# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-1
changelog:
  - Bump version to  1.3.10.2-1
  - Resolves: Bug 1724761 - Entry cache contention during base search
  - Resolves: Bug 1515319 - nsDS5ReplicaId cant be set to the old value it had before
  - Resolves: Bug 1700987 - 389-base-ds expected file permissions in package don't match final runtime permissions
  - Resolves: Bug 1762901 - cenotaph errors on modrdn operations
  - Resolves: Bug 1772616 - Typo in the replication debug message "error 0 for oparation 561" 
  - Resolves: Bug 1781276 - Regression: NSS has interop problems as server when using limited cipher list
  - Resolves: Bug 1787921 - Crash on startup: Bus error in __env_faultmem.isra.1.part.2
  - Resolves: Bug 1759142 - No error returned when adding an entry matching filters for a non existing automember group
  - Resolves: Bug 1763365 - ns-slapd is crashing while restarting ipactl
  - Resolves: Bug 1769418 - Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  - Resolves: Bug 1775165 - ldclt core dumped when run with -e genldif option
  - Resolves: Bug 1796558 - Memory leak in ACI using IP subject
  - Resolves: Bug 1769296 - cl-dump exit code is 0 even if command fails with invalid arguments


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-2
changelog:
  - Bump version to  1.3.10.2-2
  - Resolves: Bug 1820433 - Invalid defaults.inf, missing key db_home_dir
  - Resolves: Bug 1801327 - intermittent SSL hang with rhds
  - Resolves: Bug 1807537 - wildcards in rootdn-allow-ip attribute are not accepted
  - Resolves: Bug 1827284 - Memory leak in indirect COS


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-3
changelog:
  - Bump version to 1.3.10.2-3
  - Resolves: Bug 1824930 - ipa ns-slapd 3 threads deadlock, db pages, state_change lock, write vattr lock
  - Resolves: Bug 1837477 - ns-slapd hangs during CleanAllRUV tests


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-5
changelog:
  - Bump version to 1.3.10.2-5
  - Resolves: Bug 1700987 - 389-base-ds expected file permissions in package don't match final runtime permissions


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-6
changelog:
  - Bump version to 1.3.10.2-6
  - Resolves: Bug 1839085 - IPA: Winsync not honoring parameters winSyncDirectoryFilter and winSyncWindowsFilter


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-7
changelog:
  - Bump version to 1.3.10.2-7
  - Resolves: Bug 1870624 - RHDS - allow more than 1 empty AttributeDescription for ldapsearch, without the risk of denial of service
  - Resolves: Bug 1876028 - errors log with incorrectly formatted message parent_update_on_childchange on PARENTUPDATE_DEL
  - Resolves: Bug 1860008 - On ADD replication URP issue internal searches with filter containing unescaped chars


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-8
changelog:
  - Bump version to 1.3.10.2-8
  - Resolves: Bug 1904145 - group rdn with leading space char and add fails error 21 invalid syntax and delete fails error 32
  - Resolves: Bug 1902042 - Entries conflict not resolved by replication


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-10
changelog:
  - Bump version to 1.3.10.2-10
  - Resolves: Bug 1909342 - DS crash in deref plugin while dereferencing an entry that exists but that is not returned by internal search
  - Resolves: Bug 1921856 - “write” permission of ACI changes ns-slapd’s behavior on search operation 
  - Resolves: Bug 1881968 - Replication Lag under high load


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-11
changelog:
  - Bump version to 1.3.10.2-11
  - Resolves: Bug 1953673 - Add new access log keywords for time spent in work queue and actual operation time
  - Resolves: Bug 1931182 - information disclosure during the binding of a DN


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-13
changelog:
  - Bump version to 1.3.10.2-13
  - Resolves: Bug 2005399 - Internal unindexed searches in syncrepl
  - Resolves: Bug 2005432 - CVE-2021-3652 389-ds:1.4/389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed
  - Resolves: Bug 2005434 - ACIs are being evaluated against the Replication Manager account in a replication context.
  - Resolves: Bug 2005435 - A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind rule


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-14
changelog:
  - Bump version to 1.3.10.2-14
  - Resolves: Bug 2018257 - hang because of incorrect accounting of readers in vattr rwlock
  - Resolves: Bug 2010976 - IPA server (389ds) is very slow in execution of some searches (`&(memberOf=...)(objectClass=ipaHost)` in particular)


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-15
changelog:
  - Bump version to 1.3.10.2-15
  - Resolves: Bug 2049812 - Fix csn generator to limit time skew drift
  - Resolves: Bug 2048530 - CVE-2021-4091 389-ds-base: double-free of the virtual attribute context in persistent search


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-16
changelog:
  - Bump version to 1.3.10.2-16
  - Resolves: Bug 2077395 - CVE-2022-0918 389-ds:1.4/389-ds-base: sending crafted message could result in DoS
  - Resolves: Bug 2014768 - Log the Auto Member invalid regex rules in the LDAP errors log
  - Resolves: Bug 2018153 - RFE - Provide an option to abort an Auto Member rebuild task
  - Resolves: Bug 2093294 - CVE-2022-0996 389-ds:1.4/389-ds-base: expired password was still allowed to access the database


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10-2-17
changelog:
  - Bump version to 1.3.10.2-17
  - Resolves: Bug 2113056 - Import may break replication because changelog starting csn may not be created
  - Resolves: Bug 2131083 - SIGSEGV in sync_repl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-5
changelog:
  - Bump version to 1.3.10.1-5
  - Resolves: Bug 1744623 - DB Deadlock on modrdn appears to corrupt database and entry cache(cont)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-6
changelog:
  - Bump version to 1.3.10.1-6
  - Resolves: Bug 1801694 - ns-slapd is crashing while restarting ipactl
  - Resolves: Bug 1803023 - Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  - Resolves: Bug 1803052 - Memory leak in ACI using IP subject
  - Resolves: Bug 1801703 - Regression: NSS has interop problems as server when using limited cipher list
  - Resolves: Bug 1809160 - Entry cache contention during base search


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-7
changelog:
  - Bump version to 1.3.10.1-7
  - Resolves: Bug 1803023 - Several memory leaks reported by Valgrind (fix regression)


author: Simon Pichugin <spichugi@redhat.com> - 1.3.11.1-1
changelog:
  - Bump version to 1.3.11.1-1
  - Resolves: Bug 2170224 - Backport Rust password storage PBKDF2 schemes
  - Resolves: Bug 2170221 - Boolean attributes should be case insensitive
  - Resolves: Bug 2170218 - Slow memberof fixup task for large static groups, high CPU use


author: Jan Horak <jhorak@redhat.com> - 6.7.8.9-15
changelog:
  - Added fix for CVE-2016-5118, CVE-2016-5240, rhbz#1269562,
    rhbz#1326834, rhbz#1334188, rhbz#1269553


author: Thomas Haller <thaller@redhat.com> - 1:1.18.4-1
changelog:
  - Update to 1.18.4 release
  - cli: fix bash completion for slave-types (rh #1654062)
  - core: improve handling of policy routing rules when restarting daemon (rh #1696881)
  - ifcfg-rh: preserve existance of ethernet setting in profile (rh #1703960)
  - tui: only add bond options to profile that are supported by tui (rh #1715720)
  - cli: fix resetting default value for properties (rh #1715887)
  - core: fix detecting parent device by connection's UUID (rh #1716438)
  - core: fix setting IPv6 route options and destination (rh #1727193)
  - core: support more "arp_validate" bond options (rh #1730793)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.4-2
changelog:
  - dhcp: include conditionals from existing dhclient configuration (rh #1758550)
  - core: fix sending ARP announcements (rh #1767681)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.6-1
changelog:
  - Update to 1.18.6 release
  - cli: unset "ipv[46].never-default" when setting "ipv[46].gateway" (rh #1785039)
  - core: keep MTU of MACsec and MAC-VLAN interfaces in sync with parent (rh #1723690)
  - core: forbid autoactivation of parent when it is blocked by user request (rh #1765566)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.6-2
changelog:
  - vpn: gracefully handle invalid routes from VPN plugins
  - workaround g_strtoll() failing with EAGAIN (rh #1797915)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-1
changelog:
  - Update to 1.18.8 relase
  - ifcfg-rh: handle "802-1x.{,phase2-}ca-path" (rh #1841397, CVE-2020-10754)
  - ifcfg-rh: handle 802-1x.pin properties.


author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-2
changelog:
  - Backport OVS related fixes (rh #1871935)
  - ovs: support changing the MTU of ovs interfaces (rh #1820052)
  - ovs: fix race condition in setting MAC address (rh #1852106)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-4.gitc325e41585e3.el7
changelog:
  - ovmf-ShellPkg-Shell-clean-up-bogus-member-types-in-SPLIT_.patch [bz#1442908]
  - ovmf-ShellPkg-Shell-eliminate-double-free-in-RunSplitComm.patch [bz#1442908]
  - Resolves: bz#1442908
    (Guest hang when running a wrong command in Uefishell)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170228-5.gitc325e41585e3.el7
changelog:
  - ovmf-OvmfPkg-EnrollDefaultKeys-update-SignatureOwner-GUID.patch [bz#1443351]
  - ovmf-OvmfPkg-EnrollDefaultKeys-expose-CertType-parameter-.patch [bz#1443351]
  - ovmf-OvmfPkg-EnrollDefaultKeys-blacklist-empty-file-in-db.patch [bz#1443351]
  - ovmf-OvmfPkg-introduce-the-FD_SIZE_IN_KB-macro-build-flag.patch [bz#1443351]
  - ovmf-OvmfPkg-OvmfPkg.fdf.inc-extract-VARS_LIVE_SIZE-and-V.patch [bz#1443351]
  - ovmf-OvmfPkg-introduce-4MB-flash-image-mainly-for-Windows.patch [bz#1443351]
  - ovmf-OvmfPkg-raise-max-variable-size-auth-non-auth-to-33K.patch [bz#1443351]
  - ovmf-OvmfPkg-PlatformPei-handle-non-power-of-two-spare-si.patch [bz#1443351]
  - ovmf-redhat-update-local-build-instructions-with-D-FD_SIZ.patch [bz#1443351]
  - ovmf-redhat-update-OVMF-build-commands-with-D-FD_SIZE_4MB.patch [bz#1443351]
  - Resolves: bz#1443351
    ([svvp][ovmf] job "Secure Boot Logo Test" failed  with q35&ovmf)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20171011-1.git92d07e48907f.el7
changelog:
  - Rebase to 92d07e48907f [bz#1469787]
  - Resolves: bz#1469787
    ((ovmf-rebase-rhel-7.5) Rebase OVMF for RHEL-7.5)
  - Resolves: bz#1434740
    (OvmfPkg/PciHotPlugInitDxe: don't reserve IO space when IO support is disabled)
  - Resolves: bz#1434747
    ([Q35] code12 error when hotplug x710 device in win2016)
  - Resolves: bz#1447027
    (Guest cannot boot with 240 or above vcpus when using ovmf)
  - Resolves: bz#1458192
    ([Q35] recognize "usb-storage" devices in XHCI ports)
  - Resolves: bz#1468526
    (>1TB RAM support)
  - Resolves: bz#1488247
    (provide "OVMF_CODE.secboot.verbose.fd" for log capturing; silence "OVMF_CODE.secboot.fd")
  - Resolves: bz#1496170
    (Inconsistent MOR control variables exposed by OVMF, breaks Windows Device Guard)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20171011-2.git92d07e48907f.el7
changelog:
  - ovmf-MdeModulePkg-Bds-Remove-assertion-in-BmCharToUint.patch [bz#1513632]
  - ovmf-MdeModulePkg-Bds-Check-variable-name-even-if-OptionN.patch [bz#1513632]
  - ovmf-MdeModulePkg-PciBus-Fix-bug-that-PCI-BUS-claims-too-.patch [bz#1514105]
  - ovmf-OvmfPkg-make-it-a-proper-BASE-library.patch [bz#1488247]
  - ovmf-OvmfPkg-create-a-separate-PlatformDebugLibIoPort-ins.patch [bz#1488247]
  - ovmf-OvmfPkg-save-on-I-O-port-accesses-when-the-debug-por.patch [bz#1488247]
  - ovmf-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch [bz#1488247]
  - ovmf-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-QemuVide.patch [bz#1488247]
  - ovmf-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch [bz#1488247]
  - ovmf-Revert-redhat-introduce-separate-silent-and-verbose-.patch [bz#1488247]
  - Resolves: bz#1488247
    (make debug logging no-op unless a debug console is active)
  - Resolves: bz#1513632
    ([RHEL-ALT 7.5] AAVMF fails to boot after setting BootNext)
  - Resolves: bz#1514105
    (backport edk2 commit 6e3287442774 so that PciBusDxe not over-claim resources)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20171011-3.git92d07e48907f.el7
changelog:
  - ovmf-UefiCpuPkg-CpuDxe-Fix-multiple-entries-of-RT_CODE-in.patch [bz#1518308]
  - ovmf-MdeModulePkg-DxeCore-Filter-out-all-paging-capabilit.patch [bz#1518308]
  - ovmf-MdeModulePkg-Core-Merge-memory-map-after-filtering-p.patch [bz#1518308]
  - Resolves: bz#1518308
    (UEFI memory map regression (runtime code entry splitting) introduced by c1cab54ce57c)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20171011-4.git92d07e48907f.el7
changelog:
  - ovmf-MdeModulePkg-Core-Dxe-log-informative-memprotect-msg.patch [bz#1520485]
  - ovmf-MdeModulePkg-BdsDxe-fall-back-to-a-Boot-Manager-Menu.patch [bz#1515418]
  - Resolves: bz#1515418
    (RFE: Provide diagnostics for failed boot)
  - Resolves: bz#1520485
    (AAVMF: two new messages with silent build)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-2.gitee3198e672e2
changelog:
  - OvmfPkg/PlatformBootManagerLib: connect consoles unconditionally [bz#1577546]
  - build OVMF varstore template with SB enabled / certs enrolled [bz#1561128]
  - connect Virtio RNG devices again [bz#1579518]
  - Resolves: bz#1577546
    (no input consoles connected under certain circumstances)
  - Resolves: bz#1561128
    (OVMF Secure boot enablement (enrollment of default keys))
  - Resolves: bz#1579518
    (EFI_RNG_PROTOCOL no longer produced for virtio-rng)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-3.gitee3198e672e2.el7
changelog:
  - ovmf-redhat-provide-virtual-bundled-OpenSSL-in-OVMF.patch [bz#1607792]
  - Resolves: bz#1607792
    (add 'Provides: bundled(openssl) = 1.1.0h' to the spec file)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-3.gitee3198e672e2.el7_6.1
changelog:
  - ovmf-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch [bz#1684006]
  - ovmf-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch [bz#1684006]
  - Resolves: bz#1684006
    (CVE-2018-12180 OVMF: edk2: Buffer Overflow in BlockIo service for RAM disk [rhel-7.6.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-4.gitee3198e672e2.el7
changelog:
  - ovmf-redhat-provide-firmware-descriptor-meta-files.patch [bz#1608599]
  - Resolves: bz#1608599
    ([RHEL 7.7] RFE: provide firmware descriptor meta-files for OVMF)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-5.gitee3198e672e2.el7
changelog:
  - ovmf-MdeModulePkg-Variable-Fix-Timestamp-zeroing-issue-on.patch [bz#1666586]
  - ovmf-MdePkg-Add-more-checker-in-UefiDecompressLib-to-acce.patch [bz#1666586]
  - ovmf-IntelFrameworkModulePkg-Add-more-checker-in-UefiTian.patch [bz#1666586]
  - ovmf-BaseTools-Add-more-checker-in-Decompress-algorithm-t.patch [bz#1666586]
  - ovmf-BaseTools-Fix-UEFI-and-Tiano-Decompression-logic-iss.patch [bz#1666586]
  - ovmf-MdePkg-BaseUefiDecompressLib-Fix-UEFI-Decompression-.patch [bz#1666586]
  - ovmf-IntelFrameworkModulePkg-Fix-UEFI-and-Tiano-Decompres.patch [bz#1666586]
  - ovmf-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch [bz#1684007]
  - ovmf-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch [bz#1684007]
  - ovmf-redhat-openssl-update-introduce-MOCK-shorthand-for-m.patch [bz#1650390]
  - ovmf-redhat-openssl-update-enable-the-bootstrap-container.patch [bz#1650390]
  - ovmf-redhat-consume-OpenSSL-1.1.0i-from-Fedora-28.patch [bz#1650390]
  - ovmf-Upgrade-OpenSSL-to-1.1.0j.patch [bz#1650390]
  - Resolves: bz#1650390
    (CVE-2018-5407 OVMF: openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) [rhel-7])
  - Resolves: bz#1666586
    (CVE-2017-5731 CVE-2017-5732 CVE-2017-5733 CVE-2017-5734 CVE-2017-5735 CVE-2018-3613 OVMF: various flaws [rhel-7])
  - Resolves: bz#1684007
    (CVE-2018-12180 OVMF: edk2: Buffer Overflow in BlockIo service for RAM disk [rhel-7.7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-6.gitee3198e672e2.el7
changelog:
  - ovmf-MdeModulePkg-HiiDatabase-Fix-potential-integer-overf.patch [bz#1691479]
  - ovmf-MdeModulePkg-HiiImage-Fix-stack-overflow-when-corrup.patch [bz#1691479]
  - ovmf-MdeModulePkg-PartitionDxe-Add-check-for-underlying-d.patch [bz#1691647]
  - ovmf-MdeModulePkg-UdfDxe-Refine-boundary-checks-for-file-.patch [bz#1691647]
  - ovmf-MdeModulePkg-UdfDxe-Add-boundary-check-the-read-of-F.patch [bz#1691647]
  - ovmf-MdeModulePkg-UdfDxe-Add-boundary-check-for-Component.patch [bz#1691647]
  - ovmf-MdeModulePkg-UdfDxe-Add-boundary-check-for-getting-v.patch [bz#1691647]
  - ovmf-MdeModulePkg-UsbBusDxe-Fix-wrong-buffer-length-used-.patch [bz#1697534]
  - Resolves: bz#1691479
    (CVE-2018-12181 OVMF: edk2: Stack buffer overflow with corrupted BMP [rhel-7])
  - Resolves: bz#1691647
    (CVE-2019-0160 OVMF: edk2: buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media [rhel-7])
  - Resolves: bz#1697534
    (CVE-2019-0161 ovmf: edk2: stack overflow in XHCI causing denial of service [rhel-7])


author: Nicolas Chauvet <kwizart@gmail.com> - 1.7.1-1
changelog:
  - Update to 1.7.1

  -* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.0-5
  -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Patch: not-rhel.patch
  -->  SL is not RHEL
  - Added Patch: pk-upgrade-distro.patch
  -->  Use /usr/sbin/sl7-upgrade rather than preupgrade
  - Added Source: PackageKit.ini
  -->  Config file for automated patch script
  - Added Patch: pk-yum-backend-for-sl.patch
  -->  Add in code to let PackageKit check dist to upgrade
  - Added Patch: use-sl-upgrade.patch
  -->  Use /usr/sbin/sl7-upgrade rather than preupgrade


author: Petr Pisar <ppisar@redhat.com> - 1.2.15-14
changelog:
  - Do not harness backing store by default. Export SDL_VIDEO_X11_BACKINGSTORE
    environment variable to enable it.
  - Resolves: rhbz#1245417


author: Wim Taymans <wtaymans@redhat.com> - 1.2.15-17
changelog:
  - Fix Some CVEs: CVE-2019-7572, CVE-2019-7573, CVE-2019-7574,
    CVE-2019-7575, CVE-2019-7576, CVE-2019-7577, CVE-2019-7578,
    CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638
  - Resolves: rhbz#1716201, rhbz#1716202, rhbz#1716206,
  - Resolves: rhbz#1716207, rhbz#1716208


author: Ray Strode <rstrode@redhat.com> - 0.6.45-6
changelog:
  - Don't return bogus password expiration policy when
    shadow file is unavailable
    Resolves: #1530659


author: Sumit Bose <sbose@redhat.com> - 0.8.1-8
changelog:
  - Various updates for RHEL-7.7
  - many adcli-krb5-????? directories are created /tmp [#1588596]
  - adcli exports kerberos ticket with old kvno [#1642546]
  - [RFE] Have `adcli join` work without FQDN in `hostname` output [#1595911]
  - Improve handling of service principals [#1644311]
  - [RFE] adcli command with --unix-* options doesn't update
    values in UnixAttributes Tab for user [#1337489]
  - [RFE] adcli join should preserve SPN added by adcli preset-computer [#1630187]
  - [RFE] Need an option for adcli command which will show domain join status. [#1622583]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-9
changelog:
  - Fixes for RHEL-7.7 updates
  - additional patch for [RFE] adcli join should preserve SPN added by adcli
    preset-computer [#1630187]
  - new patches for many adcli-krb5-????? directories are created /tmp [#1588596]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-10
changelog:
  - adcli is failing with "Couldn't add keytab entries: FILE:/etc/krb5.keytab:
    Cannot allocate memory" [1665162]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-11
changelog:
  - Fixes and improvements for RHEL-7.8
  - Issue is that with arcfour-hmac as first encryption type in the config ... [#1683745]
  - adcli update --add-samba-data does not work as expected [#1738573]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-14
changelog:
  - Fixes for RHEL-7.9
  - Update' adcli update --add-samba-data ' info under correct section in man adcli [#1774622]
  - [abrt] [faf] adcli: raise(): /usr/sbin/adcli killed by 6 [#1802258]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-15
changelog:
  - More fixes for RHEL-7.9
  - No longer able to delete computer from AD using adcli [#1840752]
  - adcli: presetting $computer in $domain domain failed: Cannot set computer
    password: Authentication error [#1762633]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-1
changelog:
  - Update to upstream release 0.8.1
  - Rebase adcli in RHEL-7.3 to version 0.8.0 [#1292530]
  - Support Host Keytab renewal [#1288485]
  - realmd not joining AD so ssh gssapi-with-mic works [#1061371]
  - technically wrong length checks in binary parsers  [#1027905]
  - avoid alloca in _adcli_ldap_have_in_mod [#1027889]
  - [RFE] adcli --stdin-password should be able to strip newline character from
    the input [#1134330]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-3
changelog:
  - fix crash when name is specified on the command line and detect names with
    lower case characters [#1359773]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-4
changelog:
  - adcli doesn't update kvno while joining system to AD domain (RODC) [#1471021]
  - adcli_tool_computer_delete description spelling [#1450179]
  - adcli man page should not only mention FILE type credential caches [#1423871]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-5
changelog:
  - enable "Trust this computer for delegation to any service (Kerberos only)" [#1538730]
  - realm join fails with Insufficient permissions [#1542354]
  - adcli update option cannot add principals for computer object [#1545568]
  - adcli refuses to add service principals [#1547013]
  - [RFE] Support adding SPN of a different host [#1547014]
  - adcli segfaults during AD join RHEL 7.5 [#1575554]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-6
changelog:
  - Couldn't set service principals on computer account [#1608212]
  - additional fix #1547014 and #1593240


author: Than Ngo <than@redhat.com> - 1.15-21
changelog:
  - Resolves: #1711051, CVE-2019-8383 denial of service
  - Resolves: #1710910, CVE-2019-8379 null pointer dereference


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-6
changelog:
  - warn if processing prelinked binary objects and the prelink binary
    is not available
    Resolves: rbhz#1004826


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-10
changelog:
  - Updated the default configuration file. New defaults contributed
    by Steve Grubb.
    Resolves: rhbz#1304334


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.140-1
changelog:
  - Preserve the boot option zfcp.allow_lun_scan (vponcova)
    Resolves: rhbz#1561662
  - Don't display "Alternate Architectures" in product name (rvykydal)
    Resolves: rhbz#1488558


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.143-1
changelog:
  - Add data loss warning to nvdimm reconfigure dialog. (rvykydal)
    Resolves: rhbz#1280500
  - Add UI feedback for disk repopulating after nvdimm reconfiguration.
    (rvykydal)
    Resolves: rhbz#1280500
  - Use only devices specified by nvdimm command for installation. (rvykydal)
    Resolves: rhbz#1280500
  - Add option to reconfigure nvdimm devices into sector mode. (rvykydal)
    Resolves: rhbz#1280500
  - Allow only devices in sector mode to be selected. (rvykydal)
    Resolves: rhbz#1280500
  - Add nvdimm devices to Advanced Storage spoke. (rvykydal)
    Resolves: rhbz#1280500
  - Add kickstart support for nvdimm reconfiguration to sector mode. (rvykydal)
    Resolves: rhbz#1280500


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.144-1
changelog:
  - Don't allow unlocking and using of LUKS2 devices (vponcova)
    Resolves: rhbz#1608251
  - Fix glade accelerator conflicts (rvykydal)
    Related: rhbz#1602436
  - Add nvdimm files to POTFILES.in (rvykydal)
    Related: rhbz#1602436
  - Support nvdimm only on x86_64 (rvykydal)
    Resolves: rhbz#1602436


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.146-1
changelog:
  - Revert "If someone really wants to eject the cdrom, then do it. (jkonecny)"
    Resolves: rhbz#1618408


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Patch: anaconda-context-treeinfo-DVD-72.patch
  -->  Permit selective enabling of 'addon' repos (for contexts)
  - Added Source: anaconda_spec-dont-use-rhel-bugzilla.patch
  -->  Do not configure anaconda to autoreport errors to TUV
  - Added Patch: sl-branding-bootloader-xfs.patch
  -->  Modify filesystem list in pyanaconda/bootloader.py for SL
  - Added Patch: anaconda-doesnt-use-yumvars-for-mirrorlist.patch
  -->  Anaconda doesn't use yumvars for mirrorlists in UI, do it by hand
  - Added Source: anaconda.ini
  -->  Config file for automated patch script
  - Added Patch: anaconda-expand-yumvars-in-script.patch
  -->  Anaconda doesn't use yumvars for mirrorlists in script, do it by hand
  - Added Patch: sl-branding-installclass.patch
  -->  Modify installclasses/rhel.py and installclasses/fedora.py for SL


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com>
changelog:
  - Change sl-branding-installclass.patch for EuroLinux
  - Removed Patch: anaconda-doesnt-use-yumvars-for-mirrorlist.patch
  - Removed Patch: anaconda-expand-yumvars-in-script.patch
  - Removed Patch: anaconda-context-treeinfo-DVD-72.patch


author: Java SIG <java-devel@lists.fedoraproject.org> - 1.8.3-8
changelog:
  - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
  - Replace maven BuildRequires with maven-local


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.8.3-10
changelog:
  - Build with xmvn
  - Don't generate extra JARs
  - Simplify build dependencies
  - Update to current packaging guidelines


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.8.3-13
changelog:
  - Add BuildRequires on apache-commons-parent >= 26-7
  - Remove BuildRequires on commons-collections-testframework


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-16
changelog:
  - the correct solution is remove smp_flags, they don't work properly on ppc with
    the option mpower7
  - Related: rhbz#1048745


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-21
changelog:
  - correct the DST correction when using UTC time specification (#1328832)
  - clear non-job files from at dir and test for write error on fclose
    to fix bogus syslog messages


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-23
changelog:
  - fix the ownership of the spool directory (#1414228)
  - document the -n option of atd (#739870)
  - fix handling of the aborted jobs (due to possibly
    temporary conditions) and avoid flooding the syslog


author: Michael Schwendt <mschwendt@fedoraproject.org> - 1:0.3.6-5
changelog:
  - Merge fix from upstream pull request #25 for CVE-2015-7747.
    Test conversion from e.g. 16-bit LE stereo to 8-bit LE mono
    no longer causes corruption.


author: Michael Schwendt <mschwendt@fedoraproject.org> - 1:0.3.6-7
changelog:
  - Merge upstream pull requests #42,#43,#44 from Agostino Sarubbo to fix
    security issues.  CVE-2017-6827, CVE-2017-6828,
    CVE-2017-6829, CVE-2017-6830, CVE-2017-6831,
    CVE-2017-6832, CVE-2017-6833, CVE-2017-6834, CVE-2017-6835,
    CVE-2017-6836, CVE-2017-6837, CVE-2017-6838, CVE-2017-6839


author: Wim Taymans <wtaymans@redhat.com> - 1:0.3.6-9
changelog:
  - Apply security patches. CVE-2018-17095, CVE-2018-13440
  - Resolves: rhbz#1600369, rhbz#1601014, rhbz#1637128


author: Dominic Cleal <dcleal@redhat.com> - 1.4.0-1
changelog:
  - Rebase to Augeas 1.4.0
  - Revert some changes for better compatibility with 1.1.0-17:
    * Dhcpd: keep 1.1.0 behaviour, add Dhcpd_140 for 1.4.0 features
    * Dnsmasq: revert splitting of address/server options
    * Dovecot: restore quotes within values
    * Jaas: revert semicolon and line break changes
    * Slapd: keep 1.1.0 behaviour, add Slapd_140 for 1.4.0 features
    * Sshd: keep 1.1.0 behaviour, add Sshd_140 for 1.4.0 features
    * Syslog: restore tree without protocol for UDP hosts
    * UpdateDB: keep Simplevars to load config by default


author: Pino Toscano <ptoscano@redhat.com> - 1.4.0-4
changelog:
  - Fix CVE-2017-7555, improper handling of escaped strings (RHBZ#1481546)
  - Skip testSaveNoPermission when running as root (RHBZ#1269817)
  - Chrony: allow signed numbers (RHBZ#1302017)
  - Krb5: support includedir (RHBZ#1406111)


author: Pino Toscano <ptoscano@redhat.com> - 1.4.0-5
changelog:
  - Cgconfig: allow fperm & dperm in admin & task (RHBZ#1325741)
  - Grub: handle top-level "boot" directive (RHBZ#1484261)


author: Pino Toscano <ptoscano@redhat.com> - 1.4.0-9
changelog:
  - Add "Provides: bundled(gnulib)" to augeas-libs, as it embeds gnulib
    (RHBZ#1653766)
  - Anaconda: new lens (RHBZ#1657189)


author: Pino Toscano <ptoscano@redhat.com> - 1.4.0-9.el7_7.1
changelog:
  - Krb5: support realms that start with numbers; add more pkinit_* options;
    improve handling of [dbmodules]; allow include/includedir directives
    everywhere (RHBZ#1799021)


author: Pino Toscano <ptoscano@redhat.com> - 1.4.0-9.el7_8.1
changelog:
  - Krb5: support realms that start with numbers; add more pkinit_* options;
    improve handling of [dbmodules]; allow include/includedir directives
    everywhere (RHBZ#1799022)


author: Stephan Bergmann <sbergman@redhat.com> - 1:5.3.6.1-17
changelog:
  - Resolves: rhbz#1545262 Workaround for spurious ppc64le automated testing crash
  - Resolves: rhbz#1610692 silence console warnings from print dialog


author: Ian Kent <ikent@redhat.com> - 5.0.7-108
changelog:
  - bz1728914 - getmntent returns additional "-hosts" entries when
    automounter is used with "hosts" map
    - remove unused function has_fstab_option().
    - remove unused function reverse_mnt_list().
    - remove a couple of old debug messages.
    - fix amd entry memory leak.
    - fix unlink_mount_tree() not umounting mounts.
    - add ignore mount option.
    - use ignore option for offset mounts as well.
    - add config option for "ignore" mount option
    - use bit flags for autofs mount types in mnt_list.
    - use mp instead of path in mnt_list entries.
    - always use PROC_MOUNTS to make mount lists.
    - add glibc getmntent_r().
    - use local getmntent_r in table_is_mounted().
    - refactor unlink_active_mounts() in direct.c.
    - don't use tree_is_mounted() for mounted checks.
    - use single unlink_umount_tree() for both direct and indirect mounts.
    - move unlink_mount_tree() to lib/mounts.c.
    - use local_getmntent_r() for unlink_mount_tree().
    - use local getmntent_r() in get_mnt_list().
    - use local getmntent_r() in tree_make_mnt_list().
  - Resolves: rhbz#1728914


author: Ian Kent <ikent@redhat.com> - 5.0.7-109
changelog:
  - bz1728914 - getmntent returns additional "-hosts" entries when
    automounter is used with "hosts" map
    - fix missing initialization of autofs_point flags.
  - Related: rhbz#1728914


author: Ian Kent <ikent@redhat.com> - 5.0.7-110
changelog:
  - bz1806514 - strictexpire option not set for offset mounts
    - also use strictexpire for offsets.
  - Resolves: rhbz#1806514


author: Ian Kent <ikent@redhat.com> - 5.0.7-111
changelog:
  - bz1806514 - strictexpire option not set for offset mounts
    - fix patch not applied.
  - Related: rhbz#1806514


author: Ian Kent <ikent@redhat.com> - 5.0.7-112
changelog:
  - bz1818664 - autofs cannot mount samba/cifs shares that end with a dollar sign
    - fix trailing dollar sun entry expansion.
  - Resolves: rhbz#1818664


author: Ian Kent <ikent@redhat.com> - 5.0.7-114
changelog:
  - bz1847762 - automount program crashes with "malloc(): invalid next size
    (unsorted)
    - initialize struct addrinfo for getaddrinfo() calls.
    - fix quoted string length calc in expandsunent().
    - fix autofs mount options construction.
  -Resolves: rhbz#1847762


author: Ian Kent <ikent@redhat.com> - 5.0.7-115
changelog:
  - bz1885511 - automount force unlink option (-F) does not work as expected
    on autofs-5.0.7-109.el7
    - fix direct mount unlink_mount_tree() path.
    - fix unlink mounts umount order.
  - bz1858586 - autofs share doesn't mount when using nobind over RDMA where
    nfs-server and nfs-client are the same systems
    - mount_nfs.c fix local rdma share not mounting.
  - Resolves: rhbz#1885511 rhbz#1858586


author: Ian Kent <ikent@redhat.com> - 5.0.7-116
changelog:
  - bz1885511 - automount force unlink option (-F) does not work as expected
    on autofs-5.0.7-109.el7
    - fix incorrect logical compare in unlink_mount_tree().
  - Related: rhbz#1885511


author: Ian Kent <ikent@redhat.com> - 5.0.7-116el7_9.1
changelog:
  - bz2107752 - autofs: send FAIL cmd/ioctl mess when encountering problems
    with mount trigger
    - fix kernel mount status notification.
  - Resolves: rhbz#2107752


author: Ian Kent <ikent@redhat.com> - 5.0.7-107
changelog:
  - bz1734057 - automount segfaults if a bad hosts entry is added
    in /etc/auto.master
    - fix reset flex scan buffer on init.
  - Resolves: rhbz#1734057


author: Michal Sekletar <msekleta@redhat.com> - 0.6.31-15
changelog:
  - enable hardened build (#1092506)
  - fix short option for --version, document -t option of avahi-autoipd (#948583)
  - fix crashes in D-Bus methods GetAlternativeHostName and GetAlternativeServiceName (#1003688)
  - fix bug when avahi-daemon ended up in a tight loop (#1081801)
  - remove prefix /home/lennart/tmp/avahi from references in man pages (#1120233)


author: Michal Sekletar <msekleta@redhat.com> - 0.6.31-17
changelog:
  - fix crash due to use of deprecated Gtk3 API (#1263720)
  - don't add 0pointer.de and zeroconf.org to default browse list (#1340837)
  - fix not publishing entries if a probing interface is removed (#1222646)


author: Michal Sekletar <msekleta@redhat.com> - 0.6.31-18
changelog:
  - create home directory for avahi-autoipd user (#1416287)
  - get rid of the dangling symlink to avahi-discover in debuginfo package (#1421229)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.14.28-5
changelog:
  - Append python-botocore and python-jmespath bundled directory to
    search path where needed

    Resolves: rhbz#1509434


author: Ondrej Holy <oholy@redhat.com> - 3.14.1-1
changelog:
  - Update to 3.14.1
  - Remove obsolete upstream patch
  - Add translations updates from upstream
  - Resolves: #1174557


author: Ville Skyttä <ville.skytta@iki.fi> - 0:5.2-10
changelog:
  - Specify explicit source encoding to fix build with Java 7.
  - Install jar and javadocs unversioned.
  - Crosslink with JDK javadocs.


author: Andy Grimm <agrimm@gmail.com> - 0:5.2-13
changelog:
  - This package should not own _mavendepmapfragdir (RHBZ#850005)
  - Build with maven, and clean up deprecated spec constructs
  - Fix pom file (See http://jira.codehaus.org/browse/MEV-592)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.1
changelog:
  - Fix tsig-request verify (CVE-2020-8622)
  - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
  - Correct update-policy type subdomain to match documentation (CVE-2020-8624)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.10
changelog:
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-23.P2
changelog:
  - Limit number of queries triggered by a request (CVE-2020-8616)
  - Fix invalid tsig request (CVE-2020-8617)


author: Tomas Krizek <tkrizek@redhat.com> - 11.1-1
changelog:
  - update to letest upstream version
  - resolves: #1393889 Rebase to bind-dyndb-ldap 11+
  - resolves: #1165796 bind-dyndb-ldap crashes if server is shutting down and connection to LDAP is down
  - resolves: #1413805 bind-dyndb-ldap default schema is shipped with syntax error


author: Petr Menšík <pemensik@redhat.com> - 11.1-6
changelog:
  - Bump BIND version and fix library dependecies
  - Rebuild for bind 9.11.3. Minor tweaks to compile.
  - Support for bind 9.11.5 headers


author: Nick Clifton <nickc@redhat.com> 2.27-41.base.1
changelog:
  - Stop the BFD library from complaining about multiple reloc sections for the same code section.  (#1755779)


author: Nick Clifton <nickc@redhat.com> - 2.27-41.base.3
changelog:
  - Allow the BFD library to handle the copying of files containing secondary reloc sections.  (#1804149)


author: Nick Clifton <nickc@redhat.com> 2.27-42.base
changelog:
  - Stop the BFD library from complaining about sections with multiple sets of relocations.  (#1749085)


author: Nick Clifton <nickc@redhat.com> - 2.27-43.base.1
changelog:
  - Allow the BFD library to handle the copying of files containing secondary reloc sections.  (#1804151)


author: Nick Clifton <nickc@redhat.com> 2.27-44.base
changelog:
  - Allow the BFD library to handle the copying of files which contain secondary reloc sections.  (#1785294)
  - Implement assembler workaround for Intel JCC microcode bug.  (#1778892)


author: Eric Sandeen <sandeen@redhat.com> - 1.0.5-7
changelog:
  - Add upstream cpu scalability patches (#1032368)
  - Remove "-k" option from manpage (#1300354)
  - Fix potential deadlock when calling stop_tracers (#1263189)


author: Don Zickus <dzickus@redhat.com> 5.41-1
changelog:
  - Update to 5.41
  - obexd fixes to prevent crashes
  - add /etc/bluetooth/main.conf config file
  Resolves: #1313363, #1336476, #1338895


author: David Arcari <darcari@redhat.com> 5.44-1
changelog:
  - Update to 5.44
  - Ship btattach tool
  - Configure systemctl settings for bluez-obex correctly
  - Add Provides: bluez-obexd
  Resolves: #1434581, #1401501


author: Josef Ridky <jridky@redhat.com> - 0:1.8.18-3
changelog:
  - Fix issues with warning: dereferencing type-punned pointer 
    will break strict-aliasing rules from RPMDiff


author: Pavel Cahyna <pcahyna@redhat.com> - 0:1.8.18-10
changelog:
  - Protect against negative values to memmove that caused
    "ipmitool sol activate" to crash against an IBM DataPower appliance
    (#1951480) and IP-131 Dayton blades in a SGI ICE-X (#2025519)
    Cherry-picked from upstream PR#78.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.18-11
changelog:
  - Add upstream ipmievd patch to check received msg id against expectation
    Fixes problem where SEL response is not recognized correctly
    when SEL request times out
    Resolves: rhbz#2224569


author: Boris Ranto <branto@redhat.com> - 0:1.8.15-7
changelog:
  - New release (0:1.8.15-7)
  - ID:437 - sel: Fix "sel time set <time>"
  - ID 408 - fix sel list last X listing


