# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-10
changelog:
- Bump version to 1.3.7.5-10
- Resolves: Bug 1464463 - Replication fails to start with CBCA (Certificate-Based Client Authentication) while FIPS mode is enabled.
- Resolves: Bug 1465383 - Segmentation fault in valueset_array_to_sorted_quick
- Resolves: Bug 1510865 - python-ldap is not a dependency of 389-ds-base
- Resolves: Bug 1513467 - IPA upgrade fails for latest ipa package
- Resolves: Bug 1192099 - IPA server replication broken, after DS stop-start, due to changelog reset
- Resolves: Bug 1445188 - Misleading error message - Incoming BER Element was 3 bytes 
- Resolves: Bug 1498980 - heap corruption during import
- Resolves: Bug 1511462 - scope one searches give incorrect results
- Resolves: Bug 1514033 - opened connection are hanging, no longer poll


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-11
changelog:
- Bump version to 1.3.7.5-11
- Resolves: Bug 1518069 - heap-buffer-overflow in ss_unescape
- Resolves: Bug 1516676 - gssapi authentication fails after upgrading 389-ds-base
- Resolves: Bug 1511885 - Automatically load /usr/lib/sysctl.d/70-dirsrv.conf after installing 389-ds-base
- Resolves: Bug 1517980 - stack-buffer-overflow in slapi_pblock_get


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-12
changelog:
- Bump version to 1.3.7.5-12
- Resolves: Bug 1459946 - GetEffectiveRights gives false-negative with ACIs containing targetfilter
- Resolves: Bug 1507194 - cleanallruv could break replication if anchor csn in ruv originated in deleted replica
- Resolves: Bug 1517788 - password policy: minimum token length fails when the token length is equal to attribute length
- Resolves: Bug 1518287 - heap-use-after-free in csn_as
- Resolves: Bug 1531153 - Indexing of internationalized matching rules is failing
- Resolves: Bug 1517383 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired
- Resolves: Bug 1523183 - search with CoS attribute is getting slower after modifying/adding CosTemplate
- Resolves: Bug 1457315 - cmocka tests are not executed during rpm build
- Resolves: Bug 1516309 - After cleanALLruv, replication is looping on keep alive DEL


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-13
changelog:
- Bump version to 1.3.7.5-13
- Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry
- Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7
- Resolves: Bug 1534379 - CVE-2017-15134: Remote DoS via search filters in slapi_filter_sprintf in slapd/util.c 
- Resolves: Bug 1533571 - memberof: schema violation error message is confusing as memberof will likely repair target entry
- Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-14
changelog:
- Bump version to 1.3.7.5-14
- Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7 (fix regression in -13)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-15
changelog:
- Bump version to 1.3.7.5-15
- Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry
- Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy
- Resolves: Bug 1541108 - Allow CRL handling to be configurable for outgoing connections


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-16
changelog:
- Bump version to 1.3.7.5-16
- Resolves: Bug 1542645 - Outgoing secure connection is failing with recent OpenLDAP


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5.17
changelog:
- Bump version to 1.3.7.5.17
- Resolves: Bug 1539082 - Child entry cenotaphs should not prevent the deletion of the parent
- Resolves: Bug 1540106 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 
- Resolves: Bug 1535538 - CVE-2017-15135 - Authentication bypass due to lack of size check in slapi_ct_memcmp


author: Matus Honek <mhonek@redhat.com> - 1.3.7.5-19
changelog:
- Bump version to 1.3.7.5-19
- Resolves: Bug 1563107 - IPA server is not responding, all authentication and admin tests failed [rhel-7.5.z]


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-20
changelog:
- Bump version to 1.3.7.5-20
- Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received 
- Resolves: Bug 1559764 - memberof fails if group is moved into scope
- Resolves: Bug 1554720 - "Truncated search results" pop-up appears in user details in WebUI 
- Resolves: Bug 1553605 - ipa-server-install fails with Error: Upgrade failed with no such entry
- Resolves: Bug 1559760 - ds-replcheck: add -W option to ask for the password from stdin instead of passing it on command line
- Resolves: Bug 1559464 - replica_write_ruv log a failure even when it succeeds


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-21
changelog:
- Bump version to 1.3.7.5-21
- Resolves: Bug 1559818 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-22
changelog:
- Bump version to 1.3.5.7-22
- Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received
- Resolves: Bug 1579702 - Replication stops working when MemberOf plugin is enabled on hub and consumer
- Resolves: Bug 1579698 - replicated operations should be serialized
- Resolves: Bug 1579700 - Upgrade script doesn't enable PBKDF password storage plug-in
- Resolves: Bug 1580257 - ds-replcheck LDIF comparision fails when checking for conflicts
- Resolves: Bug 1580523 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-23
changelog:
- Bump version to 1.3.7.5-23
- Resolves: Bug 1581588 - ACI deny rules do not work correctly
- Resolves: Bug 1582747 - DS only accepts RSA and Fortezza cipher families


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-25
changelog:
- Bump version to 1.3.7.5-25
- Resolves: Bug 1597530 - Async operations can hang when the server is running nunc-stans


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-26
changelog:
- Bump version to 1.3.7.5-26
- Resolves: Bug 1615924 - Fine grained password policy can impact search performance
- Resolves: Bug 1614836 - Disable nunc-stans by default
- Resolves: Bug 1614861 - ldapsearch with server side sort crashes the ldap server


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-28
changelog:
- Bump version to 1.3.7.5-28
- Resolves: Bug 1628676 - 389-ds-base: race condition on reference counter leads to DoS using persistent search
- Resolves: Bug 1628677 - Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-6
changelog:
- Bump version to 1.3.8.4-6
- Resolves: Bug 1595766 - backout this fix for now because it breaks FreeIPA


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-7
changelog:
- Bump version to 1.3.8.4-7
- Resolves: Bug 1595766 - backout this fix for now because it breaks FreeIPA (removed patch file all together)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-8
changelog:
- Bump version to 1.3.8.4-8
- Resolves: Bug 1594484 - setup-ds.pl not able to handle/create the user "dirsrv" if there is an already existing user with the UID/GID 389 on the machine.


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-9
changelog:
- Bump version to 1.3.8.4-9
- Resolves: Bug 1594484 - setup-ds.pl not able to handle/create the user "dirsrv" if there is an already existing user with the UID/GID 389 on the machine.


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-10
changelog:
- Bump verison to 1.3.8.4-10
- Resolves: Bug 1614501 - Disable nunc-stans by default
- Resolves: Bug 1607078 - ldapsearch with server side sort crashes the ldap server


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-11
changelog:
- Bump version to 1.3.8.4-11
- Resolves: Bug 1614820 - Server crash through modify command with large DN


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-12
changelog:
- Bump version to 1.3.8.4-12
- Resolves: Bug 1616412 - filter optimization fix causes regression(fix reverted)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-13
changelog:
- Bump version to 1.3.8.4-13
- Resolves: Bug 1623949 - Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-16
changelog:
- Bump version to 1.3.8.4-16
- Resolves: Bug 1638513 - Message: "CRIT - list_candidates - NULL idl was recieved from filter_candidates_ext." should not be critical


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-18
changelog:
- Bump version to 1.3.8.4-18
- Resolves: Bug 1638516 - CRIT - list_candidates - NULL idl was recieved from filter_candidates_ex


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-4
changelog:
- settings: clear unsaved flag on new connections (rh #1525078)
- platform-linux: reload qdiscs and tfilters after removing them (rh #1527197)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-5
changelog:
- wwan: add default route even if modem didn't return a gateway (rh #1527934)
- dhcp: fix assertion failure for dhcp-client-id (rh #1531173)


author: Thomas Haller <thaller@redhat.com> - 1:1.10.2-6
changelog:
- core: use distinct route-metric to keep connectivity on first activated device (rh #1505893)
- core: fix enabling connectivity-check-enabled via D-Bus (rh #1534477)
- core: fix invalid assertion deleting volatile connection (rh #1506552)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-7
changelog:
- po: import translations (rh #1481186)
- device: increase carrier wait time to 6 seconds (rh #1520826)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-10
changelog:
- device: skip IP configuration phase for external devices (rh #1530288)
- platform: fix crash during route-get call (rh #1534721)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-11
changelog:
- ovs-interface: avoid starting ip configuration twice (rh #1540063)
- libnm-core: ensure alignment of team.config and other team properties (rh #1533830)
- nmcli: clear link-watchers before adding the new ones (rh #1533926)
- libnm-core: update team.runner description (rh #1533799)
- libnm-core: team: fix runner sys_prio default value (rh #1533810)
- libnm: avoid a symbol clash with json-glib (rh #1535905)
- libnm-core: team: add support to runner "random" (rh #1538699)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-12
changelog:
- ppp: don't start IPv6 configuration on the device (rh #1515829)
- device: avoid setting the IPv4 rp_filter (rh #1492472)
- nmcli: team: clear runner-tx-hash before adding new hashes (rh #1541922)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-14
changelog:
- manager: retry activating devices when the parent becomes managed (rh #1553595)
- manager: allow autoconnect-slaves to reconnect the same connection (rh #1548265)
- manager: fix starting teamd after service restart  (rh #1551958)


author: Thomas Haller <thaller@redhat.com> - 1:1.12.0-0.1
changelog:
- Update to upstream release 1.11.90 (release candidate) (rh #1592311)
- libnm: properly handle cancelling of async operations (rh #1555281)
- libnm: support handling checkpoints (rh #1496739)
- core: fix blocking/not-blocking autoconnect related to missing secrets (rh #1553113)
- core: rework and improve IPv4 address collission detection (rh #1507864)
- wifi: fix timeout handling for supplicant when no secrets provided (rh #1575501)
- macsec: enable sending SCI by default and make it configurable (rh #1588041)
- ethernet: support announcing duplex/speed in combination with autonegotiation (rh #1487477)
- wwan: improve failure reason for unsupported IP methods (rh #1459529)
- tun: use netlink kernel API for tun devices if available (rh #1547213)
- ovs: fix assertion during shutdown of NetworkManager (rh #1543871)
- dhcp: improve handling DHCP timeouts (rh #1573780)
- dhcp: support specifying ipv6.dhcp-duid (rh #1414093)
- dhcp: support generating ipv4.dhcp-client-id based on MAC/stable-id
- dns: avoid updating resolv.conf when exiting (rh #1541031)
- ifcfg-rh: fix IPv4 settings in combination with method "shared" (rh #1519299)
- ifcfg-rh: fix handling unset Wi-Fi mode (rh #1549972)
- iface-helper: fix invalid reentrant call to platform (rh #1546656)
- doc: various improvments to documentation (rh #1543832)


author: Thomas Haller <thaller@redhat.com> - 1:1.12.0-1
changelog:
- Update to upstream 1.12.0 release (rh #1592311)
- device: improve MTU handling for VLAN (rh #1586191)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-2
changelog:
- device: disable rp_filter handling (rh #1593194)
- ibft: grant required CAP_SYS_ADMIN capabilities (rh#1596954)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.12.0-3
changelog:
- cli: remove assertion in nmc_device_state_to_color() (rh #1614691)
- po: import Japanese translation (rh #1569438)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-6
changelog:
- dns: dnsmasq: avoid crash when no reverse domains exist (rh #1628576)
- initscripts: fix ownership of ifup/ifdown executables (rh #1626517)
- cli: fix parsing vpn secrets from password file (rh #1628946)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-7
changelog:
- manager: accept non-null device for VPN activations (rh #1641174)
- drop dependency of NetworkManager-ovs on openvswitch (rh #1633190)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-3.gitc325e41585e3.el7
changelog:
- ovmf-ArmVirtPkg-FdtClientDxe-supplement-missing-EFIAPI-ca.patch [bz#1430262]
- ovmf-ArmVirtPkg-ArmVirtPL031FdtClientLib-unconditionally-.patch [bz#1430262]
- ovmf-MdeModulePkg-RamDiskDxe-fix-C-string-literal-catenat.patch [bz#1430262]
- ovmf-EmbeddedPkg-introduce-EDKII-Platform-Has-ACPI-GUID.patch [bz#1430262]
- ovmf-EmbeddedPkg-introduce-PlatformHasAcpiLib.patch [bz#1430262]
- ovmf-EmbeddedPkg-introduce-EDKII-Platform-Has-Device-Tree.patch [bz#1430262]
- ovmf-ArmVirtPkg-add-PlatformHasAcpiDtDxe.patch [bz#1430262]
- ovmf-ArmVirtPkg-enable-AcpiTableDxe-and-EFI_ACPI_TABLE_PR.patch [bz#1430262]
- ovmf-ArmVirtPkg-FdtClientDxe-install-DT-as-sysconfig-tabl.patch [bz#1430262]
- ovmf-ArmVirtPkg-PlatformHasAcpiDtDxe-don-t-expose-DT-if-Q.patch [bz#1430262]
- ovmf-ArmVirtPkg-remove-PURE_ACPI_BOOT_ENABLE-and-PcdPureA.patch [bz#1430262]
- Resolves: bz#1430262
  (AAVMF: forward QEMU's DT to the guest OS only if ACPI payload is unavailable)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-4.gitc325e41585e3.el7
changelog:
- ovmf-ShellPkg-Shell-clean-up-bogus-member-types-in-SPLIT_.patch [bz#1442908]
- ovmf-ShellPkg-Shell-eliminate-double-free-in-RunSplitComm.patch [bz#1442908]
- Resolves: bz#1442908
  (Guest hang when running a wrong command in Uefishell)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-5.gitc325e41585e3.el7
changelog:
- ovmf-OvmfPkg-EnrollDefaultKeys-update-SignatureOwner-GUID.patch [bz#1443351]
- ovmf-OvmfPkg-EnrollDefaultKeys-expose-CertType-parameter-.patch [bz#1443351]
- ovmf-OvmfPkg-EnrollDefaultKeys-blacklist-empty-file-in-db.patch [bz#1443351]
- ovmf-OvmfPkg-introduce-the-FD_SIZE_IN_KB-macro-build-flag.patch [bz#1443351]
- ovmf-OvmfPkg-OvmfPkg.fdf.inc-extract-VARS_LIVE_SIZE-and-V.patch [bz#1443351]
- ovmf-OvmfPkg-introduce-4MB-flash-image-mainly-for-Windows.patch [bz#1443351]
- ovmf-OvmfPkg-raise-max-variable-size-auth-non-auth-to-33K.patch [bz#1443351]
- ovmf-OvmfPkg-PlatformPei-handle-non-power-of-two-spare-si.patch [bz#1443351]
- ovmf-redhat-update-local-build-instructions-with-D-FD_SIZ.patch [bz#1443351]
- ovmf-redhat-update-OVMF-build-commands-with-D-FD_SIZE_4MB.patch [bz#1443351]
- Resolves: bz#1443351
  ([svvp][ovmf] job "Secure Boot Logo Test" failed  with q35&ovmf)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20171011-1.git92d07e48907f.el7
changelog:
- Rebase to 92d07e48907f [bz#1469787]
- Resolves: bz#1469787
  ((ovmf-rebase-rhel-7.5) Rebase OVMF for RHEL-7.5)
- Resolves: bz#1434740
  (OvmfPkg/PciHotPlugInitDxe: don't reserve IO space when IO support is disabled)
- Resolves: bz#1434747
  ([Q35] code12 error when hotplug x710 device in win2016)
- Resolves: bz#1447027
  (Guest cannot boot with 240 or above vcpus when using ovmf)
- Resolves: bz#1458192
  ([Q35] recognize "usb-storage" devices in XHCI ports)
- Resolves: bz#1468526
  (>1TB RAM support)
- Resolves: bz#1488247
  (provide "OVMF_CODE.secboot.verbose.fd" for log capturing; silence "OVMF_CODE.secboot.fd")
- Resolves: bz#1496170
  (Inconsistent MOR control variables exposed by OVMF, breaks Windows Device Guard)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20171011-2.git92d07e48907f.el7
changelog:
- ovmf-MdeModulePkg-Bds-Remove-assertion-in-BmCharToUint.patch [bz#1513632]
- ovmf-MdeModulePkg-Bds-Check-variable-name-even-if-OptionN.patch [bz#1513632]
- ovmf-MdeModulePkg-PciBus-Fix-bug-that-PCI-BUS-claims-too-.patch [bz#1514105]
- ovmf-OvmfPkg-make-it-a-proper-BASE-library.patch [bz#1488247]
- ovmf-OvmfPkg-create-a-separate-PlatformDebugLibIoPort-ins.patch [bz#1488247]
- ovmf-OvmfPkg-save-on-I-O-port-accesses-when-the-debug-por.patch [bz#1488247]
- ovmf-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch [bz#1488247]
- ovmf-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-QemuVide.patch [bz#1488247]
- ovmf-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch [bz#1488247]
- ovmf-Revert-redhat-introduce-separate-silent-and-verbose-.patch [bz#1488247]
- Resolves: bz#1488247
  (make debug logging no-op unless a debug console is active)
- Resolves: bz#1513632
  ([RHEL-ALT 7.5] AAVMF fails to boot after setting BootNext)
- Resolves: bz#1514105
  (backport edk2 commit 6e3287442774 so that PciBusDxe not over-claim resources)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20171011-3.git92d07e48907f.el7
changelog:
- ovmf-UefiCpuPkg-CpuDxe-Fix-multiple-entries-of-RT_CODE-in.patch [bz#1518308]
- ovmf-MdeModulePkg-DxeCore-Filter-out-all-paging-capabilit.patch [bz#1518308]
- ovmf-MdeModulePkg-Core-Merge-memory-map-after-filtering-p.patch [bz#1518308]
- Resolves: bz#1518308
  (UEFI memory map regression (runtime code entry splitting) introduced by c1cab54ce57c)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20171011-4.git92d07e48907f.el7
changelog:
- ovmf-MdeModulePkg-Core-Dxe-log-informative-memprotect-msg.patch [bz#1520485]
- ovmf-MdeModulePkg-BdsDxe-fall-back-to-a-Boot-Manager-Menu.patch [bz#1515418]
- Resolves: bz#1515418
  (RFE: Provide diagnostics for failed boot)
- Resolves: bz#1520485
  (AAVMF: two new messages with silent build)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-2.gitee3198e672e2
changelog:
- OvmfPkg/PlatformBootManagerLib: connect consoles unconditionally [bz#1577546]
- build OVMF varstore template with SB enabled / certs enrolled [bz#1561128]
- connect Virtio RNG devices again [bz#1579518]
- Resolves: bz#1577546
  (no input consoles connected under certain circumstances)
- Resolves: bz#1561128
  (OVMF Secure boot enablement (enrollment of default keys))
- Resolves: bz#1579518
  (EFI_RNG_PROTOCOL no longer produced for virtio-rng)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-3.gitee3198e672e2.el7
changelog:
- ovmf-redhat-provide-virtual-bundled-OpenSSL-in-OVMF.patch [bz#1607792]
- Resolves: bz#1607792
  (add 'Provides: bundled(openssl) = 1.1.0h' to the spec file)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Patch: not-rhel.patch
-->  SL is not RHEL
- Added Patch: pk-upgrade-distro.patch
-->  Use /usr/sbin/sl7-upgrade rather than preupgrade
- Added Source: PackageKit.ini
-->  Config file for automated patch script
- Added Patch: pk-yum-backend-for-sl.patch
-->  Add in code to let PackageKit check dist to upgrade
- Added Patch: use-sl-upgrade.patch
-->  Use /usr/sbin/sl7-upgrade rather than preupgrade


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Patch: not-rhel.patch
-->  SL is not RHEL
- Added Source: PackageKit.ini
-->  Config file for automated patch script
- Ran Regex: (Release: .*)%{\?dist}(.*) => \1.sl7\2
-->  Modify release string to note changes


author: Ray Strode <rstrode@redhat.com> - 0.6.45-1
changelog:
- Update to 0.6.45 so password expiration policy is wrapped by libaccountsservice
  Related: #1424623 #1334464


author: Ray Strode <rstrode@redhat.com> - 0.6.45-2
changelog:
- Don't tread explicitly requested users as cached
  Fixes UncacheUser operation.
  Resolves: 1446620
  Related: #1432602


author: Ray Strode <rstrode@redhat.com> - 0.6.45-6
changelog:
- Don't return bogus password expiration policy when
  shadow file is unavailable
  Resolves: #1530659


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.140-1
changelog:
- Preserve the boot option zfcp.allow_lun_scan (vponcova)
  Resolves: rhbz#1561662
- Don't display "Alternate Architectures" in product name (rvykydal)
  Resolves: rhbz#1488558


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.143-1
changelog:
- Add data loss warning to nvdimm reconfigure dialog. (rvykydal)
  Resolves: rhbz#1280500
- Add UI feedback for disk repopulating after nvdimm reconfiguration.
  (rvykydal)
  Resolves: rhbz#1280500
- Use only devices specified by nvdimm command for installation. (rvykydal)
  Resolves: rhbz#1280500
- Add option to reconfigure nvdimm devices into sector mode. (rvykydal)
  Resolves: rhbz#1280500
- Allow only devices in sector mode to be selected. (rvykydal)
  Resolves: rhbz#1280500
- Add nvdimm devices to Advanced Storage spoke. (rvykydal)
  Resolves: rhbz#1280500
- Add kickstart support for nvdimm reconfiguration to sector mode. (rvykydal)
  Resolves: rhbz#1280500


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.144-1
changelog:
- Don't allow unlocking and using of LUKS2 devices (vponcova)
  Resolves: rhbz#1608251
- Fix glade accelerator conflicts (rvykydal)
  Related: rhbz#1602436
- Add nvdimm files to POTFILES.in (rvykydal)
  Related: rhbz#1602436
- Support nvdimm only on x86_64 (rvykydal)
  Resolves: rhbz#1602436


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.146-1
changelog:
- Revert "If someone really wants to eject the cdrom, then do it. (jkonecny)"
  Resolves: rhbz#1618408


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Patch: anaconda-context-treeinfo-DVD-72.patch
-->  Permit selective enabling of 'addon' repos (for contexts)
- Added Source: anaconda_spec-dont-use-rhel-bugzilla.patch
-->  Do not configure anaconda to autoreport errors to TUV
- Added Patch: sl-branding-bootloader-xfs.patch
-->  Modify filesystem list in pyanaconda/bootloader.py for SL
- Added Patch: anaconda-doesnt-use-yumvars-for-mirrorlist.patch
-->  Anaconda doesn't use yumvars for mirrorlists in UI, do it by hand
- Added Source: anaconda.ini
-->  Config file for automated patch script
- Added Patch: anaconda-expand-yumvars-in-script.patch
-->  Anaconda doesn't use yumvars for mirrorlists in script, do it by hand
- Added Patch: sl-branding-installclass.patch
-->  Modify installclasses/rhel.py and installclasses/fedora.py for SL


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com>
changelog:
- Change sl-branding-installclass.patch for EuroLinux
- Removed Patch: anaconda-doesnt-use-yumvars-for-mirrorlist.patch
- Removed Patch: anaconda-expand-yumvars-in-script.patch
- Removed Patch: anaconda-context-treeinfo-DVD-72.patch


author: Steve Grubb <sgrubb@redhat.com> 2.7.4-1
changelog:
resolves: #1367703 - auvirt wasn't supporting date keywords
resolves: #1396792 - augenrules includes files ending in regexp "rules"
resolves: #1406525 - ausearch with '--raw' parameter outputs garbage character


author: Steve Grubb <sgrubb@redhat.com> 2.7.5-1
changelog:
resolves: #1437187 - audit rpm postinstall script points to non-existing file
resolves: #1437426 - Remove "--backlog_wait_time" from auditctl man page & rules
resolves: #1437626 - PF_PACKET socket address will cause ausearch to segfault
resolves: #1438997 - SECCOMP records have wrong syscall


author: Steve Grubb <sgrubb@redhat.com> 2.7.8-1
changelog:
resolves: #1406887 - auditd validate_email uses obsolete gethostbyname
resolves: #1448526 - aureport shows the wrong auid "-1"
resolves: #1475998 - python audit crash if when using AUSOURCE_FILE_POINTER
resolves: #1482121 - python audit crash dereferencing auparse_state_t le field


author: Steve Grubb <sgrubb@redhat.com> 2.8.1-1
changelog:
resolves: #982154 - Can't find the "avc" event with the auvirt command
resolves: #1101605 - Ipv6 seems no working
resolves: #1399314 - Allow non-equality comparisons for uid and gid fields
resolves: #1455598 - Default port is wrong in audisp-remote.conf
resolves: #1476406 - Audit package rebase


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-14
changelog:
- Kdump: parse new options, EOL comments (RHBZ#1139298)
- Rsyslog: parse property filters and templates (RHBZ#1138402)
- Systemd: parse semicolons inside entry values (RHBZ#1139498)
- Systemd: parse environment variables where value is quoted (RHBZ#1138508)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-16
changelog:
- Iptables: parse /etc/sysconfig/iptables.save (RHBZ#1144651)
- Lvm: parse /etc/lvm/lvm.conf (RHBZ#1145495)
- Shadow: add lens (RHBZ#1145249)


author: Dominic Cleal <dcleal@redhat.com> - 1.4.0-1
changelog:
- Rebase to Augeas 1.4.0
- Revert some changes for better compatibility with 1.1.0-17:
  * Dhcpd: keep 1.1.0 behaviour, add Dhcpd_140 for 1.4.0 features
  * Dnsmasq: revert splitting of address/server options
  * Dovecot: restore quotes within values
  * Jaas: revert semicolon and line break changes
  * Slapd: keep 1.1.0 behaviour, add Slapd_140 for 1.4.0 features
  * Sshd: keep 1.1.0 behaviour, add Sshd_140 for 1.4.0 features
  * Syslog: restore tree without protocol for UDP hosts
  * UpdateDB: keep Simplevars to load config by default


author: Pino Toscano <ptoscanoredhat.com> - 1.4.0-4
changelog:
- Fix CVE-2017-7555, improper handling of escaped strings (RHBZ#1481546)
- Skip testSaveNoPermission when running as root (RHBZ#1269817)
- Chrony: allow signed numbers (RHBZ#1302017)
- Krb5: support includedir (RHBZ#1406111)


author: Pino Toscano <ptoscanoredhat.com> - 1.4.0-5
changelog:
- Cgconfig: allow fperm & dperm in admin & task (RHBZ#1325741)
- Grub: handle top-level "boot" directive (RHBZ#1484261)


author: Stephan Bergmann <sbergman@redhat.com> - 1:5.3.6.1-17
changelog:
- Resolves: rhbz#1545262 Workaround for spurious ppc64le automated testing crash
- Resolves: rhbz#1610692 silence console warnings from print dialog


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.14.28-5
changelog:
- Append python-botocore and python-jmespath bundled directory to
  search path where needed

  Resolves: rhbz#1509434


author: Ondrej Holy <oholy@redhat.com> - 3.14.1-1
changelog:
- Update to 3.14.1
- Remove obsolete upstream patch
- Add translations updates from upstream
- Resolves: #1174557


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-59
changelog:
- Support for additional signing algorithms in rndc (#1501531)
- New autogenerated rndc keys will use hmac-sha256 algorithm


author: Nick Clifton <nickc@redhat.com> 2.27-21.base
changelog:
- Prevent the PowerPC64 linker from triggering a seg-fault when discarding dynamic sections.
  (#1513014)


author: Nick Clifton <nickc@redhat.com> 2.27-28.base
changelog:
- Stop the x86_64 linker from crashing when asked to convert a reloc against the ABS section.
  (#1557346)
- Stop strip from replacing unknown relocs with null relocs.
  (#1545386)


author: Nick Clifton <nickc@redhat.com> 2.27-30.base
changelog:
- Version bump in order to allow a rebuild, in order to work around a transient problem with the compose database.


author: Nick Clifton <nickc@redhat.com> 2.27-32.base
changelog:
- Fix seg-fault parsing DWARF-1 information.  (#1569580)
- Fix seg-fault parsing DWARF-2 information.  (#1569891)
- Fix seg-fault parsing COFF files.  (#1571917)


author: Nick Clifton <nickc@redhat.com> 2.27-33.base
changelog:
- Fix seg-fault parsing ELF files.  (#1578979)
- Fix seg-fault parsing DWARF-2 information.  (#1579065)
- Fix seg-fault parsing DWARF-2 information.  (#1579051)
- Fix seg-fault parsing a PE format file.  (#1579019)


author: Nick Clifton <nickc@redhat.com> 2.27-34.base
changelog:
- Fix seg-fault parsing corrupt AOUT format files.  (#1579799)
- Fix seg-fault parsing corrupt DWARF2 debug information.  (#1579802)
- Fix seg-fault parsing corrupt ELF format files.  (#1579801)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-952.el7]
changelog:
- [netdrv] mlx5e: IPoIB, Use priv stats in completion rx flow (Alaa Hleihel) [1618609]
- [netdrv] mlx5e: IPoIB, Add ndo stats support for IPoIB child devices (Alaa Hleihel) [1618609]
- [netdrv] mlx5e: IPoIB, Add ndo stats support for IPoIB netdevices (Alaa Hleihel) [1618609]
- [netdrv] mlx5e: IPoIB, Initialize max_opened_tc in mlx5i_init flow (Alaa Hleihel) [1618609]
- [netdrv] mlx5e: Present SW stats when state is not opened (Alaa Hleihel) [1618609]
- [netdrv] mlx5e: Avoid reset netdev stats on configuration changes (Alaa Hleihel) [1618609]
- [netdrv] mlx5e: Use bool as return type for mlx5e_xdp_handle (Alaa Hleihel) [1618609]
- [netdrv] net: aquantia: memory corruption on jumbo frames (Igor Russkikh) [1628238]
- [kernel] revert "platform/uv: Add adjustable set memory block size function" (Baoquan He) [1625143]
- [x86] revert "mm: probe memory block size for generic x86 64bit" (Baoquan He) [1625143]
- [x86] revert "mm: Use 2GB memory block size on large-memory x86-64 systems" (Baoquan He) [1625143]
- [x86] revert "mm: Streamline and restore probe_memory_block_size()" (Baoquan He) [1625143]
- [x86] revert "mm/memory_hotplug: determine block size based on the end of boot memory" (Baoquan He) [1625143]
- [mm] revert "memory_hotplug: do not fail offlining too early" (Baoquan He) [1625143]
- [mm] revert "memory_hotplug: remove timeout from __offline_memory" (Baoquan He) [1625143]
- [kernel] revert "x86/platform/uv: Add adjustable set memory block size function" (Baoquan He) [1625143]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-953.el7]
changelog:
- [cdrom] information leak in cdrom_ioctl_media_changed() (Sanskriti Sharma) [1578207] {CVE-2018-10940}
- [mm] mlock: remove lru_add_drain_all() (Oleksandr Natalenko) [1624765]
- [block] blk-mq: fix race between updating nr_hw_queues and switching io sched (Ming Lei) [1619988]
- [block] blk-mq: avoid to map CPU into stale hw queue (Ming Lei) [1619988]
- [block] blk-mq: fix sysfs inflight counter (Ming Lei) [1548261]
- [block] blk-mq: count allocated but not started requests in iostats inflight (Ming Lei) [1548261]
- [block] fix a crash caused by wrong API (Ming Lei) [1548261]
- [block] blk-mq: enable checking two part inflight counts at the same time (Ming Lei) [1548261]
- [block] blk-mq: provide internal in-flight variant (Ming Lei) [1548261]
- [block] make part_in_flight() take an array of two ints (Ming Lei) [1548261]
- [block] pass in queue to inflight accounting (Ming Lei) [1548261]
- [x86] Mark Intel Cascade Lake supported (Steve Best) [1584343]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-954.el7]
changelog:
- [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625991] {CVE-2018-14634}
- [fs] exec: account for argv/envp pointers (Yauheni Kaliuta) [1625991] {CVE-2018-14634}
- [kernel] revert "sched/topology: Introduce NUMA identity node sched domain" (Gustavo Duarte) [1620031]
- [powerpc] revert "powernv: Add a virtual irqchip for opal events" (Gustavo Duarte) [1617966]
- [powerpc] revert "powernv: Reorder OPAL subsystem initialisation" (Gustavo Duarte) [1617966]
- [char] revert "ipmi/powernv: Convert to irq event interface" (Gustavo Duarte) [1617966]
- [tty] revert "hvc: Convert to using interrupts instead of opal events" (Gustavo Duarte) [1617966]
- [powerpc] revert "powernv/eeh: Update the EEH code to use the opal irq domain" (Gustavo Duarte) [1617966]
- [powerpc] revert "powernv/opal: Convert opal message events to opal irq domain" (Gustavo Duarte) [1617966]
- [powerpc] revert "powernv/elog: Convert elog to opal irq domain" (Gustavo Duarte) [1617966]
- [powerpc] revert "powernv/opal-dump: Convert to irq domain" (Gustavo Duarte) [1617966]
- [powerpc] revert "opal: Remove events notifier" (Gustavo Duarte) [1617966]
- [powerpc] revert "powernv: Increase opal-irqchip initcall priority" (Gustavo Duarte) [1617966]
- [powerpc] revert "opal-irqchip: Fix double endian conversion" (Gustavo Duarte) [1617966]
- [powerpc] revert "opal-irqchip: Fix deadlock introduced by "Fix double endian conversion"" (Gustavo Duarte) [1617966]
- [sound] alsa: hda/realtek - two more lenovo models need fixup of MIC_LOCATION (Jaroslav Kysela) [1611958]
- [sound] alsa: hda/realtek - Fix the problem of two front mics on more machines (Jaroslav Kysela) [1611958]
- [sound] alsa: hda/realtek - Enable mic-mute hotkey for several Lenovo AIOs (Jaroslav Kysela) [1611958]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-955.el7]
changelog:
- [netdrv] net/mlx5e: IPoIB, Set the netdevice sw mtu in ipoib enhanced flow (Alaa Hleihel) [1633652]
- [netdrv] net/mlx5e: Fix traffic between VF and representor (Alaa Hleihel) [1633652]
- [mm] vmscan: do not loop on too_many_isolated for ever (Waiman Long) [1632050]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-956.el7]
changelog:
- [block] blk-mq: fix hctx debugfs entry related race between update hw queues and cpu hotplug (Ming Lei) [1619988]
- [nvme] nvme-pci: unquiesce dead controller queues (Ming Lei) [1632424]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-957.el7]
changelog:
- [mm] mlock: avoid increase mm->locked_vm on mlock() when already mlock2(, MLOCK_ONFAULT) (Rafael Aquini) [1633059]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.1.1.el7]
changelog:
- [x86] boot: Fix kexec booting failure in the SEV bit detection code (Kairui Song) [1644990 1628828]
- [net] 8021q: create device with all possible features in wanted_features (Davide Caratti) [1644675 1640645]
- [mm] memcontrol: fix high scheduling latency source in mem_cgroup_reparent_charges (Andrea Arcangeli) [1644673 1632898]
- [kernel] cpuset: use trialcs->mems_allowed as a temp variable (Aristeu Rozanski) [1644236 1613248]
- [kernel] cpuset: fix a warning when clearing configured masks in old hierarchy (Aristeu Rozanski) [1644236 1613248]
- [kernel] cpuset: initialize effective masks when clone_children is enabled (Aristeu Rozanski) [1644236 1613248]
- [x86] efi: Only load initrd above 4g on second try (Lenny Szubowicz) [1643359 1608955]
- [x86] efi: Support initrd loaded above 4G (Lenny Szubowicz) [1643359 1608955]
- [x86] efi: Generalize handle_ramdisks() and rename to handle_cmdline_files() (Lenny Szubowicz) [1643359 1608955]
- [kernel] sched/fair: Fix throttle_list starvation with low CFS quota (Phil Auld) [1640675 1601153]
- [target] scsi: iscsi: Use bin2hex instead of a re-implementation (Maurizio Lombardi) [1634711 1627034] {CVE-2018-14633}
- [target] scsi: iscsi: Use hex2bin instead of a re-implementation (Maurizio Lombardi) [1634711 1627034] {CVE-2018-14633}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.1.2.el7]
changelog:
- [net] rtnetlink: give a user socket to get_target_net() (Jiri Benc) [1639635 1630694] {CVE-2018-14646}
- [net] Add variants of capable for use on on sockets (Jiri Benc) [1639635 1630694] {CVE-2018-14646}


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: genkey.patch
-->  Debrand certs
- Ran Regex: Red Hat Enterprise => Scientific
-->  This RPM shouldn't say it is upstream's product
- Added Source: debrand_taint_cpu.patch
-->  Rename RHEL7 to SL7
- Added Source: sl-ldup.x509
-->  The FNAL SL signing certificate for driver updates
- Added Source: kernel-spec_use_our_keys.patch
-->  Remove the TUV keys and sign with ours
- Added Source: kernel.ini
-->  Config file for automated patch script
- Added Source: sl-kpatch.x509
-->  The FNAL SL signing certificate for kpatch updates
- Added Source: fnal-sl.cer
-->  The FNAL SL signing certificate
- Added Source: kernel-spec_debrand_taint_cpu.patch
-->  Apply our debrand patch


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-949.el7]
changelog:
- [scsi] libsas: fix memory leak in sas_smp_get_phy_events() (Tomas Henzl) [1558582] {CVE-2018-7757}
- [vhost] fix info leak due to uninitialized memory (Jason Wang) [1573705] {CVE-2018-1118}
- [pci] Fix calculation of bridge window's size and alignment (Myron Stowe) [1623800]
- [md] dm thin metadata: try to avoid ever aborting transactions (Mike Snitzer) [1614151]
- [crypto] api: fix finding algorithm currently being tested (Herbert Xu) [1618701]
- [sound] alsa: hda/realtek: Fix HP Headset Mic can't record (Jaroslav Kysela) [1622721]
- [sound] alsa: hda/realtek - Fixup for HP x360 laptops with B&O speakers (Jaroslav Kysela) [1622721]
- [sound] alsa: hda/realtek - Fixup mute led on HP Spectre x360 (Jaroslav Kysela) [1622721]
- [target] scsi: tcmu: use u64 for dev_size (Xiubo Li) [1603363]
- [target] scsi: tcmu: use match_int for dev params (Xiubo Li) [1603363]
- [target] scsi: tcmu: do not set max_blocks if data_bitmap has been setup (Xiubo Li) [1603363]
- [target] scsi: tcmu: unmap if dev is configured (Xiubo Li) [1603363]
- [target] scsi: tcmu: check if dev is configured before block/reset (Xiubo Li) [1603363]
- [target] scsi: tcmu: use lio core se_device configuration helper (Xiubo Li) [1603363]
- [target] scsi: target: add helper to check if dev is configured (Xiubo Li) [1603363]
- [target] scsi: tcmu: initialize list head (Xiubo Li) [1603363]
- [target] scsi: target_core_user: fix double unlock (Xiubo Li) [1603363]
- [s390] arch: Set IORESOURCE_SYSTEM_RAM flag for resources (Gary Hook) [1627889]
- [x86] efi-bgrt: Switch all pr_err() to pr_notice() for invalid BGRT (Lenny Szubowicz) [1464241]
- [x86] efi/bgrt: Don't ignore the BGRT if the 'valid' bit is 0 (Lenny Szubowicz) [1464241]
- [x86] efi: Preface all print statements with efi* tag (Lenny Szubowicz) [1464241]
- [x86] efi-bgrt: Switch pr_err() to pr_debug() for invalid BGRT (Lenny Szubowicz) [1464241]
- [x86] efi-bgrt: Add error handling; inform the user when ignoring the BGRT (Lenny Szubowicz) [1464241]
- [x86] efi: Check status field to validate BGRT header (Lenny Szubowicz) [1464241]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-950.el7]
changelog:
- [kernel] posix-timer: Properly check sigevent->sigev_notify (Phil Auld) [1613711] {CVE-2017-18344}
- [sound] alsa: rawmidi: Change resized buffers atomically (Denys Vlasenko) [1593087] {CVE-2018-10902}
- [fs] Fix up non-directory creation in SGID directories (Miklos Szeredi) [1600953] {CVE-2018-13405}
- [fs] pnfs: Layoutreturn must free the layout after the layout-private data (Scott Mayhew) [1625517]
- [fs] sunrpc: Ensure we always close the socket after a connection shuts down (Steve Dickson) [1614950]
- [fs] xfs: remove filestream item xfs_inode reference (Brian Foster) [1518623]
- [mm] set IORESOURCE_SYSTEM_RAM to system RAM to fix memory hot-add failure (Larry Woodman) [1628349]
- [firmware] efivars: Protect DataSize and Data in efivar_entry.var (Lenny Szubowicz) [1597868]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-951.el7]
changelog:
- [fs] fanotify: fix logic of events on child (Miklos Szeredi) [1597738]
- [fs] cifs: add a check for session expiry (Leif Sahlberg) [1626358]
- [fs] xfs: completely disable per-inode DAX behavior (Eric Sandeen) [1623150]
- [fs] fs: get_rock_ridge_filename(): handle malformed NM entries (Bill O'Donnell) [1340778] {CVE-2016-4913}
- [md] fix 'allow faster resync only on non-rotational media' underneath dm (Nigel Croxon) [1561162]
- [md] Revert "allow faster resync only on non-rotational media" (Nigel Croxon) [1561162]
- [mm] madvise: fix madvise() infinite loop under special circumstances (Rafael Aquini) [1552982] {CVE-2017-18208}
- [infiniband] srpt: Support HCAs with more than two ports (Don Dutile) [1616192]
- [infiniband] overflow.h: Add allocation size calculation helpers (Don Dutile) [1616192]
- [net] ip_tunnel: clean the GSO bits properly (Flavio Leitner) [1607907]
- [kernel] revert cpuset: fix a warning when clearing configured masks in old hierarchy (Aristeu Rozanski) [1626943]
- [s390] sclp: Change SCLP console default buffer-full behavior (Hendrik Brueckner) [1625350]
- [x86] kvm: Take out __exit annotation in vmx_exit() (Waiman Long) [1626560]
- [x86] mark coffeelake-s 8+2 as supported (David Arcari) [1575457]
- [x86] kvm: vmx: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1619602]
- [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1619602]


author: Kai Engert <kaie@redhat.com> - 2017.2.11-71
changelog:
- Update to CKBI 2.11 from NSS 3.28.1 with legacy modifications.
- Use comments in extracted bundle files.
- Change packaging script to support empty legacy bundles.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-72
changelog:
- Changed the packaged bundle to use the flexible p11-kit-object-v1 file format,
  as a preparation to fix bugs in the interaction between p11-kit-trust and
  Mozilla applications, such as Firefox, Thunderbird etc.
- For CAs trusted by Mozilla, set attribute nss-mozilla-ca-policy: true
- Require p11-kit 0.23.5
- Added an utility to help with comparing output of the trust dump command.


author: Kai Engert <kaie@redhat.com> - 2017.2.16-71
changelog:
- Update to CKBI 2.16 from NSS 3.32. In addition to removals/additions,
  Mozilla removed code signing trust from all CAs (rhbz#1472933)


author: Boris Ranto <branto@redhat.com> - 1:10.2.5-1
changelog:
- New version (1:10.2.5-1)
- Makefile: Fix dencoder build
- Add fake fcgiapp.h for rgw
- common: Build more files of libcommon in client
- libradosstripper: Build libradostripper for rados as noinst


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-1
changelog:
- Resolves: #1249753 challenge password not added in csr using start-tracking
- Resolves: #1250397 Remove certmonger rekey feature in 7.2
  - Remove rekey feature
- Related:  #1205756 Rebase certmonger to 0.77 or later
  - Update to upstream 0.78.4


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-2
changelog:
- Resolves: #1345755 Support for specifying IPA lightweight CA
  - Add 'issuer' request option for specifying issuer
  - Documentation: mark $CERTMONGER_CA_ISSUER as 0.79
  - Comment/whitespace fixup
  - ipa-submit: Retry without "ca" on OptionError
  - getcert: fix a potential out-of-bounds
  - Document the -X option in the ipa-submit man page
- Resolves: #1351052 certmonger build for RHEL 7.3 failure
  - Stop assuming RSA 512 works
  - Stop assuming RSA 512 works, part two
  - Fix a flakiness in the 028-dbus test


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-3
changelog:
- Resolves: #1367683 getcert request command fails to use Sub CA using -X
  argument
  - Fix CA option name for ipa cert-request


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-4
changelog:
- Use required DER encoding when setting CA basic constraint (#1551635)
- NSS 3.34 more strictly enforces length checking when verifying signatures
  (#1551702)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-5
changelog:
- Add Requires on psmsic for killall in post script (#1458890)
- upstream project migrated from fedorahosted.org to pagure.io (#1501723)
- Strip CR/LF from passwords read from a file (#1545935)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-8
changelog:
- Disable iterate-10 test which fails intermitently (#1596161)
- Add BuildRequires for running autoreconf


