm-generators from F29 to be used in RHEL7
  - The regex in pythondist.attr has been modified to only match Python 3
    modules, so that we do not affect the building of python2 files in RHEL7 at
    this late stage
  - Removed python.attr and pythondeps.sh files, because they are contained in
    rpm-build in RHEL7 and we do not want to modify them
  - the pythondist.attr and pythondistdeps.py are completely new, therefore we
    don't need to conflict with anything in RHEL7
  Resolves: rhbz#1660578


author: Tomas Orsava <torsava@redhat.com> - 3-28
changelog:
  - Fix the %py_dist_name macro to not convert dots (".") into dashes, so that
    submodules can be addressed as well Resolves: rhbz#1564095


author: Lumír Balhar <lbalhar@redhat.com> - 3-31
changelog:
  - Converting specfile from F28 to RHEL7
  - Move the macros to the standard RHEL7 macro location at /etc/rpm/,
    instead of Fedora's location at /usr/lib/rpm/macros.d/
  - Import the macros.python{,2} files from the python-devel package where they
    resided until now, and Conflict with that old version of python-devel
  - Import the macros.pybytecompile from Fedora rawhide / RHEL8
  Resolves: rhbz#1660579


author: Miro Hrončok <mhroncok@redhat.com> - 3-32
changelog:
  - %python_provide: Obsolete and provide python36- from python3-
  - %python_provide: Provide python3- from python36-
  Resolves: rhbz#1702719


author: David Sloboda <david.x.sloboda@oracle.com> - 2.1.72-1.0.1
changelog:
  - Add patch 0005-allow-mixed-case-in-oracle-iqns to fix [Orabug: 27613482]
  - Add patch 0004-allow-underscore-in-oracle-iqns to fix [Orabug: 27582660]
  - Add patch 0014-reenable-vhost to fix [Orabug: 27707403] <alan.adamson@oracle.com>


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb63-5
changelog:
  - rtslib never creates hba directories without a storage object within it,
    but if under some circumstance these existed then we should remove them.


author: EL Errata <el-errata_ww@oracle.com> - 2.1.fb63-11.0.1
changelog:
  - Add patch 0005-allow-mixed-case-in-oracle-iqns to fix [Orabug: 27613482]
  - Add patch 0004-allow-underscore-in-oracle-iqns to fix [Orabug: 27582660]


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.1.13-1
changelog:
  - Fix "python2-s3transfer" from EPEL issue by adding it to Obsoletes
  - Rebase to v0.1.13 to fix missing "max_bandwidth" issue

    Resolves: rhbz#1576985
    Resolves: rhbz#1578083


author: Arnaldo Carvalho de Melo <acme@redhat.com> - 0.2-1
changelog:
  - Add get_priority_{min,max} methods
  - Add constants for SCHED_{BATCH,FIFO,OTHER,RR}
  - Implement get_priority method
  - Add pchrt utility for testing the bindings, chrt clone
  - Add ptaskset utility for testing the bindings, taskset clone


author: John Kacur <jkacur@redhat.com> - 0.4-5
changelog:
  - Add man pages for pchrt and ptaskset
  - Fix and update usage messages for pchrt and ptaskset
  - Resolves:rhbz#948381


author: John Kacur <jkacur@redhat.com> - 0.4-6
changelog:
  - python-schedutils-Update-URL-in-python-schedutils.sp.patch
  - schedutils.c-added-support-for-SCHED_DEADLINE.patch
  Resolves: rhbz#1298388


author: Bohuslav Kabrda <bkabrda@redhat.com> - 0.8-1
changelog:
  - Switch source from distribute to setuptools, that are now uptodate and supported.
  - Update to setuptools 0.8.0.
  - Specfile cleanup (unnecessary Python 3 logic, old RPM stuff, bogus changelog dates)


author: Nils Philippsen <nils@redhat.com> - 0.2.17-1
changelog:
  - fix default timeouts of None in bus objects (#716620)
  - reduce proxy method calling overhead a bit more


author: Nils Philippsen <nils@redhat.com> - 0.2.19-1
changelog:
  - allow service object methods to be called locally
  - preserve signature, docstrings, etc. of decorated methods


author: Nils Philippsen <nils@redhat.com> - 0.4.0-1
changelog:
  - version 0.4.0:
    - get rid of (ancient) PolicyKit-0.x support
    - add basic (experimental, unstable) dbus introspection support
    - learn to cope with polkitd being restarted


author: Charalampos Stratakis <cstratak@redhat.com> - 0.4.0-3
changelog:
  - Make firewalld to not log errors when running commands as root
  in the absence of polkitd.
  Resolves: rhbz#1393488


author: Charalampos Stratakis <cstratak@redhat.com> - 1.0.13-8
changelog:
  - Fix memory leak in the auth_fn callback.
  - Make sure auth info is NUL-terminated.
  Resolves: rhbz#1248519


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.6-9
changelog:
  - Python 2 binary package renamed to python2-subprocess32
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Marcel Plch <mplch@redhat.com> - 3.2.6-14
changelog:
  - Backport upstream patch for heap overflow when parsing too many arguments
  - Resolves: rhbz#1619386


author: jortel <jortel@redhat.com> - 0.3.7-1
changelog:
  - Better soap header support
  - Added new transport HttpAuthenticated for active (not passive) basic authentication.
  - New options (prefixes, timeout, retxml)
  - WSDL processing enhancements.
  - Expanded builtin XSD type support.
  - Fixed <xs:iniclude/>
  - Better XML date/datetime conversion.
  - Client.clone() method added for lightweight copy of client object.
  - XSD processing fixes/enhancements.
  - Better <simpleType/> by <xs:restriction/> support.
  - Performance enhancements. 
  - Fixed tickets: #65, #232, #233, #235, #241, #242, #244, #247, #254, #254, #256, #257, #258


author: jortel <jortel@redhat.com> - 0.3.8-1
changelog:
  - Includeds Windows NTLM Transport.
  - Add missing self.messages in Client.clone().
  - Changed default behavior for WSDL PartElement to be optional.
  - Add support for services/ports defined without <address/> element in WSDL.
  - Fix sax.attribute.Element.attrib() to find by name only when ns is not specified; renamed to Element.getAttribute().
  - Update HttpTransport to pass timeout parameter to urllib2 open() methods when supported by urllib2.
  - Add null class to pass explicit NULL values for parameters and optional elements.
  - Soap encoded array (soap-enc:Array) enhancement for rpc/encoded.
    Arrays passed as python arrays - works like document/literal now.
    No more using the factory to create the Array.
    Automatically includes arrayType attribute.  Eg: soap-enc:arrayType="Array[2]".
    Reintroduced ability to pass complex (objects) using python dict instead of suds object via factory.
  - Fixed tickets: #84, #261, #262, #263, #265, #266, #278, #280, #282.