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.94.1.el7]
changelog:
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Florian Westphal) [2196159] {CVE-2023-32233}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.95.1.el7]
changelog:
  - perf/s390x: Align the register list to what we support (Michael Petlan) [2207745]
  - Revert "[tools] s390/perf: add perf register support for floating-point registers" (Michael Petlan) [2207745]
  - s390/perf: add perf_regs support and user stack dump (Michael Petlan) [2207745]
  - s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR (Tobias Huschle) [2212672]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1160.96.1.el7]
changelog:
  - sched/fair: Eliminate bandwidth race between throttling and distribution (Phil Auld) [2180681]
  - sched/fair: Fix race between runtime distribution and assignment (Phil Auld) [2180681]
  - sched/fair: Don't assign runtime for throttled cfs_rq (Phil Auld) [2180681]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.97.1.el7]
changelog:
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Davide Caratti) [2216982] {CVE-2023-35788}
  - netfilter: conntrack: re-fetch conntrack after insertion (Florian Westphal) [2188190]
  - netfilter: conntrack: handle tcp challenge acks during connection reuse (Florian Westphal) [2128262]
  - netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst (Florian Westphal) [2128262]
  - netfilter: conntrack: remove unneeded indent level (Florian Westphal) [2128262]
  - netfilter: conntrack: ignore overly delayed tcp packets (Florian Westphal) [2128262]
  - netfilter: conntrack: prepare tcp_in_window for ternary return value (Florian Westphal) [2128262]
  - netfilter: conntrack: connection timeout after re-register (Florian Westphal) [2128262]
  - netfilter: conntrack: always store window size un-scaled (Florian Westphal) [2128262]
  - netfilter: conntrack: work around exceeded receive window (Florian Westphal) [2128262]
  - netfilter: conntrack: avoid misleading 'invalid' in log message (Florian Westphal) [2128262]
  - netfilter: remove BUG_ON() after skb_header_pointer() (Florian Westphal) [2128262]
  - netfilter: nf_conntrack_tcp: re-init for syn packets only (Florian Westphal) [2128262]
  - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options (Florian Westphal) [2128262]
  - netfilter: conntrack: re-init state for retransmitted syn-ack (Florian Westphal) [2128262]
  - netfilter: conntrack: move synack init code to helper (Florian Westphal) [2128262]
  - netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state (Florian Westphal) [2128262]
  - netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options (Florian Westphal) [2128262]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.98.1.el7]
changelog:
  - GFS2: gfs2_dir_get_hash_table(): avoiding deferred vfree() is easy here... (Andrew Price) [2190450]
  - GFS2: use kvfree() instead of open-coding it (Andrew Price) [2190450]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.99.1.el7]
changelog:
  - x86/cpu/amd: Add a Zenbleed fix (Waiman Long) [2226841] {CVE-2023-20593}
  - x86/cpu/amd: Move the errata checking functionality up (Waiman Long) [2226841] {CVE-2023-20593}
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Waiman Long) [2226841] {CVE-2023-20593}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.100.1.el7]
changelog:
  - bnxt: count Tx drops (Jamie Bainbridge) [2175062]
  - bnxt: make sure xmit_more + errors does not miss doorbells (Jamie Bainbridge) [2175062]
  - netfilter: nf_tables: skip deactivated anonymous sets during lookups (Florian Westphal) [2196159] {CVE-2023-32233}
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Florian Westphal) [2196159]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.101.1.el7]
changelog:
  - cifs: fix a buffer leak in smb2_query_symlink (Jay Shin) [2166706]
  - kernfs: Improve kernfs_notify() poll notification latency (Ian Kent) [1703180]
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Florian Westphal) [2221720] {CVE-2023-35001}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.102.1.el7]
changelog:
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Davide Caratti) [2225486] {CVE-2023-3609}
  - NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION (Benjamin Coddington) [2219604]


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: genkey.patch
  -->  Debrand certs
  - Ran Regex: Red Hat Enterprise => Scientific
  -->  This RPM shouldn't say it is upstream's product
  - Added Source: debrand_taint_cpu.patch
  -->  Rename RHEL7 to SL7
  - Added Source: sl-ldup.x509
  -->  The FNAL SL signing certificate for driver updates
  - Added Source: kernel-spec_use_our_keys.patch
  -->  Remove the TUV keys and sign with ours
  - Added Source: kernel.ini
  -->  Config file for automated patch script
  - Added Source: sl-kpatch.x509
  -->  The FNAL SL signing certificate for kpatch updates
  - Added Source: fnal-sl.cer
  -->  The FNAL SL signing certificate
  - Added Source: kernel-spec_debrand_taint_cpu.patch
  -->  Apply our debrand patch


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.103.1.el7]
changelog:
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Davide Caratti) [2225555] {CVE-2023-3611}
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Davide Caratti) [2225555]
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225639] {CVE-2023-3776}
  - redhat: fix to be able to build with rpm 4.19.0 (Denys Vlasenko)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.104.1.el7]
changelog:
  - CI: Remove unused kpet_tree_family (Nikolai Kondrashov)
  - xen/x86: don't lose event interrupts (Vitaly Kuznetsov) [RHEL-1534]
  - Documentation/x86: Fix backwards on/off logic about YMM support (Waiman Long) [2229893] {CVE-2022-40982}
  - KVM: Add GDS_NO support to KVM (Waiman Long) [2229893] {CVE-2022-40982}
  - x86/speculation: Add Kconfig option for GDS (Waiman Long) [2229893] {CVE-2022-40982}
  - x86/speculation: Add force option to GDS mitigation (Waiman Long) [2229893] {CVE-2022-40982}
  - x86/speculation: Add Gather Data Sampling mitigation (Waiman Long) [2229893] {CVE-2022-40982}
  - Documentation/ABI: Mention retbleed vulnerability info file for sysfs (Waiman Long) [2229893]
  - docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed (Waiman Long) [2229893]
  - x86/speculation: Add missing srbds=off to the mitigations= help text (Waiman Long) [2229893]
  - x86: Sync Intel family names & cpu_vuln_blacklist[] with upstream (Waiman Long) [2229893]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.105.1.el7]
changelog:
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}
  - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.106.1.el7]
changelog:
  - gfs2: Fix quota=quiet oversight (Bob Peterson) [2196280]
  - gfs2: Free quota data objects synchronously (Andreas Gruenbacher) [2196280]
  - gfs2: Fix initial quota data refcount (Andreas Gruenbacher) [2196280]
  - gfs2: Factor out duplicate quota data disposal code (Andreas Gruenbacher) [2196280]
  - gfs2: Use gfs2_qd_dispose in gfs2_quota_cleanup (Andreas Gruenbacher) [2196280]
  - gfs2: Fix wrong quota shrinker return value (Andreas Gruenbacher) [2196280]
  - gfs2: ignore negated quota changes (Bob Peterson) [2196280]
  - gfs2: Introduce new quota=quiet mount option (Bob Peterson) [2196280]
  - gfs2: Add quota_change type (Bob Peterson) [2196280]
  - gfs2: Rename sd_{ glock => kill }_wait (Andreas Gruenbacher) [2196280]
  - gfs2: Wake up when sd_glock_disposal becomes zero (Alexander Aring) [2196280]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.107.1.el7]
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Phil Sutter) [RHEL-8433] {CVE-2023-42753}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.108.1.el7]
changelog:
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez) [RHEL-6302]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.3.1.el7]
changelog:
  - [net] net-sysfs: Call dev_hold always in rx_queue_add_kobject (Hangbin Liu) [1846454] {CVE-2019-20811}
  - [net] net-sysfs: Call dev_hold always in netdev_queue_add_kobject (Hangbin Liu) [1846454] {CVE-2019-20811}
  - [net] net-sysfs: call dev_hold if kobject_init_and_add success (Hangbin Liu) [1846454] {CVE-2019-20811}
  - [netdrv] macvlan: Change status when lower device goes down (Hangbin Liu) [1848950]
  - [netdrv] macvlan: make operstate and carrier more accurate (Hangbin Liu) [1848950]
  - [infiniband] RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah() (Kamal Heib) [1858707]
  - [infiniband] RDMA/ipoib: Return void from ipoib_ib_dev_stop() (Kamal Heib) [1858707]
  - [net] tcp: limit sk_write_qlen based on sndbuf size (Florian Westphal) [1847765]
  - [netdrv] net/mlx5e: Modify uplink state on interface up/down (Alaa Hleihel) [1733181]
  - [netdrv] net/mlx5: E-Switch, Disable esw manager vport correctly (Alaa Hleihel) [1733181]
  - [netdrv] net/mlx5: E-Switch, Properly refer to host PF vport as other vport (Alaa Hleihel) [1733181]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.4.1.el7]
changelog:
  - [block] virtio-blk: handle block_device_operations callbacks after hot unplug (Stefan Hajnoczi) [1811893]
  - [scsi] Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" (Nilesh Javali) [1826127]
  - [scsi] scsi: qla2xxx: Fix stale mem access on driver unload (Nilesh Javali) [1826127]
  - [scsi] scsi: qedf: Fix crash when MFW calls for protocol stats while function is still probing (Nilesh Javali) [1836443]
  - [scsi] scsi: qedf: Keep track of num of pending flogi (Nilesh Javali) [1836443]
  - [scsi] scsi: qedf: Fix race betwen fipvlan request and response path (Nilesh Javali) [1836443]
  - [scsi] scsi: qedf: Decrease the LL2 MTU size to 2500 (Nilesh Javali) [1836443]
  - [scsi] scsi: qedf: Check for module unloading bit before processing link update AEN (Nilesh Javali) [1836443]
  - [scsi] scsi: qedf: Initiator fails to re-login to switch after link down (Nilesh Javali) [1836443]
  - [scsi] scsi: qedf: Fix crash during sg_reset (Nilesh Javali) [1836443]
  - [scsi] scsi: qedf: Stop sending fipvlan request on unload (Nilesh Javali) [1836443]
  - [message] scsi: mptscsih: Fix read sense data size (Tomas Henzl) [1829803]
  - [scsi] scsi: megaraid_sas: Clear affinity hint (Tomas Henzl) [1828312]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.5.1.el7]
changelog:
  - [x86] x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs (Myron Stowe) [1849223]
  - [kernel] uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression (Oleg Nesterov) [1861396]
  - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859468] {CVE-2020-14331}
  - [pci] hv: Retry PCI bus D0 entry on invalid device state (Mohammed Gamal) [1846667]
  - [pci] hv: Fix the PCI HyperV probe failure path to release resource properly (Mohammed Gamal) [1846667]
  - [x86] xen: Add call of speculative_store_bypass_ht_init() to PV paths (Vladis Dronov) [1882468]
  - [powerpc] powerpc/smp: Use nid as fallback for package_id (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Add Power9 scheduler topology (Desnes Augusto Nunes do Rosario) [1826306]
  - [kernel] sched: Add a new SD_SHARE_POWERDOMAIN for sched_domain (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] sched, powerpc: Create a dedicated topology table (Desnes Augusto Nunes do Rosario) [1826306]
  - [s390] sched, s390: Create a dedicated topology table (Desnes Augusto Nunes do Rosario) [1826306]
  - [s390] s390/topology: Remove call to update_cpu_masks() (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Add cpu_l2_cache_map (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Rework CPU topology construction (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Use cpu_to_chip_id() to find core siblings (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc, hotplug: Avoid to touch non-existent cpumasks (Desnes Augusto Nunes do Rosario) [1826306]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.6.1.el7]
changelog:
  - [net] netfilter: nf_queue: place bridge physports into queue_entry struct (Florian Westphal) [1885682]
  - [net] netfilter: nf_queue: do not release refcouts until nf_reinject is done (Florian Westphal) [1885682]
  - [net] netfilter: nf_queue: make nf_queue_entry_release_refs static (Florian Westphal) [1885682]
  - [net] bluetooth: l2cap: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888253] {CVE-2020-12351}
  - [net] bluetooth: a2mp: Fix not initializing all members (Gopal Tiwari) [1888797] {CVE-2020-12352}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.7.1.el7]
changelog:
  - [fs] xfs: fix off-by-one in inode alloc block reservation calculation (Brian Foster) [1857203]
  - [fs] xfs: fix inode allocation block res calculation precedence (Brian Foster) [1857203]
  - [powerpc] powernv/dump: Handle multiple writes to ack attribute (Gustavo Duarte) [1873189]
  - [powerpc] powernv/dump: Fix race while processing OPAL dump (Gustavo Duarte) [1873189]
  - [powerpc] powernv: opal-dump: Use IRQ_HANDLED instead of numbers in interrupt handler (Gustavo Duarte) [1873189]
  - [powerpc] opal_elog: Handle multiple writes to ack attribute (Gustavo Duarte) [1873189]
  - [powerpc] powernv/elog: Fix race while processing OPAL error log event (Gustavo Duarte) [1873189]
  - [powerpc] powernv Adapt opal-elog and opal-dump to new sysfs_remove_file_self (Gustavo Duarte) [1873189]
  - [powerpc] powernv: Fix opal-elog interrupt handler (Gustavo Duarte) [1873189]
  - [net] flow_dissector: switch to siphash (Davide Caratti) [1835614] {CVE-2019-18282}
  - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1875317] {CVE-2020-14385}
  - [fs] cifs: make 'nodfs' mount opt a superblock flag (Leif Sahlberg) [1873033]
  - [crypto] crypto: authenc - fix parsing key with misaligned rta_len (Herbert Xu) [1846355] {CVE-2020-10769}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.8.1.el7]
changelog:
  - [kernel] sched/fair: Fix RCU stall upon -ENOMEM in sched_create_group() (Kenneth Yin) [1878000]
  - [security] selinux: do not report error on connect(AF_UNSPEC) (Paolo Abeni) [1886305]
  - [kernel] timer: Fix lockup in __run_timers() caused by large jiffies/timer_jiffies delta (Waiman Long) [1849716]
  - [mm] revert "mm/page_alloc: fix memmap_init_zone pageblock alignment" (Artem Savkov) [1878732]
  - [mm] page_alloc: Make paranoid check in move_freepages a VM_BUG_ON (Artem Savkov) [1878732]
  - [nvme] rdma: Avoid double freeing of async event data (Gopal Tiwari) [1878950]
  - [pci] hv: Fix a timing issue which causes kdump to fail occasionally (Mohammed Gamal) [1846667]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.9.1.el7]
changelog:
  - [hv] hv: vmbus: Only notify Hyper-V for die events that are oops (Vitaly Kuznetsov) [1868130]
  - [uapi] include: do not export changes made to struct ip_ct_sctp (Florian Westphal) [1887975]
  - [net] openvswitch: free vport unless register_netdevice() succeeds (Timothy Redaelli) [1869190]
  - [net] openvswitch: do not free vport if register_netdevice() is failed (Timothy Redaelli) [1869190]
  - [kernel] signals: avoid random wakeups in sigsuspend() (Oleg Nesterov) [1704650]
  - [fs] nfs: Fix getxattr kernel panic and memory overflow (Benjamin Coddington) [1880893] {CVE-2020-25212}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.10.1.el7]
changelog:
  - [md] dm-mirror: provide the merge method (Mikulas Patocka) [1890059]
  - [nvme] nvme-rdma: cancel async events before freeing event struct (David Milburn) [1857397]
  - [s390] dasd: Use struct_size() helper (Sterling Alexander) [1886477]
  - [s390] dasd: fix inability to use DASD with DIAG driver (Sterling Alexander) [1886477]
  - [hv] hv_utils: drain the timesync packets on onchannelcallback (Vitaly Kuznetsov) [1884735]
  - [hv] hv_utils: return error if host timesysnc update is stale (Vitaly Kuznetsov) [1884735]
  - [x86] cpu: Re-apply forced caps every time CPU caps are re-read (Herbert Xu) [1886792]
  - [x86] cpu: Factor out application of forced CPU caps (Herbert Xu) [1886792]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.11.1.el7]
changelog:
  - [netdrv] hdlc_ppp: add range checks in ppp_cp_parse_cr() (Guillaume Nault) [1882078] {CVE-2020-25643}
  - [fs] ext4: fix potential negative array index in do_split() (Pavel Reichl) [1846164] {CVE-2020-14314}
  - [fs] nfsd: apply umask on fs without ACL support ("J. Bruce Fields") [1870215] {CVE-2020-24394}
  - [kernel] watchdog/core: Remove the park_in_progress obfuscation (Waiman Long) [1860661]
  - [mm] swap_slots: recheck cache->slots_ret under spin_lock_irq() protection (Rafael Aquini) [1862915]
  - [netdrv] ethernet: i40e: Set RX_ONLY mode for unicast promiscuous on VLAN (Stefan Assmann) [1845677]
  - [infiniband] mlx5: Fix use-after-free in dereg_mr() (Alaa Hleihel) [1880184]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.12.1.el7]
changelog:
  - [mm] mmap: relax file size limit for regular files (Rafael Aquini) [1855985]
  - [mm] mmap: introduce sane default mmap limits (Rafael Aquini) [1855985]
  - [of] Move dynamic node fixups out of powerpc and into common code (Laurent Vivier) [1866138]
  - [fs] nfs: Fix double-free in filelayout_alloc_commit_info/filelayout_free_lseg (Benjamin Coddington) [1679980]
  - [hid] HID: hid-plantronics: Re-resend Update to map button for PTT products (Torez Smith) [1769502]
  - [fs] dlm: make posix locks interruptible (Alexander Aring) [1826858]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.13.1.el7]
changelog:
  - [s390] zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl (Philipp Rudo) [1896826]
  - [block] block/diskstats: more accurate approximation of io_ticks for slow disks (Ming Lei) [1859364]
  - [block] block: delete part_round_stats and switch to less precise counting (Ming Lei) [1859364]
  - [md] dm: simplify start of block stats accounting for bio-based (Ming Lei) [1859364]
  - [block] block/rsxx: use generic io stats accounting functions to simplify io stat accounting (Ming Lei) [1859364]
  - [block] drbd: use generic io stats accounting functions to simplify io stat accounting (Ming Lei) [1859364]
  - [md] md: use generic io stats accounting functions to simplify io stat accounting (Ming Lei) [1859364]
  - [nvme] limit number of IO queues on Dell/Kioxia config (Gopal Tiwari) [1883403]
  - [netdrv] hv_netvsc: make recording RSS hash depend on feature flag (Mohammed Gamal) [1898280]
  - [netdrv] hv_netvsc: record hardware hash in skb (Mohammed Gamal) [1898280]
  - [fs] block: Fix use-after-free in blkdev_get() (Ming Lei) [1902414] {CVE-2020-15436}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.14.1.el7]
changelog:
  - [fs] nfsd: fix incorrect umasks ("J. Bruce Fields") [1905208]
  - [hv] vmbus: Add timeout to vmbus_wait_for_unload (Mohammed Gamal) [1888979]
  - [scsi] qla2xxx: Fix device loss on 4G and older HBAs (Nilesh Javali) [1889311]
  - [s390] dasd: Fix zero write for FBA devices (Philipp Rudo) [1896839]
  - [net] ipv6: use in6_dev_put in dad timer handler instead of __in6_dev_put (Xin Long) [1809519]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.15.1.el7]
changelog:
  - [fs] ceph: quota: fix null pointer dereference in quota check (Jeff Layton) [1890386]
  - [netdrv] revert "mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query" (Alaa Hleihel) [1896756]
  - [kernel] timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion (Waiman Long) [1890911]
  - [kernel] exit: Optimize forget_original_parent() for large thread group exiting (Waiman Long) [1872110]
  - [kernel] exit: reparent: call forget_original_parent() under tasklist_lock (Waiman Long) [1872110]
  - [kernel] Disable tasklist_waiters when qrwlock is enabled (Waiman Long) [1872110]
  - [fs] cifs: handle ERRBaduid for SMB1 (Leif Sahlberg) [1847041]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.16.1.el7]
changelog:
  - [tty] Fix ->pgrp locking in tiocspgrp() (Chris von Recklinghausen) [1908193] {CVE-2020-29661}
  - [net] fix struct pid memory leak (Jay Shin) [1901797]
  - [hid] Fix assumption that devices have inputs (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] microsoft: the driver now neeed MEMLESS_FF infrastructure (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] microsoft: Add rumble support for Xbox One S controller (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] microsoft: Convert private data to be a proper struct (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] revert "hid: microsoft: fix invalid rdesc for 3k kbd" (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] input: ignore System Control application usages if not System Controls (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] hid-microsoft: Do the check for the ms usage page per device (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [net] net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc (Antoine Tenart) [1903819]
  - [net] net-sysfs: take the rtnl lock when storing xps_cpus (Antoine Tenart) [1903819]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.17.1.el7]
changelog:
  - [x86] kvm: svm: Initialize prev_ga_tag before use ("Dr. David Alan Gilbert") [1909036]
  - [scsi] scsi_dh: fix scheduling while atomic and also missing unlock in error path (Mike Snitzer) [1619147]
  - [video] hyperv_fb: Fix the cache type when mapping the VRAM (Mohammed Gamal) [1908896]
  - [video] hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver (Mohammed Gamal) [1908896]
  - [scsi] target: iscsi: Fix cmd abort fabric stop race (Maurizio Lombardi) [1784540]
  - [scsi] target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock (Maurizio Lombardi) [1784540]
  - [s390] kernel/uv: handle length extension properly (Claudio Imbrenda) [1899172]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.18.1.el7]
changelog:
  - [fs] nfs: Fix security label length not being reset (Dave Wysochanski) [1917504]
  - [target] scsi: Fix XCOPY NAA identifier lookup (Maurizio Lombardi) [1900469] {CVE-2020-28374}
  - [ipc] sem.c: fully initialize sem_array before making it visible (Vladis Dronov) [1877264]
  - [netdrv] geneve: add transport ports in route lookup for geneve (Sabrina Dubroca) [1885144] {CVE-2020-25645}
  - [kernel] perf/core: Fix race in the perf_mmap_close() function (Michael Petlan) [1869936] {CVE-2020-14351}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.19.1.el7]
changelog:
  - [kernel] watchdog: use nmi registers snapshot in hardlockup handler (Prarit Bhargava) [1916589]
  - [nvme] nvmet: allow Keep Alive for Discovery controller (Gopal Tiwari) [1910817]
  - [net] netfilter: ctnetlink: add a range check for l3/l4 protonum (Florian Westphal) [1888296] {CVE-2020-25211}
  - [net] icmp: randomize the global rate limiter (Antoine Tenart) [1896515] {CVE-2020-25705}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.20.1.el7]
changelog:
  - [md] Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1889372]
  - [md] improve variable names in md_flush_request() (Xiao Ni) [1889372]
  - [kernel] timer: Fix potential bug in requeue_timers() (Waiman Long) [1914011]
  - [x86] kvm: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits (Vitaly Kuznetsov) [1890669]
  - [x86] kvm: avoid incorrect writes to host MSR_IA32_SPEC_CTRL (Vitaly Kuznetsov) [1890669]
  - [md] dm-mirror: fix a crash if the underlying block device doesn't have merge_bvec_fn (Mikulas Patocka) [1916407]
  - [gpu] drm/i915: Fix use-after-free when destroying GEM context (Dave Airlie) [1814731] {CVE-2020-7053}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.21.1.el7]
changelog:
  - [pinctrl] devicetree: Avoid taking direct reference to device name string (Aristeu Rozanski) [1922902] {CVE-2020-0427}
  - [pinctrl] Delete an error message (Aristeu Rozanski) [1922902] {CVE-2020-0427}
  - [tty] vt: keyboard, reorder user buffer handling in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, rename i to kb_func in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, extend func_buf_lock to readers (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, simplify vt_kdgkbsent (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] keyboard, do not speculate on func_table index (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: fix write/write race in ioctl(KDSKBSENT) handler (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [iommu] amd: return error on real irq alloc failure (Jerry Snitselaar) [1918273]
  - [iommu] amd: Set DTE[IntTabLen] to represent 512 IRTEs (Jerry Snitselaar) [1921187]
  - [iommu] amd: Increase interrupt remapping table limit to 512 entries (Jerry Snitselaar) [1921187]
  - [scsi] lpfc: Fix LUN loss after cable pull (Dick Kennedy) [1875961]
  - [scsi] lpfc: Fix NVMe rport deregister and registration during ADISC (Dick Kennedy) [1875961]
  - [scsi] lpfc: Fix ADISC reception terminating login state if a NVME target (Dick Kennedy) [1875961]
  - [netdrv] i40e: revert "i40e: don't report link up for a VF who hasn't enabled queues" (Stefan Assmann) [1901064]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.22.1.el7]
changelog:
  - mm: do not stall register_shrinker() (Rafael Aquini) [1926043]
  - sched/rt: Fix PI handling vs. sched_setscheduler() (Phil Auld) [1928082]
  - sched/rt: Simplify pull_rt_task() logic and remove .leaf_rt_rq_list (Phil Auld) [1928082]
  - sched: Queue RT tasks to head when prio drops (Phil Auld) [1928082]
  - sched/core: Use READ_ONCE()/WRITE_ONCE() in move_queued_task()/task_rq_lock() (Phil Auld) [1928082]
  - mmc: block: handle complete_work on separate workqueue (Ming Lei) [1918916]
  - tcp: fix to update snd_wl1 in bulk receiver fast path (Vladis Dronov) [1929804]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.23.1.el7]
changelog:
  - tcm_loop: add WQ_MEM_RECLAIM and flush_work (Maurizio Lombardi) [1925652]
  - net/mlx4_en: Handle TX error CQE (Alaa Hleihel) [1925691]
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Alaa Hleihel) [1925691]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.24.1.el7]
changelog:
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930826] {CVE-2021-27365}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930849] {CVE-2021-27363}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930807] {CVE-2021-27364}
  - redhat: add CI file for kernel-private (Bruno Meneguele)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.25.1.el7]
changelog:
  - redhat: Enable CKI RT verification for kernel-private (Juri Lelli)
  - redhat: Enable CKI RT verification (Juri Lelli)
  - RDMA/ipoib: Remove racy Subnet Manager sendonly join checks (Honggang Li) [1922460]
  - net: sched: protect against stack overflow in TC act_mirred (Davide Caratti) [1916682]
  - floppy: check_events callback should not return a negative number (Jay Shin) [1928576]
  - floppy: fix lock_fdc() signal handling (Jay Shin) [1928576]
  - ipv6: clean up anycast when an interface is destroyed (Xin Long) [1917700]
  - virtio_net: fix virtnet_open and virtnet_probe competing for try_fill_recv (Laurent Vivier) [1895319]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.26.1.el7]
changelog:
  - selinux: fix deadlock in security_set_bools() (Ondrej Mosnacek) [1939091]
  - md: fix md io stats accounting broken (Ming Lei) [1927106]
  - redhat: Fix realtime_check for -private (Juri Lelli)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.27.1.el7]
changelog:
  - video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host (Mohammed Gamal) [1941841]
  - Drivers: hv: vmbus: enable VMBus protocol version 5.0 (Mohammed Gamal) [1941841]
  - redhat: Add git suffix to realtime_check merge_tree (Juri Lelli)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.28.1.el7]
changelog:
  - i40e: acquire VSI pointer only after VF is initialized (Stefan Assmann) [1886003]
  - ACPICA: Store GPE register enable masks upfront (Al Stone) [1883174]
  - netfilter: nf_tables: validate NFTA_SET_TABLE parameter (Phil Sutter) [1873171]
  - sctp: change to hold/put transport for proto_unreach_timer (Xin Long) [1707184]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.29.1.el7]
changelog:
  - drm/i915: warn on guc enable about CVE (Dave Airlie) [1935277] {CVE-2020-12362}
  - sched: prevent divide by zero error in scale_rt_power() (Phil Auld) [1910763]
  - x86/efi: reset the correct tlb_state in efi_switch_mm() (Rafael Aquini) [1837531]
  - x86/mm, sched/core: Turn off IRQs in switch_mm() (Rafael Aquini) [1837531]
  - x86/mm, sched/core: Uninline switch_mm() (Rafael Aquini) [1837531]
  - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Rafael Aquini) [1837531]
  - hpsa: fix regression issue for old controllers (Joseph Szczypek) [1830268]
  - scsi: hpsa: Correct dev cmds outstanding for retried cmds (Joseph Szczypek) [1830268]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.30.1.el7]
changelog:
  - pf: Prohibit alu ops for pointer types not defining ptr_limit (Jiri Olsa) [1942689] {CVE-2020-27170}
  - bpf: Add sanity check for upper ptr_limit (Jiri Olsa) [1942689] {CVE-2020-27170}
  - bpf: Simplify alu_limit masking for pointer arithmetic (Jiri Olsa) [1942689] {CVE-2020-27170}
  - bpf: Fix off-by-one for area size in creating mask to left (Jiri Olsa) [1942689] {CVE-2020-27170}
  - netxen_nic: fix MSI/MSI-x interrupts (Tony Camuso) [1894274]
  - block: fix use-after-free on cached last_lookup partition (Ming Lei) [1898596]
  - mm: reduce struct page_cgroup overhead when page_owner is not enabled (Rafael Aquini) [1948451]
  - vt: selection, close sel_buffer race (Chris von Recklinghausen) [1831034] {CVE-2020-8648}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.31.1.el7]
changelog:
  - mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() (Philipp Rudo) [1917840]
  - scsi: qla2xxx: Fix the call trace for flush workqueue (Nilesh Javali) [1937945]
  - futex: Handle faults correctly for PI futexes (Donghai Qiao) [1935108] {CVE-2021-3347}
  - futex: Provide and use pi_state_update_owner() (Donghai Qiao) [1935108] {CVE-2021-3347}
  - futex: Replace pointless printk in fixup_owner() (Donghai Qiao) [1935108] {CVE-2021-3347}
  - futex: Ensure the correct return value from futex_lock_pi() (Donghai Qiao) [1935108] {CVE-2021-3347}
  - scsi: qla2xxx: Remove WARN_ON_ONCE in qla2x00_status_cont_entry() (Nilesh Javali) [1933784]
  - scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path (Philipp Rudo) [1917839]
  - net: netfilter: Avoid deadlock when loading logger backend (Phil Sutter) [1858329]
  - net: netfilter: Link nfnetlink into bzImage (Phil Sutter) [1858329]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.32.1.el7]
changelog:
  - Bluetooth: verify AMP hci_chan before amp_destroy (Gopal Tiwari) [1962532] {CVE-2021-33034}
  - net: ipv4: route: Fix sending IGMP messages with link address (Hangbin Liu) [1958339]
  - hv_netvsc: remove ndo_poll_controller (Mohammed Gamal) [1953075]
  - Fix double free in nvme_trans_log_temperature (Gopal Tiwari) [1946793]
  - rcu: Call touch_nmi_watchdog() while printing stall warnings (Artem Savkov) [1924688]
  - sched/fair: Use RCU accessors consistently for ->numa_group (Rafael Aquini) [1915635] {CVE-2019-20934}
  - sched/fair: Don't free p->numa_faults with concurrent readers (Rafael Aquini) [1915635] {CVE-2019-20934}
  - sched/numa: Simplify task_numa_compare() (Rafael Aquini) [1915635] {CVE-2019-20934}
  - sched/numa: Fix task_numa_free() lockdep splat (Rafael Aquini) [1915635] {CVE-2019-20934}
  - sched/numa: Move task_numa_free() to __put_task_struct() (Rafael Aquini) [1915635] {CVE-2019-20934}
  - [s390] s390/dasd: fix diag 0x250 inline assembly (Philipp Rudo) [1910395]
  - vsock/vmci: log once the failed queue pair allocation (Stefano Garzarella) [1892237]
  - VMCI: Stop log spew when qp allocation isn't possible (Stefano Garzarella) [1892237]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.33.1.el7]
changelog:
  - CI: Disable result checking for realtime check (Veronika Kabatova)
  - CI: Explicitly disable result checking for private CI (Veronika Kabatova)
  - CI: Rename variable (Veronika Kabatova)
  - mm: memcontrol: switch to rcu protection in drain_all_stock() (Waiman Long) [1957719]
  - sctp: Don't add the shutdown timer if its already been added (Xin Long) [1953052]
  - media: xirlink_cit: add missing descriptor sanity checks (Mark Langsdorf) [1826877] {CVE-2020-11668}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.34.1.el7]
changelog:
  - futex: remove lockdep_assert_held() in pi_state_update_owner() (Donghai Qiao) [1965495]
  - video: hyperv_fb: Add ratelimit on error message (Mohammed Gamal) [1957803]
  - Drivers: hv: vmbus: Increase wait time for VMbus unload (Mohammed Gamal) [1957803]
  - Drivers: hv: vmbus: Initialize unload_event statically (Mohammed Gamal) [1957803]
  - blk-mq: always allow reserved allocation in hctx_may_queue (Ming Lei) [1926825]
  - s390/pci: fix out of bounds access during irq setup (Philipp Rudo) [1917943]
  - s390/pci: improve irq number check for msix (Philipp Rudo) [1917943]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.35.1.el7]
changelog:
  - CI: Merge configuration (Veronika Kabatova)
  - [pci/aer] Work around use-after-free in pcie_do_fatal_recovery() (Al Stone) [1933663]
  - [pci/aer] do not invoke error recovery with non-fatal errors (Al Stone) [1933663]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.36.1.el7]
changelog:
  - cipso,calipso: resolve a number of problems with the DOI refcounts (Antoine Tenart) [1967720]
  - net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() (Alaa Hleihel) [1962406]
  - sched/debug: Fix cgroup_path[] serialization (Waiman Long) [1912221]
  - sched/debug: Reset watchdog on all CPUs while processing sysrq-t (Waiman Long) [1912221]
  - vt: vt_ioctl: fix use-after-free in vt_in_use() (Vladis Dronov) [1872778]
  - vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console (Vladis Dronov) [1872778]
  - vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines (Vladis Dronov) [1872778]
  - vt: selection, introduce vc_is_sel (Vladis Dronov) [1872778]
  - redhat: genspec: generate changelog entries since last release (Augusto Caringi)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.37.1.el7]
changelog:
  - bluetooth: eliminate the potential race condition when removing the HCI controller (Gopal Tiwari) [1971457]
  - net: Update window_clamp if SOCK_RCVBUF is set (Balazs Nemeth) [1962196]
  - bpf, x86: Validate computation of branch displacements for x86-64 (Jiri Olsa) [1947249] {CVE-2021-29154}
  - mm: vmalloc: add cond_resched() in __vunmap() (Rafael Aquini) [1896794]
  - mm/vmalloc: __vmalloc_area_node(): avoid 32-bit overflow (Rafael Aquini) [1896794]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.38.1.el7]
changelog:
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975251]
  - memcg, slab: Fix incorrect placement of rcu_head in struct memcg_cache_params (Waiman Long) [1951810]
  - netfilter: x_tables: Use correct memory barriers. (Phil Sutter) [1949087] {CVE-2021-29650}
  - netfilter: nf_nat: don't bug when mapping already exists (Florian Westphal) [1972970]
  - netfilter: don't setup nat info for confirmed ct (Florian Westphal) [1972970]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.39.1.el7]
changelog:
  - netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal) [1980489] {CVE-2021-22555}
  - Revert "be2net: disable bh with spin_lock in be_process_mcc" (Petr Oros) [1971744]
  - futex: futex_requeue can potentially free the pi_state structure twice (Donghai Qiao) [1966856]
  - xfs: sync lazy sb accounting on quiesce of read-only mounts (Carlos Maiolino) [1921551]
  - scsi: lpfc: Fix crash caused by switch reboot (Dick Kennedy) [1897576]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.40.1.el7]
changelog:
  - redhat: ppc64: CONFIG_RTAS_FILTER (Aristeu Rozanski) [1906443] {CVE-2020-27777}
  - powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter (Aristeu Rozanski) [1906443] {CVE-2020-27777}
  - powerpc/rtas: Restrict RTAS requests from userspace (Aristeu Rozanski) [1906443] {CVE-2020-27777}
  - IB/mlx5: Fix initializing CQ fragments buffer (Alaa Hleihel) [1962499]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.42.1.el7]
changelog:
  - [s390] s390/dasd: fix list corruption of lcu list (Claudio Imbrenda) [1889418]
  - [s390] s390/dasd: fix list corruption of pavgroup group list (Claudio Imbrenda) [1889418]
  - [s390] s390/dasd: prevent inconsistent LCU device data (Claudio Imbrenda) [1889418]
  - [s390] s390/dasd: fix hanging device offline processing (Claudio Imbrenda) [1889418]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.43.1.el7]
changelog:
  - PCI: hv: Add support for protocol 1.3 and support PCI_BUS_RELATIONS2 (Mohammed Gamal) [1984128]
  - PCI: hv: Decouple the func definition in hv_dr_state from VSP message (Mohammed Gamal) [1984128]
  - PCI: hv: Only queue new work items in hv_pci_devices_present() if necessary (Mohammed Gamal) [1984128]
  - i40e: improve locking of mac_filter_hash (Stefan Assmann) [1993850]
  - i40e: always propagate error value in i40e_set_vsi_promisc() (Stefan Assmann) [1993850]
  - i40e: fix return of uninitialized aq_ret in i40e_set_vsi_promisc (Stefan Assmann) [1993850]
  - i40e: Remove scheduling while atomic possibility (Stefan Assmann) [1993850]
  - scsi: lpfc: Fix pt2pt discovery on SLI3 HBAs (Dick Kennedy) [1922479]
  - qed: Disable "MFW indication via attention" SPAM every 5 minutes (Manish Chopra) [1854544]
  - NFS: Fix a performance regression caused by buffered IO locking (Benjamin Coddington) [1995649]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.44.1.el7]
changelog:
  - fs: dlm: change handling of reconnects (Bob Peterson) [1834878]
  - DLM: fix NULL pointer dereference in send_to_sock() (Bob Peterson) [1834878]
  - DLM: fix to reschedule rwork (Bob Peterson) [1834878]
  - DLM: fix to use sk_callback_lock correctly (Bob Peterson) [1834878]
  - DLM: fix overflow dlm_cb_seq (Bob Peterson) [1834878]
  - DLM: fix conversion deadlock when DLM_LKF_NODLCKWT flag is set (Bob Peterson) [1834878]
  - DLM: use CF_CLOSE flag to stop dlm_send correctly (Bob Peterson) [1834878]
  - DLM: Reanimate CF_WRITE_PENDING flag (Bob Peterson) [1834878]
  - DLM: fix race condition between dlm_recoverd_stop and dlm_recoverd (Bob Peterson) [1834878]
  - DLM: close othercon at send/receive error (Bob Peterson) [1834878]
  - DLM: retry rcom when dlm_wait_function is timed out. (Bob Peterson) [1834878]
  - DLM: fix to use sock_mutex correctly in xxx_accept_from_sock (Bob Peterson) [1834878]
  - DLM: fix race condition between dlm_send and dlm_recv (Bob Peterson) [1834878]
  - DLM: fix double list_del() (Bob Peterson) [1834878]
  - DLM: Eliminate CF_WRITE_PENDING flag (Bob Peterson) [1834878]
  - KVM: do not allow mapping valid but non-reference-counted pages (Jon Maloy) [1975511]
  - vxlan: check return value of gro_cells_init() (Aristeu Rozanski) [1970618]
  - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow (Jon Maloy) [1988218] {CVE-2021-37576}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.45.1.el7]
changelog:
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - mm: page_counter: mitigate consequences of a page_counter underflow (Scott Wood) [2000973]
  - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested(CVE-2021-3656) (Jon Maloy) [1985425] {CVE-2021-3656}
  - KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted (Marcelo Tosatti) [1991856]
  - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Jon Maloy) [1985408] {CVE-2021-3653}
  - scsi: qedf: Initiate cleanup for ELS commands as well (Nilesh Javali) [1982702]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.46.1.el7]
changelog:
  - RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy (Kamal Heib) [1978075] {CVE-2020-36385}
  - RDMA/ucma: Fix locking for ctx->events_reported (Kamal Heib) [1978075] {CVE-2020-36385}
  - RDMA/ucma: Fix the locking of ctx->file (Kamal Heib) [1978075] {CVE-2020-36385}
  - RDMA/cma: Add missing locking to rdma_accept() (Kamal Heib) [1978075] {CVE-2020-36385}
  - RDMA/ucma: Add missing locking around rdma_leave_multicast() (Kamal Heib) [1978075] {CVE-2020-36385}
  - RDMA/ucma: Put a lock around every call to the rdma_cm layer (Kamal Heib) [1978075] {CVE-2020-36385}
  - nvme-pci: Unblock reset_work on IO failure (Gopal Tiwari) [1981610]
  - nvme-pci: Don't disable on timeout in reset state (Gopal Tiwari) [1981610]
  - nvme-pci: shutdown on timeout during deletion (Gopal Tiwari) [1981610]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.47.1.el7]
changelog:
  - PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus (Mohammed Gamal) [1948961]
  - PCI: hv: Remove bus device removal unused refcount/functions (Mohammed Gamal) [1948961]
  - PCI: hv: Fix a race condition when removing the device (Mohammed Gamal) [1948961]
  - scsi: qla2xxx: Fix use after free in eh_abort path (Nilesh Javali) [1899599]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.48.1.el7]
changelog:
  - scsi: qedf: Add check to synchronize abort and flush (Nilesh Javali) [1941766]
  - scsi: ibmvfc: Reinit target retries (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: Avoid move login if fast fail is enabled (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: Handle move login failure (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: Avoid link down on FS9100 canister reboot (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: don't check for failure from mempool_alloc() (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: Use compiler attribute defines instead of __attribute__() (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info (Desnes A. Nunes do Rosario) [1882627]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.50.1.el7]
changelog:
  - tcp: grow window for OOO packets only for SACK flows (Guillaume Nault) [1990665]
  - scsi: mpt3sas: Fix unlock imbalance (Tomas Henzl) [2006536]
  - pci-hyperv: Fix setting CPU affinity on Azure (Vitaly Kuznetsov) [2019272]
  - media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() (Lucas Zampieri) [1956471] {CVE-2021-42739}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.51.1.el7]
changelog:
  - mm, fs: Fix do_generic_file_read() error return (Carlos Maiolino) [2020857]
  - perf/core: Fix a memory leak in perf_event_parse_addr_filter() (Michael Petlan) [1901932]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.52.1.el7]
changelog:
  - acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (David Arcari) [2019588]
  - x86/cpu/amd: Call init_amd_zn() om Family 19h processors too (David Arcari) [2019218]
  - x86/cpu/AMD: Fix erratum 1076 (CPB bit) (David Arcari) [2019218]
  - i40e: Fix the conditional for i40e_vc_validate_vqs_bitmaps (Stefan Assmann) [1977246]
  - i40e: Fix virtchnl_queue_select bitmap validation (Stefan Assmann) [1977246]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.53.1.el7]
changelog:
  - fuse: fix live lock in fuse_iget() (Miklos Szeredi) [1952046]
  - fuse: fix bad inode (Miklos Szeredi) [1952046]
  - GFS2: Truncate address space mapping when deleting an inode (Bob Peterson) [1364234]
  - gfs2: Fix gfs2_testbit to use clone bitmaps (Bob Peterson) [1364234]
  - gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps (Bob Peterson) [1364234]
  - gfs2: Fix oversight in gfs2_ail1_flush (Bob Peterson) [1364234]
  - gfs2: Additional information when gfs2_ail1_flush withdraws (Bob Peterson) [1364234]
  - gfs2: leaf_dealloc needs to allocate one more revoke (Bob Peterson) [1364234]
  - gfs2: allow journal replay to hold sd_log_flush_lock (Bob Peterson) [1364234]
  - gfs2: don't allow releasepage to free bd still used for revokes (Bob Peterson) [1364234]
  - gfs2: flesh out delayed withdraw for gfs2_log_flush (Bob Peterson) [1364234]
  - gfs2: Do proper error checking for go_sync family of glops functions (Bob Peterson) [1364234]
  - gfs2: drain the ail2 list after io errors (Bob Peterson) [1364234]
  - gfs2: Withdraw in gfs2_ail1_flush if write_cache_pages fails (Bob Peterson) [1364234]
  - gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty (Bob Peterson) [1364234]
  - gfs2: Check for log write errors before telling dlm to unlock (Bob Peterson) [1364234]
  - gfs2: Prepare to withdraw as soon as an IO error occurs in log write (Bob Peterson) [1364234]
  - gfs2: Issue revokes more intelligently (Bob Peterson) [1364234]
  - gfs2: Add verbose option to check_journal_clean (Bob Peterson) [1364234]
  - gfs2: fix infinite loop when checking ail item count before go_inval (Bob Peterson) [1364234]
  - gfs2: Force withdraw to replay journals and wait for it to finish (Bob Peterson) [1364234]
  - gfs2: Allow some glocks to be used during withdraw (Bob Peterson) [1364234]
  - gfs2: move check_journal_clean to util.c for future use (Bob Peterson) [1364234]
  - gfs2: Ignore dlm recovery requests if gfs2 is withdrawn (Bob Peterson) [1364234]
  - gfs2: Only complain the first time an io error occurs in quota or log (Bob Peterson) [1364234]
  - gfs2: log error reform (Bob Peterson) [1364234]
  - gfs2: Rework how rgrp buffer_heads are managed (Bob Peterson) [1364234]
  - gfs2: clear ail1 list when gfs2 withdraws (Bob Peterson) [1364234]
  - gfs2: Introduce concept of a pending withdraw (Bob Peterson) [1364234]
  - gfs2: Return bool from gfs2_assert functions (Bob Peterson) [1364234]
  - gfs2: Turn gfs2_consist into void functions (Bob Peterson) [1364234]
  - gfs2: Remove usused cluster_wide arguments of gfs2_consist functions (Bob Peterson) [1364234]
  - gfs2: Report errors before withdraw (Bob Peterson) [1364234]
  - gfs2: Split gfs2_lm_withdraw into two functions (Bob Peterson) [1364234]
  - gfs2: Fix incorrect variable name (Bob Peterson) [1364234]
  - gfs2: Don't write log headers after file system withdraw (Bob Peterson) [1364234]
  - gfs2: clean up iopen glock mess in gfs2_create_inode (Bob Peterson) [1364234]
  - gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS (Bob Peterson) [1364234]
  - gfs2: fix infinite loop in gfs2_ail1_flush on io error (Bob Peterson) [1364234]
  - gfs2: Introduce function gfs2_withdrawn (Bob Peterson) [1364234]
  - gfs2: replace more printk with calls to fs_info and friends (Bob Peterson) [1364234]
  - gfs2: dump fsid when dumping glock problems (Bob Peterson) [1364234]
  - gfs2: simplify gfs2_freeze by removing case (Bob Peterson) [1364234]
  - gfs2: Rename SDF_SHUTDOWN to SDF_WITHDRAWN (Bob Peterson) [1364234]
  - gfs2: Warn when a journal replay overwrites a rgrp with buffers (Bob Peterson) [1364234]
  - gfs2: log which portion of the journal is replayed (Bob Peterson) [1364234]
  - gfs2: slow the deluge of io error messages (Bob Peterson) [1364234]
  - gfs2: Don't withdraw under a spin lock (Bob Peterson) [1364234]
  - GFS2: Clear gl_object when deleting an inode in gfs2_delete_inode (Bob Peterson) [1364234]
  - gfs2: Use fs_* functions instead of pr_* function where we can (Bob Peterson) [1364234]
  - GFS2: Use pr_<level> more consistently (Bob Peterson) [1364234]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.54.1.el7]
changelog:
  - block: queue lock must be acquired when iterating over rls (Ming Lei) [2029574]
  - Bluetooth: use correct lock to prevent UAF of hdev object (Chris von Recklinghausen) [1968211] {CVE-2021-3573}
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Carlos Maiolino) [2034857] {CVE-2021-4155}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.55.1.el7]
changelog:
  - SUNRPC: Fix null rpc_clnt dereference in rpc_task_queued tracepoint (Benjamin Coddington) [2039508]
  - buffer: eliminate the need to call free_more_memory() in __getblk_slow() (Carlos Maiolino) [2030609]
  - buffer: grow_dev_page() should use __GFP_NOFAIL for all cases (Carlos Maiolino) [2030609]
  - buffer: have alloc_page_buffers() use __GFP_NOFAIL (Carlos Maiolino) [2030609]
  - net: add READ_ONCE() annotation in __skb_wait_for_more_packets() (Sabrina Dubroca) [2033561]
  - efi: Decode IA32/X64 Context Info structure (Aristeu Rozanski) [1950302]
  - efi: Decode IA32/X64 MS Check structure (Aristeu Rozanski) [1950302]
  - efi: Decode additional IA32/X64 Bus Check fields (Aristeu Rozanski) [1950302]
  - efi: Decode IA32/X64 Cache, TLB, and Bus Check structures (Aristeu Rozanski) [1950302]
  - efi: Decode UEFI-defined IA32/X64 Error Structure GUIDs (Aristeu Rozanski) [1950302]
  - efi: Decode IA32/X64 Processor Error Info Structure (Aristeu Rozanski) [1950302]
  - efi: Decode IA32/X64 Processor Error Section (Aristeu Rozanski) [1950302]
  - efi: Fix IA32/X64 Processor Error Record definition (Aristeu Rozanski) [1950302]
  - HID: core: Sanitize event code and type when mapping input (Aristeu Rozanski) [1920848] {CVE-2020-0465}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.56.1.el7]
changelog:
  - RDMA/mlx5: Fix access to wrong pointer while performing flush due to error (Kamal Heib) [1984070]
  - af_unix: fix garbage collect vs MSG_PEEK (William Zhao) [2031970] {CVE-2021-0920}
  - selinux: fix race condition when computing ocontext SIDs (Ondrej Mosnacek) [2040196]
  - Bluetooth: fix the erroneous flush_work() order (Chris von Recklinghausen) [1964556] {CVE-2021-3564}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.57.1.el7]
changelog:
  - fix regression in "epoll: Keep a reference on files added to the check list" (Carlos Maiolino) [2042760] {CVE-2020-0466}
  - epoll: Keep a reference on files added to the check list (Carlos Maiolino) [2042760] {CVE-2020-0466}
  - drm/i915: Flush TLBs before releasing backing store (Dave Airlie) [2044319] {CVE-2022-0330}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.58.1.el7]
changelog:
  - Bluetooth: fix use-after-free error in lock_sock_nested() (Gopal Tiwari) [2005687]
  - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Dave Airlie) [2047597] {CVE-2022-22942}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1159.el7]
changelog:
  - [kernel] modsign: Import certificates from optional MokListRT (Lenny Szubowicz) [1862840]
  - [crypto] crypto/pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1862840]
  - [crypto] crypto/pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1862840]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1160.el7]
changelog:
  - [kernel] modsign: Add nomokvarconfig kernel parameter (Lenny Szubowicz) [1867857]
  - [firmware] modsign: Add support for loading certs from the EFI MOK config table (Lenny Szubowicz) [1867857]
  - [kernel] modsign: Move import of MokListRT certs to separate routine (Lenny Szubowicz) [1867857]
  - [kernel] modsign: Avoid spurious error message after last MokListRTn (Lenny Szubowicz) [1867857]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.1.1.el7]
changelog:
  - [net] netfilter: conntrack: allow sctp hearbeat after connection re-use (Florian Westphal) [1869751]
  - [scsi] scsi: ses: don't ask for diagnostic pages repeatedly during probe (Maurizio Lombardi) [1855324]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.2.1.el7]
changelog:
  - [edac] EDAC/i10nm: Update driver to support different bus number config register offsets (Aristeu Rozanski) [1840276]
  - [edac] EDAC, {skx, i10nm}: Make some configurations CPU model specific (Aristeu Rozanski) [1840276]
  - [net] test nouarg before dereferencing zerocopy pointers (Patrick Talbert) [1862273]
  - [net] packet: copy user buffers before orphan or clone (Patrick Talbert) [1862273]
  - [netdrv] net/mlx5e: Fix deallocation of non-fully init encap entries (Alaa Hleihel) [1874101]
  - [netdrv] net/mlx5e: Allow concurrent creation of encap entries (Alaa Hleihel) [1874101]
  - [netdrv] net/mlx5e: Protect encap hash table with mutex (Alaa Hleihel) [1874101]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.60.1.el7]
changelog:
  - svcrdma: Fix leak of svc_rdma_recv_ctxt objects (Benjamin Coddington) [2028740]
  - sunrpc: Remove unneeded pointer dereference (Benjamin Coddington) [2028740]
  - x86/platform/uv: Add more to secondary CPU kdump info (Frank Ramsay) [2042462]
  - [s390] s390/AP: support new dynamic AP bus size limit (Claudio Imbrenda) [1997156]
  - CI: Enable baseline realtime checks (Veronika Kabatova)
  - CI: Rename pipelines to include release names (Veronika Kabatova)
  - RDMA/cma: Do not change route.addr.src_addr.ss_family (Kamal Heib) [2032075] {CVE-2021-4028}
  - fget: clarify and improve __fget_files() implementation (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fget: check that the fd still exists after getting a ref to it (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - net: Set fput_needed iff FDPUT_FPUT is set (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - vfs, fdtable: Add fget_task helper (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: add fget_many() and fput_many() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs/file.c: __fget() and dup2() atomicity rules (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - vfs: Don't let __fdget_pos() get FMODE_PATH files (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - get rid of fget_light() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - sockfd_lookup_light(): switch to fdget^W^Waway from fget_light (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: __fget_light() can use __fget() in slow path (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: factor out common code in fget_light() and fget_raw_light() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: factor out common code in fget() and fget_raw() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - introduce __fcheck_files() to fix rcu_dereference_check_fdtable(), kill rcu_my_thread_group_empty() (Miklos Szeredi) [2032478] {CVE-2021-4083}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.61.1.el7]
changelog:
  - x86/efi: reset the correct tlb_state when returning from efi_switch_mm() (Rafael Aquini) [2055587]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.62.1.el7]
changelog:
  - cifs: fix handling of DFS links where we can not access all components (Ronnie Sahlberg) [1937304]
  - redhat: kernel.spec: install new kernel boot entry in posttrans, not post (Denys Vlasenko) [1893756]
  - [s390] s390/cpumf: Support for CPU Measurement Facility CSVN 7 (Mete Durlu) [2048920]
  - dm table: fix iterate_devices based device capability checks (Mike Snitzer) [2054743]
  - buffer: eliminate the need to call free_more_memory() in __getblk_slow() (Carlos Maiolino) [2030609]
  - buffer: grow_dev_page() should use __GFP_NOFAIL for all cases (Carlos Maiolino) [2030609]
  - buffer: have alloc_page_buffers() use __GFP_NOFAIL (Carlos Maiolino) [2030609]
  - mm: memcg: do not fail __GFP_NOFAIL charges (Rafael Aquini) [2054345]
  - mm: filemap: do not drop action modifier flags from the gfp_mask passed to __add_to_page_cache_locked() (Rafael Aquini) [2054345]
  - Added ZSTREAM=yes to makefile (Lucas Zampieri)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.63.1.el7]
changelog:
  - NFSv4: Set the connection timeout to match the lease period (Benjamin Coddington) [2066699]
  - SUNRPC: Allow changing of the TCP timeout parameters on the fly (Benjamin Coddington) [2066699]
  - SUNRPC: Refactor TCP socket timeout code into a helper function (Benjamin Coddington) [2066699]
  - SUNRPC: Remove unused function rpc_get_timeout() (Benjamin Coddington) [2066699]
  - kernel/timer: Fix incorrect assertion in requeue_timers() (Waiman Long) [2048502]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.65.1.el7]
changelog:
  - CI: Remove deprecated option (Veronika Kabatova)
  - RDMA/core: Fix panic when port_pkey_list isn't initialized (Kamal Heib) [2046571]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.66.1.el7]
changelog:
  - net-sysfs: add check for netdevice being present to speed_show (William Zhao) [2055457]
  - CI: Drop baseline runs (Veronika Kabatova)
  - perf/x86/intel: Add more Icelake CPUIDs (Michael Petlan) [2072317]
  - perf vendor events intel: Add Icelake V1.00 event file (Michael Petlan) [2072317]
  - perf vendor events intel: Add core event list for Icelake Server (Michael Petlan) [2072317]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.67.1.el7]
changelog:
  - mm/rmap.c: explicitly reset vma->anon_vma in unlink_anon_vmas() (Rafael Aquini) [1824109 2069962]
  - mm/rmap.c: don't reuse anon_vma if we just want a copy (Rafael Aquini) [1824109 2069962]
  - mm/mmap.c: rb_parent is not necessary in __vma_link_list() (Rafael Aquini) [1824109 2069962]
  - mm/mmap.c: extract __vma_unlink_list() as counterpart for __vma_link_list() (Rafael Aquini) [1824109 2069962]
  - mm/mmap.c: __vma_unlink_prev() is not necessary now (Rafael Aquini) [1824109 2069962]
  - mm/mmap.c: prev could be retrieved from vma->vm_prev (Rafael Aquini) [1824109 2069962]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.68.1.el7]
changelog:
  - libceph: fix potential use-after-free on linger ping and resends (Ilya Dryomov) [2088025]
  - xfs: use length to balance duplicate bno buffers in perag rb_tree (Brian Foster) [2050464]
  - sock: sock_dequeue_err_skb() needs hard irq safety (Kenneth Yin) [2070408]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.71.1.el7]
changelog:
  - netfilter: nf_tables: disallow non-stateful expression in sets earlier (Phil Sutter) [2093000] {CVE-2022-1966}
  - netfilter: nf_tables: fix memory leak if expr init fails (Phil Sutter) [2093000]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.72.1.el7]
changelog:
  - sched,perf: Fix periodic timers (Valentin Schneider) [2077346]
  - sched: debug: Remove the cfs bandwidth timer_active printout (Valentin Schneider) [2077346]
  - sched: Cleanup bandwidth timers (Valentin Schneider) [2077346]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.73.1.el7]
changelog:
  - qede: Reduce verbosity of ptp tx timestamp (Manish Chopra) [2080646]
  - RDMA/cma: Fix unbalanced cm_id reference count during address resolve (Kamal Heib) [2085425]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.75.1.el7]
changelog:
  - xfs: fix up non-directory creation in SGID directories (Andrey Albershteyn) [2089360]
  - x86/speculation/mmio: Print SMT warning (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - KVM: x86/speculation: Disable Fill buffer clear within guests (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/srbds: Update SRBDS mitigation selection (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - cpu/speculation: Add prototype for cpu_show_srbds() (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation: Add a common function for MD_CLEAR mitigation update (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - Documentation: Add documentation for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - [s390] s390/zcrypt: use kvmalloc instead of kmalloc for 256k alloc (Mete Durlu) [2072970]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.77.1.el7]
changelog:
  - net/mlx5: Add Fast teardown support (Jay Shin) [2077711]
  - net/mlx5: Free IRQs in shutdown path (Jay Shin) [2077711]
  - net/mlx5: Change teardown with force mode failure message to warning (Jay Shin) [2077711]
  - net/mlx5: Cancel health poll before sending panic teardown command (Jay Shin) [2077711]
  - net/mlx5: Add fast unload support in shutdown flow (Jay Shin) [2077711]
  - net/mlx5: Expose command polling interface (Jay Shin) [2077711]
  - posix-timers: Remove remaining uses of tasklist_lock (Oleg Nesterov) [2115147]
  - posix-timers: Use sighand lock instead of tasklist_lock on timer deletion (Oleg Nesterov) [2115147]
  - posix-cpu-timers: remove tasklist_lock in posix_cpu_clock_get() (Oleg Nesterov) [2115147]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.78.1.el7]
changelog:
  - net_sched: cls_route: remove from list when handle is 0 (Davide Caratti) [2121809] {CVE-2022-2588}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.79.1.el7]
changelog:
  - x86/speculation: Add LFENCE to RSB fill sequence (Rafael Aquini) [2115073] {CVE-2022-26373}
  - x86/speculation: Protect against userspace-userspace spectreRSB (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/speculation: cope with spectre_v2=retpoline cmdline on retbleed-affected Intel CPUs (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - KVM: emulate: do not adjust size of fastop and setcc subroutines (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/speculation: Disable RRSBA behavior (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kexec: Disable RET on kexec (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpu/amd: Enumerate BTC_NO (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/common: Stamp out the stepping madness (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpu/amd: Add Spectral Chicken (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Do IBPB fallback check only once (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Add retbleed=ibpb (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Report Intel retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Enable STIBP for JMP2RET (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Add AMD retbleed= boot parameter (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Report AMD retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Add magic AMD return-thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Use return-thunk in asm code (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/sev: Avoid using __x86_return_thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: Fix SETcc emulation for return thunks (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86,objtool: Create .return_sites (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Undo return-thunk damage (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/retpoline: Use -mfunction-return (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Move RETPOLINE flags to word 11 (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - objtool: Add ELF writing capability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Prepare asm files for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Prepare inline-asm for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: Fix fastop function ELF metadata (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: Move kvm_fastop_exception to .fixup section (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/vdso: Fix vDSO build if a retpoline is emitted (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Carve out CQM features retrieval (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Re-tabulate the X86_FEATURE definitions (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeature: Move processor tracing out of scattered features (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6 (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/alternatives: Cleanup DPRINTK macro (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.80.1.el7]
changelog:
  - scsi: lpfc: Fix FCP I/O flush functionality for TMF routines (Dick Kennedy) [1969988]
  - scsi: lpfc: Fix illegal memory access on Abort IOCBs (Dick Kennedy) [1969988]
  - NFS: Fix extra call to dput() in nfs_prime_dcache (Benjamin Coddington) [2117856]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.81.1.el7]
changelog:
  - [netdrv] bnxt: don't lock the tx queue from napi poll (Jamie Bainbridge) [2110869]
  - [netdrv] bnxt_en: reverse order of TX disable and carrier off (Jamie Bainbridge) [2110869]
  - [netdrv] qede: confirm skb is allocated before using (Jamie Bainbridge) [2131145]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.82.1.el7]
changelog:
  - net: usb: ax88179_178a: Fix packet receiving (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - net: usb: Merge cpu_to_le32s + memcpy to put_unaligned_le32 (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32 (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - net: usb: ax88179_178a: fix packet alignment padding (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - mm: swap: disable swap_vma_readahead for PPC64 (Rafael Aquini) [2142455]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.83.1.el7]
changelog:
  - x86/sme: avoid using __x86_return_thunk (Rafael Aquini) [2122158]
  - scsi: core: Simplify control flow in scmd_eh_abort_handler() (Ewan D. Milne) [2128337]
  - scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run (Ewan D. Milne) [2128337]
  - [netdrv] i40e: Fix freeing of uninitialized misc IRQ vector (Jamie Bainbridge) [2129248]
  - x86/speculation: Use generic retpoline by default on AMD (Rafael Aquini) [2062165] {CVE-2021-26401}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.84.1.el7]
changelog:
  - blk-mq: fix flush-rq race (Ming Lei) [2088029]
  - scsi: target: iscsi: Fix a race condition between login_work and the login thread (Maurizio Lombardi) [2154243]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.85.1.el7]
changelog:
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_b (Xin Long) [2054037]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_a (Xin Long) [2054037]
  - sctp: handle errors when updating asoc (Xin Long) [2054037]
  - sctp: no need to check assoc id before calling sctp_assoc_set_id (Xin Long) [2054037]
  - s390/topology: fix warning when disabling cpus (Tobias Huschle) [2071980]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.86.1.el7]
changelog:
  - openvswitch: fix OOB access in reserve_sfa_size() (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - openvswitch: fix flow actions reallocation (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - gitlab-ci: use CI templates from production branch (Michael Hofmann)
  - mm: prevent page_frag_alloc() from corrupting the memory (Rafael Aquini) [2141062]
  - mm: Use fixed constant in page_frag_alloc instead of size + 1 (Rafael Aquini) [2141062]
  - mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs (Rafael Aquini) [2141062]
  - x86/pat: Pass valid address to sanitize_phys() (Jeff Moyer) [1974485]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.87.1.el7]
changelog:
  - Revert "openvswitch: fix flow actions reallocation" (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - Revert "openvswitch: fix OOB access in reserve_sfa_size()" (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - kvm/emulate: Fix SETcc emulation function offsets with SLS (Vitaly Kuznetsov) [2143438]
  - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (Rafael Aquini) [2138620] {CVE-2022-42703}
  - mm, rmap: handle anon_vma_prepare() common case inline (Rafael Aquini) [2138620] {CVE-2022-42703}
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Wander Lairson Costa) [2152565] {CVE-2022-4378}
  - proc: avoid integer type confusion in get_proc_long (Wander Lairson Costa) [2152565] {CVE-2022-4378}
  - scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts (Nilesh Javali) [2092105]
  - fs: move S_ISGID stripping into the vfs_*() helpers (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}
  - fs: Add missing umask strip in vfs_tmpfile (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}
  - fs: add mode_strip_sgid() helper (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.88.1.el7]
changelog:
  - KVM: x86: add bit to indicate correct tsc_shift (Marcelo Tosatti) [2152838]
  - KVM: x86: rewrite handling of scaled TSC for kvmclock (Marcelo Tosatti) [2152838]
  - KVM: x86: rename argument to kvm_set_tsc_khz (Marcelo Tosatti) [2152838]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.90.1.el7]
changelog:
  - NFSv4.1: Fix open stateid recovery (Benjamin Coddington) [2156890]
  - NFS: Don't open code clearing of delegation state (Benjamin Coddington) [2156890]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.92.1.el7]
changelog:
  - packet: fix use-after-free in prb_retire_rx_blk_timer_expired() (Florian Westphal) [2182642]
  - x86/bugs: Workaround for incorrectly set X86_BUG_RETBLEED under VMware (Waiman Long) [2189556]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.93.1.el7]
changelog:
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Wander Lairson Costa) [2152941] {CVE-2022-3564}
  - proc/pagemap: walk page tables under pte lock (Rafael Aquini) [2190338]