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-9
changelog:
- Remove patch to pass _PROXY, _proxy, LANG and LC_* environment
  variables to helpers. The root cause was a bug in IPA (#1596161)


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.14-1
changelog:
- make pathname canonicalization slightly smarter, to handle ".." in
  locations (#1131758)
- updates to self-tests (#1144082)


author: Jan Cholasta <jcholast@redhat.com> - 0.75.14-2
changelog:
- backport dogtag-submit: accept additional options to pass to the server when
  approving requests using agent creds (#1165155)


author: Jan Cholasta <jcholast@redhat.com> - 0.75.14-3
changelog:
- backport change from git to correctly retrieve string values from DBus
  property interface replies (#1181022)


author: Jan Cholasta <jcholast@redhat.com> - 0.78.1-1
changelog:
- Resolves: #1140241 RFE: Add SCEP support to certmonger
- Resolves: #1148001 ipa-getcert killed by SIGABRT
- Resolves: #1205756 Rebase certmonger to 0.77 or later
  - Update to upstream 0.78.1


author: Jan Cholasta <jcholast@redhat.com> - 0.78.3-1
changelog:
- Resolves: #1244914 scep ca helper does not parse command line options
  correctly
- Related:  #1205756 Rebase certmonger to 0.77 or later
  - Update to upstream 0.78.3


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-3.1
changelog:
- Use required DER encoding when setting CA basic constraint (#1560961)
- NSS 3.34 more strictly enforces length checking when verifying signatures
  (#1560960)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
- Fix typos in test/dispol
- Set flex as default lexer
- Fix checkmodule output message
- Build policy on systems not supporting DCCP protocol
- Fail if module name different than output base filename


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-6
changelog:
- Add ibendport ocontext handling
- Add support for ibendportcon labels
- Add ibpkey ocontext handling
- Add support for ibpkeycon labels
- Add binary module support for xperms


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-16
changelog:
- Disable NetworkManager management of resolv.conf if nameservers
  are specified by configuration.
  Resolves: rhbz#1454491


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-18
changelog:
- Start the cloud-init init local service after the dbus socket is created
  so that the hostnamectl command works.
  Resolves: rhbz#1450521


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-23
changelog:
- Fix a bug tha caused cloud-init to fail as a result of trying
  to rename bonds.
  Resolves: rhbz#1512247


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-24
changelog:
- Set DHCP_HOSTNAME on Azure to allow for the hostname to be
  published correctly when bouncing the network.
  Resolves: rhbz#1434109


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.7.9-24.el7_5.1
changelog:
- ci-Revert-azure-Fix-publishing-of-hostname.patch [bz#1568717]
- ci-DataSourceAzure.py-use-hostnamectl-to-set-hostname.patch [bz#1568717]
- ci-sysconfig-Don-t-disable-IPV6_AUTOCONF.patch [bz#1578702]
- Resolves: bz#1568717
  (Add patch to bounce NICs in Azure/update DNS [rhel-7.5.z])
- Resolves: bz#1578702
  (cloud-init-0.7.9-9.el7_4.6 breaks IPv4/IPv6 dual-stack EC2 instances in AWS [rhel-7.5.z])


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.179-3
changelog:
- Add convenient conversions between stripe and linear.
- Fix snapshot hanging on shutdown.
- Fix internal error in lvs while pvmove in progress.
- Fix more coverity issues.
- Improve message for pvresize.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.180-1
changelog:
- Never send any discard ioctl with test mode.
- Fix thin-pool alloc which needs same PV for data and metadata.
- Enhance vgcfgrestore to check for active LVs in restored VG.
- Cache can use metadata format 2 with cleaner policy.
- Fix lvmetad hanging on shutdown.
- Fix check if resized PV can also fit metadata area.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.180-2
changelog:
- Add vdo plugin for monitoring VDO devices.
- Reject conversions on raid1 LVs with split tracked SubLVs.
- Reject conversions on raid1 split tracked SubLVs.
- Fix dmstats list failing when no regions exist.
- Reject conversions of LVs under snapshot.
- Limit suggested options on incorrect option for lvconvert subcommand.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.180-3
changelog:
- Fix lvconvert --splitmirror for mirror type (2.02.178).
- Do not pair cache policy and cache metadata format.
- Fix mirrors honoring read_only_volume_list.
- Fix vgcreate with sanlock when PVs are created automatically.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.180-7
changelog:
- Fix ordering of lvm2 activation and rbdmap services.
- Fix to avoid locking collisions when monitoring thin-pools.


author: Dominik Perpeet <dperpeet@redhat.com> 147-1
changelog:
- Update to 147 release
- Add "Software Updates" page for packages
- Fix Kubernetes authentication when Kubernetes configured for RBAC
- Add configuration of account locking and password expiry to Accounts page
- Consistently ignore loopback traffic on all network load graphs
- Add ABRT integration to the System page
- Resize the terminal dynamically to use all available space


author: Martin Pitt <mpitt@redhat.com> 148-1
changelog:
- Update Cluster/Registry Image tags design to current Openshift Web Console
- Delete Kubernetes session tokens on logout
- Detect unregistered RHEL systems on Software Updates page


author: Martin Pitt <mpitt@redhat.com> 155-1
changelog:
- Add NFS client support to the Storage page
 - Add checkboxes for common Storage encryption and mount options


author: Martin Pitt <mpitt@redhat.com> 160-1
changelog:
- Add check boxes for common NFS mount options
 - Redesign package list on Software Updates page and show RHEL Errata
 - Clarify Software Update status if only security updates are available
 - Add serial console to virtual Machines page and redesign the Consoles tab
 - Show more error message details for failures on virtual Machines page


author: Dominik Perpeet <dperpeet@redhat.com> 141-1
changelog:
- Update to 141 release
- Allow users to change Docker container environment variables
- Allow auth commands to store credentials for future challenges
- Attempt to tear down used partitions when formatting disks
- Show the correct known_hosts path on missing/mismatching host keys
- Set HTML content type when serving login page, for better reverse proxy operation


author: Martin Pitt <mpitt@redhat.com> 158-1
changelog:
- Update to 158 release
- New package "cockpit-packagekit", which provides a "Software Updates" page
  for installing package updates rhbz#1479836
- Add NFS client support to the Storage page
- Add checkboxes for common Storage encryption and mount options
- Adjust cockpit-storaged dependencies to storaged → udisks2 rename
  rhbz#1510667


author: Martin Pitt <mpitt@redhat.com> 159-1
changelog:
- Update to 159 release
- Configure data deduplication with VDO devices on Storage page
- Add serial console to virtual Machines page and redesign the Consoles tab
- Show more error message details for failures on virtual Machines page


author: Martin Pitt <mpitt@redhat.com> 160-2
changelog:
- Add kubevirt Virtual Machines overview
- Redesign package list on Software Updates page and show RHEL Errata


author: Martin Pitt <mpitt@redhat.com> 165-1
changelog:
- Update to 165 release
- New VMs can be created on Machines page
- Improve LVM volume resizing
- Hide Docker storage pool reset button when it cannot work properly
- Move NFS management into new details page
- Show more details of sessions and services that keep NFS busy
- Machines page now shows proper error notifications
- Show virtual machines that are being created
- Detect if libvirtd is not running and offer to start and/or enable it
- Enable building of cockpit-machines-ovirt rhbz#1515796


author: Martin Pitt <mpitt@redhat.com> 154-3
changelog:
- Update source po for Japanese translations rhbz#1512923
- Adjust build system to avoid build failure for the above


author: Martin Pitt <mpitt@redhat.com> 169-3
changelog:
- Rebase to version 169, drop all patches rhbz#1568728
- Fix Subscriptions page hang when accessing as non-admin rhbz#1442540
- Show an indicator on front page if updates are available rhbz#1495543
- Properly localize "Log in" rhbz#1541454
- Improve check for root privilege availability, to e. g. also work for FreeIPA
  admins rhbz#1574630


author: Martin Pitt <mpitt@redhat.com> 173-6
changelog:
- Fix remote unauthenticated crash with crafted URLs rhbz#1627631
- Fix off-by-one error in flow control rhbz#1626846


author: Martin Pitt <mpitt@redhat.com> 173.1-1
changelog:
- Crash fixes spotted by coverity rhbz#1644345
- Fix race condition with fslist channels rhbz#1644346
- Fix remotectl crash on errors rhbz#1644348


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: cockpit-spec-debranding.patch
-->  Correctly brand this as NOT TUV's product
- Added Source: cockpit.ini
-->  Config file for automated patch script


author: Jan Grulich <jgrulich@redhat.com> - 0.23-1
changelog:
- Spec file based on exiv2 package to provide old libraries before API change
  Resolves: bz#1568618


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-6
changelog:
+ control-center-3.26.2-6
- Fix Clone MAC not being saved in Ethernet device properties
- Resolves: #1467295


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-8
changelog:
+ control-center-3.26.2-8
- Fix Wi-Fi networks not getting updated
- Show "Wi-Fi disabled" page when Wi-Fi is disabled
- Resolves: #1545713


author: Robert Relyea <rrelyea@redhat.com> - 1.1.0-34
changelog:
- recognize up to 32 keys and certs in coolkeys. (can go up to 62 with just #define changes)
- own our cache file.
- verify we are using the correct mechanisms


author: Jiri Vanek <jvanek@redhat.com> - 1.1-3
changelog:
- commented requires on lua posix to stop blocking composes.
- changed it to 644 to dont mislead by executable flags
- Resolves: rhbz#1296430


author: Jiri Vanek <jvanek@redhat.com> - 1.1-5
changelog:
- posttrans silenced, the error is appearing only in state, when there is nothing to copy
- Resolves: rhbz#1296430


author: Jiri Vanek <jvanek@redhat.com> - 2.2-1
changelog:
- added "jre/lib/security/blacklisted.certs" to cared files
- moved to newest release 2.1
- moved to new upstream at pagure.io
- added new script of copy_jdk_configs_fixFiles.sh 
- copy_jdk_configs.lua  aligned to it
- Resolves: rhbz#1427463


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-4
changelog:
- Resolves: rhbz#1367813

- Man: Fix corosync-qdevice-net-certutil link (rhbz#1367813)
- merge upstream commit 49a9f722bba13e4b2762151b7b96b1d4196fd5e0 (rhbz#1367813)
- man: mention qdevice incompatibilites in votequorum.5 (rhbz#1367813)
- merge upstream commit 0da1b7446239424b76b1d5eb7c3640afce9b054e (rhbz#1367813)
- Qnetd LMS: Fix two partition use case (rhbz#1367813)
- merge upstream commit b0c850f308d44ddcdf1a1f881c1e1142ad489385 (rhbz#1367813)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-6
changelog:
- Resolves: rhbz#1371880

- libvotequorum: Bump version (rhbz#1371880)
- merge upstream commit 96f91f23a6a413535cc2f0e8492e2300373fed40 (rhbz#1371880)
- votequorum: Don't update expected_votes display if value is too high (rhbz#1371880)
- merge upstream commit 596433066805af029be1292a37a35ce31307f0bf (rhbz#1371880)
- votequorum: simplify reconfigure message handling (rhbz#1371880)
- merge upstream commit 4a385f2e94c7168dbd92168c54a80ee97a3c2140 (rhbz#1371880)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-7
changelog:
- Related: rhbz#1371880

- Fix build on RHEL7.3 latest (rhbz#1371880)
- merge upstream commit 19e48a6eee20d5f34f79a3b8d4e1c694169c1d7b (rhbz#1371880)
- Enable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-8
changelog:
- Resolves: rhbz#1434528
- Resolves: rhbz#1434529
- Resolves: rhbz#1434534

- cfg: Prevents use of uninitialized buffer (rhbz#1434528)
- merge upstream commit 52e6ae57ea06d0bef61c5c9250881bef1372ead2 (rhbz#1434528)
- man: Fix typos in man page (rhbz#1434529)
- merge upstream commit b642904ea9640bd7a1573a8c0d2c5bcb43a10dfc (rhbz#1434529)
- Fix typo: Destorying -> Destroying (rhbz#1434529)
- merge upstream commit 117d9e4eb77ef9941fdeaf17ddfd892514da8143 (rhbz#1434529)
- init: Add doc URIs to the systemd service files (rhbz#1434529)
- merge upstream commit 21a728785027483786e41c19f6aff57a95b80aa5 (rhbz#1434529)
- man: Modify man-page according to command usage (rhbz#1434529)
- merge upstream commit 79898e8cb1715e79b7467b91661b7341e2664550 (rhbz#1434529)
- Totempg: remove duplicate memcpy in mcast_msg func (rhbz#1434528)
- merge upstream commit 4a8e9d80409590cb42732ae3105b5ae71fda52c1 (rhbz#1434528)
- upstart: Add softdog module loading example (rhbz#1434529)
- merge upstream commit 75474d69bebea6c9c4ef2252476ce738cf92f0f4 (rhbz#1434529)
- Remove deprecated doxygen flags (rhbz#1434529)
- merge upstream commit b252013e42007ea7284ae54d035a30ca40f20fc0 (rhbz#1434529)
- Remove redundant header file inclusion (rhbz#1434528)
- merge upstream commit d6c7ade277a4a23d84c56d7fde6b60b377a1023b (rhbz#1434528)
- Qdevice: fix spell errors in qdevice (rhbz#1434529)
- merge upstream commit d9caa09c45d4560c89a1ad873087c0476cabab46 (rhbz#1434529)
- doc: document watchdog_device parameter (rhbz#1434529)
- merge upstream commit a5f97ae1b99063383d8f45168125b34232b91faf (rhbz#1434529)
- Logsys: Change logsys syslog_priority priority (rhbz#1434534)
- merge upstream commit 609cc0cc100aa1070d97b405273373682da0e270 (rhbz#1434534)
- logconfig: Do not overwrite logger_subsys priority (rhbz#1434534)
- merge upstream commit c866a2f8603b44e89eb21a6cf7d88134af2e8b66 (rhbz#1434534)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9
changelog:
- Resolves: rhbz#1445001

- Main: Call mlockall after fork (rhbz#1445001)
- merge upstream commit 238e2e62d8b960e7c10bfa0a8281d78ec99f3a26 (rhbz#1445001)
- Disable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-10
changelog:
- Resolves: rhbz#1439205
- Resolves: rhbz#1461450
- Resolves: rhbz#1469170
- Resolves: rhbz#1476214

- main: Don't ask libqb to handle segv, it doesn't work (rhbz#1439205)
- merge upstream commit c0da36a6c0ecf7bc7def252a06336a7088e68086 (rhbz#1439205)
- totem: Propagate totem initialization failure (rhbz#1461450)
- merge upstream commit 0413a8f4672352171f0df731b7d9c1fe20acbc4c (rhbz#1461450)
- totemcrypto: Refactor symmetric key importing (rhbz#1461450)
- merge upstream commit a885868181c07ba9ab5cdfdad1d66d387b2a4428 (rhbz#1461450)
- totemcrypto: Use different method to import key (rhbz#1461450)
- merge upstream commit 5dadebd21862074deaeb9a337fc9e49f5e9f692a (rhbz#1461450)
- main: Add option to set priority (rhbz#1469170)
- merge upstream commit a008448efb2b1d45c432867caf08f0bcf2b4b9b0 (rhbz#1469170)
- main: Add support for libcgroup (rhbz#1476214)
- merge upstream commit c56086c701d08fc17cf6d8ef603caf505a4021b7 (rhbz#1476214)
- totemcrypto: Fix compiler warning (rhbz#1461450)
- merge upstream commit fdeed33f514e0056e322a45d9a0a04ca4b9a2709 (rhbz#1461450)


author: Jan Friesse <jfriesse@redhat.com> 2.4.3-2
changelog:
- Resolves: rhbz#1536219

- logging: Make blackbox configurable (rhbz#1536219)
- merge upstream commit 8af39f66e56e319b6b93804c0400e6e29737a90f (rhbz#1536219)
- logging: Close before and open blackbox after fork (rhbz#1536219)
- merge upstream commit 995ed0bd814ff3eacf6c09534841e6ce39ab6614 (rhbz#1536219)


author: Marek Polacek <polacek@redhat.com> 4.8.5-20
changelog:
- handle exceptions in basic_istream::sentry (#1469384)
- don't run pr63354.c on ppc (#1468546)
- ensure proxy privatization safety (#1491395)
- fix incorrect codegen from rdseed intrinsic use (#1482762, CVE-2017-11671)
- on aarch64, remove libatomic.so (#1465510)


author: Marek Polacek <polacek@redhat.com> 4.8.5-21
changelog:
- fix 27_io/basic_fstream/53984.cc
- fix for classes with bases with mutable members (PR c++/77375)
- fix handling side-effects of parameters (PR c/77767)
- fix combine's make_extraction (PR rtl-optimization/78378)
- fix gimplification of const var initialization from COND_EXPR (PR c++/80129)
- fix -A / -B to A / B folding (PR middle-end/80362)
- fix comparison of decimal float zeroes (PR middle-end/80692)
- fix __mulv[dt]i3 and expand_mul_overflow (PR target/82274)


author: Jeff Law <law@redhat.com> 4.8.5-24
changelog:
- Sync gcc48-rh1469697-13 patch to upstream (#1469697)
- Avoid probing in the red zone for noreturn functions (#1507980, #1469697)
- Avoid infinite loop if probing interval is less than guard size (#1469697)
- Fix debug information for large probing interval on aarch64 (#1469697)
- Fix ICE on ppc port with large probing interval (#1469697)

- rebuild to remove static relocations not known to older linkers (#1508968)


author: Jeff Law <law@redhat.com> 4.8.5-26
changelog:
- Avoid red zone probing for zero residual dynamic allocation (#1469697)
- Avoid bogus CFIs for probes in noreturn fucntions on x86/x86_64 (#1469697)


author: Marek Polacek <polacek@redhat.com> 4.8.5-28
changelog:
- Minor testsuite fixes to clean up test results (#1469697)
- retpoline support for spectre mitigation (#1535655)


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-14
changelog:
- mark the 0hourly and dailyjobs crontabs as config
- properly handle users for whose getpwnam() returns NULL temporarily
- log when crond is shutting down


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-16
changelog:
- disable mail from anacron with empty MAILTO
- crontab: do not block access with PAM when running as root
- improve the crontab man page
- do not hardcode system_u selinux user but use the user from
  the current context


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-17
changelog:
- make anacron not to contradict itself in syslog
  (job output does not have to be necessarily mailed)


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-18
changelog:
- fix regression - spurious PAM log message from crontab (#1479064)
- allow empty variables in crontabs (#1439217)


author: Marcel Plch <mplch@redhat.com> - 1.4.11-20
changelog:
- Fix race condition when crontab is modified the same second
  before and after reading the crontab
- Resolves: rhbz#1638691


author: Ondrej Kozina <okozina@redhat.com> - 1.6.7-1
changelog:
- Update to cryptsetup 1.6.7.
- patch: avoid use of kernel crypto API socket which is known
  to be broken in RHEL7.0 kernel (7.1+ is fine).
- Resolves: #1206170


author: Ondrej Kozina <okozina@redhat.com> - 1.7.4-4
changelog:
- patch: fix regression in blockwise functions
- patch: avoid repeating error messages when device holders
  detected.
- patch: add option to cryptsetup-reencrypt to print progress
  log sequentaly
- patch: use --progress-frequency in reencryption dracut module
- Resolves: #1480006 #1447632 #1479857


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-2
changelog:
- patch: stop LUKS2 auto-recovery if device is no longer LUKS
  type
- patch: update cryptsetup man page for --type option
- patch: rephrase error message for invalid --type option in
  convert action
- Resolves: #1599281 #1601477 #1601481


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-3
changelog:
- Add expected permissions explicitly for locking directory.
- Reinstate sed script removing library rpath from libtool
  script due to bug in upstream sources distribution.
- Resolves: #1609847 #1610379


author: Andreas Schneider <asn@redhat.com> - 4.7.1-3
changelog:
- resolves: #1498353 - Fix broken MacOSX client which can't handle file_ids
                       correctly
- resolves: #1495490 - Fix client rename over SMB2
- resolves: #1510598 - Fix client volume cmd over SMB2


author: Andreas Schneider <asn@redhat.com> - 4.7.1-5
changelog:
- resolves: #1505940 - Fix 'net ads keytab list'
- resolves: #1518732 - Enable AES-NI to make SMB3 encryption and signing
                       faster


author: Andreas Schneider <asn@redhat.com> - 4.7.1-6
changelog:
- resolves: #1476153 - Handle SMB echo responses more gracefully
- resolves: #1523212 - Fix SMB2 client read-after-free issue


author: Andreas Schneider <asn@redhat.com> - 4.7.1-7
changelog:
- resolves: #1581369 - Fix segfault updating dns during 'net ads join'
- resolves: #1581373 - Fix segfault during NT1 session setup
- resolves: #1581376 - Fix segfault in keytab handling
- resolves: #1581377 - Fix segfault in smbclient dfsgetinfo


author: Andreas Schneider <asn@redhat.com> - 4.8.1-1
changelog:
- related: #1558560 - Rebase to newer Samba version
- resolves: #1567896 - Fix possible crash if secrets db is emtpy
- resolves: #1570020 - Fix a crash in smbd when dfsgetinfo is called


author: Andreas Schneider <asn@redhat.com> - 4.8.1-3
changelog:
- resolves: #1575205 - Fix segfault when updating DNS with 'net ads join'
- resolves: #1525511 - Fix idmap_rid dependency on trusted domain list


author: Andreas Schneider <asn@redhat.com> - 4.8.3-1
changelog:
- related: #1558560 - Rebase to Samba version 4.8.3
- resolves: #1579398 - Add winbind localauth krb5 plugin


author: Andreas Schneider <asn@redhat.com> - 4.8.3-4
changelog:
- resolves: #1614132 - Fix delete-on-close after smb2_find
- resolves: #1614265 - Fix CVE-2018-1139
- resolves: #1614269 - Fix CVE-2018-10858


author: Kamil Dudka <kdudka@redhat.com> 7.29.0-43
changelog:
- curl --socks5-{basic,gssapi}: control socks5 auth (#1409208)
- nss: fix a memory leak when CURLOPT_CRLFILE is used (#1427883)
- nss: do not leak PKCS #11 slot while loading a key (#1444860)
- nss: fix a possible use-after-free in SelectClientCert() (#1473158)


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-48
changelog:
- fix RTSP bad headers buffer over-read (CVE-2018-1000301)
- fix FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)
- fix LDAP NULL pointer dereference (CVE-2018-1000121)
- fix RTSP RTP buffer over-read (CVE-2018-1000122)
- http: prevent custom Authorization headers in redirects (CVE-2018-1000007)
- doc: --tlsauthtype works only if built with TLS-SRP support (#1542256)
- update certificates in the test-suite because they expire soon (#1572723)


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-50
changelog:
- remove dead code, detected by Coverity Analysis
- remove unused variable, detected by GCC and Clang


author: Jeff Moyer <jmoyer@redhat.com> - 58.2-1
changelog:
- rebase to v58.2
- remove patches that were backported from later versions
- we now support >4k faults, so remove rhel-only patches
- add libpmem dependency, and gate it on x86_64
- pull in static checker fix for uncheck sscanf result
- fix up use of uninitialized variable
- Related: bz#1457566 bz#1471807 bz#1456954


author: Jeff Moyer <jmoyer@redhat.com> - 60.3-2.1
changelog:
- Remove the btt.rules udev rule file.  This was fixed in-kernel. (Jeff Moyer)
- Related: bz#1585122


author: Jeff Moyer <jmoyer@redhat.com> - 62-1
changelog:
- Rebase to v62 (Jeff Moyer)
  - a new monitor command / daemon
  - an ndctl udev rule for recording the unsafe shutdown count
  - smart error injection
  - create-namespace fix for fragmented namespaces
- Resolves: bz#1610649 bz#1611833 bz#1456320


author: Marek Kasik <mkasik@redhat.com> - 0.26.0-1
changelog:
- Update to 0.26.0
- Remove editor subpackage
- Return libdbus-1 library (not header or pkgconfig files)
- Resolves: #1386841


author: Marek Kasik <mkasik@redhat.com> - 0.26.0-3
changelog:
- Check mtimes of files in /etc/dconf/db/*.d/ directories
- when running "dconf update"
- Resolves: #1626372


author: Marek Kasik <mkasik@redhat.com> - 0.28.0-3
changelog:
- Check mtimes of files in /etc/dconf/db/*.d/ directories
- when running "dconf update"
- Resolves: #1570569


author: Marek Kasik <mkasik@redhat.com> - 3.22.3-2
changelog:
- Import dconf-editor package from Fedora 25
- Add Conflicts tag
- Version BuildRequires
- Update License field
- Resolves: #1388931


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.38-1
changelog:
- ifdown-eth: we need to flush global scope as well
- killproc/status: add missing '-b <binary>' option
- specfile: mark 'rwtab' and 'statetab' as config files
- spec: we need newer lvm
- rwtab: add /var/lib/systemd/timers
- ifup-eth: remove quote marks
- 9.70-sync: Move everything to github
- 9.70-sync: rwtab updated
- 9.70-sync: service file updated
- 9.70-sync: syconfig.txt updated
- 9.70-sync: systemd/rhel-import-state updated
- 9.70-sync: sysconfig/network-scripts/* updated - part 2
- 9.70-sync: sysconfig/network-scripts/* updated - part 1
- 9.70-sync: rc.d/init.d/network updated
- 9.70-sync: rc.d/init.d/netconsole updated
- 9.70-sync: rc.d/init.d/functions updated
- 9.70-sync: ipv6-6to4.howto example updated
- 9.70-sync: examples/networking/ifcfg-bridge updated
- network: load NetworkManager connection via dbus
- network: check for running NetworkManager via dbus


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.39-1
changelog:
- sysconfig.txt: mention previously introduced NO_DHCP_HOSTNAME option
- DHCP_FQDN and DHCP_SEND_HOSTNAME introduced
- re-add missing $HOSTNAME initialization
- ifup: add support for VLAN_EGRESS_PRIORITY_MAP
- rhel-autorelabel: synchronize cached writes before reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.40-1
changelog:
- require 'redhat-release' instead of /etc/system-release & conflict with older versions
- ifup-post: always update 'nameserver' & 'search' entries in /etc/resolv.conf
- systemd/system: symlinks for initscripts' services removed
- *.old extension added to list of ignored files
- ifup-eth: wait for STP to complete setup on bridge if $DELAY is not set
- init.d/functions: convert2sec() function added
- init.d/functions: is_true() & is_false() extended by ON/OFF support
- usleep(1) calls replaced with sleep(1) calls
- network-scripts: DBus calls forwarded to /dev/null
- network-scripts: firewall-cmd replaced with DBus calls
- ARPUDATE option introduced


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.41-1
changelog:
- ifdown-post: fix logical error in commit 5d61564
- network-functions: use POSIX forwarding instead of bash-ism


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-111
changelog:
- Remove 0217-RHBZ-1437329-blacklist-oracle-devs.patch
  * Incorrect change, and the bug is already fixed.
- Move 0218-RHBZ-1448576-3PAR-config.patch to
  0217-RHBZ-1448576-3PAR-config.patch
- Resolves: bz #1448576


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-112
changelog:
- Modify 0191-RHBZ-1169168-disable-changed-paths.patch
  * man page fixup
- Modfiy 0197-RHBZ-1394059-max-sectors-kb.patch
  * man page fixup
- Modify 0205-RHBZ-1416569-reset-stats.patch
  * man page fixup
- Add 0218-RHBZ-1459370-add-feature-fix.patch
  * handle null feature string
- Add 0219-RHBZ-1448970-fix-resize.patch
  * if the resize fails, try to resume again with the old table.
- Add 0220-RHBZ-1448223-fix-kpartx.patch
  * gracefully fail when run on something other than a file or block device
- Add 0221-RH-harden-files.patch
  * change build parameters to use position independent code
- Add 0222-RHBZ-1457288-fix-show-maps-json.patch
  * handle running "show maps json" with no multipath devices present
- Add 0223-RHBZ-1452210-unpriv-sgio.patch
  * add unpriv_sgio configuration option to set unpriv_sgio on multipath device
    and paths
- Add 0224-RHBZ-1452210-prkey.patch
  * allow setting reservation_key to "file" to set and read keys from
    prkey_file. Also add new multipathd commands to modify the prkey file.
- Resolves: bz #1459370, #1448970, #1448223, #1457288, #1452210


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-113
changelog:
- Modify 0224-RHBZ-1452210-prkey.patch
  * fix errow with telling multipathd to set prkeys
- Add 0225-RH-udevdir.patch
  * fix rpmdiff complaint about udev rules installation
- Resolves: bz #1452210


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-114
changelog:
- Add 0226-RH-allow-overrides-section.patch
  * This is a dummy section that exists to help the transition to RHEL8
- Add 0227-RHBZ-1465773-fix-path-delay-msg.patch
- Add 0228-RHBZ-1464634-hauwei-config-update.patch
- Add 0229-RHBZ-1467987-poll-on-udev-monitor.patch
  * Do poll first, so udev_monitor_receive_device doesn't return error when
    there is no uevent
- Add 0230-UP-allow-invalid-creates.patch
  * Allow creation of devices with no valid paths.
- Add 0231-RHBZ-1458852-delay-readying.patch
  * Add ghost_delay configuration option to delay device activation when only
    ghost paths exist.
- Add 0232-RHBZ-1456955-property-blacklist.patch
  * Add the "property" blacklist type.
- Resolves: bz #1456955, #1458852, #1464634, #1465773, #1467987


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-115
changelog:
- Add 0233-RHBZ-1451852-1482629-nimble-config.patch
- Add 0234-RHBZ-1500109-doc-typo.patch
- Remove old triggerun scriptlet (bz1470384)
- Resolves: bz #1451852, #1470384, #1482629, #1500109


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-116
changelog:
- Add 0235-RHBZ-1480638-NVMe-support.patch
  * adds support for multipathing NVMe devices
- Resolves: bz #1480638


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-117
changelog:
- Modify 0235-RHBZ-1480638-NVMe-support.patch
  * remove overly-restrictive uevent filtering
- Resolves: bz #1480638


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-118
changelog:
- Modify 0224-RHBZ-1452210-prkey.patch
  * Improve error checking for mpathpersist
- Resolves: bz #1452210


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-119.1
changelog:
- Add 0237-RHBZ-1607749-add-transport-blacklist.patch
  * and new blacklist option, "protocol"
- Resolves: bz #1607749


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: dhcp.ini
-->  Config file for automated patch script
- Removed Patch: dhcp-4.2.0-errwarn-message.patch
-->  Remove patch containing instructions to report bugs to bugzilla.redhat.com


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-513
changelog:
- spec: add missing modules
- add 90multipath-hostonly module
Resolves: #1457311
- Add NTFS support to 90dmsquash-live module
Resolves: #1449410
- dracut.sh: gather host_modalias when "--no-hostonly-default-device" is set
- rootfs-block/module-setup.sh: check root_dev in cmdline_rootfs()
- dracut.sh: introduce "--no-hostonly-default-device" argument
Resolves: #1483838
- 10i18n/parse-i18n.sh: parse rd.vconsole and rd.locale
Resolves: #1479325
- dracut.cmdline: remove extra ":" from ip= doc
Resolves: #1469997
- Try BOOT_IMAGE and fallback to vmlinuz-${KERNEL}
- fips: honor $BOOT_IMAGE variable for HMAC check of the kernel
Resolves: #1415032


author: Lukáš Nykrýn <lnykryn@redhat.com> - 033-520
changelog:
- network/ifup: don't arping for point-to-point connections
Resolves: #1477339
- network: Only bring up wired network interfaces
Resolves: #1480246
- dracut.sh: source dracut-version.sh earlier than dracut-functions.sh
Resolves: #1490777
- Fix MTU on bond interface.
- add 'mtu' parameter for bond options
Resolves: #1494265
- fcoe: Allow more time for the bnx2x link negotiation before brining up fcoe interfaces.
Resolves: #1378910
- lvm_scan.sh: use -K when calling lvchange
Resolves: #1489841


author: Lukas Nykryn <lnykryn@redhat.com> - 033-534
changelog:
- base/dracut-lib.sh:dev_unit_name() guard against $dev beginning with "-"
- base/dracut-lib.sh: remove bashism
- Align dev_unit_name() with systemd's function.
- dracut-lib.sh:dev_unit_name(): use systemd-escape, if available
Resolves: #1306640
- 90dmsquash-live-ntfs: fix depends()
- 90dmsquash-live: we don't have find_binary inside initramdisk
- dracut: Ajusting variables name for --include
Resolves: #1489882


author: Lukas Czerner <lczerner@redhat.com> - 1.42.9-4
changelog:
- Fix posisble use after free in some error paths (#997982)
- Enable lazy_itable_init even if ext4 module is not loaded (#1071909)
- Remove any ocurence of ext4dev and test_fs from e2fsprogs (#1063801)
- Allow to resize ext4 file system past 16TB (#982871)
- Disable altivec instructions for libext2fs on ppc (#1074604)


author: Eric Sandeen <sandeen@redhat.com> 1.42.9-5
changelog:
- Various manpage updates for chattr and mount (#1053885)
- Fix resize2fs -P hang on corrupted filesystems (#1104612)


author: Eric Sandeen <sandeen@redhat.com> 1.42.9-8
changelog:
- e4defrag: backwards-allocated files should be defragmented (#1176785)
- tune2fs: allow removal of dirty journal with two "-f" options (#1212376)
- mke2fs: prevent creation of filesystem with unsupported revision (#1212378)
- libext2fs: prevent buffer overflows (#1293677)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-10
changelog:
- libext2fs: don't ignore fsync errors (#1405049)
- Fix nroff macro issue in chattr man page (#1429213)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-11
changelog:
- libext2fs: skip start_blk adjustment when stride and flex_bg is set (#1503969)
- tune2fs: edit dire warning about check intervals (#1433233)


author: Peter Jones <pjones@redhat.com> - 0.8.0-6
changelog:
- Handle -b and -o parsing in a way that matches the documentation.
  Resolves: rhbz#1174964
- Use the right GUID when setting boot entries active/inactive
  Resolves: rhbz#1221771


author: Peter Jones <pjones@redhat.com> - 17-2
changelog:
- Try to make covscan actually complete the scan...
  Related: rhbz#1570032
  Related: rhbz#1558937
  Related: rhbz#1520533


author: Peter Jones <pjones@redhat.com> - 36-6
changelog:
- Fix device path generation for block devices on nonstandard device path
  roots.
  Related: rhbz#1558937
  Resolves: rhbz#1591853


author: Peter Jones <pjones@redhat.com> - 36-10
changelog:
- Work around platform ACPI PCI(e) root drivers that don't fill in the
  "driver" symlink in sysfs.
  Resolves: rhbz#1614944


author: Peter Jones <pjones@redhat.com> - 36-11
changelog:
- Fix device probing with no matching probes where HD() will work
  Resolves: rhbz#1613698
- Detect partitiond md devices correctly
  Resolves: rhbz#1602414
  Resolves: rhbz#1613370


author: Peter Robinson <pbrobinson@fedoraproject.org> 4.0.1-1
changelog:
- Ekiga 4.0.1 stable release - Changelog
  http://ftp.gnome.org/pub/gnome/sources/ekiga/4.0/ekiga-4.0.1.news


author: Pat Riehecky <riehecky@fnal.gov> - 70.0.3-0.5
changelog:
- Revised fedora-gdm-logo picture (again)
- Revised plymoth splash screen
- now running image optimizations before packaging


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com> 7.1-3
changelog:
- Old EULA bug fixed 
- SL keys removed
- Removed Trigger for yum-conf-7x, we don't use that packaged - Sun Oct 25 2015
  |- sl-version 7.1-3


author: Petr Stodulka <pstodulk@redhat.com> -1.8.3.1-9
changelog:
- add control of GSSAPI credential delegation to enable HTTP(S)-SSO
  authentication
  Resolves: #1369173


author: Petr Stodulka <pstodulk@redhat.com> - 1.8.3.1-13
changelog:
- fall back to Basic auth if Negotiate fails
  Resolves: #1490998
- handle request-pull when multiple tags point to the same commit
  Resolves: #1192146


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-14
changelog:
- Backport fix for CVE-2018-1123
- Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
  and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-14
changelog:
- Backport fix for CVE-2018-11235
- Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
  and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-15
changelog:
- move instaweb to separate git-instaweb subpackage.
	Resolves: #1213059
- move gnome-keyring to a separate git-gnome-keyring subpackage.
	Resolves: #1284081


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-16
changelog:
- Remove EL-5 settings and old Fedora conditionals.
  Taken from fedora commits 903d8f35ed8ae16bece8ae8033f3d3926cc97595 and
  2c6eff99d7b50b87e8a1fe2e4a0489dfd90659b8.
- Fix builds using '--without docs'
- Change git-instaweb default from lighttpd(not available in rhel7) to
  apache2.
- Add requires for git-{instaweb,gnome-keyring} to pull them, when
  installing git-all.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-17
changelog:
- Correctly return an error from fsck on encountering a .gitmodules symlink.
  This was broken in the debian 2.1.x backport and found by covscan.
  Fix the test to catch this.
- Correct a typo in changelog.


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-19
changelog:
- Fix httpd modules path to be independent from system architecture.
Upstream commit: 1976311aa285549599e5a451d7ad72b55a2b60e2
Resolves: #1213059


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-20
changelog:
- Fix CVE-2018-17456: arbitrary code execution via .gitmodules
  Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
  and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Debarshi Ray <rishi@fedoraproject.org> - 3.12.12-4
changelog:
- Fix certificate validation (use reference identities, handle validation
  failures correctly, fixed the test suite)
- Resolves: #1386616


author: Marek Kasik <mkasik@redhat.com> - 3.28.2-3
changelog:
- Fix patch fixing crash in EvMediaPlayerKeys
- Fix building of comics backend with libarchive 3.1.2
- Resolves: #1567186


author: Marek Kasik <mkasik@redhat.com> - 3.28.2-4
changelog:
- Change requires as requested by RPMDiff
- Check returned size for negative value (CovScan)
- Resolves: #1567186


author: Milan Crha <mcrha@redhat.com> - 3.22.7-4
changelog:
- Add patch for RH bug #1441608 (Use-after-free when setting summary for component with alarms)
- Add patch for RH bug #1439590 ([IMAPx] Unsubscribed folders shown after refresh)


author: Milan Crha <mcrha@redhat.com> - 3.22.7-7
changelog:
- Add patch for RH bug #1504071 (Prefer SSL over STARTTLS for mail when both are set in GOA)
- Add patch for RH bug #1476329 (Deadlock on exit under e-categories.c:finalize_categories())


author: Milan Crha <mcrha@redhat.com> - 3.28.2-1
changelog:
- Update to 3.28.2
- Add patch for GNOME bug #795997 (Fails to parse Google OAuth2 authorization code)
- Resolves: #1575495


author: Milan Crha <mcrha@redhat.com> - 3.12.10-5
changelog:
- Add patch for RH bug #1366206 (Free/Busy Information returns wrong time)
- Add patch for RH bug #1367455 (No contacts are displayed until search is started)


author: Milan Crha <mcrha@redhat.com> - 3.22.6-2
changelog:
- Add patch for RH bug #1520936 (Unable to authenticate using Kerberos without krb5-auth-dialog package)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-90
changelog:
- fence_gce: new fence agent
  Resolves: rhbz#1568753
- fence_rhevm: dont require --ssl parameter when using --ssl-insecure
  Resolves: rhbz#1544093
- fence_mpath: fix preemptive abort
  Resolves: rhbz#1556857
- fence-agents-all: dont show manpage-tags in metadata
  Resolves: rhbz#1553908
- fence_scsi: dont write duplicates to .dev-file
  Resolves: rhbz#1575973
- fence_impilan: add iLO5-support
  Resolves: rhbz#1579391


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-1
changelog:
- rebase to v4.2.1
  Resolves: rhbz#1236395
- fence_mpath: add watchdog support
  Resolves: rhbz#1504202


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-8
changelog:
- fence_aliyun: add logging
  Resolves: rhbz#1568742
- fence_gce: add stackdriver-logging support, improve logging and
  set default mode to cycle
  Resolves: rhbz#1568753


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-83
changelog:
- fence_compute/fence_evacuate: add support for keystone v3 authentication
  Resolves: rhbz#1533170
- fence_ilo3: default to onoff
  Resolves: rhbz#1519370


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-86
changelog:
- fence-agents-all: remove fence-agents-aws and fence-agents-azure-arm
  dependencies
  Resolves: rhbz#1476009


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-86.1
changelog:
- fence_azure_arm: add network-fencing
  Resolves: rhbz#1565670
- fence_compute/fence_evacuate: fix parameters
  Resolves: rhbz#1565701


author: Ray Strode <rstrode@redhat.com> 3.14.2-6
changelog:
- Add more goo to the compat desktop file to prevent it
  from getting exposed in control-center
  Related: #1259292


author: Jan Horak <jhorak@redhat.com> - 60.1.0-8
changelog:
- Fixed homepage and bookmarks (rhbz#1606778)
- Fixed missing file associations in RHEL6 (rhbz#1613565)


author: Jan Horak <jhorak@redhat.com> - 60.1.0-9
changelog:
- Do not set user agent (rhbz#1608065)
- GTK dialogs are localized now (rhbz#1619373)
- JNLP association works again (rhbz#1607457)


author: Eric Garver <egarver@redhat.com> - 0.4.4.4-7
changelog:
- firewall.functions: New function get_nf_nat_helpers (RHBZ#1452681)
- firewall.core.fw: Get NAT helpers and store them internally. (RHBZ#1452681)
- firewall.core.fw_zone: Load NAT helpers with conntrack helpers (RHBZ#1452681)
- firewalld.dbus: Add missing properties nf_conntrach_helper_setting and
  nf_conntrack_helpers (RHBZ#1452681)
- D-Bus interfaces: Fix GetAll for interfaces without properties (RHBZ#1452017)
- firewall.server.firewalld: New property for NAT helpers supported by the
  kernel (RHBZ#1452681)


author: Phil Sutter - 0.4.4.4-11
changelog:
- core: Log unsupported ICMP types as informational only (RHBZ#1479951)
- doc: firewall-cmd: Document --query-* options return codes (RHBZ#1372716)
- doc: firewall-cmd: Document quirk in --reload option (RHBZ#1452137)
- firewall-cmd: Use colors only if output is a TTY (RHBZ#1368544)
- firewall-offline-cmd: Don't require root for help output (RHBZ#1445214)


author: David King <dking@redhat.com> - 0.8.4-2
changelog:
- Sync bzip2 dependency with Fedora package
- Make the libs subpackage depend on the base package for libostree
- Fix multilib issues with XML-based documentation


author: Colin Walters <walters@verbum.org> - 0.8.7-3
changelog:
- Fix libostree bundling:
  Ensure we do not Provide or Require libostree.
  Move the shared library into flatpak-libs so flatpak always
  depends on it.
  Keep the shared library filename as libostree, but put it
  under a private directory.  Renaming the file on disk did not
  really do much since the dynamic linker and RPM work from the
  soname.
  Resolves: #1476905


author: Ray Strode <rstrode@redhat.com> - 0.8.8-2
changelog:
- Fix crasher in xdg-desktop-portal
  Resolves: #1503579
- Tweak spec file so it still builds even though we need to
  autoreconf.


author: Akira TAGOH <tagoh@redhat.com> - 2.10.95-5
changelog:
- Fix the race condition issue on updating cache (#1011510)
- Fix crash issue in FcFontSort()
- Fix an issue not copying all values from the font.


author: Akira TAGOH <tagoh@redhat.com> - 2.13.0-4.1
changelog:
- Rebase to 2.13.0 (#1576501)
- Rename fc-cache binary to fc-cache-{32,64} for multilib. (#1568968)
- backport some fixes related to Flatpak.
- Drop new syntax in config for compatibility.
- Requires dejavu-sans-fonts instead of font(:lang=en) (#1484094)


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-2
changelog:
- Do not fail logrotate if radiusd is not running.
  Resolves: Bug#1365226 error running non-shared postrotate script for
                        /var/log/radius/radius.log of
                        '/var/log/radius/radius.log '
- Fix output to log file specified with -l option.
  Resolves: Bug#1421207 radiusd does not work with log file specified by -l
                        option
- Fix long hostnames interpreted as IP addresses.
  Resolves: Bug#1420359 radclient does not detect 4. level and higher domain
                        name as a domain name
- Avoid clashes with libtool library symbols.
  Resolves: Bug#1391960 undefined symbol: get_vtable in
                        /usr/lib64/libtdsodbc.so.0 with freeradius-unixODBC
- Remove mentions of Auth-Type = System from docs.
  Resolves: Bug#1420293 Freeradius does not know Auth-Type = System
- Improve ip/v4/v6/addr documentation.
  Resolves: Bug#1179736 add description for ipaddr = hostname from DNS with A
                        and AAAA entries