author: jortel <jortel@redhat.com> - 0.3.9-1
changelog:
  - Bumped python requires to 2.4
  - Replaced stream-based caching in the transport package with document-based caching.
  - Caches pickled Document objects instead of XML text. 2x Faster!
  - No more SAX parsing exceptions on damaged or incomplete cached files. 
  - Cached WSDL objects. Entire Definitions object including contained Schema object cached via pickle.
  - Copy of soap encoding schema packaged with suds.
  - Refactor Transports to use ProxyHandler instead of urllib2.Request.set_proxy().
  - Added WSSE enhancements <Timestamp/> and <Expires/> support. See: Timestamp token. 
  - Fixed Tickets: #256, #291, #294, #295, #296


author: jortel <jortel@redhat.com> - 0.4-1
changelog:
  - Fix spelling errors in spec description.
  - Fix source0 URL warning.
  - Updated caching to not cache intermediate wsdls.
  - Added DocumentCache which caches verified XML documents as text. User can choose.
  - Added cachingpolicy option to allow user to specify whether to cache XML documents or the WSDL object.
  - Provided for repeating values in reply for message parts consistent with way handled in nested objects.
  - Added charset=utf-8 to stock content-type http header.
  - Added <?xml version="1.0" encoding="UTF-8"?> to outgoing SOAP messages.
  - Detection of faults in successful (http=200) replies and raise WebFault. Search for <soapenv:Fault/>.
  - Add plugins facility. 
  - Fixed Tickets: #251, #313, #314, #334


author: Zdenek Pavlas <zpavlas@redhat.com> - 3.10-0
changelog:
  - clamp timestamps from the future.  BZ 894630, 1013733
  - Fix the condition to enter single-connection mode. BZ 853432
  - Fix unit tests


author: Ralph Bean <rbean@redhat.com> - 1.5-3
changelog:
  - Renamed patches to python-urllib3-*
  - Fixed ssl check patch to use the correct cert path for Fedora.
  - Included dependency on ca-certificates
  - Cosmetic indentation changes to the .spec file.


author: Ralph Bean <rbean@redhat.com> - 1.5-4
changelog:
  - Upstream patch to fix Accept header when behind a proxy.
  - Reorganize patch numbers to more clearly distinguish them.


author: bkabrda <bkabrda@redhat.com> - 1.10.2-2
changelog:
  - Fix the way we unbundle six to make ovirt work even when they remove .py files
  Resolves: rhbz#1247093


author: Toshio Kuratomi <toshio@fedoraproject.org> - 1.9.1-1
changelog:
  - Update to upstream 1.9.1 because of security issues with the bundled
    python-pip in older releases.  This is just a quick fix until a
    python-virtualenv maintainer can unbundle the python-pip package
    see: https://bugzilla.redhat.com/show_bug.cgi?id=749378


author: Tomas Orsava <torsava@redhat.com> - 1.10.1-3
changelog:
  - Added a patch that shows a custom error message when a FILE passed to
    virtualenv to be used as 'home dir' already exists and is NOT a directory.
  Resolves: rhbz#1306513


author: Charalampos Stratakis <cstratak@redhat.com> - 15.1.0-1
changelog:
  - Rebase to version 15.1.0
  - Disable automatic downloads from pypi on new venv creation
  Resolves: rhbz#1461154


author: Lumír Balhar <lbalhar@redhat.com> - 15.1.0-3
changelog:
  - Add three new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1643829


author: Jiri Kucera <jkucera@redhat.com> - 0.3.9-9
changelog:
  - Backport ecef526 (Stop using crypt_get_error)
    Backport 23a1ff0 (Fix nonsensical error messages on missing keys)
    Fix License, URL and Source0 tags
    Resolves: #1502399, #1574988, #1593855, #1454358


author: Lumír Balhar <lbalhar@redhat.com> - 0.31.1-4
changelog:
  - Converting specfile from F29 to RHEL7
  - Disabled building of the Python 2 subpackage
  - Disabled tests (by setting the bootstrap on - see note)
  - Removed python-wheel-wheel package with the wheel of wheel
  Resolves: rhbz#1660574


author: Lumir Balhar & Tomas Orsava <lbalhar@redhat.com> - 3.6.8-2
changelog:
  - Converting F28 python3 specfile to RHEL7
  - Updated the bootstrapping sequence
  - Disabled LTO because of buggy support for it in gcc on RHEL7
  - Removed deprecated system-python and platform-python tags and files
  - Removed a tag from `python3-libs` that recommended the `python3` package,
    because the Recommends tag doesn't work in RHEL7
  - Remove unnecessary unversioned requires on glibc and gdbm
  - Changes from RHEL8:
    - Move macros.pybytecompile to python-rpm-macros
    - Enable test_gdb, test_faulthandler
  - Changes from Fedora:
    - Security fix for CVE-2019-5010 (#1666519, #1666522)
    - Make sure we don't ship any exe files (not needed an prebuilt)
  Resolves: rhbz#1597718


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-4
changelog:
  - Add explicit conflicts with python34 < 3.4.9-3, which was the main python3
    package in EPEL before that version and contained conflicting files,
    e.g. /usr/bin/python3
  Resolves: rhbz#1597718


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-8
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1703535 and rhbz#1704364


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-19
changelog:
  - Security fix for CVE-2023-24329
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2173917


author: EL Errata <el-errata_ww@oracle.com> - 3.6.8-19.0.1
changelog:
  - Remove the "getfile" feature of pydoc [Orabug: 33182027][CVE-2021-3426]
  - Fix buffer overflow in PyCArg_repr [Orabug: 32551171][CVE-2021-3177]
  - Add Oracle Linux distribution in platform.py [Orabug: 20812544]


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-7
changelog:
  - Converting specfile from F28 to RHEL7
  - Tests disabled because the minimal RHEL7 Python 3 stack does not contain test
    dependencies
  - Disabled building of the Python 2 subpackage
  Resolves: rhbz#1660563


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-8
changelog:
  - SRPM renamed from python-setuptools to python3-setuptools
  - Package prepared to contain only Python 3 version
  Resolves: rhbz#1660563


author: Marcin Zajaczkowski <mszpak ATT wp DOTT pl> - 0.5.0-5
changelog:
  - remove prodive/obsolete of python-xattr (bug 781838)
  - fix problem with mixed use of tabs and spaces


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-2.el7
changelog:
  - synchronized with qemu-kvm-rhev-2.3.0-9.el7
  - qemuga-Change-fsreeze-hook-default-location.patch [bz#1210707]
  - qemuga-qga-commands-posix-Fix-bug-in-guest-fstrim.patch [bz#1211973]
  - Resolves: bz#1210707
    (The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)
  - Resolves: bz#1211973
    ('guest-fstrim' failed for guest with os on spapr-vscsi disk)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-3.el7
changelog:
  - qemuga-Do-not-stop-qemu-guest-agent-service-on-target-switc.patch [bz#1160930]
  - Resolves: bz#1160930
    (The guest agent service in rhel7 guest will be stopped after run the init command)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-2.el7
changelog:
  - qemuga-redhat-blacklist-guest-exec-commands.patch [bz#1340346]
  - Resolves: bz#1340346
    (blacklist guest-exec in newer version of qemu-guest-agent)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-3.el7
changelog:
  - qemuga-spec-add-qemu-ga-man-page.patch [bz#1101556]
  - Resolves: bz#1101556
    ([RFE] qemu-ga should have a config file)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.8.0-1.el7
changelog:
  - Rebase to 2.8.0 base [bz#1414676]
  - Resolves: bz#1414676
    (Rebase qemu-guest-agent to 2.8.0 base)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.8.0-2.el7
changelog:
  - qemuga-Remove-unnecessary-dependencies.patch [bz#1441999]
  - Resolves: bz#1441999
    (Clean qemu-ga dependencies)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-1.el7
changelog:
  - Rebase to 2.12.0 base [bz#1562218]
  - Resolves: bz#1562218
    (Rebase qemu-guest-agent for RHEL-7.6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-2.el7
changelog:
  - qemuga-qemu-ga-make-get-fsinfo-work-over-pci-bridges.patch [bz#1567041]
  - qemuga-qga-fix-driver-leak-in-guest-get-fsinfo.patch [bz#1567041]
  - Resolves: bz#1567041
    (qemu-guest-agent does not parse PCI bridge links in "build_guest_fsinfo_for_real_device" (q35))