author: Pavel Raiskup <praiskup@redhat.com> - 3.1.2-11
changelog:
  - fix out-of-bounds read within lha_read_data_none() (CVE-2017-14503)
  - fix crash on crafted 7zip archives (CVE-2019-1000019)
  - fix infinite loop in ISO9660 (CVE-2019-1000020)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.1-5
changelog:
  - Apply a patch by Stephen Gallagher to patch autoconf, not configure to
    allow optflags to be passed in by build environment
  - Run autoreconf before configure
  - git rm obsolete patches
  - Apply upstream patch to stop overriding AC_CONFIG_MACRO_DIR


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-1
changelog:
  - New upstream release 1.10
  - Obsolete upstreamed patches
  - Amend the multilib patch, there's no need to patch configure since we
    are running autoreconf anyways
  - https://raw.github.com/bagder/c-ares/cares-1_10_0/RELEASE-NOTES


author: Kai Engert <kaie@redhat.com> - 2017.2.11-71
changelog:
  - Update to CKBI 2.11 from NSS 3.28.1 with legacy modifications.
  - Use comments in extracted bundle files.
  - Change packaging script to support empty legacy bundles.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-72
changelog:
  - Changed the packaged bundle to use the flexible p11-kit-object-v1 file format,
    as a preparation to fix bugs in the interaction between p11-kit-trust and
    Mozilla applications, such as Firefox, Thunderbird etc.
  - For CAs trusted by Mozilla, set attribute nss-mozilla-ca-policy: true
  - Require p11-kit 0.23.5
  - Added an utility to help with comparing output of the trust dump command.


author: Kai Engert <kaie@redhat.com> - 2017.2.16-71
changelog:
  - Update to CKBI 2.16 from NSS 3.32. In addition to removals/additions,
    Mozilla removed code signing trust from all CAs (rhbz#1472933)


author: Bob Relyea <rrelyea@redhat.com> - 2019.2.32-76
changelog:
  - Update to CKBI 2.32 from NSS 3.44
  -   Removing:
  -   # Certificate "Visa eCommerce Root"
  -   # Certificate "AC Raiz Certicamara S.A."
  -   # Certificate "TC TrustCenter Class 3 CA II"
  -   # Certificate "ComSign CA"
  -   # Certificate "S-TRUST Universal Root CA"
  -   # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5"
  -   # Certificate "Certplus Root CA G1"
  -   # Certificate "Certplus Root CA G2"
  -   # Certificate "OpenTrust Root CA G1"
  -   # Certificate "OpenTrust Root CA G2"
  -   # Certificate "OpenTrust Root CA G3"
  -  Adding:
  -   # Certificate "GlobalSign Root CA - R6"
  -   # Certificate "OISTE WISeKey Global Root GC CA"
  -   # Certificate "GTS Root R1"
  -   # Certificate "GTS Root R2"
  -   # Certificate "GTS Root R3"
  -   # Certificate "GTS Root R4"
  -   # Certificate "UCA Global G2 Root"
  -   # Certificate "UCA Extended Validation Root"
  -   # Certificate "Certigna Root CA"
  -   # Certificate "emSign Root CA - G1"
  -   # Certificate "emSign ECC Root CA - G3"
  -   # Certificate "emSign Root CA - C1"
  -   # Certificate "emSign ECC Root CA - C3"
  -   # Certificate "Hongkong Post Root CA 3"


author: Bob Relyea <rrelyea@redhat.com> - 2020.2.41-70.0
changelog:
  - Update to CKBI 2.41 from NSS 3.53.0
  -    Removing:
  -     # Certificate "AddTrust Low-Value Services Root"
  -     # Certificate "AddTrust External Root"
  -     # Certificate "UTN USERFirst Email Root CA"
  -     # Certificate "Certplus Class 2 Primary CA"
  -     # Certificate "Deutsche Telekom Root CA 2"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "Certinomis - Root CA"
  -    Adding:
  -     # Certificate "Entrust Root Certification Authority - G4"
  - fix permissions on ghosted files.


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-71
changelog:
  - Update to CKBI 2.48 from NSS 3.66
  -    Removing:
  -     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root CA"
  -     # Certificate "Sonera Class 2 Root CA"
  -     # Certificate "Taiwan GRCA"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Trustis FPS Root CA"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
  -     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
  -    Adding:
  -     # Certificate "Microsoft ECC Root Certificate Authority 2017"
  -     # Certificate "Microsoft RSA Root Certificate Authority 2017"
  -     # Certificate "e-Szigno Root CA 2017"
  -     # Certificate "certSIGN Root CA G2"
  -     # Certificate "Trustwave Global Certification Authority"
  -     # Certificate "Trustwave Global ECC P256 Certification Authority"
  -     # Certificate "Trustwave Global ECC P384 Certification Authority"
  -     # Certificate "NAVER Global Root Certification Authority"
  -     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
  -     # Certificate "GlobalSign Secure Mail Root R45"
  -     # Certificate "GlobalSign Secure Mail Root E45"
  -     # Certificate "GlobalSign Root R46"
  -     # Certificate "GlobalSign Root E46"
  -     # Certificate "GLOBALTRUST 2020"
  -     # Certificate "ANF Secure Server Root CA"
  -     # Certificate "Certum EC-384 CA"
  -     # Certificate "Certum Trusted Root CA"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-71
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "GlobalSign Root CA - R2"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2"
  -    Adding:
  -     # Certificate "TunTrust Root CA"
  -     # Certificate "HARICA TLS RSA Root CA 2021"
  -     # Certificate "HARICA TLS ECC Root CA 2021"
  -     # Certificate "HARICA Client RSA Root CA 2021"
  -     # Certificate "HARICA Client ECC Root CA 2021"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "vTrus ECC Root CA"
  -     # Certificate "vTrus Root CA"
  -     # Certificate "ISRG Root X2"
  -     # Certificate "HiPKI Root CA - G1"
  -     # Certificate "Telia Root CA v2"
  -     # Certificate "D-TRUST BR Root CA 1 2020"
  -     # Certificate "D-TRUST EV Root CA 1 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-72
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Adding:
  -     # Certificate "CAEDICOM Root"
  -     # Certificate "I.CA Root CA/RSA"
  -     # Certificate "MULTICERT Root Certification Authority 01"
  -     # Certificate "Certification Authority of WoSign G2"
  -     # Certificate "CA WoSign ECC Root"
  -     # Certificate "CCA India 2015 SPL"
  -     # Certificate "Swedish Government Root Authority v3"
  -     # Certificate "Swedish Government Root Authority v2"
  -     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "OpenTrust Root CA G2"
  -     # Certificate "OpenTrust Root CA G3"
  -     # Certificate "Certplus Root CA G1"
  -     # Certificate "Certplus Root CA G2"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Thailand National Root Certification Authority - G1"
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Certification Authority of WoSign"
  -     # Certificate "CA 沃通根证书"
  -     # Certificate "SSC GDL CA Root B"
  -     # Certificate "SAPO Class 2 Root CA"
  -     # Certificate "SAPO Class 3 Root CA"
  -     # Certificate "SAPO Class 4 Root CA"
  -     # Certificate "CA Disig Root R1"
  -     # Certificate "Autoridad Certificadora Raíz Nacional de Uruguay"
  -     # Certificate "ApplicationCA2 Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Halcom Root CA"
  -     # Certificate "Swisscom Root EV CA 2"
  -     # Certificate "CFCA GT CA"
  -     # Certificate "Digidentity L3 Root CA - G2"
  -     # Certificate "SITHS Root CA v1"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "IGC/A AC racine Etat francais"
  -     # Certificate "PersonalID Trustworthy RootCA 2011"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "Swiss Government Root CA II"
  -     # Certificate "Swiss Government Root CA I"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "LuxTrust Global Root"
  -     # Certificate "AC1 RAIZ MTIN"
  -     # Certificate "Microsoft Root Certificate Authority 2011"
  -     # Certificate "CCA India 2011"
  -     # Certificate "ANCERT Certificados Notariales V2"
  -     # Certificate "ANCERT Certificados CGN V2"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "China Internet Network Information Center EV Certificates Root"
  -     # Certificate "Verizon Global Root CA"
  -     # Certificate "SwissSign Silver Root CA - G3"
  -     # Certificate "SwissSign Platinum Root CA - G3"
  -     # Certificate "SwissSign Gold Root CA - G3"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "SITHS CA v3"
  -     # Certificate "Certinomis - Autorité Racine"
  -     # Certificate "ANF Server CA"
  -     # Certificate "Thawte Premium Server CA"
  -     # Certificate "Thawte Server CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "KEYNECTIS ROOT CA"
  -     # Certificate "I.CA - Standard Certification Authority, 09/2009"
  -     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
  -     # Certificate "VI Registru Centras RCSC (RootCA)"
  -     # Certificate "CCA India 2007"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Actalis Authentication CA G1"
  -     # Certificate "A-Trust-Qual-03"
  -     # Certificate "AddTrust External CA Root"
  -     # Certificate "ECRaizEstado"
  -     # Certificate "Configuration"
  -     # Certificate "FNMT-RCM"
  -     # Certificate "StartCom Certification Authority"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "E-ME SSI (RCA)"
  -     # Certificate "ACEDICOM Root"
  -     # Certificate "Autoridad Certificadora Raiz de la Secretaria de Economia"
  -     # Certificate "Correo Uruguayo - Root CA"
  -     # Certificate "CNNIC ROOT"
  -     # Certificate "Common Policy"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "Cisco Root CA 2048"
  -     # Certificate "CA Disig"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "UCA Global Root"
  -     # Certificate "UCA Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Starfield Services Root Certificate Authority"
  -     # Certificate "I.CA - Qualified root certificate"
  -     # Certificate "I.CA - Standard root certificate"
  -     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
  -     # Certificate "Japanese Government"
  -     # Certificate "AdminCA-CD-T01"
  -     # Certificate "Admin-Root-CA"
  -     # Certificate "Izenpe.com"
  -     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
  -     # Certificate "Halcom CA FO"
  -     # Certificate "Halcom CA PO 2"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "ACNLB"
  -     # Certificate "state-institutions"
  -     # Certificate "state-institutions"
  -     # Certificate "SECOM Trust Systems CO.,LTD."
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "D-TRUST Root Class 2 CA 2007"
  -     # Certificate "D-TRUST Root Class 3 CA 2007"
  -     # Certificate "SSC Root CA A"
  -     # Certificate "SSC Root CA B"
  -     # Certificate "SSC Root CA C"
  -     # Certificate "Autoridad de Certificacion de la Abogacia"
  -     # Certificate "Root CA Generalitat Valenciana"
  -     # Certificate "VAS Latvijas Pasts SSI(RCA)"
  -     # Certificate "ANCERT Certificados CGN"
  -     # Certificate "ANCERT Certificados Notariales"
  -     # Certificate "ANCERT Corporaciones de Derecho Publico"
  -     # Certificate "GLOBALTRUST"
  -     # Certificate "Certipost E-Trust TOP Root CA"
  -     # Certificate "Certipost E-Trust Primary Qualified CA"
  -     # Certificate "Certipost E-Trust Primary Normalised CA"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "IGC/A"
  -     # Certificate "S-TRUST Authentication and Encryption Root CA 2005:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "Swisscom Root CA 1"
  -     # Certificate "Microsec e-Szigno Root CA"
  -     # Certificate "LGPKI"
  -     # Certificate "AC RAIZ DNIE"
  -     # Certificate "Common Policy"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 1"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Staat der Nederlanden Root CA"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Global CA 2"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root Certification Authority"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Microsoft Root Authority"
  -     # Certificate "Microsoft Root Certificate Authority"
  -     # Certificate "Microsoft Root Certificate Authority 2010"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "UTN-USERFirst-Object"
  -     # Certificate "BYTE Root Certification Authority 001"
  -     # Certificate "CISRCA1"
  -     # Certificate "ePKI Root Certification Authority - G2"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "SSL.com EV Root Certification Authority RSA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "ACA ROOT"
  -     # Certificate "Security Communication ECC RootCA1"
  -     # Certificate "Security Communication RootCA3"
  -     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
  -     # Certificate "Network Solutions RSA Certificate Authority"
  -     # Certificate "Network Solutions ECC Certificate Authority"
  -     # Certificate "Australian Defence Public Root CA"
  -     # Certificate "SI-TRUST Root"
  -     # Certificate "Halcom Root Certificate Authority"
  -     # Certificate "Application CA G3 Root"
  -     # Certificate "GLOBALTRUST 2015"
  -     # Certificate "Microsoft ECC Product Root Certificate Authority 2018"
  -     # Certificate "emSign Root CA - G2"
  -     # Certificate "emSign Root CA - C2"
  -     # Certificate "Microsoft ECC TS Root Certificate Authority 2018"
  -     # Certificate "DigiCert CS ECC P384 Root G5"
  -     # Certificate "DigiCert CS RSA4096 Root G5"
  -     # Certificate "DigiCert RSA4096 Root G5"
  -     # Certificate "DigiCert ECC P384 Root G5"
  -     # Certificate "HARICA Code Signing RSA Root CA 2021"
  -     # Certificate "HARICA Code Signing ECC Root CA 2021"
  -     # Certificate "Microsoft Identity Verification Root Certificate Authority 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-74
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "Izenpe.com"
  -     # Certificate "state-institutions"
  -     # Certificate "GlobalSign"
  -     # Certificate "Common Policy"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "AC Raíz Certicámara S.A."