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-1
changelog:
- Upgrade to upstream v3.0.13 release.
  See upstream ChangeLog for details (in freeradius-doc subpackage).
  Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
  Resolves: Bug#1329181 freeradius-python fix libpython2.7.so dependency at
                        compile time
  Resolves: Bug#1425869 Radiusd does not trigger modules.sql.fail trap if it
                        can't connect to mysql server
  Resolves: Bug#1427829 Stack overflow when passing bare IPv6 to radclient


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-2
changelog:
- Fix some issues found with static analyzers.
  Resolves: Bug#1432103 FreeRADIUS fails covscan checks
- Revert rlm_eap_tnc removal, because the tncfhh package is still in RHEL.
  Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-3
changelog:
- Explicitly disable rlm_cache_memcached to avoid error when the module's
  dependencies are installed, and it is built, but not packaged.
  Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
- Prevent segfaults by adding a missing handling of connection errors in
  rlm_ldap.
  Resolves: Bug#1437409 [abrt] freeradius: radiusd killed by SIGSEGV
- Make radtest use Cleartext-Password for EAP, fixing its support for eap-md5.
  Resolves: Bug#1436619 radtest does not work with eap-md5


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-4
changelog:
- Disable internal OpenSSL cache.
  Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                        authentication bypass
- Check sizeof(*packet), not sizeof(packet) in EAP-PWD
  Resolves: Bug#1459073 Potential buffer overflow in FreeRADIUS EAP-PWD
- Parse port as well as address for dhcpclient destination
  Resolves: Bug#1457825 dhcpclient does no accept IP:PORT


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-5
changelog:
- Refer to correct package version in configuration comments for Bug#1458746
  (CVE-2017-9148) fix.
  Related: Bug#1458746  CVE-2017-9148 freeradius: TLS resumption
                        authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-6
changelog:
- Avoid race condition when creating session cache file
  Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                        authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-7
changelog:
- Resolves: Bug#1469408 CVE-2017-10978 freeradius: Out-of-bounds read/write due
                        to improper output buffer size check in make_secret()
- Resolves: Bug#1469412 CVE-2017-10983 freeradius: Out-of-bounds read in
                        fr_dhcp_decode() when decoding option 63
- Resolves: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                        data2vp_wimax()
- Resolves: Bug#1469416 CVE-2017-10985 freeradius: Infinite loop and memory
                        exhaustion with 'concat' attributes
- Resolves: Bug#1469419 CVE-2017-10986 freeradius: Infinite read in
                        dhcp_attr2vp()
- Resolves: Bug#1469422 CVE-2017-10987 freeradius: Buffer over-read in
                        fr_dhcp_decode_suboptions()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
- Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
- Related: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                       data2vp_wimax()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-9
changelog:
- Fix double free in rlm_sql acct_redundant
  Resolves: Bug#1551069 Radius service crashes with "Bad talloc magic value -
                        unknown value" when using module sql rlm_sql


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-11
changelog:
- Fixes CVE-2014-9657
   - Check minimum size of `record_size'.
- Fixes CVE-2014-9658
   - Use correct value for minimum table length test.
- Fixes CVE-2014-9675
   - New macro that checks one character more than `strncmp'.
- Fixes CVE-2014-9660
   - Check `_BDF_GLYPH_BITS'.
- Fixes CVE-2014-9661
   - Initialize `face->ttf_size'.
   - Always set `face->ttf_size' directly.
   - Exclusively use the `truetype' font driver for loading
     the font contained in the `sfnts' array.
- Fixes CVE-2014-9663
   - Fix order of validity tests.
- Fixes CVE-2014-9664
   - Add another boundary testing.
   - Fix boundary testing.
- Fixes CVE-2014-9667
   - Protect against addition overflow.
- Fixes CVE-2014-9669
   - Protect against overflow in additions and multiplications.
- Fixes CVE-2014-9670
   - Add sanity checks for row and column values.
- Fixes CVE-2014-9671
   - Check `size' and `offset' values.
- Fixes CVE-2014-9673
   - Fix integer overflow by a broken POST table in resource-fork.
- Fixes CVE-2014-9674
   - Fix integer overflow by a broken POST table in resource-fork.
   - Additional overflow check in the summation of POST fragment lengths.
- Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
- Resolves: #1197740


author: Richard Hughes <richard@hughsie.com> 1.0.1-1
changelog:
- Rebase to 1.0.1, specifically the wip/hughsie/rhel75 branch which adds
  back the automake build system and lowers the required versions of deps.
- This also un-neuters fwupd so that most of the plugins are functional,
  for instance allowing updates of Thunderbolt controllers and Logitech
  Unifying devices. However, the LVFS is still disabled.
- Resolves: #1313086


author: Peter Jones <pjones@redhat.com> - 9-6
changelog:
- Rebuild to make some dependencies versioned, in order to make TPS's really
  broken builder setup work.
  Related: rhbz#1380825


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-25
changelog:
- Added security fix for CVE-2017-7207 (bug #1434353)
- Added explicit requirement for lcms2 version we are build with (bug #1436273)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-29
changelog:
- Fix rare Segmentation fault when converting PDF to PNG (bug #1473337)
- Raise the default VMThreshold from 1Mb to 8Mb (bug #1479852)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-29.el7_5.1
changelog:
- Added security fixes for:
  - CVE-2018-16509 (bug #1621156)
  - CVE-2018-15910 (bug #1621157)
  - CVE-2018-16542 (bug #1621380)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-31
changelog:
- Added security fixes for:
  - CVE-2018-16509 (bug #1621158)
  - CVE-2018-15910 (bug #1621160)
  - CVE-2018-16542 (bug #1621382)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.1
changelog:
- Remove as many non-standard operators as possible to make the codebase
  closer to upstream for later CVEs
- Resolves: #1621383 - CVE-2018-16511 ghostscript: missing type check in type
  checker (699659)
- Resolves: #1621159 - CVE-2018-15908 ghostscript: .tempfile file permission
  issues (699657)
- Resolves: #1621381 - CVE-2018-15909 ghostscript: shading_param incomplete
  type checking (699660)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.1
changelog:
- Remove as many non-standard operators as possible to make the codebase
  closer to upstream for later CVEs
- Resolves: #1621383 - CVE-2018-16511 ghostscript: missing type check in type
  checker (699659)
- Resolves: #1649721 - CVE-2018-16539 ghostscript: incorrect access checking
  in temp file handling to disclose contents of files (699658) 
- Resolves: #1621159 - CVE-2018-15908 ghostscript: .tempfile file permission
  issues (699657)
- Resolves: #1621381 - CVE-2018-15909 ghostscript: shading_param incomplete
  type checking (699660)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.4
changelog:
- Resolves: #1651149 - CVE-2018-15911 ghostscript: uninitialized memory
  access in the aesdecode operator (699665)
- Resolves: #1650060 - CVE-2018-16802 ghostscript: Incorrect "restoration of
  privilege" checking when running out of stack during exception handling
- Resolves: #1652935 - CVE-2018-19409 ghostscript: Improperly implemented
  security check in zsetdevice function in psi/zdevice.c


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.5
changelog:
- Resolves: #1654621 - CVE-2018-16541 ghostscript: incorrect free logic in
  pagedevice replacement (699664)
- Resolves: #1650210 - CVE-2018-17183 ghostscript: User-writable error
  exception table
- Resolves: #1645516 - CVE-2018-18073 ghostscript: saved execution stacks
  can leak operator arrays
- Resolves: #1648891 - CVE-2018-17961 ghostscript: saved execution stacks
  can leak operator arrays (incomplete fix for CVE-2018-17183)
- Resolves: #1643115 - CVE-2018-18284 ghostscript: 1Policy operator
  allows a sandbox protection bypass
- Resolves: #1655937 - CVE-2018-19134 ghostscript: Type confusion in
  setpattern (700141)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.6
changelog:
- Resolves: #1657822 - ghostscript: Regression: Warning: Dropping incorrect
  smooth shading object (Error: /rangecheck in --run--)


author: Kalev Lember <kalevlember@gmail.com> - 3.14.2-2
changelog:
- Revise the summary for consistency with the parallel installable
  glade2/glade3 packages (#882557)


author: Carlos O'Donell <carlos@redhat.com> 2.17-256
changelog:
- CVE-2017-16997: Correctly handle DT_RPATH (#1540480).
- Correctly process "$ORIGIN" element in DT_RPATH or DT_NEEDED (#1447808).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-258
changelog:
- Fix dynamic string token substitution in DT_RPATH etc. (#1447808, #1540480)
- Additional robust mutex fixes (#1401665)


author: Patsy Franklin <pfrankli@redhat.com> - 2.17-260
changelog:
- Update glibc-rh1560641.patch to initialize pad outside
  the conditional eliminating an uninitialized byte warning from
  valgrind. (#1560641)


author: Milind Changire <mchangir@redhat.com> - 3.12.2-9
changelog:
- fixes bugs bz#1546717 bz#1557551 bz#1558948 bz#1561999 bz#1563804 
  bz#1565015 bz#1565119 bz#1565399 bz#1565577 bz#1567100 bz#1567899 bz#1568374 
  bz#1568969 bz#1569490 bz#1570514 bz#1570541 bz#1570582 bz#1571645 bz#1572087 
  bz#1572585 bz#1575895


author: Milind Changire <mchangir@redhat.com> - 3.12.2-10
changelog:
- fixes bugs bz#1488120 bz#1565577 bz#1568297 bz#1570586 bz#1572043 
  bz#1572075 bz#1575840 bz#1575877


author: Milind Changire <mchangir@redhat.com> - 3.12.2-13
changelog:
- fixes bugs bz#1493085 bz#1518710 bz#1554255 bz#1558948 bz#1558989 
  bz#1559452 bz#1567001 bz#1569312 bz#1569951 bz#1575539 bz#1575557 bz#1577051 
  bz#1580120 bz#1581184 bz#1581553 bz#1581647 bz#1582119 bz#1582129 bz#1582417 
  bz#1583047 bz#1588408 bz#1592666 bz#1594658


author: Milind Changire <mchangir@redhat.com> - 3.12.2-14
changelog:
- fixes bugs bz#1547903 bz#1566336 bz#1568896 bz#1578716 bz#1581047 
  bz#1581231 bz#1582066 bz#1593865 bz#1597506 bz#1597511 bz#1597654 bz#1597768 
  bz#1598105 bz#1598356 bz#1599037 bz#1599823 bz#1600057 bz#1601314


author: Milind Changire <mchangir@redhat.com> - 3.12.2-16
changelog:
- fixes bugs bz#1569657 bz#1608352 bz#1609163 bz#1609724 bz#1610825 
  bz#1611151 bz#1612098 bz#1615338 bz#1615440


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
* Mon Aug 27 2018 Milind Changire <mchangir@redhat.com> - 3.12.2-18
- fixes bugs bz#1524336 bz#1622029 bz#1622452


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
* Thu Jul 12 2018 Milind Changire <mchangir@redhat.com> - 3.8.4-54.15
- fixes bugs bz#1590774 bz#1597509 bz#1599803


author: Bastien Nocera <bnocera@redhat.com> - 1:3.28.1-1
changelog:
+ gnome-bluetooth-3.28.1-1
- Work-around bluez bug that would leave adapters on Discoverable
  when exiting
- Resolves: #1567381


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.5-1
changelog:
- Update to 3.28.5
- Fix the libgovirt requirement
- Revert to using Python 2 and Tracker 1.0
- Resolves: #1567399


author: Florian Müllner <fmuellner@redhat.com> - 3.26.2-2
changelog:
- Fix notification legibility in classic mode
  Resolves: #1507457
- Fix stray icon shadows in classic mode
  Resolves: #1530654


author: Florian Müllner <fmuellner@redhat.com> - 3.28.1-3
changelog:
- Fix a couple of regressions from the rebase:
  - add back classic overview style
  - update dash-to-dock to a compatible version
  Related: #1569717


author: Zeeshan Ali <zeenix@redhat.com> - 3.8.2-7
changelog:
- Add missing resource files (related: #1028079).
- Don't ignore removal of src/resources.c (related: #1028079).


author: Richard Hughes <rhughes@redhat.com> - 3.8.2-3
changelog:
- Do not build the clutter support to allow us to drop two deps
  now unsuitable for RHEL.
- Resolves: #1025270


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-3
changelog:
- Disable the print button in the selection toolbar when printing isn't
  supported
  Resolves: #1438362


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-6
changelog:
- Adjust the LOKDocView detection to work with GJS 1.48.0
- Suppress WARNINGs from GJS 1.50.0 by using var instead of let/const for
  exported symbols
  Resolves: #1517704


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-8
changelog:
- Initialize the getting started PDF only when presenting a UI, and before any
  SPARQL has been submitted
- Suppress WARNINGs from GJS 1.50.0 by using var instead of let/const for
  exported symbols
- Use the standard dialect of String.prototype.replace
  Resolves: #1517770


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.1-1
changelog:
- Update to 3.28.1
- Rebased downstream patches
- Revert to using Python 2 and Tracker 1.0
- Resolves: #1568171


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.2-1
changelog:
- Update to 3.28.2
- Rebased downstream patches
- Fix crash on right-click on local collection
  Resolves: #1611565


author: Zeeshan Ali <zeenix@redhat.com> - 3.8.2-8
changelog:
- Remove patch 'daemon: Exit gnome-keyring-daemon when the DBus connection
  closes' (related: rhbz#1030671).


author: Debarshi Ray <rishi@fedoraproject.org> - 3.14.5-3
changelog:
- Don't remove Telepathy accounts or expire Kerberos credentials when stopping
  goa-daemon
Resolves: #1267534


author: Debarshi Ray <rishi@fedoraproject.org> - 3.14.5-5
changelog:
- Ensure that temporary accounts are really removed from the keyring and
  avoid a WARNING
Resolves: #1261940


author: Richard Hughes <rhughes@redhat.com> - 3.14.3-3
changelog:
- Re-apply the fix "Change the UI policy to show the comps tree" as it was
  lost in the rebase process.
- Resolves: #1174550


author: Richard Hughes <rhughes@redhat.com> - 3.14.3-6
changelog:
- Create a -common subpackage and make the "parent" package depend on all
  the split out applications. This fixes upgrades from old versions.
- Resolves: #1290868


author: Ray Strode <rstrode@redhat.com> 3.26.1-8
changelog:
- New sed incantation is still overzealous.  Rework how
  gnome-wayland session file is generated.
  Resolves: #1510391


author: Ray Strode <rstrode@redhat.com> - 3.28.1-5
changelog:
- Fix gnome-disk-utility timeout at startup
  Resolves: #1593215
- add back session properties icons
  Related: #1568620


author: Ray Strode <rstrode@redhat.com> - 3.26.2-7
changelog:
- Fix logic error in password expiration notification bubble
  Resolves: #1530659
  Related: 1314443


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-9
changelog:
+ gnome-settings-daemon-3.26.2-9
- Revert automatic suspend after inactivity, it was rejected
- Related: #1449171


author: Florian Müllner <fmuellner@redhat.com> - 3.28.2-2
changelog:
- Update rebased downstream patches
  Related: #1568624
- Revert port to python3 of some utility tools
  Resolves: #1493526
- Add tooltips to app names in overview
  Resolves: #1541180


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: gnome-shell_spec-use-our-artwork.patch
-->  Brand this with SL colors
- Added Source: gnome-shell.ini
-->  Config file for automated patch script


author: Richard Hughes <rhughes@redhat.com> - 3.22.7-3
changelog:
- Never show 'Startup Applications' in the search results
- Note: the other issue shown in the bug is likely a dupe of #1445651
- Resolves: #1481145


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.2-2
changelog:
- Backport fix for client-side memory error (GNOME/gnome-terminal#1)
- Bump BuildRequires versions
- Drop the dark theme override
- Rebase and restore the scroll speed patches
- Rebase and restore the patch to allow old ISO 8895 charsets
- Restore the GConf migration tool
- Resolves: #1568632


author: Tomáš Mráz <tmraz@redhat.com> - 2.0.22-4
changelog:
- allow import of RSA-E and RSA-S keys (patch by Marcel Kolaja) (#1233182)
- do not abort when missing hash algorithm in FIPS mode (#1078962)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-9
changelog:
- Amended fix for FIPS enforcement issue (#1163848)
- Fixed issue with applications that close all file descriptors (#1165047)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-11
changelog:
- Applied fix for urandom FD in FIPS140 mode (#1165047)
- Applied fix for FIPS140-2 related regression (#1110696)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-13
changelog:
- Corrected reseed and respect of max_number_of_bits_per_request in 
  FIPS140-2 mode. Also enhanced the initial tests. (#1228199)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.24-1
changelog:
- Addressed issue with DSA public keys smaller than 2^1024 (#1238279)
- Addressed two-byte buffer overflow in the DTLS-0.9 protocol (#1209365)
- When writing certificates to smart cards write the CKA_ISSUER and
  CKA_SERIAL_NUMBER fields to allow NSS reading them (#1272179)
- Use the shared system certificate store (#1110750)
- Address MD5 transcript collision attacks in TLS key exchange (#1289888, 
  CVE-2015-7575)
- Allow hashing data over 2^32 bytes (#1306953)
- Ensure written PKCS#11 public keys are not marked as private (#1339453)
- Ensure secure_getenv() is called on all uses of environment variables
  (#1344591).
- Fix issues related to PKCS #11 private key listing on certain HSMs
  (#1351389)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-7
changelog:
- Address interoperability issue with 3.5.x (#1388932)
- Reject CAs which are both trusted and blacklisted in trust module (#1375303)
- Added new functions to set issuer and subject ID in certificates (#1378373)
- Reject connections with less than 1024-bit DH parameters (#1335931)
- Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
- Mention limitations of certtool in manpage (#1375463)
- Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
- Do not link directly to trousers but instead use dlopen (#1379739)
- Fix incorrect OCSP validation (#1377569)
- Added support for pin-value in PKCS#11 URIs (#1379283)
- Added the --id option to p11tool (#1399232)
- Improved sanity checks in RSA key generation (#1444780)
- Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
  CVE-2017-7869


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-9
changelog:
- Address crash in OCSP status request extension, by eliminating the
  unneeded parsing (CVE-2017-7507, #1455828)


author: Anderson Sasaki <ansasaki@redhat.com> 3.3.29-8
changelog:
- Backported --sni-hostname option which allows overriding the hostname
  advertised to the peer (#1444792)
- Improved counter-measures in TLS CBC record padding for lucky13 attack
  (CVE-2018-10844, #1589704, CVE-2018-10845, #1589707)
- Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
  (CVE-2018-10846, #1589708)
- Address p11tool issue in object deletion in batch mode (#1375307)
- Backport PKCS#11 tests from master branch. Some tests were disabled due to
  unsupported features in 3.3.x (--load-pubkey and --test-sign options, ECC key
  generation without login, and certificates do not inherit ID from the private
  key)
- p11tool explicitly marks certificates and public keys as NOT private objects
  and private keys as private objects
- Enlarge buffer size to support resumption with large keys (#1542461)
- Legacy HMAC-SHA384 cipher suites were disabled by default
- Added DSA key generation to p11tool (#1464896)
- Address session renegotiation issue using client certificate (#1434091)
- Address issue when importing private keys into Atos HSM (#1460125)


author: Mike FABIAN <mfabian@redhat.com> - 20170827-1
changelog:
- Update to upstream snapshot tarball
- Update color emoji font to version 2.001, new design.
- Contains the new emoji added in Unicode 10.0.0.


author: Mike FABIAN <mfabian@redhat.com> - 20170828-1
changelog:
- Update to upstream snapshot tarball
- split black-and-white and color fonts into different sub-packages.


author: Peter Oliver <rpm@mavit.org.uk> - 20170928-2
changelog:
- Prefer zopflipng to optipng, since it should yield smaller files.
- Use the font we built, rather than the one included with the source.


author: Mike FABIAN <mfabian@redhat.com> - 20180508-1
changelog:
- Update to upstream snapshot tarball (color emoji font version 2.011)
- Add patch to build all country flags (Resolves: rhbz#1574195)


author: Bastien Nocera <bnocera@redhat.com> 0.2.14-6
changelog:
- Enable a number of missing plugins
Related: #1184200
- Disable blip.tv plugin as service has now closed
- Add patch to downgrade the gom requirements
- Port back local-metadata plugin to libmediaart-1.0


author: Bastien Nocera <bnocera@redhat.com> - 0.3.4-3
changelog:
- Fix size reporting in Apple Trailers source
- Add compatibility layer to allow building with lua 5.1
Resolves: #1477129


author: Ondrej Holy <oholy@redhat.com> - 1.30.3-1
changelog:
- Update to 1.30.3
- Disable nfs support (#1387270)
- Revert desktop database scriplets
- Resolves: #1386993, #1399343, #1306146, #1259746, #1344317


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-74
changelog:
- Resolves: #1430640 - "ProxyAddHeaders Off" does not become effective
  when it's defined outside <Proxy> setting


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-75
changelog:
- Resolves: #1448892 - Cannot override LD_LIBARY_PATH in Apache HTTPD
  using SetEnv or PassEnv. Needs documentation.


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-80.1
changelog:
- Resolves: #1560609 - httpd: active connections being terminated when httpd
  gets gracefully stopped/restarted, GracefulShutdownTimeout is not being
  honored


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: httpd-sl_index.html.sl.patch
-->  This patch removes TUV branding from the default index.html
- Added Source: httpd.ini
-->  Config file for automated patch script


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com> 2.4.6-80.2
changelog:
- Rebuild for EuroLinux based on Scientific Linux Version
--> Change default index.html
--> Modify release string to note changes


author: Jarod Wilson <jarod@redhat.com> 13-6
changelog:
- Clean up htonll/ntohll handling for opa-ff/infiniband-diags compile
- Add necessary Provides/Obsoletes for old -static packages
- Remove ibverbs providers that we aren't currently able to support
- Resolves: rhbz#1453096, rhbz#1451607


author: Jarod Wilson <jarod@redhat.com> 15-2
changelog:
- Fix ibacm segfault and improper multicast handling
- Resolves: rhbz#1502745
- Resolves: rhbz#1502759


author: Honggang Li <honli@redhat.com> 15-3
changelog:
- srp_daemon: Don't create async_ev_thread if only run once
- srp_daemon: Remove unsupported systemd configurations
- srp_daemon: Start srp_daemon service after network target
- Resolves: bz1525193
- Resolves: bz1528671


author: Jarod Wilson <jarod@redhat.com> 15-4
changelog:
- Add support for extended join multicast API in librdmacm
- Add support for striding RQ on mlx5
- Resolves: rhbz#1515487, rhbz#1516571


author: Jarod Wilson <jarod@redhat.com> 15-5
changelog:
- libmlx4: report RSS caps for improved DPDK support
- Fix double mutex unlock in iwpmd
- Resolves: rhbz#1527350
- Resolves: rhbz#1542362


author: Jarod Wilson <jarod@redhat.com> 15-7
changelog:
- i40iw: revoke systemd udev rules auto-load on i40e hardware, due to
  causing problems with suspend and resume, and fall back to load via
  systemd rdma initscript.
- Resolves: rhbz#1568325


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-22.20160119
changelog:
- xorg-x11-drv-intel hardly has any accel on skylake and newer, so make
  Xorg fallback to modesetting + glamor by returning FALSE from probe
- Using glamor also gives us proper Xvideo support on skylake (rhbz#1305369)


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-23.20160512
changelog:
- Update to 20160512 snapshot
- This fixes laptops with switchable graphics hanging after a dpms off of
  the lcd screen (rhbz#1334581)
- Fix fd-leak when falling back to mode-setting on skylake, this fixes
  Xorg exiting with a "drmSetMaster failed" error when not using server
  managed fds (e.g. using a different login manager then gdm)
- Fix duplicate binaries in -devel / intel-gpu-tools subpackages (rhbz#1323641)


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-24.20160712
changelog:
- Git snapshot du jour, bringing in a bunch of bugfixes
- Fix dpi issues on Surface 3 (also needs some kernel fixes)
- Hopefully fix rhbz#1354124


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-7.el7
changelog:
- Resolves: #1421869 Unable to re-add broken AD trust - Unexpected Information received
  - adtrust: filter out subdomains when defining our topology to AD
- Resolves: #1486286 IPA failing to authenticate via password+OTP on RHEL7.4 with fips enabled
  - Don't allow OTP or RADIUS in FIPS mode
- Resolves: #1494226 IPA User Details not being displayed in WebUI
  - Fix cert-find for CA-less installations
- Resolves: #1498387 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
  - 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
- Resolves: #1503022 ipa-getkeytab man page should have more details about consequences of krb5 key renewal
  - ipa-getkeytab man page: add more details about the -r option
- Resolves: #1509288 IPA trust-add internal error (expected security.dom_sid got None)
  - ipaserver/plugins/trust.py; fix some indenting issues
  - trust: detect and error out when non-AD trust with IPA domain name exists
  - ipaserver/plugins/trust.py: pep8 compliance
- Resolves: #1511019 ipa-restore broken with python2
  - Fix ipa-restore (python2)
- Resolves: #1511607 ipa-backup does not backup Custodia keys and files
  - Backup ipa-custodia conf and keys
- Resolves: #1512482 kra install fails after ipa cert renewed
  - Don't use admin cert during KRA installation
  - Prevent set_directive from clobbering other keys
  - pep8: reduce line lengths in CAInstance.__enable_crl_publish
  - installutils: refactor set_directive
  - Add tests for installutils.set_directive
  - Add safe DirectiveSetter context manager
  - Old pylint doesn't support bad python3 option
- Resolves: #1514163 CA less IPA install with external certificates fails on RHEL 7 in FIPS mode
  - Fix ca less IPA install on fips mode


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-8.el7
changelog:
- Resolves: #1477531 Incorrect attribute level rights (ipaallowedtoperform) of service object
  - WebUI: make keytab tables on service and host pages writable
- Resolves: #1529444 ObjectclassViolation seen while adding idview with domain-resolution-order option
  - Idviews: fix objectclass violation on idview-add
- Resolves: #1451576 ipa cert-request failed to generate certificate from csr
  - Fixing the cert-request comparing whole email address case-sensitively.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-9.el7
changelog:
- Resolves: #1458169 --force-join option is not mentioned in ipa-replica-install man page
  - Add --force-join into ipa-replica-install manpage
- Resolves: #1457876 ipa-backup fails silently
  - Changed ownership of ldiffile to DS_USER
- Resolves: #1409786 Second phase of --external-ca ipa-server-install setup fails when dirsrv is not running
  - Checks if Dir Server is installed and running before IPA installation
- Resolves: #1452086 Pagination Size under Customization in IPA WebUI accepts negative values
  - WebUI: Add positive number validator
  - WebUI: change validator of page size settings
  - WebUI: fix jslint error


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.1
changelog:
- Resolves: #1565519 Clarify the need to restart services in ipa-server-certinstall(1)
  - Add a notice to restart ipa services after certs are installed
- Resolves: #1564390 OTP and Radius Authentication does not work in FIPS mode
  - Fix OTP validation in FIPS mode
  - Increase the default token key size
  - Revert "Don't allow OTP or RADIUS in FIPS mode"
  - Log errors from NSS during FIPS OTP key import
- Resolves: #1565520 ipa client pointing to replica shows KDC has no support for encryption type
  - ipa-replica-install: make sure that certmonger picks the right master
- Resolves: #1565605 DNS records updated with all IPAddresses of an interface when IPA server/replica try to install with Specific IP address of that interface
  - replica-install: pass --ip-address to client install


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.2
changelog:
- Resolves: #1579189 nsds5ReplicaReleaseTimeout should be set by default
  - Add nsds5ReplicaReleaseTimeout to replica config
  - Fix upgrade (update_replica_config) in single master mode
- Resolves: #1579190 Improve Custodia client and key distribution handling
  - Use single Custodia instance in installers
- Resolves: #1579203 4.5.0 -> 4.5.4 upgrade breaks in ipa-server-upgrade: No such file or directory: '/var/lib/pki/pki-tomcat/conf/ca/CS.cfg'
  - Don't try to backup CS.cfg during upgrade if CA is not configured


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-10.el7.3
changelog:
- Resolves: #1579190 Improve Custodia client and key distribution handling
  - Use single Custodia instance in installers


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.4
changelog:
- Resolves: #1615983 ipa-restore fails on newly installed system.
  - Fix ipa-restore: create /var/run/ipa files
- Resolves: #1615966 ipa-replica-manage re-initialize TypeError: 'NoneType' object does not support item assignment
  - Check if replication agreement exist before enable/disable it
- Resolves: #1615984 ldapmodify userPassword reflects on krblastpwdchange on RHEL6 but not RHEL7
  - Tests: add integration test for password changes by dir mgr
  - In IPA 4.4 when updating userpassword with ldapmodify does not update krbPasswordExpiration nor krbLastPwdChange
- Resolves: #1615893 nsds5ReplicaReleaseTimeout should be set by default.
  - Tune DS replication settings
- Resolves: #1615964 Authn/TOTP defined users periodically prompt for just password credentials to access resources
  - Fix elements not being removed in otpd_queue_pop_msgid()


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.4.2
changelog:
- Resolves: #1623673 SRV lookup doesn't correctly sort results
  - Sort and shuffle SRV record by priority and weight
- Resolves: #1623679 Installation of replica against a specific master
  - Always set ca_host when installing replica
  - Query for server role IPA master
  - Only create DNS SRV records for ready server
  - Delay enabling services until end of installer
  - replicainstall: DS SSL replica install pick right certmonger host
  - Fix race condition in get_locations_records()
  - Fix DNSSEC install regression
  - Handle races in replica config
  - Fix KRA replica installation from CA master
  - Do not set ca_host when --setup-ca is used
- Resolves: #1623676 Replication races in DogtagInstance.setup_admin
  - Improve and fix timeout bug in wait_for_entry()
  - Use common replication wait timeout of 5min
  - Fix replication races in Dogtag admin code
  - Catch ACIError instead of invalid credentials
- Resolves: #1623680 Increase WSGI worker process count
  - Increase WSGI process count to 5 on 64bit
  - Use 4 WSGI workers on 64bit systems
- Resolves: #1623669 ipa-replica-install defines nsds5replicabinddngroup before the group contains the DN of the replication manager
  - DS replication settings: fix regression with <3.3 master
- Resolves: #1623668 Replica install: certmonger sometimes fails
  - Auto-retry failed certmonger requests
  - Wait for client certificates


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.4.3
changelog:
- Resolves: #1624811 ipa-otpd: fix potential double-free and infinite loop in queue code
  - Clear next field when returnining list elements in queue.c
  - Add cmocka unit tests for ipa otpd queue code


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7_5.4.4
changelog:
- Resolves: #1626379 PKINIT configuration did not succeed message is received during Replica-install
  - ipa-replica-install: fix pkinit setup


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: ipa-spec-debrand.patch
-->  remove TUV's Artwork
- Added Source: ipa-spec-fix-osrelease.patch
-->  Force use of rhel as the ipaplatform
- Added Source: ipa.ini
-->  Config file for automated patch script


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.4-2.el7
changelog:
- Resolves: #1461177 ipa-otptoken-import  - XML file is missing PBKDF2
  parameters!
- Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
  search in cn=ad, cn=trusts,dc=example,dc=com
- Resolves: #1467887 iommu platform support for ipxe
- Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
  validate message: Incorrect number of results (0) searching forpublic key for
  host
- Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
  4.5
- Resolves: #1480102 ipa-server-upgrade failes with "This entry already
  exists"
- Resolves: #1482802 Unable to set ca renewal master on replica
- Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
  (ipa-server-upgrade)
- Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
  versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
  thus startup of Web UI fails
- Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
  to self-signed CA
- Resolves: #1469246 Replica install fails to configure IPA-specific
  temporary files/directories
- Resolves: #1469480 bind package is not automatically updated during
  ipa-server upgrade process
- Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
  installs only)
- Resolves: #1477703 IPA upgrade fails for latest ipa package


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-3.el7
changelog:
- Drop workaround for building on AArch64 (#1482244)
- Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-4.el7
changelog:
- Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
  - ldap: limit the retro changelog to dns subtree
- Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
  of "CA:FALSE" IPA CA CSR
  - Include the CA basic constraint in CSRs when renewing a CA
- Resolves: #1493145 ipa-replica-install might fail because of an already
  existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
  - Checks if replica-s4u2proxy.ldif should be applied
- Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
  - ds: ignore time skew during initial replication step
  - ipa-replica-manage: implicitly ignore initial time skew in force-sync 
- Resolves: #1500218 Replica installation at domain-level 0 fails against
  upgraded ipa-server
  - Fix ipa-replica-conncheck when called with --principal
- Resolves: #1506188 server-del doesn't remove dns-server configuration
  from ldap


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.5.4-5.el7
changelog:
- Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
- Resolves: #1378892 host-find slowness caused by missing host attributes in index


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.4-3.el7
changelog:
- Resolves: #1603514 Replica install fails with "Certificate issuance failed (CA_REJECTED)" - ACIError


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-4.el7
changelog:
- Resolves: #1600525 ipa-client-install --uninstall fails to uninstall client.
  - ipa client uninstall: clean the state store when restoring hostname
- Resolves: #1598117 client uninstall fails when installed using non-existing hostname
  - ipa client uninstall: clean the state store when restoring hostname
- Resolves: #1596168 ipa help topics displays 'ipa: ERROR: an internal error has occurred'
  - Fix regression: Handle unicode where str is expected
- Resolves: #1591824 Installation of replica against a specific master
  - Query for server role IPA master
  - Only create DNS SRV records for ready server
  - Delay enabling services until end of installer
  - replicainstall: DS SSL replica install pick right certmonger host
  - Fix CA topology warning
  - Fix race condition in get_locations_records()
  - Fix DNSSEC install regression
  - Handle races in replica config
- Resolves: #1591647 Increase WSGI worker process count
  - Use 4 WSGI workers on 64bit systems
- Resolves: #1565633 nsds5ReplicaReleaseTimeout should be set by default.
  - Tune DS replication settings
- Resolves: #1607616 Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
  - Removing filesystem encoding check
- Resolves: #1598044  plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
  - Removing filesystem encoding check


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-5.el7
changelog:
- Resolves: #1607616 Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
  - Removing filesystem encoding check
- Resolves: #1598044  plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
  - Removing filesystem encoding check


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-6.el7
changelog:
- Resolves: #1590647 ldapmodify userPassword reflects on krblastpwdchange on RHEL6 but not RHEL7
  - In IPA 4.4 when updating userpassword with ldapmodify does not update krbPasswordExpiration nor krbLastPwdChange
- Resolves: #1600074 ipa-server-upgrade displays 'DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated'
  - Re-open the ldif file to prevent error message
- Resolves: #1608783 ipa trust-add fails in FIPS mode.
  - Move fips_enabled to a common library to share across different plugins
  - ipasam: do not use RC4 in FIPS mode


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-7.el7
changelog:
- Resolves: #1609882 ipaserver/plugins/cert.py: Add reason to raise of errors.NotFound
  - ipaserver/plugins/cert.py: Added reason to raise of errors.NotFound
- Resolves: #1598662 Replica installation fails with connection refused error 
  - Do not set ca_host when --setup-ca is used
- Resolves: #1577108 Improve Custodia client and key distribution handling
  - Fix KRA replica installation from CA master
- Resolves: #1515314 ipa-replica-install fails with PIN error [ CA-less environment ]
  - Fix ipa-replica-install when key not protected by PIN
- Resolves: #1480502 ipa server uninstall with -v option displays "IOError: [Errno 9] Bad file descriptor Logged from file ipautil.py, line 442"
  - uninstall -v: remove Tracebacks
- Resolves: #1368345 Replace ERROR: cannot connect to 'http://localhost:8888/ipa/json': [Errno 111] Connection refused with 'IPA is not configured on this system'
  - ipa commands: print 'IPA is not configured' when ipa is not setup
  - Disable message about log in ipa-backup if IPA is not configured
- Resolves: #1591824 Installation of replica against a specific master
  - Do not set ca_host when --setup-ca is used
- Resolves: #1594141 Replication races in DogtagInstance.setup_admin
  - Catch ACIError instead of invalid credentials
- Resolves: #1623112  ipa-replica-install defines nsds5replicabinddngroup before the group contains the DN of the replication manager
  - DS replication settings: fix regression with <3.3 master
- Resolves: #1623113 Replica install: certmonger sometimes fails
  - Wait for client certificates
  - Auto-retry failed certmonger requests


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-8.el7
changelog:
- Resolves #1508498 Authn/TOTP defined users periodically prompt for just password credentials to access resources
  - Clear next field when returnining list elements in queue.c
  - Add cmocka unit tests for ipa otpd queue code
- Resolves #1622168 ipa-otpd: fix potential double-free and infinite loop in queue code
  - Clear next field when returnining list elements in queue.c
  - Add cmocka unit tests for ipa otpd queue code
- Resolves #1603444 ipa-server-install script is failing when using the "--no-dnssec-validation" parameter combined with the "--forwarder"
  - ipa-server-install: do not perform forwarder validation with --no-dnssec-validation


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-9.el7
changelog:
- Resolves: #1624755 Re-installing replica on the same system displays 'WARNING: cannot check if port 443 is already configured'
  - ipa-replica-install: properly use the file store
- Resolves: #1623486 PKINIT configuration did not succeed message is received during Replica-install
  - ipa-replica-install: fix pkinit setup
- Related: #1624289 AVC denials noticed during test execution for SUB-CA test-suite in FIPS mode
  - Update minimum selinux-policy to 3.13.1-224


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7
changelog:
- Resolves: 1630361 PKINIT fails in FIPS mode
  - Ensure that public cert and CA bundle are readable
  - Always make ipa.p11-kit world-readable
  - Make /etc/httpd/alias world readable & executable
  - Fix permission of public files in upgrader


author: Thomas Woerner <twoerner@redhat.com> - 6.19-5
changelog:
- New service sub package to provide the ipset service (RHBZ#1136257)
  Service and start-stop script from F-24
- Fixed ipset package summary (RHBZ#1195171)
  Spec file derived from F-24


author: Thomas Woerner <twoerner@redhat.com> - 6.19-6
changelog:
- Use /etc/sysconfig/ipset-config in service as EnvironmentFile (RHBZ#1136257)
- Use /etc/sysconfig/ipset for data as in RHEL-6 (RHBZ#1136257)
- No save on reload, but legacy save action (RHBZ#1136257)


author: Thomas Woerner <twoerner@redhat.com> - 6.29-1
changelog:
- Rebase to 6.29 (RHBZ#1351299)
- Fixes:
  - Backport ipset capability to run in namespaces (RHBZ#1226051)
  - Fix service save with empty ipset list and existing ipset save file
    (RHBZ#1377621)
  - Fix internal error at printing to output buffer (RHBZ#1395865)


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-1
changelog:
- Rebase to 6.38 (RHBZ#1557600):
  - hash:ipmac type support added to ipset, userspace part (Tomasz Chilinski)
- Refactor /etc/sysconfig/ipset.start-stop
- Fixes:
  - IPSet Service Monolithic Operation (RHBZ#1440741)
  - "systemctl start ipset" doesn't handle existing ipset's having counters
    (RHBZ#1502212)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
- Fix important coverity findings: missing include for flock and use bash for
  init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
- Fixed init script not to fail on missing restorecon (RHBZ#1246380)
- Adapted man page snipplet for TRACE to use proper logging backend names
  (RHBZ#1261238)
- Warn about use of DROP in nat table (RHBZ#1298879)
- Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
- Add support for --wait options to restore commands (RHBZ#1438597)
- Do not set changed flag for rule check operations with module targets
  (RHBZ#1438597)
- Add version option to restore commands (RHBZ#1438597)


author: Phil Sutter - 1.4.21-20
changelog:
- Prevent iptables.service and ip6tables.service from running in parallel
  (RHBZ#1486803)
- Don't restart services upon upgrade (RHBZ#1380141)


author: Phil Sutter - 1.4.21-24.1
changelog:
- Fix for stopping iptables and ip6tables at the same time (RHBZ#1563168)
- Propagate errors on service stop (RHBZ#1563168)
- Avoid overwriting parent's return code (RHBZ#1563168)


author: Rafael Aquini <aquini@redhat.com> - 20170530-54.gitdf40d15
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- opa: HFI firmware problems with new OPA switch firmware (rhbz 1452253)


author: Rafael Aquini <aquini@redhat.com> - 20171011-57.gitbf04291
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- ath10k: Update to the latest firmware released version (rhbz 1457363)
- opa: update Intel Omni-Path Architecture firmware (rhbz 1452785)
- chelsio: Pull in the latest firmware 1.16.63.0 (rhbz 1458328)
- qla2xxx: Update firmware version to 8.07.00 (rhbz 1427148)


author: Rafael Aquini <aquini@redhat.com> - 20171127-58.git17e6288
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- iwlwifi: Firmware update for 3160, 3168, 7260, 7265 and 7265D WIFI devices (rhbz 1508709)
- iwlwifi: Firmware update for 8260 and 8265 WIFI devices (rhbz 1508711)
- iwlwifi: Firmware update for 9260 and 9560 WIFI devices (rhbz 1501166)
- Fixes CVE-2016-0801 CVE-2017-0561 CVE-2017-9417


author: Rafael Aquini <aquini@redhat.com> - 20180113-60.git65b1c68
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- netr: Add Netronome TC flower firmware (rhbz 1518900)
- Revert amd-ucode for fam17h (rhbz 1533945)


author: Rafael Aquini <aquini@redhat.com> - 20180220-62.git6d51311
changelog:
- nfp: NIC stops transmitting for small MSS values when TSO is enabled (rhbz 1542263)
- chelsio: pull in latests firmware 1.17.14.0 (rhbz 1538590)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180518-63.git2a9b2cf
changelog:
- Update to latest upstream linux-firmware image for assorted netdrv updates
- amd: add microcode for family 17h and update for family 15h (rhbz 1574575)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180529-65.git7518922
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- amd: update microcode for family 15h (rhbz 1574575)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180717-67.git8d69bab
changelog:
- Update to latest upstream linux-firmware image for assorted netdrv updates
- chelsio: update firmware to revision 1.20.8.0 (rhbz 1523202)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180911-68.git85c5d90
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- nvidia: update firmware for Pascal GPUs (rhbz 1625514)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-27
changelog:
- CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                  marker segment decoders (#1171211)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-28
changelog:
- CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173569)
- CVE-2014-8138 - heap overflow in jp2_decode (#1173569)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-29
changelog:
- CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183674)
- CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183682)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-30
changelog:
- Multiple security fixes (fixed by thoger):
  CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089
  CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692
  CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262
  CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391
  CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583
  CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
- Fix implicit declaration warning caused by security fixes above


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.2
changelog:
- Rebuild with RPM optimisation flags disabled due to issues on x86 multilib
- Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.0
changelog:
- Bump to 2.6.14 and u181b00.
- Drop 8197981 Zero 32-bit patch now applied upstream.
- Update RC4 patch (8076221/PR2809) to apply after 8175075 (disable 3DES)
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.1
changelog:
- Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add missing ones
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.3
changelog:
- Bump release number to an unused one as rhel-7.5-z-java-unsafe-candidate wrongly using .el7
- Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.5
changelog:
- added depndence on latest c-j-c who do not have the incorrect jre-abrt handling
- Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.10
changelog:
- jsa files changed to 444 to pass rpm verification
- Add reg-ex for filtering private libraries' provides/requires.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.10
changelog:
- Cleanup RH1566890 patch and differentiate from java-1.8.0-openjdk version.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.191-2.6.15.0
changelog:
- Bump to 2.6.15 and u191b00.
- Drop PR3608/RH1566890/CVE-2018-3639 patch now applied upstream.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.16.1
changelog:
- Bump to 2.6.16 and u201b00.
- Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
- Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-0.b12
changelog:
- Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
- Remove upstreamed patches for 8181055/PR3394/RH1448880,
-  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
-  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
-  8181810/PR3466/RH1498319.
- Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-1.b10
changelog:
- Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-1.b10
changelog:
- Cleanup from previous commit.
- Remove unused upstream patch 8167200.hotspotAarch64.patch.
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
- Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
- Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550)
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-7.b10
changelog:
- Bump release number to be greater than RHEL 7.6 package to allow build with .el7 suffix
- Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-4.b11
changelog:
- Read jssecacerts file prior to trying either cacerts file (system or local) (PR3575)
- Resolves: rhbz#1593737


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-0.b03
changelog:
- Update to aarch64-jdk8u181-b03 and aarch64-shenandoah-jdk8u181-b03.
- Remove AArch64 patch for PR3458/RH1540242 as applied upstream.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-1.b04
changelog:
- Mark bugs that have been pushed to 8u upstream and are scheduled for a release.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-2.b04
changelog:
- Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-7.b13
changelog:
- Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13.
- Remove 8187577/PR3578 now applied upstream.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
- Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
- Update to aarch64-shenandoah-jdk8u181-b15.
- Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
- Move buildver to where it should be in the OpenJDK version.
- Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
- Update pr3539-rh1548475.patch to apply after 8187045.
- Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
- Update to aarch64-shenandoah-jdk8u181-b16.
- Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
- Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
- Update to aarch64-shenandoah-jdk8u191-b10.
- Drop 8146115/PR3508/RH1463098 applied upstream.
- Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
- Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
- Update to aarch64-shenandoah-jdk8u181-b15.
- Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
- Move buildver to where it should be in the OpenJDK version.
- Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
- Update pr3539-rh1548475.patch to apply after 8187045.
- Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
- Update to aarch64-shenandoah-jdk8u181-b16.
- Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
- Resolves: rhbz#1633822


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.22-6
changelog:
- Add patch, JDK-8210416-RHBZ-1624122-fdlibm-opt-fix.patch, so as to
  optimize compilation of fdlibm library.
- Add patch, JDK-8210425-RHBZ-1624122-sharedRuntimeTrig-opt-fix.patch, so
  as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
- Add patch, JDK-8210647-RHBZ-1624122-libsaproc-opt-fix.patch, so as to
  optimize compilation of libsaproc (extra c flags won't override
  optimization).
- Add patch, JDK-8210703-RHBZ-1624122-vmStructs-opt-fix.patch, so as to
  optimize compilation of vmStructs.cpp (part of libjvm.so).
- No longer filter -O flags from C flags coming from
  redhat-rpm-config.
- Resolves: RHBZ#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-5
changelog:
- Add patch, RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch,
  so as to disable dsin/dcos math intrinsics on aarch64. Work-around for
  JDK-8210461.
- Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-6
changelog:
- Add patch, RHBZ-1630996-JDK-8210858-workaround-disable-aarch64-intrinsic-log.patch,
  so as to disable log math intrinsic on aarch64. Work-around for
  JDK-8210858
- Resolves: rhbz#1570856


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.28-8
changelog:
- removed version less provides
- javadocdir moved to arched dir as it is no longer noarch
- Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-9
changelog:
- Rework changes from 1:11.0.ea.22-6. RHBZ#1632174 supercedes
  RHBZ-1624122.
- Add patch, JDK-8210416-RHBZ-1632174-fdlibm-opt-fix.patch, so as to
  optimize compilation of fdlibm library.
- Add patch, JDK-8210425-RHBZ-1632174-sharedRuntimeTrig-opt-fix.patch, so
  as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
- Add patch, JDK-8210647-RHBZ-1632174-libsaproc-opt-fix.patch, so as to
  optimize compilation of libsaproc (extra c flags won't override
  optimization).
- Add patch, JDK-8210761-RHBZ-1632174-libjsig-opt-fix.patch, so as to
  optimize compilation of libjsig.
- Add patch, JDK-8210703-RHBZ-1632174-vmStructs-opt-fix.patch, so as to
  optimize compilation of vmStructs.cpp (part of libjvm.so).
- Reinstate filtering of opt flags coming from redhat-rpm-config.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.0.28-1
changelog:
- Identify as GA version and no longer as early access (EA).
- JDK 11 has been released for GA on 2018-09-25.