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.12.0-3.el7
changelog:
  - qemuga-qga-ignore-non-present-cpus-when-handling-qmp_guest_.patch [bz#1611062]
  - qemuga-qemu-guest-agent.spec-add-systemd-devel-dependency.patch [bz#1635571]
  - qemuga-configure-add-test-for-libudev.patch [bz#1635571]
  - qemuga-qga-linux-report-disk-serial-number.patch [bz#1635571]
  - qemuga-qga-linux-return-disk-device-in-guest-get-fsinfo.patch [bz#1635571]
  - Resolves: bz#1611062
    ("virsh vcpucount --guest" fails after hotunplug a vcpu with intermediate order by "setvcpu")
  - Resolves: bz#1635571
    ([RFE] Report disk device name and serial number (qemu-guest-agent on Linux))


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-3.el7
changelog:
  - Allow building qemu-guest-agent on ppc64le
  - Synchronize with qemu-kvm-rhev-2.1.0-3.el7
  - Resolves: bz#1132718
    (qemu-guest-agent fails to build for ppc64le)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.1.0-4.el7
changelog:
  - kvm-Mark-etc-sysconfig-qemu-ga-as-config-noreplace.patch [bz#1150924]
  - Resolves: bz#1150924
    (/etc/sysconfig/qemu-ga is replaced when updated)


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 2.8.0-3.el7
changelog:
  - qemuga-qga-Add-guest-get-host-name-command.patch [bz#1598210]
  - qemuga-qga-Add-guest-get-users-command.patch [bz#1598210]
  - qemuga-qga-Add-guest-get-timezone-command.patch [bz#1598210]
  - qemuga-qemu-ga-check-if-utmpx.h-is-available-on-the-system.patch [bz#1598210]
  - qemuga-qemu-ga-add-guest-get-osinfo-command.patch [bz#1598210]
  - qemuga-test-qga-pass-environemnt-to-qemu-ga.patch [bz#1598210]
  - qemuga-test-qga-add-test-for-guest-get-osinfo.patch [bz#1598210]
  - Resolves: bz#1598210
    (Backport some features to 2.8 in RHEL 7.5 [rhel-7.5.z])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 2.8.0-2.el7_5.1
changelog:
  - Corrected the package version from 2.8.0-3.el7 to 2.8.0-2.el7_5.1
  - Resolves: bz#1598210
    (Backport some features to 2.8 in RHEL 7.5 [rhel-7.5.z])


author: Rex Dieter <rdieter@fedoraproject.org> - 0.0.4-2
changelog:
  - update summary/description/Source_url
  - %files: track soname
  - cleaner cmake-fu
  - upstream noexecstack patch


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 0.0.4-3
changelog:
  - require the main package with exact version-release in -examples
  - remove explicit Requires: qt4-devel pkgconfig from -devel, now autodetected


author: Rex Dieter <rdieter@fedoraproject.org> - 0.7.1-8
changelog:
  - skip stripping some compiler flags (undocumented)
  - %files: track files closer (lib soname in particular)
  - -devel: avoid dep on cmake 
  - %check: +make test, pkgconfig check


author: Doug Ledford <dledford@redhat.com> - 0.4.6-6
changelog:
  - Fix the fact that qperf was using the wrong PF_RDS define now that RDS
    is integrated upstream and its assigned number is no longer temporary


author: Matthieu Saulnier <fantom@fedoraproject.org> - 3.2.0-1
changelog:
  - update to 3.2.0
  - remove BuildRoot tag in spec file
  - remove "rm -rf $RPM_BUILD_ROOT" at the beginning of %install section
  - remove %clean section
  - remove %defattr lines
  - add a joker for libqrencode.so.* files


author: Peter Gordon <peter@thecodergeek.com> - 3.2.0-2
changelog:
  - Add patch to fix improper LIBPTHREAD macro in the pkgconfig file:
    + fix-LIBPTHREAD-macro.patch
  - Resolves: #795582 (qrencode-devel: Malformed pkgconfig file causes build to
    fail ("@LIBPTHREAD@: No such file or directory"))


author: Matthieu Saulnier <fantom@fedoraproject.org> - 3.3.1-1
changelog:
  - update to 3.3.1
  - remove "Group" tag in spec file
  - fix manfile suffix
  - remove patch to fix improper LIBPTHREAD macro in the pkgconfig file:
    - upstream issue


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-12
changelog:
  - Revert upstream fix for QTBUG-15319
    Resolves: bz#1259675
  - Do not use nonstandard linux-g++-aarch64
    Resolves: bz#1291461


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-14
changelog:
  * Mon May 02 2016 Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-13
  - Prefer adwaita-qt theme over gtk
    Resolves: bz#1332094


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-1
changelog:
  - Update to 4.8.7 (+ sync with Fedora)
    Resolves: bz#1484361

  - Don't close Qt apps in Gnome on shutdown dialog
    Resolves: bz#1378865


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-4
changelog:
  - Bump build version for RPM to not consider z-stream build as newer
    Revert fix for font cache check in QFontEngineFT::recalcAdvances()
    Resolves: bz#1684167


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-8
changelog:
  - Fix QImage allocation failure in qgifhandler
    Resolves: bz#1667863

  - Fix QTgaFile CPU exhaustion
    Resolves: bz#1667879

  - Fix QBmpHandler segmentation fault on malformed BMP file
    Resolves: bz#1667862


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-8
changelog:
  - make 10-qt5-check-opengl2.sh xinit script more robust
  - enable journald support for el7+ (#1315239)


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-4
changelog:
  - backport upstream fixes
  - drop -fno-delete-null-pointer-checks hack (included in qt5-rpm-macros as needed now)


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-2
changelog:
  - libwebp security fixes:
    Resolves: bz#1961742
    Resolves: bz#1961743
    Resolves: bz#1961744
    Resolves: bz#1961745


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-6
changelog:
  - obsolete quagga-sysvinit subpackage
  - use macro to specify location where to install tmpfiles configuration file
  - fix rpm scripts handling documentation in info format


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.1-7
changelog:
  - quagga is service which might implement networking, thus it should not have
    WantedBy=network.target in its systemd configuration
  - resolves: #976883


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.3-1
changelog:
  - update to 0.99.22.3
  - disable ospfapi and ospfclient
  - fix bogus dates in changelog
  - resolves : #984532


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.4-4
changelog:
  - fix link to upstream tarball (#1059219)
  - reference pidfiles of quagga daemons in service files (#842309)


author: Ondřej Lysoněk <olysonek@redhat.com> - 0.99.22.4-5
changelog:
  - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing
    certain forms of UPDATE message allowing to crash or potentially execute
    arbitrary code
  - Resolves: rhbz#1546015


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-6
changelog:
  - Add LGPLv2+ and GPLv2 to license declaration
  - Correct changelog dates
  - Package additional LDAP scripts as a documentation
  - Package XFS-specific tools