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-71
changelog:
  - Update to CKBI 2.60_v7.0.306 from NSS 3.91
  -    Removing:
  -     # Certificate "Camerfirma Global Chambersign Root"
  -     # Certificate "Staat der Nederlanden EV Root CA"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "CCA India 2007"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -    Adding:
  -     # Certificate "DigiCert TLS ECC P384 Root G5"
  -     # Certificate "DigiCert TLS RSA4096 Root G5"
  -     # Certificate "DigiCert SMIME ECC P384 Root G5"
  -     # Certificate "DigiCert SMIME RSA4096 Root G5"
  -     # Certificate "Certainly Root R1"
  -     # Certificate "Certainly Root E1"
  -     # Certificate "E-Tugra Global Root CA RSA v3"
  -     # Certificate "E-Tugra Global Root CA ECC v3"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
  -     # Certificate "BJCA Global Root CA1"
  -     # Certificate "BJCA Global Root CA2"
  -     # Certificate "Symantec Enterprise Mobile Root for Microsoft"
  -     # Certificate "A-Trust-Root-05"
  -     # Certificate "ADOCA02"
  -     # Certificate "StartCom Certification Authority G2"
  -     # Certificate "ATHEX Root CA"
  -     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "America Online Root Certification Authority 1"
  -     # Certificate "Juur-SK"
  -     # Certificate "ComSign CA"
  -     # Certificate "ComSign Secured CA"
  -     # Certificate "ComSign Advanced Security CA"
  -     # Certificate "Global Chambersign Root"
  -     # Certificate "Sonera Class2 CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "VeriSign, Inc."
  -     # Certificate "GTE CyberTrust Global Root"
  -     # Certificate "Equifax Secure Global eBusiness CA-1"
  -     # Certificate "Equifax"
  -     # Certificate "Class 1 Primary CA"
  -     # Certificate "Swiss Government Root CA III"
  -     # Certificate "Application CA G4 Root"
  -     # Certificate "SSC GDL CA Root A"
  -     # Certificate "GlobalSign Code Signing Root E45"
  -     # Certificate "GlobalSign Code Signing Root R45"
  -     # Certificate "Entrust Code Signing Root Certification Authority - CSBR1"


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-72
changelog:
  - hand merge the two 'GlobalSign ECC Root CA R4' certs together and the two 'AC RAIZ FNMT-RCM' certs together to keep p11kit from getting confused.


author: Boris Ranto <branto@redhat.com> - 1:10.2.5-1
changelog:
  - New version (1:10.2.5-1)
  - Makefile: Fix dencoder build
  - Add fake fcgiapp.h for rgw
  - common: Build more files of libcommon in client
  - libradosstripper: Build libradostripper for rados as noinst


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-1
changelog:
  - Resolves: #1249753 challenge password not added in csr using start-tracking
  - Resolves: #1250397 Remove certmonger rekey feature in 7.2
    - Remove rekey feature
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.4


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-2
changelog:
  - Resolves: #1345755 Support for specifying IPA lightweight CA
    - Add 'issuer' request option for specifying issuer
    - Documentation: mark $CERTMONGER_CA_ISSUER as 0.79
    - Comment/whitespace fixup
    - ipa-submit: Retry without "ca" on OptionError
    - getcert: fix a potential out-of-bounds
    - Document the -X option in the ipa-submit man page
  - Resolves: #1351052 certmonger build for RHEL 7.3 failure
    - Stop assuming RSA 512 works
    - Stop assuming RSA 512 works, part two
    - Fix a flakiness in the 028-dbus test


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-3
changelog:
  - Resolves: #1367683 getcert request command fails to use Sub CA using -X
    argument
    - Fix CA option name for ipa cert-request


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-4
changelog:
  - Use required DER encoding when setting CA basic constraint (#1551635)
  - NSS 3.34 more strictly enforces length checking when verifying signatures
    (#1551702)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-5
changelog:
  - Add Requires on psmsic for killall in post script (#1458890)
  - upstream project migrated from fedorahosted.org to pagure.io (#1501723)
  - Strip CR/LF from passwords read from a file (#1545935)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-8
changelog:
  - Disable iterate-10 test which fails intermitently (#1596161)
  - Add BuildRequires for running autoreconf


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-9
changelog:
  - Remove patch to pass _PROXY, _proxy, LANG and LC_* environment
    variables to helpers. The root cause was a bug in IPA (#1596161)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-12
changelog:
  - Add documentation for the '-N' option to the dogtag-ipa-renew-agent-submit
    man page (#1651368)
  - SCEP: Don't set message=<ca ident> with GetCaps and GetCACert (#1608781)
  - SCEP operation GetCAChain is not valid. Should be GetCACertChain (#1590727)
  - Document owner and permission parameters to getcert (#1549585)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-17
changelog:
  - certmonger creates CSRs with invalid DER syntax for X509v3 extensions
    with critical=FALSE (#2015511)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Fix typos in test/dispol
  - Set flex as default lexer
  - Fix checkmodule output message
  - Build policy on systems not supporting DCCP protocol
  - Fail if module name different than output base filename


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-6
changelog:
  - Add ibendport ocontext handling
  - Add support for ibendportcon labels
  - Add ibpkey ocontext handling
  - Add support for ibpkeycon labels
  - Add binary module support for xperms


author: Miroslav Rezanina <mrezanin@redhat.com> - 18.5-6.el7
changelog:
  - ci-util-json.dumps-on-python-2.7-will-handle-UnicodeDec.patch [bz#1744526]
  - Resolves: bz#1744526
    ([cloud-init][OpenStack] cloud-init can't persist instance-data.json)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-2.el7
changelog:
  - ci-Removing-cloud-user-from-wheel.patch [bz#1549638]
  - ci-Remove-race-condition-between-cloud-init-and-Network.patch [bz#1748015]
  - ci-cc_set_password-increase-random-pwlength-from-9-to-2.patch [bz#1812170]
  - ci-utils-use-SystemRandom-when-generating-random-passwo.patch [bz#1812173]
  - ci-Enable-ssh_deletekeys-by-default.patch [bz#1574338]
  - Resolves: bz#1549638
    ([RHEL7]cloud-user added to wheel group and sudoers.d causes 'sudo -v' prompts for passphrase)
  - Resolves: bz#1574338
    (CVE-2018-10896 cloud-init: SSH host keys are not regenerated for the new instances [rhel-7])
  - Resolves: bz#1748015
    ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
  - Resolves: bz#1812170
    (CVE-2020-8632 cloud-init: Too short random password length in cc_set_password in config/cc_set_passwords.py [rhel-7])
  - Resolves: bz#1812173
    (CVE-2020-8631 cloud-init: Use of random.choice when generating random password [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-3.el7
changelog:
  - ci-Do-not-use-fallocate-in-swap-file-creation-on-xfs.-7.patch [bz#1772505]
  - Resolves: bz#1772505
    ([RHEL7] swapon fails with "swapfile has holes" when created on a xfs filesystem by cloud-init)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-4.el7
changelog:
  - ci-swap-file-size-being-used-before-checked-if-str-315.patch [bz#1772505]
  - Resolves: bz#1772505
    ([RHEL7] swapon fails with "swapfile has holes" when created on a xfs filesystem by cloud-init)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-5.el7
changelog:
  - ci-Remove-race-condition-between-cloud-init-and-Network-v2.patch [bz#1748015]
  - ci-cc_mounts-fix-incorrect-format-specifiers-316.patch [bz#1772505]
  - Resolves: bz#1748015
    ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
  - Resolves: bz#1772505
    ([RHEL7] swapon fails with "swapfile has holes" when created on a xfs filesystem by cloud-init)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-6.el7
changelog:
  - ci-Use-reload-or-try-restart-instead-of-try-reload-or-r.patch [bz#1748015]
  - ci-ec2-Do-not-log-IMDSv2-token-values-instead-use-REDAC.patch [bz#1821999]
  - Resolves: bz#1748015
    ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
  - Resolves: bz#1821999
    ([RHEL7.9] Do not log IMDSv2 token values into cloud-init.log)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-7.el7
changelog:
  - ci-ec2-only-redact-token-request-headers-in-logs-avoid-.patch [bz#1821999]
  - Resolves: bz#1821999
    ([RHEL7.9] Do not log IMDSv2 token values into cloud-init.log)


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com> - 19.4-7.el7_9.2
changelog:
  - Pull from upstream:
    -> ci-When-tools.conf-does-not-exist-running-cmd-vmware-to.patch [bz#1839619]
    -> ci-Changing-notation-of-subp-call.patch [bz#1839619]
    -> ci-DHCP-sandboxing-failing-on-noexec-mounted-var-tmp-52.patch [bz#1871916]
    -> Resolves: bz#1839619
       ([ESXi][RHEL7.9][cloud-init]ERROR log in cloud-init.log after clone VM on ESXi platform [rhel-7.9.z])
    -> Resolves: bz#1871916
       ([Azure][RHEL 7.9] cloud-init Permission denied with the use of mount option noexec [rhel-7.9.z])


author: Kamil Halat <kh@euro-linux.com> - 19.4-7.el7_9.3
changelog:
  - ci-network-Fix-type-and-respect-name-when-rendering-vla.patch [bz#1861871]
  - Resolves: bz#1861871
    ([rhel7][cloud-init] ifup bond0.504 Error: Connection activation failed: No suitable device found for this connection [rhel-7.9.z])
  - ci-network-Fix-type-and-respect-name-when-rendering-vla.patch [bz#1861871]
  - Resolves: bz#1861871
  - ([rhel7][cloud-init] ifup bond0.504 Error: Connection activation failed: No suitable device found for this connection [rhel-7.9.z])
  - ci-When-tools.conf-does-not-exist-running-cmd-vmware-to.patch [bz#1839619]
  - ci-Changing-notation-of-subp-call.patch [bz#1839619]
  - ci-DHCP-sandboxing-failing-on-noexec-mounted-var-tmp-52.patch [bz#1871916]
  - Resolves: bz#1839619
    ([ESXi][RHEL7.9][cloud-init]ERROR log in cloud-init.log after clone VM on ESXi platform [rhel-7.9.z])
  - Resolves: bz#1871916
    ([Azure][RHEL 7.9] cloud-init Permission denied with the use of mount option noexec [rhel-7.9.z])


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com>
changelog:
  - Pull from upstream:
    - ci-DataSourceAzure-update-password-for-defuser-if-exist.patch [bz#1900807]
    - Resolves: bz#1900807
      (Update existing user password RHEL7x)


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com>
changelog:
  - Pull from upstream:
    - ci-Fix-unit-failure-of-cloud-final.service-if-NetworkMa.patch [bz#1897616]
    - Resolves: bz#1897616
      ([rhel-7]cloud-final.service fails if NetworkManager not installed.)


author: Alex Baranowski <ab@euro-linux.com> - 19.4-7.6
changelog:
  - Pull: from upstream:
    -> ci-cloudinit-net-handle-two-different-routes-for-the-sa.patch [bz#2003231]
    -> Resolves: bz#2003231
       (anything above 19.2 of cloud init it fails to assign default route and connect to the meta data service)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.29-2.el7_6.2
changelog:
  - growpart: fix bug when resizing a middle partition with sgdisk [rhbz#1726564]
  - Resolves: rhbz#1726564
    (When growing GPT partitions use [start of next - 1] instead of [start of next] as the new end sector.)


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.185-2
changelog:
  - Fix cluster conversions from linear to mirror.
  - Report no_discard_passdown for cache LVs with lvs -o+kernel_discards.
  - Prevent shared active mirror LVs with lvmlockd.
  - Parsing of cache status understand no_discard_passdown.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.186-1
changelog:
  - Improve removal of cached devices.
  - Synchronize with udev when dropping snapshot.
  - Add missing device synchronization point before removing pvmove node.
  - Correctly set read_ahead for LVs when pvmove is finished.
  - Fix metadata writes from corrupting with large physical block size.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.186-2
changelog:
  - Prevent creating VGs with PVs with different logical block sizes.
  - Pvmove runs in exlusively activating mode for exclusively active LVs.
  - Activate thin-pool layered volume as 'read-only' device.
  - Enhance validation for thin and cache pool conversion and swapping.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.186-3
changelog:
  - Fix lvmetad shutdown and avoid lenghty timeouts when rebooting system.
  - Change allow_mixed_block_sizes default to 1.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.187-6.el7_9.2
changelog:
  - Fix dmeventd crash with modified reserved_stack configuration option.
  - Fix lvm crashing when .cache file is changed by external tools.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.187-6.el7_9.5
changelog:
  - Fix fsadm failure due to accessing unbound variable.
  - Fix segfault in vgextend when a PV is missing in the processed VG.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.185-1
changelog:
  - Fix change of monitoring in clustered volumes.
  - Improve -lXXX%VG modifier which improves cache segment estimation.
  - Add synchronization with udev before removing cached devices.
  - Fix missing growth of _pmspare volume when extending _tmeta volume.
  - Automatically grow thin metadata, when thin data gets too big.


author: Martin Pitt <mpitt@redhat.com> 154-3
changelog:
  - Update source po for Japanese translations rhbz#1512923
  - Adjust build system to avoid build failure for the above


author: Martin Pitt <mpitt@redhat.com> 169-3
changelog:
  - Rebase to version 169, drop all patches rhbz#1568728
  - Fix Subscriptions page hang when accessing as non-admin rhbz#1442540
  - Show an indicator on front page if updates are available rhbz#1495543
  - Properly localize "Log in" rhbz#1541454
  - Improve check for root privilege availability, to e. g. also work for FreeIPA
    admins rhbz#1574630


author: Martin Pitt <mpitt@redhat.com> 173-6
changelog:
  - Fix remote unauthenticated crash with crafted URLs rhbz#1627631
  - Fix off-by-one error in flow control rhbz#1626846


author: Martin Pitt <mpitt@redhat.com> 173.1-1
changelog:
  - Crash fixes spotted by coverity rhbz#1644345
  - Fix race condition with fslist channels rhbz#1644346
  - Fix remotectl crash on errors rhbz#1644348


author: Martin Pitt <mpitt@redhat.com> 190-1
changelog:
  - kdump: Add NFS and SSH dump targets rhbz#1533366
  - kdump: Fix confusing design of target selector rhbz#1536327
  - firewall: Hide already enabled items from "Add Services" dialog rhbz#1598625
  - networking: Gracefully handle when NetworkManager is  not running
    rhbz#1551615
  - web server: Mark deleted cookie as "secure", and add X-Content-Type-Options
    header rhbz#1677767
  - web server: Mark deleted cookie as "HttpOnly" rhbz#1656339
  - Fix various crashes spotted by coverity rhbz#1644209
  - Fix remotectl crash with inaccessible files rhbz#1644213
  - Fix race condition with fslist1 channels rhbz#1644223
  - Fix crash with parsing invalid bas64 headers rhbz#1663712


author: Martin Pitt <mpitt@redhat.com> 195.2-1
changelog:
  - firewall: Only reload firewall when adding custom services (rhbz#1725094)
  - networking: Activate a connection after clearing master/slave fields (rhbz#1729378)
  - Add Obsoletes: for ancient cockpit-shell package (rhbz#1744208)


author: Martin Pitt <mpitt@redhat.com> 195.3-1
changelog:
  - subscriptions: Add support for Red Hat Insights (rhbz#1748026)
  - systemd: Warn if not connected to Insights (rhbz#1748350)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: cockpit-spec-debranding.patch
  -->  Correctly brand this as NOT TUV's product
  - Added Source: cockpit-spec-nokub-32bit.patch
  -->  Make sure to not bother with kubernetes on 32bit
  - Added Source: cockpit.ini
  -->  Config file for automated patch script


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: cockpit-spec-debranding.patch
  -->  Correctly brand this as NOT TUV's product
  - Added Source: cockpit.ini
  -->  Config file for automated patch script


author: Richard Hughes <richard@hughsie.com> 1.0.1-1
changelog:
  - New upstream version
  - Do not unconditionally enable BPC on the color transform
  - Fix profile created time for non-UTC timezones
  - Record the gamma table in the session helper error message


author: Richard Hughes <richard@hughsie.com> 1.0.2-1
changelog:
  - New upstream version
  - Add cd_icc_save_data() so that we can easily set _ICC_PROFILE
  - Add CdIccStore to monitor directories of ICC profiles
  - Add SystemVendor and SystemModel properties to the main interface
  - Allow to specify a non-qualified path when using FindProfileByFilename
  - Allow using the key 'Filename' when using FindProfileByProperty
  - Always return the error if any sync method failed
  - Fix GObject introspection when getting lists
  - Fix GObject introspection when getting metadata


author: Richard Hughes <richard@hughsie.com> 1.0.4-1
changelog:
  - Rebase to a new upstream version to fix small security bug
  - Use %ghost in the to avoid removing databases on upgrades
  - Resolves: #1012832


author: Jan Grulich <jgrulich@redhat.com> - 0.23-1
changelog:
  - Spec file based on exiv2 package to provide old libraries before API change
    Resolves: bz#1568618


author: Jan Grulich <jgrulich@redhat.com> - 0.26-1
changelog:
  - Spec file based on exiv2 package to provide old libraries before API change
    Resolves: bz#1668355


author: Michal Schmidt <mschmidt@redhat.com> - 1.10.6-1
changelog:
  - Update to upstream release 1.10.6.
  - Fix missing RPM provides.
  - Resolves: #1382800
  - Resolves: #1365792


author: Michal Schmidt <mschmidt@redhat.com> - 1.10.7-1
changelog:
  - Update to upstream release 1.10.7.
  - Add Open MPI 3.0.0 subpackage (openmpi3).
  - Resolves: #1452826


author: Jarod Wilson <jarod@redhat.com> - 1.10.7-3
changelog:
  - Update openmpi3 sub-package to OpenMPI v3.1.3
  - Resolves: #1637247
  - Rebuild against latest opensm
  - Resolves: #1670688


author: Doug Ledford <dledford@redhat.com> - 3.3.5-2
changelog:
  - Drop libibmad as it didn't soname bump, and also remove the lower level
    opensm libs, libosm{comp,vendor} as they didn't soname bump either
  - Related: bz725016


author: Doug Ledford <dledford@redhat.com> - 3.3.5-3
changelog:
  - Change the file spec so we don't accidentally pick up the debug files in
    the base package on 32bit arches
  - Resolves: bz732495


author: Honggang Li <honli@redhat.com> - 3.3.15-3
changelog:
  - Package up libosmcomp.so.3* to fix dependency issue after rebase
    opensm to release 3.3.21
  - Resolves: bz1670692


author: Marek Polacek <polacek@redhat.com> 10.2.1-1
changelog:
  - GCC 10.2 release
  - disable -flto in %{optflags}, lto bootstrap will be enabled the GCC way
    later
  - require MPFR Library version 3.1.0 (or later)


author: <odubaj@redhat.com> - 2.3.4-2
changelog:
  - move soname back to *.so.2 (#1875355)
  - add *.so.1002 symlinks for backward compatibility (#1844443)


author: Paul Wouters <pwouters@redhat.com> - 1.4.2-8
changelog:
  - Resolves: rhbz#CVE-2015-6496
  - Fold in upstream patches since 1.4.2 release up to git 900d7e8
  - Fold in upstream patch set of 2015-08-18 for coverity issues


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1425552 (explicitely Require: libnetfilter_conntrack >= 1.0.6 as it is same .so version)


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-4
changelog:
  - Resolves: rhbz#1578059 Greatest NVR version of conntrack-tools for ppc64le and x86_64 are different


author: Phil Sutter <psutter@redhat.com> - 1.4.4-5
changelog:
  - Add git commit info to IPv6 NAT support patch
  - Backport: conntrackd: helpers: dhcpv6: Fix potential array overrun
  - Backport: nfct: Drop dead code in nfct_timeout_parse_params()
  - Backport: src: Fix for implicit-fallthrough warnings


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-6
changelog:
  + control-center-3.26.2-6
  - Fix Clone MAC not being saved in Ethernet device properties
  - Resolves: #1467295


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-8
changelog:
  + control-center-3.26.2-8
  - Fix Wi-Fi networks not getting updated
  - Show "Wi-Fi disabled" page when Wi-Fi is disabled
  - Resolves: #1545713


author: Jiri Vanek <jvanek@redhat.com> - 1.1-5
changelog:
  - posttrans silenced, the error is appearing only in state, when there is nothing to copy
  - Resolves: rhbz#1296430


author: Jiri Vanek <jvanek@redhat.com> - 2.2-1
changelog:
  - added "jre/lib/security/blacklisted.certs" to cared files
  - moved to newest release 2.1
  - moved to new upstream at pagure.io
  - added new script of copy_jdk_configs_fixFiles.sh 
  - copy_jdk_configs.lua  aligned to it
  - Resolves: rhbz#1427463


author: Ondrej Vasik <ovasik@redhat.com> - 8.22-18
changelog:
  - fix xfs build failure in chrooted environment (#1263341)
  - update filesystem lists for stat and tail from latest upstream
    (#1327881, #1280357) 
  - disable id/setgid.sh test(missing chroot feature), fix 
    cp-a-selinux test (#1266500,#1266501)
  - colorls.sh - change detection of interactive shell for ksh
    compatibility (#1321648)
  - fix date --date crash with empty or invalid TZ envvar (#1325786)
  - df -l: do not hang on a dead autofs mount point (#1309247)
  - sort -h: fix functionality of human readable numeric sort for other
    than first field (#1328360)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-19
changelog:
  - timeout: fix race possibly terminating wrong process (#1439465)
  - ls: allow interruption when reading slow directories (#1421802)
  - fold: preserve new-lines in mutlibyte text (#1418505)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-23
changelog:
  - update description of the -a/--all option in df.1 man page (#1553212)
  - sort -M: fix memory leak when using multibyte locale (#1540059)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-24
changelog:
  - doc: improve description of the --kibibytes option of ls (#1527391)
  - doc: fix typo in date example (#1620624)
  - stat,tail: sync the list of file systems with coreutils-8.31 (#1659530)
  - df: avoid stat() for dummy file systems with -l (#1668137)
  - df: prioritize mounts nearer the device root (#1042840)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-8
changelog:
  - Resolves: rhbz#1434528
  - Resolves: rhbz#1434529
  - Resolves: rhbz#1434534

  - cfg: Prevents use of uninitialized buffer (rhbz#1434528)
  - merge upstream commit 52e6ae57ea06d0bef61c5c9250881bef1372ead2 (rhbz#1434528)
  - man: Fix typos in man page (rhbz#1434529)
  - merge upstream commit b642904ea9640bd7a1573a8c0d2c5bcb43a10dfc (rhbz#1434529)
  - Fix typo: Destorying -> Destroying (rhbz#1434529)
  - merge upstream commit 117d9e4eb77ef9941fdeaf17ddfd892514da8143 (rhbz#1434529)
  - init: Add doc URIs to the systemd service files (rhbz#1434529)
  - merge upstream commit 21a728785027483786e41c19f6aff57a95b80aa5 (rhbz#1434529)
  - man: Modify man-page according to command usage (rhbz#1434529)
  - merge upstream commit 79898e8cb1715e79b7467b91661b7341e2664550 (rhbz#1434529)
  - Totempg: remove duplicate memcpy in mcast_msg func (rhbz#1434528)
  - merge upstream commit 4a8e9d80409590cb42732ae3105b5ae71fda52c1 (rhbz#1434528)
  - upstart: Add softdog module loading example (rhbz#1434529)
  - merge upstream commit 75474d69bebea6c9c4ef2252476ce738cf92f0f4 (rhbz#1434529)
  - Remove deprecated doxygen flags (rhbz#1434529)
  - merge upstream commit b252013e42007ea7284ae54d035a30ca40f20fc0 (rhbz#1434529)
  - Remove redundant header file inclusion (rhbz#1434528)
  - merge upstream commit d6c7ade277a4a23d84c56d7fde6b60b377a1023b (rhbz#1434528)
  - Qdevice: fix spell errors in qdevice (rhbz#1434529)
  - merge upstream commit d9caa09c45d4560c89a1ad873087c0476cabab46 (rhbz#1434529)
  - doc: document watchdog_device parameter (rhbz#1434529)
  - merge upstream commit a5f97ae1b99063383d8f45168125b34232b91faf (rhbz#1434529)
  - Logsys: Change logsys syslog_priority priority (rhbz#1434534)
  - merge upstream commit 609cc0cc100aa1070d97b405273373682da0e270 (rhbz#1434534)
  - logconfig: Do not overwrite logger_subsys priority (rhbz#1434534)
  - merge upstream commit c866a2f8603b44e89eb21a6cf7d88134af2e8b66 (rhbz#1434534)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9
changelog:
  - Resolves: rhbz#1445001

  - Main: Call mlockall after fork (rhbz#1445001)
  - merge upstream commit 238e2e62d8b960e7c10bfa0a8281d78ec99f3a26 (rhbz#1445001)
  - Disable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-10
changelog:
  - Resolves: rhbz#1439205
  - Resolves: rhbz#1461450
  - Resolves: rhbz#1469170
  - Resolves: rhbz#1476214

  - main: Don't ask libqb to handle segv, it doesn't work (rhbz#1439205)
  - merge upstream commit c0da36a6c0ecf7bc7def252a06336a7088e68086 (rhbz#1439205)
  - totem: Propagate totem initialization failure (rhbz#1461450)
  - merge upstream commit 0413a8f4672352171f0df731b7d9c1fe20acbc4c (rhbz#1461450)
  - totemcrypto: Refactor symmetric key importing (rhbz#1461450)
  - merge upstream commit a885868181c07ba9ab5cdfdad1d66d387b2a4428 (rhbz#1461450)
  - totemcrypto: Use different method to import key (rhbz#1461450)
  - merge upstream commit 5dadebd21862074deaeb9a337fc9e49f5e9f692a (rhbz#1461450)
  - main: Add option to set priority (rhbz#1469170)
  - merge upstream commit a008448efb2b1d45c432867caf08f0bcf2b4b9b0 (rhbz#1469170)
  - main: Add support for libcgroup (rhbz#1476214)
  - merge upstream commit c56086c701d08fc17cf6d8ef603caf505a4021b7 (rhbz#1476214)
  - totemcrypto: Fix compiler warning (rhbz#1461450)
  - merge upstream commit fdeed33f514e0056e322a45d9a0a04ca4b9a2709 (rhbz#1461450)


author: Jan Friesse <jfriesse@redhat.com> 2.4.3-2
changelog:
  - Resolves: rhbz#1536219

  - logging: Make blackbox configurable (rhbz#1536219)
  - merge upstream commit 8af39f66e56e319b6b93804c0400e6e29737a90f (rhbz#1536219)
  - logging: Close before and open blackbox after fork (rhbz#1536219)
  - merge upstream commit 995ed0bd814ff3eacf6c09534841e6ce39ab6614 (rhbz#1536219)


author: Jan Friesse <jfriesse@redhat.com> 2.4.3-5
changelog:
  - Resolves: rhbz#1376819
  - Resolves: rhbz#1634710

  - configure: add --with-initconfigdir option (rhbz#1376819)
  - merge upstream commit c0d8af0c7b247df16a90850b0edab4f978cb8192 (rhbz#1376819)
  - Use RuntimeDirectory instead of tmpfiles.d (rhbz#1376819)
  - merge upstream commit fde7fa0c6408709ccdd090aa9064e6a78232498a (rhbz#1376819)
  - totemcrypto: Fix importing of the private key (rhbz#1634710)
  - merge upstream commit 3f3e6b62719a263cb221c19a06d9a2c570234caa (rhbz#1634710)
  - qnetd: Check existence of NSS DB dir before fork (rhbz#1376819)
  - merge upstream commit eac28dffdf7f060f41f2b2e95bb0f4c6c033425d (rhbz#1376819)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-1
changelog:
  - Resolves: rhbz#1732039
  - Resolves: rhbz#1153818
  - Resolves: rhbz#1647120

  - Rebase to Corosync 2.4.5


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-2
changelog:
  - Resolves: rhbz#1656492

  - totem: Increase ring_id seq after load (rhbz#1656492)
  - merge upstream commit 1061804d09565363aba73e369faf310a7d2c4d86 (rhbz#1656492)


author: Jan Friesse <jfriesse@redhat.com> - 2.4.5-3
changelog:
  - Resolves: rhbz#1737884
  - Resolves: rhbz#1737887

  - Do not set exec permission for service file
  - Fix CFLAGS definition


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-5
changelog:
  - Resolves: rhbz#1679792
  - Resolves: rhbz#1780134

  - votequorum: Ignore the icmap_get_* return value (rhbz#1780134)
  - merge upstream commit 8ad3c6bbb4556332c5a6b7fecdab73310c045b24 (rhbz#1780134)
  - votequorum: Reflect runtime change of 2Node to WFA (rhbz#1780134)
  - merge upstream commit bfbed8c320b0c0c5d3db48630f3de77e5fd62b75 (rhbz#1780134)
  - votequorum: set wfa status only on startup (rhbz#1679792)
  - merge upstream commit 6894792d76b1e8932bc822bb040933ae17e1a0c7 (rhbz#1679792)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-6
changelog:
  - Resolves: rhbz#1835885

  - stats: Add basic schedule-miss stats to needle (rhbz#1835885)
  - merge upstream commit 274fda334a84253222e01b779349784ec552921b (rhbz#1835885)
  - main: Add schedmiss timestamp into message (rhbz#1835885)
  - merge upstream commit 3166a87749fa4817d90ed335f3c5843fc38e7304 (rhbz#1835885)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-7
changelog:
  - Related: rhbz#1835885

  - main: Make schedmiss in cmap and log equal (rhbz#1835885)
  - merge upstream commit 44c1c8ea31f981bdd7856d4eb8f4ac49f95a85e3 (rhbz#1835885)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-7.1
changelog:
  - Resolves: rhbz#1896311
  - Resolves: rhbz#1897087

  - spausedd: Fix log_perror (rhbz#1896311)
  - spausedd: Add ability to move process into root cgroup (rhbz#1897087)


author: Pavel Raiskup <praiskup@redhat.com> - 2.11-20
changelog:
  - fix another bogus date in changelog
  - update config.guess/config.sub for aarm64 build (#925189)
  - run autoreconf instead of autoheader


author: Marek Polacek <polacek@redhat.com> 4.8.5-28
changelog:
  - Minor testsuite fixes to clean up test results (#1469697)
  - retpoline support for spectre mitigation (#1535655)


author: Marek Polacek <polacek@redhat.com> 4.8.5-31
changelog:
  - backport s390 -mpic-data-is-text-relative feature (#1555397)
  - fix crash when write follows large read (#1463706)
  - fix emit_move_insn ICE (#1565536)
  - add missing rs6000-cpus.def (#1512202)


author: Marek Polacek <polacek@redhat.com> 4.8.5-34
changelog:
  - fix infinite looping in -fipa-cp-clone (#1546372)
  - don't look for vsld gcc.target/powerpc/pr72717.c


author: Marek Polacek <polacek@redhat.com> 4.8.5-36.2
changelog:
  - allow libitm to use HTM (#1674383)
  - fix mode mismatch in prepare_cmp_insn (#1676795, PR target/63442)


author: Dave Anderson <anderson@redhat.com> - 7.2.3-5
changelog:
  - Rebase to github commits b9d76838 to c79a11fa
    Resolves: rhbz#1559460
  - Fix ppc64/ppc6le stacksize calculation
    Resolves: rhbz#1589685


author: Dave Anderson <anderson@redhat.com> - 7.2.3-7
changelog:
  - Support ppc64 increased VA range
  - Fix ppc64 "bt" command failure reporting invalid NIP value
    Resolves: rhbz#1617936


author: Dave Anderson <anderson@redhat.com> - 7.2.3-8
changelog:
  - Fix ppc64 "bt" command failure reporting invalid NIP value for a user-space task. 
    Resolves: rhbz#1617936


author: Dave Anderson <anderson@redhat.com> - 7.2.3-9
changelog:
  - Alternate list loop detection option
    Resolves: rhbz#1595389
  - Readline library tab completion plugin
    Resolves: rhbz#1656165


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.3-11.1
changelog:
  - crash/sadump, kaslr: fix failure of calculating kaslr_offset due to an sadump format restriction
    Resolves: rhbz#1854016


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-14
changelog:
  - mark the 0hourly and dailyjobs crontabs as config
  - properly handle users for whose getpwnam() returns NULL temporarily
  - log when crond is shutting down


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-16
changelog:
  - disable mail from anacron with empty MAILTO
  - crontab: do not block access with PAM when running as root
  - improve the crontab man page
  - do not hardcode system_u selinux user but use the user from
    the current context


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-17
changelog:
  - make anacron not to contradict itself in syslog
    (job output does not have to be necessarily mailed)


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-18
changelog:
  - fix regression - spurious PAM log message from crontab (#1479064)
  - allow empty variables in crontabs (#1439217)


author: Marcel Plch <mplch@redhat.com> - 1.4.11-20
changelog:
  - Fix race condition when crontab is modified the same second
    before and after reading the crontab
  - Resolves: rhbz#1638691


author: Marcel Plch <mplch@redhat.com> - 1.4.11-22
changelog:
  - Backport upstream patch to fix cron failing on
    smart card authentication
  - Resolves: rhbz#1650314


author: Jan Staněk <jstanek@redhat.com> - 1.4.11-24
changelog:
  - Limit memory allocated for file descriptors
    Backports https://github.com/cronie-crond/cronie/commit/584911514ce6aa2f16e1d79431bac816ea62cb2c
    Resolves: rhbz#2026289


author: Ondrej Kozina <okozina@redhat.com> - 1.6.7-1
changelog:
  - Update to cryptsetup 1.6.7.
  - patch: avoid use of kernel crypto API socket which is known
    to be broken in RHEL7.0 kernel (7.1+ is fine).
  - Resolves: #1206170


author: Ondrej Kozina <okozina@redhat.com> - 1.7.4-4
changelog:
  - patch: fix regression in blockwise functions
  - patch: avoid repeating error messages when device holders
    detected.
  - patch: add option to cryptsetup-reencrypt to print progress
    log sequentaly
  - patch: use --progress-frequency in reencryption dracut module
  - Resolves: #1480006 #1447632 #1479857


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-2
changelog:
  - patch: stop LUKS2 auto-recovery if device is no longer LUKS
    type
  - patch: update cryptsetup man page for --type option
  - patch: rephrase error message for invalid --type option in
    convert action
  - Resolves: #1599281 #1601477 #1601481


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-3
changelog:
  - Add expected permissions explicitly for locking directory.
  - Reinstate sed script removing library rpath from libtool
    script due to bug in upstream sources distribution.
  - Resolves: #1609847 #1610379


author: Isaac Boukris <iboukris@redhat.com> - 4.10.16-2
changelog:
  - resolves: #1828354 - add additioanl hostnames to the keytab
  - resolves: #1836427 - add dnshostname option net-ads-join


author: Andreas Schneider <asn@redhat.com> - 4.10.16-8
changelog:
  - resolves: #1878205 - Fix restarting winbind on package upgrade
  - resolves: #1892632 - Fix CVE-2020-14318
  - resolves: #1891687 - Fix CVE-2020-14323
  - resolves: #1879834 - Fix CVE-2020-1472
  - resolves: #1892313 - Fix memory leak in winbindd (wbinfo -u)
  - resolves: #1868917 - Fix %U substitution for 'valid users' option
  - resolves: #1853272 - Fix 'require_membership_of' documentation in
                         pam_winbind{.conf} manpage


author: Andreas Schneider <asn@redhat.com> - 4.10.16-14
changelog:
  - resolves: #1937867 - Fix possible core dump with printing support
  - resolves: #1930747 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.10.16-16
changelog:
  - resolves: #2019661 - Fix CVE-2016-2124
  - resolves: #2019673 - Fix CVE-2020-25717
  - resolves: #2021428 - Add missing PAC buffer types to krb5pac.idl


author: Andreas Schneider <asn@redhat.com> - 4.10.16-18
changelog:
  - resolves: #2034800 - Fix usermap script regression caused by CVE-2020-25717
  - resolves: #2036595 - Fix MIT realm regression caused by CVE-2020-25717
  - resolves: #2046148 - Fix CVE-2021-44142


author: Andreas Schneider <asn@redhat.com> - 4.10.16-19
changelog:
  - resolves: #2081649 - Fix idmap_rfc2307 and idmap_nss returning wrong
                         mapping for uid/gid conflict


author: Andreas Schneider <asn@redhat.com> - 4.10.15-1
changelog:
  - related: #1785121 - Rebase to version 4.10.15
  - resolves: #1828924 - Fix typo in pam_winbind documentation about require_membership_of
  - resolves: #1801496 - Add missing ctdb directories


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-39
changelog:
  - resolve covscan issue found in fix for 1570480
  - automake sometimes fails to generate correct macros - so force autoconf


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-44
changelog:
  - 1774460 - CVE-2019-8696 cups: stack-buffer-overflow in libcups's asn1_get_packed function [rhel-7]
  - 1774461 - CVE-2019-8675 cups: stack-buffer-overflow in libcups's asn1_get_type function [rhel-7]
  - 1753809 - Settings in ~/.cups/client.conf aren't used


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-46
changelog:
  - 1715907 - CUPS- client: cupsGetPPD3() function tries to load PPD from IPP printer and not from the CUPS queue


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-18
changelog:
  - Fix segfault in texttopdf filter (bug #1194263).
  - Improve cups-browsed efficiency (bug #1191691).
  - Fetch printer descriptions with cups-browsed (bug #1223719).
  - Fix cups-browsed "_" handling for printer names (bug #1167408).


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-21
changelog:
  - Fix heap-based buffer overflow in texttopdf filter (bug #1241242,
    CVE-2015-3258, CVE-2015-3279).