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-4
changelog:
- Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
- Updated build requirements for NSPR
- Updated build and runtime requirements for NSS
- ## 'jss-post-rebase.patch' resolves the following issues ported from
  - Mozilla Bugzilla #1337092 - CMC conformance update: Implement required ASN.1
  code for RFC5272+ (cfu)
- Mozilla Bugzilla #1347394 - Eclipse project files for JSS (edewata)
- Mozilla Bugzilla #1347429 - Deprecated SSL 3.0 cipher names in SSLSocket
  class. (edewata)
- Mozilla Bugzilla #1348856 - SSL alert callback (edewata)
- Mozilla Bugzilla #1349278 - SSL cipher enumeration (edewata)
- Mozilla Bugzilla #1349349 - Problem with Password.readPasswordFromConsole().
  (edewata)
- Mozilla Bugzilla #1349831 - Revise top-level README file (mharmsen)
- Mozilla Bugzilla #1349836 - Changes to JSS Version Block (mharmsen)
- Mozilla Bugzilla #1350130 - Missing
  CryptoManager.verifyCertificateNowCUNative() implementation. (emaldona)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-5
changelog:
- Mozilla Bugzilla #1355268 - JSS 4.4 is incompatible with versions of
  idm-console-framework < 1.1.17-4
- Red Hat Bugzilla #1435076 - Remove unused legacy lines from JSS spec files


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-6
changelog:
- Mozilla Bugzilla #1352476 - RFE: Document on the README how to create a
  release tag (mharmsen)
- Mozilla Bugzilla #1355358 - CryptoStore: add methods for importing and
  exporting EncryptedPrivateKeyInfo (ftweedal)
- Mozilla Bugzilla #1359731 - CryptoStore.importPrivateKey enhancements
  (ftweedal)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-7
changelog:
- Bump NSS dependencies from 4.28.3 to 4.28.4-6 to pick-up fix in
  Mozilla Bugzilla #1360207 - Fix incorrect if (ss->...) in SSL_ReconfigFD


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-8
changelog:
- Bugzilla #1488846 - Fix HmacTest code for AES encrypt/unwrap [rhel-7.4.z]
  (jmagne)
- Bugzilla #1490494 - PKCS12: (JSS) upgrade to at least AES and SHA2 (FIPS)
  [RHEL-7.4.z] (ftweedal)
- Bugzilla #1490740 - PK11Store.getEncryptedPrivateKeyInfo() segfault if
  export fails [rhel-7.4.z] (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-9
changelog:
- Bugzilla #1505690 - new JSS failures: HMAC Unwrap and KeyWrapping
  FIPSMODE [rhel-7.4.z] (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-10
changelog:
- Bugzilla #1506710 - JSS throws ObjectNotFoundException without message
  (edewata)
- Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
  producing signatures (especially for EC) (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-11
changelog:
- Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
  producing signatures (especially for EC) (cfu,dstutzman)
- Bugzilla #1533667 - Add: standard algorithm names for all ECC signature
  types (cfu,dstutzman)
- Bugzilla #1534761 - SignerInfo class inserts wrong version # into the
  resulting structure (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.2-12
changelog:
- Bugzilla #1579202 - JSS has wrong encoding for ecdsa with sha*
  AlgorithmIdentifier [rhel-7.5.z] (cfu)


author: Dogtag Team <pki-devel@redhat.com> 4.4.2-13
changelog:
- Bugzilla #1595759 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
  decode/encode process alters original data [rhel-7.5.z] (cfu)
- Bugzilla #1596552 - JSS: Add support for TLS_*_SHA384 ciphers
  [rhel-7.5.z] (cfu)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.8.1.el7]
changelog:
- [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}
- [net] nf_reset: also clear nfctinfo bits (Florian Westphal) [1588458 1572983]
- [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Fix VM guest SSBD problems (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] kvm: vmx: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] kvm: svm: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [kernel] seccomp: Add filter flag to opt-out of SSB mitigation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] prctl: Add force disable speculation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spectre_v2: No mitigation if CPU not affected and no command override (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bug: Add X86_BUG_CPU_MELTDOWN and X86_BUG_SPECTRE_V[12] (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Sync up SSBD changes with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-862.9.1.el7]
changelog:
- [iscsi-target] Fix iscsi_np reset hung task during parallel delete (Maurizio Lombardi) [1583593 1579217]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.10.1.el7]
changelog:
- [x86] add _TIF_UPROBE to _TIF_DO_NOTIFY_MASK (Oleg Nesterov) [1595155 1579521]
- [x86] spec_ctrl: Always clear SPEC_CTRL MSRs when disabling IBRS (Radomir Vrbovsky) [1586150 1574730]
- [sound] alsa: hda/realtek - Add headset mode support for Dell laptop (Jaroslav Kysela) [1588946 1528587]
- [sound] alsa: hda/realtek - Support headset mode for ALC215/ALC285/ALC289 (Jaroslav Kysela) [1593586 1535427]
- [mm] compaction: release zone irqlock in isolate_freepages_block (Andrea Arcangeli) [1596283 1582793]
- [mm] compaction: change the timing to check to drop the spinlock (Andrea Arcangeli) [1596283 1582793]
- [fs] dcache.c: add cond_resched() in shrink_dentry_list() (Aaron Tomlin) [1596184 1584693]
- [misc] vmware balloon: Treat init like reset (Cathy Avery) [1595601 1540110]
- [netdrv] qede: Fix ref-cnt usage count (Chad Dupuis) [1594700 1574847]
- [x86] kvm: fix LAPIC timer drift when guest uses periodic mode ("Dr. David Alan Gilbert") [1594292 1584775]
- [x86] kvm: remove APIC Timer periodic/oneshot spikes ("Dr. David Alan Gilbert") [1594292 1584775]
- [netdrv] mlx4_en: Increase number of default RX rings (Erez Alfasi) [1594127 1520295]
- [netdrv] mlx4_en: Limit the number of RX rings (Erez Alfasi) [1594127 1520295]
- [netdrv] mlx4_en: Limit the number of TX rings (Erez Alfasi) [1594127 1520295]
- [fs] ceph: don't set read_ahead_kb to 0 by default (Ilya Dryomov) [1590825 1579539]
- [scsi] qla2xxx: Remove stale debug value for login_retry flag (Himanshu Madhani) [1588937 1578880]
- [x86] topology: Update the 'cpu cores' field in /proc/cpuinfo correctly across CPU hotplug operations (Prarit Bhargava) [1588563 1582023]
- [acpi] osi: Add OEM _OSI strings to disable NVidia RTD3 (Jaroslav Kysela) [1584685 1581391]
- [hv] vmbus: Fix a rescind issue (Eduardo Otubo) [1582124 1518498]
- [linux] libata: enable host-wide tags (Ewan Milne) [1581728 1491014]
- [ata] libata: remove ATA_FLAG_LOWTAG (Ewan Milne) [1581728 1491014]
- [ata] Add a new flag to destinguish sas controller (Ewan Milne) [1581728 1491014]
- [ata] libata: make sata_sil24 use fifo tag allocator (Ewan Milne) [1581728 1491014]
- [ata] libata: move sas ata tag allocation to libata-scsi.c (Ewan Milne) [1581728 1491014]
- [ata] libata: use blk taging (Ewan Milne) [1581728 1491014]
- [nvme] rdma: Use mr pool (David Milburn) [1581347 1547273]
- [nvme] rdma: Check remotely invalidated rkey matches our expected rkey (David Milburn) [1581347 1547273]
- [nvme] rdma: wait for local invalidation before completing a request (David Milburn) [1581347 1547273]
- [nvme] rdma: don't complete requests before a send work request has completed (David Milburn) [1581347 1547273]
- [nvme] rdma: don't suppress send completions (David Milburn) [1581347 1547273]
- [x86] kvm: Fix loss of pending INIT due to race (Radim Krcmar) [1580467 1569473]
- [mm] mempolicy: fix use after free when calling get_mempolicy (Augusto Caringi) [1576759 1576755] {CVE-2018-10675}
- [sound] alsa: seq: Fix racy pool initializations (Jaroslav Kysela) [1550171 1593586 1550169 1535427] {CVE-2018-7566}
- [crypto] algif_skcipher: Load TX SG list after waiting (Bruno Eduardo de Oliveira Meneguele) [1541870 1541875] {CVE-2017-13215}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.11.1.el7]
changelog:
- [tcmu] allow userspace to reset ring (Xiubo Li) [1599669 1562587]
- [tcmu] remove commands_lock (Xiubo Li) [1599669 1562587]
- [tcmu] move expired command completion to unmap thread (Xiubo Li) [1599669 1562587]
- [tcmu] add cmd timeout handling wq (Xiubo Li) [1599669 1562587]
- [tcmu] don't block submitting context for block waits (Xiubo Li) [1599669 1562587]
- [tcmu] fix double se_cmd completion (Xiubo Li) [1599669 1562587]
- [tcmu] replace spin lock with mutex (Xiubo Li) [1599669 1562587]
- [target] add SAM_STAT_BUSY sense reason (Xiubo Li) [1599669 1562587]
- [target] core: add device action configfs files (Xiubo Li) [1599669 1562587]
- [target] Avoid mappedlun symlink creation during lun shutdown (Xiubo Li) [1599656 1585081]
- [spectre] update Spectre v1 mitigation string (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [spectre] fix hiddev nospec issues (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] syscall: clarify clobbered registers in entry code (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [powerpc] add missing barrier_nospec() in __get_user64_nocheck() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [spectre] fix gadgets found by smatch scanner (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [alsa] rme9652: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [alsa] hdspm: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [alsa] asihpi: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [alsa] opl3: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [alsa] hda: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [alsa] seq: oss: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [alsa] seq: oss: Fix unbalanced use lock for synth MIDI device (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [net] atm: Fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [kernel] time: Protect posix clock array access against speculation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [kernel] sys.c: fix potential Spectre v1 issue (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [sched] autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[] (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [perf] core: Fix possible Spectre-v1 indexing for ->aux_pages[] (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [sysvipc] sem: mitigate semnum index against spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [alsa] control: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [usbip] vhci_sysfs: fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [media] dvb_ca_en50221: prevent using slot_info for Spectre attacs (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [media] dvb_ca_en50221: sanity check slot number from userspace (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [atm] zatm: Fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] kvm: Update spectre-v1 mitigation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] kvm: Add memory barrier on vmcs field lookup (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] perf/msr: Fix possible Spectre-v1 indexing in the MSR driver (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] perf: Fix possible Spectre-v1 indexing for x86_pmu::event_map() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] perf: Fix possible Spectre-v1 indexing for hw_perf_event cache_* (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [net] nl80211: Sanitize array index in parse_txq_params (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [include] vfs, fdtable: Prevent bounds-check bypass via speculative execution (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] syscall: Sanitize syscall table de-references under speculation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [powerpc] Use barrier_nospec in copy_from_user() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [include] nospec: Introduce barrier_nospec for other arches (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] Introduce barrier_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] spectre_v1: Disable compiler optimizations over array_index_mask_nospec() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] Implement array_index_mask_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [documentation] Document array_index_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [include] nospec: Include <asm/barrier.h> dependency (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [include] nospec: Allow index argument to have const-qualified type (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [include] nospec: Kill array_index_nospec_mask_check() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [include] nospec: Move array_index_nospec() parameter checking into separate macro (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [include] array_index_nospec: Sanitize speculative array de-references (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] get_user: Use pointer masking to limit speculation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] Introduce __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] usercopy: Replace open coded stac/clac with __uaccess_{begin, end} (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] reorganize SMAP handling in user space accesses (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] uaccess: Tell the compiler that uaccess is unlikely to fault (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
- [x86] uaccess: fix sparse errors (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.11.2.el7]
changelog:
- [kernel] cpu: hotplug: detect SMT disabled by BIOS (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [documentation] l1tf: Fix typos (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Remove extra newline in vmentry_l1d_flush sysfs file (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Initialize the vmx_l1d_flush_pages' content (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] speculation: l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [documentation] Add section about CPU vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] bugs, kvm: introduce boot-time control of L1TF mitigations (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu: hotplug: Set CPU_SMT_NOT_SUPPORTED early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu: hotplug: Expose SMT control init function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Allow runtime control of L1D flush (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Serialize L1D flush parameter setter (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Add static key for flush always (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Move l1tf setup function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Handle EPT disabled state proper (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Drop L1TF MSR list approach (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] litf: Introduce vmx status variable (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] bugs: Make cpu_show_common() static (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] bugs: Concentrate bug reporting into a separate function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu: hotplug: Online siblings when SMT control is turned on (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Use MSR save list for IA32_FLUSH_CMD if required (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Separate the VMX AUTOLOAD guest/host number accounting (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Add find_msr() helper function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Split the VMX MSR LOAD structures to have an host/guest numbers (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 3 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu: hotplug: Boot HT siblings at least once, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] speculation/l1tf: fix typo in l1tf mitigation string (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu/hotplug: Boot HT siblings at least once (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- Revert "x86/apic: Ignore secondary threads if nosmt=force" (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] speculation/l1tf: Protect PAE swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] speculation/l1tf: Extend 64bit swap file size limit (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu/AMD: Remove the pointless detect_ht() call (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] bugs: Move the l1tf function and define pr_fmt properly (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu/hotplug: Provide knobs to control SMT, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] topology: Provide topology_smt_supported() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] smp: Provide topology_is_primary_thread(), part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] apic: Ignore secondary threads if nosmt=force (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu/AMD: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu/intel: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu/topology: Provide detect_extended_topology_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu/common: Provide detect_ht_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu: Remove the pointless CPU printout (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu/hotplug: Provide knobs to control SMT (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu/hotplug: Split do_cpu_down() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] smp: Provide topology_is_primary_thread() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] CPU: Modify detect_extended_topology() to return result (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: fix build for CONFIG_NUMA_BALANCING=n (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: sync with latest L1TF patches (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: protect _PAGE_NUMA PTEs and PMDs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [mm] l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Report if too much memory for L1TF workaround (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Limit swap file size to MAX_PA/2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Add sysfs reporting for l1tf (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Make sure the first page is always reserved (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Protect PROT_NONE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Protect swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Increase 32bit PAE __PHYSICAL_PAGE_MASK (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] mm: Fix swap entry comment and macro (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86]  add support for L1D flush MSR (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.3.el7]
changelog:
- [net] tcp: add tcp_ooo_try_coalesce() helper (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: call tcp_drop() from tcp_data_queue_ofo() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: avoid collapses in tcp_prune_queue() if possible (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] net: add rb_to_skb() and other rb tree helpers (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: fix a stale ooo_last_skb after a replace (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: use an RB tree for ooo receive queue (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: increment sk_drops for dropped rx packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [x86] x86/syscall: Fix regression when using the last syscall (pkey_free) (Lauro Ramos Venancio) [1589033 1589035] {CVE-2018-3693}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.4.el7]
changelog:
- [net] ipv6: fix nospec-related regression in ipv6_addr_prefix() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3693}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-862.11.5.el7]
changelog:
- [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.6.el7]
changelog:
- [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.12.1.el7]
changelog:
- [fs] CIFS: Fix NULL pointer deref on SMB2_tcon() failure (Leif Sahlberg) [1609159 1591092]
- [net] multicast: do not restore deleted record source filter mode to new one (Hangbin Liu) [1610380 1586321]
- [net] multicast: remove useless parameter for group add (Hangbin Liu) [1610380 1586321]
- [net] ipv6/mcast: init as INCLUDE when join SSM INCLUDE group (Hangbin Liu) [1610380 1586321]
- [net] ipv4/igmp: init group mode as INCLUDE when join source group (Hangbin Liu) [1610380 1586321]
- [net] ipv6: mcast: fix unsolicited report interval after receiving querys (Hangbin Liu) [1610380 1586321]
- [net] ipv6: refactor ipv6_dev_mc_inc() (Hangbin Liu) [1610380 1586321]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.13.1.el7]
changelog:
- [infiniband] ib/ipoib: Fix race condition in neigh creation (Don Dutile) [1616164 1520300]
- [gpu] qxl: hook monitors_config updates into crtc, not encoder (Gerd Hoffmann) [1614349 1544322]
- [gpu] qxl: move qxl_send_monitors_config() (Gerd Hoffmann) [1614349 1544322]
- [gpu] qxl: remove qxl_io_log() (Gerd Hoffmann) [1614349 1544322]
- [kernel] locking: Introduce smp_mb__after_spinlock() (Steve Best) [1613814 1496574]
- [scsi] ibmvfc: Avoid unnecessary port relogin (Steve Best) [1613202 1605080]
- [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1612353 1585297]
- [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1612353 1585297]
- [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1612353 1585297]
- [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1612353 1585297]
- [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1612353 1585297]
- [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1612353 1585297]
- [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1612353 1585297]
- [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1612353 1585297]
- [powerpc] stf-barrier: update fallback routine as in upstream (Gustavo Duarte) [1612353 1585297]
- [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1612353 1585297]
- [nvmet-fc] move tech preview warning to nvmet_fc_register_targetport call (Ewan Milne) [1610381 1608947]
- [nvme-fc] move tech preview warning to nvme_fc_register_localport call (Ewan Milne) [1610381 1608947]
- [block] blk-throttle: check stats_cpu before reading it from sysfs (Ming Lei) [1608228 1567748]
- [powerpc] signals: Discard transaction state from signal frames (Steve Best) [1608227 1586153]
- [ipc] shm.c: add split function to shm_vm_ops (Desnes Augusto Nunes do Rosario) [1608225 1586152]
- [scsi] lpfc: Fix port initialization failure (Dick Kennedy) [1605235 1584377]
- [vmbus] fix the missed signaling in hv_signal_on_read() (Vitaly Kuznetsov) [1605089 1591976]
- [infiniband] ib/ipoib: Fix for potential no-carrier state (Donald Dutile) [1601935 1548474]
- [vmwgfx] refuse to hibernate if we have any resources. (v2) (Dave Airlie) [1601516 1595136]
- [netdrv] sfc: stop the TX queue before pushing new buffers (Xin Long) [1601353 1445576]
- [lib] rhashtable: Fix rhlist duplicates insertion (Xin Long) [1601009 1559106]
- [kernel] hrtimer: Allow concurrent hrtimer_start() for self restarting timers (Oleksandr Natalenko) [1600911 1574387]
- [iommu] amd: Add NULL sanity check for struct irq_2_irte.ir_data (Suravee Suthikulpanit) [1600661 1542697]
- [hid] wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large (Benjamin Tissoires) [1600660 1591499]
- [md] avoid NULL dereference to queue pointer (Ming Lei) [1600056 1581845]
- [scsi] qla2xxx: Fix NULL pointer access for fcport structure (Himanshu Madhani) [1597546 1547714]
- [scsi] csiostor: Add a soft dep on cxgb4 driver (Arjun Vynipadath) [1597529 1584003]
- [mm] initialize pages on demand during boot (Masayoshi Mizuma) [1588366 1496330]
- [mm] split deferred_init_range into initializing and freeing parts (Masayoshi Mizuma) [1588366 1496330]
- [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [net] ipv6: fix nospec-related regression in ipv6_addr_prefix() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3693}
- [net] tcp: add tcp_ooo_try_coalesce() helper (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: call tcp_drop() from tcp_data_queue_ofo() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: avoid collapses in tcp_prune_queue() if possible (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] add rb_to_skb() and other rb tree helpers (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: fix a stale ooo_last_skb after a replace (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: use an RB tree for ooo receive queue (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [net] tcp: increment sk_drops for dropped rx packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
- [x86] x86/syscall: Fix regression when using the last syscall (pkey_free) (Lauro Ramos Venancio) [1589033 1589035] {CVE-2018-3693}
- [kernel] cpu: hotplug: detect SMT disabled by BIOS (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [documentation] l1tf: Fix typos (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Remove extra newline in vmentry_l1d_flush sysfs file (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Initialize the vmx_l1d_flush_pages' content (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] speculation: l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [documentation] Add section about CPU vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] bugs, kvm: introduce boot-time control of L1TF mitigations (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu: hotplug: Set CPU_SMT_NOT_SUPPORTED early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu: hotplug: Expose SMT control init function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Allow runtime control of L1D flush (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Serialize L1D flush parameter setter (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Add static key for flush always (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Move l1tf setup function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Handle EPT disabled state proper (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Drop L1TF MSR list approach (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] litf: Introduce vmx status variable (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] bugs: Make cpu_show_common() static (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] bugs: Concentrate bug reporting into a separate function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu: hotplug: Online siblings when SMT control is turned on (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Use MSR save list for IA32_FLUSH_CMD if required (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Separate the VMX AUTOLOAD guest/host number accounting (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Add find_msr() helper function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: vmx: Split the VMX MSR LOAD structures to have an host/guest numbers (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 3 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu: hotplug: Boot HT siblings at least once, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] speculation/l1tf: fix typo in l1tf mitigation string (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu/hotplug: Boot HT siblings at least once (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- Revert "x86/apic: Ignore secondary threads if nosmt=force" (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] speculation/l1tf: Protect PAE swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] speculation/l1tf: Extend 64bit swap file size limit (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu/AMD: Remove the pointless detect_ht() call (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] bugs: Move the l1tf function and define pr_fmt properly (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu/hotplug: Provide knobs to control SMT, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] topology: Provide topology_smt_supported() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] smp: Provide topology_is_primary_thread(), part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] apic: Ignore secondary threads if nosmt=force (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu/AMD: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu/intel: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu/topology: Provide detect_extended_topology_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu/common: Provide detect_ht_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] cpu: Remove the pointless CPU printout (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu/hotplug: Provide knobs to control SMT (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [kernel] cpu/hotplug: Split do_cpu_down() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] smp: Provide topology_is_primary_thread() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] CPU: Modify detect_extended_topology() to return result (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: fix build for CONFIG_NUMA_BALANCING=n (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: sync with latest L1TF patches (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: protect _PAGE_NUMA PTEs and PMDs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [mm] l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Report if too much memory for L1TF workaround (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Limit swap file size to MAX_PA/2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Add sysfs reporting for l1tf (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Make sure the first page is always reserved (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Protect PROT_NONE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Protect swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] l1tf: Increase 32bit PAE __PHYSICAL_PAGE_MASK (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] mm: Fix swap entry comment and macro (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86]  add support for L1D flush MSR (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
- [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.1.el7]
changelog:
- [x86] microcode: Allow late microcode loading with SMT disabled (Josh Poimboeuf) [1619622 1614515]
- [infiniband] core: Fix nospec regression (Josh Poimboeuf) [1619624 1616346]
- [x86] microcode/amd: Do not load when running on a hypervisor (Vitaly Kuznetsov) [1618390 1607899]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.14.2.el7]
changelog:
- [uio] fix possible circular locking dependency (Xiubo Li) [1608677 1560418]
- [scsi] tcmu: Don't pass KERN_ERR to pr_err (Xiubo Li) [1608677 1560418]
- [scsi] tcmu: add module wide block/reset_netlink support (Xiubo Li) [1608677 1560418]
- [scsi] tcmu: simplify nl interface (Xiubo Li) [1608677 1560418]
- [scsi] tcmu: track nl commands (Xiubo Li) [1608677 1560418]
- [scsi] tcmu: delete unused __wait (Xiubo Li) [1608677 1560418]
- [uio] fix crash after the device is unregistered (Xiubo Li) [1608677 1560418]
- [uio] change to use the mutex lock instead of the spin lock (Xiubo Li) [1608677 1560418]
- [uio] Prevent device destruction while fds are open (Xiubo Li) [1608677 1560418]
- [uio] Reduce return paths from uio_write() (Xiubo Li) [1608677 1560418]
- [uio] fix incorrect memory leak cleanup (Xiubo Li) [1608677 1560418]
- [uio] add missing error codes (Xiubo Li) [1608677 1560418]
- [uio] fix false positive __might_sleep warning splat (Xiubo Li) [1608677 1560418]
- [uio] Destroy uio_idr on module exit (Xiubo Li) [1608677 1560418]
- [uio] don't free irq that was not requested (Xiubo Li) [1608677 1560418]
- [uio] support memory sizes larger than 32 bits (Xiubo Li) [1608677 1560418]
- [uio] we cannot mmap unaligned page contents (Xiubo Li) [1608677 1560418]
- [uio] Pass pointers to virt_to_page(), not integers (Xiubo Li) [1608677 1560418]
- [uio] fix memory leak (Xiubo Li) [1608677 1560418]
- [uio] Request/free irq separate from dev lifecycle (Xiubo Li) [1608677 1560418]
- [uio] Simplify uio error path by using devres functions (Xiubo Li) [1608677 1560418]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.3.el7]
changelog:
- [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625980 1625991] {CVE-2018-14634}
- [fs] exec: account for argv/envp pointers (Yauheni Kaliuta) [1625980 1625991] {CVE-2018-14634}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.4.el7]
changelog:
- [scsi] Revert: lpfc: Fix port initialization failure (Radomir Vrbovsky) [1605235 1584377]
- [scsi] Revert: qla2xxx: Fix NULL pointer access for fcport structure (Radomir Vrbovsky) [1597546 1547714]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-858.el7]
changelog:
- [tools] revert perf: Fix swap for samples with raw data (Jiri Olsa) [1458228]
- [netdrv] ibmvnic: Fix early release of login buffer (Desnes Augusto Nunes do Rosario) [1545578]
- [netdrv] ibmvnic: Clean RX pool buffers during device close (Desnes Augusto Nunes do Rosario) [1545578]
- [netdrv] ibmvnic: Free RX socket buffer in case of adapter error (Desnes Augusto Nunes do Rosario) [1545578]
- [netdrv] ibmvnic: Fix NAPI structures memory leak (Desnes Augusto Nunes do Rosario) [1545578]
- [netdrv] ibmvnic: Fix login buffer memory leaks (Desnes Augusto Nunes do Rosario) [1545578]
- [netdrv] ibmvnic: Wait until reset is complete to set carrier on (Desnes Augusto Nunes do Rosario) [1545578]
- [block] disable runtime-pm for blk-mq (Ming Lei) [1548269]
- [mm] revert memcontrol: fix cgroup creation failure after many small jobs (Aristeu Rozanski) [1548593 1517028]
- [mm] revert cgroup: kill css_id (Aristeu Rozanski) [1548593 1517028]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-859.el7]
changelog:
- [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548430] {CVE-2017-13166}
- [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547585] {CVE-2018-6927}
- [fs] Revert dcache_readdir back to ->readdir() ("Eric W. Biederman") [1525541]
- [md] dm-raid: fix incorrect sync_ratio when degraded (Mike Snitzer) [1547979]
- [mm] page_alloc: fix memmap_init_zone pageblock alignment (Daniel Vacek) [1525121]
- [mm] revert kvmalloc: stress the vmalloc path in the debugging kernel (Jeff Moyer) [1550094]
- [powerpc] 64s: Allow control of RFI flush via debugfs (Mauricio Oliveira) [1543067]
- [powerpc] 64s: Improve RFI L1-D cache flush fallback (Mauricio Oliveira) [1543067]
- [powerpc] 64s: Wire up cpu_show_meltdown() (Mauricio Oliveira) [1543067]
- [x86] kvm: vmx: Cache IA32_DEBUGCTL in memory (Paolo Bonzini) [1537379]
- [x86] spec_ctrl: avoid rmb() on full retpoline kernels (Paolo Bonzini) [1537379]
- [x86] spec_ctrl: replace boot_cpu_has with a static key for IBRS checks (Paolo Bonzini) [1537379]
- [x86] spec_ctrl: actually use static key for retpolines (Paolo Bonzini) [1537379]
- [x86] kvm: vmx: optimize IBRS handling at vmenter/vmexit (Paolo Bonzini) [1537379]
- [x86] kvm: vmx: mark RDMSR path as unlikely (Paolo Bonzini) [1537379]
- [x86] kvm: use native_read_msr to read SPEC_CTRL (Paolo Bonzini) [1537379]
- [x86] kvm/nvmx: Set the CPU_BASED_USE_MSR_BITMAPS if we have a valid L02 MSR bitmap (Paolo Bonzini) [1537379]
- [x86] nvmx: Properly set spec_ctrl and pred_cmd before merging MSRs (Paolo Bonzini) [1537379]
- [x86] kvm/vmx: Allow direct access to MSR_IA32_SPEC_CTRL (Paolo Bonzini) [1537379]
- [x86] kvm: Add IBPB support (Paolo Bonzini) [1537379]
- [x86] kvm: vmx: make MSR bitmaps per-VCPU (Paolo Bonzini) [1537379]
- [x86] kvm: vmx: Do not disable intercepts for BNDCFGS (Paolo Bonzini) [1537379]
- [x86] kvm: vmx: introduce alloc_loaded_vmcs (Paolo Bonzini) [1537379]
- [x86] kvm: nvmx: Eliminate vmcs02 pool (Paolo Bonzini) [1537379]
- [x86] kvm: nvmx: single function for switching between vmcs (Paolo Bonzini) [1537379]
- [x86] kvm: Update the reverse_cpuid list to include CPUID_7_EDX (Paolo Bonzini) [1537379]
- [x86] cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Paolo Bonzini) [1537379]
- [x86] cpufeatures: Clean up Spectre v2 related CPUID flags (Paolo Bonzini) [1537379]
- [x86] cpufeatures: Add Intel feature bits for Speculation Control (Paolo Bonzini) [1537379]
- [x86] cpufeatures: Add AMD feature bits for Speculation Control (Paolo Bonzini) [1537379]
- [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf (Paolo Bonzini) [1537379]
- [x86] cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Paolo Bonzini) [1537379]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-860.el7]
changelog:
- [acpi] sbshc: remove raw pointer from printk() message (Baoquan He) [1547009] {CVE-2018-5750}
- [fs] gfs2: fixes to "implement iomap for block_map" (Andreas Grunbacher) [1542594]
- [x86] kvm: svm: disable virtual GIF and VMLOAD/VMSAVE (Paolo Bonzini) [1552090]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-861.el7]
changelog:
- [netdrv] tg3: prevent scheduling while atomic splat (Jonathan Toppins) [1554590]
- [nvme] validate admin queue before unquiesce (David Milburn) [1549733]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-862.el7]
changelog:
- [netdrv] i40e: Fix attach VF to VM issue (Stefan Assmann) [1528123]
- [netdrv] ixgbevf: Add check for ixgbe_mbox_api_13 to ixgbevf_probe when setting max_mtu (Ken Cox) [1556696]
- [md] dm btree: fix serious bug in btree_split_beneath() (Mike Snitzer) [1557849]
- [x86] pti: Disable PTI user page table update in EFI virtual mode (Waiman Long) [1540061]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.1.1.el7]
changelog:
- [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1565700 1540061]
- [x86] pti: Rework the UEFI data corruption fix (Waiman Long) [1565700 1540061]
- [powerpc] tm: Flush TM only if CPU has TM feature (David Gibson) [1563773 1544676] {CVE-2018-1091}
- [gpu] drm/i915/glk: IPC linetime watermark workaround for GLK (Lyude Paul) [1563711 1548651]
- [x86] apic: Remove the (now) unused disable_IO_APIC() function (Baoquan He) [1563108 1521003]
- [x86] apic: Fix restoring boot IRQ mode in reboot and kexec/kdump (Baoquan He) [1563108 1521003]
- [x86] apic: Split disable_IO_APIC() into two functions to fix CONFIG_KEXEC_JUMP=y (Baoquan He) [1563108 1521003]
- [x86] apic: Split out restore_boot_irq_mode() from disable_IO_APIC() (Baoquan He) [1563108 1521003]
- [netdrv] i40e: Close client on suspend and restore client MSIx on resume (Stefan Assmann) [1563106 1538847]
- [fs] nfs: Fix unstable write completion (Scott Mayhew) [1563103 1544647]
- [x86] kvm: Fix device passthrough when SME is active (Suravee Suthikulpanit) [1563098 1557911]
- [powerpc] powernv: Support firmware disable of RFI flush (Mauricio Oliveira) [1563096 1553927]
- [powerpc] pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1563096 1553927]
- [powerpc] pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper (Mauricio Oliveira) [1563096 1553927]
- [nvme] fixup nvme_sysfs_delete() (David Milburn) [1563092 1543716]
- [x86] smpboot: Fix uncore_pci_remove() indexing bug when hot-removing a physical CPU (Prarit Bhargava) [1563091 1527731]
- [x86] tsc: Fix erroneous TSC rate on Skylake Xeon (Prarit Bhargava) [1563088 1466058]
- [x86] tsc: Print tsc_khz, when it differs from cpu_khz (Prarit Bhargava) [1563088 1466058]
- [x86] tsc: Future-proof native_calibrate_tsc() (Prarit Bhargava) [1563088 1466058]
- [scsi] csiostor: add support for 32 bit port capabilities (Arjun Vynipadath) [1561906 1526163]
- [netdrv] cxgb4/cxgbvf: Handle 32-bit fw port capabilities (Arjun Vynipadath) [1561906 1526163]
- [netdrv] cxgb4vf: define get_fecparam ethtool callback (Arjun Vynipadath) [1561906 1526163]
- [netdrv] cxgb4: ethtool forward error correction management support (Arjun Vynipadath) [1561906 1526163]
- [netdrv] cxgb4: core hardware/firmware support for Forward Error Correction on a link (Arjun Vynipadath) [1561906 1526163]
- [iscsi-target] Fix panic when adding second TCP connection to iSCSI session (Maurizio Lombardi) [1561900 1544670]
- [crypto] chelsio: Fix src buffer dma length (Arjun Vynipadath) [1561899 1548047]
- [crypto] chelsio: Move DMA un/mapping to chcr from lld cxgb4 driver (Arjun Vynipadath) [1561899 1548047]
- [crypto] chelsio: Remove unused parameter (Arjun Vynipadath) [1561899 1548047]
- [crypto] chelsio: Remove allocation of sg list to implement 2K limit of dsgl header (Arjun Vynipadath) [1561899 1548047]
- [crypto] chelsio: introduce __skb_put_zero() (Arjun Vynipadath) [1561899 1548047]
- [crypto] chelsio: make skb_put & friends return void pointers (Arjun Vynipadath) [1561899 1548047]
- [gpu] drm/i915/cfl: Remove alpha support protection (Rob Clark) [1561897 1464911]
- [gpu] drm/i915/cnl: Map VBT DDC Pin to BSpec DDC Pin (Rob Clark) [1561897 1464911]
- [gpu] drm/i915: Add retries for LSPCON detection (Rob Clark) [1561897 1464911]
- [gpu] drm/i915: Don't give up waiting on INVALID_MODE (Rob Clark) [1561897 1464911]
- [nvme] pci: Fix EEH failure on ppc (Mauricio Oliveira) [1561894 1558499]
- [net] netfilter: ebtables: fix erroneous reject of last rule (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
- [net] netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
- [net] netfilter: bridge: ebt_among: add more missing match size checks (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
- [net] netfilter: bridge: ebt_among: add missing match size checks (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
- [net] ipsec: Fix aborted xfrm policy dump crash (Bruno Eduardo de Oliveira Meneguele) [1517292 1517290] {CVE-2017-16939}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.1.el7]
changelog:
- [md] dm: fix dropped return code from dm_get_bdev_for_ioctl (Mike Snitzer) [1567746 1562962]
- [crypto] aesni: Add support for 192 & 256 bit keys to AESNI RFC4106 (Bruno Eduardo de Oliveira Meneguele) [1570537 1568167]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.2.el7]
changelog:
- [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569878 1569874] {CVE-2018-1000199}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.3.el7]
changelog:
- [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566849 1566845] {CVE-2018-1087}
- [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1567084 1567083] {CVE-2018-8897}


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: genkey.patch
-->  Debrand certs
- Ran Regex: Red Hat Enterprise => Scientific
-->  This RPM shouldn't say it is upstream's product
- Added Source: debrand_taint_cpu.patch
-->  Rename RHEL7 to SL7
- Added Source: sl-ldup.x509
-->  The FNAL SL signing certificate for driver updates
- Added Source: kernel.ini
-->  Config file for automated patch script
- Added Source: sl-kpatch.x509
-->  The FNAL SL signing certificate for kpatch updates
- Added Source: fnal-sl.cer
-->  The FNAL SL signing certificate