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-9
changelog:
  - Move /sbin/* files under /usr (bug #983179)
  - Harden executables due to rpc.rquotad and quota_nld daemons (bug #983179)
  - Document quotagrpadmins(5), quotatab(5), warnquota.conf(5), rcp.rquota(8)
    (bug #983179)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-12
changelog:
  - Do not warn if rquotad RPC service is not registered (bug #1155584)
  - Query kernel for next quota on XFS or file system with hidden quota files
    (bug #1305968)
  - Add rpc-rquotad.service file which was known as nfs-rquotad.service
    in nfs-utils (bug #1207239)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-14
changelog:
  - Add nfs-rquotad.service alias for backward compatibility (bug #1207239)
  - Start rpc-rquotad.service when starting nfs-server.service (bug #1207239)


author: Petr Pisar <ppisar@redhat.com> - 1:4.01-18
changelog:
  - Distinguish between none quota limits and no allocated resources in quota(1)
    tool (bug #1601109)


author: William Roche <william.roche@oracle.com> 0.4.1-37.0.1.el7
changelog:
  - ipmitool to be used with AER on Ampere Altra platforms [Orabug: 32744936]
  - Add error handling for Ampere-specific errors. [Orabug: 32744936]
  - Add code to decode Ampere specific error
  - rasdaemon: fix memory leak in parse_ras_data
  - rasdaemon: Fix error print
  - rasdaemon: Modify non-standard error decoding interface using linked list
  - rasdaemon: add closure and cleanups for the database
  - rasdaemon: fix memory leak in ras-events.c:add_event_handler()
  - rasdaemon: fix missing fclose in ras-events.c:select_tracing_timestamp()
  - rasdaemon: update iteration logic for the non-standard error decoding functions
  - parse_ras_data: flush trace buffer immediately, not on next call
  - rasdaemon:print non-standard error data if not decoded
  - libtrace: Fix get_field_str() for dynamic strings
  - rasdaemon: use separate string array for error status
  - rasdaemon: fix PCIe AER error type


author: Honza Horak <hhorak@redhat.com> - 5.8.1-2
changelog:
  - Provides: bundled(gnulib) added, as per #821786
  - minor spec file clean up
  - install-info run in postin/postun


author: Sumit Bose <sbose@redhat.com> - 0.16.1-6
changelog:
  - Resolves: rhbz#1258745
  - Resolves: rhbz#1258488
  - Resolves: rhbz#1267563
  - Resolves: rhbz#1293390
  - Resolves: rhbz#1273924
  - Resolves: rhbz#1274368
  - Resolves: rhbz#1291924


author: Sumit Bose <sbose@redhat.com> - 0.16.1-10
changelog:
  Use current Samba options and read NetBIOS name from keytab
  - Resolves: rhbz#1484072
  - Resolves: rhbz#1370457


author: Sumit Bose <sbose@redhat.com> - 0.16.1-12
changelog:
  Fixes for RHEL-7.9
  - Resolves: rhbz#1625001
  - Resolves: rhbz#1625005
  - Resolves: rhbz#1638396
  - Resolves: rhbz#1714223
  - Resolves: rhbz#1832134


author: Stef Walter <stefw@redhat.com> - 0.16.0-1
changelog:
  - Updated to upstream 0.16.0
  - Resolves: rhbz#1174911
  - Resolves: rhbz#1142191
  - Resolves: rhbz#1142148


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - rear does not require syslinux
  - changing to arch package so that syslinux is installed
  - Resolves: #1283927


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-4
changelog:
  - cd to the correct directory before md5sum to fix BACKUP_INTEGRITY_CHECK.
    Upstream PR#1685, bz1532676


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-6
changelog:
  - Ensure that NetBackup is started automatically upon recovery (PR#1544)
    Also do not kill daemons spawned by sysinit.service at the service's end
    (PR#1610, applies to NetBackup and also to dhclient)
    Resolves #1506231
  - Print a warning if grub2-mkimage is about to fail and suggest what to do.
    bz#1492177
  - Update the patch for #1388653 to the one actually merged upstream (PR1418)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-7
changelog:
  - Backport upstream PR1383: Allow backup to be stored in ISO for ppc64/ppc64le
    Includes also commit 30099a98fdc1eab6373bc3682929bc4b9c09b54b.
    Resolves: #1596182


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-1
changelog:
  - Rebase to version 2.4, drop patches integrated upstream
    Resolves #1534646 #1484051 #1498828 #1571266 #1496518


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-3
changelog:
  - Backport fixes for upstream bugs 1974 and 1975
  - Apply upstream PR1954 (record permanent MAC address for bond members)
  - Apply upstream PR2004 (support for custom network interface naming)
  - Backport fix for upstream bug 1926 (support for LACP bonding and teaming)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-7
changelog:
  - Backport fix for upstream bug 1913 (backup succeeds in case of tar error)
    Resolves: rhbz1631183
  - Apply upstream patch PR1885
    Partition information recorded is unexpected when disk has 4K block size
    Resolves: rhbz1610638
  - Apply upstream patch PR1887
    LPAR/PPC64 bootlist is incorrectly set when having multiple 'prep' partitions
    Resolves: rhbz1610647
  - Apply upstream patch PR1993
    Automatically exclude $BUILD_DIR from the backup
    Resolves: rhbz1655956
  - Require xorriso instead of genisoimage, it is now the preferred method
    and supports files over 4GB in size.
    Resolves: rhbz1462189


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-8
changelog:
  - Backport fix for upstream issue 2187 (disklayout.conf file contains
    duplicate lines, breaking recovery in migration mode or when
    thin pools are used). PR2194, 2196.
    Resolves: rhbz1732328


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-9
changelog:
  - Apply upstream PR2173 - Cannot restore using Bacula method
    due to "bconsole" not showing its prompt
    Resolves: rhbz1726982


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-10
changelog:
  - Apply upstream PR2122: add additional NBU library path to fix support for
    NetBackup 8.
    Resolves: rhbz1700807


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-11
changelog:
  - Apply upstream PR2122: add additional NBU library path to fix support for
    NetBackup 8.
    Resolves: rhbz1700807
  - Apply upstream PR212: Be safe against empty docker_root_dir (issue 1989)
    Resolves: rhbz1711123, where ReaR can not create a backup in rescue mode,
    because it thinks that the Docker daemon is running and hits the problem
    with empty docker_root_dir.
  - Apply upstream PR2223 and commit 36cf20e to avoid an empty string in the
    list of users to clone, which can lead to bash overflow with lots of users
    and groups per user and to wrong passwd/group files in the rescue system.
    Resolves: rhbz1692575
  - Backport of Upstream fix for issue 2035: /run is not mounted in the rescue
    chroot, which causes LVM to hang, especially if rebuilding initramfs.
    Resolves: rhbz1697815
  - Backport upstream PR 2218: avoid keeping build dir on errors
    by default when used noninteractively
    Resolves: rhbz1693608


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-15
changelog:
  - Backport PR2608:
    Fix setting boot path in case of UEFI partition (ESP) on MD RAID
    Resolves: rhbz1945869
  - Backport PR2625 & 2675
    Prevents accidental backup removal in case of errors
    Resolves: rhbz1843585
  - Fix rsync error and option handling
    Fixes metadata storage when rsync user is not root
    Resolves: rhbz1947064
  - Changes for NetBackup (NBU) support, upstream PR2544
    Resolves: rhbz2031833
  - On POWER add bootlist & ofpathname to the list of required programs
    conditionally (bootlist only if running under PowerVM, ofpathname
    always except on PowerNV) - upstream PR2665, add them to package
    dependencies
    Resolves: rhbz1983008
  - On POWER mount /sys in the chroot, otherwise ofpathname does not work
    and we risk ending up with not instlaling the bootloader properly
    Resolves: rhbz1983000


author: Zoltan Kota <z.kota[AT]gmx.net> 3.6-29
changelog:
  - Fix build on x86_64. Run autoreconf to update config files.
    autoconf >= 2.64 needs to patch the flex.m4 file.
    Fixing FTBFS bug #564601.