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.0.35-28
changelog:
  - 1816109 - Queues are not cleaned up after stopping cups-browsed
  - 1811190 - cups-browsed leaks memory


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-50
changelog:
  - remove dead code, detected by Coverity Analysis
  - remove unused variable, detected by GCC and Clang


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-52
changelog:
  - prevent curl --rate-limit from hanging on file URLs (#1281969)
  - fix NTLM password overflow via integer overflow (CVE-2018-14618)
  - fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)
  - backport options to force TLS 1.3 in curl and libcurl (#1672639)
  - prevent curl --rate-limit from crashing on https URLs (#1683292)


author: Jakub Jelen <jjelen@redhat.com> 2.1.26-18
changelog:
  - Revert updated GSSAPI flags as in RFC 4752 to restore backward compatibility (#1154566)
  - Add and document ability to run saslauth as non-root user (#1188065)
  - Support AIX SASL GSSAPI (#1174322)
  - Update client library to be thread safe (#1147659)
  - Fix problem, that parsing short prefix matches the whole mechanism name (#1089267)
  - Don't use unnecessary quotes around user description (#1082564)
  - Fix confusing message when config file has typo (#1022479)


author: Jeff Moyer <jmoyer@redhat.com> - 58.2-1
changelog:
  - rebase to v58.2
  - remove patches that were backported from later versions
  - we now support >4k faults, so remove rhel-only patches
  - add libpmem dependency, and gate it on x86_64
  - pull in static checker fix for uncheck sscanf result
  - fix up use of uninitialized variable
  - Related: bz#1457566 bz#1471807 bz#1456954


author: Jeff Moyer <jmoyer@redhat.com> - 60.3-2.1
changelog:
  - Remove the btt.rules udev rule file.  This was fixed in-kernel. (Jeff Moyer)
  - Related: bz#1585122


author: Jeff Moyer <jmoyer@redhat.com> - 62-1
changelog:
  - Rebase to v62 (Jeff Moyer)
    - a new monitor command / daemon
    - an ndctl udev rule for recording the unsafe shutdown count
    - smart error injection
    - create-namespace fix for fragmented namespaces
  - Resolves: bz#1610649 bz#1611833 bz#1456320


author: Jeff Moyer <jmoyer@redhat.com> - 64.1-1
changelog:
  - Rebase to v64.1 (Jeff Moyer)
    - add security commands
    - fix broken udev rule for dirty shutdown count
  - Resolves: bz#1634348 bz#1635441


author: Jeff Moyer <jmoyer@redhat.com> - 65.1.el7
changelog:
  - Rebase to v65
    - clear-errors: new command to clear errors on a namespace
    - monitor: remove the requirement of a default config
    - sanitize-dimm: allow a zero-key for secure-erase
    - sanitize-dimm: preserve keys after an overwrite
    - load-keys: fix for non-TPM keys
  - Fix test harness to run against the rhel7 test kernel modules
  - Related: rhbz#1722481


author: Jeff Moyer <jmoyer@redhat.com> - 65.2.el7
changelog:
  - Remove 'daxctl migrate-device-model' command.  We won't
    support hot-plugging device dax into the memory hierarchy
    on RHEL 7.
  - Resolves: rhbz#1734153


author: Jeff Moyer <jmoyer@redhat.com> - 65.3.el7
changelog:
  - modify nvdimm-security.conf touse '&&' instead of ';'
    Without this change, the module doesn't load
  - Resolves: rhbz#1725405


author: Marek Kasik <mkasik@redhat.com> - 0.26.0-1
changelog:
  - Update to 0.26.0
  - Remove editor subpackage
  - Return libdbus-1 library (not header or pkgconfig files)
  - Resolves: #1386841


author: Marek Kasik <mkasik@redhat.com> - 0.28.0-3
changelog:
  - Check mtimes of files in /etc/dconf/db/*.d/ directories
  - when running "dconf update"
  - Resolves: #1570569


author: Marek Kasik <mkasik@redhat.com> - 3.22.3-2
changelog:
  - Import dconf-editor package from Fedora 25
  - Add Conflicts tag
  - Version BuildRequires
  - Update License field
  - Resolves: #1388931


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.45-1
changelog:
  - network: parsing of /proc/mounts returned (bug #1572659)
  - netconsole: LSB header added (bug #1508489)
  - ifdown-eth: no longer needed 'pidof -x dhclient' condition removed (bug #1559384)


author: Jan Macku <jamacku@redhat.com> - 9.49.48-1
changelog:
  - network: don't fail with IFDOWN_ON_SHUTDOWN (bug #1693977)
  - Configure autorelabel service to output to journal and to console if set (bug #1634661)
  - Fix changelog typo


author: Jan Macku <jamacku@redhat.com> - 9.49.49-1
changelog:
  - ifup-eth: Check that device name is set (bug #1741830)
  - Add option for IPv6 GRE tunnel (bug #1691552)


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-125
changelog:
  - Modify 0250-RHBZ-1610867-rescan-change.patch
    * Fix memory Leak
  - Modify 0255-RHBZ-1638651-marginal-path.patch
    * Fix NULL dereference
  - Refresh 0252-RHBZ-1623595-cmd-error-status.patch
  - Resolves: bz #1610867, #1638651


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-127
changelog:
  - Add 0256-RHBZ-1672175-retry-no-fd-paths.patch
    * retry adding paths if they couldn't be opened initially
  - Add 0257-RHBZ-1679556-dont-check-dm-devices.patch
    * don't check if dm devices are multipath paths
  - Add 0258-RHBZ-1634183-ANA-prioritizer.patch
    * Add NVMe ANA path prioritizer
  - Resolves: bz #1634183, #1672175, #1679556


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-128
changelog:
  - Modify 0258-RHBZ-1634183-ANA-prioritizer.patch
    * minor change
  - Add 0259-RHBZ-1701604-fix-nr-active.patch
    * recalculate the number of active paths whenever a path is checked
  - Add 0260-RHBZ-1634183-prio-fixes.patch
  - Add 0261-RHBZ-1714506-skip-blacklisted-paths.patch
    * ignore blacklisted paths in mpathpersist
  - Add 0262-RHBZ-1699486-reload-with-failed-paths.patch
    * allow forced reloads even if there are no reusable paths
  - Add 0263-RHBZ-1686708-nvme-hcil.patch
    * make nvme ids work like in upstream
  - Add 0264-RHBZ-1699441-de-series-config.patch
  - Resolves: bz #1686708, #1699441, #1699486, #1701604, #1714506


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-129
changelog:
  - Add 0265-RHBZ-1721855-mpathpersist-speedup.patch
    * only grab path information from necessary devices, and allow batch files.
  - Add 0266-RHBZ-1696817-fix-emc-checker.patch
    * fix detection of inactive snapshots
  - Add 0267-RHBZ-1661156-powermax-config.patch
  - Remove 0261-RHBZ-1714506-skip-blacklisted-paths.patch
    * This fix is superseded by 0265-RHBZ-1721855-mpathpersist-speedup.patch
  - Resolves: bz #1661156, #1696817, #1721855


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-130
changelog:
  - Add 0268-RHBZ-1721855-mpathpersist-fixes.patch
    * Fix issues in the mpathpersist speedup code
  - Resolves: bz #1721855


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-131
changelog:
  - Modify 0268-RHBZ-1721855-mpathpersist-fixes.patch
    * The fix for 1721855 broke 1714506.
  - Resolves: bz #1714506


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-132
changelog:
  - Add 0269-RHBZ-1804420-remove-kpartx-limit.patch
    * Remove the 256 device limit, when searching loop devices with kpartx
  - Resolves: bz #1804420


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-133
changelog:
  - Add 0270-RHBZ-1775481-segfault-fix.patch
    * Fix segfault related to missing dm device tables
  - 0271-RHBZ-1806197-mpathconf-typo.patch
  - Resolves: bz #1775481, #1806197


author: Marian Csontos <mcsontos@redhat.com> - 0.7.3-1
changelog:
  - Update to latest bugfix and documentation update release.
  - *_restore tools wipe superblock as a last resort.
  - Add thin_check --override-mapping-root.


author: Petr Menšík <pemensik@redhat.com> - 12:4.2.5-74
changelog:
  - Use bind-export-libs package instead of bind99
  - Use isc-config.sh to configure bind libs
  - Change requirement to bind-export-devel
  - Compile with recent bind includes, that does not include isc/util.h


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: dhcp.ini
  -->  Config file for automated patch script
  - Removed Patch: dhcp-4.2.0-errwarn-message.patch
  -->  Remove patch containing instructions to report bugs to bugzilla.redhat.com


author: Lianbo Jiang <lijiang@redhat.com> - 1:3.2-4
changelog:
  - Fix System Slot Information for PCIe SSD
  - Resolves: rhbz#1793900
  - Sync with upstream(commit:62bce59fed1)
  - Resolves: rhbz#1767323


author: Petr Menšík <pemensik@redhat.com> - 2.76-2
changelog:
  - Fix a few coverity warnings
  - package is dual-licensed GPL v2 or v3
  - don't include /etc/dnsmasq.d in triplicate, ignore RPM backup files instead


author: Petr Menšík <pemensik@redhat.com> - 2.76-5
changelog:
  - Fix CVE-2017-14491
  - Fix CVE-2017-14492
  - Fix CVE-2017-14493
  - Fix CVE-2017-14494
  - Fix CVE-2017-14496
  - Fix CVE-2017-14495
  - extra fixes


author: Petr Menšík <pemensik@redhat.com> - 2.76-16.1
changelog:
  - Accept responses only on correct sockets (CVE-2020-25684)
  - Use strong verification on queries (CVE-2020-25685)
  - Handle multiple identical DNS queries better (CVE-2020-25686)
  - Link against nettle for sha256 hash implementation


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.10-7
changelog:
  - prevent warning messages from %post section if selinux-policy is
    not installed (yet) (#1057522)
  - compile with xz compression support enabled (#1176214)
  - fix crash in sieve script compilation (#1177852)
  - wait with start after network-online target (#1209006)
  - build with tcp wrappers enabled (#1229164)
  - fixed userdb extra fields handling in passdb failure (#1234868)
  - fix valgrind option detection for make check (#1249625)
  - first valid regular user id is 1000 (#1280433)
  - fixed race condition when creating a new mailbox and another process getting its GUID (#1331478)
  - fixed header parsing when there were multiple same header names (#1224496)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-1
changelog:
  - dovecot updated to 2.2.36, pigeonhole to 0.4.24
  - fixed dsync not replicating sieve scripts (#1419426)
  - fix plugins incorrectly reporting epipe errors(#1489943)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-3
changelog:
  - fix global ACL directory configuration search path (#1630380)
  - update first/last_valid_gid range patch (#1630409)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-5
changelog:
  - fix CVE-2019-3814: improper certificate validation (#1674369)
  - fix CVE-2019-7524: buffer overflow in indexer-worker process resulting in privilege 
    escalation (#1700398)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-6
changelog:
  - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
    when scanning data in quoted strings, leading to out of bounds heap
    memory writes (#1741787)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-6.1
changelog:
  - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1871841)
  - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1871843)
  - fix CVE-2020-12674 crash due to assert in RPA implementation (#1871842)


author: Than Ngo <than@redhat.com> - 1:1.8.4-3
changelog:
  - backport upstream patches to fix issues:
     * Generated XML is malformed
     * Missing space before optional option in method argument list
     * Closing ) of function in function documentation is in wrong color
     * Segmentation fault parsing a fortran file


author: Than Ngo <than@redhat.com> - 1:1.8.5-4
changelog:
  - Resolves: #1483569, incorrect processing of code blocks
  - Resolves: #1724173 - CVE-2016-10245, cross-site scripting


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-18
changelog:
  - fix out-of-bounds write on corrupted fs (#1797731)
  - fix out-of-bounds write on corrupted fs (#1768710)
  - fix e2fsprogs creating corrupted meta image (#1711880)
  - fix typo in ext4 man page (#1720130)
  - provide easy metod for creating compatible rhel6 fs (#1780277)
  - better handling of trivial dir link count problem (#1820048)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
    by assuming the date is correct and changing the weekday.
    Tue Oct 15 2007 --> Tue Oct 09 2007 or Mon Oct 15 2007 or Tue Oct 16 2007 or ....
    Tue Jan 09 2008 --> Tue Jan 08 2008 or Wed Jan 09 2008 or Tue Jan 15 2008 or ....
    Mon Jan 10 2008 --> Mon Jan 07 2008 or Thu Jan 10 2008 or Mon Jan 14 2008 or ....
    Mon Oct 03 2008 --> Mon Sep 29 2008 or Fri Oct 03 2008 or Mon Oct 06 2008 or ....
    Fri Aug 05 2009 --> Fri Jul 31 2009 or Wed Aug 05 2009 or Fri Aug 07 2009 or ....
    Thu Sep 14 2009 --> Thu Sep 10 2009 or Mon Sep 14 2009 or Thu Sep 17 2009 or ....
    Mon Jul 13 2010 --> Mon Jul 12 2010 or Tue Jul 13 2010 or Mon Jul 19 2010 or ....
    Thu Jan 01 2014 --> Thu Dec 26 2013 or Wed Jan 01 2014 or Thu Jan 02 2014 or ....
    Tue Mar 23 2018 --> Tue Mar 20 2018 or Fri Mar 23 2018 or Tue Mar 27 2018 or ....
    Tue Jun 13 2018 --> Tue Jun 12 2018 or Wed Jun 13 2018 or Tue Jun 19 2018 or ....


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
    by assuming the date is correct and changing the weekday.


author: Peter Jones <pjones@redhat.com> - 0.8.0-6
changelog:
  - Handle -b and -o parsing in a way that matches the documentation.
    Resolves: rhbz#1174964
  - Use the right GUID when setting boot entries active/inactive
    Resolves: rhbz#1221771


author: Peter Jones <pjones@redhat.com> - 17-2
changelog:
  - Try to make covscan actually complete the scan...
    Related: rhbz#1570032
    Related: rhbz#1558937
    Related: rhbz#1520533


author: Peter Jones <pjones@redhat.com> - 36-6
changelog:
  - Fix device path generation for block devices on nonstandard device path
    roots.
    Related: rhbz#1558937
    Resolves: rhbz#1591853


author: Peter Jones <pjones@redhat.com> - 36-10
changelog:
  - Work around platform ACPI PCI(e) root drivers that don't fill in the
    "driver" symlink in sysfs.
    Resolves: rhbz#1614944


author: Peter Jones <pjones@redhat.com> - 36-11
changelog:
  - Fix device probing with no matching probes where HD() will work
    Resolves: rhbz#1613698
  - Detect partitiond md devices correctly
    Resolves: rhbz#1602414
    Resolves: rhbz#1613370


author: Peter Robinson <pbrobinson@fedoraproject.org> 4.0.1-1
changelog:
  - Ekiga 4.0.1 stable release - Changelog
    http://ftp.gnome.org/pub/gnome/sources/ekiga/4.0/ekiga-4.0.1.news


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com> 7.1-3
changelog:
  - Old EULA bug fixed 
  - SL keys removed
  - Removed Trigger for yum-conf-7x, we don't use that packaged - Sun Oct 25 2015
    |- sl-version 7.1-3


author: Mark Wielaard <mjw@redhat.com> - 0.170-1
changelog:
  - New upstream release. Remove upstreamed patches.
  - Sync provide_yama_scope with fedora.
  - Add elfutils-0.170-x86_64-backtrace-test-override.patch.


author: Mark Wielaard <mjw@redhat.com> - 0.171-1
changelog:
  - New upstream release.
    - DWARF5 and split dwarf, including GNU DebugFission, support.
    - readelf: Handle all new DWARF5 sections.
      --debug-dump=info+ will show split unit DIEs when found.
      --dwarf-skeleton can be used when inspecting a .dwo file.
      Recognizes GNU locviews with --debug-dump=loc.
    - libdw: New functions dwarf_die_addr_die, dwarf_get_units,
      dwarf_getabbrevattr_data and dwarf_cu_info.
      libdw will now try to resolve the alt file on first use
      when not set yet with dwarf_set_alt.
      dwarf_aggregate_size() now works with multi-dimensional arrays.
    - libdwfl: Use process_vm_readv when available instead of ptrace.
    - backends: Add a RISC-V backend.


author: Mark Wielaard <mjw@redhat.com> - 0.172-1
changelog:
  - New upstream release.
    - No functional changes compared to 0.171.
    - Various bug fixes in libdw and eu-readelf dealing with bad DWARF5
      data. Thanks to running the afl fuzzer on eu-readelf and various
      testcases.
    - eu-readelf -N is ~15% faster.


author: Mark Wielaard <mjw@redhat.com> - 0.176-1
changelog:
  - New upstream release (#1676504)
    CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150,
    CVE-2019-7664, CVE-2019-7665, CVE-2018-16062, CVE-2018-16402,
    CVE-2018-16403, CVE-2018-18310, CVE-2018-18521, CVE-2018-18520.


author: Jan Synáček <jsynacek@redhat.com> - 1:24.3-21
changelog:
  - fix libjpeg detection fails with gcc7 (#1487557)
  - fix Emacs GUI Toolbar icons missing (#1477745)
  - fix hardening: TLS certificate warnings should be hard errors (#1403643)


author: Petr Stodulka <pstodulk@redhat.com> - 1.8.3.1-13
changelog:
  - fall back to Basic auth if Negotiate fails
    Resolves: #1490998
  - handle request-pull when multiple tags point to the same commit
    Resolves: #1192146


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-14
changelog:
  - Backport fix for CVE-2018-11235
  - Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-15
changelog:
  - move instaweb to separate git-instaweb subpackage.
  	Resolves: #1213059
  - move gnome-keyring to a separate git-gnome-keyring subpackage.
  	Resolves: #1284081


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-16
changelog:
  - Remove EL-5 settings and old Fedora conditionals.
    Taken from fedora commits 903d8f35ed8ae16bece8ae8033f3d3926cc97595 and
    2c6eff99d7b50b87e8a1fe2e4a0489dfd90659b8.
  - Fix builds using '--without docs'
  - Change git-instaweb default from lighttpd(not available in rhel7) to
    apache2.
  - Add requires for git-{instaweb,gnome-keyring} to pull them, when
    installing git-all.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-17
changelog:
  - Correctly return an error from fsck on encountering a .gitmodules symlink.
    This was broken in the debian 2.1.x backport and found by covscan.
    Fix the test to catch this.
  - Correct a typo in changelog.


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-19
changelog:
  - Fix httpd modules path to be independent from system architecture.
  Upstream commit: 1976311aa285549599e5a451d7ad72b55a2b60e2
  Resolves: #1213059


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-20
changelog:
  - Fix CVE-2018-17456: arbitrary code execution via .gitmodules
    Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Ondrej Pohorelsky <opohorel@redhat.com> - 1.8.3.1-21
changelog:
  - Fix CVE-2019-1387: remote code execution in recursive clones with nested
    submodules
    Resolves: CVE-2019-1387


author: Vít Ondruch <vondruch@redhat.com> - 1.8.3.1-23
changelog:
  - Prevent crafted URL containing new lines, empty host or lacks a scheme
    to cause credential leak.
    Resolves: CVE-2020-11008


author: Debarshi Ray <rishi@fedoraproject.org> - 3.12.12-4
changelog:
  - Fix certificate validation (use reference identities, handle validation
    failures correctly, fixed the test suite)
  - Resolves: #1386616


author: Marek Kasik <mkasik@redhat.com> - 3.28.2-3
changelog:
  - Fix patch fixing crash in EvMediaPlayerKeys
  - Fix building of comics backend with libarchive 3.1.2
  - Resolves: #1567186


author: Marek Kasik <mkasik@redhat.com> - 3.28.2-4
changelog:
  - Change requires as requested by RPMDiff
  - Check returned size for negative value (CovScan)
  - Resolves: #1567186


author: Marek Kasik <mkasik@redhat.com> - 3.28.2-8
changelog:
  - Do not free EvDocumentInfo in ev_window_save_print_settings(),
  - it is freed in EvDocument's destructor
  - Resolves: #1541358


author: Milan Crha <mcrha@redhat.com> - 3.28.5-6
changelog:
  - Add patch for RH bug #1753122 (GalA11yETableItem: Incorrect implementation of AtkObjectClass::ref_child())


author: Milan Crha <mcrha@redhat.com> - 3.22.7-4
changelog:
  - Add patch for RH bug #1441608 (Use-after-free when setting summary for component with alarms)
  - Add patch for RH bug #1439590 ([IMAPx] Unsubscribed folders shown after refresh)


author: Milan Crha <mcrha@redhat.com> - 3.22.7-7
changelog:
  - Add patch for RH bug #1504071 (Prefer SSL over STARTTLS for mail when both are set in GOA)
  - Add patch for RH bug #1476329 (Deadlock on exit under e-categories.c:finalize_categories())


author: Milan Crha <mcrha@redhat.com> - 3.28.2-1
changelog:
  - Update to 3.28.2
  - Add patch for GNOME bug #795997 (Fails to parse Google OAuth2 authorization code)
  - Resolves: #1575495


author: Milan Crha <mcrha@redhat.com> - 3.28.5-4
changelog:
  - Add patch for RH bug #1392567 (Sync CategoryList with mail Labels)
  - Add patch for RH bug #1764669 (Send meeting change notifications only if being the organizer)


author: Milan Crha <mcrha@redhat.com> - 3.12.10-5
changelog:
  - Add patch for RH bug #1366206 (Free/Busy Information returns wrong time)
  - Add patch for RH bug #1367455 (No contacts are displayed until search is started)


author: Milan Crha <mcrha@redhat.com> - 3.22.6-2
changelog:
  - Add patch for RH bug #1520936 (Unable to authenticate using Kerberos without krb5-auth-dialog package)


author: Nikola Forró <nforro@redhat.com> - 2.2.0-9
changelog:
  - Fix CVE-2017-18233
    resolves: #1574865
  - Fix CVE-2017-18234
    resolves: #1656011
  - Fix CVE-2017-18236
    resolves: #1574905
  - Fix CVE-2017-18238
    resolves: #1572270
  - Fix CVE-2018-7730
    resolves: #1572631


author: Jan Grulich <jgrulich@redhat.com> - 0.26-2
changelog:
  - Fix heap-based buffer over-read in Exiv2::Image::byteSwap4 in image.cpp
    Resolves: bz#1547207

    Fix heap-based buffer over-read in Exiv2::getULong function in types.cpp
    Resolves: bz#1545232


author: Jan Grulich <jgrulich@redhat.com> - 0.26-3
changelog:
  - Fix uncontrolled recursion in image.cpp:Exiv2::Image::printIFDStructure() which can allow a
    remote attacker to cause a denial of service via a crafted tif file
    Resolves: bz#1548410


author: Jan Grulich <jgrulich@redhat.com> - 0.27.0-4
changelog:
  - Fix heap-based buffer overflow vulnerability in jp2image.cpp that may lead to DoS
    Resolves: bz#1990352


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-13
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-14
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Chris Leech <cleech@redhat.com> - 1.0.30-4.git91c0c8c
changelog:
  - 1039779 replace README that contained mostly build instructions with
    README.redhat containing better distro-specific information


author: Chris Leech <cleech@redhat.com> - 1.0.31-1.git5dfd3e4
changelog:
  - 1274530 rebase to upstream 1.0.31+
  - no longer requires libhbaapi/libhbalinux
  - no longer attempts to connect to lldpad if DC_REQUIRED is configured off
    for all interfaces


author: Chris Leech <cleech@redhat.com> - 1.0.32-1
changelog:
  - 1384707 fcoeadm --target segfaults if non-FCoE FC targets are present
  - 1321611 fcoemon should only try to connect to lldpad when required


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-26
changelog:
  - fence_mpath: fix watchdog reboot not triggered when multipath
    disconnected
    Resolves: rhbz#1751702


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-30
changelog:
  - fencing: only use inetX_only parameters for SSH based agents and
    fence_zvmip
    Resolves: rhbz#1722004


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-31
changelog:
  - fence_compute/fence_evacuate: fix region_name content type and
    project shortopt in usage text and project-domain shortopt
    Resolves: rhbz#1760203
  - fence_rhevm: add cookie support
    Resolves: rhbz#1763675
  - fencing: improve stdin quote parsing
    Resolves: rhbz#1769784


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-34
changelog:
  - fence_aws: improve parameter logic to allow setting region parameter
    while using credentials from ~/.aws/config
    Resolves: rhbz#1673468
  -


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-39
changelog:
  - fence_vmware_rest: add filter parameter to avoid 1000 VM API limit
    and avoid failing when hitting it during the monitor-action
    Resolves: rhbz#1654058


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-41.1
changelog:
  - fence_lpar: fix issue with long username, hostname, etc not
    working when the command run by the agent exceeds 80 characters
  - fence_evacuate: enable evacuation of instances using private flavors

    Resolves: rhbz#1860545
    Resolves: rhbz#1862024


author: Jan Kaluza <jkaluza@redhat.com> - 5.11-27
changelog:
  - fix CVE-2014-0207 - cdf_read_short_sector insufficient boundary check
  - fix CVE-2014-0237 - cdf_unpack_summary_info() excessive looping DoS
  - fix CVE-2014-0238 - CDF property info parsing nelements infinite loop
  - fix CVE-2014-3478 - mconvert incorrect handling of truncated pascal string
  - fix CVE-2014-3479 - fix extensive backtracking in regular expression
  - fix CVE-2014-3480 - cdf_count_chain insufficient boundary check
  - fix CVE-2014-3487 - cdf_read_property_info insufficient boundary check
  - fix CVE-2014-3538 - unrestricted regular expression matching
  - fix CVE-2014-3587 - fix cdf_read_property_info
  - fix CVE-2014-3710 - out-of-bounds read in elf note headers
  - fix CVE-2014-8116 - multiple denial of service issues (resource consumption)
  - fix CVE-2014-8117 - denial of service issue (resource consumption)
  - fix CVE-2014-9652 - out of bounds read in mconvert()
  - fix CVE-2014-9653 - malformed elf file causes access to uninitialized memory


author: Jan Kaluza <jkaluza@redhat.com> 5.11-32
changelog:
  - fix #1278737 - add support for Java 1.7 and 1.8
  - fix #1281723 - show full executable name for core
  - fix #1271636 - add support for detection of Python 2.7 byte-compiled files
  - fix #1278768 - comment out too-sensitive Pascal magic


author: Ray Strode <rstrode@redhat.com> 3.14.2-6
changelog:
  - Add more goo to the compat desktop file to prevent it
    from getting exposed in control-center
    Related: #1259292


author: Eric Garver <egarver@redhat.com> - 0.6.3-3
changelog:
  - backport recent upstream stable fixes
  - backport fix --remove-rules deleting all direct rules
  - backport fix unable to delete rich rule forward-port
  - backport fix forward-port for external zone hijacking internal zone
  - backport fix testsuite iptables locking


author: Eric Garver <egarver@redhat.com> - 0.6.3-1
changelog:
  - rebase package to v0.6.3, include recent stable fixes
  - use QT4 patch for firewall-applet
  - remove cockpit service definition, cockpit package still ships their own
  - remove testsuite force of LC_ALL=C.UTF-8. RHEL-7 doesn't have C.UTF-8
  - remove nftables support


author: Eric Garver <egarver@redhat.com> - 0.6.3-2
changelog:
  - backport recent upstream stable fixes
  - backport fix to enable IP forwarding only if toaddr specified


author: Akira TAGOH <tagoh@redhat.com> - 2.10.95-5
changelog:
  - Fix the race condition issue on updating cache (#1011510)
  - Fix crash issue in FcFontSort()
  - Fix an issue not copying all values from the font.


author: Akira TAGOH <tagoh@redhat.com> - 2.13.0-4.1
changelog:
  - Rebase to 2.13.0 (#1576501)
  - Rename fc-cache binary to fc-cache-{32,64} for multilib. (#1568968)
  - backport some fixes related to Flatpak.
  - Drop new syntax in config for compatibility.
  - Requires dejavu-sans-fonts instead of font(:lang=en) (#1484094)


author: Parag Nemade <pnemade AT redhat DOT com> - 20120731b-9
changelog:
  - Added cflags -Wstrict-aliasing
  - Fixed some compile-time errors from invalid Makefile rules
  - Fixed bogus date in changelog


author: Parag Nemade <pnemade AT redhat DOT com> - 20120731b-10
changelog:
  - Revert previously added -Wstrict-aliasing cflags
  - We actaully need -fno-strict-aliasing (rh#903288)
  - Remove %defattr() (rh#1003518)
  - fontforge.xml should not be executable (rh#1003518)


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-1
changelog:
  - Upgrade to upstream v3.0.13 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
    Resolves: Bug#1329181 freeradius-python fix libpython2.7.so dependency at
                          compile time
    Resolves: Bug#1425869 Radiusd does not trigger modules.sql.fail trap if it
                          can't connect to mysql server
    Resolves: Bug#1427829 Stack overflow when passing bare IPv6 to radclient


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-2
changelog:
  - Fix some issues found with static analyzers.
    Resolves: Bug#1432103 FreeRADIUS fails covscan checks
  - Revert rlm_eap_tnc removal, because the tncfhh package is still in RHEL.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-3
changelog:
  - Explicitly disable rlm_cache_memcached to avoid error when the module's
    dependencies are installed, and it is built, but not packaged.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
  - Prevent segfaults by adding a missing handling of connection errors in
    rlm_ldap.
    Resolves: Bug#1437409 [abrt] freeradius: radiusd killed by SIGSEGV
  - Make radtest use Cleartext-Password for EAP, fixing its support for eap-md5.
    Resolves: Bug#1436619 radtest does not work with eap-md5


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-4
changelog:
  - Disable internal OpenSSL cache.
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass
  - Check sizeof(*packet), not sizeof(packet) in EAP-PWD
    Resolves: Bug#1459073 Potential buffer overflow in FreeRADIUS EAP-PWD
  - Parse port as well as address for dhcpclient destination
    Resolves: Bug#1457825 dhcpclient does no accept IP:PORT


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-5
changelog:
  - Refer to correct package version in configuration comments for Bug#1458746
    (CVE-2017-9148) fix.
    Related: Bug#1458746  CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-6
changelog:
  - Avoid race condition when creating session cache file
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-7
changelog:
  - Resolves: Bug#1469408 CVE-2017-10978 freeradius: Out-of-bounds read/write due
                          to improper output buffer size check in make_secret()
  - Resolves: Bug#1469412 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63
  - Resolves: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                          data2vp_wimax()
  - Resolves: Bug#1469416 CVE-2017-10985 freeradius: Infinite loop and memory
                          exhaustion with 'concat' attributes
  - Resolves: Bug#1469419 CVE-2017-10986 freeradius: Infinite read in
                          dhcp_attr2vp()
  - Resolves: Bug#1469422 CVE-2017-10987 freeradius: Buffer over-read in
                          fr_dhcp_decode_suboptions()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-9
changelog:
  - Fix double free in rlm_sql acct_redundant
    Resolves: Bug#1551069 Radius service crashes with "Bad talloc magic value -
                          unknown value" when using module sql rlm_sql


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-10
changelog:
  - Fixes two EAP-PWD security issues
    Resolves: bz#1699413 authentication bypass with an invalid curve attack


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-10
changelog:
  - Fixes two EAP-PWD security issues
    Resolves: bz#1699414 authentication bypass with an invalid curve attack
    Resolves: bz#1699419 fake authentication using reflection


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-11
changelog:
  - Fixes logrotate, EAP-PWD vulnerability
    Resolves: bz#1719368 privilege escalation due to insecure logrotate configuration
    Resolves: bz#1751796 eap-pwd: Information leak due to aborting when needing more than 10 iterations


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-15
changelog:
  - Fixes EAP-PWD: DoS issues due to multithreaded BN_CTX access
    Resolves: bz#1818808

    * Fri Feb 7 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.13-14
  - Fixes receiving of multiple RADIUS packets under load
    Resolves: bz#1630684


author: Ondrej Holy <oholy@redhat.com> - 1.0.2-11
changelog:
  - Use boolean types defined stdbool.h (#1404575)
  - Prevent stucked keys on focus out and unmap events (#1415069)
  - Fix crashes when copying images (#1417536)
  - Enable TLS 1.1 connections and later (#1312967)


author: Ondrej Holy <oholy@redhat.com> - 2.0.0-4.rc4
changelog:
  - CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
  - CVE-2020-11523: Fix integer overflow in region.c (#1837622)
  - CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-11
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197740


author: Richard Hughes <richard@hughsie.com> 1.0.1-1
changelog:
  - Rebase to 1.0.1, specifically the wip/hughsie/rhel75 branch which adds
    back the automake build system and lowers the required versions of deps.
  - This also un-neuters fwupd so that most of the plugins are functional,
    for instance allowing updates of Thunderbolt controllers and Logitech
    Unifying devices. However, the LVFS is still disabled.
  - Resolves: #1313086


author: Peter Jones <pjones@redhat.com> - 9-6
changelog:
  - Rebuild to make some dependencies versioned, in order to make TPS's really
    broken builder setup work.
    Related: rhbz#1380825


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: fwupdate.ini
  -->  Config file for automated patch script
  - Ran Regex: Red Hat Enterprise => Scientific
  -->  This RPM shouldn't say it is upstream's product
  - Added Source: fnal-sl.cer
  -->  The FNAL SL signing certificate
  - Added Source: fwupdate-spec-use_our_keys.patch
  -->  Remove the TUV keys and sign with ours


author: Honza Horak <hhorak@redhat.com> - 2.0.35-19
changelog:
  - Spec file cleanup
  - Compile and run test suite during build
  - Using chrpath to get rid of --rpath in gd-progs


author: Filip Januš <fjanus@redhat.com> - 2.0.35-27
changelog:
  - Fix CVE-2016-5766
  - Resolves: #1356813
  - Upstream patch: https://github.com/libgd/libgd/commit/aba3db8


author: Nils Philippsen <nils@redhat.com> - 0.2.0-11
changelog:
  - replace lua-5.2 patch by upstream commit
  - fix buffer overflow in and add plausibility checks to ppm-load op
    (CVE-2012-4433)
  - fix multi-lib issue in generated documentation


author: Paul Howarth <paul@city-fan.org> - 2.2.2-1
changelog:
  - Update to 2.2.2
    - geoipupdate now calls fsync on the database directory after a rename to
      make it durable in the event of a crash
  - Update autotools patch


author: Paul Howarth <paul@city-fan.org> - 2.3.1-1
changelog:
  - Update to 2.3.1
    - geoipupdate now uses TCP keep-alive when compiled with cURL 7.25 or
      greater
    - Previously, on an invalid gzip file, geoipupdate would output binary data
      to stderr; it now displays an appropriate error message
    - Install README, ChangeLog, GeoIP.conf.default etc. into docdir (GH#33)
    - $(sysconfdir) is now created if it doesn't exist (GH#33)
    - The sample config file is now usable (GH#33)


author: Paul Howarth <paul@city-fan.org> - 2.4.0-1
changelog:
  - Update to 2.4.0
    - geoipupdate now checks that the database directory is writable: if it is
      not, it reports the problem and aborts
    - geoipupdate now acquires a lock when starting up to ensure only one
      instance may run at a time: a new option, 'LockFile', exists to set the
      file to use as a lock ('.geoipupdate.lock' in the database directory by
      default)
    - geoipupdate now prints out additional information from the server when a
      download request results in something other than HTTP status 2xx; this
      provides more information when the API does not respond with a database
      file
    - ${datarootdir}/GeoIP is now created on 'make install' (GH#29)
    - Previously, a variable named 'ERROR' was used, which caused issues building
      on Windows (GH#36)
  - Drop EL-5 support
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section
    - noarch subpackages always available now
    - libcurl-devel always available now


author: Paul Howarth <paul@city-fan.org> - 2.5.0-1
changelog:
  - Update to 2.5.0
    - Replace use of strnlen() due to lack of universal availability (GH#71)
    - Document the 'LockFile' option in the 'GeoIP.conf' man page (GH#64)
    - Remove unused base64 library (GH#68)
    - Add the new configuration option 'PreserveFileTimes'; if set, the
      downloaded files will get the same modification times as their original on
      the server (default is '0') (GH#63)
    - Use the correct types when calling 'curl_easy_setopt()'; this fixes
      warnings generated by libcurl's 'typecheck-gcc.h' (GH#61)
    - In 'GeoIP.conf', the 'UserId' option was renamed to 'AccountID' and the
      'ProductIds' option was renamed to 'EditionIDs'; the old options will
      continue to work, but upgrading to the new names is recommended for
      forward compatibility


author: Andrew Price <anprice@redhat.com> - 3.1.10-3
changelog:
  - libgfs2: Issue one write per rgrp when creating them
  - mkfs.gfs2: Fix resource group alignment issue
  - mkfs.gfs2: Free unnecessary cached pages, disable readahead
    Resolves: rhbz#1440269


author: Andrew Price <anprice@redhat.com> - 3.1.10-5
changelog:
  - Update URL in spec file
    Resolves: rhbz#1501738
  - fsck.gfs2: Make -p, -n and -y conflicting options
    Resolves: rhbz#1507091


author: Andrew Price <anprice@redhat.com> - 3.1.10-9
changelog:
  - fsck.gfs2: Don't check fs formats we don't recognise
  - libgfs2: Fix pointer cast byte order issue
    Resolves: rhbz#1616389


author: Andrew Price <anprice@redhat.com> - 3.1.10-10
changelog:
  - libgfs2: Use sizeof for 'reserved' fields in ondisk.c
  - fsck.gfs2: Disambiguate 'check_data'
  - gfs2-utils: Accept a char* instead of a buffer head in gfs2_check_meta
  - fsck.gfs2: Disambiguate check_metalist
  - fsck.gfs2: Fix segfault in build_and_check_metalist
  - fsck.gfs2: Retain context for indirect pointers in ->check_metalist
  - fsck.gfs2: Clear bad indirect block pointers when bitmap meets expectations
    Resolves: rhbz#1487726


author: Andrew Price <anprice@redhat.com> - 3.1.10-11
changelog:
  - gfs2_jadd: Handle out-of-space issues
  - gfs2_jadd: error handling overhaul
    Resolves: rhbz#1837640