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.1.el7]
changelog:
- [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1573173 1571162]
- [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566849 1566845] {CVE-2018-1087}
- [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1567084 1567083] {CVE-2018-8897}
- [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569878 1569874] {CVE-2018-1000199}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.2.el7]
changelog:
- [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] entry: Add missing "$" in IBRS macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [fs] proc: Use CamelCase for SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [uapi] prctl: Add speculation control prctls (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] kvm/vmx: Expose SPEC_CTRL Bit(2) to the guest (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] bugs/amd: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] bugs: Expose /sys/../spec_store_bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] bugs: Read SPEC_CTRL MSR during boot and re-use (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] cpufeatures: Make CPU bugs sticky (Waiman Long) [1566904 1566905] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.3.el7]
changelog:
- [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.4.1.el7]
changelog:
- [powerpc] msi: Fix race condition in tearing down MSI interrupts (David Milburn) [1570511 1549680]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.5.1.el7]
changelog:
- [netdrv] vmxnet3: use correct flag to indicate LRO feature (Neil Horman) [1567771 1558685]
- [netdrv] vmxnet3: avoid xmit reset due to a race in vmxnet3 (Neil Horman) [1567771 1558685]
- [kernel] ib/mlx5: Respect new UMR capabilities (Alaa Hleihel) [1579847 1573661]
- [infiniband] ib/mlx5: Enable ECN capable bits for UD RoCE v2 QPs (Alaa Hleihel) [1579847 1573661]
- [scsi] cdrom: do not call check_disk_change() inside cdrom_open() (Maurizio Lombardi) [1579834 1538362]
- [hid] wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events (Benjamin Tissoires) [1579192 1551776]
- [hid] wacom: generic: Recognize WACOM_HID_WD_PEN as a type of pen collection (Benjamin Tissoires) [1579192 1551776]
- [hid] wacom: generic: Send BTN_STYLUS3 when both barrel switches are set (Benjamin Tissoires) [1579191 1551783]
- [fs] eventpoll: fix uninitialized variable in epoll_ctl (Paul Moore) [1578734 1553256]
- [fs] nfs41: do not return ENOMEM on LAYOUTUNAVAILABLE (Scott Mayhew) [1578458 1574002]
- [net] sock_diag: request _diag module only when the family or proto has been registered (Xin Long) [1578272 1544898]
- [target] Re-add missing SCF_ACK_KREF assignment in (Mike Christie) [1578048 1561851]
- [gpu] drm/nouveau: Fix deadlock in nv50_mstm_register_connector() (Lyude Paul) [1577792 1571927]
- [netdrv] vmxnet3: segCnt can be 1 for LRO packets (Neil Horman) [1577790 1426680]
- [s390] correct nospec auto detection init order (Hendrik Brueckner) [1577767 1558325]
- [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1577767 1558325]
- [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1577767 1558325]
- [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1577767 1558325]
- [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1577767 1558325]
- [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1577767 1558325]
- [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1577767 1558325]
- [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1577767 1558325]
- [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1577767 1558325]
- [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1577767 1558325]
- [s390] entry.s: fix spurious zeroing of r0 (Hendrik Brueckner) [1577767 1558325]
- [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1577767 1558325]
- [s390] align and prepare spectre mitigation for upstream commits (Hendrik Brueckner) [1577767 1558325]
- [s390] alternative: use a copy of the facility bit mask (Hendrik Brueckner) [1577767 1558325]
- [gpu] drm/amdgpu: Fix deadlock on runtime suspend (Lyude Paul) [1577760 1563957]
- [gpu] drm/radeon: Fix deadlock on runtime suspend (Lyude Paul) [1577760 1563957]
- [gpu] drm/nouveau: Fix deadlock on runtime suspend (Lyude Paul) [1577760 1563957]
- [gpu] drm: Allow determining if current task is output poll worker (Lyude Paul) [1577760 1563957]
- [gpu] workqueue: Allow retrieval of current task's work struct (1/5) (Lyude Paul) [1577760 1563957]
- [md] dm: remove fmode_t argument from .prepare_ioctl hook (Mike Snitzer) [1576508 1562960]
- [md] dm: hold DM table for duration of ioctl rather than use blkdev_get (Mike Snitzer) [1576508 1562960]
- [scsi] iscsi: respond to netlink with unicast when appropriate (Chris Leech) [1576293 1330865]
- [netdrv] i40e: fix incorrect UP-TC mapping (Stefan Assmann) [1574371 1558159]
- [powerpc] System reset avoid interleaving oops using die synchronisation (Mauricio Oliveira) [1574366 1564126]
- [powerpc] Do not send system reset request through the oops path (Mauricio Oliveira) [1574366 1564126]
- [powerpc] crash: Remove the test for cpu_online in the IPI callback (Mauricio Oliveira) [1574366 1564126]
- [sound] hda: Fix a wrong FIXUP for alc289 on Dell machines (Jaroslav Kysela) [1571581 1548969]
- [sound] hda: Fix headset mic detection problem for two Dell machines (Jaroslav Kysela) [1571581 1548969]
- [firmware] fw_cfg: write vmcoreinfo details (Marc-Andre Lureau) [1571369 1533367]
- [kernel] crash: export paddr_vmcoreinfo_note() (Marc-Andre Lureau) [1571369 1533367]
- [firmware] fw_cfg: add DMA register (Marc-Andre Lureau) [1571369 1533367]
- [firmware] fw_cfg: add a public uapi header (Marc-Andre Lureau) [1571369 1533367]
- [firmware] fw_cfg: handle fw_cfg_read_blob() error (Marc-Andre Lureau) [1571369 1533367]
- [firmware] fw_cfg: remove inline from fw_cfg_read_blob() (Marc-Andre Lureau) [1571369 1533367]
- [firmware] fw_cfg: fix sparse warnings around FW_CFG_FILE_DIR read (Marc-Andre Lureau) [1571369 1533367]
- [firmware] fw_cfg: fix sparse warning reading FW_CFG_ID (Marc-Andre Lureau) [1571369 1533367]
- [firmware] fw_cfg: fix sparse warnings with fw_cfg_file (Marc-Andre Lureau) [1571369 1533367]
- [firmware] fw_cfg: fix sparse warnings in fw_cfg_sel_endianness() (Marc-Andre Lureau) [1571369 1533367]
- [firmware] revert "fw_cfg: add DMA register" (Marc-Andre Lureau) [1571369 1533367]
- [firmware] revert "fw_cfg: do DMA read operation" (Marc-Andre Lureau) [1571369 1533367]
- [firmware] revert "fw_cfg: write vmcoreinfo details" (Marc-Andre Lureau) [1571369 1533367]
- [infiniband] mlx5: Set the default active rate and width to QDR and 4X (Honggang Li) [1570536 1554535]
- [x86] spec_ctrl: disable IBRS in idle, part 2 (Josh Poimboeuf) [1570532 1558668]
- [x86] platform/uv: Fix critical UV MMR address error (Frank Ramsay) [1570520 1562945]
- [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1570518 1561787]
- [powerpc] Move default security feature flags (Mauricio Oliveira) [1570518 1561787]
- [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1570518 1561787]
- [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1570518 1561787]
- [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1570518 1561787]
- [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1570518 1561787]
- [powerpc] powernv: Use the security flags in pnv_setup_rfi_flush() (Mauricio Oliveira) [1570518 1561787]
- [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1570518 1561787]
- [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1570518 1561787]
- [powerpc] powernv: Set or clear security feature flags (Mauricio Oliveira) [1570518 1561787]
- [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1570518 1561787]
- [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1570518 1561787]
- [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1570518 1561787]
- [powerpc] lib: seq: Add seq_buf_printf() (Mauricio Oliveira) [1570518 1561787]
- [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1570509 1561785]
- [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1570509 1561785]
- [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1570509 1561785]
- [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1570509 1561785]
- [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1570509 1561785]
- [fs] vfs: Remove incorrect debugging WARN in prepend_path (Frank Sorenson) [1568322 1481732]
- [fs] xfs: fix transaction allocation deadlock in IO path (Eric Sandeen) [1568320 1551111]
- [md] support to split big bio (Ming Lei) [1568070 1557434]
- [block] introduce bio_split2() and bio_pair2_release() (Ming Lei) [1568070 1557434]
- [netdrv] qed: Free reserved MR tid (Harish Patil) [1568069 1554217]
- [netdrv] qed: Free RoCE ILT Memory on rmmod qedr (Harish Patil) [1568069 1554217]
- [net] sctp: use right member as the param of list_for_each_entry (Xin Long) [1565983 1483445]
- [net] sctp: reset owner sk for data chunks on out queues when migrating a sock (Xin Long) [1565983 1483445]
- [net] xfrm: policy: check policy direction value (Bruno Eduardo de Oliveira Meneguele) [1479419 1479421] {CVE-2017-11600}
- [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] entry: Add missing "$" in IBRS macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [fs] proc: Use CamelCase for SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [uapi] prctl: Add speculation control prctls (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] kvm/vmx: Expose SPEC_CTRL Bit(2) to the guest (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] bugs/amd: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] bugs: Expose /sys/../spec_store_bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] bugs: Read SPEC_CTRL MSR during boot and re-use (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566904 1566905] {CVE-2018-3639}
- [x86] cpufeatures: Make CPU bugs sticky (Waiman Long) [1566904 1566905] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.1.el7]
changelog:
- [x86] microcode: Load microcode on all cpus (Prarit Bhargava) [1578047 1568249]
- [x86] microcode: Fix CPU synchronization routine (Prarit Bhargava) [1578047 1568249]
- [x86] microcode: Attempt late loading only when new microcode is present (Prarit Bhargava) [1578047 1568249]
- [x86] microcode: Synchronize late microcode loading (Prarit Bhargava) [1578047 1568249]
- [x86] microcode: Request microcode on the BSP (Prarit Bhargava) [1578047 1568249]
- [x86] microcode: Do not upload microcode if CPUs are offline (Prarit Bhargava) [1578047 1568249]
- [x86] microcode/intel: Writeback and invalidate caches before updating microcode (Prarit Bhargava) [1578047 1568249]
- [x86] microcode/intel: Check microcode revision before updating sibling threads (Prarit Bhargava) [1578047 1568249]
- [x86] microcode: Get rid of struct apply_microcode_ctx (Prarit Bhargava) [1578047 1568249]
- [x86] cpu: Add a microcode loader callback (Prarit Bhargava) [1578047 1568249]
- [x86] microcode: Propagate return value from updating functions (Prarit Bhargava) [1578047 1568249]
- [x86] microcode/amd: Change load_microcode_amd()'s param to bool to fix preemptibility bug (Prarit Bhargava) [1578047 1568249]
- [x86] microcode/intel: Add a helper which gives the microcode revision (Prarit Bhargava) [1578047 1568249]
- [x86] cpu: Add native CPUID variants returning a single datum (Prarit Bhargava) [1578047 1568249]
- [x86] microcode/amd: Move private inlines to .c and mark local functions static (Prarit Bhargava) [1578047 1568249]
- [x86] microcode/intel: Simplify generic_load_microcode() (Prarit Bhargava) [1578047 1568249]
- [x86] microcode/intel: Do not issue microcode updates messages on each CPU (Prarit Bhargava) [1578047 1568249]
- [kernel] pidns: Don't have unshare(CLONE_NEWPID) imply CLONE_THREAD (Oleg Nesterov) [1578997 1577745]
- [powerpc] 64s: Add support for a store forwarding barrier at kernel entry/exit (Mauricio Oliveira) [1581045 1581036] {CVE-2018-3639}
- [powerpc] 64s: Move the data access exception out-of-line (Mauricio Oliveira) [1581045 1581036] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.2.el7]
changelog:
- [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] kvm: vmx: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] kvm: svm: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [kernel] seccomp: Add filter flag to opt-out of SSB mitigation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] prctl: Add force disable speculation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spectre_v2: No mitigation if CPU not affected and no command override (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bug: Add X86_BUG_CPU_MELTDOWN and X86_BUG_SPECTRE_V[12] (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Sync up SSBD changes with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.3.el7]
changelog:
- [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}
- [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584323 1584569] {CVE-2018-3639}
- [x86] spec_ctrl: Fix VM guest SSBD problems (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Pingfan Liu <piliu@redhat.com> 2.0.15-5
changelog:
- Revert "Update kdump anaconda addon"
- Revert "Update kdump anaconda addon: fix the md5sum in source file"


author: Pingfan Liu <piliu@redhat.com> 2.0.15-7
changelog:
- mkdumprd: apply dracut "--hostonly-cmdline" and "--no-hostonly-default-device"
- Change dump_to_rootfs to use "--mount" instead of "root=X"
- kdumpctl: move is_fadump_capable() to kdump-lib.sh
- module-setup: fix 99kdumpbase network dependency
- mkdumprd: change for_each_block_target() to use get_kdump_targets()
- kdump-lib.sh: introduce get_kdump_targets()
- kdump-lib.sh: fix improper get_block_dump_target()
- kdumpctl: remove "root=X" for kdump boot
- kdumpctl: fix a bug in remove_cmdline_param()


author: Pingfan Liu <piliu@redhat.com> 2.0.15-9
changelog:
- makedumpfile: Fix 'kernel_version' variable being uninitialized & introduce minor reorganization
- makedumpfile: Fix segmentation fault when using --split on a vmcore
- dracut-module-setup.sh: check whether to include multipath-hostonly or not


author: Pingfan Liu <piliu@redhat.com> 2.0.15-10
changelog:
- kexec-tools.spec: require dracut >= 033-522 to make 99kdump module installed correctly
- kdump.sysconfig.ppc64(le): remove "root=" param from ppc64(le) 2nd kernel's command line
- Revert "kdumpctl: sanity check of nr_cpus for x86_64 in case running out of vectors"


author: Pingfan Liu <piliu@redhat.com> 2.0.15-11
changelog:
- dracut-module-setup.sh: temporary install /bin/grep to work around dracut's bug
- kdump.sysconfig/x86_64: Add nokaslr to kdump kernel cmdline
- kdumpctl: skip selinux-relabel for dracut_args --mount dump target


author: Pingfan Liu <piliu@redhat.com> 2.0.15-13
changelog:
* Thu Feb 1 2018 Pingfan Liu <piliu@redhat.com> 2.0.15-12
- makedumpfile/sadump: Fix a problem of PTI enabled kernel
- makedumpfile: Fix physical-to-virtual conversion in 'exclude_segment()'


author: Joe Chapman <jochapma@redhat.com> 6.1.0.97-11
changelog:
- Default logical size is no longer over-provisioned
- Remove debug logging when verifying dedupe advice
- Resolves: rhbz#1519330


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.106-11
changelog:
- Detect journal overflow after 160E of writes
- Clean up UDS threads when removing last VDO
- Resolves: rhbz#1512968
- Resolves: rhbz#1523240


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.114-11
changelog:
- /sys/uds permissions now resticted to superuser only
- Remove /sys/uds files that should not be used in production
- Removing kvdo module reports version
- VDO automatically chooses the proper write policy by default
- Fixed a Coverity-detected error path leak
- Resolves: rhbz#1525305
- Resolves: rhbz#1527734
- Resolves: rhbz#1527737
- Resolves: rhbz#1527924
- Resolves: rhbz#1528399


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.124-11
changelog:
- Fixed provisional referencing for dedupe.
- Only log a bio submission from a VDO to itself.
- vdoformat cleans up metadata properly after fail.
- Resolves: rhbz#1511587
- Resolves: rhbz#1520972
- Resolves: rhbz#1532481


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.130-12
changelog:
- Fix General Protection Fault unlocking UDS callback mutex
- Removing kmod-kvdo package unloads kernel module
- Fix URL to point to GitHub tree
- Resolves: rhbz#1510176
- Resolves: rhbz#1533260
- Resolves: rhbz#1539061


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.146-13
changelog:
- Module target is now "vdo" instead of "dedupe"
- Fixed a bug where crash recovery led to failed kernel page request
- Improved modification log messages
- Improved package description and summary fields
- Resolves: rhbz#1535127
- Resolves: rhbz#1535597
- Resolves: rhbz#1540696
- Resolves: rhbz#1541409


author: - Andy Walsh <awalsh@redhat.com> - 6.1.0.168-16
changelog:
- Updated source to use GitHub
- Fixed module version checking for upgrades.
- Removed debug kernel requirement from spec file.
- Fixed a deadlock resulting from sleeping while holding a spinlock while
  getting statistics.
- Resolves: rhbz#1567742
- Fixed bugs arising from attempts to access sysfs nodes during startup and
  shutdown.
- Resolves: rhbz#1567744
- Removed the prepare_ioctl() function to avoid signature changes since this
  function currently does nothing.
- Resolves: rhbz#1572494


author: - Andy Walsh <awalsh@redhat.com> - 6.1.0.181-17
changelog:
- Fixed a bug which would cause kernel panics when a VDO device is stacked on a
  RAID50 device.
- Resolves: rhbz#1599668
- Fixed a bug which could cause data loss when discarding unused portions of a
  VDO's logical space.
- Resolves: rhbz#1600058
- Modified grow physical to fail in the prepare step if the size isn't
  changing, avoiding a suspend-and-resume cycle.
- Resolves: rhbz#1600662
- Fixed a bug which would cause attempts to grow the physical size of a VDO
  device to fail if the device below the VDO was resized while the VDO was
  offline.
- Resolves: rhbz#1591180


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.84-1
changelog:
- Deleted unused UDS features.
- Improved performance of sub 4K writes.
- Simplified and improved performance of writes with FUA.
- Improved the accuracy of dedupe statistics.
- Made the MurmurHash3 implementation architecture independent.
- Fixed compilation errors on newer versions of GCC.
- Eliminated spurious allocation of a UDS sparse cache for dense indexes.
- Fixed a deadlock resulting from sleeping while holding a spinlock while
  getting statistics.
- Resvolves: rhbz#1562228
- Fixed bugs related to the timing of the creation and destruction of sysfs
  nodes relative to the creation and destruction of VDO data structures.
- Resolves: rhbz#1559692
- Fixed a bug which made deduplication impossible to disable.
- Removed obsolete code.
- Improved deduplication of concurrent requests containing the same data.
- Reduced unnecessary logging.
- Resolves: rhbz#1511127
- Removed the prepare_ioctl() function to avoid signature changes since
  this function currently does nothing.
- Resolves: rhbz#1568129
- Fixed a bug which made using a sparse index impossible to create.
- Resolves: rhbz#1570156


author: - Andy Walsh <awalsh@redhat.com> 6.1.1.99-1
changelog:
- Added /sys/kvdo/version which contains the currently loaded version of
  the kvdo module.
- Resolves: rhbz#1533950
- Added logging of normal operation when a VDO device starts normally.
- Resolves: rhbz#1520988
- Fixed a race in the UDS module which could cause the index to go offline.
- Resolves: rhbz#1520988
- Fixed a bug which would cause attempts to grow the physical size of a VDO
  device to fail if the device below the VDO was resized while the VDO was
  offline.
- Resolves: rhbz#1582647
- Fixed thread safety issues in the UDS page cache.
- Resolves: rhbz#1579492
- Modified the vdo script to not allow creation of a VDO device on top of an
  already running VDO device.
- Resolves: rhbz#1572640
- Fixed a bug which could cause data loss when discarding unused portions of a
  VDO's logical space.
- Resolves: rhbz#1589249
- Modified grow physical to fail in the prepare step if the size isn't
  changing, avoiding a suspend-and-resume cycle.
- Resolves: rhbz#1576539


author: - Andy Walsh <awalsh@redhat.com> 6.1.1.111-1
changelog:
- Added support for issuing fullness warnings via dmeventd
- rhbz#1519307
- Fixed a bug which would cause kernel panics when a VDO device is stacked on a
  RAID50 device.
- Resolves: rhbz#1593444
- Improved logging when growing the physical size of a VDO volume.
- Resolves: rhbz#1597890
- Resolves: rhbz#1597886
- Removed misleading log messages when rebuilding the UDS index.
- Resolves: rhbz#1599867


author: - Andy Walsh <awalsh@redhat.com> 6.1.1.120-2
changelog:
- No longer attempt to unload modules in %preun
- Resolves: rhbz#1553420
- Improved memory allocation by not using the incorrect __GFP_NORETRY flag
  and by using the memalloc_noio_save mechanism.
- Resolves: rhbz#1571292
- Fixed a potential deadlock in the UDS index by using the kernel supplied
  struct callback instead of our own implementation of synchronous
  callbacks.
- Resolves: rhbz#1602151
- Fixed a potential stack overflow when reaping the recovery journal.
- Resolves: rhbz#1608070
- No longer attempt to unload modules in %preun
- Resolves: rhbz#1553420
- Improved safety around memory allocation permissions
- Resolves: rhbz#1595923
- Improved statistics accounting to allow for concurrent dedupe.
- Resolves: rhbz#1540722


author: - Andy Walsh <awalsh@redhat.com> 6.1.1.125-4
changelog:
- Attempt to unload modules and print a warning if unable to.
- Resolves: rhbz#1553420
- Fixed a hang when recovering a VDO volume with a physical size larger than
  16TB.
- Resolves: rhbz#1628316


author: Stephan Wiesand <stephan wiesand desy de> 1.6.17-234.SLx
changelog:
- update to release 1.6.17 (security release)
- install service unit files with mode 644, not 755 (rt.central.org #132662)


author: Stephan Wiesand <stephan wiesand desy de> 1.6.20-256.SLx
changelog:
- update to security release 1.6.20
- added RemainAfterExit=true in afs.service, to fix the case where only
  kernel threads remain after the client has started


author: Stephan Wiesand <stephan wiesand desy de> 1.6.23-289.SLx
changelog:
- update to release 1.6.23 (security release)
- addresses OPENAFS-SA-2018-001, OPENAFS-SA-2018-002, OPENAFS-SA-2018-003


author: Eugene Syromiatnikov <esyr@redhat.com> 2.0.2.1_kern_dup7.5-1
changelog:
- 394e4cd9074e05af7cd4843b33b4b1bef1e122d0
- Resolves: #bz1607750
- atlantic module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 07.702.06.00_rh2_dup7.5-1
changelog:
- 1514ac33c3e6a00c504e6e5eb0289f3c23bb8aa4
- Resolves: #bz1578455
- megaraid_sas module for Driver Update Program


author: Robbie Harwood <rharwood@redhat.com> - 1.15.1-29
changelog:
- Process profile includedir in sorted order
- Also, ignore dotfiles in included directories
- Resolves: #1539824


author: Robbie Harwood <rharwood@redhat.com> - 1.15.1-32
changelog:
- Include preauth name in trace output if possible
- Update cert generation scripts to work on modern openssl
- Fix per-request preauth scoping
- Add test case for PKINIT DH renegotiation
- Echo KDC cookies in preauth tryagain
- Fall back to other preauth mechanisms after failures
- Resolves: #1540130


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.20-2
changelog:
- Resolves: rhbz#1290715 - CVE-2015-5330 libldb: samba: Remote memory read
                           in Samba LDAP server [rhel-7.3]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.20-3
changelog:
- Resolves: rhbz#1290715 - CVE-2015-5330 libldb: samba: Remote memory read
                           in Samba LDAP server [rhel-7.3]
- Remove the patch from the previous commit, it doesn't fix a remotely
  eploitable issue. Add patches from upstream #11636 instead.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.29-1
changelog:
- Resolves: rhbz#1393810 - Rebase libldb to enable samba rebase to
                           version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.2.2-1
changelog:
- Resolves: rhbz#1470056 - Rebase libldb to enable samba rebase to
                           version 4.7.x


author: Karel Zak <kzak@redhat.com> 2.23.2-44
changelog:
- fix #1478002 - systemd read-only container produces errors
- fix #1499760 - gvfs-udisks2-volume-monitor generates huge amount of audit log with access denied messages
- fix #1498462 - agetty not parsing /etc/os-release correctly when processing /etc/issue
- fix #1490984 - Please update fdisk's manual page
- fix #1487031 - [GSS][RFE]The Ceph disk type is unknown then we run the command "fdisk -l"
- fix #1468646 - lscpu output missing Hypervisor
- fix #1455398 - flock --timeout=0 doesn't work on RHEL7
- fix #1336432 - journald: SYSLOG_IDENTIFIER is invalid when running logger
- fix #1427500 - util-linux: script does not retry on EINTR when logging command output
- fix #1336432 - journald: SYSLOG_IDENTIFIER is invalid when running logger
- fix #1296233 - login(1) writes 0.0.0.0 IP address to wtmp when executed with "-h <ipv4-mapping-to-ipv6>" hostname


author: Karel Zak <kzak@redhat.com> 2.23.2-45
changelog:
- fix #1501953 - blkid shows wrong return code on failure with ambivalent results
- fix #1486777 - wipefs printing duplicate gpt clear messages
- fix #1454652 - fix test suite


author: Karel Zak <kzak@redhat.com> 2.23.2-49
changelog:
- fix #1520906 - make hostname in login(1) prompt optional
- fix #1521163 - [RFE] blkid can identify magic number and UUID of VDO volume


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.8-1
changelog:
- Temporarily skip vfat generic resize test on rawhide (vtrefny)
- Use "safeprobe" in "bd_fs_wipe" (vtrefny)
- Add a generic filesystem resize function (vtrefny)
- Add a function to get mountpoint for a device (vtrefny)
- Add a function to get filesystem type for a device (vtrefny)
- Only include the LVM DBus config when shipping LVM DBus (vpodzime)
- Skip the LVM DBus vgreduce tests on Rawhide (vpodzime)
- Do not build the lvm-dbus plugin on RHEL/CentOS (vpodzime)
- Give zRAM more time to settle before trying to remove a device (vpodzime)
- Put zram tests adding/removing devices into a separate class (vpodzime)
- Skip LVM cache and RAID tests on Rawhide (vpodzime)
- Fix the skip_on decorator factory for tests (vpodzime)
- Use 'blkid -p' instead of lsblk to get device's FS type (vpodzime)
- Improve the lvm_set_global_config test (vpodzime)
- Pass '-y' to pvresize (vpodzime)
- Create a copy of os.environ for a child process (vpodzime)
- Revert "Use the "C.UTF-8" locale instead of just "C"" (vpodzime)
- Fix how we create vfat FS in tests (vpodzime)
- Skip the test if requiring unavailable locales (vpodzime)
- Use the "C.UTF-8" locale instead of just "C" (vpodzime)
- Add functions for working with ext2 and ext3 filesystems (vtrefny)
- Link to gobject when lvm or btrfs is enabled (andreas)
- Link to libm where needed (andreas)
- Add a function for cleaning a device (vtrefny)
- Add few code exaples to documentation (vtrefny)
- Use a special exception for no fs signature when doing wipe (vpodzime)
- One more incompatible os.symlink() call (vpodzime)
- Do not use pass-by-name in the os.symlink() call (vpodzime)
- Ignore previous errors when falling back to using ioctl() (vpodzime)
- Use ioctl() call to teardown loop devices (vpodzime)
- Resolve the device to remove for mdadm (vpodzime)
- Add a function for getting device symlinks (vpodzime)
- Use the new resolve_device() function where appropriate (vpodzime)
- Add the resolve_device() function to the utils library (vpodzime)
- First try to read the 'autoclear' flag from /sys/ (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.9-1
changelog:
- Fix hardcoded reference to gcc (timo.gurr)
- Catch and ignore partial failures in LVM tests' cleanups (vpodzime)
- Fix hardcoded reference to pkg-config (timo.gurr)
- Make GObject introspection optional (vpodzime)
- Do not link libraries required by plugins to the GI files (vpodzime)
- Make sure the whole build status image is shown (vpodzime)
- Show CI status in README (at the GH repo's front page) (vpodzime)
- Always require the libudev pkg (tgurr)
- Make sure we give kernel time to fully setup zram device(s) (vpodzime)
- fs_test.py: Close FDs when calling utilities (tasleson)
- crypto.c: Correct segmentation fault (tasleson)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.10-1
changelog:
- Only enable partition size tolerance with alignment (vpodzime)
- Limit the requested partition size to maximum possible (vpodzime)
- Do not verify vfat FS' size after generic resize (vpodzime)
- Specify tolerance for partition size (kailueke)
- Only use the exact constraint if not using any other (vpodzime)
- Check resulting FS size in tests for generic FS resize (vpodzime)
- Query setting FS label support and generic relabeling (kailueke)
- Do not strictly require all FS utilities (vpodzime)
- Compile everything with the C99 standard (vpodzime)
- Add partition resize function (kailueke)
- Generic Check and Repair Functions (kailueke)
- Query functions for FS resize and repair support (kailueke)
- Update the project/source URL in the spec file (vpodzime)
- Add functions for opening/closing TrueCrypt/VeraCrypt volumes (vpodzime)
- Adapt to a change in behaviour in new libmount (vpodzime)
- Try RO mount also if we get EACCES (vpodzime)
- Size in bytes for xfs_resize_device (kailueke)
- src/plugins/Makefile.am: Remove hard coded include path in /usr prefix (tristan.vanberkom)
- Fixed include for libvolume_key.h (tristan.vanberkom)
- Ignore parted warnings if possible (squimrel)
- bcache tests: Remove FEELINGLUCKY checks (tasleson)
- kbd.c: Code review corrections (tasleson)
- kbd.c: Make bd_kbd_bcache_create work without abort (tasleson)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.11-1
changelog:
- Make the KbdZRAMDevicesTestCase inherit from KbdZRAMTestCase (vpodzime)
- Allow non-source directory builds (kailueke)
- Add a way to disable runtime dependency checks (vpodzime)
- Link to GObject even if no plugin is activated (kailueke)
- Skip zram tests on Rawhide (vpodzime)
- Keep most utilities available for tests (vpodzime)
- Use new libmount function to get (un)mount error message (vtrefny)
- Update the documentation URL (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.12-1
changelog:
- Own directories /etc/libblockdev and /etc/libblockdev/conf.d (vtrefny)
- Wait for resized partition (kailueke)
- Make sure the device is opened for libparted (vpodzime)
- Fix label check in swap_test (vtrefny)
- Use "run_tests" script for running tests from Makefile (vtrefny)
- Add a script for running tests (vtrefny)
- Tests: Move library initialization to setUpClass method (vtrefny)
- Stop skipping FAT resize tests on rawhide (vtrefny)
- Close filesystem before closing the partition during FAT resize (vtrefny)
- Use mountpoint for "xfs_info" calls (vtrefny)
- Use libmount cache when parsing /proc/mounts (vtrefny)
- Add some space for the CI status (vpodzime)
- Confirm the force when creating PVs in FS tests (vpodzime)
- Skip vgremove tests on 32bit Debian (vtrefny)
- Fix names of backing files in tests (vtrefny)
-  Fix checking for available locales (vtrefny)
- Skip dependency checking in mpath tests on Debian (vtrefny)
- Skip zRAM tests on Debian (vtrefny)
- Skip the test for device escrow on Debian too (vtrefny)
- Skip free region tests on Debian too (vtrefny)
- Fix redirecting command output to /dev/null in tests (vtrefny)
- Try harder to unmount devices in test cleanup (vtrefny)
- Require only plugins that are needed for given test (vtrefny)
- Try to get distribution info from "PrettyName" if "CPEName" isn't available (vtrefny)
- Use -ff when creating PVs in FS tests (vpodzime)
- Sync spec with downstream (vpodzime)


author: Peter Robinson <pbrobinson@fedoraproject.org> 0.12.4-1
changelog:
- Update to 0.12.4
- http://ftp.gnome.org/pub/GNOME/sources/libchamplain/0.12/libchamplain-0.12.4.news


author: Debarshi Ray <rishi@fedoraproject.org> - 0.10.4-4
changelog:
- Ensure that the new exiv2 soname is used during the build
- Adapt to Exiv2::BasicIo API change
  Resolves: rhbz#1486570


author: Iryna Shcherbina <ishcherb@redhat.com> - 1:1.0.1-0.2.20180226gitb029c24
changelog:
- Update Python 2 dependency declarations to new packaging standards
  (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Adam Jackson <ajax@redhat.com> - 1.0.1-0.6.git5baa1e5
changelog:
- Enable %check for all but ppc64 and s390x, which has known but low-impact
  failures
- Simplify %release


author: Till Maas <opensource@till.name> - 3.6.0-7
changelog:
- Rebuilt for Fedora 23 Change
  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Kalev Lember <klember@redhat.com> - 3.21.92-1
changelog:
- Update to 3.21.92
- Don't set group tags
- Use make_install macro
- Use license macro for COPYING
- Use desktop-file-validate instead of desktop-file-install
- Tighten -devel deps with the _isa macro


author: Christophe Fergeau <cfergeau@redhat.com> 0.3.1-2
changelog:
- Requires a new enough librest as we use symbols not available in older
  librest
  Related: rhbz#1116844


author: Fabiano Fidêncio <fidencio@redhat.com> 0.3.3-2
changelog:
- Fix crash when VM has several ISO domains
  Resolves: rhbz#1274356
- Add OvirtProxy::sso-token support for oVirt 4.0
  Resolves: rhbz#1324457


author: Christophe Fergeau <cfergeau@redhat.com> - 0.3.3-3
changelog:
- Add upstream patch fixing unwanted authentication dialog for foreign menu
  when using remote-viewer ovirt://
  Resolves: rhbz#1346256


author: Christophe Fergeau <cfergeau@redhat.com> - 0.3.3-4
changelog:
- Add upstream patch forcing use of the older v3 REST API as we don't support
  yet the v4 API
  Resolves: rhbz#1346215


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 0.3.3-5
changelog:
- New storage format added in oVirt 4.1
  Resolves: rhbz#1346215
- Check if operation was cancelled before disconnecting signal
  Resolves: rhbz#1431275


author: Christophe Fergeau <cfergeau@redhat.com> - 0.3.4-1
changelog:
- Rebase to latest 0.3.4 upstream release. Still quite a few patches as
  there was no 0.3.5 release yet
  Resolves: rhbz#1584266


author: Lukas Nykryn <lnykryn@redhat.com> - 219-50
changelog:
- core: fix the reversed sanity check when setting StartupBlockIOWeight over dbus (#1302305)
- shared/dropin: ignore ENAMETOOLONG when checking drop-in directories (#7525) (#1489095)
- enable display manager only on systemd installation (#1464893)
- remove unnecessary dependency on dracut (#1466676)
- substitute PACKAGE_STRING with the actual package NVR (#1453153)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-52
changelog:
- cryptsetup: when unlocking always put path to the object into Id (#1511043)
- cryptsetup: use more descriptive name for the variable and drop redundant function (#1511043)
- cryptsetup-generator: do not bind to the decrypted device unit (#6538) (#1511043)
- introduce naming based on phys_port_name for nfp via udev rule (#1516283)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-54
changelog:
- automount: ack automount requests even when already mounted (#1535135)
- udev: net_id add support for platform bus (ACPI, mostly arm64) devices (#1529633)
- journald-native: Fix typo in MANDLOCK message (#1501017)
- process-util: make our freeze() routine do something useful (#1540941)
- dbus: propagate errors from bus_init_system() and bus_init_api() (#1541061)
- bus-util.c: fix TasksMax= property assignment (#1537147)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-55
changelog:
- sparse: avoid clash with __bitwise and __force from 4.10 linux/types.h (#5061) (#1447937)
- core: Let two more booleans survive a daemon-reload (#1542391)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-57
changelog:
- sd-journal: properly handle inotify queue overflow (#1540538)
- sd-journal: make sure it's safe to call sd_journal_process() before the first sd_journal_wait() (#1540538)
- journalctl: Periodically call sd_journal_process in journalctl (#1540538)
- sd-journal: when picking up a new file, compare inode/device info with previous open file by same name (#1540538)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-57.1
changelog:
- umount: always use MNT_FORCE in umount_all() (#7213) (#1571098)
- core: Implement timeout based umount/remount limit (#1571098)
- core: Implement sync_with_progress() (#1571098)


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.32.7-3
changelog:
- Rebase to libguestfs 1.32 in RHEL 7.3
  resolves: rhbz#1218766
- The full tests are now run after the package has been built.
- New tool and subpackage: virt-dib (safe diskimage-builder replacement).
- New subpackage libguestfs-inspect-icons to reduce dependencies of main pkg
  (see https://bugzilla.redhat.com/1194158).
- New tool: virt-get-kernel.
- Depend on java-headless instead of full java.
- New tool: virt-v2v-copy-to-local.
- Disable virt-v2v subpackage on ppc64 etc
  resolves: rhbz#1287826
- v2v: Remove VirtualBox Additions correctly
  resolves: rhbz#1296606
- Add clearer warnings sections to all man pages
  resolves: rhbz#1293527
- v2v: Disable the --in-place option.
- v2v: Support conversion of Windows > 7
  resolves: rhbz#1190669
- Add code to verify tarball signatures.
- General performance improvements.
- v2v: Prevent duplicate -b, -n, -oa options
  resolves: rhbz#1326266
  resolves: rhbz#1325825
- v2v: Unquote UUID and LABEL in fstab (util-linux 1335671)
- v2v: Fix alignment issues in treeviews in conversion dialog
  resolves: rhbz#1340407
- p2v: spinner should be hidden when it stops spinning
  resolves: rhbz#1341564
- p2v: ethtool command is not supported on p2v client
  resolves: rhbz#1341608
- p2v: Add ifconfig command to ISO
  resolves: rhbz#1342447
- p2v: Warn if virt-p2v-make-disk used on a partition
  resolves: rhbz#1342337
- Build using OCaml with fix for CVE-2015-8869.
  resolves: rhbz#1343101
- customize: Add --uninstall option (upstream 1343375)
- p2v: Document permissions on id_rsa file
  resolves: rhbz#1343414
- p2v: Print full curl error message
  resolves: rhbz#1343423
- get-kernel: Fix --format auto
  resolves: rhbz#1341984
- v2v: Provide better <Origin/> information to RHEV-M
  resolves: rhbz#1342398
- customize: Give an error if --truncate-recursive path does not exist
  resolves: rhbz#1345809
- sysprep: Add --network option so that --install option can be used
  resolves: rhbz#1345813
- p2v: Print proper error if incorrect password is given
  resolves: rhbz#1227599
- p2v: Print ssh error if incorrect hostname is given
  resolves: rhbz#1167916
- p2v: Display progress of operation in non-GUI mode
  resolves: rhbz#1229386
- p2v: Add a dialog confirming the user really means to cancel
  resolves: rhbz#1340464
- p2v: log window should process colour escapes and backspaces
  resolves: rhbz#1314244
- v2v: Fix installation of virtio drivers with *.dll files
  resolves: rhbz#1311373
- p2v: Improve error message when ssh login to conversion server fails
  resolves: rhbz#1348900
- v2v: Remove --dcpath parameter from manual
  resolves: rhbz#1315237
- v2v: Fix conversion of guests with floppy drives
  resolves: rhbz#1309706
- p2v: Better error when sudo requires a password
  resolves: rhbz#1340809
- v2v: Refuse to convert if there is < 1GB free in temporary directory
  resolves: rhbz#1316479
- inspection: Get Windows drive letters for GPT disks
  resolves: rhbz#1349237
- p2v: Add disk utils and display serial number of disks
  resolves: rhbz#855058
- p2v: Fix timeout error when connecting to unresponsive ssh server
  resolves: rhbz#1350363
- Remove external dependency generator.  Use supermin RPM deps instead.
  related: rhbz#1309796
- p2v: Flush messages to the journal immediately
  resolves: rhbz#1229386
- customize: Fix --install on ppc64le
  resolves: rhbz#1264835
- lib: Fix finding icons in Windows 7 64 bit guests
  resolevs: rhbz#1352761
- v2v: Add virsh --quiet flag when running virt-v2v --quiet
  resolves: rhbz#1358142
- lib: Fix inspection of ISOs with latest libosinfo
  resolves: rhbz#1359652
- dib: Fix run_command exit handlers on failure
  resolves: rhbz#1362357
- dib: Rework run of extra-data.d hooks
  resolves: rhbz#1362354
- Miscellaneous fixes to man pages and --help output
  resolves: rhbz#1362668
- lib: Specify backing format for read-only files
  resolves: rhbz#1354335
- Fix --selinux-relabel option
  resolves: rhbz#1362669
- sparsify: Fix --in-place option with UEFI guest
  resolves: rhbz#1364347
- p2v: Use latest linux-firmware in ISO
  resolves: rhbz#1364419
- v2v: Fix guest name when using -i disk
  resolves: rhbz#1365005
- p2v: Fix GUI message.
- v2v: Make fstrim message clearer
  resolves: rhbz#1366456
- v2v: Fix conversion of UEFI guests when Secure Boot OVMF installed
  resolves: rhbz#1367615
- lib: Fix assert-fail if port is missing in libvirt XML
  resolves: rhbz#1370424


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.3-6
changelog:
- Rebase to libguestfs 1.36 in RHEL 7.4.
  resolves: rhbz#1359086
- v2v: always use names for libvirt pools
  resolves: rhbz#1141631
- v2v: correctly find GRUB in RHEL UEFI guests
- v2v: uninstall VMware tools packages from guests
  resolves: rhbz#1155150
- v2v: install RHEV-APT only when using -o rhev/-o vdsm
  resolves: rhbz#1161019
- New API: btrfs-filesystem-show
  resolves: rhbz#1164765
- p2v: always enable debugging when running virt-v2v
  resolves: rhbz#1167623
- libguestfs prefers virtio-pci on aarch64
  resolves: rhbz#1237250
- v2v: make sure to copy all the driver files on Windows
  resolves: rhbz#1255610
- Better tolerate corrupted Windows hivex; bump the hivex BuildRequires and
  Requires to >= 1.3.10-5.8.el7
  resolves: rhbz#1311890
- v2v: ignore all the environment variables for proxy when exporting from
  vCenter
  resolves: rhbz#1354507
- virt-sysprep can deal with full-LUKS encrypted guests
  resolves: rhbz#1362649
- All the tools have bash completion scripts.
  resolves: rhbz#1367738
- v2v: do not remove Processor and Intelppm nodes in Windows guests
  resolves: rhbz#1372668
- Fix SELinux relabelling in old RHEL 6 guests, by adjusting a broken
  regular expression in file_contexts file
  resolves: rhbz#1374232
- v2v: set all the properties on creation when exporting to Glance
  resolves: rhbz#1374405
- v2v: set hw_video_model when exporting to Glance
  resolves: rhbz#1374651
- v2v: fix OVA conversion as root using the libvirt backend
  resolves: rhbz#1375157
- Various improvements and fixes to the documentation
  resolves: rhbz#1377081
  resolves: rhbz#1390876
  resolves: rhbz#1398070
  resolves: rhbz#1425306
- v2v: support <listen type='socket'> and <listen type='none'>
  resolves: rhbz#1378022
- v2v: allow libvirt >= 2.1.0 for vCenter conversions
  resolves: rhbz#1379240
- p2v: enable mnemonics in the GUI
  resolves: rhbz#1379289
- Split virt-p2v, and the tools for it, in an own package: virt-p2v-maker
  resolves: rhbz#1382275
- Correctly parse mount options in btrfs entries in /etc/fstab.
  resolves: rhbz#1383517
- Read secrets from libvirt domains, when inspecting them
  resolves: rhbz#1392798
- v2v: add --vdsm-compat=1.1 flag for VDSM
  resolves: rhbz#1400205
- Fix inspection with UsrMove and /usr in a separate partition
  resolves: rhbz#1401474
- v2v: improve import compatibility with OVAs produced by AWS
  resolves: rhbz#1402301
- resize: allow URIs for the output disk
  resolves: rhbz#1404182
- Disable EDD when launching the appliance
  resolves: rhbz#1404287
- v2v: increase the memory allocated to the appliance
  resolves: rhbz#1418283
- p2v: switch from GTK+ 2 to GTK+ 3
- p2v: add dbus-devel as BuildRequires to disable suspension during the
  conversion
- libguestfs-java: bump the java-headless Require to >= 1.7.0, matching the
  Build-Require, and the generated bytecode
  resolves: rhbz#1364518
- Do not try to use/write to /var/cache/yum & /var/log/yum.log
- Bump ocaml-findlib-devel BuildRequires to >= 1.3.3-7.el7, because of
  RHBZ#1403897
- v2v: remove --dcpath & --dcPath from --help output too
  resolves: rhbz#1429430
- v2v: force VNC as display for -i disk, as SDL is not supported
  resolves: rhbz#1372671
- v2v, p2v: rename rhvm network to ovirtmgmt
  resolves: rhbz#1429491
- v2v: when exporting to local disk, check that UEFI firmware is installed
  before conversion
  resolves: rhbz#1429506
- dib: actually generate SHA256 checksums when using --checksum
  resolves: rhbz#1430184
- v2v: do not mention SUSE Xen hosts as supported
  resolves: rhbz#1430203
- v2v: depend on OVMF/AAVMF, for converting EFI guests
  resolves: rhbz#1429643
- v2v: use absolute path when using an OVA as backing file
  resolves: rhbz#1430680
- v2v: support Debian/Ubuntu guests
  resolves: rhbz#1387213
- sysprep: remove DHCP_HOSTNAME entries
  resolves: rhbz#1427529
- v2v: avoid repeated "run virt-v2v -v -x" message on error
  resolves: rhbz#1167623
- bash-completion: add script for virt-v2v-copy-to-local
  resolves: rhbz#1367738
- v2v: fix virtio block driver installation for Windows 10 and Windows 2016
  resolves: rhbz#1434737
- Replace the libosinfo dependency with osinfo-db, since we are only using
  the osinfo database.
- v2v: fix virtio driver installation for Windows 8 UEFI
  resolves: rhbz#1431579
- v2v: new 'vmx' import method
  resolves: rhbz#1441197
- v2v: properly identify Windows 2016 guests when exporting them to RHV-M
  resolves: rhbz#1447202
- Run pvresize in non-interactive mode
  resolves: rhbz#1460692
- resize: make sure the input disk is read-only
  resolves: rhbz#1463714
- Switch qemu-kvm-rhev dependency to qemu-kvm on aarch64
  resolves: rhbz#1463646


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.10-6
changelog:
- Rebase to libguestfs 1.36.10 in RHEL 7.5.
  resolves: rhbz#1472272
- Build against OCaml 4.05
  resolves: rhbz#1447981
- Enable the copyonread flag when running the appliance using libvirt.
  resolves: rhbz#1466563
- Make sure kernel-rt is never used as Requires.
  resolves: rhbz#1471651
- v2v: disable unconfiguration of manually installed VMware tools.
  resolves: rhbz#1477905
- v2v: prefer pigz or pxz for uncompressing OVA files, if available
  resolves: rhbz#1448739
- resize: handle empty UUIDs for swap partitions
  resolves: rhbz#1482737
- v2v: remove mention of --dcpath in an error message
  resolves: rhbz#1486197
- Disables the QEMU image file locking when opening disks as read-only
  resolves: rhbz#1417306
  resolves: rhbz#1503497
- Briefly document the format used for URIs
  resolves: rhbz#1450325
- v2v: deal with grub2 configurations without a default set
  resolves: rhbz#1472288
- v2v: warn when a guest has passthrough devices
  resolves: rhbz#1472719
- v2v: fix three regular expressions
  resolves: rhbz#1494555
- v2v: enable conversion of full-disk LUKS-encrypted Linux guests
  resolves: rhbz#1451665
- v2v: new 'vddk' import method
  resolves: rhbz#1477912
  resolves: rhbz#1513884
- Enable libguestfs to work on z Systems
  resolves: rhbz#1479526
- p2v: fx check for sudo requiring a password
  resolves: rhbz#1500673
- v2v: handle disks with snapshots in vCenter
  resolves: rhbz#1172425
- rescue: backport improved version
  resolves: rhbz#1438710
- v2v: improve bootloader detection
  resolves: rhbz#1508299
- v2v: parse MAC address of network interfaces in OVF files
  resolves: rhbz#1506572
- Unconditionally depend on libvirt-daemon-kvm >= 3.9.0-1, which will always
  pull the right qemu-kvm too, and thus remove the unversioned dependencies
  on it
  resolves: rhbz#1500870
- v2v: fix RPM file owned test
  resolves: rhbz#1503958
- Do not open read-only disks using <shareable/> in the libvirt backend
  resolves: rhbz#1518517
- v2v: handle better when grubby does not report any default kernel
  resolves: rhbz#1519204
- v2v: enhance vmx import method to access via SSH
  resolves: rhbz#1523767
- builder: fix caching of templates when using --cache-all-templates
  resolves: rhbz#1523650


author: Pino Toscano <ptoscano@redhat.com> - 1:1.38.2-12
changelog:
- Rebase to libguestfs 1.38.2 in RHEL 7.6.
  resolves: rhbz#1551055
- v2v: warn about unknown VMware controller types
  resolves: rhbz#1510801
- df: show correct sizes in human-readable mode for filesystems with
  block size = 512
  resolves: rhbz#1525262
- v2v: fix example URL in man page
  resolves: rhbz#1540535
- Fix SELinux relabelling when the SELinux config has no SELINUXTYPE key
  resolves: rhbz#1541525
- Fix qemu-img-ma dependency in non-x86_64 architectures
  resolves: rhbz#1568676
- v2v: update "resume=/dev/sdaX" entries in GRUB command lines
  resolves: rhbz#1532224
- v2v: fix virtio-rng and memballoon OVF fragment for RHV
  resolves: rhbz#1550168
- v2v: detect whether the root filesystem was not mounted in read-write mode
  resolves: rhbz#1567763
- v2v: import OVAs with snapshots
  resolves: rhbz#1570407
- v2v: ship a newer version of rhev-apt.exe
  resolves: rhbz#1571237
- Move the osinfo-db dependency to libguestfs-tools-c, since it's the only
  place where it used now (by virt-builder-repository).
- v2v: new 'rhv-upload' method to stream images directly to oVirt/RHV using
  oVirt REST API
  resolves: rhbz#1557273
- Start lvmetad earlier when booting the appliance
  resolves: rhbz#1581810
- v2v: fix kernel detection in Ubuntu guests since 18.04
  resolves: rhbz#1591248
- v2v: convert the CPU topology correctly
  resolves: rhbz#1541908
- Add a new inspect_get_osinfo API, and add its result to the output of
  virt-inspector
  resolves: rhbz#1544842
- Pass absolute paths to NBD sockets when using the libvirt backend
  resolves: rhbz#1588451
- v2v: do not write only <vendor> without <model> in libvirt XMLs
  resolves: rhbz#1591789
- v2v: depend on nbdkit, nbdkit-plugin-python2, and nbdkit-plugin-vddk,
  used for -it vddk, and -o rhv-upload
  resolves: rhbz#1589776
  resolves: rhbz#1608718
- v2v/p2v: disable on aarch64, since it is not supported (nor even working)
  there
  resolves: rhbz#1601488
- v2v: handle srN devices in libvirt XML (for virt-p2v)
  resolves: rhbz#1612785
- Do not use the -cpu parameter under any circumstances for ppc64le.
  resolves: rhbz#1605071


author: Pino Toscano <ptoscano@redhat.com> - 1:1.38.2-12.el7_6.1
changelog:
- v2v: update documentation regarding SHA-2 certificates in Windows 7 and
  Windows Server 2008 R2
  resolves: rhbz#1632788
- v2v: fix rhev-apt firstboot command for Windows
  resolves: rhbz#1625216


author: Marek Kasik <mkasik@redhat.com> - 0.2.4-1
changelog:
- Update to 0.2.4
- Backport several important patches from current master
- Revert addition of GXPSImage (it would change ABI)
- Resolves: #1384959


author: Marek Kasik <mkasik@redhat.com> - 0.2.5-1
changelog:
- Update to newly released 0.2.5
- Preserve ABI by exporting the same set of methods as before
- Resolves: #1384959


author: Marek Kasik <mkasik@redhat.com> - 0.3.0-2
changelog:
- Ensure gxps_archive_read_entry() fills the GError in case of failure
- Handle errors returned by archive_read_data()
- Resolves: #1574844


author: Peter Hutterer <peter.hutterer@redhat.com> 1.6.3-3
changelog:
- Fix touchpad tap timestamps (#1491525)
- Fix missing show-keycodes entry in man page (#1491532)
- Change palm detection thresholds (#1491537)
- Ignore tap motion threshold for nfingers > nslots (#1491533)
- Fix a memory leak on destroy
- Ignore hovering touches while tapping
- Fix a man page typo