author: Neil Horman <nhorman@tuxdriver.com> - 0.1-2
changelog:
  - Updated requires for python3
  - Removed unneeded BuildRequires
  - Globed the inclusion of man page
  - Fixed license file tagging


author: Jingdong Lu <jingdong.lu@oracle.com> - 7-2.0.1.el7
changelog:
  - replaced default-bookmarks.html with oracle's default-bookmarks.html
  - Updated Summary and description to be production neutral in spec file


author: Tomas Popela <tpopela@redhat.com> - 7-5
changelog:
  - Change the default set of bookmarks and also use the RH logo from redhat-logos
  - Resolves: rhbz#1991552
  - Related to rhbz#1975914


author: Paul W. Frields <pfrields@redhat.com> - 7-9
changelog:
  - New content tarball to fix errant translation files (Resolves: rhbz1055849)
  - Remove obsolete feedback.html and unsupported locale


author: Jingdong Lu <jingdong.lu@oracle.com> - 7-11.0.1.el7_0
changelog:
  - Replaced the reference from the redhat icon to the oracle linux icon [bug 18272222]
  - Updated image banner-platform-rhel.png and replaced RHEL7_720x60.png in tarball
  - Replace redhat reference in index.html
  - Updated index.html for en-US (Avi Miller)


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-18
changelog:
  - Require sil-abyssinica-fonts in supplemental(#994341)
  - Fully specify requirements on subpackages(#971386)


author: Matthias Clasen <mclasen@redhat.com> - 12.0.1-1
changelog:
  * Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 10.0.1-4
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild


author: Lubos Kocman <lkocman@redhat.com> - 7.4-11.el7
changelog:
  - Enable rhsmcertd.service (default preset) Resolves: rhbz#1271839
  - Enable lvm2-lvmpolld.socket in default preset Resolves: rhbz#1316307
  - Enable brandbot.* by default in default preset. Resolves: rhbz#1359645


author: Jon Disnard <jdisnard@redhat.com> - 7.4-12.el7
changelog:
  - Fine grain versioning of product id source file. 
  - Apply various rpm macros consistently
  - Resolves: rhbz#1380694


author: Lubos Kocman <lkocman@redhat.com> - 7.5-6.el7
changelog:
  - add NetworkManager-wait-online.service to presets
  - add forgotten rhel-domainname.service to presets
  - add spice-vdagentd.socket to presets
  - Resolves: rhbz#1540243


author: Florian Festi <ffesti@redhat.com> - 9.1.0-70
changelog:
  - Be stricter with she bang lines in find-requires (#1179523)
  - Use --with-cpu=power8 for ppc64le (#1213268)
  - Fix stripping of binaries for changed file output (#1250015)
  - Fix find-provides.libtool for new libtool style (#1061619)
  - Restore UID/ GID on jar files (#1270053)
  - Fix latest_kernel macro (#1323087)
  - Add _pkgdocdir and _docdir_fmt macro (#1057327)
  - Fix detection for perl files in old depencency generator (#1324003)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 9.1.0-84
changelog:
  - Revert dropping brp-java-repack-jars
  - fix generating group owner name when processing a jar file (#1460628)


author: Eugene Syromiatnikov <esyr@redhat.com> - 9.1.0-85
changelog:
  - Fix generation of kernel module versioned symbol dependencies for the case
    when module depends on a symbol with the same name as the one present
    in kernel but with a different version (#1619235)


author: Eugene Syromiatnikov <esyr@redhat.com> - 9.1.0-86
changelog:
  - Add support for compressed kernel modules to find-provides,
    find-provides.ksyms, find-requires, find-requires.ksyms (#1619891)


author: Eugene Syromiatnikov <esyr@redhat.com> - 9.1.0-87
changelog:
  - Revert to usage of join instead of comm in find-requires.ksym:mod_requires()
    as generated "Requires:" and "Provides:" lists have different format
    and unsuitable for processing with comm (#1619235)


author: David Shea <dshea@redhat.com> - 0.8.9-1
changelog:
  - backup old product id certificates before installation of new ones (jdornak)
    Resolves: rhbz#1148783


author: David Shea <dshea@redhat.com> - 2:0.7.6-1
changelog:
  - Remove the URL from the Source0 line (dshea)
    Resolves: rhbz#1056730
  - fix UnboundLocalError with fedup --device (wwoods)
    Resolves: rhbz#1056717


author: David Shea <dshea@redhat.com> - 2:0.9.1-1
changelog:
  - Fix the kernel and initrd names.
    Resolves: rhbz#1084143
  - Change the python-devel BuildRequires to python-libs
    Related: rhbz#1084143
  - Check for preupgrade-assistant risks
    Resolves: rhbz#1084145
  - Don't display package problems covered by preupgrade-assistant
    Related: rhbz#1084145
  - Revise the preupgrade HIGH risk message.
    Related: rhbz#1084145
  - Require --instrepo with --network.
    Resolves: rhbz#1084151
  - Call preupgrade-assistant API directly (phracek)
    Related: rhbz#1084145
  - Revise how preupgrade issues are printed
    Related: rhbz#1084145
  - Save the repo config files to /var/tmp/system-upgrade/yum.repos.d
    Resolves: rhbz#1084164
  - Added a check to prevent cross-variant upgrades.
    Related: rhbz#1084145
  - Move the repo files to /etc/yum.repos.d
    Related: rhbz#1084164
  - Add an option --cleanup-post to cleanup packages in post scripts.
    Resolves: rhbz#1084155
  - Clear upgrade.conf before starting
    Related: rhbz#1100391
  - Always create the upgrade.conf directory
    Related: rhbz#1084155
  - Copy upgrade.conf to /root/preupgrade
    Related: rhbz#1084155
  - Fix ValueError with --addrepo/--repo REPOID (wwoods)
    Related: rhbz#1085023
  - Add a message about invalid repo URLs
    Resolves: rhbz#1085023
  - Catch exceptions from early treeinfo parsing
    Resolves: rhbz#1084156
  - Skip preupgrade-assistant checks if preupgrade is not available
    Related: rhbz#1084145
  - Fix the URLGrabError import
    Related: rhbz#1084156
  - treat --network VERSION as a float, not int (wwoods)
    Related: rhbz#1084151


author: David Shea <dshea@redhat.com> - 2:0.9.2-1
changelog:
  - Add --instrepokey
    Related: rhbz#1201822
  - Automatically add the GPG key to Red Hat repos.
    Resolves: rhbz#1201822
  - Revert "fetch/verify .treeinfo.signed if gpgcheck is on"
    Related: rhbz#1201822
  - Write GPG information to the yum repo files
    Related: rhbz#1201822


author: EL Errata <el-errata_ww@oracle.com> - 2:0.9.5-1.0.1
changelog:
  - Drop python-rhsm requires
  - Added oracle-linux.patch to support Oracle Linux(Tianyue Lan) [bug 22253459] 
  - change Summary and Description in specfile


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.5-9
changelog:
  - Install LICENSE file with javadoc package
  - Add maven POM file
  - Update to current packaging guidelines
  - Convert versioned JAR to unversioned


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.0-10.5
changelog:
  - Install license file with javadoc package
  - Convert versioned javadoc to versionless
  - Update to current packaging guidelines
  - Remove msv provides and obsoletes


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-102
changelog:
  - LVM: update metadata on start/relocate
  - LVM: warn when cache mode is not writethrough

    Resolves: rhbz#1451933


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-116
changelog:
  - azure-lb: new resource agent
  - CTDB: fix initial probe

    Resolves: rhbz#1516435
    Resolves: rhbz#1512580


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-117
changelog:
  - ocf_attribute_target: add fallback for Pacemaker versions without
    bundle support