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-29
changelog:
  - Fix rare Segmentation fault when converting PDF to PNG (bug #1473337)
  - Raise the default VMThreshold from 1Mb to 8Mb (bug #1479852)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-31
changelog:
  - Added security fixes for:
    - CVE-2018-16509 (bug #1621158)
    - CVE-2018-15910 (bug #1621160)
    - CVE-2018-16542 (bug #1621382)


author: Martin Osvald <mosvald@redhat.com> - 9.07-32
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621385 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1649722 - CVE-2018-16539 ghostscript: incorrect access checking
    in temp file handling to disclose contents of files (699658) 
  - Resolves: #1621162 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621384 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)
  - Resolves: #1652902 - CVE-2018-16863 ghostscript: incomplete fix for
    CVE-2018-16509
  - Resolves: #1654045 ghostscript update breaks xdvi (gs: Error: /undefined in flushpage)
  - Resolves: #1651150 - CVE-2018-15911 ghostscript: uninitialized memory
    access in the aesdecode operator (699665)
  - Resolves: #1650061 - CVE-2018-16802 ghostscript: Incorrect "restoration of
    privilege" checking when running out of stack during exception handling
  - Resolves: #1652936 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c
  - Resolves: #1654622 - CVE-2018-16541 ghostscript: incorrect free logic in
    pagedevice replacement (699664)
  - Resolves: #1650211 - CVE-2018-17183 ghostscript: User-writable error
    exception table
  - Resolves: #1645517 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1648892 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1643117 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1655939 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)
  - Resolves: #1657694 - ghostscript: Regression: Warning: Dropping incorrect
    smooth shading object (Error: /rangecheck in --run--)
  - Resolves: #1661210 pdf2ps reports an error when reading from stdin
  - Resolves: #1657334 - CVE-2018-16540 ghostscript: use-after-free in
    copydevice handling (699661)
  - Resolves: #1660570 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660829 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661279 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)
  - Resolves: #1667443 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata


author: Martin Osvald <mosvald@redhat.com> - 9.25-1
changelog:
  - Rebase to latest upstream version (bug #1636115)
  - Resolves: #1673399 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - Resolves: #1678172 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1680026 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - fix for pdf2dsc regression added to allow fix for CVE-2019-3839


author: Martin Osvald <mosvald@redhat.com> - 9.25-2.2
changelog:
  - Resolves: #1744008 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445)
  - Resolves: #1744012 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444)
  - Resolves: #1744003 - CVE-2019-14813 ghostscript: Safer Mode Bypass by .forceput Exposure in setsystemparams (701443)
  - Resolves: #1744228 - CVE-2019-14817 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdfexectoken and other procedures (701450)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.1
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621383 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1649721 - CVE-2018-16539 ghostscript: incorrect access checking
    in temp file handling to disclose contents of files (699658) 
  - Resolves: #1621159 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621381 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.4
changelog:
  - Resolves: #1651149 - CVE-2018-15911 ghostscript: uninitialized memory
    access in the aesdecode operator (699665)
  - Resolves: #1650060 - CVE-2018-16802 ghostscript: Incorrect "restoration of
    privilege" checking when running out of stack during exception handling
  - Resolves: #1652935 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.5
changelog:
  - Resolves: #1654621 - CVE-2018-16541 ghostscript: incorrect free logic in
    pagedevice replacement (699664)
  - Resolves: #1650210 - CVE-2018-17183 ghostscript: User-writable error
    exception table
  - Resolves: #1645516 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1648891 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1643115 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1655937 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.6
changelog:
  - Resolves: #1657822 - ghostscript: Regression: Warning: Dropping incorrect
    smooth shading object (Error: /rangecheck in --run--)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.7
changelog:
  - Resolves: #1665919 pdf2ps reports an error when reading from stdin
  - Resolves: #1657333 - CVE-2018-16540 ghostscript: use-after-free in
    copydevice handling (699661)
  - Resolves: #1660569 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660828 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661278 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.8
changelog:
  - Resolves: #1667442 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.10
changelog:
  - Resolves: #1673915 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - Resolves: #1678171 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1680025 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.11
changelog:
  - Resolves: #1673398 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - fix for pdf2dsc regression added


author: Kalev Lember <kalevlember@gmail.com> - 3.14.2-2
changelog:
  - Revise the summary for consistency with the parallel installable
    glade2/glade3 packages (#882557)


author: Arjun Shankar <arjun@redhat.com> - 2.17-308
changelog:
  - CVE-2019-19126: rtld: Check __libc_enable_secure before honoring
    LD_PREFER_MAP_32BIT_EXEC (#1775599)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-321
changelog:
  - CVE-2020-10029: Prevent stack corruption from crafted input in cosl, sinl,
    sincosl, and tanl function. (#1812119)


author: Florian Weimer <fweimer@redhat.com> - 2.17-325
changelog:
  - Support /etc/sysconfig/strcasecmp-nonascii for enabling non-ASCII case
    conversion in strcasecmp, strncasecmp (#1993930)


author: Milind Changire <mchangir@redhat.com> - 3.12.2-9
changelog:
  - fixes bugs bz#1546717 bz#1557551 bz#1558948 bz#1561999 bz#1563804 
    bz#1565015 bz#1565119 bz#1565399 bz#1565577 bz#1567100 bz#1567899 bz#1568374 
    bz#1568969 bz#1569490 bz#1570514 bz#1570541 bz#1570582 bz#1571645 bz#1572087 
    bz#1572585 bz#1575895


author: Milind Changire <mchangir@redhat.com> - 3.12.2-10
changelog:
  - fixes bugs bz#1488120 bz#1565577 bz#1568297 bz#1570586 bz#1572043 
    bz#1572075 bz#1575840 bz#1575877


author: Milind Changire <mchangir@redhat.com> - 3.12.2-13
changelog:
  - fixes bugs bz#1493085 bz#1518710 bz#1554255 bz#1558948 bz#1558989 
    bz#1559452 bz#1567001 bz#1569312 bz#1569951 bz#1575539 bz#1575557 bz#1577051 
    bz#1580120 bz#1581184 bz#1581553 bz#1581647 bz#1582119 bz#1582129 bz#1582417 
    bz#1583047 bz#1588408 bz#1592666 bz#1594658


author: Milind Changire <mchangir@redhat.com> - 3.12.2-14
changelog:
  - fixes bugs bz#1547903 bz#1566336 bz#1568896 bz#1578716 bz#1581047 
    bz#1581231 bz#1582066 bz#1593865 bz#1597506 bz#1597511 bz#1597654 bz#1597768 
    bz#1598105 bz#1598356 bz#1599037 bz#1599823 bz#1600057 bz#1601314


author: Milind Changire <mchangir@redhat.com> - 3.12.2-16
changelog:
  - fixes bugs bz#1569657 bz#1608352 bz#1609163 bz#1609724 bz#1610825 
    bz#1611151 bz#1612098 bz#1615338 bz#1615440


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  * Mon Aug 27 2018 Milind Changire <mchangir@redhat.com> - 3.12.2-18
  - fixes bugs bz#1524336 bz#1622029 bz#1622452


author: Rinku Kothiya <rkothiya@redhat.com> - 6.0-23
changelog:
  - fixes bugs bz#1344758 bz#1599802 bz#1685406 bz#1686800 bz#1724021 
    bz#1726058 bz#1727755 bz#1731513 bz#1741193 bz#1758923 bz#1761326 bz#1761486 
    bz#1762180 bz#1764095 bz#1766640


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  * Fri Feb 19 2021 Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-49.1
  - fixes bugs bz#1930561


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-57
changelog:
  - fixes bugs bz#1600379 bz#1689375 bz#1782428 bz#1798897 bz#1815462 
    bz#1889966 bz#1891403 bz#1901468 bz#1903911 bz#1908635 bz#1917488 bz#1918018 
    bz#1919132 bz#1925425 bz#1927411 bz#1927640 bz#1928676 bz#1942816 bz#1943467 
    bz#1945143 bz#1946171 bz#1957191 bz#1957641


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-60
changelog:
  - fixes bugs bz#1668303 bz#1853631 bz#1901468 bz#1904137 bz#1911665 
    bz#1962972 bz#1973566 bz#1994593 bz#1995029 bz#1997447 bz#2006205


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  * Mon Nov 29 2021 Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-61
  - fixes bugs bz#1973566


author: Bastien Nocera <bnocera@redhat.com> - 1:3.28.1-1
changelog:
  + gnome-bluetooth-3.28.1-1
  - Work-around bluez bug that would leave adapters on Discoverable
    when exiting
  - Resolves: #1567381


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.5-1
changelog:
  - Update to 3.28.5
  - Fix the libgovirt requirement
  - Revert to using Python 2 and Tracker 1.0
  - Resolves: #1567399


author: Florian Müllner <fmuellner@redhat.com> - 3.28.1-3
changelog:
  - Fix a couple of regressions from the rebase:
    - add back classic overview style
    - update dash-to-dock to a compatible version
    Related: #1569717


author: Florian Müllner <fmuellner@redhat.com> - 3.28.1-7
changelog:
  - Add window-grouper extension
    Resolves: #1355845

  - Add disable-screenshield extension
    Resolves: #1643501


author: Florian Müllner <fmuellner@redhat.com> - 3.28.1-13
changelog:
  - Adjust dash-to-dock for classic backports
    Resolves: #1805920
  - Fix inconsistent state in window-list prefs dialog
    Resolves: #1613835
  - Add accessible name to status icons
    Resolves: #1600999


author: Zeeshan Ali <zeenix@redhat.com> - 3.8.2-7
changelog:
  - Add missing resource files (related: #1028079).
  - Don't ignore removal of src/resources.c (related: #1028079).


author: Richard Hughes <rhughes@redhat.com> - 3.8.2-3
changelog:
  - Do not build the clutter support to allow us to drop two deps
    now unsuitable for RHEL.
  - Resolves: #1025270


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-3
changelog:
  - Disable the print button in the selection toolbar when printing isn't
    supported
    Resolves: #1438362


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-6
changelog:
  - Adjust the LOKDocView detection to work with GJS 1.48.0
  - Suppress WARNINGs from GJS 1.50.0 by using var instead of let/const for
    exported symbols
    Resolves: #1517704


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-8
changelog:
  - Initialize the getting started PDF only when presenting a UI, and before any
    SPARQL has been submitted
  - Suppress WARNINGs from GJS 1.50.0 by using var instead of let/const for
    exported symbols
  - Use the standard dialect of String.prototype.replace
    Resolves: #1517770


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.1-1
changelog:
  - Update to 3.28.1
  - Rebased downstream patches
  - Revert to using Python 2 and Tracker 1.0
  - Resolves: #1568171


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.2-1
changelog:
  - Update to 3.28.2
  - Rebased downstream patches
  - Fix crash on right-click on local collection
    Resolves: #1611565


author: Zeeshan Ali <zeenix@redhat.com> - 3.8.2-8
changelog:
  - Remove patch 'daemon: Exit gnome-keyring-daemon when the DBus connection
    closes' (related: rhbz#1030671).


author: Debarshi Ray <rishi@fedoraproject.org> - 3.14.5-3
changelog:
  - Don't remove Telepathy accounts or expire Kerberos credentials when stopping
    goa-daemon
  Resolves: #1267534


author: Debarshi Ray <rishi@fedoraproject.org> - 3.14.5-5
changelog:
  - Ensure that temporary accounts are really removed from the keyring and
    avoid a WARNING
  Resolves: #1261940


author: Richard Hughes <rhughes@redhat.com> - 3.14.3-3
changelog:
  - Re-apply the fix "Change the UI policy to show the comps tree" as it was
    lost in the rebase process.
  - Resolves: #1174550


author: Richard Hughes <rhughes@redhat.com> - 3.14.3-6
changelog:
  - Create a -common subpackage and make the "parent" package depend on all
    the split out applications. This fixes upgrades from old versions.
  - Resolves: #1290868


author: Ray Strode <rstrode@redhat.com> 3.26.1-8
changelog:
  - New sed incantation is still overzealous.  Rework how
    gnome-wayland session file is generated.
    Resolves: #1510391


author: Ray Strode <rstrode@redhat.com> - 3.28.1-5
changelog:
  - Fix gnome-disk-utility timeout at startup
    Resolves: #1593215
  - add back session properties icons
    Related: #1568620


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-9
changelog:
  + gnome-settings-daemon-3.26.2-9
  - Revert automatic suspend after inactivity, it was rejected
  - Related: #1449171


author: Benjamin Berg <bberg@redhat.com> - 3.28.1-9
changelog:
  - Keep auto-logout working inside VMs
    Resolves: #1672998
  - Never log out automatically from greeter sessions
    Resolves: #1729296


author: Carlos Garnacho <cgarnach@redhat.com> - 3.28.1-11
changelog:
  - Fix possible crash on gsd-media-keys startup
    Resolves: #1878167
  - Ignore permission issues during gsd-housekeeping file deletion
    Resolves: #1909954
  - Revert mapping of "XF86RFKill" key
    Resolves: #1888412


author: Ray Strode <rstrode@redhat.com> - 3.26.2-7
changelog:
  - Fix logic error in password expiration notification bubble
    Resolves: #1530659
    Related: 1314443


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: gnome-shell_spec-use-our-artwork.patch
  -->  Brand this with SL colors
  - Added Source: gnome-shell.ini
  -->  Config file for automated patch script


author: Richard Hughes <rhughes@redhat.com> - 3.22.7-3
changelog:
  - Never show 'Startup Applications' in the search results
  - Note: the other issue shown in the bug is likely a dupe of #1445651
  - Resolves: #1481145


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.2-2
changelog:
  - Backport fix for client-side memory error (GNOME/gnome-terminal#1)
  - Bump BuildRequires versions
  - Drop the dark theme override
  - Rebase and restore the scroll speed patches
  - Rebase and restore the patch to allow old ISO 8895 charsets
  - Restore the GConf migration tool
  - Resolves: #1568632


author: Milan Crha <mcrha@redhat.com> - 3.28.1-6
changelog:
  - Resolves: #1460768 (Cannot hide desktop icons in classic mode)
  - Resolves: #1607839 (Invisible panel is made visible on click between Setting and Toggle button)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-9
changelog:
  - Amended fix for FIPS enforcement issue (#1163848)
  - Fixed issue with applications that close all file descriptors (#1165047)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-11
changelog:
  - Applied fix for urandom FD in FIPS140 mode (#1165047)
  - Applied fix for FIPS140-2 related regression (#1110696)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-13
changelog:
  - Corrected reseed and respect of max_number_of_bits_per_request in 
    FIPS140-2 mode. Also enhanced the initial tests. (#1228199)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.24-1
changelog:
  - Addressed issue with DSA public keys smaller than 2^1024 (#1238279)
  - Addressed two-byte buffer overflow in the DTLS-0.9 protocol (#1209365)
  - When writing certificates to smart cards write the CKA_ISSUER and
    CKA_SERIAL_NUMBER fields to allow NSS reading them (#1272179)
  - Use the shared system certificate store (#1110750)
  - Address MD5 transcript collision attacks in TLS key exchange (#1289888, 
    CVE-2015-7575)
  - Allow hashing data over 2^32 bytes (#1306953)
  - Ensure written PKCS#11 public keys are not marked as private (#1339453)
  - Ensure secure_getenv() is called on all uses of environment variables
    (#1344591).
  - Fix issues related to PKCS #11 private key listing on certain HSMs
    (#1351389)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-7
changelog:
  - Address interoperability issue with 3.5.x (#1388932)
  - Reject CAs which are both trusted and blacklisted in trust module (#1375303)
  - Added new functions to set issuer and subject ID in certificates (#1378373)
  - Reject connections with less than 1024-bit DH parameters (#1335931)
  - Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
  - Mention limitations of certtool in manpage (#1375463)
  - Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
  - Do not link directly to trousers but instead use dlopen (#1379739)
  - Fix incorrect OCSP validation (#1377569)
  - Added support for pin-value in PKCS#11 URIs (#1379283)
  - Added the --id option to p11tool (#1399232)
  - Improved sanity checks in RSA key generation (#1444780)
  - Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
    CVE-2017-7869


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-9
changelog:
  - Address crash in OCSP status request extension, by eliminating the
    unneeded parsing (CVE-2017-7507, #1455828)


author: Anderson Sasaki <ansasaki@redhat.com> 3.3.29-8
changelog:
  - Backported --sni-hostname option which allows overriding the hostname
    advertised to the peer (#1444792)
  - Improved counter-measures in TLS CBC record padding for lucky13 attack
    (CVE-2018-10844, #1589704, CVE-2018-10845, #1589707)
  - Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
    (CVE-2018-10846, #1589708)
  - Address p11tool issue in object deletion in batch mode (#1375307)
  - Backport PKCS#11 tests from master branch. Some tests were disabled due to
    unsupported features in 3.3.x (--load-pubkey and --test-sign options, ECC key
    generation without login, and certificates do not inherit ID from the private
    key)
  - p11tool explicitly marks certificates and public keys as NOT private objects
    and private keys as private objects
  - Enlarge buffer size to support resumption with large keys (#1542461)
  - Legacy HMAC-SHA384 cipher suites were disabled by default
  - Added DSA key generation to p11tool (#1464896)
  - Address session renegotiation issue using client certificate (#1434091)
  - Address issue when importing private keys into Atos HSM (#1460125)


author: Mike FABIAN <mfabian@redhat.com> - 20170827-1
changelog:
  - Update to upstream snapshot tarball
  - Update color emoji font to version 2.001, new design.
  - Contains the new emoji added in Unicode 10.0.0.


author: Mike FABIAN <mfabian@redhat.com> - 20170828-1
changelog:
  - Update to upstream snapshot tarball
  - split black-and-white and color fonts into different sub-packages.


author: Peter Oliver <rpm@mavit.org.uk> - 20170928-2
changelog:
  - Prefer zopflipng to optipng, since it should yield smaller files.
  - Use the font we built, rather than the one included with the source.


author: Mike FABIAN <mfabian@redhat.com> - 20180508-1
changelog:
  - Update to upstream snapshot tarball (color emoji font version 2.011)
  - Add patch to build all country flags (Resolves: rhbz#1574195)


author: Bastien Nocera <bnocera@redhat.com> 0.2.14-6
changelog:
  - Enable a number of missing plugins
  Related: #1184200
  - Disable blip.tv plugin as service has now closed
  - Add patch to downgrade the gom requirements
  - Port back local-metadata plugin to libmediaart-1.0


author: Bastien Nocera <bnocera@redhat.com> - 0.3.4-3
changelog:
  - Fix size reporting in Apple Trailers source
  - Add compatibility layer to allow building with lua 5.1
  Resolves: #1477129


author: Peter Jones <pjones@redhat.com> - 2.02-0.74
changelog:
  - Fix symlink issues with grubenv
    Resolves: rhbz#1602773
    Related: rhbz#1497918
  - Make the common subpackage only build on x86_64 to avoid timestamp
    mismatches.
    Related: rhbz#1602773
    Related: rhbz#1497918


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.78
changelog:
  - Prevent errors from diskfilter scan of removable drives
    Resolves: rhbz#1446418
  - Avoid grub2-efi package to overwrite existing /boot/grub2/grubenv file
    Resolves: rhbz#1497918
  - Remove glibc32 and glibc-static(x86-32) BuildRequires
    Resolves: rhbz#1614259


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.79
changelog:
  - Ignore the modification time when doing RPM verification of /boot/efi files
    Resolves: rhbz#1496952


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.82
changelog:
  - Prepend prefix when HTTP path is relative
  - efi/http: Export {fw,http}_path variables to make them global
  - efi/http: Enclose literal IPv6 addresses in square brackets
  - efi/net: Allow to specify a port number in addresses
  - efi/ip4_config: Improve check to detect literal IPv6 addresses
  - efi/net: Print a debug message if parsing the address fails


author: Peter Jones <pjones@redhat.com> - 2.02-0.86
changelog:
  - Fix several CVEs:
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: grub2_spec-force-efidir.patch
  -->  hardcode efidir for compat with 7.0-7.5
  - Replaced Source: secureboot.cer
  -->  Not using upstream Key
  - Replaced Source: securebootca.cer
  -->  Don't recognize upstream CA
  - Added Source: grub2.ini
  -->  Config file for automated patch script


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.82
changelog:
  - Prepend prefix when HTTP path is relative
  - efi/http: Export {fw,http}_path variables to make them global
    Resolves: rhbz#1616395
  - efi/http: Enclose literal IPv6 addresses in square brackets
  - efi/net: Allow to specify a port number in addresses
  - efi/ip4_config: Improve check to detect literal IPv6 addresses
  - efi/net: Print a debug message if parsing the address fails
    Resolves: rhbz#1732765


author: Peter Jones <pjones@redhat.com> - 2.02-0.84
changelog:
  - Couple more late fixes.
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 2.02-0.85
changelog:
  - Couple more late fixes.
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311
    Resolves: CVE-2020-15705


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: grub2_spec-force-efidir.patch
  -->  hardcode efidir for compat with 7.0-7.5
  - Replaced Source: securebootca5.cer
  -->  Don't recognize upstream CA
  - Added Source: grub2.ini
  -->  Config file for automated patch script
  - Replaced Source: redhatsecureboot502.cer
  -->  Not using upstream Key


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.87.e7.2
changelog:
  - Fix another batch of CVEs
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Colin Walters <walters@verbum.org> 0.10.23-17
changelog:
  - Hack the gtk-doc to remove plugin docs that are not shipped
  - Drop mythtv, opencv sources that are no longer buildable


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-21
changelog:
  - Remove insecure NSF plugin
  - vmncdec: Sanity-check width/height before using it
  Resolves: rhbz#1400839


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-22
changelog:
  - h264parse: Ensure codec_data has the required size when reading number of SPS
  Resolves: rhbz#1400839


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-24
changelog:
  - Patch CVE-2023-44446: MXF demuxer use-after-free
  - Disable gtk-doc to fix the build
  - Resolves: RHEL-16792


author: Wim Taymans <wtaymans@redhat.com> - 1.4.5-6
changelog:
  - Fix h264 and h265 buffer size checks
  - Fix mpegts pat parsing and add more size checks
  Resolves: rhbz#1400898


author: Wim Taymans <wtaymans@redhat.com> - 1.10.4-4
changelog:
  - Patch CVE-2023-44446: MXF demuxer use-after-free
  - Disable gtk-doc to fix build
  - Resolves: RHEL-16793


author: Ondrej Holy <oholy@redhat.com> - 1.30.3-1
changelog:
  - Update to 1.30.3
  - Disable nfs support (#1387270)
  - Revert desktop database scriplets
  - Resolves: #1386993, #1399343, #1306146, #1259746, #1344317


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-2
changelog:
  - Prevent spawning new daemons if outgoing operation exists (#1632960)
  - CVE-2019-3827: Prevent access if any authentication agent isn't available (#1673887)


author: Petr Stodulka <pstodulk@redhat.com> - 1.5-8
changelog:
  - Gzip overwrite existing files when user choose "no" on yes/no question.
    It's due to wrong dupicit declaration of yesno() function in gzip.h
    which is compiled wrong with -O2 option.
    Resolves: rhbz#1201689


author: Jakub Martisko <jamartis@redhat.com> - 1.5-10
changelog:
  - doc change: missing grep options are now mentioned in the zgrep 
    man pages/help message
    Resolves: #1437002


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.7
changelog:
  - Fix: "Argument list too long" when using virt-v2v on Windows guest
    with French copy of Citrix installed
    related: rhbz#1145056


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.8
changelog:
  - Tolerate corruption in some hives
    resolves: rhbz#1423436
  - Switch to using git to manage patches.


author: Jiri Popelka <jpopelka@redhat.com> - 3.11-3
changelog:
  - remove some rh-specific bits from rh.patch as they are no longer valid (#881913)
  - remove outdated de & pt man pages
  - /usr move: use _bindir macro


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1:1.8.1.3-14
changelog:
  - Remove dependency on initscripts
  - Add After=network.target to systemd service
  - Resolves: rhbz#1283893, rhbz#1269717


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1479471


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-6
changelog:
  - Resolves: rhbz#1666381 - CVE-2018-12121 http-parser: nodejs: Denial of
                             Service with large HTTP headers [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-7
changelog:
  - Resolves: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                             allowed for spaces inside Content-Length header
                             values [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-8
changelog:
  - Backport needed test fixes
  - Related: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                            allowed for spaces inside Content-Length header
                            values [rhel-7]


author: Sergio Correia <scorreia@redhat.com> - 2.7.1-8.1
changelog:
  - Resolves: CVE-2019-15605 http-parser: nodejs: HTTP request
                             smuggling using malformed Transfer-Encoding header


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Added Source: httpd-spec_sl_index.html.sl7.patch
  -->  The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Added Source: httpd.ini
  -->  Config file for automated patch script


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com> 2.4.6.88
changelog:
  - Rebuild for EuroLinux based on Scientific Linux Version
  --> Change default index.html
  --> Modify release string to note changes


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com>
changelog:
  - Rebuild for EuroLinux based on Scientific Linux Version
  --> Change default index.html
  --> Modify release string to note changes
  - fix per-request leak of bucket brigade structure (#1583218)


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com>
changelog:
  - Pull from upstream:
  - Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control
    bypass due to race condition
  - Resolves: #1696096 - CVE-2019-0220 httpd: URL normalization inconsistency


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com> 2.4.6-92
changelog:
  - Pull from upstream:
   -> Resolves: #1677496 - CVE-2018-17199 httpd: mod_session_cookie does not respect
    expiry time
   -> htpasswd: add SHA-2 crypt() support (#1486889)
   -> Resolves: #1630886 - scriptlet can fail if hostname is not installed
   -> Resolves: #1565465 - CVE-2017-15710 httpd: Out of bound write in
      mod_authnz_ldap when using too small Accept-Language values
   -> Resolves: #1568298 - CVE-2018-1301 httpd: Out of bounds access after
      failure in reading the HTTP request
   -> Resolves: #1673457 - Apache child process crashes because ScriptAliasMatch
      directive
   -> Resolves: #1633152 - mod_session missing apr-util-openssl
   -> Resolves: #1649470 - httpd response contains garbage in Content-Type header
   -> Resolves: #1724034 - Unexpected OCSP in proxy SSL connection


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com> 2.4.6-95
changelog:
  - Pull from upstream:
    -> Resolves: #1823262 - CVE-2020-1934 httpd: mod_proxy_ftp use of uninitialized
       value
    -> Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
    -> Resolves: #1724879 - httpd terminates all SSL connections using an abortive
       shutdown
    -> Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
    -> Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
       mod_cache_socache can allow a remote attacker to cause a denial of service
    -> Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
       mod_session can allow a remote user to modify session data for CGI applications
    -> Resolves: #1677496 - CVE-2018-17199 httpd: mod_session_cookie does not respect
       expiry time


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com> 2.4.6-97
changelog:
  - Pull from upstream:
    -> Resolves: #1852350 - httpd/mod_proxy_http/mod_ssl aborted when sending
       a client cert to backend server
    -> Resolves: #1785100 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
    -> Resolves: #1862499 - Intermittent Segfault in Apache httpd due to pool
       concurrency issues


author: Aleksander Baranowski <alex@euro-linux.com> 2.4.6-97.1
changelog:
  - Pull from upstream:
    -> Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
    request uri-path containing "unix:"


author: Alex Baranowski <alex@euro-linux.com> 2.4.6-97.2
changelog:
  - Pull from upstream:
    -> Resolves: #2015694 - proxy rewrite to unix socket fails with CVE-2021-40438 fix


author: Tomasz Podsiadły <tp@euro-linux.com> 2.4.6-97
changelog:
  - Pull from upstream:
    -> Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
       malformed requests
    -> Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
       ap_escape_quotes() via malicious input
    -> Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session
    -> Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
       when parsing multipart content


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
  - Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
    newline in the file name
  - Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
  - Resolves: #1724879 - httpd terminates all SSL connections using an abortive
    shutdown
  - Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
  - Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
    mod_cache_socache can allow a remote attacker to cause a denial of service
  - Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
    mod_session can allow a remote user to modify session data for CGI applications


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-97
changelog:
  - Resolves: #1852350 - httpd/mod_proxy_http/mod_ssl aborted when sending
    a client cert to backend server
  - Resolves: #1785100 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
  - Resolves: #1862499 - Intermittent Segfault in Apache httpd due to pool
    concurrency issues


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.1
changelog:
  - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
    request uri-path containing "unix:"


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.3
changelog:
  - Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
    when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.4
changelog:
  - Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
    malformed requests
  - Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input
  - Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.5
changelog:
  - Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.6
changelog:
  - Resolves: #2101997 - HEAD request with a 404 and custom ErrorPage causes
    corrupt and mixed-up responses


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.7
changelog:
  - Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: EuroLinux Autopatch <devel@euro-linux.com>
changelog:
  - Replaced Source: index.html
  -->  Replace RHEL index.html with EuroLinux index.html (default test page).


author: Caolán McNamara <caolanm@redhat.com> - 1.3.2-6
changelog:
  - Resolves: rhbz#573516 have hunspell require hunspell-en to ensure
    at least one dictionary exists


author: Jarod Wilson <jarod@redhat.com> 17.2-2
changelog:
  - Restore SysV Initscripts ib ifup and ifdown helpers
  - Adjust MTU limit for IPoIB in datagram mode via ifup-ib
  - Resolves: rhbz#1593426
  - Resolves: rhbz#1593334


author: Jarod Wilson <jarod@redhat.com> 22-1
changelog:
  - Rebase to upstream rdma-core v22
  - Resolves: rhbz#1641921
  - Add mlx5 IB Device Memory support (MEMIC)
  - Resolves: rhbz#1644697
  - Add mlx5 Tunnel protocol RX decap/encap offload
  - Resolves: rhbz#1644709
  - Add mlx5 Tunnel protocol TX decap/encap offload
  - Resolves: rhbz#1644778
  - Add support for mlx5 infiniband flow counters
  - Resolves: rhbz#1644714
  - Add mlx5 DEVX interface
  - Resolves: rhbz#1644722
  - Add libbnxt_re support for SRQ
  - Resolves: rhbz#1570393


author: Jarod Wilson <jarod@redhat.com> 22.1-1
changelog:
  - Update to upstream v22.1 release with stable-v22 branch fixes
  - Add support for Broadcom 57500 RoCE adapter
  - Resolves: rhbz#1678274


author: Jarod Wilson <jarod@redhat.com> 22.4-1
changelog:
  - Update to v22.4 stable release
  - Support mlx5 scatter to CQE over DCT QP
  - Fix ibacm segfault on non-IB hardware
  - Resolves: rhbz#1715489
  - Resolves: rhbz#1712296


author: Jay Fenlason <fenlason@redhat.com> 1.5.7-8
changelog:
  - Add the -output patch to have programs use /var/cache/ibutils
    instead of /tmp
    Resolves: bz958569


author: Doug Ledford <dledford@redhat.com> - 1.5.7-12
changelog:
  - Change ExclusiveArch to ExcludeArch instead so we don't have
    the same problem again in the future
  - Update to the git repo tarball that we shipped in rhel6.6
  - Related: bz1123998


author: Jiri Vanek <jvanek@redhat.com> 1.6.1-4
changelog:
  - added and and applied patch2 fileLogInitializationError-1.6.patch to prevent 
  consequences 1268909
  - Resolves: rhbz#1217153


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. 
  set -e 
     _pompart="need" 
     _jarpart="tobe" 
  _filelist=".mfiles" 
  install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64/usr/share/maven-fragments 
  for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
      if [ -f /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64$_dir/$_jarpart ]; then 
  	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64$_dir/$_jarpart" 
      fi 
  done 
  python -m /usr/share/java-utils/maven_depmap   \
            -p "/usr" -n "" \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64/usr/share/maven-fragments/icedtea-web \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64/usr/share/maven-poms/$_pompart \
          >> ${_filelist} 
  sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.7.1-2.el7_6.x86_64::' ${_filelist} 
  sort -u -o ${_filelist} ${_filelist} 


  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-3
changelog:
  - added --family to make it part of javas alternatives alignment
  - java-javaver-openjdk collected into preffered_java 
  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.7-1
changelog:
  - updated to itw 1.7 and sync from fedora
  - added forgotten slaves of itweb-settings policyeditor
  - Own %{_datadir}/%{name} dir
  - Mark non-English man pages with %lang
  - Install COPYING as %license
  - last three by Ville Skytta <ville.skytta@iki.fi> via 1481270
  - for sake of rpms added patch0, bashCompDirHardcodedAgain.patch to hardcode bashcompletion dir
  - removed maven macros in favour of manual handling (bug)
  - Resolves: rhbz#1475411


author: Jiri Vanek <jvanek@redhat.com> 1.7.2-16
changelog:
  - added patch1, patch4 and patch11 to fix CVE-2019-10182
  - added patch2 to fix CVE-2019-10181
  - added patch3 and patch33 to fix CVE-2019-10185
  - Resolves: rhbz#1724958 
  - Resolves: rhbz#1725928 
  - Resolves: rhbz#1724989


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. 
  set -e 
     _pompart="need" 
     _jarpart="tobe" 
  _filelist=".mfiles" 
  install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-fragments 
  for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
      if [ -f /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64$_dir/$_jarpart ]; then 
  	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64$_dir/$_jarpart" 
      fi 
  done 
  python -m /usr/share/java-utils/maven_depmap   \
            -p "/usr" -n "" \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-fragments/icedtea-web \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-poms/$_pompart \
          >> ${_filelist} 
  sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64::' ${_filelist} 
  sort -u -o ${_filelist} ${_filelist} 


  - Resolves: rhbz#1299537


author: Mike FABIAN <mfabian@redhat.com> - 50.2-1
changelog:
  - Update to 50.2 maintenance release including support for new Japanese era Reiwa (令和).
  - Resolves: rhbz#1677092


author: Mike FABIAN <mfabian@redhat.com> - 50.2-2
changelog:
  - Fix rpmdiff failure: File /usr/src/debug/icu/source/i18n/unicode/selfmt.h
    relaxed permissions from 0644 to 0755 on all architectures
  - Related: rhbz#1677092


author: Mike FABIAN <mfabian@redhat.com> - 50.2-4
changelog:
  - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch
  - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch
  - Resolves: rhbz#1808235


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-22.20160119
changelog:
  - xorg-x11-drv-intel hardly has any accel on skylake and newer, so make
    Xorg fallback to modesetting + glamor by returning FALSE from probe
  - Using glamor also gives us proper Xvideo support on skylake (rhbz#1305369)


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-23.20160512
changelog:
  - Update to 20160512 snapshot
  - This fixes laptops with switchable graphics hanging after a dpms off of
    the lcd screen (rhbz#1334581)
  - Fix fd-leak when falling back to mode-setting on skylake, this fixes
    Xorg exiting with a "drmSetMaster failed" error when not using server
    managed fds (e.g. using a different login manager then gdm)
  - Fix duplicate binaries in -devel / intel-gpu-tools subpackages (rhbz#1323641)


author: Hans de Goede <hdegoede@redhat.com> - 2.99.917-24.20160712
changelog:
  - Git snapshot du jour, bringing in a bunch of bugfixes
  - Fix dpi issues on Surface 3 (also needs some kernel fixes)
  - Hopefully fix rhbz#1354124


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7
changelog:
  - Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp
    -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.4
changelog:
  - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
    - wgi/plugins.py: ignore empty plugin directories
  - Resolves: #1895197 improve IPA PKI susbsystem detection by other means than a directory presence, use pki-server subsystem-find
    - Improve PKI subsystem detection
    - ipatests: add test for PKI subsystem detection
    - ipatest: fix test_upgrade.py::TestUpgrade::()::test_kra_detection
  - Resolves: #1892793 Authentication and login times are over several seconds due to unindexed ipaExternalMember
    - Add more indices
  - Resolves: #1884819 IdM Web UI shows users as disabled
    - fix cert-find errors in CA-less deployment
  - Resolves: #1863619 CA-less install does not set required permissions on KDC certificate
    - CAless installation: set the perms on KDC cert file
    - ipatests: check KDC cert permissions in CA less install
  - Resolves: #1859248 CVE-2020-11023 ipa: jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
    - WebUI: Fix jQuery DOM manipulation issues
  - Resolves: #1846349 cannot issue certs with multiple IP addresses corresponding to different hosts
    - fix iPAddress cert issuance for >1 host/service


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.5
changelog:
  - Resolves: #1931405 krb5kdc crash - Segmentation fault in ldap_first_entry().
    - ipa-kdb: fix compiler warnings
    - ipa-kdb: add missing prototypes
    - ipa-kdb: reformat ipa_kdb_certauth
    - ipa-kdb: mark test functions as static
    - ipa-kdb: do not use OpenLDAP functions with NULL LDAP context
  - Resolves: #1835741 krb5kdc crashing on ipa server
  - Resolves: #1929372 krb5kdc is crashing intermittently on IPA server.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.7
changelog:
  - Resolves: #1956550 - IPA server installation fails when cert contains non-ASCII character
    - CA less installation: non ASCII chars in CA subject
    - ipatests: use non-ascii chars in CA-less install
  - Resolves: #1974328 - Revise PKINIT upgrade code
    - Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.9
changelog:
  - Resolves: #2000261 - extdom: LDAP_INVALID_SYNTAX returned instead of LDAP_NO_SUCH_OBJECT
    - extdom: return LDAP_NO_SUCH_OBJECT if domains differ


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.10
changelog:
  - Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server 
    - Fix cert_request for KDC cert
  - Resolves: 2021444 - CVE-2020-25719 ipa: samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
    - SMB: switch IPA domain controller role


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.11
changelog:
  - Resolves: 2082272 - [RFE] Require confirmation to change "Default host group" in IdM automember rules
    - WebUI: Add confirmation dialog for changing default user/host group


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.12
changelog:
  - Resolves: 2084223 - 'ipa idview-show idviewname' & IPA WebUI takes longer time to return the results
    - idviews: use cached ipaOriginalUid value when resolving ID override
  - Resolves: 2124369 - OTP token sync always returns OK even with random numbers
    - ipa otptoken-sync: return error when sync fails
    - ipatests: add negative test for otptoken-sync
    - ipatests: python2 does not support f-strings
    - Fix otptoken_sync plugin


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: ipa-spec-debrand.patch
  -->  remove TUV's Artwork
  - Added Source: ipa-spec-fix-osrelease.patch
  -->  Force use of rhel as the ipaplatform
  - Added Source: ipa.ini
  -->  Config file for automated patch script


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.6-3.el7
changelog:
  - Resolves: 1717008 - User incorrectly added to negative cache when backend is reconnecting to IPA service / timed out: error code 32 'No such object'


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.6-4.el7
changelog:
  - Resolves: 1744926 - rebuild against Samba 4.10 to solve undefined symbol: DEBUGLEVEL_CLASS
  - Backport patches to compile against Samba 4.10
  - Fix Python 2 compatibility in adtrustinstance


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-5.el7
changelog:
  - Resolves: #1749788 - ipa host-find --pkey-only includes SSH keys in output
    - Don't return SSH keys with ipa host-find --pkey-only
  - Resolves: #1745108 - Bug 1497334 invalidating single-label domains introduces regression of usage for customers
    - check for single-label domains only during server install
  - Resolves: #1583950 - IPA: IDM drops all custom attributes when moving account from preserved to stage
    - user-stage: transfer all attributes from preserved to stage user
    - xmlrpc test: add test for preserved > stage user


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-6.el7
changelog:
  - Resolves: #1752005 - Keyrings should not be used in containerized environment
    - Don't configure KEYRING ccache in containers
  - Resolves: #1751951 - When master's IP address does not resolve to its name, ipa-replica-install fails
    - Add container environment check to replicainstall
  - Resolves: #1750700 - when migrating trusted domain object structure, add default access control definitions, if they were missing in old trust objects
    - add default access control when migrating trust objects
    - adtrust: add default read_keys permission for TDO objects
    - Disable deprecated-lambda check in adtrust upgrade code


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-7.el7
changelog:
  - Resolves: #1754494 - ipa-replica-install does not enforce --server option
    - replica install: enforce --server arg
  - Resolves: #1729638 - ipa_kdb: assertion failure from NULL lcontext pointer to ldap_get_values_len()
    - Fix segfault in ipadb_parse_ldap_entry()
    - Log INFO message when LDAP connection fails on startup
    - Fix NULL pointer dereference in maybe_require_preauth()
  - Resolves: #1636765 - ipa-restore set wrong file permissions and ownership for /var/log/dirsrv/slapd- directory
    - ipa-restore: Restore ownership and perms on 389-ds log directory


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-8.el7
changelog:
  - Resolves: #1755223 - Sub-CA key replication failure
    - Handle missing LWCA certificate or chain
    - Fix CustodiaClient ccache handling
    - CustodiaClient: use ldapi when ldap_uri not specified
    - CustodiaClient: fix IPASecStore config on ipa-4-7
    - Bump krb5 min version


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-9.el7
changelog:
  - Resolves: #1762317 - ipa-backup command is failing on rhel-7.8
    -  ipa-backup: fix python2 issue with os.mkdir


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-10.el7
changelog:
  - Resolves: #1728123 - EMBARGOED CVE-2019-10195 ipa: FreeIPA: batch API logging user passwords to /var/log/httpd/error_log [rhel-7]
    - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
  - Resolves: #1773550 - IPA upgrade fails for latest ipa package when adtrust is installed
    - Do not run trust upgrade code if master lacks Samba bindings
  - Resolves: #1767302 - EMBARGOED CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf() [rhel-7.8]
    - Make sure to have storage space for tag


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-11.el7
changelog:
  - Resolves: #1778777 - After upgrade AD Trust Agents were removed from LDAP
    - trust upgrade: ensure that host is member of adtrust agents


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.13
changelog:
  - Resolves: 2148249 - ipa-client-install does not maintain server affinity during installation
    - Defer creating the final krb5.conf on clients
    - Move client certificate request after krb5.conf is created
    - server install: remove error log about missing bkup file


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.14
changelog:
  - Resolves: 2180919 [rhel-7] Sequence processing failures for group_add using server context
    - ipaserver: deepcopy objectclasses list from IPA config


author: EuroLinux Autopatch <devel@euro-linux.com>
changelog:
  - Added Source: login-screen-logo.png
  -->  Add login-screen-logo.png
  - Added Source: os-name-white-big.png
  -->  Add os-name-white-big.png
  - Added Source: os-name-white.png
  -->  Add os-name-white.png