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-15
changelog:
- Resolves: rhbz#1517971 - AD Domain goes offline immediately during
                           subdomain initialization - IPA AD Trust
- Related: rhbz#1482555 - sysdb index improvements - missing ghost
                          attribute indexing, unneeded objectclass index
                          etc..
- Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
                          on RHEL clients joined to AD via sssd [RHEL 7]
- Resolves: rhbz#1527149 - AD provider - AD BUILTIN groups are cached with
                           gidNumber = 0
- Related: rhbz#1461899 - Loading enterprise principals doesn't work with
                          a primed cache
- Related: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
                          threads


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-16
changelog:
- Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                           with no specific host/hostgroup set
- Related: rhbz#1441908 - SELINUX: Use getseuserbyname to get IPA seuser
- Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
                          on RHEL clients joined to AD via sssd [RHEL 7]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-17
changelog:
- Resolves: rhbz#1523282 - sssd used wrong search base with wrong AD
                           server


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-18
changelog:
- Resolves: rhbz#1543348 - sssd_be consumes more memory on RHEL 7.4 systems.
- Resolves: rhbz#1544943 - sssd goes offline when renewing expired ticket


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.1
changelog:
- Resolves: rhbz#1570527 - memory management issue in the sssd_nss_ex interface can cause the ns-slapd process on IPA server to crash [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.2
changelog:
- Resolves: rhbz#1579703 - crash in nss_protocol_fill_netgrent. sssd_nss[19234]: segfault at 80 ip 000055612688c2a0 sp 00007ffddf9b9cd0 error 4 in sssd_nss[55612687e000+39000] [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.4
changelog:
- Resolves: rhbz#1580281 - Samba can not register sss idmap module because it's using an outdated SMB_IDMAP_INTERFACE_VERSION [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.5
changelog:
- Resolves: rhbz#1583746 - The SSSD IPA provider allocates information about external groups on a long lived memory context, causing memory growth of the sssd_be process [rhel-7.5.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.0-19.6
changelog:
- Resolves: rhbz#1594178 - Login with sshkeys stored in ipa not working after update to RHEL-7.5 [rhel-7.5.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.0-19.7
changelog:
- Resolves: rhbz#1596292 - home dir disappear in sssd cache on the IPA master for AD users [rhel-7.5.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.0-19.8
changelog:
- Resolves: rhbz#1601360 - SSSD bails out saving desktop profiles in case an invalid profile is found [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-4
changelog:
- Resolves: rhbz#1590603 - EMBARGOED CVE-2018-10852 sssd: information leak from the sssd-sudo responder [rhel-7]
- Resolves: rhbz#1450778 - Full information regarding priority of lookup of principal in keytab not in man page


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-5
changelog:
- Resolves: rhbz#1583725 - SSSD AD uses LDAP filter to detect POSIX attributes stored in AD GC also for regular AD DC queries
- Resolves: rhbz#1416528 - sssd in cross realm trust configuration should be able to use AD KDCs from a client site defined in sssd.conf or a snippet
- Resolves: rhbz#1592964 - Groups go missing with PAC enabled in sssd


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-6
changelog:
- Resolves: rhbz#1582975 - The search filter for detecting POSIX attributes in global catalog is too broad and can cause a high load on the servers


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-7
changelog:
- Resolves: rhbz#1600822 - SSSD bails out saving desktop profiles in case an invalid profile is found


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.2-8
changelog:
- Resolves: rhbz#1607313 - When sssd is running as non-root user, the sudo pipe is created as sssd:sssd but then the private pipe ownership fails


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.2-10
changelog:
- Resolves: rhbz#1586127 - Spurious check in the sssd nss memcache can cause the memory cache to be skipped


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-12
changelog:
- Resolves: rhbz#1610667 - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key
- Resolves: rhbz#1583360 - The IPA selinux provider can return an error if SELinux is completely disabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.2-13
changelog:
- Resolves: rhbz#1593756 - sssd needs to require a newer version of
                           libtalloc and libtevent to avoid an issue
                           in GPO processing


author: Than Ngo <than@redhat.com> - 4.10.5-2
changelog:
- bz#970713, CVE-2013-2126, double-free flaw when handling
  damaged full-color in Foveon and sRAW files


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-0.4.alpha
changelog:
- Avoid 'test/md5.c:126:3: warning: dereferencing type-punned pointer
  will break strict-aliasing rules' by adding -fno-strict-aliasing flag.


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-0.6.alpha
changelog:
- Fixes for CVE-2018-14679 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682
- resolves: rhbz#1611550 rhbz#1611551 rhbz#1611552 rhbz#1611553


author: Paul Wouters <pwouters@redhat.com> - 3.22-2
changelog:
- Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555)
- Resolves: rhbz#1372050 RFE: Support IKE and ESP over TCP: RFC 8229


author: Paul Wouters <pwouters@redhat.com> - 3.22-3
changelog:
- Resolves: rhbz#1475434 Add support for AES-GMAC for ESP (RFC-4543) to libreswan
- Resolves: rhbz#1300759 Implement RFC-7427 Digital Signature authentication


author: Paul Wouters <pwouters@redhat.com> - 3.22-5
changelog:
- Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [updated]
- Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
- Resolves: rhbz#1375776 [IKEv2 Conformance] Test IKEv2.EN.R.1.2.2.1: Receipt of retransmitted CREATE_CHILD_SA reques failed
- Resolves: rhbz#1375750 SECCOMP support for libreswan [updated for libunbound syscalls]
- Resolves: rhbz#1300763 Implement draft-ietf-ipsecme-split-dns for libreswan


author: Paul Wouters <pwouters@redhat.com> - 3.23-0.1.rc4
changelog:
- Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [client support]
- Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
- Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
- Resolves: rhbz#1492501 Reboot or 'systemctl stop ipsec' brings down _ethernet_ interfaces on _both_ ends of ipv4 ipsec tunnel
- Resolves: rhbz#1324421 libreswan works not well when setting leftid field to be email address
- Resolves: rhbz#1136076 After IKE rekeying Pluto sends DPD even if there is active SA


author: Paul Wouters <pwouters@redhat.com> - 3.23-2
changelog:
- Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
- Resolves: rhbz#1375750 SECCOMP support for libreswan [updated]


author: Paul Wouters <pwouters@redhat.com> - 3.23-4
changelog:
- Resolves: rhbz#1573949 ipsec newhostkey fails in FIPS mode when RSA key is generated
- Resolves: rhbz#1574456 Shared IKE SA leads to rekey interop issues
- Resolves: rhbz#1574457 IKEv2 liveness false positive on IKEv2 idle connections causes tunnel to be restarted


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
- Fix setexecfilecon() to work better in a chroot (#1329931)
- Fix typo in sefcontext_compile.8 (#1320062)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-4
changelog:
- Clarify is_selinux_mls_enabled() description
- Explain how to free policy type from selinux_getpolicytype()
- Compare absolute pathname in matchpathcon -V
- Add selinux_snapperd_contexts_path()
- Modify audit2why analyze function to use loaded policy
- Sort object files for deterministic linking order
- Respect CC and PKG_CONFIG environment variable
- Avoid mounting /proc outside of selinux_init_load_policy()
- Fix multiple spelling errors


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-10
changelog:
- Add missing av_permission values (#1025931)
- Set an appropriate errno in booleans.c (#1402140)
- Change matchpathcon usage to match with matchpathcon manpage (#1412797)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
- Sort object files for deterministic linking order
- Support overriding Makefile RANLIB
- Respect CC and PKG_CONFIG environment variable
- Fix multiple spelling errors
- genhomedircon: %{USERID} and %{USERNAME} support and code cleanups


author: Petr Lautrbach <plautrba@redhat.com> 2.5-4
changelog:
- genhomedircon: add support for Development/Debug syntax
- genhomedircon: generate contexts for logins mapped to the default user
- Validate and compile file contexts before installing
- Swap tcp and udp protocol numbers


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-8
changelog:
- Save linked policy, skip re-link when possible
- Replace access(,F_OK) checks to make setuid programs work (#1186431)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-9
changelog:
- Update semanage to allow runtime labeling of Infiniband Pkeys (#1466274)
- Update semanage to allow runtime labeling of ibendports (#1466274)
- Keep copy of file_contexts.homedirs in policy store (#1409813)
- Add support for listing fcontext.homedirs file (#1409813)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-12
changelog:
- Do not change file mode of seusers and users_extra (#1512639)
- Improve warning for installing disabled module (#1337199)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-14
changelog:
- Include user name in ROLE_REMOVE audit events (#1622045)
- Improve "reset umask before creating directories"


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
- Correctly detect unknown classes in sepol_string_to_security_class
- Sort object files for deterministic linking order
- Fix neverallowxperm checking on attributes
- Remove libsepol.map when cleaning
- Add high-level language line marking support to CIL
- Change logic of bounds checking to match change in kernel
- Fix multiple spelling errors
- Only apply bounds checking to source types in rules
- Fix CIL and not add an attribute as a type in the attr_type_map
- Build policy on systems not supporting DCCP protocol
- Fix extended permissions neverallow checking
- Fix CIL neverallow and bounds checking
- Android.mk: Add -D_GNU_SOURCE to common_cflags


author: Petr Lautrbach <plautrba@redhat.com> 2.5-5
changelog:
- Warn instead of fail if permission is not resolved
- Ignore object_r when adding userrole mappings to policydb


author: Petr Lautrbach <plautrba@redhat.com> 2.5-6
changelog:
- Fix memory leak in expand.c
- Fix invalid read when policy file is corrupt
- Fix possible use of uninitialized variables


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-7
changelog:
- Define cgroup_seclabel policy capability (rhbz#1493517)
- Fix unitialized jmp and invalid dereference


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-8.1
changelog:
- Define nnp_nosuid_transition policy capability (rhbz#1480519)
- use IN6ADDR_ANY_INIT to initialize IPv6 addresses
- Allow runtime labeling of ibendports (rhbz#1464489)
- Allow runtime labeling of Infiniband Pkeys (rhbz#1464489)
- Add IB end port handling to CIL (rhbz#1464489)
- Add ibendport ocontext handling (rhbz#1464489)
- Add support for ibendportcon labels (rhbz#1464489)
- Add Infiniband Pkey handling to CIL (rhbz#1464489)
- Add ibpkey ocontext handling (rhbz#1464489)
- Add support for ibpkeycon labels (rhbz#1464489)
- Remove unused attribute on a used argument from avrule_read() (rhbz#1464489)
- Add binary module support for xperms
- Add support for converting extended permissions to CIL


author: Peter Jones <pjones@redhat.com> - 2.3.3-6
changelog:
- Pull in all the coverity fixes we sent upstream.  I had thought these
  made it in to this release; they did not, but the 2.4.0 release they are
  in is also the python 3 switchover, so we need these as patches.
  Related: rhbz#1463329


author: Peter Jones <pjones@redhat.com> - 2.3.3-8
changelog:
- Fix smbios-sys-info-lite crashes when an asset tag is not set
  Resolves: rhbz#1562440
- Fix vestigial c++ artifacts included in the package
  Resolves: rhbz#1562440


author: Milan Crha <mcrha@redhat.com> - 2.62.2-2
changelog:
- Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c: get_cookies() on empty hostnames
- Resolves: #1598838


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.8-1
changelog:
- Rebase to libtalloc 2.1.8
- Resolves: rhbz#1393811 - Rebase libtalloc to enable samba rebase to
                           version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.9-1
changelog:
- Rebase to libtalloc 2.1.9
- Resolves: rhbz#1393811 - Rebase libtalloc to enable samba rebase to
                           version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.10-1
changelog:
- Rebase to libtalloc 2.1.10
- Resolves: rhbz#1470053 - Rebase libtalloc to enable samba rebase to
                           version 4.7.x


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.21-3
changelog:
- BuildRequire the minimal applicable libtalloc version
- Resolves: rhbz#1133919 - Rebase libtevent to version 0.9.21 or newer


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.33-1
changelog:
- Resolves: #1470054 - Rebase libtevent to enable samba rebase to version
                       4.7.x


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.34-1
changelog:
- Resolves: #1512414 - tevent can cause a Samba file corruption bug under
                       heavy threaded load


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.7.3-2
changelog:
- Put back the hack to ensure hardening
  Related: rhbz#1477736
- Fix the relationship between new udisks2 and storaged
  Related: rhbz#1477736


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.7.3-3
changelog:
- Add and use a service for cleaning up mount point directories
  Resolves: rhbz#1384796
- Do not try to create file watchers for RAIDs without redundancy
  Resolves: rhbz#1400056


author: Vojtech Trefny <vtrefny@redhat.com> - 2.7.3-7
changelog:
- core: Add Encrypted.Resize method
  Resolves: rhbz#1567992
- Fix checking for distribution and version in integration tests
  Resolves: rhbz#1508385
- Do not skip integration tests on CentOS/RHEL
  Resolves: rhbz#1511974
- Fix failing MDRAID integration test
  Resolves: rhbz#1511986


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-7
changelog:
- conf: Add infrastructure for disk source private data XML (rhbz#1523261)
- util: storage: Add helpers to parse and format relPath into privateData (rhbz#1523261)
- qemu: domain: Parse and format relPath into disk source private data (rhbz#1523261)
- qemu: remove input device after receiving the event (rhbz#1524837)
- conf: honor maxnames in nodeListDevices API (rhbz#1528572)
- storage: Fixing missing 'backingStore' tag from volume XML dumps. (rhbz#1529663)
- util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
- util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
- cpu_x86: Rename virCPUx86MapInitialize (CVE-2017-5715)
- conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
- qemu: capabilities: force update if the microcode version does not match (CVE-2017-5715)
- cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-8
changelog:
- qemuDomainAttachDeviceMknodHelper: Remove symlink before creating it (rhbz#1528502)
- RHEL: cpu: Fix EPYC-IBRS CPU model (CVE-2017-5715)
- cpu_x86: Copy CPU signature from ancestor (rhbz#1533125)
- qemu: Ignore fallback CPU attribute on reconnect (rhbz#1532980)
- qemu: Fix type of a completed job (rhbz#1523036)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-9
changelog:
- qemu: Fix crash in offline migration (rhbz#1536351)
- Revert "qemu: monitor: do not report error on shutdown" (rhbz#1536461)
- qemu: Refresh caps cache after booting a different kernel (rhbz#1525182)
- qemu: Don't initialize struct utsname (rhbz#1525182)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-10
changelog:
- storage: util: Properly ignore errors when backing volume is inaccessible (rhbz#1540022)
- util: json: Add helper to return string or number properties as string (rhbz#1540290)
- util: storage: Parse 'lun' for iSCSI protocol from JSON as string or number (rhbz#1540290)
- util: Introduce virFormatIntPretty (rhbz#1289368)
- util: Make prefix optional in virBitampString (rhbz#1289368)
- util: Rename virBitmapString to virBitmapToString (rhbz#1289368)
- util: Rename virBitmapDataToString to virBitmapDataFormat (rhbz#1289368)
- util: Don't output too many zeros from virBitmapToString (rhbz#1289368)
- util: Introduce virBitmapNewString (rhbz#1289368)
- util: Reintroduce virBitmapSubtract (rhbz#1289368)
- util: Introduce virBitmapShrink (rhbz#1289368)
- conf: Sort cache banks in capabilities XML (rhbz#1289368)
- conf: Format cache banks in capabilities with virFormatIntPretty (rhbz#1289368)
- tests: Remove executable bits on plain data files (rhbz#1289368)
- tests: Minor adjustments for test data (rhbz#1289368)
- tests: Add resctrl-skx-twocaches test case to vircaps2xmltest (rhbz#1289368)
- util: Fix leak in virStringTrimOptionalNewline (rhbz#1289368)
- Rename virResctrlInfo to virResctrlInfoPerCache (rhbz#1289368)
- util: Add virResctrlInfo (rhbz#1289368)
- conf: Use virResctrlInfo in capabilities (rhbz#1289368)
- util: Remove now-unneeded resctrl functions (rhbz#1289368)
- fixup_resctrlinfo (rhbz#1289368)
- resctrl: Add functions to work with resctrl allocations (rhbz#1289368)
- conf: Add support for cputune/cachetune (rhbz#1289368)
- tests: Add virresctrltest (rhbz#1289368)
- qemu: Add support for resctrl (rhbz#1289368)
- tests: Clean up and modify some vircaps2xmldata (rhbz#1289368)
- resctl: stub out functions with Linux-only APIs used (rhbz#1289368)
- util: Check for empty allocation instead of just NULL pointer (rhbz#1289368)
- util: Use "resctrl" instead of "resctrlfs" spelling (rhbz#1289368)
- util: Make it possible for virResctrlAllocSetMask to replace existing mask (rhbz#1289368)
- util: Remove unused variable in virResctrlGetInfo (rhbz#1289368)
- util: Don't check if entries under /sys/fs/resctrl/(info/) are directories (rhbz#1289368)
- util: Add helpers for getting resctrl group allocs (rhbz#1289368)
- util: Use default group's mask for unspecified resctrl allocations (rhbz#1289368)
- util: Don't overwrite mask in virResctrlAllocFindUnused (rhbz#1289368)
- qemu: Restore machinename even without cgroups (rhbz#1289368)
- util: Extract path formatting into virResctrlAllocDeterminePath (rhbz#1289368)
- qemu: Restore resctrl alloc data after restart (rhbz#1289368)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-11
changelog:
- qemu: migration: Refresh device information after transferring state (rhbz#1463168)
- qemuDomainRemoveMemoryDevice: unlink() memory backing file (rhbz#1461214)
- util: Fix possible leak in virResctrlAllocMasksAssign (rhbz#1540817)
- util: Clear unused part of the map in virBitmapShrink (rhbz#1540817)
- tests: Add test for properly removing cachetune entries (rhbz#1540817)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-12
changelog:
- util: Check if kernel-provided info is consistent with itself (rhbz#1540780)
- qemu: Refresh capabilities when creating resctrl allocation (rhbz#1540780)
- qemu: Expose rx/tx_queue_size in qemu.conf too (rhbz#1541960)
- util: bitmap: Fix value of 'map_alloc' when shrinking bitmap (rhbz#1540817)
- qemu: driver: Extract vcpu halted state directly (rhbz#1534585)
- qemu: Remove unused 'cpuhalted' argument from qemuDomainHelperGetVcpus (rhbz#1534585)
- qemu: domain: Store vcpu halted state as a tristate (rhbz#1534585)
- qemu: Limit refresh of CPU halted state to s390 (rhbz#1534585)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.1
changelog:
- virDomainDeviceValidateAliasForHotplug: Use correct domain defintion (rhbz#1554928)
- conf: Check for user aliases duplicates only (rhbz#1554962)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.3
changelog:
- qemu_cgroup: Fix 'rc' argument on virDomainAuditCgroupPath() calls (rhbz#1564996)
- util: Introduce virStringListMerge (rhbz#1564996)
- util: Introduce virDevMapperGetTargets (rhbz#1564996)
- qemu_cgroup: Handle device mapper targets properly (rhbz#1564996)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.4
changelog:
- lxc: Drop useless check in live device update (rhbz#1557922)
- Pass oldDev to virDomainDefCompatibleDevice on device update (rhbz#1557922)
- qemu: Fix updating device with boot order (rhbz#1557922)
- conf: Fix crash in virDomainDefCompatibleDevice (rhbz#1557922)
- vmx: check for present/enabled devices earlier (rhbz#1566524)
- vmx: allocate space for network interfaces if needed (rhbz#1566524)
- internal: add STRCASEPREFIX (rhbz#1566524)
- vmx: convert any amount of NICs (rhbz#1566524)
- qemu: Use dynamic buffer for storing PTY aliases (rhbz#1566525)
- qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748) (CVE-2018-5748)
- qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064) (CVE-2018-1064)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.6
changelog:
- logging: Don't inhibit shutdown in system daemon (rhbz#1573268)
- util: don't check for parallel iteration in hash-related functions (rhbz#1581364)
- cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639)
- virNumaGetHugePageInfo: Return page_avail and page_free as ULL (rhbz#1582418)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.8
changelog:
- remote: Extract common clearing of event callbacks of client private data (rhbz#1619206)
- remote: Move the call to remoteClientFreePrivateCallbacks from FreeFunc to CloseFunc (rhbz#1619206)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-1
changelog:
- Rebased to libvirt-4.5.0 (rhbz#1563169)
- The rebase also fixes the following bugs:
    rhbz#1291851, rhbz#1393106, rhbz#1468422, rhbz#1469338, rhbz#1526382
    rhbz#1529059, rhbz#1541921, rhbz#1544869, rhbz#1552092, rhbz#1568407
    rhbz#1583623, rhbz#1584091, rhbz#1585108, rhbz#1586027, rhbz#1588295
    rhbz#1588336, rhbz#1589730, rhbz#1590214, rhbz#1591017, rhbz#1591561
    rhbz#1591628, rhbz#1591645, rhbz#1593549


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-2
changelog:
- qemu: Add capability for the HTM pSeries feature (rhbz#1525599)
- conf: Parse and format the HTM pSeries feature (rhbz#1525599)
- qemu: Format the HTM pSeries feature (rhbz#1525599)
- qemu: hotplug: Don't access srcPriv when it's not allocated (rhbz#1597550)
- qemuDomainNestedJobAllowed: Allow QEMU_JOB_NONE (rhbz#1598084)
- src: Mention DEVICE_REMOVAL_FAILED event in virDomainDetachDeviceAlias docs (rhbz#1598087)
- virsh.pod: Drop --persistent for detach-device-alias (rhbz#1598087)
- qemu: don't use chardev FD passing with standalone args (rhbz#1598281)
- qemu: remove chardevStdioLogd param from vhostuser code path (rhbz#1597940)
- qemu: consolidate parameters of qemuBuildChrChardevStr into flags (rhbz#1597940)
- qemu: don't use chardev FD passing for vhostuser backend (rhbz#1597940)
- qemu: fix UNIX socket chardevs operating in client mode (rhbz#1598440)
- qemuDomainDeviceDefValidateNetwork: Check for range only if IP prefix set (rhbz#1515533)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-3
changelog:
- qemu: hotplug: Do not try to add secret object for TLS if it does not exist (rhbz#1598015)
- qemu: monitor: Make qemuMonitorAddObject more robust against programming errors (rhbz#1598015)
- spec: Explicitly require matching libvirt-libs (rhbz#1600122)
- virDomainConfNWFilterInstantiate: initialize @xml to avoid random crash (rhbz#1599545)
- qemuProcessStartPRDaemonHook: Try to set NS iff domain was started with one (rhbz#1470007)
- qemuDomainValidateStorageSource: Relax PR validation (rhbz#1470007)
- virStoragePRDefFormat: Suppress path formatting for migratable XML (rhbz#1470007)
- qemu: Wire up PR_MANAGER_STATUS_CHANGED event (rhbz#1470007)
- qemu_monitor: Introduce qemuMonitorJSONGetPRManagerInfo (rhbz#1470007)
- qemu: Fetch pr-helper process info on reconnect (rhbz#1470007)
- qemu: Fix ATTRIBUTE_NONNULL for qemuMonitorAddObject (rhbz#1598015)
- virsh.pod: Fix a command name typo in nwfilter-binding-undefine (rhbz#1600329)
- docs: schema: Add missing <alias> to vsock device (rhbz#1600345)
- virnetdevtap: Don't crash on !ifname in virNetDevTapInterfaceStats (rhbz#1595184)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-4
changelog:
- qemu: hotplug: don't overwrite error message in qemuDomainAttachNetDevice (rhbz#1598311)
- qemu: hotplug: report error when changing rom enabled attr for net iface (rhbz#1599513)
- qemu: Fix setting global_period cputune element (rhbz#1600427)
- tests: qemucaps: Add test data for upcoming qemu 3.0.0 (rhbz#1475770)
- qemu: capabilities: Add capability for werror/rerror for 'usb-device' frontend (rhbz#1475770)
- qemu: command: Move graphics iteration to its own function (rhbz#1475770)
- qemu: address: Handle all the video devices within a single loop (rhbz#1475770)
- conf: Introduce virDomainVideoDefClear helper (rhbz#1475770)
- conf: Introduce virDomainDefPostParseVideo helper (rhbz#1475770)
- qemu: validate: Enforce compile time switch type checking for videos (rhbz#1475770)
- tests: Add capabilities data for QEMU 2.11 x86_64 (rhbz#1475770)
- tests: Update capabilities data for QEMU 3.0.0 x86_64 (rhbz#1475770)
- qemu: qemuBuildHostdevCommandLine: Use a helper variable mdevsrc (rhbz#1475770)
- qemu: caps: Introduce a capability for egl-headless (rhbz#1475770)
- qemu: Introduce a new graphics display type 'headless' (rhbz#1475770)
- qemu: caps: Add vfio-pci.display capability (rhbz#1475770)
- conf: Introduce virDomainGraphicsDefHasOpenGL helper (rhbz#1475770)
- conf: Replace 'error' with 'cleanup' in virDomainHostdevDefParseXMLSubsys (rhbz#1475770)
- conf: Introduce new <hostdev> attribute 'display' (rhbz#1475770)
- qemu: command: Enable formatting vfio-pci.display option onto cmdline (rhbz#1475770)
- docs: Rephrase the mediated devices hostdev section a bit (rhbz#1475770)
- conf: Introduce new video type 'none' (rhbz#1475770)
- virt-xml-validate: Add schema for nwfilterbinding (rhbz#1600330)
- tools: Fix typo generating adapter_wwpn field (rhbz#1601377)
- src: Fix memory leak in virNWFilterBindingDispose (rhbz#1603025)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-5
changelog:
- esx storage: Fix typo lsilogic -> lsiLogic (rhbz#1571759)
- networkGetDHCPLeases: Don't always report error if unable to read leases file (rhbz#1600468)
- nwfilter: Resolve SEGV for NWFilter Snoop processing (rhbz#1599973)
- qemu: Remove unused bypassSecurityDriver from qemuOpenFileAs (rhbz#1589115)
- qemuDomainSaveMemory: Don't enforce dynamicOwnership (rhbz#1589115)
- domain_nwfilter: Return early if net has no name in virDomainConfNWFilterTeardownImpl (rhbz#1607831)
- examples: Add clean-traffic-gateway into nwfilters (rhbz#1603115)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-6
changelog:
- qemu: Exempt video model 'none' from getting a PCI address on Q35 (rhbz#1609087)
- conf: Fix a error msg typo in virDomainVideoDefValidate (rhbz#1607825)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-7
changelog:
- qemu_migration: Avoid writing to freed memory (rhbz#1593137)
- qemu: hotplug: Fix asynchronous unplug of 'shmem' (rhbz#1618622)
- tests: rename hugepages to hugepages-default (rhbz#1591235)
- tests: extract hugepages-numa-default-dimm out of hugepages-numa (rhbz#1591235)
- tests: rename hugepages-numa into hugepages-numa-default (rhbz#1591235)
- tests: remove unnecessary XML elements from hugepages-numa-default (rhbz#1591235)
- tests: extract pages-discard out of hugepages-pages (rhbz#1591235)
- tests: rename hugepages-pages into hugepages-numa-nodeset (rhbz#1591235)
- tests: rename hugepages-pages2 into hugepages-numa-default-2M (rhbz#1591235)
- tests: extract pages-discard-hugepages out of hugepages-pages3 (rhbz#1591235)
- tests: rename hugepages-pages3 into hugepages-numa-nodeset-part (rhbz#1591235)
- tests: rename hugepages-pages4 into hugepages-numa-nodeset-nonexist (rhbz#1591235)
- tests: rename hugepages-pages5 into hugepages-default-2M (rhbz#1591235)
- tests: rename hugepages-pages6 into hugepages-default-system-size (rhbz#1591235)
- tests: rename hugepages-pages7 into pages-dimm-discard (rhbz#1591235)
- tests: rename hugepages-pages8 into hugepages-nodeset-nonexist (rhbz#1591235)
- tests: introduce hugepages-default-1G-nodeset-2M (rhbz#1591235)
- tests: introduce hugepages-nodeset (rhbz#1591235)
- conf: Move hugepage XML validation check out of qemu_command (rhbz#1591235)
- conf: Move hugepages validation out of XML parser (rhbz#1591235)
- conf: Introduce virDomainDefPostParseMemtune (rhbz#1591235)
- tests: sev: Test launch-security with specific QEMU version (rhbz#1612009)
- qemu: Fix probing of AMD SEV support (rhbz#1612009)
- qemu: caps: Format SEV platform data into qemuCaps cache (rhbz#1612009)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-8
changelog:
- storage: Add --shrink to qemu-img command when shrinking vol (rhbz#1613746)
- access: Fix nwfilter-binding ACL access API name generation (rhbz#1611320)
- qemu: mdev: Use vfio-pci 'display' property only with vfio-pci mdevs (rhbz#1624735)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-9
changelog:
- virDomainDefCompatibleDevice: Relax alias change check (rhbz#1621910)
- virDomainDetachDeviceFlags: Clarify update semantics (rhbz#1621910)
- virDomainNetDefCheckABIStability: Check for MTU change too (rhbz#1623157)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.1
changelog:
- security: dac: also label listen UNIX sockets (rhbz#1635228)
- qemu: fix up permissions for pre-created UNIX sockets (rhbz#1635228)
- virFileIsSharedFSType: Check for fuse.glusterfs too (rhbz#1635705)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.2
changelog:
- virfile: fix cast-align error (rhbz#1635705)
- virfiletest: Fix test name prefix for virFileInData test (rhbz#1635705)
- virfiletst: Test virFileIsSharedFS (rhbz#1635705)
- virFileIsSharedFSType: Detect direct mount points (rhbz#1635705)
- virfile: Rework virFileIsSharedFixFUSE (rhbz#1635705)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.3
changelog:
- virfile: Take symlink into account in virFileIsSharedFixFUSE (rhbz#1641798)
- qemu: Properly report VIR_DOMAIN_EVENT_RESUMED_FROM_SNAPSHOT (rhbz#1634759)
- qemu: Report more appropriate running reasons (rhbz#1634759)
- qemu: Pass running reason to RESUME event handler (rhbz#1634759)
- qemu: Map running reason to resume event detail (rhbz#1634759)
- qemu: Avoid duplicate resume events and state changes (rhbz#1634759)
- qemu: Don't ignore resume events (rhbz#1634759)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-10
changelog:
- Fix CVE-2014-6051 (integer overflow in screen size handling) (bug #1157671)
- Fix CVE-2014-6052 (NULL pointer dereference in framebuffer setup)
  (bug #1157671)
- Fix CVE-2014-6053 (NULL pointer dereference in ClientCutText message
  handling) (bug #1157671)
- Fix CVE-2014-6054 (server divide-by-zero in scaling factor handling)
  (bug #1157671)
- Fix CVE-2014-6055 (server stacked-based buffer overflow in file transfer
  handling) (bug #1157671)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-11
changelog:
- Fix a crash in the VNC server library on connecting an IPv4 client if the
  server could not start listening on an IPv6 socket (bug #1314814)


author: Rex Dieter <rdieter@fedoraproject.org> - 1.11-4
changelog:
- fix fpath (use autoreconf -f)
- -devel: tighten deps via %{?_isa}, drop Requires: pkgconfig (add explicit BR: pkgconfig)


author: Jan Synáček <jsynacek@redhat.com> - 7.4.0-29.20130522svn140
changelog:
- Fix disrupted sentence in default logwatch.conf file (#1126848)
- Fix smartd copyright message needs to be suppressed again (#1162741)
- Fix Logwatch cron files not marked correctly as %config(noreplace) (#1221903)
- Fix When filesystem name is long, the disk full check fails to work (#1293360)
- Fix Should not change the case of $logdir (#1293624)
- Fix logwatch --service sshd --detail 8 does not print Kerberos summary (#1295888)
- Fix logwatch puppet-agent unknown entries (#1299181)
- Fix logwatch fails with argument list too long (#1300170)


author: Jan Synáček <jsynacek@redhat.com> - 7.4.0-32.20130522svn140
changelog:
- Refix logwatch fails with argument list too long (#1300170)
- Fix Typos in sshd service script output (#1335493)


author: Jan Synáček <jsynacek@redhat.com> - 7.4.0-33.20130522svn140
changelog:
- SSHD log format is going to change (#1422797)
- logwatch encode=base64 generates invalid mime block (#1123093)


author: Michal Schorm <mschorm@redhat.com> - 5.5.52-2
changelog:
- Extension of mariadb-prepare-db-dir script
- Resolves: #1356897

- Rebase to 5.5.52, that also include fix for CVE-2016-6662
  Resolves: #1377974


author: Honza Horak <hhorak@redhat.com> - 1:5.5.56-1
changelog:
- Rebase to 5.5.56
  That release also fixes the following security issues:
  CVE-2016-5617/CVE-2016-6664 CVE-2017-3312 CVE-2017-3238 CVE-2017-3243
  CVE-2017-3244 CVE-2017-3258 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318
  CVE-2017-3291 CVE-2017-3302 CVE-2016-5483/CVE-2017-3600 CVE-2017-3308
  CVE-2017-3309 CVE-2017-3453 CVE-2017-3456 CVE-2017-3464
  Resolves: #1458933
  New deps required by upstream: checkpolicy and policycoreutils-python
  License text removed by upstream: COPYING.LESSER
  Do not ignore test-suite failure
  Downstream script mariadb-prepare-db-dir fixed for CVE-2017-3265
  Resolves: #1458940


author: Honza Horak <hhorak@redhat.com> - 1:5.5.56-2
changelog:
- Do not fix context and change owner if run by root in mariadb-prepare-db-dir
  Related: #1458940
- Check properly that datadir includes only expected files
  Related: #1356897


author: Michal Schorm <mschorm@redhat.com> - 1:5.5.60-1
changelog:
- Rebase to 5.5.60
- CVE's fixed: #1558256, #1558260, #1559060
  CVE-2017-3636 CVE-2017-3641 CVE-2017-3653 CVE-2017-10379
  CVE-2017-10384 CVE-2017-10378 CVE-2017-10268 CVE-2018-2562
  CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668
  CVE-2018-2755 CVE-2018-2819 CVE-2018-2817 CVE-2018-2761
  CVE-2018-2781 CVE-2018-2771 CVE-2018-2813
- Resolves: #1535217, #1491833, #1511982, #1145455, #1461692


author: Petr Oros <poros@redhat.com> - 2.1-29.3
changelog:
- Fix: Operation not permitted when installing microcode_ctl
- CVE-2018-3639 hw: cpu: speculative store bypass
- Resolves: #1573456


author: Eugene Syromiatnikov <esyr@redhat.com> - 2.1-29.8
changelog:
- Add model name blacklist infrastructure.
- Store Intel ucode files in /usr/share/microcode_ctl; do not populate them
  in a virtualised environment.
- Resolves: #1576334


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-29.11
changelog:
- Add an ability to disable "hypervisor" /proc/cpuinfo flag check.
- Intel CPU microcode update to 20180807.
- Resolves: #1614847.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-29.12
changelog:
- Drop "hypervisor" /proc/cpuinfo flag check.
- Intel CPU microcode update to 20180807a.
- Add README.caveats documentation file.
- Add intel-microcode2ucode manual page.
- Add check for early microcode load, use it in microcode_ctl dracut module.
- Check that the currently running kernel is installed before
  running dracut -f.


author: John Dennis <jdennis@redhat.com> - 0.10.0-1
changelog:
- Rebase to upstream 0.10.0 release
- Apply upstream commits post 0.10.0 release
- Apply ECP pending patches
- Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.10.0-2
changelog:
- Rebase to upstream 0.10.0 release
- Apply upstream commits post 0.10.0 release
- Apply revised ECP pending patches
- Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.10.0-3
changelog:
- Rebase to upstream 0.10.0 release
- Apply upstream commits post 0.10.0 release
- Apply revised ECP pending patches,
  fix patch to pickup change in configure script that causes
  HAVE_ECP to be defined
- Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.11.0-1
changelog:
- Upgrade to upstream 0.11.0 release.
- Includes ECP support, see NEWS for all changes.
- Update mellon_create_metadata.sh to match internally generated metadata,
  includes AssertionConsumerService for postResponse, artifactResponse &
  paosResponse.
- Add lasso 2.5.0 version dependency
- Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.11.0-2
changelog:
- Resolves: bug #1296286
  mod_auth_mellon emits CRITICAL warning message in Apache log when doing ECP
- Resolves: bug #1324536
  Installing mod_auth_mellon causes working Kerberos authentication
  to start failing
- Add ECP.rst documentation file that was erroneously omitted


author: John Dennis <jdennis@redhat.com> - 0.11.0-4
changelog:
- Resolves: rhbz#1414021 - Incorrect Content-Type header in ECP PAOS
  Rebuilding due to missing comment in Changelog


author: John Dennis <jdennis@redhat.com> - 0.13.1-1
changelog:
- Resolves: rhbz#1481332 Upgrade to current upstream 0.13.1
- Adds the following upstream bug fixes on top of 0.13.1:
  * ee97812 Add Mellon User Guide
  * daa5d1e If no IdP's are defined explicitly log that fact
  * c291232 Make MellonUser case-insensitive.
  * 2c2e19d Fix incorrect error check for many `lasso_*`-functions.
  * 5c5ed1d Fix segmentation fault with POST field without a value.
  * 4c924d9 Fix some log message typos
  * 93faba4 Update log msg for Invalid Destination and Invalid Audience to
    show both the expected and received values.
- Add new mellon user guide to installed docdir


author: John Dennis <jdennis@redhat.com> - 0.13.1-2
changelog:
- Resolves: rhbz#1553854 Add diagnostic logging
- Add MellonSignatureMethod config option to set signature method used
  to sign SAML messages sent by Mellon. Defaults to original sha1.


author: John Dennis <jdennis@redhat.com> - 0.13.1-3
changelog:
- Resolves: rhbz#1553854 Add diagnostic logging
- Add README.redhat.rst doc, explains how to enable diagnostic logging


author: Jan Kaluza <jkaluza@redhat.com> - 3.4-7
changelog:
- compile with -fno-strict-aliasing to workaround Python
  bug http://www.python.org/dev/peps/pep-3123/


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-8
changelog:
- mwm: do not see outline of window when moving (RHBZ#1080548)
  Clone of RHBZ#997241
- Fixed rendering issues seen while scrolling window (RHBZ#1134365)
  (MotifZone bug #1654)


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-9
changelog:
- Fixed motif issue while navigating drop down menus with arrow keys
  (RHBZ#1396514) (MotifZone bug #1564)


author: Carlos Soriano <csoriano@redhat.com> - 2.3.4-10
changelog:
- Fix last commit that is actually MotifZone#1565 and removes that patch since
  it was causing more problems. Fixes MotifZone#1576.
  Resolves: rhbz#1448509


author: Carlos Soriano <csoriano@redhat.com> - 2.3.4-13
changelog:
- Fix motifzone 1665. Motif was deactivating shorcuts in cascade menus when
  closing them by mouse.
  Resolves: RHBZ#1467303


author: Björn Esser <besser82@fedoraproject.org> - 52.5.0-3
changelog:
- SpiderMonkey tests do not fail on any arch
- Basic JIT tests are failing on s390 arches, only
- Use macro for ppc64 arches
- Run tests using Python2 explicitly
- Simplify %check
- Use the %{major} macro consequently
- Replace %define with %global


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.21-27
changelog:
- Resolves #1388511 (System default CA bundle not set as default in compiled-in
  default or config)
- Resolves #1388512 (mutt sends e-mail with broken "From" header, which has no
  host part)


author: Florian Müllner <fmuellner@redhat.com> - 3.26.2-7
changelog:
- Fix crash during session saving
  Resolves: #1535080
- Fix XWayland prevented from starting
  Resolves: #1540986


author: Carlos Garnacho <cgarnach@redhat.com> - 3.26.2-10
changelog:
- Detect CLUTTER_TOUCHPAD_DEVICE on all Synaptics devices
  Resolves: #1499788
- Fix tablet pressure curve configuration not being applied
  Resolves: #1543693


author: Kalev Lember <klember@redhat.com> - 3.28.3-1
changelog:
- Update to 3.28.3
- Apply HW cursor on-demand patches
- Apply monitor transform regression patch
- Resolves: #1569736


author: Richard W.M. Jones <rjones@redhat.com> - 1.2.3-1
changelog:
- New stable version 1.2.3.
- Add patch to work around libvirt problem with relative socket paths.
- Add patch to fix the xz plugin test with recent guestfish.
- Fix version in VDDK plugin spec file.


author: Richard W.M. Jones <rjones@redhat.com> - 1.2.4-1
changelog:
- New stable version 1.2.4.
- Remove upstream patches.
- Enable tarball signatures.
- Add upstream patch to fix tests when guestfish not available.


author: Richard W.M. Jones <rjones@redhat.com> - 1.2.4-2
changelog:
- Add all upstream patches since 1.2.4 was released.
- Drop example4 and tar plugins since they depend on Perl.


author: Richard W.M. Jones <rjones@redhat.com> - 1.2.5-1
changelog:
- New stable version 1.2.5.
- Enable VDDK plugin on x86-64 only.
- Small refactorings in the spec file.