    Resolves: rhbz#1520574


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-1
changelog:
  - rebase to v4.1.1
  - IPaddr2: add "monitor_retries" parameter

    Resolves: rhbz#1596139
    Resolves: rhbz#1484920


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-3
changelog:
  - gcp-vpc-move-vip: new resource agent for Google Cloud
  - vdo-vol: new resource agent
  - LVM-activate: fix issue with dashes
  - dont use attribute_target for metadata

    Resolves: rhbz#1568588
    Resolves: rhbz#1538689
    Resolves: rhbz#1513957
    Resolves: rhbz#1602783


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-8
changelog:
  - lvmlockd: add cmirrord support
  - LVM-activate: warn about incorrect vg_access_mode

    Resolves: rhbz#1606316
    Resolves: rhbz#1619428


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-10
changelog:
  - aws-vpc-move-ip: avoid false positive monitor result on initial probe
  - timeout/interval add "s"-suffix

    Resolves: rhbz#1624741
    Resolves: rhbz#1523318


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-12.5
changelog:
  - rabbitmq-cluster: get cluster status from mnesia during monitor
  - rabbitmq-cluster: fail monitor when node is in minority partition

    Resolves: rhbz#1641944
    Resolves: rhbz#1641946


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-18
changelog:
  - SAPInstance: add reload-action
  - LVM-activate: support LVs from same VG
  - Remove grpc from bundle

    Resolves: rhbz#1642069
    Resolves: rhbz#1667413
    Resolves: rhbz#1683629


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-20
changelog:
  - IPsrcaddr: add proto and table parameters
  - iSCSILogicalUnit: only create iqn when it doesnt exist

    Resolves: rhbz#1504055
    Resolves: rhbz#1598969


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-22
changelog:
  - IPsrcaddr: make proto optional to fix regression when used without
    NetworkManager

    Resolves: rhbz#1504055


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-23
changelog:
  - aws-vpc-move-ip: add multi route-table support and fix issue
    w/multiple NICs

    Resolves: rhbz#1697558


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-32
changelog:
  - iSCSITarget/iSCSILogicalUnit: only create iqn/acls when it doesnt
    exist

    Resolves: rhbz#1598969


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-53
changelog:
  - redis: fix validate-all action and run it during start-action
  - ocf-shellfuncs: ocf_is_clone(): fix to return true when clone-max
    is set to 0
  - Filesystem: add symlink support
  - azure-events: new resource agent for Azure
  - pgsql: get correct status during start-action, and set initial
    score for primary and hot standby

    Resolves: rhbz#1792241
    Resolves: rhbz#1818035
    Resolves: rhbz#1624203
    Resolves: rhbz#1640575
    Resolves: rhbz#1744431


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-54
changelog:
  - aws-vpc-route53: new resource agent for AWS
  - aws-vpc-move-ip: add "routing_table_role" parameter
  - aws-vpc-move-ip: delete remaining route entries

    Resolves: rhbz#1759113
    Resolves: rhbz#1810466
    Resolves: rhbz#1828895


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-56
changelog:
  - sap-hana-scaleout: set default timeouts based on recommendations
    and a couple of bugfixes

    Resolves: rhbz#1829081


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.1
changelog:
  - gcp-vpc-move-vip: add support for multiple alias IPs
  - sybaseASE: run verify action during start action only
  - azure-events: handle exceptions in urlopen

    Resolves: rhbz#1846732
    Resolves: rhbz#1848673
    Resolves: rhbz#1862121


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.8
changelog:
  - gcp-vpc-move-route, gcp-vpc-move-vip: add project parameter and
    make vpc_network parameter optional

    Resolves: rhbz#1913936


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.13
changelog:
  - SAPHana: use actual_mode from global.ini and fallback to mode when
    it's not set

    Resolves: rhbz#1855888


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.15
changelog:
  - gcp-pd-move/gcp-vpc-move-route/gcp-vpc-move-vip: dont fail with
    configuration rc when it might be a network hickup

    Resolves: rhbz#2042070


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.18
changelog:
  - db2: add PRIMARY/REMOTE_CATCHUP_PENDING/CONNECTED status to promote-check

    Resolves: rhbz#2127477


author: Ade Lee <alee@redhat.com> - 2.3.2-11
changelog:
  - Removed unneeded maven-checkstyle-plugin BR
  - Removed Tomcat 6 dependency
  - Replaced maven BR with maven-local


author: Ade Lee <alee@redhat.com> - 2.3.2-12
changelog:
  - Removed modules not needed for pki-core
  - Bugzilla # 973224 - resteasy-base must be split into subpackages to 
    simplify dependencies.  With help from msrb.


author: Tom Lane <tgl@redhat.com> 9.0.0-1
changelog:
  - Update pg_filedump to version 9.0.0, to support PostgreSQL 9.0.
  - Relabel license as PostgreSQL now that that's separately recognized by OSI.


author: Tom Lane <tgl@redhat.com> 9.1.0-1
changelog:
  - Update pg_filedump to version 9.1.0, to support PostgreSQL 9.1.
  - Point to new upstream home at pgfoundry.org.


author: Elliott Baron <ebaron@redhat.com> - 1.7R5-1
changelog:
  - Update to 1.7R5.
  - Add rhino-backout-686806.patch for backward compatibility.
  - Resolves: rhbz#1350331


author: Tomas Kasparek <tkasparek@redhat.com> 2.0.2-18
changelog:
  - Resolves: #1430298 - rhnreg_ks man page missing documentation for some
    options (ogajduse@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.0.2-19
changelog:
  - Related: #1494389 - detect if action has been picked up for 2nd time
    (tkasparek@redhat.com)
  - Resolves: #1494389 - revert previous reboot loop changes
    (tkasparek@redhat.com)


author: Bruce Hill <bruce.hill@oracle.com> 2.0.2-22.0.1
changelog:
  - Fix Empty UUID Workaround
  - Obsolete subscription-manager-plugin-container and subscription-manager-initial-setup-addon
  - Updated public-yum-ol7.repo [ OraBug 26241827 ] (Keshav Sharma)
  - Missing fixes for bug 24659077 [OraBug 24659077]
  - Update ULN-CA-CERT [OraBug 24825502]
  - update public-yum-ol7.repo file [Orabug 24659077]
  - added ceph repository to public-yum-ol7.repo file [Orabug 24910502]
  - enable UEKR4 repository in public-yum-ol7.repo file [Orabug 25031255]
  - Replace Redhat string with ULN
  - do not move repo files [orabug 22230790]
  - added repo entry for 7.2  base  in public-yum repo file.
  - replace up2date.png in tarball [bug 20542844]
  - fix public-yum-ol7.repo [orabug 20281779]
  - fix indentation error in rhnreg_ks/ulnreg_ks [bug 20369398]
  - remove --use-eus-channel option from rhnreg_ks/ulnreg_ks [bug 20369398]
  - Enable rhnreg_ks register to spacewalk server, BZ14791
  - Fixes for RHEL-> ULN Migration
  - Fixed public-yum-ol7.repo file [OraBug 19176214]
  - Added 7.1 entries to public-yum-ol7.repo file [OraBug 20281779]
  - Merge ksplice firstboot plugin from 1.0.0.1-17.0.3.el6
  - Fixed text in rh_register.glade [Orabug 19192726] (Keshav Sharma)
  - Fixed error text in rhnregGui.py [Orabug 19167535] (Keshav Sharma)
  - Added MySQL repositories to public-yum-ol7.repo file. (Keshav Sharma)
  - Fix text in up2date.config file [Orabug 18892489] (Keshav Sharma)
  - Fix url in public-yum.ol7.repo file (Keshav Sharma)
  - Fix firstboot issue [Orabug 18851116] (Keshav Sharma)
  - Fix display text [Orabug 19051197] (Keshav Sharma)
  - Fix public-yum.repo file [Orabug 18380583] (Keshav Sharma)
  - Fix bug 18910928 (Leon Wang)
  - Add ULN-specific changes (Jared Greenwald)