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-12.el7
changelog:
  - Resolves: #1754902 - Running ipa-server-install fails when RHEL 7.7 packages are installed on RHEL 7.6
  - Resolves: #1404770 - ID Views: do not allow custom Views for the masters
    - idviews: prevent applying to a master
  - Resolves: #1801791 - Compatibility Schema difference in functionality for systems following RHEL 7.5 -> 7.6 upgrade path as opposed to new RHEL 7.6 systems
    - install/updates: move external members past schema compat update
  - Resolves: #1795890 - ipa-pkinit-manage enable fails on replica if it doesn't host the CA
    - pkinit setup: fix regression on master install
    - pkinit enable: use local dogtag only if host has CA
  - Resolves: #1788907 - Renewed certs are not picked up by IPA CAs
    - Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
  - Resolves: #1780548 - Man page ipa-cacert-manage does not display correctly on RHEL
    - ipa-cacert-manage man page: fix indentation
  - Resolves: #1782587 - add "systemctl restart sssd" to warning message when adding trust agents to replicas
    - adtrust.py: mention restarting sssd when adding trust agents
  - Resolves: #1771356 - Default client configuration breaks ssh in FIPS mode
    - Use default ssh host key algorithms
  - Resolves: #1755535 - ipa-advise on a RHEL7 IdM server is not able to generate a configuration script for a RHEL8 IdM client
    - smartcard: make the ipa-advise script compatible with authselect/authconfig
  - Resolves: #1758406 - KRA authentication fails when IPA CA has custom Subject DN
    - upgrade: fix ipakra people entry 'description' attribute
    - krainstance: set correct issuer DN in uid=ipakra entry
  - Resolves: #1756568 - ipa-server-certinstall man page does not match built-in help
    - ipa-server-certinstall manpage: add missing options
  - Resolves: #1206690 - UPG not being enforced properly
    - ipa user_add: do not check group if UPG is disabled
  - Resolves: #1811982 - CVE-2018-14042 ipa: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip.
  - Resolves: #1811978 - CVE-2018-14040 ipa: bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
  - Resolves: #1811972 - CVE-2016-10735 ipa: bootstrap: XSS in the data-target attribute
  - Resolves: #1811969 -CVE-2018-20676 ipa: bootstrap: XSS in the tooltip data-viewport attribute
  - Resolves: #1811966 - CVE-2018-20677 ipa: bootstrap: XSS in the affix configuration target property
  - Resolves: #1811962 - CVE-2019-8331 ipa: bootstrap: XSS in the tooltip or popover data-template attribute
    - Web UI: Upgrade Bootstrap version 3.3.7 -> 3.4.1
  - Resolves: #1769791 - Invisible part of notification area in Web UI intercepts clicks of some page elements
    - WebUI: Fix notification area layout
  - Resolves: #1545755 - ipa-replica-prepare should not update pki admin password
    - Fix indentation levels
    - ipa-pwd-extop: use SLAPI_BIND_TARGET_SDN
    - ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
    - Don't save password history on non-Kerberos accounts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-1.el7
changelog:
  - Resolves: #1819725 - Rebase IPA to latest 4.6.x version
  - Resolves: #1817927 - host-add --password logs cleartext userpassword to Apache error log
  - Resolves: #1817923 - IPA upgrade is failing with error "Failed to get request: bus, object_path and dbus_interface must not be None."
  - Resolves: #1817922 - covscan memory leaks report
  - Resolves: #1817919 - Enable compat tree to provide information about AD users and groups on trust agents
  - Resolves: #1817918 - Secure tomcat AJP connector
  - Resolves: #1817886 - ipa group-add-member: prevent adding IPA objects as external members
  - Resolves: #1788718 - ipa-server-install incorrectly setting slew mode (-x) when setting up ntpd


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-2.el7
changelog:
  - Resolves: #1802408 CVE-2020-1722 ipa: No password length restriction leads to denial of service
    - Add interactive prompt for the LDAP bind password to ipa-getkeytab
    - CVE-2020-1722: prevent use of too long passwords


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-3.el7
changelog:
  - Resolves: #1834385 Man page syntax issue detected by rpminspect
    - Man pages: fix syntax issues
  - Resolves: #1829787 ipa service-del deletes the required principal when specified in lower/upper case
    - Make check_required_principal() case-insensitive
  - Resolves: #1825829 ipa-advise on a RHEL7 IdM server generate a configuration script for client having hardcoded python3
    - ipa-advise: fallback to /usr/libexec/platform-python if python3 not found
  - Resolves: #1812020 CVE-2015-9251 ipa: js-jquery: Cross-site scripting via cross-domain ajax requests
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1
  - Resolves: #1713487 CVE-2019-11358 ipa: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-4.el7
changelog:
  - Resolves: #1842950 ipa-adtrust-install fails when replica is offline
    - ipa-adtrust-install: avoid failure when replica is offline
  - Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
    - WebUI: Apply jQuery patch to fix htmlPrefilter issue


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com>
changelog:
  - Pull from upstream:
    - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
      - wgi/plugins.py: ignore empty plugin directories
    - Resolves: #1895197 improve IPA PKI susbsystem detection by other means than a directory presence, use pki-server subsystem-find
      - Improve PKI subsystem detection
      - ipatests: add test for PKI subsystem detection
      - ipatest: fix test_upgrade.py::TestUpgrade::()::test_kra_detection
    - Resolves: #1892793 Authentication and login times are over several seconds due to unindexed ipaExternalMember
      - Add more indices
    - Resolves: #1884819 IdM Web UI shows users as disabled
      - fix cert-find errors in CA-less deployment
    - Resolves: #1863619 CA-less install does not set required permissions on KDC certificate
      - CAless installation: set the perms on KDC cert file
      - ipatests: check KDC cert permissions in CA less install
    - Resolves: #1859248 CVE-2020-11023 ipa: jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
      - WebUI: Fix jQuery DOM manipulation issues
    - Resolves: #1846349 cannot issue certs with multiple IP addresses corresponding to different hosts
      - fix iPAddress cert issuance for >1 host/service


author: Aleksander Baranowski <aleksander.baranowski@euro-linux.com> - 4.6.8-5.el7_9.5
changelog:
  - Pull from upstream:
      - Resolves: #1931405 krb5kdc crash - Segmentation fault in ldap_first_entry().
        - ipa-kdb: fix compiler warnings
        - ipa-kdb: add missing prototypes
        - ipa-kdb: reformat ipa_kdb_certauth
        - ipa-kdb: mark test functions as static
        - ipa-kdb: do not use OpenLDAP functions with NULL LDAP context
      - Resolves: #1835741 krb5kdc crashing on ipa server
      - Resolves: #1929372 krb5kdc is crashing intermittently on IPA server.


author: Michal Ruprich <mruprich@redhat.com> - 3.1.7-1
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding latest version before including iperf3 in RHEL-7


author: Michal Ruprich - 3.1.7-2
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding requires to spec file for devel package


author: Phil Sutter <psutter@redhat.com> [4.11.0-9.el7]
changelog:
  - lib/libnetlink: update rtnl_talk to support malloc buff at run time (Hangbin Liu) [1380803]
  - lib/libnetlink: re malloc buff if size is not enough (Hangbin Liu) [1380803]
  - iplink: double the buffer size also in iplink_get() (Hangbin Liu) [1380803]
  - iplink: check for message truncation in iplink_get() (Hangbin Liu) [1380803]
  - iproute: Add support for extended ack to rtnl_talk (Hangbin Liu) [1380803]
  - libnetlink: drop unused parameter to rtnl_dump_done (Hangbin Liu) [1380803]
  - netlink: Change rtnl_dump_done to always show error (Hangbin Liu) [1380803]


author: Phil Sutter <psutter@redhat.com> [4.11.0-10.el7]
changelog:
  - tc: flower: add support for matching on ip tos and ttl (Kamal Heib) [1456539]
  - iplink: Update usage in help message (Kamal Heib) [1456539]
  - tc: flower: add support for tcp flags (Kamal Heib) [1456539]
  - devlink: Add option to set and show eswitch encapsulation support (Kamal Heib) [1456539]
  - pedit: Introduce ipv6 support (Kamal Heib) [1456539]
  - pedit: Check for extended capability in protocol parser (Kamal Heib) [1456539]
  - pedit: Do not allow using retain for too big fields (Kamal Heib) [1456539]
  - pedit: Fix a typo in warning (Kamal Heib) [1456539]
  - tc: Reflect HW offload status (Kamal Heib) [1456539]
  - devlink: Add support for pipeline debug (dpipe) (Kamal Heib) [1456539]
  - devlink: Change netlink attribute validation (Kamal Heib) [1456539]
  - Update linux headers (Phil Sutter) [1456539]


author: Phil Sutter <psutter@redhat.com> [4.11.0-11.el7]
changelog:
  - ss: add AF_VSOCK support (Stefano Brivio) [1472759]
  - ss: allow AF_FAMILY constants >32 (Stefano Brivio) [1472759]
  - uapi: add include linux/vm_sockets_diag.h (Stefano Brivio) [1472759]
  - iproute: build more easily on Android (Phil Sutter) [1472759]


author: Phil Sutter <psutter@redhat.com> [4.11.0-12.el7]
changelog:
  - man: tc-csum.8: Fix inconsistency in example description (Phil Sutter) [1417162]
  - link_gre6: Detect invalid encaplimit values (Phil Sutter) [1459600]


author: Phil Sutter <psutter@redhat.com> [4.11.0-14.el7_6.1]
changelog:
  - ip-route: Fix nexthop encap parsing (Phil Sutter) [1679996]
  - man: ip-route.8: Document nexthop limit (Phil Sutter) [1679996]
  - ip-route: Fix segfault with many nexthops (Phil Sutter) [1679996]
  - iproute: Abort if nexthop cannot be parsed (Phil Sutter) [1679996]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-19.el7]
changelog:
  - rdma: add infrastructure for RDMA tool (Andrea Claudi) [1642479 1641914]
  - rdma: Add MR resource tracking information (Andrea Claudi) [1642479 1641914]
  - json_writer: add new json handlers (null, float with format, lluint, hu) (Andrea Claudi) [1642479 1641914]
  - lib: make resolve_hosts variable common (Andrea Claudi) [1642479 1641914]
  - utils: Move BIT macro to common header (Andrea Claudi) [1642479 1641914]
  - tc: flower: Add support for QinQ (Andrea Claudi) [1642347]
  - man: tc-vlan.8: Fix for incorrect example (Andrea Claudi) [1593630]
  - man: ip-route.8: ssthresh parameter is NUMBER (Andrea Claudi) [1593628]
  - devlink: Add param command support (Andrea Claudi) [1644731]
  - devlink: Update man pages and add resource man (Andrea Claudi) [1644731]
  - devlink: Add support for hot reload (Andrea Claudi) [1644731]
  - devlink: Add support for devlink resource abstraction (Andrea Claudi) [1644731]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-21.el7]
changelog:
  - Check user supplied interface name lengths (Andrea Claudi) [1465646]
  - tc: flower: No need to cache indev arg (Andrea Claudi) [1465646]
  - ip{6, }tunnel: Avoid copying user-supplied interface name around (Andrea Claudi) [1465646]
  - utils: strlcpy() and strlcat() don't clobber dst (Andrea Claudi) [1465646]
  - lnstat_util: Make sure buffer is NUL-terminated (Andrea Claudi) [1465646]
  - tc_util: No need to terminate an snprintf'ed buffer (Andrea Claudi) [1465646]
  - ipxfrm: Replace STRBUF_CAT macro with strlcat() (Andrea Claudi) [1465646]
  - Convert harmful calls to strncpy() to strlcpy() (Andrea Claudi) [1465646]
  - Convert the obvious cases to strlcpy() (Andrea Claudi) [1465646]
  - utils: Implement strlcpy() and strlcat() (Andrea Claudi) [1465646]
  - lib/libnetlink: Don't pass NULL parameter to memcpy() (Andrea Claudi) [1465646]
  - lib/fs: Fix and simplify make_path() (Andrea Claudi) [1465646]
  - lib/bpf: Check return value of write() (Andrea Claudi) [1465646]
  - netem/maketable: Check return value of fscanf() (Andrea Claudi) [1465646]
  - ss: Make sure scanned index value to unix_state_map is sane (Andrea Claudi) [1465646]
  - ss: Make struct tcpstat fields 'timer' and 'timeout' unsigned (Andrea Claudi) [1465646]
  - lib/ll_map: Choose size of new cache items at run-time (Andrea Claudi) [1465646]
  - tc/m_xt: Fix for potential string buffer overflows (Andrea Claudi) [1465646]
  - lnstat_util: Simplify alloc_and_open() a bit (Andrea Claudi) [1465646]
  - lib/inet_proto: Review inet_proto_{a2n,n2a}() (Andrea Claudi) [1465646]
  - lib/fs: Fix format string in find_fs_mount() (Andrea Claudi) [1465646]
  - ipntable: Avoid memory allocation for filter.name (Andrea Claudi) [1465646]
  - tipc/bearer: Prevent NULL pointer dereference (Andrea Claudi) [1465646]
  - tc/tc_filter: Make sure filter name is not empty (Andrea Claudi) [1465646]
  - tc/q_netem: Don't dereference possibly NULL pointer (Andrea Claudi) [1465646]
  - ifstat, nstat: Check fdopen() return value (Andrea Claudi) [1465646]
  - lib/bpf: Don't leak fp in bpf_find_mntpt() (Andrea Claudi) [1465646]
  - devlink: Check return code of strslashrsplit() (Andrea Claudi) [1465646]
  - iplink_vrf: Complain if main table is not found (Andrea Claudi) [1465646]
  - iproute: Check mark value input (Andrea Claudi) [1465646]
  - tc/q_multiq: Don't pass garbage in TCA_OPTIONS (Andrea Claudi) [1465646]
  - netem/maketable: Check return value of fstat() (Andrea Claudi) [1465646]
  - ss: Use C99 initializer in netlink_show_one() (Andrea Claudi) [1465646]
  - ipmaddr: Avoid accessing uninitialized data (Andrea Claudi) [1465646]
  - iplink_can: Prevent overstepping array bounds (Andrea Claudi) [1465646]
  - ipaddress: Avoid accessing uninitialized variable lcl (Andrea Claudi) [1465646]
  - tc/m_gact: Drop dead code (Andrea Claudi) [1465646]
  - ss: Drop useless assignment (Andrea Claudi) [1465646]
  - ss: Skip useless check in parse_hostcond() (Andrea Claudi) [1465646]
  - lib/rt_names: Drop dead code in rtnl_rttable_n2a() (Andrea Claudi) [1465646]
  - iproute: Fix for missing 'Oifs:' display (Andrea Claudi) [1465646]
  - ipntable: No need to check and assign to parms_rta (Andrea Claudi) [1465646]
  - devlink: No need for this self-assignment (Andrea Claudi) [1465646]
  - tipc/bearer: Fix resource leak in error path (Andrea Claudi) [1465646]
  - ss: Fix potential memleak in unix_stats_print() (Andrea Claudi) [1465646]
  - ifstat: Fix memleak in dump_kern_db() for json output (Andrea Claudi) [1465646]
  - ifstat: Fix memleak in error case (Andrea Claudi) [1465646]
  - ipvrf: Fix error path of vrf_switch() (Andrea Claudi) [1465646]
  - tc/em_ipset: Don't leak sockfd on error path (Andrea Claudi) [1465646]
  - ss: Don't leak fd in tcp_show_netlink_file() (Andrea Claudi) [1465646]
  - iproute_lwtunnel: csum_mode value checking was ineffective (Andrea Claudi) [1465646]
  - iproute_lwtunnel: Argument to strerror must be positive (Andrea Claudi) [1465646]
  - tipc/node: Fix socket fd check in cmd_node_get_addr() (Andrea Claudi) [1465646]
  - ifcfg: Quote left-hand side of [ ] expression (Andrea Claudi) [1465646]
  - examples: Some shell fixes to cbq.init (Andrea Claudi) [1465646]
  - ip-address: Use correct max attribute value in print_vf_stats64() (Andrea Claudi) [1679749]
  - ss: enclose IPv6 address in brackets (Andrea Claudi) [1588122]
  - tc: f_flower: Add support for matching first frag packets (Andrea Claudi) [1559814]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-23.el7]
changelog:
  - tc_util: Silence spurious compiler warning (Andrea Claudi) [1714660]
  - gre6: add collect metadata support (Andrea Claudi) [1714660]
  - tc: m_tunnel_key: add csum/nocsum option (Andrea Claudi) [1714660]
  - m_mirred: don't bail if the control action is missing (Andrea Claudi) [1714660]
  - tc: fix parsing of the control action (Andrea Claudi) [1714660]
  - tc: util: Don't call NEXT_ARG_FWD() in __parse_action_control() (Andrea Claudi) [1714660]
  - tc: don't print error message on miss when parsing action with default (Andrea Claudi) [1714660]
  - tc: gact: fix control action parsing (Andrea Claudi) [1714660]
  - tc/actions: introduce support for goto chain action (Andrea Claudi) [1714660]
  - tc: actions: add helpers to parse and print control actions (Andrea Claudi) [1714660]
  - tc_filter: add support for chain index (Andrea Claudi) [1714660]
  - gre/gre6: allow clearing {,i,o}{key,seq,csum} flags (Andrea Claudi) [1714660]
  - man: ip link: document GRE tunnels (Andrea Claudi) [1714660]
  - ip/tunnel: Use tnl_parse_key() to parse tunnel key (Andrea Claudi) [1714660]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-25.el7]
changelog:
  - tc: implement ingress/egress block index attributes for qdiscs (Andrea Claudi) [1721291]
  - tc: introduce support for block-handle for filter operations (Andrea Claudi) [1721291]
  - tc_filter: resolve device name before parsing filter (Andrea Claudi) [1721291]
  - tc: introduce tc_qdisc_block_exists helper (Andrea Claudi) [1721291]


author: Jakub Čajka <jcajka@redhat.com> - 2.4.8-1
changelog:
  - Resolves: #1182038 - [7.2 FEAT] iprutils package update - ppc64/ppc64le
  - Resolves: #1183460 - RHEL7.1 BE: iprutils: Set known zeroed after format


author: Sinny Kumari <skumari@redhat.com> - 2.4.11.1-1
changelog:
  - Resolves: #1274367 - [7.3 FEAT] iprutils package update
  - Resolves: #1297921 - IPR: Raid migration fails to kick while executing through command line


author: Sinny Kumari <skumari@redhat.com> - 2.4.12.1-1
changelog:
  - Resolves: #1364131 - Integrate various important bug fixes for iprutils in
    RHEL7.3 by updating iprutils to 2.4.12


author: Sinny Kumari <skumari@redhat.com> - 2.4.16.1-1
changelog:
  - Resolves: #1587834 - vpdupdate takes over an hour on system with 104 drive
  - Resolves: #1521052 - iprutils package update for POWER
  - Resolves: #1547891 - iprconfig unable to Download microcode on all applicable devices
  - Resolves: #1576013 - iprconfig tools shows wrong error message, while creating raid using RI SSDs and normal SSDs


author: Thomas Woerner <twoerner@redhat.com> - 6.19-5
changelog:
  - New service sub package to provide the ipset service (RHBZ#1136257)
    Service and start-stop script from F-24
  - Fixed ipset package summary (RHBZ#1195171)
    Spec file derived from F-24


author: Thomas Woerner <twoerner@redhat.com> - 6.19-6
changelog:
  - Use /etc/sysconfig/ipset-config in service as EnvironmentFile (RHBZ#1136257)
  - Use /etc/sysconfig/ipset for data as in RHEL-6 (RHBZ#1136257)
  - No save on reload, but legacy save action (RHBZ#1136257)


author: Thomas Woerner <twoerner@redhat.com> - 6.29-1
changelog:
  - Rebase to 6.29 (RHBZ#1351299)
  - Fixes:
    - Backport ipset capability to run in namespaces (RHBZ#1226051)
    - Fix service save with empty ipset list and existing ipset save file
      (RHBZ#1377621)
    - Fix internal error at printing to output buffer (RHBZ#1395865)


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-1
changelog:
  - Rebase to 6.38 (RHBZ#1557600):
    - hash:ipmac type support added to ipset, userspace part (Tomasz Chilinski)
  - Refactor /etc/sysconfig/ipset.start-stop
  - Fixes:
    - IPSet Service Monolithic Operation (RHBZ#1440741)
    - "systemctl start ipset" doesn't handle existing ipset's having counters
      (RHBZ#1502212)


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-12
changelog:
  - 1389071 handle newer ISCSI_ERR_NOP_TIMEDOUT code from the kernel
  - 1624670 Login negotiation failed due to CHAP_N values do not match
            (rec update race condition)


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-17
changelog:
  - 1518367 boot from iSCSI not establishing all sessions persistently
  - 1667965 A manual restart of iscsi.service modifies records node.startup value


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-18
changelog:
  - 1809945 backport new CHAP modes for FIPS environments (SHA1 and SHA256 only, no SHA3 in OpenSSL-1.0.2)


author: Rafael Aquini <aquini@redhat.com> - 20180113-60.git65b1c68
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - netr: Add Netronome TC flower firmware (rhbz 1518900)
  - Revert amd-ucode for fam17h (rhbz 1533945)


author: Rafael Aquini <aquini@redhat.com> - 20180220-62.git6d51311
changelog:
  - nfp: NIC stops transmitting for small MSS values when TSO is enabled (rhbz 1542263)
  - chelsio: pull in latests firmware 1.17.14.0 (rhbz 1538590)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180518-63.git2a9b2cf
changelog:
  - Update to latest upstream linux-firmware image for assorted netdrv updates
  - amd: add microcode for family 17h and update for family 15h (rhbz 1574575)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180529-65.git7518922
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - amd: update microcode for family 15h (rhbz 1574575)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180717-67.git8d69bab
changelog:
  - Update to latest upstream linux-firmware image for assorted netdrv updates
  - chelsio: update firmware to revision 1.20.8.0 (rhbz 1523202)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180911-68.git85c5d90
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - nvidia: update firmware for Pascal GPUs (rhbz 1625514)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190225-70.git80dee31
changelog:
  - cxgb4: update firmware to revision 1.22.9.0 (rhbz 1671610)
  - nfp: update Agilio SmartNIC flower firmware to rev AOTC-2.10.A.13 (rhbz 1637996)
  - linux-firmware: Update firmware patch for Intel Bluetooth 8260 (rhbz 1649148)
  - qed: Add 8.37.7.0 firmware image (rhbz 1654809)
  - liquidio: fix GPL compliance issue (rhbz 1622521)
  - Update Intel OPA hfi1 firmware (rhbz 1637240)
  - qed: Add firmware 8.37.7.0 (rhbz 1643554)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190318-71.git283373f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: update firmware to revision 1.23.3.0 (rhbz 1642422)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190429-72.gitddde598
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: update firmware to revision 1.23.4.0 (rhbz 1690727)
  - linux-firmware: Add firmware file for Intel Bluetooth 22161 (rhbz 1622438)


author: Jan Stancek <jstancek@redhat.com> - 20190815-73.git07b925b
changelog:
  - Update to latest upstream linux-firmware image for assorted updates (rhbz 1741356)
  - iwlwifi- Update to support the Cyclone Peak Dual Band 2x2 802.11ax
  - iwl7265-firmware sub-package merged into iwl7260-firmware sub-package


author: Jan Stancek <jstancek@redhat.com> - 20190918-74.git6c6918a
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update bnx2x firmware to latest upstream (rhbz 1720386)


author: Jan Stancek <jstancek@redhat.com> - 20191203-75.gite8a0f4c
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update qed zipped/unzipped firmware to latest upstream (rhbz 1720385)


author: Rado Vrbovsky <rvrbovsk@redhat.com> - 20200421-80.git78c0348
changelog:
  - Cross-Process Information Leak (RHEL-8938)
  - Return Address Predictor velunerability leading to information disclosure (RHEL-9250)


author: Rado Vrbovsky <rvrbovsk@redhat.com> - 20200421-80.git78c0348
changelog:
  - AMD: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem (RHEL-13985)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-27
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171211)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-28
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173569)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173569)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-29
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183674)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183682)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-30
changelog:
  - Multiple security fixes (fixed by thoger):
    CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089
    CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692
    CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262
    CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391
    CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583
    CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
  - Fix implicit declaration warning caused by security fixes above


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.17pre01.0
changelog:
  - Bump to 2.6.17pre01.
  - Add support for icedtea_snapshot so we can build pre-releases.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Bump to 2.6.17.
  - Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after 8211883
  - Regenerate pr3393-rh1273760-support_rsaandmgf1_with_sha_in_pkcs11.patch against current sources
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.2
changelog:
  - Synchronise Requires with java-1.8.0-openjdk
  - Replace liblcms.so and libsctp.so in _privatelibs with libjavalcms.so and libjavasctp.so
  - Add libjavagtk.so and libmawt.so to _privatelibs
  - Remove duplicate fontconfig build requirement
  - Remove unneeded Requires for fontconfig, lcms2 and libjpeg (all dynamically linked against)
  - Add _isa to NSS requirements
  - Move policytool desktop file and man page to java-1.7.0-openjdk where the binary is
  - Resolves: rhbz#1608957


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.231-2.6.19.1
changelog:
  - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
  - Fix fsg.sh to fail if patching fails.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.0
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.1
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Drop JDK-8226318/RH1738637 which is now included upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.261-2.6.22.1
changelog:
  - Add release notes from IcedTea.
  - Mark license files with appropriate macro.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b05-shenandoah-merge-2020-08-28.
  - Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.2.ea
changelog:
  - Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b06.
  - Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Delay tzdata 2020b dependency until tzdata update has shipped.
  - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.275.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u275-b01 (GA)
  - Update release notes for 8u275.
  - Resolves: rhbz#1895062


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
  - Added patch600: rh1750419-redhat_alt_java.patch
  - Replaced alt-java placeholder with real patched alt-java
  - Removed patch529: rh1566890-CVE_2018_3639-speculative_store_bypass.patch
  - Removed patch531: rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Both surpassed by new patch
  - Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
  - Extend RH1750419 alt-java fix to include external debuginfo, following JDK-8252395 in 8u282-b01
  - Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b02 (EA)
  - Update release notes for 8u282-b02.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b03 (EA)
  - Update release notes for 8u282-b03.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b04 (EA)
  - Update release notes for 8u282-b04.
  - Remove upstreamed patch PR3519
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b05 (EA)
  - Update release notes for 8u282-b05 and make some minor corrections.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b06 (EA)
  - Update release notes for 8u282-b06.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b07 (EA)
  - Update release notes for 8u282-b07.
  - Fix placement issue in release notes, caught by comparing with vanilla version.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b08 (GA)
  - Update release notes for 8u282-b08.
  - This tarball is embargoed until 2021-01-19 @ 1pm PT.
  - Resolves: rhbz#1908963


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b04 (EA)
  - Update release notes for 8u292-b04.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05 (EA)
  - Update release notes for 8u292-b05.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.1.ea
changelog:
  - Re-organise S/390 patches for upstream submission, separating 8u upstream from Shenandoah fixes.
  - Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
  - Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
  - Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813 in 8u.
  - Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are accurate.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b06 (EA)
  - Update release notes for 8u292-b06.
  - Require tzdata 2020f due to JDK-8259048
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b07 (EA)
  - Update release notes for 8u292-b07.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b08-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b08 (EA)
  - Update release notes for 8u292-b08.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b09 (EA)
  - Update release notes for 8u292-b09.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b10 (GA)
  - Update release notes for 8u292-b10.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1938201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b01 (EA)
  - Update release notes for 8u302-b01.
  - Switch to EA mode.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b02 (EA)
  - Update release notes for 8u302-b02.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03 (EA)
  - Update release notes for 8u302-b03.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
  - Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b04 (EA)
  - Update release notes for 8u302-b04.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b05 (EA)
  - Update release notes for 8u302-b05.
  - Remove JDK-8266929/RH1960024 as now upstream.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b06 (EA)
  - Update release notes for 8u302-b06.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
  - Update release notes for 8u302-b07.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b08 (EA)
  - Update release notes for 8u302-b08.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b01 (EA)
  - Update release notes for 8u312-b01.
  - Switch to EA mode.
  - Remove "-clean" suffix as no 8u312 builds are unclean.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b02 (EA)
  - Update release notes for 8u312-b02.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b03 (EA)
  - Update release notes for 8u312-b03.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b04 (EA)
  - Update release notes for 8u312-b04.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05 (EA)
  - Update release notes for 8u312-b05.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
  - Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
  - Resolves: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.3.ea
changelog:
  - Add patch to improve performance of common separators in Scanner.useLocale
  - Move alt-java patch to correct section.
  - Resolves: rhbz#1862929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b07 (EA)
  - Update release notes for 8u312-b07.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b04 (EA)
  - Update release notes for 8u322-b04.
  - Require tzdata 2021c as of JDK-8274407.
  - Switch to EA mode.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2022809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-1
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Require tzdata 2021e as of JDK-8275766.
  - Update tarball generation script to use git following shenandoah-jdk8u's move to github
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b01 (EA)
  - Update release notes for shenandoah-8u332-b01.
  - Switch to EA mode.
  - Related: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b06 (EA)
  - Update release notes for shenandoah-8u332-b06.
  - Resolves: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-1
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-04-19 @ 1pm PT.
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-1
changelog:
  - Update to shenandoah-jdk8u342-b07
  - Update release notes for shenandoah-8u342-b07.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Remove redundant "REPOS" variable from tarball script
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Rebase JDK-8186464 patch so it applies after JDK-8190753
  - Resolves: rhbz#2106502


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-1
changelog:
  - Update to shenandoah-jdk8u345-b01 (GA)
  - Update release notes for 8u345-b01.
  - Resolves: rhbz#2112383


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Add test to ensure timezones can be translated
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.1.ea
changelog:
  - Update to shenandoah-jdk8u362-b07 (EA)
  - Update release notes for shenandoah-8u362-b07.
  - Switch to EA mode for 8u362 pre-release builds.
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150191


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Fix broken links and missing release notes in older releases.
  - Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
    - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
    - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
    - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-1
changelog:
  - Update to shenandoah-jdk8u372-b07 (GA)
  - Update release notes for shenandoah-8u372-b07.
  - Require tzdata 2023c due to inclusion of JDK-8305113 in 8u372-b07
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Include JDK-8271199 backport early ahead of 8u382 (RH2175317)
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2159458


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b01 (EA)
  - Update release notes for shenandoah-8u382-b01.
  - Switch to EA mode.
  - Remove JDK-8271199 patch which is now upstream.
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b04-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b04 (EA)
  - Update release notes for shenandoah-8u382-b04.
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u372-b05 (GA)
  - Update release notes for shenandoah-8u372-b05.
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u382-b05 (GA)
  - Update release notes for shenandoah-8u382-b05.
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-11319


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - Update to shenandoah-jdk8u392-b08 (GA)
  - Update release notes for shenandoah-8u392-b08.
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Regenerate PR2462 patch following JDK-8315135
  - Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12212
  - Resolves: RHEL-13574
  - Resolves: RHEL-13575
  - Resolves: RHEL-13576
  - Resolves: RHEL-11319
  - Resolves: RHEL-13577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-3
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19630


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b01 (EA)
  - Update release notes for shenandoah-8u402-b01.
  - Switch to EA mode.
  - Sync NEWS with vanilla branch version.
  - Related: RHEL-17914


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b06 (GA)
  - Update release notes for shenandoah-8u402-b06.
  - Drop local copy of JDK-8312489 which is now included upstream
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-17914
  - Resolves: RHEL-20965


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-5
changelog:
  - Introduced ssbd_arches to denote architectures with SSBD mitigation (currently only x86_64)
  - Introduced nm-based check to verify alt-java on ssbd_arches is patched, and no other alt-java or java binaries are patched
  - RH1750419 patch amended to emit a warning on architectures where alt-java is the same as java
  - Resolves: rhbz#1901695


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.1-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+1
  - Update release notes to 11.0.10.0+1
  - Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly.
  - Still use 11.0.x rather than 11.0.x.0 for file naming, as the trailing zero is omitted from tags.
  - Revert configure and built_doc_archive hacks to build 11.0.9.1 from 11.0.9.0 sources, and synced with Fedora version.
  - Cleanup debug package descriptions and version number placement.
  - Switch to EA mode for 11.0.10 pre-release builds.
  - Drop JDK-8222286 & JDK-8254177 as applied upstream
  - Explicitly request bundled Harfbuzz (too risky to change this so late in the RHEL 7 lifecycle)
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.2-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+2
  - Update release notes to 11.0.10.0+2
  - Update tarball generation script to use PR3818 which handles JDK-8171279 changes
  - Drop JDK-8250861 as applied upstream.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.2-0.0.ea
changelog:
  - Completely revert hacks from previous release, using buildver in configure and tzdata 2020b
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.5-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+5
  - Update release notes to 11.0.10.0+5
  - Drop JDK-8222527 as applied upstream.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.8-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+8
  - Update release notes to 11.0.10.0+8 and add missing JDK-8245051 from b04.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-0
changelog:
  - Update to jdk-11.0.10.0+9
  - Update release notes to 11.0.10.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-01-19 @ 1pm PT.
  - Resolves: rhbz#1908970


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.1.ea
changelog:
  - Perform static library build on a separate source tree with bundled image libraries
  - Make static library build optional
  - Based on initial work by Severin Gehwolf
  - Resolves: rhbz#1930527


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.1.ea
changelog:
  - Debug builds need to find their documentation from the release build.
  - RHEL 7 builds still include a doc package for debug builds, though debug builds do not build docs.
  - Resolves: rhbz#1930527


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:11.0.11.0.3-0.1.ea
changelog:
  - Fix issue where CheckVendor.java test erroneously passes when it should fail.
  - Add proper quoting so '&' is not treated as a special character by the shell.
  - Resolves: rhbz#1938082


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.9-0
changelog:
  - Update to jdk-11.0.11.0+9
  - Update release notes to 11.0.11.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1940228


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.1-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+1
  - Update release notes to 11.0.12.0+1
  - Switch to EA mode for 11.0.12 pre-release builds.
  - Update ECC patch following JDK-8226374 (bug ID yet to be confirmed)
  - Remove local JDK-8187450 backport as now included upstream.
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.4-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+4
  - Update release notes to 11.0.12.0+4
  - Correct bug ID JDK-8264846 to intended ID of JDK-8264848
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.6-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+6
  - Update release notes to 11.0.12.0+6
  - Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-0
changelog:
  - Update to jdk-11.0.12.0+7
  - Update release notes to 11.0.12.0+7
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-3
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Related: rhbz#1999936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.13.0+1
  - Update release notes to 11.0.13.0+1
  - Update tarball generation script to use git following OpenJDK 11u's move to github
  - Switch to EA mode for 11.0.13 pre-release builds.
  - Remove non-Free test from source tarball.
  - Related: rhbz#1999936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-1
changelog:
  - Update to jdk-11.0.12.0+8
  - Update release notes to 11.0.12.0+8
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2012332


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Replaced hardcoded 11 by featurever where appropriate
  - Fixed comment of `for slowdebug` to correct `any debug`
  - Related: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.14.0+8
  - Update release notes to 11.0.14.0+8
  - Switch to EA mode for 11.0.14 pre-release builds.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Rename blacklisted.certs to blocked.certs following JDK-8253866
  - Resolves: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-1
changelog:
  - Update to jdk-11.0.14.0+9
  - Update release notes to 11.0.14.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-01-18 @ 1pm PT.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.15.0+1
  - Update release notes to 11.0.15.0+1
  - Switch to EA mode for 11.0.15 pre-release builds.
  - Related: rhbz#2047531


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-1
changelog:
  - Update to jdk-11.0.15.0+9
  - Update release notes to 11.0.15.0+9
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-2
changelog:
  - Remove security items from release notes that were only in 17u and N/A for 11u
  - Related: rhbz#2073422


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Add additional patch during tarball generation to align tests with ECC changes
  - Related: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Update to jdk-11.0.16+8
  - Update release notes to 11.0.16+8
  - Use same tarball naming style as java-17-openjdk and java-latest-openjdk
  - Drop JDK-8284920 patch now upstreamed
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-1
changelog:
  - Update to jdk-11.0.16.1+1
  - Update release notes to 11.0.16.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119512


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.17+1
  - Update release notes to 11.0.17+1
  - Switch to EA mode for 11.0.17 pre-release builds.
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Include Aleksey's patch for JDK-8291053 to try and get HarfBuzz to build again
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Try to build using system HarfBuzz to avoid build failures with 4.4.1 & gcc 4.8.5
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-1
changelog:
  - Update to jdk-11.0.17+8 (GA)
  - Update release notes to 11.0.17+8
  - Switch to GA mode for release
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - Remove unneeded JDK-8291053 patch as we no longer build in-tree HarfBuzz
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.18+1
  - Update release notes to 11.0.18+1
  - Switch to EA mode for 11.0.18 pre-release builds.
  - Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e
  - Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.2.ea
changelog:
  - Update to jdk-11.0.18+9
  - Update release notes to 11.0.18+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-1
changelog:
  - Update to jdk-11.0.18+10 (GA)
  - Update release notes to 11.0.18+10
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
  - Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-1
changelog:
  - Update to jdk-11.0.19.0+7
  - Update release notes to 11.0.19.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Rebase RH1750419 alt-java patch against 11.0.19+6
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.20+1 (EA)
  - Update release notes to 11.0.20+1
  - Switch to EA mode
  - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 11.0.20+1
  - Add missing Swing release note
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
changelog:
  - Update to jdk-11.0.20.0+8 (GA)
  - Update release notes to 11.0.20.0+8
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
  - Update to jdk-11.0.20.1+1 (GA)
  - Update release notes to 11.0.20.1+1
  - Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
  - Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Synchronise runtime and buildtime tzdata requirements
  - Update README.md to match the version in later RHEL releases
  - Resolves: rhbz#2236229


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.21.0.9-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-11320


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-1
changelog:
  - Update to jdk-11.0.21+9 (GA)
  - Update release notes to 11.0.21+9
  - Remove system crypto policy patch which doesn't belong on RHEL 7 with no system policies
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Apply all patches using -p1
  - Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12217
  - Resolves: RHEL-12910
  - Resolves: RHEL-12913
  - Resolves: RHEL-11320
  - Resolves: RHEL-13227
  - Resolves: RHEL-13217


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19642


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.6-0.1.ea
changelog:
  - Update to jdk-11.0.22+6 (EA)
  - Update release notes to 11.0.22+6
  - Switch to EA mode
  - Drop local copy of JDK-8312489 which is now included upstream
  - Resolves: RHEL-21031


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
changelog:
  - Update to jdk-11.0.22+7 (GA)
  - Update release notes to 11.0.22+7
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-20966


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.6-0.0.ea
changelog:
  - Update to jdk-11.0.9+6 (EA)
  - Update tarball generation script to use PR3802, handling JDK-8233228 & JDK-8177334
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.8-0.0.ea
changelog:
  - Update to jdk-11.0.9+8 (EA)
  - Remove JDK-8252258/RH1868406 now applied upstream.
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.10-0.1.ea
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Moved vendor_version_string to a better place
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-0
changelog:
  - Update to jdk-11.0.9+11
  - Update release notes for 11.0.9 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-1
changelog:
  - Move all license files to NVR-specific JVM directory.
  - This bad placement was killing parallel installability and thus having a bad impact on leapp, if used.
  - Resolves: rhbz#1896609


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.9.11-1
changelog:
  - Update to jdk-11.0.9.1+1
  - RPM version stays at 11.0.9.11 so as to not break upgrade path.
  - Adds a single patch for JDK-8250861.
  - Resolves: rhbz#1895275


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-2
changelog:
  - Add backport of JDk-8222537 so the Host header is sent when using proxies.
  - Resolves: rhbz#1869530


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-3
changelog:
  - Bugzilla #1534772 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
    decode/encode process alters original data (cfu)
  - Bugzilla #1554056 - JSS: Add support for TLS_*_SHA384 ciphers (cfu)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-4
changelog:
  - Bugzilla #1671244 - x25519 allowed in FIPS mode [rhel-7.6.z] (ascheel)
  - Bugzilla #1671247 - CC: Enable AIA OCSP cert checking for entire cert
    chain [rhel-7.6.z] (jmagne)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-5
changelog:
  - Bugzilla #1671247 - CC: Enable AIA OCSP cert checking for entire cert
    chain [rhel-7.6.z] (jmagne)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.6-2
changelog:
  - Bugzilla #1747966 - CVE 2019-14823 jss: OCSP policy "Leaf and Chain" implicitly trusts the root certificate


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-8
changelog:
  - Fix vlock doesn't perform PAM account management or credential reinitialization
    Resolves: #1032140


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-14
changelog:
  - Replace CtrlL_Lock with Caps_Lock in generated us.map
    Resolves: #1441411
  - Improve man pages and usage messages quality and consistency
    Resolves: #949015


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-8
changelog:
  - Powerdevil: do not notify about a non existent action
    Resolves: bz#1289149
  - Plasma taskmanager: close context menu when task is closed
    Resolves: bz#1262603


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-10
changelog:
  - Fix grouping of tasks in taskmanager applet
    Resolves: bz#1348917
  - Fix unlocking of kscreenlocker, unlock it just once
    Resolves: bz#1333441


author: Jan Grulich <jgrulich@redhat.com> - 4.11-19-13
changelog:
  - Sanitise notification HTML
    Resolves: bz#1568853

  - Increase cpu buffer size in ksysguard
    Resolves: bz#1611762


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-14
changelog:
  - Do not show disabled buttons in Plastik decoration theme
    Resolves: bz#1677641

  - Taskmanager: dismiss group when application is closed and there is enough space
    Resolve: bz#1698048


author: Jan Grulich <jgrulich@redhat.com> - 19-23.9
changelog:
  - Check if we have write access to home directory before creating default folders
    Resolves: bz#1579764


author: Jan Grulich <jgrulich@redhat.com> - 6:4.14.8-9
changelog:
  - Do not fork konsole process when opening terminal from apps using dolphin-part
    Resolves: bz#1710362


author: Pingfan Liu <piliu@redhat.com> 2.0.15-15
changelog:
  - dracut-module-setup.sh: pass ip=either6 param for ipv6
  - dracut-module-setup.sh: install /etc/hosts when using fence_kdump
  - update kdump-anaconda-addon-003-29-g4c517c5.tar.gz


author: Pingfan Liu <piliu@redhat.com> 2.0.15-18
changelog:
  kdumpctl: Rebuild initramfs if loaded kernel modules changed
  dracut-module-setup.sh: don't include multipath-hostonly
  Add document to declare FCoE support (V2)
  Revert "Add document to declare FCoE support"
  Add document to declare FCoE support
  makedumpfile: fix makedumpfile Not tainted in 2nd kernel


author: Pingfan Liu <piliu@redhat.com> 2.0.15-20
changelog:
  - makedumpfile: when refiltering, initialize refiltered bitmap2 from the kdump file's bitmap2
  - dracut-module-setup: Fix DRM module inclusion test for hyper-v
  - kdumpctl: remove some cmdline inheritage from 1st kernel
  - kdump-lib.sh:get_loaded_kernel_modules() Fix missing newline
  - kdumpctl: Rebuild initramfs if loaded kernel modules changed (V2)
  - Revert "kdumpctl: Rebuild initramfs if loaded kernel modules changed"
  - dracut-module-setup: Fix test for inclusion of DRM modules


author: Bhupesh Sharma <bhsharma@redhat.com> 2.0.15-43
changelog:
  - module-setup: re-fix 99kdumpbase network dependency
  - kdumpctl: bail out immediately if host key verification failed


author: Bhupesh Sharma <bhsharma@redhat.com> 2.0.15-48
changelog:
  - dracut-module-setup.sh: ensure cluster info is ready before query.
  - dracut-module-setup.sh: improve get_alias()


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8-1
changelog:
  - Resolves: rhbz#1673716 - Rebase k-h-c-i to version 0.8
  - The rebase also includes fixes for:
    - rhbz#1533190 - CVE-2017-15111 keycloak-httpd-client-install: unsafe
                     /tmp log file in --log-file option in keycloak_cli.py
    - rhbz#1533202 - CVE-2017-15112 keycloak-httpd-client-install: unsafe
                     use of -p/--admin-password on command line


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-17
changelog:
  - libkmod-elf: resolve CRC if module is built with MODULE_REL_CRCS.
  - weak-modules: process only weak-updates related depmod output.
    Resolves: rhbz#1468305
  - weak-modules: implement dry run by symlink restoration.
    Resolves: rhbz#1477073


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-18
changelog:
  - depmod: external directories support.
    Resolves: rhbz#1361857
  - BuildRequires automake autoconf libtool.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-20
changelog:
  - weak-modules: use function to generate weak_updates_dir
  - weak-modules: implement dry-run on the tempdir
    Resolves: rhbz#1510058


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-23
changelog:
  - weak-modules: fix initial state creation for dry-run
  - weak-modules: check compatibility in a temporary directory
    Resolves: rhbz#1619889.