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-27
changelog:
- Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1326850)
- snmpd: Speed up ipAddressTable loading. (#1327240)
- Fixed net-snmp segfault in netsnmp_copy_fd_set_to_large_fd_set (#1327200)
- Fixed issue with net-snmp-perl dependency on net-snmp-devel (#1438875)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-29
changelog:
- Move net-snmp-config from devel package to general package (#1486733)
- Fix SCTP parser (#1329338)
- Fix strstr() crash (#1428609)
- Add support for TCP and UDP 64 bit counters (#1448082)
- Fix documentation lack for includeFile, includeDir and includeSearch options (#1464485)
- Fix wrong usage of structure iterator (#1461666)
- Fix issue with statistics from autofs (#1501144)


author: Elio Maldonado <emaldona@redhat.com> 4.10.6-2
changelog:
- Generic 32/64 bit platform detection (fix ppc64le build)
- Resolves: Bug 1126243 - Ensure nspr is built for 64 bit on ppc64le


author: Elio Maldonado <emaldona@redhat.com> - 4.10.6-3
changelog:
- Restore s390x related patch as it hasn't been applied upstream yet
- Resolves: Bug 1103250 - Rebase RHEL 7.1 to NSPR 4.10.6 (for FF 31)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
- Resolves: Bug 1269363 - CVE-2015-7183
- nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
- Rebase to NSPR 4.11
- Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
- Decrease the iteration count of PKCS#12 for compatibility with Windows
- Fix deadlock when a token is re-inserted while a client process is running


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-7
changelog:
- Backport upstream fix for CVE-2018-12384
- Remove nss-lockcert-api-change.patch, which turned out to be a
  mistake (the symbol was not exported from libnss)


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-0.1.beta
changelog:
- Update to NSS 3.36 BETA
- Remove upstreamed nss-softokn-3.16-add_encrypt_derive.patch
- Remove upstreamed nss-softokn-3.28-fix-fips-login.patch
- Remove upstreamed nss-softokn-fix-ecc-post.patch


author: Richard W.M. Jones <rjones@redhat.com> - 10.0.5-2
changelog:
- Rebase to open-vm-tools 10.0.5 (from Fedora Rawhide)
  resolves: rhbz#1268537
- Remove PAM calls to pam_unix2.so module
  resolves: rhbz#1313071


author: Richard W.M. Jones <rjones@redhat.com> - 10.0.5-4
changelog:
- Fix failure to quiesce filesystem when Docker containers are running
  resolves: rhbz#1406483
- Fix for deadlock when taking a snapshot
  resolves: rhbz#1398802


author: Richard W.M. Jones <rjones@redhat.com> - 10.1.5-1
changelog:
- Rebase to open-vm-tools 10.1.5 from Fedora Rawhide
  resolves: rhbz#1406901
- Enable vgauthd.
  resolves: rhbz#1269243
- Add runtime dependency on pciutils (1388766).


author: Matus Honek <mhonek@redhat.com> - 2.4.44-10
changelog:
- Drop update-ppolicy-schema.sh scriptlet's output (#1487857)
- Fix issues in MozNSS compatibility layer (#1400578)
  + Force write file with fsync to avoid race conditions
  + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix
  + Allow missing cert and key which is a valid usecase
  + Create extraction folder only in /tmp to simplify selinux rules
  + Fix Covscan issues


author: Matus Honek <mhonek@redhat.com> - 2.4.44-11
changelog:
- MozNSS Compat. Layer: Enable usage of NSS DB with PEM cert/key (#1525485)
  + Fix a possible invalid dereference (covscan)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-12
changelog:
- MozNSS Compat. Layer: Ensure consistency of a PEM dir before usage (#1516409)
  + Warn just before use of a PIN about key file extraction


author: Matus Honek <mhonek@redhat.com> - 2.4.44-13
changelog:
- MozNSS Compat. Layer: fix recursive directory deletion (#1516409)
- MozNSS Compat. Layer: fix PIN disclaimer not always shown (#1516409)
- MozNSS Compat. Layer: fix incorrect parsing of CACertDir (#1533955)


author: Martin Preisler <mpreisle@redhat.com> - 1.2.14-2
changelog:
- RPM probes to return not applicable on non-rpm systems (#1447629)
- fixed sysctl tests on s390x architecture (#1447649)
- Revert warning by default in oscap tool, our message categories are not ready for it (#1447341)


author: Jan Černý <jcerny@redhat.com> - 1.2.15-1
changelog:
- upgrade to the latest upstream release
- short profile names can be used instead of long IDs
- new option --rule allows to evaluate only a single rule
- new option --fix-type in "oscap xccdf generate fix" allows choosing
  remediation script type without typing long URL
- "oscap info" shows profile titles
- OVAL details in HTML report are easier to read
- HTML report is smaller because unselected rules are removed
- HTML report supports NIST 800-171 and CJIS
- remediation scripts contain headers with useful information (#1439813)
- remediation scripts report progress when they run
- basic support for Oracle Linux (CPEs, runlevels)
- remediation scripts can be generated from datastreams that contain
  multiple XCCDF benchmarks
- basic support for OVAL 5.11.2 (only schemas, no features)
- enabled offline RPM database in rpminfo probe
- added Fedora 28 CPE
- fixed oscap-docker with Docker >= 2.0
- fixed behavior of sysctl probe to be consistent with sysctl tool
- fixed generating remediation scripts
- severity of tailored rules is not discarded
- fixed errors in RPM probes initialization
- oscap-docker shows all warnings reported by oscap
- fixed pkgconfig file


author: Matěj Týč <matyc@redhat.com> - 1.2.16-1
changelog:
- upgrade to the latest upstream release
- moved oscap-chroot to openscap-scanner because it's a thin wrapper script with no dependencies


author: Matěj Týč <matyc@redhat.com> - 1.2.16-2
changelog:
- moved oscap-docker to newly created openscap-containers.
- moved man of oscap-chroot to oscap-scanner.


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
changelog:
- fix CVE-2017-3737 - incorrect handling of fatal error state
- fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
changelog:
- add S390x assembler updates
- make CA name list comparison function case sensitive (#1548401)
- fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
- fix CVE-2018-0732 - large prime DH DoS of TLS client
- fix CVE-2018-0737 - RSA key generation cache timing vulnerability
- fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
- fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
- fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: William Cohen <wcohen@redhat.com> - 0.9.9-17
changelog:
- Define some  Intel broadwell default unit masks by names
- Add support for Harrisonville (Denverton SoC)
- Add support for Skylake-SP server
- Add support for Kabylake-U/Y
- Add support for Kabylake-H/S
- Make Nehalem, Westmere, and Haswell event names unique.


author: William Cohen <wcohen@redhat.com> - 0.9.9-22
changelog:
- Update ppc64/ppc64le support. rhbz1385007
- Add recognition check for POWER8NV and POWER8NVL. rhbz1426426


author: Felipe Borges <feborges@redhat.com> - 20170813-1
changelog:
- Update source URL to Pagure
 - Drop the rhel-7.4 data patch
 - Update to new release
 - Resolves: rhbz#1479731


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-4
changelog:
- Rebase to upstream 1a4ef7d180e77bcd6423f342d62e05e516c4e852 (1.1.18-rc4)
- Resolves: rhbz#1381754
- Resolves: rhbz#1474428
- Resolves: rhbz#1499217
- Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-5
changelog:
- Properly clean up primitive inside bundle
- Scalability improvements
- Resolves: rhbz#1499217
- Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-6
changelog:
- Rebase to upstream 2b07d5c5a908998891c3317faa30328c108d3a91 (1.1.18)
- If on-fail=ignore, migration-threshold should also be ignored
- Resolves: rhbz#1474428
- Resolves: rhbz#1507344


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-7
changelog:
- Avoid node attribute write delay when corosync.conf has only IP addresses
- Fix regressions in "pcs resource cleanup" behavior
- Restore ordering of unfencing before fence device starts
- Ensure --wait options work when bundles are in use
- Fix possible invalid transition with bundle ordering constraints
- Resolves: rhbz#1454960
- Resolves: rhbz#1508350
- Resolves: rhbz#1517796
- Resolves: rhbz#1519812
- Resolves: rhbz#1522822


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-10
changelog:
- Always trigger transition when quorum changes
- Match clone names correctly with crm_resource --cleanup
- Fix pcs resource --wait timeout when bundles are used
- Observe colocation constraints correctly with bundles in master role
- Resolves: rhbz#1464068
- Resolves: rhbz#1508350
- Resolves: rhbz#1519812
- Resolves: rhbz#1527072


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-11.1
changelog:
- Do not schedule notifications for unrunnable actions
- Do not expire remote failures if fencing is pending
- Do not consider attribute order difference as CIB change in crm_diff
- Resolves: rhbz#1563345
- Resolves: rhbz#1566533
- Resolves: rhbz#1568720


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-11.3
changelog:
- Fix regression in handling of mixed-case node names
- Avoid multiple recovery of stonith devices
- Resolves: rhbz#1583747
- Resolves: rhbz#1585741


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-13
changelog:
- Pull latest upstream 1.1 branch fixes
- Resolves: rhbz#1478451
- Resolves: rhbz#1501505
- Resolves: rhbz#1514492
- Resolves: rhbz#1550829
- Resolves: rhbz#1564536
- Resolves: rhbz#1576148
- Resolves: rhbz#1577300


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-1
changelog:
- Rebase to upstream 29ac12ad21f73524f69c0580798e07cdf1fe3fa0 (1.1.19-rc1)
- Allow crm_node to work on Pacemaker Remote nodes
- Implement new --validate option to stonith_admin
- Support .path, .mount, and .timer systemd unit files as resources
- Handle INFINITY fail count correctly in crm_failcount
- Resolves: rhbz#1374175
- Resolves: rhbz#1434936
- Resolves: rhbz#1562255
- Resolves: rhbz#1590483
- Resolves: rhbz#1591045


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-2
changelog:
- Ensure resource agent meta-data actions can get local node name
- Do not record pending clone notifications in CIB
- Resolves: rhbz#1374175
- Resolves: rhbz#1570130


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-4
changelog:
- Fix srpm build on ppc64le systems with libservicelog-devel, OpenIPMI-devel
- Resolves: rhbz#1478451


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-7
changelog:
- Shutdown corosync locally if fenced
- Count start failure once
- Resolves: rhbz#1448221
- Resolves: rhbz#1549576


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-8.1
changelog:
- Route remote clone notifications through correct cluster node
- Allow clean-up of managed guest nodes and bundle nodes
- Allow use of guest nodes and bundles in clusters with sbd fencing
- Resolves: rhbz#1646347
- Resolves: rhbz#1646350
- Resolves: rhbz#1646872


author: Lukas Berk <lberk@redhat.com> - 3.12.2-5
changelog:
- Correction to spec file and selinux policy (BZ 1488116)
- Show all perfevent metrics in pcpatop (BZ 1525864)
- Multilib corrections (BZ 1537623)


author: Nathan Scott <nathans@redhat.com> - 4.0.2-1
changelog:
- Ensure sans font dependency resolved for webapps (BZ 1568109)
- Ensure sans font dependency resolved for pmchart (BZ 1546640)
- Update to latest PCP sources (BZ 1565370).


author: Nathan Scott <nathans@redhat.com> - 4.0.2-3
changelog:
- Resolve rpm verification problem on /var/run/pcp (BZ 1533154)
- Fix device mapper PMDA histogram metrics sigsegv (BZ 1569854)
- Fix pmlogger_daily log rotation open port issue (BZ 1579881)


author: Ivan Devat <idevat@redhat.com> - 0.9.158-6
changelog:
- It is now possible to disable, enable, unmanage and manage bundle resources and set their meta attributes
- Fixed timeout when cluster setup takes long time in web UI
- It is now mandatory to specify container type in the "resource bundle create" command
- Resolves: rhbz#1447910 rhbz#1284404


author: Ivan Devat <idevat@redhat.com> - 0.9.160-1
changelog:
- Rebased to latest upstream sources (see CHANGELOG.md)
- Resolves: rhbz#1499749 rhbz#1443647 rhbz#1432283 rhbz#1421702 rhbz#1443418 rhbz#1464781 rhbz#1435697 rhbz#1441673 rhbz#1420437 rhbz#1388783 rhbz#1463327 rhbz#1418199 rhbz#1341582 rhbz#1489682 rhbz#1491631 rhbz#1213946


author: Ivan Devat <idevat@redhat.com> - 0.9.161-1
changelog:
- Rebased to latest upstream sources (see CHANGELOG.md)
- Resolves: rhbz#1499749 rhbz#1415197 rhbz#1501274 rhbz#1502715 rhbz#1230919 rhbz#1503110


author: Ondrej Mular <omular@redhat.com> - 0.9.162-1
changelog:
- Rebased to latest upstream sources (see CHANGELOG.md)
- Resolves: rhbz#1389943 rhbz#1389209 rhbz#1506220 rhbz#1508351 rhbz#1415197 rhbz#1506864 rhbz#1367808 rhbz#1499749


author: Ivan Devat <idevat@redhat.com> - 0.9.162-2
changelog:
- Changed snmp agent logfile path
- It is now possible to set the `action` option of stonith devices in GUI by using force
- Do not crash when `--wait` is used in `pcs stonith create`
- A warning is displayed in `pcs status` and a stonith device detail in web UI  when a stonith device has its `method` option set to `cycle`
- Resolves: rhbz#1367808 rhbz#1421702 rhbz#1522813 rhbz#1523378


author: Ivan Devat <idevat@redhat.com> - 0.9.162-3
changelog:
- Pcs now properly exits with code 1 when an error occurs in pcs cluster node add-remote and pcs cluster node add-guest commands
- Fixed a crash in the pcs booth sync command
- Resolves: rhbz#1464781 rhbz#1527530


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5
changelog:
- Fixed `pcs cluster auth` in a cluster when not authenticated and using a non-default port
- Fixed `pcs cluster auth` in a cluster when previously authenticated using a non-default port and reauthenticating using an implicit default port
- Resolves: rhbz#1415197


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.1
changelog:
- Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
- Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
- Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb
- Resolves: rhbz#1557253


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Removed Source: HAM-logo.png
-->  Remove TUV's branding logo
- Added Source: pcs.ini
-->  Config file for automated patch script
- Added Patch: 99999-Use-SL-Favicon.patch
-->  Remove TUV's branding logo
- Added Source: HAM-logo.png
-->  Add SL branding


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.2
changelog:
- Fix instance attributes setting for fence agents `fence_compute` and `fence_evacuate`
- Resolves: rhbz#1628070


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: pcs.ini
-->  Config file for automated patch script
- Added Patch: 99999-Use-SL-Favicon.patch
-->  Remove TUV's branding logo
- Added Source: HAM-logo.png
-->  Add SL branding


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-5
changelog:
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
  (RHEL)
- Bugzilla Bug #1466066 - CC: Secure removal of secret data storage
  (jmagne)
- Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to
  setup with CMC signed certificates (cfu)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-6
changelog:
- Updated jss, nuxwdog, and openssl dependencies
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
  (RHEL)
- Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in
  few cases (ftweedal)
- Bugzilla Bug #1428021 - CC: shared token storage and retrieval
  mechanism (cfu)
- Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false
  would cause error (cfu)
- Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog
   (alee)
- Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during
  pkispawn (alee)
- Bugzilla Bug #1520526 - p12 admin certificate is missing when
  certificate is signed Externally (edewata)
- Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA
   instance (alee)
- Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to
  missing nextupdate field (ftweedal)
- Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen)
- Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords
  in several different files after installation completes (alee)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-7
changelog:
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
  - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
  set (RHEL) (edewata)
- Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and
  audit event logging at startup (jmagne)
- Bugzilla Bug #1523410 -  Unable to have non "pkiuser" owned CA instance
  (alee)
- Bugzilla Bug #1525306 - CC: missing CMC request and response record
  (cfu)
- Bugzilla Bug #1532933 - Installing subsystems with external CMC
  certificates in HSM environment shows import error (edewata)
- Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm
  (edewata)
- Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers
  permitted in fips mode (mharmsen)
- Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED
  outcomes. (edewata)
- Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
  SharedToken scenario's (cfu)
- Bugzilla Bug #1541526 - CMC: Revocation works with an unknown
  revRequest.issuer (cfu)
- Bugzilla Bug #1541853 - ProfileService: config values with
  backslashes have backslashes removed (ftweedal)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
  - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit
  - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-8
changelog:
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
  - Bugzilla Bug #1542210 - pki console configurations that involves ldap
  passwords leave the plain text password in debug logs (jmagne)
- Bugzilla Bug #1543242 - Regression in lightweight CA key replication
  (ftweedal)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-9
changelog:
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
  - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
  set (RHEL) (edewata)
- Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata)
- Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM
  and FIPS (edewata)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
  - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-10
changelog:
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- Bugzilla Bug #1550581 - CMCAuth throws
  org.mozilla.jss.crypto.TokenException: Unable to insert certificate into
  temporary database [rhel-7.5.z] (cfu)
- Bugzilla Bug #1551067 - [MAN] Add --skip-configuration
  and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata)
- Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers
  [rhel-7.5.z] (cheimes, mharmsen)
- Bugzilla Bug #1553068 - Using a Netmask produces an odd entry
  in a certifcate [rhel-7.5.z] (ftweedal)
- Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
  standard conformance [rhel-7.5.z] (cfu)
- Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled
  by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu)
- Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
  CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
- Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives
  StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal)
- Bugzilla Bug #1558919 - Not able to generate certificate request
  with ECC using pki client-cert-request [rhel-7.5.z] (akahat)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-11
changelog:
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
  standard conformance [rhel-7.5.z] (cfu)
- Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
  CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-12
changelog:
- Updated "jss" build and runtime requirements (mharmsen)
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest,
  CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu)
- Bugzilla Bug #1572548 - IPA install with external-CA is failing when
  FIPS mode enabled. [rhel-7.5.z] (edewata)
- Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
  [rhel-7.5.z] (cfu)
- Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue
  with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu)
- Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs
  improvement [rhel-7.5.z] (jmagne)
- Bugzilla Bug #1581135 - SAN in internal SSL server certificate in
  pkispawn configuration step [rhel-7.5.z] (cfu)
- Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong
  input class_id [rhel-7.5.z] (cfu)
- Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System
  9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-13
changelog:
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- Bugzilla Bug #1553068 - Using a Netmask produces an odd
  entry in a certifcate [rhel-7.5.z] (ftweedal)
- Bugzilla Bug #1585945 - CMC CRMF requests result in
  InvalidKeyFormatException when signing algorithm is ECC
  [rhel-7.5.z] (cfu)
- Bugzilla Bug #1587826 - ExternalCA: Installation failed during
  csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor)
- Bugzilla Bug #1588944 - Cert validation for installation with
  external CA cert [rhel-7.5.z] (edewata)
- Bugzilla Bug #1588945 - CRMFPopClient tool - should allow
  option to do no key archival (cfu)
- Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled
  ACL configuration in AAclAuthz.java reverses rules that allow
  and deny access [rhel-7.5.z] (ftweedal, cfu)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-14
changelog:
- Updated "jss" build and runtime requirements (mharmsen)
- Updated "tomcatjss" build and runtime requirements (mharmsen)
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
  [rhel-7.5.z] (cfu)
- Bugzilla Bug #1593585 - Need proper default subjectDN for CMC request
  authenticated through SharedToken [rhel-7.5.z] (cfu)
- Bugzilla Bug #1594128 - CMC: Audit Events needed for failures in
  SharedToken scenario's [rhel-7.5.z] (cfu)
- Bugzilla Bug #1595606 - AuditVerify failure due to line breaks
  [rhel-7.5.z] (cfu)
- Bugzilla Bug #1596525 - Address ECC profile overrides [rhel-7.5.z] (cfu)
- Bugzilla Bug #1596551 - X500Name.directoryStringEncodingOrder overridden
  by CSR encoding [rhel-7.5.z] (cfu)
- Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a
  certifcate [rhel-7.5.z] (ftweedal)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-15
changelog:
- ##########################################################################
- # RHEL 7.5:
- ##########################################################################
- Bugzilla Bug #1600905 - pki console configurations that involves ldap
  passwords leave the plain text password in signed audit logs
  [rhel-7.5.z] (cfu)
- Bugzilla Bug #1611245 - Certificate generation happens with partial
  attributes in CMCRequest file [rhel-7.5.z] (cfu)
- Bugzilla Bug #1611250 - Better understanding of
  NSS_USE_DECODED_CKA_EC_POINT for ECC [rhel-7.5.z] (cfu)
- Bugzilla Bug #1612880 - CMC Revocations throws exception with
  same reqIssuer & certissuer [rhel-7.5.z] (cfu)
- Bugzilla Bug #1614837 - ipa-replica-install --setup-kra broken on
  DL0 with latest version [rhel-7.5.z] (abokovoy)
- Bugzilla Bug #1614839 - CC: Enable all config audit events
  [rhel-7.5.z] (cfu)
- Bugzilla Bug #1615266 - ECC keys not supported for signing audit
  logs [rhel-7.5.z] (cfu)
- ##########################################################################
- # RHCS 9.3:
- ##########################################################################
- # Bugzilla Bug #1539933 - keyGen fails when only Identity


author: Java SIG <java-devel@lists.fedoraproject.org> - 0:2.2-5
changelog:
- Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
- Replace maven BuildRequires with maven-local


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:2.3-1
changelog:
- Update to upstream version 2.3
- Use apache-commons-compress for bzip2 (de)compression
- Resolves: CVE-2012-2098


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.4.2-2
changelog:
- Update to latest packaging guidelines
- Remove MIT license (only applies to test cases not binary rpm)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-13
changelog:
- hll/pp: Fix pp crash when processing base module (#1350806)
- sepolicy: fix obtaining domain name in HTMLManPages (#1174744)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-14
changelog:
- Fix export of fcontext socket entries (#1435100)
- Fix checks whether a module name is passed to semanage-module (#1420527)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-15
changelog:
- sepolicy: Do not fail when file_contexts.{homedirs,local} are not present (#1395778)
- fixfiles - use quotes around "$FILEPATH" (#1241946)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-16
changelog:
- Strip non-printable characters when parsing audit messages (#1406328)
- Install seobject python module into arch specific path (#1061049)
- restorecond: Decrease loglevel of termination message (#1422121)
- semodule_package: do not fail with an empty fc file (#1390535)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-18
changelog:
- semanage: Enable listing file_contexts.homedirs
- semanage: Fix manpage author for ibpkey and ibendport pages.
- semanage: Update man pages for infiniband
- semanage: Update semanage to allow runtime labeling of ibendports
- semanage: Update semanage to allow runtime labeling of Infiniband Pkeys
- semanage: Improve semanage-port man page
- fixfiles: do not dereference link files in tmp


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-20
changelog:
- setfiles: Mention customizable types in restorecon man page (#1260238)
- sepolicy: do not fail when file_contexts.local or .subs do not exist (#1512590)
- semanage: Fix export of ibendport entries (#1471809)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-22
changelog:
- semanage: Fix fcontext help message (#1499259)
- semanage: Improve semanage-user.8 man page (#1079946)
- semodule: Improve man page (#1337192)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-23
changelog:
- Update translation files and remove empty ones (#1375915)
- sepolicy: Fix sepolicy manpage (#1509383)
- semanage/seobject: Fix moduleRecords.modify() (#1408331)
- semodule: Improve man page and unify it with --help (#1320565)
- setfiles: Improve description of -d switch (#1271327)
- sepolgen: Try to translate SELinux contexts to raw (#1356149)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-24
changelog:
- Stop rejecting SCTP and DCCP in sepolicy.info
- semanage: Replace bare except with specific one (#1598444)
- semanage: Fix logger class definition (#1598444)
- semanage: Stop rejecting aliases in semanage commands (#1544793)
- sepolicy: Stop rejecting aliases in sepolicy commands (#1600009)
- semanage: Stop logging loginRecords changes (#1294663)
- Use file_contexts.local in fixfiles restore (#1559808)


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
- update to 9.2.15 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
- update to 9.2.18 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
  http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
  http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
- update to 9.2.21 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
  http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
  http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
- update to 9.2.22 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
- update to 9.2.23 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-4
changelog:
- don't use removed macro %add_to_maven_depmap (#992816)
- lint: trim-lines, reuse %{name} macro, fedora-review fixes
- merge cleanup changes by Stano Ochotnicky


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-6
changelog:
- fix incompatibility with 9.6+ (rhbz#1547424)
- it's unnecessary to depend on whole java (rhbz#1406931)


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-10
changelog:
- Fixes sysinfo - devices with name longer than 20 chars are mistaken for partitions
- Resolves: rhbz#1169349


author: Chris Lumens <clumens@redhat.com> - 1.99.66.11-1
changelog:
- Document %traceback and %onerror. (clumens)
  Related: rhbz#1412538
- Add an %onerror script section. (clumens)
  Related: rhbz#1412538
- Add more test coverage around Group and Script objects. (clumens)
  Related: rhbz#1412538
- Add --nohome option to autopart command. (#141) (vponcova)
  Related: rhbz#663099
- Add --chunksize option to raid command. (#140) (vponcova)
  Related: rhbz#1332316


author: Chris Lumens <clumens@redhat.com> - 1.99.66.12-1
changelog:
- Add documentation for the snapshot feature (jkonecny)
  Related: rhbz#1113207
- Add tests for a new snapshot command (jkonecny)
  Related: rhbz#1113207
- Add support of --when param to snapshot command (jkonecny)
  Related: rhbz#1113207
- Add new snapshot KS command (jkonecny)
  Related: rhbz#1113207


author: Chris Lumens <clumens@redhat.com> - 1.99.66.14-1
changelog:
- Add timeout and retries options to %packages section (#1482912) (vponcova)
- Add command hmc to support SE/HMC file access (#1498829) (vponcova)
- Add tests for method command (vponcova)
- Rewrite the method command. (vponcova)


author: Chris Lumens <clumens@redhat.com> - 1.99.66.15-1
changelog:
- Fix import in the mount command (vponcova)
  Related: rhbz#1450922
- Add a new 'mount' command (vpodzime)
  Related: rhbz#1450922


author: Chris Lumens <clumens@redhat.com> - 1.99.66.18-1
changelog:
- Add tests for the new firewall option. (clumens)
  Related: rhbz#1526486
- Use RHEL7_Firewall instead of F28_Firewall. (clumens)
  Related: rhbz#1526486
- Port the F20 firewall test from master. (clumens)
  Related: rhbz#1526486
- firewall: add --use-system-defaults arg to command (dusty)
  Resolves: rhbz#1526486


author: David Cantrell <dcantrell@redhat.com> - 1.99.66.19-1
changelog:
- Add use action to nvdimm command. (rvykydal)
  Resolves: rhbz#1590319
- Add nvdimm command (rvykydal)
  Resolves: rhbz#1590319


author: Petr Viktorin <pviktori@redhat.com> - 2.7.5-63
changelog:
- Make it more likely for the system allocator to release free()d memory arenas
Resolves: rhbz#1468410


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-65
changelog:
- Fix hanging of all threads when trying to access an inaccessible NFS server.
Resolves: rhbz#1520068


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-68
changelog:
- Add Conflicts tag with old virtualenv versions due to new behaviour of
  httplib (patch 295)
Resolves: rhbz#1483438


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-71
changelog:
- Limit the number of CPU cores when building the package on power architectures
Resolves: rhbz#1568974


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-72
changelog:
- Fix CVE-2018-1060 and CVE-2018-1061
Resolves: rhbz#1563454 and rhbz#1549192
- Provide python2-libs from the python-libs subpackage
Resolves: rhbz#1557460


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-74
changelog:
- Fix OSERROR 17 due to _multiprocessing/semaphore.c assuming
  a one-to-one Pid -> process mapping
Resolves: rhbz#1579432


author: David Lehman <dlehman@redhat.com> - 0.61.15.63-1
changelog:
- Use the uuid module instead of the uuidgen tool (vpodzime)
  Related: rhbz#1413942
- Respect thin pool's min size when setting its req_size (vpodzime)
  Resolves: rhbz#1449963
- Add RAID chunk size to the generated kickstart file (vtrefny)
  Resolves: rhbz#1447343


author: David Lehman <dlehman@redhat.com> - 0.61.15.64-1
changelog:
- Make sure an LV is deactivated before removal (vpodzime)
  Resolves: rhbz#1456821
- Make sure the device is setup before formatting it (bcl)
  Resolves: rhbz#1368986
- Round the recommended thpool metadata size to extents (vpodzime)
  Resolves: rhbz#1456528


author: David Lehman <dlehman@redhat.com> - 0.61.15.65-1
changelog:
- Autoset metadata size on percent-based thin pools (vpodzime)
  Resolves: rhbz#1463198
- Do not try to autoset MD size on a thin pool with no size (vpodzime)
  Related: rhbz#1463198


author: David Lehman <dlehman@redhat.com> - 0.61.15.66-1
changelog:
- mkfs.ext4 no longer hangs on confirmation (japokorn)
  Resolves: rhbz#1461459
- Stop enforcing obsolete limits on partition count. (dlehman)
  Resolves: rhbz#1460668
- Do not try to use protected disks for autopart (vtrefny)
  Resolves: rhbz#1456409


author: David Lehman <dlehman@redhat.com> - 0.61.15.67-1
changelog:
- fcoe: remove /etc/fcoe dir if it exists before copying configuration
  (rvykydal)
  Resolves: rhbz#1482512
- Find and remove stale LVM metadata immediately after creating md array.
  (dlehman)
  Resolves: rhbz#1223564
- Add ability to specify vg by uuid for vgremove. (dlehman)
  Related: rhbz#1223564


author: David Lehman <dlehman@redhat.com> - 0.61.15.68-1
changelog:
- Catch lvm metadata lookup failure in md post create. (dlehman)
  Related: rhbz#1223564
  Resolves: rhbz#1543579


author: David Lehman <dlehman@redhat.com> - 0.61.15.70-1
changelog:
- Deactivate incomplete VGs along with everything else. (dlehman)
  Resolves: rhbz#1554224
- Work around udev timing issues. (dlehman)
  Resolves: rhbz#1592253
  Resolves: rhbz#1592191
- nvdimm: don't crash on non-block devices (rvykydal)
  Related: rhbz#1280500
- Add NVDIMM detection to "addUdevDiskDevice" (vtrefny)
  Related: rhbz#1558942
- Add 'NVDIMMNamespaceDevice' device representing NVDIMM namespaces (vtrefny)
  Related: rhbz#1558942
- Add a function for identifying NVDIMM namespaces (vtrefny)
  Related: rhbz#1558942
- Add a singleton for NVDIMM namespaces management (vtrefny)
  Resolves: rhbz#1558942
- Backport DependencyGuard from master (vtrefny)
  Related: rhbz#1558942
- Ignore nvdimm devices unless configured in kickstart (rvykydal)
  Related: rhbz#1280500
- Do not ignore nvdimm (pmemX) devices (rvykydal)
  Related: rhbz#1280500


author: David Lehman <dlehman@redhat.com> - 0.61.15.71-1
changelog:
- Remove dependency on libblockdev-nvdimm (vtrefny)
  Resolves: rhbz#1601557
- Do not try to load NVDIMM plugin on non-x86_64 architectures (vtrefny)
  Related: rhbz#1601557
- Add version to the LUKS format (vtrefny)
  Resolves: rhbz#1607830


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.72-1
changelog:
- Install ndctl when NVDIMMs are used. (dlehman)
  Related: rhbz#1600496
- Escape dots in lvm filter devices (vtrefny)
  Resolves: rhbz#1614039


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.4.6-4
changelog:
- Append python-botocore and python-jmespath bundled directories to
  search path where needed

  Resolves: rhbz#1509439


author: Andy Grover <agrover@redhat.com> - 1:1.1.fb9-1
changelog:
- New upstream release
- Remove dependency on python-simpleparse in favor of pyparsing
- Remove BuildRequires


author: Maurizio Lombardi <mlombard@redhat.com> - 1:1.1.fb23-4
changelog:
- Fix failure when parsing parameters
- Add 0003-Fix-failing-to-pasre-par-val-parameters.patch
- Add 0004-Fix-failing-to-pasre-param-like-cfgstr-par-val.patch


author: Pavel Cahyna <pcahyna@redhat.com> - 2.1.1-3
changelog:
- Fix a security flaw (CVE-2018-7750) in Paramiko's server
  mode (emphasis on **server** mode; this does **not** impact *client* use!)
  Backported from 2.1.5.
  Resolves #1557142


author: Pavel Cahyna <pcahyna@redhat.com> - 2.1.1-4
changelog:
- Add a dependency on python2-pyasn1. It used to be a dependency
  of python2-cryptography, but it is not the case with newer versions.
  (RHBZ #1559133)


author: Jake Hunsaker <jhunsake@redhat.com> - 2.1.1-9
changelog:
- Fix a security flaw (CVE-2018-1000805) in Paramiko's server
  mode (does not effect client mode).
  Backported from 2.1.6
  Resolves rhbz#1637366


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb63-5
changelog:
- rtslib never creates hba directories without a storage object within it,
  but if under some circumstance these existed then we should remove them.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.6-9
changelog:
- Python 2 binary package renamed to python2-subprocess32
  See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-2.el7
changelog:
- synchronized with qemu-kvm-rhev-2.3.0-9.el7
- qemuga-Change-fsreeze-hook-default-location.patch [bz#1210707]
- qemuga-qga-commands-posix-Fix-bug-in-guest-fstrim.patch [bz#1211973]
- Resolves: bz#1210707
  (The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)
- Resolves: bz#1211973
  ('guest-fstrim' failed for guest with os on spapr-vscsi disk)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.3.0-3.el7
changelog:
- qemuga-Do-not-stop-qemu-guest-agent-service-on-target-switc.patch [bz#1160930]
- Resolves: bz#1160930
  (The guest agent service in rhel7 guest will be stopped after run the init command)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-2.el7
changelog:
- qemuga-redhat-blacklist-guest-exec-commands.patch [bz#1340346]
- Resolves: bz#1340346
  (blacklist guest-exec in newer version of qemu-guest-agent)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.5.0-3.el7
changelog:
- qemuga-spec-add-qemu-ga-man-page.patch [bz#1101556]
- Resolves: bz#1101556
  ([RFE] qemu-ga should have a config file)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.8.0-1.el7
changelog:
- Rebase to 2.8.0 base [bz#1414676]
- Resolves: bz#1414676
  (Rebase qemu-guest-agent to 2.8.0 base)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.8.0-2.el7
changelog:
- qemuga-Remove-unnecessary-dependencies.patch [bz#1441999]
- Resolves: bz#1441999
  (Clean qemu-ga dependencies)


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 2.8.0-3.el7
changelog:
- qemuga-qga-Add-guest-get-host-name-command.patch [bz#1598210]
- qemuga-qga-Add-guest-get-users-command.patch [bz#1598210]
- qemuga-qga-Add-guest-get-timezone-command.patch [bz#1598210]
- qemuga-qemu-ga-check-if-utmpx.h-is-available-on-the-system.patch [bz#1598210]
- qemuga-qemu-ga-add-guest-get-osinfo-command.patch [bz#1598210]
- qemuga-test-qga-pass-environemnt-to-qemu-ga.patch [bz#1598210]
- qemuga-test-qga-add-test-for-guest-get-osinfo.patch [bz#1598210]
- Resolves: bz#1598210
  (Backport some features to 2.8 in RHEL 7.5 [rhel-7.5.z])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 2.8.0-2.el7_5.1
changelog:
- Corrected the package version from 2.8.0-3.el7 to 2.8.0-2.el7_5.1
- Resolves: bz#1598210
  (Backport some features to 2.8 in RHEL 7.5 [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-148.el7
changelog:
- kvm-multiboot-validate-multiboot-header-address-values.patch [bz#1501121]
- kvm-qemu-option-reject-empty-number-value.patch [bz#1417864]
- Resolves: bz#1417864
  (Qemu-kvm starts with unspecified port)
- Resolves: bz#1501121
  (CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-149.el7
changelog:
- kvm-block-linux-aio-fix-memory-and-fd-leak.patch [bz#1491434]
- kvm-linux-aio-Fix-laio-resource-leak.patch [bz#1491434]
- kvm-slirp-cleanup-leftovers-from-misc.h.patch [bz#1508745]
- kvm-Avoid-embedding-struct-mbuf-in-other-structures.patch [bz#1508745]
- kvm-slirp-Fix-access-to-freed-memory.patch [bz#1508745]
- kvm-slirp-fix-clearing-ifq_so-from-pending-packets.patch [bz#1508745]
- kvm-qcow2-Prevent-backing-file-names-longer-than-1023.patch [bz#1459714]
- kvm-qemu-img-Use-strerror-for-generic-resize-error.patch [bz#1459725]
- kvm-qcow2-Avoid-making-the-L1-table-too-big.patch [bz#1459725]
- Resolves: bz#1459714
  (Throw error if qemu-img rebasing backing file is too long or provide way to fix a "too long" backing file.)
- Resolves: bz#1459725
  (Prevent qemu-img resize from causing "Active L1 table too large")
- Resolves: bz#1491434
  (KVM leaks file descriptors when attaching and detaching virtio-scsi block devices)
- Resolves: bz#1508745
  (CVE-2017-13711 qemu-kvm: Qemu: Slirp: use-after-free when sending response [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-150.el7
changelog:
- kvm-Build-only-x86_64-packages.patch [bz#1520793]
- Resolves: bz#1520793
  (Do not build non-x86_64 subpackages)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-151.el7
changelog:
- kvm-fw_cfg-remove-support-for-guest-side-data-writes.patch [bz#1411490]
- kvm-fw_cfg-prevent-selector-key-conflict.patch [bz#1411490]
- kvm-fw_cfg-prohibit-insertion-of-duplicate-fw_cfg-file-n.patch [bz#1411490]
- kvm-fw_cfg-factor-out-initialization-of-FW_CFG_ID-rev.-n.patch [bz#1411490]
- kvm-Implement-fw_cfg-DMA-interface.patch [bz#1411490]
- kvm-fw_cfg-avoid-calculating-invalid-current-entry-point.patch [bz#1411490]
- kvm-fw-cfg-support-writeable-blobs.patch [bz#1411490]
- kvm-Enable-fw_cfg-DMA-interface-for-x86.patch [bz#1411490]
- kvm-fw_cfg-unbreak-migration-compatibility.patch [bz#1411490]
- kvm-i386-expose-fw_cfg-QEMU0002-in-SSDT.patch [bz#1411490]
- kvm-fw_cfg-add-write-callback.patch [bz#1411490]
- kvm-hw-misc-add-vmcoreinfo-device.patch [bz#1411490]
- kvm-vmcoreinfo-put-it-in-the-misc-device-category.patch [bz#1411490]
- kvm-fw_cfg-enable-DMA-if-device-vmcoreinfo.patch [bz#1411490]
- kvm-build-sys-restrict-vmcoreinfo-to-fw_cfg-dma-capable-.patch [bz#1411490]
- kvm-dump-Make-DumpState-and-endian-conversion-routines-a.patch [bz#1411490]
- kvm-dump.c-Fix-memory-leak-issue-in-cleanup-processing-f.patch [bz#1411490]
- kvm-dump-Propagate-errors-into-qmp_dump_guest_memory.patch [bz#1411490]
- kvm-dump-Turn-some-functions-to-void-to-make-code-cleane.patch [bz#1411490]
- kvm-dump-Fix-dump-guest-memory-termination-and-use-after.patch [bz#1411490]
- kvm-dump-allow-target-to-set-the-page-size.patch [bz#1411490]
- kvm-dump-allow-target-to-set-the-physical-base.patch [bz#1411490]
- kvm-dump-guest-memory-cleanup-removing-dump_-error-clean.patch [bz#1411490]
- kvm-dump-guest-memory-using-static-DumpState-add-DumpSta.patch [bz#1411490]
- kvm-dump-guest-memory-add-dump_in_progress-helper-functi.patch [bz#1411490]
- kvm-dump-guest-memory-introduce-dump_process-helper-func.patch [bz#1411490]
- kvm-dump-guest-memory-disable-dump-when-in-INMIGRATE-sta.patch [bz#1411490]
- kvm-DumpState-adding-total_size-and-written_size-fields.patch [bz#1411490]
- kvm-dump-do-not-dump-non-existent-guest-memory.patch [bz#1411490]
- kvm-dump-add-guest-ELF-note.patch [bz#1411490]
- kvm-dump-update-phys_base-header-field-based-on-VMCOREIN.patch [bz#1411490]
- kvm-kdump-set-vmcoreinfo-location.patch [bz#1411490]
- kvm-scripts-dump-guest-memory.py-Move-constants-to-the-t.patch [bz#1411490]
- kvm-scripts-dump-guest-memory.py-Make-methods-functions.patch [bz#1411490]
- kvm-scripts-dump-guest-memory.py-Improve-python-3-compat.patch [bz#1411490]
- kvm-scripts-dump-guest-memory.py-Cleanup-functions.patch [bz#1411490]
- kvm-scripts-dump-guest-memory.py-Introduce-multi-arch-su.patch [bz#1411490]
- kvm-Fix-typo-in-variable-name-found-and-fixed-by-codespe.patch [bz#1411490]
- kvm-scripts-dump-guest-memory.py-add-vmcoreinfo.patch [bz#1411490]
- kvm-dump-guest-memory.py-fix-No-symbol-vmcoreinfo_find.patch [bz#1411490]
- kvm-dump-guest-memory.py-fix-You-can-t-do-that-without-a.patch [bz#1411490]
- Resolves: bz#1411490
  ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-152.el7
changelog:
- kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [CVE-2017-5715]
- kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [CVE-2017-5715]
- kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [CVE-2017-5715]


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-153.el7
changelog:
- kvm-i386-update-ssdt-misc.hex.generated.patch [bz#1411490]
- kvm-main-loop-Acquire-main_context-lock-around-os_host_m.patch [bz#1435432 bz#1473536]
- Resolves: bz#1411490
  ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))
- Resolves: bz#1435432
  (Emulated ISA serial port hangs randomly when sending lots of data from guest -> host)
- Resolves: bz#1473536
  (Hangs in serial console under qemu)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-154.el7
changelog:
- kvm-virtio-net-validate-backend-queue-numbers-against-bu.patch [bz#1460872]
- kvm-dump-guest-memory.py-fix-python-2-support.patch [bz#1411490]
- kvm-qxl-add-migration-blocker-to-avoid-pre-save-assert.patch [bz#1536883]
- Resolves: bz#1411490
  ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))
- Resolves: bz#1460872
  (Aborted(core dumped) when booting guest with "-netdev tap....vhost=on,queues=32")
- Resolves: bz#1536883
  ([abrt] [faf] qemu-kvm: unknown function(): /usr/libexec/qemu-kvm killed by 6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-155.el7
changelog:
- kvm-qdev-Fix-assert-in-PCI-address-property-when-used-by.patch [bz#1538866]
- kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534691]
- kvm-savevm-Improve-error-message-for-blocked-migration.patch [bz#1536883]
- kvm-savevm-fail-if-migration-blockers-are-present.patch [bz#1536883]
- Resolves: bz#1534691
  (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-7.5])
- Resolves: bz#1536883
  ([abrt] [faf] qemu-kvm: unknown function(): /usr/libexec/qemu-kvm killed by 6)
- Resolves: bz#1538866
  (qemu will coredump after executing info qtree)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7
changelog:
- kvm-vnc-Fix-qemu-crashed-when-vnc-client-disconnect-sudd.patch [bz#1527405]
- kvm-fix-full-frame-updates-for-VNC-clients.patch [bz#1527405]
- kvm-vnc-update-fix.patch [bz#1527405]
- kvm-vnc-return-directly-if-no-vnc-client-connected.patch [bz#1527405]
- kvm-buffer-add-buffer_move_empty.patch [bz#1527405]
- kvm-buffer-add-buffer_move.patch [bz#1527405]
- kvm-vnc-kill-jobs-queue-buffer.patch [bz#1527405]
- kvm-vnc-jobs-move-buffer-reset-use-new-buffer-move.patch [bz#1527405]
- kvm-vnc-zap-dead-code.patch [bz#1527405]
- kvm-vnc-add-vnc_width-vnc_height-helpers.patch [bz#1527405]
- kvm-vnc-factor-out-vnc_update_server_surface.patch [bz#1527405]
- kvm-vnc-use-vnc_-width-height-in-vnc_set_area_dirty.patch [bz#1527405]
- kvm-vnc-only-alloc-server-surface-with-clients-connected.patch [bz#1527405]
- kvm-ui-fix-refresh-of-VNC-server-surface.patch [bz#1527405]
- kvm-ui-move-disconnecting-check-to-start-of-vnc_update_c.patch [bz#1527405]
- kvm-ui-remove-redundant-indentation-in-vnc_client_update.patch [bz#1527405]
- kvm-ui-avoid-pointless-VNC-updates-if-framebuffer-isn-t-.patch [bz#1527405]
- kvm-ui-track-how-much-decoded-data-we-consumed-when-doin.patch [bz#1527405]
- kvm-ui-introduce-enum-to-track-VNC-client-framebuffer-up.patch [bz#1527405]
- kvm-ui-correctly-reset-framebuffer-update-state-after-pr.patch [bz#1527405]
- kvm-ui-refactor-code-for-determining-if-an-update-should.patch [bz#1527405]
- kvm-ui-fix-VNC-client-throttling-when-audio-capture-is-a.patch [bz#1527405]
- kvm-ui-fix-VNC-client-throttling-when-forced-update-is-r.patch [bz#1527405]
- kvm-ui-place-a-hard-cap-on-VNC-server-output-buffer-size.patch [bz#1527405]
- kvm-ui-avoid-sign-extension-using-client-width-height.patch [bz#1527405]
- kvm-ui-correctly-advance-output-buffer-when-writing-SASL.patch [bz#1527405]
- kvm-io-skip-updates-to-client-if-websocket-output-buffer.patch [bz#1518711]
- Resolves: bz#1518711
  (CVE-2017-15268 qemu-kvm: Qemu: I/O: potential memory exhaustion via websock connection to VNC [rhel-7.5])
- Resolves: bz#1527405
  (CVE-2017-15124 qemu-kvm: Qemu: memory exhaustion through framebuffer update request message in VNC server [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.1
changelog:
- kvm-vga-add-ram_addr_t-cast.patch [bz#1567913]
- kvm-vga-fix-region-calculation.patch [bz#1567913]
- Resolves: bz#1567913
  (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-7] [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.2
changelog:
- kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574075]
- Resolves: bz#1574075
  (EMBARGOED CVE-2018-3639 qemu-kvm: Kernel: omega-4 [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.3
changelog:
- kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch [bz#1584363]
- kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch [bz#1584363]
- Resolves: bz#1584363
  (CVE-2018-3639 qemu-kvm: hw: cpu: AMD: speculative store bypass [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.4
changelog:
- kvm-target-i386-introduce-kvm_put_one_msr.patch [bz#1596302]
- kvm-apic-fix-2.2-2.1-migration.patch [bz#1596302]
- kvm-x86-lapic-Load-LAPIC-state-at-post_load.patch [bz#1596302]
- kvm-apic-drop-debugging.patch [bz#1596302]
- kvm-apic-set-APIC-base-as-part-of-kvm_apic_put.patch [bz#1596302]
- Resolves: bz#1596302
  (Windows 2012 Guest hangs after live migration with RTC clock stopped. [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.5
changelog:
- kvm-multiboot-bss_end_addr-can-be-zero.patch [bz#1549824]
- kvm-multiboot-Remove-unused-variables-from-multiboot.c.patch [bz#1549824]
- kvm-multiboot-Use-header-names-when-displaying-fields.patch [bz#1549824]
- kvm-multiboot-fprintf-stderr.-error_report.patch [bz#1549824]
- kvm-multiboot-Reject-kernels-exceeding-the-address-space.patch [bz#1549824]
- kvm-multiboot-Check-validity-of-mh_header_addr.patch [bz#1549824]
- kvm-slirp-remove-mbuf-m_hdr-m_dat-indirection.patch [bz#1586248]
- kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586248]
- Resolves: bz#1549824
  (CVE-2018-7550 qemu-kvm: Qemu: i386:  multiboot OOB access while loading kernel image [rhel-7.5.z])
- Resolves: bz#1586248
  (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.5.z])