author: Gennadii Altukhov <galt@redhat.com> 2.0.2-15
changelog:
  - Related: #1378903 - fix keywords in a changelog1378903 - fix keywords in a
    changelog (galt@redhat.com)


author: Gennadii Altukhov <galt@redhat.com> 2.0.2-16
changelog:
  - Resolves: #1415742 - rhn-search traceback - immediateTrigger-server exists
    with certain identification1415742 - rhn-search traceback - immediateTrigger-
    server exists with certain identification (eherget@redhat.com)


author: Tomas Lestach <tlestach@redhat.com> 2.0.2-17
changelog:
  - Reverts: bz 1415742 - rhn-search traceback - immediateTrigger-server exists with certain identification" (michael.mraka@redhat.com)


author: Natalya Naumova <natalya.naumova@oracle.com> 2.0.2-24.0.1
changelog:
  - Fix Empty UUID Workaround
  - Obsolete subscription-manager-plugin-container and subscription-manager-initial-setup-addon
  - Updated public-yum-ol7.repo [ OraBug 26241827 ] (Keshav Sharma)
  - Missing fixes for bug 24659077 [OraBug 24659077]
  - Update ULN-CA-CERT [OraBug 24825502]
  - update public-yum-ol7.repo file [Orabug 24659077]
  - added ceph repository to public-yum-ol7.repo file [Orabug 24910502]
  - enable UEKR4 repository in public-yum-ol7.repo file [Orabug 25031255]
  - Replace Redhat string with ULN
  - do not move repo files [orabug 22230790]
  - added repo entry for 7.2  base  in public-yum repo file.
  - replace up2date.png in tarball [bug 20542844]
  - fix public-yum-ol7.repo [orabug 20281779]
  - fix indentation error in rhnreg_ks/ulnreg_ks [bug 20369398]
  - remove --use-eus-channel option from rhnreg_ks/ulnreg_ks [bug 20369398]
  - Enable rhnreg_ks register to spacewalk server, BZ14791
  - Fixes for RHEL-> ULN Migration
  - Fixed public-yum-ol7.repo file [OraBug 19176214]
  - Added 7.1 entries to public-yum-ol7.repo file [OraBug 20281779]
  - Merge ksplice firstboot plugin from 1.0.0.1-17.0.3.el6
  - Fixed text in rh_register.glade [Orabug 19192726] (Keshav Sharma)
  - Fixed error text in rhnregGui.py [Orabug 19167535] (Keshav Sharma)
  - Added MySQL repositories to public-yum-ol7.repo file. (Keshav Sharma)
  - Fix text in up2date.config file [Orabug 18892489] (Keshav Sharma)
  - Fix url in public-yum.ol7.repo file (Keshav Sharma)
  - Fix firstboot issue [Orabug 18851116] (Keshav Sharma)
  - Fix display text [Orabug 19051197] (Keshav Sharma)
  - Fix public-yum.repo file [Orabug 18380583] (Keshav Sharma)
  - Fix bug 18910928 (Leon Wang)
  - Add ULN-specific changes (Jared Greenwald)
  - Updated public-yum-ol7.repo [Orabug 27696955]
  - Updated public-yum-ol7.repo file for aarch64 [OraBug 27029619] (keshav.sharma@oracle.com)
  - Updated public-yum-ol7.repo
  - Updated public-yum-ol7.repo [Orabug 28375712]
  - Updated replacement ULN-CA-CERT
  - updated public-yum-ol7.repo for 7.6 beta [Orabug 28624952]
  - updated public-yum-ol7.repo for 7.6


author: Gennadii Altukhov <galt@redhat.com> 2.5.65-2
changelog:
  - fix except in rhnlib to make it compatible with Python 2.4 (galt@redhat.com)
  - 1409577 - Reboot loop - rhn_check, rhnsd (jdostal@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.5.65-5
changelog:
  - Resolves: #1471045 - check a state of handshake before shutdown SSL
    connection (grinrag@gmail.com)


author: Grant Gainey 5.0.13-5
changelog:
  - Bump release to get past weirdness in brew-tags (ggainey@redhat.com)
  - Related: #1138939 - up2date and systemid files are managed by rhnsd itself,
    no need to break init script if they do not exist (jdobes@redhat.com)
  - Related: #1092518 - PIE+RELRO for rhnsd (mkollar@redhat.com)
  - Revert changes in order to clean up tagging issues with brew
    (ggainey@redhat.com)
  - Automatic commit of package [rhnsd] minor release [5.0.13-4-el7].
    (ggainey@redhat.com)
  - Bump release to get past weirdness in brew-tags (ggainey@redhat.com)
  - Automatic commit of package [rhnsd] minor release [5.0.13-2-el7].
    (ggainey@redhat.com)
  - Resolves: #1138939 - up2date and systemid files are managed by rhnsd itself,
    no need to break init script if they do not exist (jdobes@redhat.com)
  - Resolves: #1092518 - PIE+RELRO for rhnsd (mkollar@redhat.com)


author: Gennadii Altukhov <galt@redhat.com> 5.0.13-6
changelog:
  - 1409562 - RHEL7 rhnsd reload doesn't work (jdostal@redhat.com)
  - 1409562 - Reboot loop - rhn_check, rhnsd (jdostal@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 5.0.13-8
changelog:
  - Resolves: #1480306 - change permissions for rhnsd.pid (grinrag@gmail.com)
  - Resolves: #1489989 - umask(0) does not reset to default umask
    (tkasparek@redhat.com)
  - Resolves: #1475039 - close and reopen syslog when redirecting child output
    (martin.matuska@axelspringer.de)


author: Tomas Kasparek <tkasparek@redhat.com> 5.0.13-9
changelog:
  - Related: #1499793 - revert previous reboot loop changes
    (tkasparek@redhat.com)
  - Resolves: #1499793 - Revert "1260527 RHEL7 rhnsd reload doesn't work"
    (tkasparek@redhat.com)


author: Milan Zazrivec <mzazrivec@redhat.com> 5.0.9-1
changelog:
  - Update .po and .pot files for rhnsd.
  - New translations from Transifex for rhnsd.
  - Download translations from Transifex for rhnsd.


author: Michael Mraka <michael.mraka@redhat.com> 5.0.10-1
changelog:
  - let rhnsd.service be enabled after installation
  - Purging %changelog entries preceding Spacewalk 1.0, in active packages.