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-5
changelog:
- cd to the correct directory before md5sum to fix BACKUP_INTEGRITY_CHECK.
  Upstream PR#1685, bz1532676


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-6
changelog:
- Ensure that NetBackup is started automatically upon recovery (PR#1544)
  Also do not kill daemons spawned by sysinit.service at the service's end
  (PR#1610, applies to NetBackup and also to dhclient)
  Resolves #1506231
- Print a warning if grub2-mkimage is about to fail and suggest what to do.
  bz#1492177
- Update the patch for #1388653 to the one actually merged upstream (PR1418)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-7
changelog:
- Backport upstream PR1383: Allow backup to be stored in ISO for ppc64/ppc64le
  Includes also commit 30099a98fdc1eab6373bc3682929bc4b9c09b54b.
  Resolves: #1596182


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-3
changelog:
- gcp-vpc-move-vip: new resource agent for Google Cloud
- vdo-vol: new resource agent
- LVM-activate: fix issue with dashes
- dont use attribute_target for metadata

  Resolves: rhbz#1568588
  Resolves: rhbz#1538689
  Resolves: rhbz#1513957
  Resolves: rhbz#1602783


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-8
changelog:
- lvmlockd: add cmirrord support
- LVM-activate: warn about incorrect vg_access_mode

  Resolves: rhbz#1606316
  Resolves: rhbz#1619428


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-10
changelog:
- aws-vpc-move-ip: avoid false positive monitor result on initial probe
- timeout/interval add "s"-suffix

  Resolves: rhbz#1624741
  Resolves: rhbz#1523318


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-12.5
changelog:
- rabbitmq-cluster: get cluster status from mnesia during monitor
- rabbitmq-cluster: fail monitor when node is in minority partition

  Resolves: rhbz#1641944
  Resolves: rhbz#1641946


author: Christopher Snyder <csnyder@redhat.com> 1.21.5-1
changelog:
- Fix python-rhsm Provides and Obsoletes (csnyder@redhat.com)
- 1568609: Updated man page for --after list option (aparadka@redhat.com)
- Get Initial Setup Addon to run during installation in Vagrant
  (jhnidek@redhat.com)
- ENT-447 Create .desktop file that opens web page with our cockpit plugin
  (jhnidek@redhat.com)
- ENT-481 service-level command & options now update syspurpose metadata
  (nmoumoul@redhat.com)
- 1560727: Search for proxy auth message in whole error string
  (aria.paradkar@gmail.com)
- 1555384: get_libexecdir now returns a string instead of bytes
  (aria.paradkar@gmail.com)
- Added generic set/unset and add/remove commands to syspurpose
  (crog@redhat.com)
- ENT-488 syspurpose now warns if running in container (nmoumoul@redhat.com)
- 1574706: Create python2-subscription-manager-rhsm properly
  (jhnidek@redhat.com)
- Automatic rebuilding of updates.img on PXE Server (jhnidek@redhat.com)
- 1574529: Fix rhsmcertd integer overflow on i386 & i686 (csnyder@redhat.com)
- Respecting proxy port configured in rhsm.conf (oskar@wycislak.pl)


author: Christopher Snyder <csnyder@redhat.com> 1.22.1-1
changelog:
- 1571998: Ignore HTB repos (nmoumoul@redhat.com)
- 1589296: subman list option --after now named --afterdate
  (aparadka@redhat.com)
- 1558411: Begin building dnf-plugin-subscription-manager for RHEL 7
  (csnyder@redhat.com)
- Use constant defined in cerdirectory.py. (jhnidek@redhat.com)
- 1553266: When d-bus methods are unavailable, show appropriate message. *
  Added a "safe call" mechanism that makes the initial dbus calls
  (entitlementService, configService, productsService) only if the service is
  available, tries to restart the rhsm service if possible, and otherwise
  failing gracefully. * Added new UI curtain that provides a meaningful message
  and advice to the end user. * Re-added utility method statusUpdateFailed that
  was accidentally deleted. (nmoumoul@redhat.com)
- 1580996: Fix comparision of objects in Python 3 (ENT-578)
  (jhnidek@redhat.com)
- Make xauth Idempotent again (csnyder@redhat.com)
- Fixes missing locale issues while running nosetests (csnyder@redhat.com)
- Remove freezegun (khowell@redhat.com)
- 1576582: Make rhsm.full_fresh_on_yum=1 working again (ENT-534)
  (jhnidek@redhat.com)
- ansible-fix: fixed ansible failing during vagrant up (aparadka@redhat.com)
- Update the license of the subman-cockpit-plugin to GPLv2 (csnyder@redhat.com)
- 1510920: Allow access to job cancellation API (wpoteat@redhat.com)
- ENT-447 Add icons to RPM package for subman cockpit plugin
  (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.23.1-1
changelog:
- Integrate Syspurpose DBus Signal with Cockpit (aparadka@redhat.com)
- Change usage_type to usage (csnyder@redhat.com)
- ENT-715 Sync syspurpose with server (csnyder@redhat.com)
- 1609052: DNF Plugin needs config initiated earlier (wpoteat@redhat.com)
- 1608963: Minimize packaging for python 3 (wpoteat@redhat.com)
- Improve test setup for syspurpose tests. (awood@redhat.com)
- Two simple fixes for syspurpose (jhnidek@redhat.com)
- Raise ioerr when necessary during sp read (csnyder@redhat.com)
- ENT-720 Adds the addons subcommand (csnyder@redhat.com)
- 1602056: Added role subcommand ENT-719 (jhnidek@redhat.com)
- Replace lsb-release in spec and Makefile (khowell@redhat.com)
- Mock out syspurpose code from being executed in subman tests
  (csnyder@redhat.com)
- ENT-584 syspurpose UTF-8 support & better formatting - All syspurpose
  operations now support UTF-8 - syspurpose.json now has user-friendly
  indentation (nmoumoul@redhat.com)
- ENT-446 Report systempurpose on registration (csnyder@redhat.com)
- 1512944: Fix up remaining python2 deps ENT-724 (csnyder@redhat.com)
- ENT-721: Usage command (wpoteat@redhat.com)
- ENT-590 Enhanced SyspurposeStore add/remove operations - 'add' will now not
  override an existing value that was added by the 'set' command, but it will
  be maintained and added in a list along with the newly added value. - 'add'
  will now not add an element to a list if the list already contains it (no
  duplicates). - 'remove' will now unset the current value, if that turns out
  to be scalar instead of being contained in a list. (nmoumoul@redhat.com)
- Move syspurpose out of packages directory. (awood@redhat.com)
- Correct small problems in syspurpose. (awood@redhat.com)
- ansible vagrant QOL fixes (khowell@redhat.com)
- ENT-723: Add System Purpose Status to System Status output
  (wpoteat@redhat.com)
- Improve debug logging for release listing (khowell@redhat.com)
- Remove other references to python-kitchen. (awood@redhat.com)
- Make build_ext a proper dependency. (awood@redhat.com)
- Add zanata.xml configuration file and gettext keys.pot (awood@redhat.com)
- Move clean command to common build_ext module. (awood@redhat.com)
- Only gather optparse strings in subscription-manager. (awood@redhat.com)
- Move syspurpose source files to be under package directory.
  (awood@redhat.com)
- Look for source files based on package directory locations.
  (awood@redhat.com)
- Add gettext calls to syspurpose. (awood@redhat.com)
- Load build_ext i18n commands in setup.py (awood@redhat.com)
- Integrate Dbus signals with Cockpit GUI (aparadka@redhat.com)
- Do not install subman-gui from setup.py by default (khowell@redhat.com)
- ENT-591 Handle when syspurpose.json is missing & create it.
  (nmoumoul@redhat.com)
- Fix indeterminate unit test failure. (awood@redhat.com)
- Removal of python-kitchen (wpoteat@redhat.com)
- ENT-731 Replaced syspurpose 'offerings' commands with 'role': - Removed
  commands 'add-offerings', 'remove-offerings', 'unset-offerings' - Added
  commands 'set-role' and 'unset-role' (nmoumoul@redhat.com)
- ENT-589 Intentctl -> syspurpose (csnyder@redhat.com)
- ENT-710: Add three_way_merge utility function (csnyder@redhat.com)
- ENT-477: Add signal EntitlementsChanged (aparadka@redhat.com)
- ENT-476: Add signal InstalledProductsChanged (aparadka@redhat.com)
- 1594733: Fix GetStatus in com.redhat.RHSM1.Entitlement ENT-641
  (jhnidek@redhat.com)
- Make vagrant setup more flexible (khowell@redhat.com)
- ENT-475: Add signal ConfigChanged (aparadka@redhat.com)
- 1581777: Reraise exception properly. ENT-566 (jhnidek@redhat.com)
- Replace curly quote with straight quote (khowell@redhat.com)
- Add implementation of filesystem watcher (aparadka@redhat.com)
- 1581410: ENT-572: subman should require dnf-plugin-subscription-manager
  (adarshvritant@gmail.com)
- ENT-478 com.redhat.RHSM1.Consumer D-Bus service object (jhnidek@redhat.com)
- 1576423: Polished changes provided in #1816 and added unit test.
  (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.23.3-1
changelog:
- 1606435: Rename the async module for compatibility with python 3.7; ENT-737
  (csnyder@redhat.com)
- Cockpit/Syspurpose service integration fix (aparadka@redhat.com)
- Display both new and old value in syspurpose diff message
  (csnyder@redhat.com)
- Fix sending single value of addons. (jhnidek@redhat.com)
- Fix synchronization of usage with candlepin (jhnidek@redhat.com)
- 1596294: Fix displayin RHSM Spoke in Initial Setup (jhnidek@redhat.com)
- Syspurpose field value lists [ENT-766] (wpoteat@redhat.com)
- ENT-717: Syncing of syspurpose store with candlepin (jhnidek@redhat.com)
- 1609048: Replacement of imp module with importlib; ENT-758
  (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.21.10-1
changelog:
- Updated translations (csnyder@redhat.com)
- 1623262: Make automatic enablement of yum plugins working again; ENT-820
  (jhnidek@redhat.com)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: subscription-manager_spec-dont-run-rhsm.patch
-->  Since we don't provide rhsm, don't bother running it
- Added Source: subscription-manager.ini
-->  Config file for automated patch script


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-8
changelog:
RHEL 7.4 ERRATUM
- added dependency automake autoconf libtool due to yum-builddep
- reenable omruleset module
  resolves: rhbz#1431615
  resolves: rhbz#1428403
  resolves: rhbz#1427821(fix regression, failed QA)
  resolves: rhbz#1432069
- resolves: rhbz#1165236
  resolves: rhbz#1419228
  resolves: rhbz#1431616 
  resolves: rhbz#1196230(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-9
changelog:
RHEL 7.4 ERRATUM
- added autoreconf call
- added patch to replace gethostbyname with getaddrinfo call
  resolves: rhbz#1056548(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-10
changelog:
RHEL 7.4 ERRATUM
- edited patches Patch19 and Patch21
  resolves: rhbz#1419228(coverity scan problems)
  resolves: rhbz#1056548(failed QA, coverity scan problems)


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-11
changelog:
RHEL 7.4 ERRATUM
- added new patch that backports num2ipv4 due to rhbz#1427821
  resolves: rhbz#1427821
- enable pmrfc3164sd module
  resolves: rhbz#1431616


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-13
changelog:
RHEL 7.5 ERRATUM
- added patch to properly resolve FQDN
  resolves: rhbz#1401456
- added documentation patch correcting qeues default values
  resolves: rhbz#1459896
- added patch adjusting log level of journal reloaded msg
  resolves: rhbz#1497985 
- added patch to prevent crash with invalid set statement
  this also obsoletes patch2 (for 1188503) 
  resolves: rhbz#1462160
- added patch with nullptr check to prevent ABRT
  resolves: rhbz#1488186


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-14
changelog:
RHEL 7.5 ERRATUM
- renamed patch for undocumented recover_qi script to correct bz number
  resolves: rhbz#1507028
- added patch ensuring relp conneciton is active before closing it
  resolves: rhbz#1505103


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-15
changelog:
RHEL 7.5 ERRATUM
- made rsyslog-doc noarch and fixed search on doc regeneration
  resolves: rhbz#1507028


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16
changelog:
RHEL 7.5 ERRATUM
- edited the patch to conform to latest upstream doc
  resolves: rhbz#1459896 (failedQA)
- disabled 32-bit builds on all arches as they are not shipped
  anymore in RHEL7


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16.5
changelog:
RHEL 7.5.z ERRATUM
- fixed imjournal duplicating msgs under some conditions
  resolves: rhbz#1545582


author: Pavel Valena <pvalena@redhat.com> - 2.0.0.648-26
changelog:
- Rebase to Ruby 2.0.0-p648
  Resolves: rhbz#1197720, rhbz#1298282, rhbz#1258863
  * Remove Patch18: ruby-2.0.0-p247-Revert-mkmf.rb-prefix-install_dirs-only-
      with-DESTDIR.patch; subsumed
  * Remove Patch23: ruby-openssl-wrap-cipher-fix.patch; subsumed
  * Remove Patch25: ruby-2.0.0-p607-DNS-Resolv-fall-back-if-canonicalization-
      fails.patch; subsumed
- Remove tests depending on europe/moscow to avoid failures due to tzdata change
  https://github.com/eggert/tz/commit/8ee11a301cf173afb0c76e0315b9f9ec8ebb9d95
- Add checks for systemtap, abrt hook and rubygems version
- Fix significant hash table performance slowdown on ppc64le
  Resolves: rhbz#1163032
- Support in no_proxy for domain names with whitespaces and leading dots
  Resolves: rhbz#1300433


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-30
changelog:
- Fix test_npn_protocol_selection_ary and test_npn_protocol_selection_enum
  failures with newest openssl.
  Resolves: rhbz#1416123
- Add gemspec_add_dep and gemspec_remove_dep macros.
- Extend 'gem_' macros for pre-release version support.
  Resolves: rhbz#1397390
- Make symlinks for json gem.
  Resolves: rhbz#1308992


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
- Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
  * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
      -vulnerability.patch
  Resolves: CVE-2017-0903
- Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
  Resolves: CVE-2017-0899
- Fix a DOS vulernerability in the query command (CVE-2017-0900).
  Resolves: CVE-2017-0900
- Fix a vulnerability in the gem installer that allowed a malicious gem
    to overwrite arbitrary files (CVE-2017-0901).
  Resolves: CVE-2017-0901
- Fix a DNS request hijacking vulnerability (CVE-2017-0902).
  * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
  Resolves: CVE-2017-0902
- Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
  * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
  Resolves: CVE-2017-0898
- Escape sequence injection vulnerability in the Basic
    authentication of WEBrick (CVE-2017-10784).
  * ruby-2.2.8-sanitize-any-type-of-logs.patch
  Resolves: CVE-2017-10784
- Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
  * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
  Resolves: CVE-2017-14064
- Command injection vulnerability in Net::FTP (CVE-2017-17405).
  * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
  Resolves: CVE-2017-17405
- Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
  * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
  Resolves: CVE-2017-14033
- Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
    execution(CVE-2017-17790).
  * ruby-2.5.0-Fixed-command-Injection.patch
  Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
- Add Psych.safe_load
  * ruby-2.1.0-there-should-be-only-one-exception.patch
  * ruby-2.1.0-Adding-Psych.safe_load.patch
  Related: CVE-2017-0903
- Disable Tokyo TZ tests broken by recen tzdata update.
  * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
  Related: CVE-2017-0903


author: Matěj Týč <matyc@redhat.com> - 0.1.36-5
changelog:
- Patched not to check library ownership in libexec.
- Patched to fix title of DISA STIG profile.
- Patched to deprecate RhostsRSAAuthentication.
- Patched to fix umask_for_daemons.


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-7
changelog:
- Fix sshd_required unset (RHBZ#1522956)
- Fix missing bash remediation functions include (RHBZ#1524738)
- Fix empty columns in SRG HTML Table (RHBZ#1531105)
- Fix reference to oudated PAM config manual (RHBZ#1447760)


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-8
changelog:
- Allow AIDE to notify other emails than only root (RHBZ#1571315)
- Fix some failing rules from profiles PCI-DSS, DISA STIG and USGCB (RHBZ#1571312)
- Fix kernel module loading rules (RHBZ#1571319)


author: Matěj Týč <matyc@redhat.com> - 0.1.36-10
changelog:
- Fix local/d typos in Ansible remediation (RHBZ#1592887)
- Fix Ansible remediation of SELinux policies (RHBZ#1592970)
- Fix Ansible remediation of login.defs umask (RHBZ#1592957)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: scap-security-guide_spec-add-all-el-stigs.patch
-->  Package all EL scap guidelines, not just TUV
- Added Source: scap-security-guide.ini
-->  Config file for automated patch script
- Added Patch: 0003-remove-TUV-ID.patch
-->  Debrand text notes too


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
- Added Source: scap-security-guide.ini
-->  Config file for automated patch script
- Added Patch: 0003-remove-TUV-ID.patch
-->  Debrand text notes too


author: Rui Matos <rmatos@redhat.com> - 3.8.0-5
changelog:
- Fix for "seahorse-nautilus broken by glib2 regression related to
  SIGCHLD warnings"
- Resolves: #1093123


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-186
changelog:
- Allow virt_domains to acces infiniband pkeys.
Resolves: rhbz#1533183
- Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t
Resolves: rhbz#1535133
- Allow audisp_remote_t domain write to files on all levels
Resolves: rhbz#1534924


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-187
changelog:
- Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets
Resolves: rhbz#1535196
- Add new interface ppp_filetrans_named_content()
Resolves: rhbz#1530601
- Allow keepalived_t read sysctl_net_t files
Resolves: rhbz#1477542
- Allow puppetmaster_t domtran to puppetagent_t
Resolves: rhbz#1376893
- Allow kdump_t domain to read kernel ring buffer
Resolves: rhbz#1540004
- Allow ipsec_t domain to exec ifconfig_exec_t binaries.
Resolves: rhbz#1539416
- Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock
Resolves: rhbz#1530601
- Allow updpwd_t domain to create files in /etc with shadow_t label
Resolves: rhbz#1412838
- Allow iptables sysctl load list support with SELinux enforced
Resolves: rhbz#1535572


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-188
changelog:
- Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t
Resolves: rhbz#1540702
- Allow keepalived_t domain getattr proc filesystem
Resolves: rhbz#1477542
- Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t
Resolves: rhbz#1538544
- Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t
Resolves: rhbz:#1539416
- Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t
Resolves: rhbz#1479350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-189
changelog:
- Allow dirsrv_t domain to create tmp link files
Resolves: rhbz#1536011
- Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t
Resolves: rhbz#1428568
- Allow ipsec_mgmt_t execute ifconfig_exec_t binaries
- Allow ipsec_mgmt_t nnp domain transition to ifconfig_t
Resolves: rhbz#1539416


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-190
changelog:
- Allow openvswitch domain to manage svirt_tmp_t sock files
Resolves: rhbz#1540702
- Fix broken systemd_tmpfiles_run() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-192
changelog:
- Label /usr/libexec/dbus-1/dbus-daemon-launch-helper  as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled.
Resolves: rhbz#1546721


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-220
changelog:
- Allow nagios_script_t domain to mmap nagios_log_t files
Resolves: rhbz#1620013
- Allow nagios_script_t domain to mmap nagios_spool_t files
Resolves: rhbz#1620013
- Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctl
Resolves: rhbz#1622197
- Update selinux_validate_context() interface to allow caller domain to mmap security_t files
Resolves: rhbz#1622061


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-221
changelog:
- Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket
- Allow httpd_t domain to mmap tmp files
Resolves: rhbz#1608355
- Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files
- Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks
- Label /dev/tpmrm[0-9]* as tpm_device_t
- Allow semanage_t domain mmap usr_t files
Resolves: rhbz#1622607
- Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-223
changelog:
- Make working SELinux sandbox with Wayland.
Resolves: rhbz#1624308
- Allow svirt_t domain to mmap svirt_image_t block files
Resolves: rhbz#1624224
- Add caps dac_read_search and dav_override to pesign_t domain
- Allow iscsid_t domain to mmap userio chr files
Resolves: rhbz#1623589
- Add boolean: domain_can_mmap_files.
Resolves: rhbz#1460322
- Add execute_no_trans permission to mmap_exec_file_perms pattern
- Allow sudodomain to search caller domain proc info
- Allow xdm_t domain to mmap and read cert_t files
- Replace optional policy blocks to make dbus interfaces effective
Resolves: rhbz#1624414
- Add interface dev_map_userio_dev()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-224
changelog:
- Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs.
Resolves: rhbz#1625678
- Allow chronyd_t domain to read virt_var_lib_t files
- Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333)
Resolves: rhbz#1625613
- Allow tomcat services create link file in /tmp
Resolves: rhbz#1624289
- Add boolean: domain_can_mmap_files.
Resolves: rhbz#1460322


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-225
changelog:
- Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs
Resolves: rhbz#1627114
- Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t
Resolves: rhbz#1567753


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-226
changelog:
- Allow tomcat servers to manage usr_t files
Resolves: rhbz#1625678
- Dontaudit tomcat serves to append to /dev/random device
Resolves: rhbz#1625678
- Allow sys_nice capability to mysqld_t domain
- Allow dirsrvadmin_script_t domain to read httpd tmp files
Resolves: rhbz#1622602
- Allow syslogd_t domain to manage cert_t files
Resolves: rhbz#1615995


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-227
changelog:
- Add interface apache_read_tmp_dirs()
- Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs
Resolves: rhbz#1622602


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-228
changelog:
- Allow tomcat_domain to read /dev/random
Resolves: rhbz#1631666
- Allow neutron_t domain to use pam
Resolves: rhbz#1630318


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.3
changelog:
- Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t
Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.4
changelog:
- Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging'
Resolves: rhbz#1638427


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.5
changelog:
- Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module
Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.6
changelog:
- Allow nova_t domain to use pam
Resolves: rhbz:#1645270
- sysstat: grant sysstat_t the search_dir_perms set
Resolves: rhbz#1645271


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-3
changelog:
- add more securetty required for mainframes (#1067347)
- set SHELL envvar to /bin/bash in bashrc (#1063552)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-5
changelog:
- reserve uidgid pair 142:142 for activemq (#1086923)
- add xfs to /etc/filesystems, fallback to /proc/filesystems
  (#1123832)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-6
changelog:
- change reservation of 185:185 to jboss user (#1192413)
- reserve uidgid pair 167:167 for ceph (#1221043)
- reserve uidgid for systemd-network(192:192) (#1213820)
- reserve uidgid for systemd-resolve(193:193) (#1213820)
- mention systemd-jounal-gateway can be dynamic (#1213820)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-7
changelog:
- add basic empty subuid/subgid files for docker (#1311278)
- specify full path to utilities in /etc/profile and /etc/bashrc
  (#1331871)


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-8
changelog:
- fix group id for tape in /etc/group (should be 33) (#1433020)
- provide a way how to override set envvars through sh.local file(#1344007)
- provide a way how to override set ennvars through csh.local file


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-10
changelog:
- fix crudp name in /etc/protocols (#1566469)
- do not list /sbin/nologin and /usr/sbin/nologin in /etc/shells
  (#1571104)


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-7
changelog:
- [openstack plugins] Tripleo specific containerized services
  Resolves: bz1463635
- [jars] Scan only /usr/{share,lib}/java by default
  Resolves: bz1482574
- [gluster_block] Added new plugin gluster_block
  Resolves: bz1491964


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-2
changelog:
- [vdo] revise collected files
  Resolves: bz1509079
- further updates to OSP plugins in containerized environment
  Resolves: bz1506908
- [opendaylight] new plugin
  Resolves: bz1483414
- collect all keystone domains
  Resolves: bz1491042
- haproxy, etcd and docker tracebacks
  Resolves: bz1519267
- [origin] fix typo in oc adm diagnostics
  Resolves: bz1463509
- [postgresql] Call SCL pg_dump with proper path
  Resolves: bz1494420


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-4
changelog:
- [pcp] really apply sizelimit to logs collected
  Resolves: bz1353873
- [opendaylight] collect more logs and puppet config
  Resolves: bz1483414
- [plugins] allow add_cmd_output to collect binary output
  Resolves: bz1494420
- [openstack_ironic] collect drivers, ports and much more
  Resolves: bz1517767
- [openstack_cinder] check for api service running
  Resolves: bz1506908


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-5
changelog:
- [rabbitmq] Log collection when run in containerized OSP
  Resolves: bz1525620
- [ipa] add KRA logs and correct PKI directories
  Resolves: bz1535390
- [opendaylight] Enable plugin by puppet-opendaylight package
  Resolves: bz1483414
- [etcd] Do not collect private etcd keys
  Resolves: bz1539038


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-7
changelog:
- [kernel] Disable gathering /proc/timer* statistics
  Resolves: bz1568884
- [openstack_octavia] Add new plugin
  Resolves: bz1568882
- [ovirt-provider-ovn] A new plugin
  Resolves: bz1568960


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-8
changelog:
- [docker] backport three container related patches
  Resolves: bz1580526
- [ovn] add two OpenVSwitch plugins
  Resoles: bz1580525


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-3
changelog:
- [sosreport] Add mechanism to encrypt final archive
  Resolves: bz1594327
- [archive] fix stat typo
  Resolves: bz1597532
- [rhui] Fix detection of CDS for RHUI3
  Resolves: bz1596494


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-4
changelog:
- [apparmor,ceph] fix typo in add_forbidden_path
  Resolves: bz1609135
- [policies] sanitize report label
  Resolves: bz1608384
- [policies,process] make lsof execution optional, dont call on RHOSP
  Resolves: bz1613806


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-5
changelog:
- [rhv-log-collector-analyzer] Add new plugin for RHV
  Resolves: bz1600158
- [kubernetes|etcd] Support OpenShift 3.10 deployments
  Resolves: bz1616030


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-6
changelog:
- [archive] fix leading path creation
  Resolves: bz1624043
- [atomic] Define valid preset for RHEL Atomic
  Resolves: bz1626159
- [utilities] wait till AsyncReader p.poll() returns None
  Resolves: bz1623070


author: Jake Hunsaker <jhunsake@redhat.com> - 1.5-3
changelog:
- Resolve race condition in cluster profile loading
- Quote all options globally
- RHBZ#1633515
- RHBZ#1647955


author: Matej Kollar <mkollar@redhat.com> 2.3.1-1
changelog:
- 1107841 - Avoid creating profile with empty id
- Typo
- Retab
- Bumping package versions for 2.3.
- Bumping package versions for 2.2.


author: Tomas Kasparek <tkasparek@redhat.com> 2.4.1-1
changelog:
- rhbz#1232596: Require just openscap-scanner package everywhere
- Bumping package versions for 2.4.


author: Tomas Kasparek <tkasparek@redhat.com> 2.5.0-5
changelog:
- Revert "Increasing required version of rhnlib in due to ImportError module"
- Increasing required version of rhnlib in due to ImportError module i18n in
  scap.py


author: Petr Lautrbach <plautrba@redhat.com> 3.3.2-17
changelog:
- document rawbody's split into chunks (#892350)
- avoid using array of cleaned uris <fkrska@redhat.com> (#892348)


author: Petr Lautrbach <plautrba@redhat.com> 3.4.0-1
changelog:
- update to 3.4.0
- Apply fix for amavisd and spampd reloading after rules updates. Fixes bug #1145654


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-3
changelog:
- Fix CVE-2018-11781 - Local user code injection in the meta rule syntax
- Fix CVE-2017-15705 - Certain unclosed tags in crafted emails allow for
- scan timeouts and resulting denial of service
- Resolves: rhbz#1632998


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-4
changelog:
- Add missing Requires for perl(XSLoader) and perl(ExtUtils::MakeMaker),
- which are no longer auto-generated due to a (expected) change in rpm-build
- Related: rhbz#1632998


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-2
changelog:
- Add missing patch for rebase
  Resolves: rhbz#1402474
- Add obsoletes to the spec file to ease updates
  Resolves: rhbz#1432776
- Fix black screen in virt-manager
  Resolves: rhbz#1433242
- Make connection error message more clear
  Resolves: rhbz#1365736


author: Victor Toso <victortoso@redhat.com> - 0.33-3
changelog:
- Avoid CRITICALs on copy-paste
  Resolves: rhbz#1440096
- Avoid assertions on file-xfer while agent disconnects
  Related: rhbz#1440096


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-4
changelog:
- Make connection error message more clear
  Resolves: rhbz#1365736
- Improve audio debug
  Resolves: rhbz#1436249
- Fix wrong encoding of transferred files
  Resolves: rhbz#1440206


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-3
changelog:
- Prevent potential buffer/integer overflows with invalid MonitorsConfig messages
  sent from an authenticated client
  Resolves: CVE-2017-7506


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-2.3
changelog:
- Revert back to spice 0.12 behaviour where QXL guest resources for cursor
  commands are only released when the current cursor is replaced. This avoids
  a QEMU regression causing crashes during migration
  Resolves: rhbz#1572489


author: Kevin Howell <khowell@redhat.com> 1.20.3-1
changelog:
- Cockpit: Implement modal dialog (khowell@redhat.com)
- Implement bootstrap-select component (khowell@redhat.com)
- Port cockpit subscriptions-client to dbus (khowell@redhat.com)
- Move python-rhsm build into subscription-manager (khowell@redhat.com)
- 1354667: Add identity cert detection to proxy error message generation
  (wpoteat@redhat.com)
- 1501889: Enable yum plugins after sub-man subcommand is executed
  (jhnidek@redhat.com)
- 1477958: Use inotify for checking changes of consumer certs
  (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.5-1
changelog:
- Sync zanata translations (khowell@redhat.com)
- Cockpit - listing of installed products using patternfly-react
  (jhnidek@redhat.com)
- 1508457: Bump versions in python-rhsm obsoletes (khowell@redhat.com)
- Implement fallback for settimeout on old m2crypto (khowell@redhat.com)
- Cockpit: reconcile translated strings (khowell@redhat.com)
- Cockpit: use translations from root dir (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.6-1
changelog:
- Sync zanata translations (khowell@redhat.com)
- 1514067: Call virt-what using absolute path (jhnidek@redhat.com)
- 1487688: Load config settings for cockpit plugin (khowell@redhat.com)
- Added dependencies to cockpit-bridge and cockpit-shell. (jhnidek@redhat.com)
- 1462456: Flush stdout and stderr on more places (jhnidek@redhat.com)
- 1491842: fixed typo in man page. (jhnidek@redhat.com)
- 1508591: Removed python-rhsm from subscription-manager version
  (jhnidek@redhat.com)
- 1421010: Subman-GUI shows error dialog (wrong proxy settings)
  (jhnidek@redhat.com)
- 1500106: subscription-manager status --ondate do not ignore date
  (jhnidek@redhat.com)
- 1506970: Fixed default custom URL in cockpit plugin (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.8-1
changelog:
- Sync zanata translations (khowell@redhat.com)
- Add parameter to D-Bus API to pass locale for localization of errors
  (jhnidek@redhat.com)
- 1463765: Fix wrong Indic-language translations (khowell@redhat.com)
- 1487600: Cockpit - Save configuration from register dialog
  (jhnidek@redhat.com)
- 1464571: Improve multiple product certs errors (khowell@redhat.com)
- Replace cockpit-subscriptions (khowell@redhat.com)
- 1507158: Provide Host: in http CONNECT header (jhnidek@redhat.com)
- 1319927: Remove newline from auto enable message (khowell@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.9-1
changelog:
- Sync zanata translations (khowell@redhat.com)
- 1510727: Enable starting of subman GUI, when consumer has been deleted
  (jhnidek@redhat.com)
- 1304056: Fix D-Bus path of com.redhat.RHSM1.Facts (jhnidek@redhat.com)


author: Kevin Howell <khowell@redhat.com> 1.20.10-1
changelog:
- Update translations from zanata (khowell@redhat.com)
- 1510024: Handle rhel-alt product tags properly (khowell@redhat.com)
- 1526622: Do not delete product certificates in protected directory
  (jhnidek@redhat.com)
- 1527813: subman-gui use new URL of Online Documentation (jhnidek@redhat.com)
- 1519512: Handle non-UTF8 RPM vendors (khowell@redhat.com)
- 1526385: Bug fix of autoregistration in subman--cockpit plugin
  (jhnidek@redhat.com)
- 1527392: Clear credential data in register dialog (jhnidek@redhat.com)
- 1526385: Fix registration success detection (khowell@redhat.com)
- 1448313: Do not log error, when rhsmcertd is restarted (jhnidek@redhat.com)
- 1516439: Cockpit reports error during unregister when candlepin unavailable
  (jhnidek@redhat.com)


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
- RHEL 7.4 erratum
- added doc patch about sudo lookup issue
  Resolves: rhbz#1293306
- added test suite patch
  Resolves: rhbz#1360687
- fixed use after free fqdn problem
  Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
- RHEL 7.4 erratum
- added patch to fix output truncation (in some cases) when log_output
  option is enabled
  Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
- RHEL 7.4 erratum
- Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
  Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
- RHEL 7.4 erratum
- removed patch for output truncation (1454571) which introduced regression
  Resolves: rhbz#1360687


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-12
changelog:
- RHEL 7.5 erratum
- Fixed exit codes for `sudo -l -U <user>`
- Fixed truncated output when log_output is enabled
- Updated use_pty and IO logging manpage

  Resolves: rhbz#1458696
  Resolves: rhbz#1454571
  Resolves: rhbz#1490358

- Fixed second pass LDAP filter expression in the sudoers ldap backend
  - inclomplete patch for rhbz#1485397


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-13
changelog:
- RHEL 7.5 erratum
- Fixed sudo -l checking results whether user should be authenticated
- Enabled LDAP filter patch
- Fixed double free in sssd

  Resolves: rhbz#1505409
  Resolves: rhbz#1511850
  Resolves: rhbz#1518104


author: David Smith <dsmith@redhat.com> - 3.1-3
changelog:
- Added patches for:
- rhbz1425568 task_dentry_path() fix
- rhbz1431263 arm64 hardware breakpoint crash fix
- rhbz1430828 replace task_exe_file() with current_exe_file()
- rhbz1436845 adapt stapdyn to the dyninst 9.3.1 library search model
- rhbz1433391 workaround parser issue in nfs_proc.stp
- rhbz1428120 update lookup_bad_addr()


author: Frank Ch. Eigler <fche@redhat.com> - 3.2-3
changelog:
- rhbz1506230 (netif_receive_skb_internal probing)
- rhbz1490862 (f2fs tracepoint header workarounds)


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb46-4
changelog:
- Properly detect errors when writing backup files. (Closes: #80) (#81)
- Read number of backup files to keep from file
- config: defend on '/etc/target/backup' directory
- config: backup when current config is different from recent backup copy
- config: rename key 'kept_backups' as 'max_backup_files'
- backup: global option to tune max no. of backup conf files


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-6
changelog:
- Kill session after user logs out
  Resolves: bz#1259757

  Build against Xorg 1.20
  Resolves: bz#1564061


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-9
changelog:
- Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
- Resolves: rhbz#1368122


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-2
changelog:
- Resolves: rhbz#1459747 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
- Resolves: rhbz#1441481 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-3
changelog:
- Resolves: rhbz#1498343 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws
- Resolves: rhbz#1495655 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning
- Resolves: rhbz#1470597 CVE-2017-5647 Add follow up revision


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-5
changelog:
- Resolves: rhbz#1485453 man page uid and gid mismatch for service accounts
- Resolves: rhbz#1505762 Problem to start tomcat with a user whose group has a name different to the user


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.0-1
changelog:
- tomcatjss Pagure Issue #6 - Rebase tomcatjss to 7.2.0 in Fedora 25+ (mharmsen)
- Bugzilla Bug #1394416 - Rebase tomcatjss to 7.2.0 in RHEL 7.4 (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.0-2
changelog:
- Changed build so that it did not package and depend upon the specfile being
  included inside the tarball


author: Matthew Harmsen <mharmsen@redhat.com> - 7.2.1-3
changelog:
- Bugzilla Bug #1394416 - Rebase tomcatjss to 7.2.x in RHEL 7.4 (mharmsen)
- ## 'tomcatjss-support-for-event-API.patch' resolves the following issues
  - tomcatjss Pagure Issue #4 - Support for Event API (edewata)


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.1-7
changelog:
- Updated jss build and runtime dependencies
- Bugzilla Bug #1597180 - Tomcatjss: Add support for TLS_*_SHA384 ciphers
  [rhel-7.5.z] (cfu)


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-1
changelog:
- Update to 3.14.3
- Re-add opensubtitles plugin, as it doesn't depend on PyXDG anymore
Resolves: #1174589


author: Bastien Nocera <bnocera@redhat.com> 3.14.3-4
changelog:
- Remove Python3 plugins, they're mostly accessory plugins,
  and RHEL 7.2 only support Python2 for now
Resolves: #1259643


author: Ray Strode <rstrode@redhat.com> 3.14.3-5
changelog:
- Add more goo to the compat desktop file to prevent them
  from exposing in control-center
Related: #1259292


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-1
changelog:
- new release
  - rebase tuned to latest upstream
    resolves: rhbz#1388454
  - cpu-partitioning: enabled timer migration
    resolves: rhbz#1408308
  - cpu-partitioning: disabled kvmclock sync and ple
    resolves: rhbz#1395855
  - spec: muted error if there is no selinux support
    resolves: rhbz#1404214
  - units: implemented instance priority
    resolves: rhbz#1246172
  - bootloader: added support for initrd overlays
    resolves: rhbz#1414098
  - cpu-partitioning: set CPUAffinity early in initrd image
    resolves: rhbz#1394965
  - cpu-partitioning: set workqueue affinity early
    resolves: rhbz#1395899
  - scsi_host: fixed probing of ALPM, missing ALPM logged as info
    resolves: rhbz#1416712
  - added new profile cpu-partitioning
    resolves: rhbz#1359956
  - bootloader: improved inheritance
    resolves: rhbz#1274464
  - units: mplemented udev-based regexp device matching
    resolves: rhbz#1251240
  - units: introduced pre_script, post_script
    resolves: rhbz#1246176
  - realtime-virtual-host: accommodate new ktimersoftd thread
    resolves: rhbz#1332563
  - defirqaffinity: fixed traceback due to syntax error
    resolves: rhbz#1369791
  - variables: support inheritance of variables
    resolves: rhbz#1433496
  - scheduler: added support for cores isolation
    resolves: rhbz#1403309
  - tuned-profiles-nfv splitted to host/guest and dropped unneeded dependency
    resolves: rhbz#1413111
  - desktop: fixed typo in profile summary
    resolves: rhbz#1421238
  - with systemd don't do full rollback on shutdown / reboot
    resolves: rhbz#1421286
  - builtin functions: added virt_check function and support to include
    resolves: rhbz#1426654
  - cpulist_present: explicitly sorted present CPUs
    resolves: rhbz#1432240
  - plugin_scheduler: fixed initialization
    resolves: rhbz#1433496
  - log errors when applying a profile fails
    resolves: rhbz#1434360


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-2
changelog:
- respin
  related: rhbz#1388454
- systemd: added support for older systemd CPUAffinity syntax
  resolves: rhbz#1441791
- scheduler: added workarounds for low level exceptions from
  python-linux-procfs
  resolves: rhbz#1441792
- bootloader: workaround for adding tuned_initrd to new kernels on restart
  resolves: rhbz#1441797
- cpu-partitioning: use tuna for cores isolation
  related: rhbz#1403309


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.9.0-0.1.rc1
changelog:
- new release
  - rebased tuned to latest upstream
    resolves: rhbz#1467576
  - added recommend.d functionality
    resolves: rhbz#1459146
  - recommend: added support for matching of processes
    resolves: rhbz#1461838
  - cpu-partitioning: used tuned instead of tuna for cores isolation
    resolves: rhbz#1442229
  - bootloader: splitted string for removal from cmdline
    resolves: rhbz#1461279
  - network-latency: added skew_tick=1 kernel command line parameter
    resolves: rhbz#1451073
  - bootloader: accepted only certain values for initrd_remove_dir
    resolves: rhbz#1455161
  - increased udev monitor buffer size, made it configurable
    resolves: rhbz#1442306
  - bootloader: don't add nonexistent overlay image to grub.cfg
    resolves: rhbz#1454340
  - plugin_cpu: don't log error in execute() if EPB is not supported
    resolves: rhbz#1443182
  - sap-hana: fixed description of the sap-hana profiles
    resolves: rhbz#1482005
  - plugin_systemd: on full_rollback notify about need of initrd regeneration
    resolves: rhbz#1469258
  - don't log errors about missing files on verify with ignore_missing set
    resolves: rhbz#1451435
  - plugin_scheduler: improved logging
    resolves: rhbz#1474961
  - improved checking if we are rebooting or not
    resolves: rhbz#1475571
  - started dbus exports after a profile is applied
    resolves: rhbz#1443142
  - sap-hana: changed force_latency to 70
    resolves: rhbz#1501252
  - plugin_video: added support for the 'dpm' power method
  - list available profiles on 'tuned-adm profile'


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.9.0-0.2.rc2
changelog:
- new release
  - rebased tuned to latest upstream
    related: rhbz#1467576
  - fixed expansion of the variables in the 'devices' section
    related: rhbz#1490399
  - cpu-partitioning: add no_rebalance_cores= option
    resolves: rhbz#1497182


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
- Rebase to tzdata-2016i:
  - Cyprus is now split into two time zones as of 2016-10-30
  - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
- Rebase to tzdata-2016ij
  - Saratov region of Russia is moving from +03 offset to +04 offset
    on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
- Rebase to tzdata-2017a.
  - Mongolia no longer observes DST. (BZ #1425214)
  - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
- Add zone1970.tab file to the install list. (BZ #1414829)