author: Tomas Kasparek <tkasparek@redhat.com> 5.0.13-7.2
changelog:
  - Resolves: #1506911 - close and reopen syslog when redirecting child output
    (martin.matuska@axelspringer.de)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-1
changelog:
  - rebase to most up2date upstream tarball, remove patches already upstream, fix
    code movements in patches (#928758)
  - fix man-page-day objections (private #948866)
  - fix the build for aarch64 (#926571)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-2
changelog:
  - package spax and scpio separately (#959917)
  - fedora-review fixes, unapplied patch
  - make the spax to be pax alternative (#960007)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-7
changelog:
  - we should provide /etc/rmt symlink for a while (related to #968980)
  - use the ssh as the default remote access method


author: Ondrej Vasik <ovasik@redhat.com> - 8.1-2
changelog:
  - Add dist tag, fix a few rpmlint issues, rebuild due to
    wrong vendor (#451229)
  - Added ncurses requirement(#469390)


author: Phil Knirsch <pknirsch@redhat.com> - 8.1-4
changelog:
  - Added the "we-are-upstream" comments according to Fedora review (#226376)
  - Added -p option to install to preserve timestamps (#226376)


author: Ondrej Vasik <ovasik@redhat.com> - 8.1-5
changelog:
  - removed clear from dot-bash_logout (synchronized with bash,
    related to #429406)
  - removed unset USERNAME from dot-bash_profile (synchronized with
    bash, related to #196735)


author: Than Ngo <than@redhat.com> - 3.11-1
changelog:
  - 3.11
  - bz#540763, add IP allocation by pppd ability to pppoe-server
  - bz#808676, add missing % symbol for triggerun


author: Steve Dickson <steved@redhat.com> - 0.2.0-35
changelog:
  - Restart rpcbind.socket on restarts (bz 1303751)
  - Added localhost:111 to rpcbind socket activation (bz 1293430)
  - Soft static allocate rpc uid/gid (bz 1321279)


author: Steve Dickson <steved@redhat.com> - 0.2.0-39
changelog:
  - Added libtirpc dependency (bz 1396291)
  - Removed xlog warning (bz 1377531)
  - Removed an 'i' warning (bz 1377560)


author: Florian Festi <ffesti@redhat.com> - 4.11.3-18
changelog:
  - Fixed failing upstream test 257 on big endian systems (#1264463)
  - Fixed problems with perl.req script (#1320214, #1275551)
  - Fixed race condition in rpm file deployment when updating an existing file
    (#1320181)
  - Move bdb warnings from stdin to stdout (#1297793)
  - Add --justdb to the erase section of the man page, too (#1310561)
  - Backport support for multi threaded xz compression (#1278924)
  - Update config.guess (#1291377)
  - Add --noplugins option (#1264031)
  - Overwrite a file if it is not marked as config any more (#1290463)
  - Add man page for systemd-inhibit plugin (#1265578)


author: Florian Festi <ffesti@redhat.com> - 4.11.3-22
changelog:
  - Move rpm-plugin-systemd-inhibit man page to that package (#1360706)
  - Fix off by one error in base64 code (#1341913)
  - Add sources to lua to prevent %autosetup failing in some cases (#1359084)
  - Fix refcounting for Python hdr objects (#1358467)
  - Perl dependecy generator: Skip blocks after variable definitions (#1378307)
  - Verify signatures properly (#1371487)
  - Export function in Python binding for yum (#1343692)


author: Florian Festi <ffesti@redhat.com> - 4.11.3-28
changelog:
  - Make sure files in /usr/src/debug are not world writable (RHBZ #1441098)
  - Increase maximal header size (RHBZ #1434656)
  - Increase buffer to be able to render Korean dates (RHBZ #1425231)
  - Add --noconfig option (RHBZ #1406611)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.3-31
changelog:
  - Backport missing infra for --noconfig option (#1406611)
  - As a side-effect, this also makes --noghost work as intended


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-33
changelog:
  - Repair of --noghost option implementation (#1395818)
  - Backport fix rpmSign() return value in case of failure (#1419590)
  - Backport passing _find_debuginfo_opts -g to eu-strip for executables
    (#1540653)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-34
changelog:
  - Adjust --noghost documentation (#1395818)
  - Provide audit events on update verification (#1555326)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-36
changelog:
  - Add popt-based options --setcaps and --restore (#1550745)
  - Improve hardlink handling in disk space calculation (#1491786)
  - Remove perl dependencies that are provided in the same file (#1570181)


author: Tom Callaway <spot@fedoraproject.org> - 1.4-10
changelog:
  - fix handling of ruby RI files as text files (they are binary files)
  - apply upstream fix for macro regexp


author: Thomas Woerner <twoerner@redhat.com> - 1.5-4
changelog:
  - enable bash-completion again, fixes (RHBZ#495529)
  - fixed rpmlint reports missing-lsb-keyword Default-Stop (rhbz#976341)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1.4.8-1
changelog:
  - New version
    Resolves: rhbz#966639
  - Updated and defuzzified patches
  - Still use lua-5.1 (fedoras < f20)


author: Michal Sekletar <msekleta@redhat.com> - 0.17-71
changelog:
  - resolves: RHBZ #737244 #896583 #947213
  - migrate from xinetd to systemd configuration
  - close pam session correctly when client does not ask for separate error channel
  - fix pty handling which was broken by changes in /bin/login


author: Michal Sekletar <msekleta@redhat.com> - 0.17-72
changelog:
  - unit files must not be marked as config files
  - fix handling of non-native IPv6 connections via AF_INET6 socket


author: Michal Ruprich <mruprich@redhat.com> - 0.17-78
changelog:
  - Resolves: #1502657 - Copying remote file to local dir fails with "rcp: protocol screwup: expected control record"
  - Resolves: #1338037 - rsh/rlogin sessions ignore SIGPIPE due to systemd
  - Resolves: #1477207 - rlogin killed when changing run level
  - Resolves: #1503112 - rexecd Could not allocate space for cmdbuf
  - Resolves: #1505226 - have a proposed patch for rsh-0.17-76.el7_1.1


author: Pavel Šimerda <psimerda@redhat.com> - 3.0.9-14
changelog:
  - Resolves: #1052814 - rsync command is terminated with SIGSEGV
  - Resolves: #1052814 - add missing patch file


author: Luboš Uhliarik <luhliari@redhat.com> - 3.0.9-17
changelog:
  - Resolves: #1082496 - socket activation for rsync doesn't work (added missing
    rsyncd@.service file)


author: Michal Ruprich - 3.1.2-4
changelog:
  - Related: #1432899 - removing dependencies on perl
  - using the bundled zlib.h(#1491582)
  - turning on upstream tests


author: Michal Ruprich <mruprich@redhat.com> - 3.1.2-10
changelog:
  - Resolves: #1672779 - Rsync bug resets modification time of every destination file that has not changed


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-15
changelog:
  - add a patch to make state file handling in imjournal more robust
    resolves: rhbz#1245194
  - add a patch to support wildcards in imfile
    resolves: rhbz#1303617


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-6
changelog:
  - RHEL 7.4 ERRATUM
  - rsyslog rebase to 8.24
  - added patch to prevent segfault while setting aclResolveHostname
    config options
    resolves: rhbz#1422414
  - added patch to check config variable names at startup
    resolves: rhbz#1427828
  - added patch for str2num to handle empty strings
    resolves: rhbz#1427821
  - fixed typo in added-chdir patch
    resolves: rhbz#1422789
  - added patch to log source process when beginning rate-limiting
    resolves: rhbz#1196230
  - added patch to chdir after chroot
    resolves: rhbz#1422789
  - added patch to remove "inputname" imudp module parameter 
    deprecation warnings
    resolves: rhbz#1403907
  - added patch which resolves situation when time goes backwards
    and statefile is invalid
    resolves rhbz#1088021
  - added a patch to bring back deprecated cmd-line switches and
    remove associated warnings
    resolves: rhbz#1403831
  - added documentation recover_qi.pl
    resolves: rhbz#1286707
  - add another setup for doc package
  - add --enable-generate-man-pages to configure parameters;
    the rscryutil man page isn't generated without it
    https://github.com/rsyslog/rsyslog/pull/469
  - enable mmcount, mmexternal modules
  - remove omruleset and pmrfc3164sd modules