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.84-1
changelog:
  - Deleted unused UDS features.
  - Improved performance of sub 4K writes.
  - Simplified and improved performance of writes with FUA.
  - Improved the accuracy of dedupe statistics.
  - Made the MurmurHash3 implementation architecture independent.
  - Fixed compilation errors on newer versions of GCC.
  - Eliminated spurious allocation of a UDS sparse cache for dense indexes.
  - Fixed a deadlock resulting from sleeping while holding a spinlock while
    getting statistics.
  - Resvolves: rhbz#1562228
  - Fixed bugs related to the timing of the creation and destruction of sysfs
    nodes relative to the creation and destruction of VDO data structures.
  - Resolves: rhbz#1559692
  - Fixed a bug which made deduplication impossible to disable.
  - Removed obsolete code.
  - Improved deduplication of concurrent requests containing the same data.
  - Reduced unnecessary logging.
  - Resolves: rhbz#1511127
  - Removed the prepare_ioctl() function to avoid signature changes since
    this function currently does nothing.
  - Resolves: rhbz#1568129
  - Fixed a bug which made using a sparse index impossible to create.
  - Resolves: rhbz#1570156


author: - Andy Walsh <awalsh@redhat.com> 6.1.1.99-1
changelog:
  - Added /sys/kvdo/version which contains the currently loaded version of
    the kvdo module.
  - Resolves: rhbz#1533950
  - Added logging of normal operation when a VDO device starts normally.
  - Resolves: rhbz#1520988
  - Fixed a race in the UDS module which could cause the index to go offline.
  - Resolves: rhbz#1520988
  - Fixed a bug which would cause attempts to grow the physical size of a VDO
    device to fail if the device below the VDO was resized while the VDO was
    offline.
  - Resolves: rhbz#1582647
  - Fixed thread safety issues in the UDS page cache.
  - Resolves: rhbz#1579492
  - Modified the vdo script to not allow creation of a VDO device on top of an
    already running VDO device.
  - Resolves: rhbz#1572640
  - Fixed a bug which could cause data loss when discarding unused portions of a
    VDO's logical space.
  - Resolves: rhbz#1589249
  - Modified grow physical to fail in the prepare step if the size isn't
    changing, avoiding a suspend-and-resume cycle.
  - Resolves: rhbz#1576539


author: - Andy Walsh <awalsh@redhat.com> 6.1.1.111-1
changelog:
  - Added support for issuing fullness warnings via dmeventd
  - rhbz#1519307
  - Fixed a bug which would cause kernel panics when a VDO device is stacked on a
    RAID50 device.
  - Resolves: rhbz#1593444
  - Improved logging when growing the physical size of a VDO volume.
  - Resolves: rhbz#1597890
  - Resolves: rhbz#1597886
  - Removed misleading log messages when rebuilding the UDS index.
  - Resolves: rhbz#1599867


author: - Andy Walsh <awalsh@redhat.com> 6.1.1.120-2
changelog:
  - No longer attempt to unload modules in %preun
  - Resolves: rhbz#1553420
  - Improved memory allocation by not using the incorrect __GFP_NORETRY flag
    and by using the memalloc_noio_save mechanism.
  - Resolves: rhbz#1571292
  - Fixed a potential deadlock in the UDS index by using the kernel supplied
    struct callback instead of our own implementation of synchronous
    callbacks.
  - Resolves: rhbz#1602151
  - Fixed a potential stack overflow when reaping the recovery journal.
  - Resolves: rhbz#1608070
  - No longer attempt to unload modules in %preun
  - Resolves: rhbz#1553420
  - Improved safety around memory allocation permissions
  - Resolves: rhbz#1595923
  - Improved statistics accounting to allow for concurrent dedupe.
  - Resolves: rhbz#1540722


author: - Andy Walsh <awalsh@redhat.com> 6.1.1.125-4
changelog:
  - Attempt to unload modules and print a warning if unable to.
  - Resolves: rhbz#1553420
  - Fixed a hang when recovering a VDO volume with a physical size larger than
    16TB.
  - Resolves: rhbz#1628316


author: - Andy Walsh <awalsh@redhat.com> 6.1.2.38-5
changelog:
  - Fixed more error path memory leaks.
    - Resolves: rhbz#1609426
  - Rebased to version 6.2.0 of the UDS module
    - Resolves: rhbz#1637762
  - Improved counting of dedupe timeouts by including in the count queries
    which are not made due to their being a lack of resources from previous
    queries taking too long.
    - Resolves: rhbz#1639898
  - Fixed a NULL pointer dereference if dmeventd registration fails.
    - Resolves: rhbz#1640794
  - Fixed a bug in the statistics tracking partial I/Os.
    - Resolves: rhbz#1594406
  - Allowed VDO backing devices to be specified by major:minor device number.
    - Resolves: rhbz#1637762
  - Suppressed egregious read-only error logging.
    - Resolves: rhbz#1687005


author: - Andy Walsh <awalsh@redhat.com> 6.1.2.41-5
changelog:
  - Reduced and rate limited error logging in order to avoid kernel soft-lockups.
    - Resolves: rhbz#1687005


author: - Andy Walsh <awalsh@redhat.com> 6.1.3.4-5
changelog:
  - Reduced and rate limited more error logging in order to avoid kernel
    soft-lockups.
    - Resolves: rhbz#1706196
  - Fixed a bug in the handling of re-used bios. This bug resulted in a
    kernel panic when rebooting a system after a crash with a VDO device on
    USB attached storage.
    - Resolves: rhbz#1676643


author: - Andy Walsh <awalsh@redhat.com> 6.1.3.7-5
changelog:
  - Fixed a rare bug which would log an assertion failure when shutting down
    a VDO device.
    - Resolves: rhbz#1749000


author: Stephan Wiesand <stephan wiesand desy de> 1.6.17-234.SLx
changelog:
  - update to release 1.6.17 (security release)
  - install service unit files with mode 644, not 755 (rt.central.org #132662)


author: Stephan Wiesand <stephan wiesand desy de> 1.6.20-256.SLx
changelog:
  - update to security release 1.6.20
  - added RemainAfterExit=true in afs.service, to fix the case where only
    kernel threads remain after the client has started


author: Stephan Wiesand <stephan wiesand desy de> 1.6.23-289.SLx
changelog:
  - update to release 1.6.23 (security release)
  - addresses OPENAFS-SA-2018-001, OPENAFS-SA-2018-002, OPENAFS-SA-2018-003


author: Stephan Wiesand <stephan wiesand desy de> 1.6.24-290.SLx
changelog:
  - update to release 1.6.24 (security release)
  - addresses OPENAFS-SA-2019-001, OPENAFS-SA-2019-002, OPENAFS-SA-2019-003
  - fix build on EL 6.10


author: Petr Oros <poros@redhat.com> 2.0.8-14
changelog:
  - Classify device connectivity issues as global errors
  - For >= kernel-3.10.0-319.el7
  - Resolves: #1265218


author: Eugene Syromiatnikov <esyr@redhat.com> 2.0.8-22.1
changelog:
  - For >= kernel-3.10.0-957.el7
  - Add "use-after-free-asm-request.patch"
  - (oracleasm: Fix use after free for request processing timer)
  - Resolves: #1679239


author: Eugene Syromiatnikov <esyr@redhat.com> 1.10.0_dup7.7-1
changelog:
  - c45db7d2f34d6fad924c20443f73147dca7f6e29
  - bnxt_en kernel module for Driver Update Program
  - Resolves: #bz1755331


author: Eugene Syromiatnikov <esyr@redhat.com> 2.0.2K_dup7.6-2
changelog:
  - baf6ab56eb2d596f7d4c6c1e1ccd8a73db6e1c94
  - Resolves: #bz1659505
  - ena module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 2.8.10_k_dup7.7-1
changelog:
  - c45db7d2f34d6fad924c20443f73147dca7f6e29
  - i40e kernel module for Driver Update Program
  - Resolves: #bz1784768


author: Eugene Syromiatnikov <esyr@redhat.com> 12.0.0.5_dup7.6-1
changelog:
  - baf6ab56eb2d596f7d4c6c1e1ccd8a73db6e1c94
  - Resolves: #bz1676589
  - lpfc kernel module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 26.100.01.00_dup7.6-1
changelog:
  - db1eefc8c25d0a3feaed310963bb3c3d04d81825
  - Resolves: #bz1660390
  - mpt3sas module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 3.10.0_957-1
changelog:
  - baf6ab56eb2d596f7d4c6c1e1ccd8a73db6e1c94
  - Resolves: #bz1672909
  - nfit kernel module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 8.33.0.20_dup7.6-1
changelog:
  - baf6ab56eb2d596f7d4c6c1e1ccd8a73db6e1c94
  - Resolves: #1668206
  - qed module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 8.33.0.20_dup7.6-1
changelog:
  - baf6ab56eb2d596f7d4c6c1e1ccd8a73db6e1c94
  - Resolves: #bz1668206
  - qede module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 8.33.0.20_dup7.6-1
changelog:
  - baf6ab56eb2d596f7d4c6c1e1ccd8a73db6e1c94
  - Resolves: #bz1668206
  - qedf module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 8.33.0.20_dup7.6-1
changelog:
  - baf6ab56eb2d596f7d4c6c1e1ccd8a73db6e1c94
  - Resolves: #bz1668206
  - qedi module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 3.10.0_957_dup7.6-3
changelog:
  - baf6ab56eb2d596f7d4c6c1e1ccd8a73db6e1c94
  - Resolves: #bz1668206
  - qedr module for Driver Update Program


author: Eugene Syromiatnikov <esyr@redhat.com> 10.01.00.20.07.8_k_dup7.7-1
changelog:
  - c45db7d2f34d6fad924c20443f73147dca7f6e29
  - qla2xxx kernel module for Driver Update Program
  - Resolves: #bz1784769


author: Robbie Harwood <rharwood@redhat.com> - 1.15.1-29
changelog:
  - Process profile includedir in sorted order
  - Also, ignore dotfiles in included directories
  - Resolves: #1539824


author: Robbie Harwood <rharwood@redhat.com> - 1.15.1-32
changelog:
  - Include preauth name in trace output if possible
  - Update cert generation scripts to work on modern openssl
  - Fix per-request preauth scoping
  - Add test case for PKINIT DH renegotiation
  - Echo KDC cookies in preauth tryagain
  - Fall back to other preauth mechanisms after failures
  - Resolves: #1540130


author: Siteshwar Vashisht <svashisht@redhat.com> - 20120801-37
changelog:
  - Add configuration option to enable signal bubbling for backward compatibility
    Resolves: #1484937


author: Kamil Dudka <kdudka@redhat.com> - 20120801-137
changelog:
  - Increase the release number by 100 to make sure it stays higher than in RHEL-6
    Related: #1484937


author: John Dennis <jdennis@redhat.com> - 2.4.1-8
changelog:
  - Add explicit minimum dependency on glib2 2.42,
    for some reason RPM is not automatically detecting the dependency
    Resolves: #1254989


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-3
changelog:
  - Resolves: #1634267 - ECP signature check fails with
                         LASSO_DS_ERROR_SIGNATURE_NOT_FOUND when assertion signed
                         instead of response


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-4
changelog:
  - Resolves: #1730009 - lasso includes "Destination" attribute in SAML
                         AuthnRequest populated with SP
                         AssertionConsumerServiceURL when ECP workflow
                         is used which leads to IdP-side errors


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-5
changelog:
  - Resolves: #1719014 - Expired certificate prevents tests from running
  - Actually apply the patch file for the previous build
  - Related: #1730009 - lasso includes "Destination" attribute in SAML
                         AuthnRequest populated with SP
                         AssertionConsumerServiceURL when ECP workflow
                         is used which leads to IdP-side errors


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-6
changelog:
  - Resolves: #1963855 - CVE-2021-28091 lasso: XML signature wrapping
                         vulnerability when parsing SAML responses


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-7
changelog:
  - Fix Coverity warning introduced by the previous patch
  - Related: #1963855 - CVE-2021-28091 lasso: XML signature wrapping
                        vulnerability when parsing SAML responses


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.20-2
changelog:
  - Resolves: rhbz#1290715 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.3]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.20-3
changelog:
  - Resolves: rhbz#1290715 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.3]
  - Remove the patch from the previous commit, it doesn't fix a remotely
    eploitable issue. Add patches from upstream #11636 instead.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.29-1
changelog:
  - Resolves: rhbz#1393810 - Rebase libldb to enable samba rebase to
                             version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.2.2-1
changelog:
  - Resolves: rhbz#1470056 - Rebase libldb to enable samba rebase to
                             version 4.7.x


author: Luboš Uhliarik <luhliari@redhat.com> - 4.4.8-6
changelog:
  - Fix lftp does not follow http redirect (302) in mirror mode (#1181580)
  - Fix lftp exists randomly when "cmd:fail-exit" is set (#1193984)
  - Added RFE - lftp configurations for restricting each SSL/TLS 
    version (#1182987)
  - Fixed bogus dates of this SPEC


author: Michal Ruprich - 4.4.8-9
changelog:
  - Resolves: #1374653 -  File size decreases when synchronizing folders with a sftp account using lftp


author: Michal Ruprich - 4.4.8-10
changelog:
  - Related: #1374653 - File size decreases when synchronizing folders with a sftp account using lftp
                      - Patch edited so that it corresponds to upstream


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-11
changelog:
  - Resolves: #1514815 - lftp doesn't seems to consider 'set net:max-retries'
  - Resolves: #1556675 - "get" command with lftp does not fail on net:max-retries


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-12
changelog:
  - Resolves: #1611641 - CVE-2018-10916 lftp: particular remote file names may lead to current working directory erased


author: Michal Ruprich <michalruprich@gmail.com> - 4.4.8-12.1
changelog:
  - Resolves: #1797964 - lftp with ssl gives error Fatal error: gnutls_record_recv: The TLS connection was non-properly terminated


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-13
changelog:
  - Resolves: #1573296 - lftp with ssl gives error Fatal error: gnutls_record_recv: The TLS connection was non-properly terminated


author: Karel Zak <kzak@redhat.com> 2.23.2-54
changelog:
  - fix #1581611 - lslogins never shows lock passwords as PWD-LOCK
  - fix #1579439 - RHEL 7.5 - lscpu shows wrong sockets, threads on max config (32TB) POWER8 machine (util-linux)
  - fix #1566674 - [RFE] Add warnings that have to be acknowledged to the -l flag in umount or remove the option
  - fix #1566390 - [RHEL-7.5] losetup can not detach all loop devices
  - fix #1562125 - "setarch ppc<*>" fails with "Unrecognized architecture"
  - fix #1528567 - [RFE] Provide 'dig-holes' functionality for fallocate
  - fix #1528959 - rbind creates duplicate entries in /proc/mounts
  - fix #1538721 - mount man page says sync option has no effect for ext4
  - fix #1252764 - icrnl is not set when autologin is used
  - fix #1561200 - [RFE] - sulogin: improve support for locked root account
  - fix #1566432 - [RHEL-7.5] losetup: /dev/loop1: failed to set up loop device


author: Karel Zak <kzak@redhat.com> 2.23.2-59
changelog:
  - fix #1618711 - exec option in mount unable to override the implicit noexec in user option
  - fix #1616264 - Login to emergency shell failed


author: Karel Zak <kzak@redhat.com> 2.23.2-59.el7_6.1
changelog:
  - fix #1664752 - Bull (Atos) server lands up in invalid stty settings on the serial console after boot preventing login


author: Karel Zak <kzak@redhat.com> 2.23.2-61
changelog:
  - #1203378 - Cannot use swapon with fallocated XFS swapfile
  - #1632944 - blkid/lsblk does not recognize exfat filesystem without a label
  - #1633657 - mount -a always tries to mount CIFS share subdir despite being already mounted
  - #1639465 - Bad formatting in agetty.8 man page
  - #1667942 - libsmartcols: scols_print_table_to_string() doesn't work
  - #1678451 - Unable to mount to a directory that matches a dm device under /dev


author: Karel Zak <kzak@redhat.com> 2.23.2-62
changelog:
  - fix #1734545 - blkid_get_dev() leak file descriptor to underlying block device
  - fix #1712768 - lsmem segfaults on ppc64 wih -o
  - fix #1690102 - setarch(8) does not check error return values properly.
  - fix #1734261 - lscpu not showing Physical socket, chips information


author: Karel Zak <kzak@redhat.com> 2.23.2-64
changelog:
  - fix #1788896 - Internal testsuite: libmount tests failed
  - fix #1802240 - systemd-udev segmentation fault in crc32() at lib/crc32.c (libblkid)
  - fix #1816183 - "mount -a" should ignore already mounted bind mounts.
  - fix #1747710 - please backport the "uid=forget" and "gid=forget" UDF mount options to libmount
  - fix #1784579 - RHEL-7: col struct char_str c_column field should be of unsigned type and/or larger than 16 bit


author: Karel Zak <kzak@redhat.com> 2.23.2-65
changelog:
  - fix #1826719 - mount -a tries to mount already mounted cifs shares when we cannot query up to root dir
  - fix #1745657 - mismatch between spec file and uuidd runtime directory


author: Karel Zak <kzak@redhat.com> 2.23.2-65.el7_9.1
changelog:
  - fix #1905956 - RHEL-7: chrt regression: unwanted 'nice' value reset on sched_setattr() [rhel-7.9.z]
  - fix #1905954 - RHEL-7: chrt regression: unexpected default scheduler [rhel-7.9.z]
  - fix #1883013 - RHEL-7: chrt command does not support the -R option [rhel-7.9.z]


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.8-1
changelog:
  - Temporarily skip vfat generic resize test on rawhide (vtrefny)
  - Use "safeprobe" in "bd_fs_wipe" (vtrefny)
  - Add a generic filesystem resize function (vtrefny)
  - Add a function to get mountpoint for a device (vtrefny)
  - Add a function to get filesystem type for a device (vtrefny)
  - Only include the LVM DBus config when shipping LVM DBus (vpodzime)
  - Skip the LVM DBus vgreduce tests on Rawhide (vpodzime)
  - Do not build the lvm-dbus plugin on RHEL/CentOS (vpodzime)
  - Give zRAM more time to settle before trying to remove a device (vpodzime)
  - Put zram tests adding/removing devices into a separate class (vpodzime)
  - Skip LVM cache and RAID tests on Rawhide (vpodzime)
  - Fix the skip_on decorator factory for tests (vpodzime)
  - Use 'blkid -p' instead of lsblk to get device's FS type (vpodzime)
  - Improve the lvm_set_global_config test (vpodzime)
  - Pass '-y' to pvresize (vpodzime)
  - Create a copy of os.environ for a child process (vpodzime)
  - Revert "Use the "C.UTF-8" locale instead of just "C"" (vpodzime)
  - Fix how we create vfat FS in tests (vpodzime)
  - Skip the test if requiring unavailable locales (vpodzime)
  - Use the "C.UTF-8" locale instead of just "C" (vpodzime)
  - Add functions for working with ext2 and ext3 filesystems (vtrefny)
  - Link to gobject when lvm or btrfs is enabled (andreas)
  - Link to libm where needed (andreas)
  - Add a function for cleaning a device (vtrefny)
  - Add few code exaples to documentation (vtrefny)
  - Use a special exception for no fs signature when doing wipe (vpodzime)
  - One more incompatible os.symlink() call (vpodzime)
  - Do not use pass-by-name in the os.symlink() call (vpodzime)
  - Ignore previous errors when falling back to using ioctl() (vpodzime)
  - Use ioctl() call to teardown loop devices (vpodzime)
  - Resolve the device to remove for mdadm (vpodzime)
  - Add a function for getting device symlinks (vpodzime)
  - Use the new resolve_device() function where appropriate (vpodzime)
  - Add the resolve_device() function to the utils library (vpodzime)
  - First try to read the 'autoclear' flag from /sys/ (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.9-1
changelog:
  - Fix hardcoded reference to gcc (timo.gurr)
  - Catch and ignore partial failures in LVM tests' cleanups (vpodzime)
  - Fix hardcoded reference to pkg-config (timo.gurr)
  - Make GObject introspection optional (vpodzime)
  - Do not link libraries required by plugins to the GI files (vpodzime)
  - Make sure the whole build status image is shown (vpodzime)
  - Show CI status in README (at the GH repo's front page) (vpodzime)
  - Always require the libudev pkg (tgurr)
  - Make sure we give kernel time to fully setup zram device(s) (vpodzime)
  - fs_test.py: Close FDs when calling utilities (tasleson)
  - crypto.c: Correct segmentation fault (tasleson)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.10-1
changelog:
  - Only enable partition size tolerance with alignment (vpodzime)
  - Limit the requested partition size to maximum possible (vpodzime)
  - Do not verify vfat FS' size after generic resize (vpodzime)
  - Specify tolerance for partition size (kailueke)
  - Only use the exact constraint if not using any other (vpodzime)
  - Check resulting FS size in tests for generic FS resize (vpodzime)
  - Query setting FS label support and generic relabeling (kailueke)
  - Do not strictly require all FS utilities (vpodzime)
  - Compile everything with the C99 standard (vpodzime)
  - Add partition resize function (kailueke)
  - Generic Check and Repair Functions (kailueke)
  - Query functions for FS resize and repair support (kailueke)
  - Update the project/source URL in the spec file (vpodzime)
  - Add functions for opening/closing TrueCrypt/VeraCrypt volumes (vpodzime)
  - Adapt to a change in behaviour in new libmount (vpodzime)
  - Try RO mount also if we get EACCES (vpodzime)
  - Size in bytes for xfs_resize_device (kailueke)
  - src/plugins/Makefile.am: Remove hard coded include path in /usr prefix (tristan.vanberkom)
  - Fixed include for libvolume_key.h (tristan.vanberkom)
  - Ignore parted warnings if possible (squimrel)
  - bcache tests: Remove FEELINGLUCKY checks (tasleson)
  - kbd.c: Code review corrections (tasleson)
  - kbd.c: Make bd_kbd_bcache_create work without abort (tasleson)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.11-1
changelog:
  - Make the KbdZRAMDevicesTestCase inherit from KbdZRAMTestCase (vpodzime)
  - Allow non-source directory builds (kailueke)
  - Add a way to disable runtime dependency checks (vpodzime)
  - Link to GObject even if no plugin is activated (kailueke)
  - Skip zram tests on Rawhide (vpodzime)
  - Keep most utilities available for tests (vpodzime)
  - Use new libmount function to get (un)mount error message (vtrefny)
  - Update the documentation URL (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.12-1
changelog:
  - Own directories /etc/libblockdev and /etc/libblockdev/conf.d (vtrefny)
  - Wait for resized partition (kailueke)
  - Make sure the device is opened for libparted (vpodzime)
  - Fix label check in swap_test (vtrefny)
  - Use "run_tests" script for running tests from Makefile (vtrefny)
  - Add a script for running tests (vtrefny)
  - Tests: Move library initialization to setUpClass method (vtrefny)
  - Stop skipping FAT resize tests on rawhide (vtrefny)
  - Close filesystem before closing the partition during FAT resize (vtrefny)
  - Use mountpoint for "xfs_info" calls (vtrefny)
  - Use libmount cache when parsing /proc/mounts (vtrefny)
  - Add some space for the CI status (vpodzime)
  - Confirm the force when creating PVs in FS tests (vpodzime)
  - Skip vgremove tests on 32bit Debian (vtrefny)
  - Fix names of backing files in tests (vtrefny)
  -  Fix checking for available locales (vtrefny)
  - Skip dependency checking in mpath tests on Debian (vtrefny)
  - Skip zRAM tests on Debian (vtrefny)
  - Skip the test for device escrow on Debian too (vtrefny)
  - Skip free region tests on Debian too (vtrefny)
  - Fix redirecting command output to /dev/null in tests (vtrefny)
  - Try harder to unmount devices in test cleanup (vtrefny)
  - Require only plugins that are needed for given test (vtrefny)
  - Try to get distribution info from "PrettyName" if "CPEName" isn't available (vtrefny)
  - Use -ff when creating PVs in FS tests (vpodzime)
  - Sync spec with downstream (vpodzime)


author: Nikola Forró <nforro@redhat.com> - 0.41-12
changelog:
  - resolves: #1406927
    start cgred service after nss-user-lookup target
    show warnings about unsuccessful user/group lookups


author: Nikola Forró <nforro@redhat.com> - 0.41-17
changelog:
  - show warning when "tasks" file can not be opened
  - extend description of "controllers" section in cgrules.conf man page
    resolves: #1561736


author: Peter Robinson <pbrobinson@fedoraproject.org> 0.12.4-1
changelog:
  - Update to 0.12.4
  - http://ftp.gnome.org/pub/GNOME/sources/libchamplain/0.12/libchamplain-0.12.4.news


author: Petr Sabata <psabata@redhat.com> - 0.6.20-1
changelog:
  - 0.6.20 bump
  - Repackaging prehistoric libexif-docs, introducing version string in filename
  - Buildroot cleanup


author: Petr Šabata <contyk@redhat.com> - 0.6.21-1
changelog:
  - 0.6.21 bump
  - A security bugfixing release (CVE-2012-2812, CVE-2012-2813, CVE-2012-2814,
    CVE-2012-2836, CVE-2012-2837, CVE-2012-2840, CVE-2012-2841 & CVE-2012-2845)
  - Drop the pre-generated docs and introduce a doc subpackage


author: Debarshi Ray <rishi@fedoraproject.org> - 0.10.4-4
changelog:
  - Ensure that the new exiv2 soname is used during the build
  - Adapt to Exiv2::BasicIo API change
    Resolves: rhbz#1486570


author: Iryna Shcherbina <ishcherb@redhat.com> - 1:1.0.1-0.2.20180226gitb029c24
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Adam Jackson <ajax@redhat.com> - 1.0.1-0.6.git5baa1e5
changelog:
  - Enable %check for all but ppc64 and s390x, which has known but low-impact
    failures
  - Simplify %release


author: Till Maas <opensource@till.name> - 3.6.0-7
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Kalev Lember <klember@redhat.com> - 3.21.92-1
changelog:
  - Update to 3.21.92
  - Don't set group tags
  - Use make_install macro
  - Use license macro for COPYING
  - Use desktop-file-validate instead of desktop-file-install
  - Tighten -devel deps with the _isa macro


author: Christophe Fergeau <cfergeau@redhat.com> 0.3.1-2
changelog:
  - Requires a new enough librest as we use symbols not available in older
    librest
    Related: rhbz#1116844


author: Fabiano Fidêncio <fidencio@redhat.com> 0.3.3-2
changelog:
  - Fix crash when VM has several ISO domains
    Resolves: rhbz#1274356
  - Add OvirtProxy::sso-token support for oVirt 4.0
    Resolves: rhbz#1324457


author: Christophe Fergeau <cfergeau@redhat.com> - 0.3.3-3
changelog:
  - Add upstream patch fixing unwanted authentication dialog for foreign menu
    when using remote-viewer ovirt://
    Resolves: rhbz#1346256


author: Christophe Fergeau <cfergeau@redhat.com> - 0.3.3-4
changelog:
  - Add upstream patch forcing use of the older v3 REST API as we don't support
    yet the v4 API
    Resolves: rhbz#1346215


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 0.3.3-5
changelog:
  - New storage format added in oVirt 4.1
    Resolves: rhbz#1346215
  - Check if operation was cancelled before disconnecting signal
    Resolves: rhbz#1431275


author: Christophe Fergeau <cfergeau@redhat.com> - 0.3.4-1
changelog:
  - Rebase to latest 0.3.4 upstream release. Still quite a few patches as
    there was no 0.3.5 release yet
    Resolves: rhbz#1584266


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 0.3.4-2
changelog:
  - Parse XML nodes automatically
    Related: rhbz#1427467
  - Set detailed error message for async call
    Related: rhbz#1427467


author: Lukas Nykryn <lnykryn@redhat.com> - 219-72
changelog:
  - service: introduce protocol error type (#1733998)
  - service: fix main processes exit behavior for type notify services (#1733998)
  - service: go through stop_post on failure (#4770) (#1733998)
  - Call getgroups() to know size of supplementary groups array to allocate (#1743230256 KB)
  - udev: introduce CONST key name (#1748051)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.2
changelog:
  - core: when restarting services, don't close fds (#1803802)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1803802)
  - tests: add basic journal test (#1803802)
  - tests: add regression test for `systemctl restart systemd-journald` (#1803802)
  - tests: add test that journald keeps fds over termination by signal (#1803802)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-74
changelog:
  - sd-bus: bump message queue size again (#1770158)
  - unit: fix potential use of cgroup_path after free() when freeing unit (#1760149)
  - add test for ExecStopPost (#1733998)
  - core: when restarting services, don't close fds (#1757704)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1757704)
  - tests: add basic journal test (#1757704)
  - tests: add regression test for `systemctl restart systemd-journald` (#1757704)
  - tests: add test that journald keeps fds over termination by signal (#1757704)
  - nss-util: silence warning about deprecated RES_USE_INET6 (#1799002)
  - journal: do not trigger assertion when journal_file_close() get NULL (#1786046)
  - mount: don't propagate errors from mount_setup_unit() further up (#1804757)
  - mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1804757)
  - fix the fix for #1691511 (#1804757)
  - v3: Properly parsing SCSI Hyperv devices (#8509) (#1809053)
  - Consider smb3 as remote filesystem (#1811700)
  - mount: don't add Requires for tmp.mount (#1813270)
  - sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1769928)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1812889)
  - sd-journal: remove the dead code and actually fix #14695 (#1812889)
  - swap: adjust swap.c in a similar way to what we just did to mount.c (#1749621)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749621)
  - core: add a new unit file setting CollectMode= for tweaking the GC logic (#1817576)
  - run: add "-G" as shortcut for "--property=CollectMode=inactive-or-failed" (#1817576)
  - core: clarify that the CollectMode bus property is constant (#1817576)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1814028)
  - logind: check PolicyKit before allowing VT switch (#1797672)
  - timer: don't use persietent file timestamps from the future (#6823) (#1769923)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766477)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798503)
  - journal-remote: split-mode=host, remove port from journal filename (#1244691)
  - core: downgrade log message about inability to propagate cgroup release message (#1679934)
  - units: move Before deps for quota services to remote-fs.target (#5627) (#1693374)
  - set kptr_restrict=1 (#1689344)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
  - core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
  - core: coldplug possible nop_job (#1829754)
  - core: make sure to restore the control command id, too (#1828953)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.1
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793527)
  - device: don't emit PropetiesChanged needlessly (#1793527)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.2
changelog:
  - core: don't update unit description if it is already set to the same value (#1793527)
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1793527)
  - core: fix unnecessary fallback to the rescue mode caused by initrd-switch-root.service's exit status judgment error (#1825232)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.4
changelog:
  - test: add a test/reproducer for BZ#1989245 (#1989245)
  - strv: fix buffer size calculation in strv_join_quoted() (#1989245)
  - install: refactor find_symlinks() and don't search for symlinks recursively (#1828758)


author: Pino Toscano <ptoscano@redhat.com> - 1:1.38.2-12
changelog:
  - Rebase to libguestfs 1.38.2 in RHEL 7.6.
    resolves: rhbz#1551055
  - v2v: warn about unknown VMware controller types
    resolves: rhbz#1510801
  - df: show correct sizes in human-readable mode for filesystems with
    block size = 512
    resolves: rhbz#1525262
  - v2v: fix example URL in man page
    resolves: rhbz#1540535
  - Fix SELinux relabelling when the SELinux config has no SELINUXTYPE key
    resolves: rhbz#1541525
  - Fix qemu-img-ma dependency in non-x86_64 architectures
    resolves: rhbz#1568676
  - v2v: update "resume=/dev/sdaX" entries in GRUB command lines
    resolves: rhbz#1532224
  - v2v: fix virtio-rng and memballoon OVF fragment for RHV
    resolves: rhbz#1550168
  - v2v: detect whether the root filesystem was not mounted in read-write mode
    resolves: rhbz#1567763
  - v2v: import OVAs with snapshots
    resolves: rhbz#1570407
  - v2v: ship a newer version of rhev-apt.exe
    resolves: rhbz#1571237
  - Move the osinfo-db dependency to libguestfs-tools-c, since it's the only
    place where it used now (by virt-builder-repository).
  - v2v: new 'rhv-upload' method to stream images directly to oVirt/RHV using
    oVirt REST API
    resolves: rhbz#1557273
  - Start lvmetad earlier when booting the appliance
    resolves: rhbz#1581810
  - v2v: fix kernel detection in Ubuntu guests since 18.04
    resolves: rhbz#1591248
  - v2v: convert the CPU topology correctly
    resolves: rhbz#1541908
  - Add a new inspect_get_osinfo API, and add its result to the output of
    virt-inspector
    resolves: rhbz#1544842
  - Pass absolute paths to NBD sockets when using the libvirt backend
    resolves: rhbz#1588451
  - v2v: do not write only <vendor> without <model> in libvirt XMLs
    resolves: rhbz#1591789
  - v2v: depend on nbdkit, nbdkit-plugin-python2, and nbdkit-plugin-vddk,
    used for -it vddk, and -o rhv-upload
    resolves: rhbz#1589776
    resolves: rhbz#1608718
  - v2v/p2v: disable on aarch64, since it is not supported (nor even working)
    there
    resolves: rhbz#1601488
  - v2v: handle srN devices in libvirt XML (for virt-p2v)
    resolves: rhbz#1612785
  - Do not use the -cpu parameter under any circumstances for ppc64le.
    resolves: rhbz#1605071


author: Pino Toscano <ptoscano@redhat.com> - 1:1.38.2-12.el7_6.1
changelog:
  - v2v: update documentation regarding SHA-2 certificates in Windows 7 and
    Windows Server 2008 R2
    resolves: rhbz#1632788
  - v2v: fix rhev-apt firstboot command for Windows
    resolves: rhbz#1625216


author: Pino Toscano <ptoscano@redhat.com> - 1:1.40.2-5
changelog:
  - Rebase to libguestfs 1.40.2 in RHEL 7.7.
    resolves: rhbz#1621895
  - v2v: uninstall the VMware Tools correctly
    resolves: rhbz#1465849
    resolves: rhbz#1481930
  - v2v: fix VMware vCenter roles needed for conversion
    resolves: rhbz#1530967
  - v2v: preserve the VM Generation ID
    resolves: rhbz#1598350
  - Query QEMU to known whether KVM is supported
    resolves: rhbz#1605071
  - v2v: add --mac option
    resolves: rhbz#1607274
  - v2v: install ovirt-guest-agent-common on Linux guests migrated to RHV
    resolves: rhbz#1619665
    resolves: rhbz#1691659
  - v2v: provide a way to query for the estimated size of the disks
    resolves: rhbz#1622785
  - Correctly inspect the newer versions of openSUSE (15, Factory, Thumbleweed)
    resolves: rhbz#1634248
  - p2v: add an option to Shutdown the machine after the conversion
    resolves: rhbz#1642044
  - v2v: fix epoch when querying installed RPM packages
    resolves: rhbz#1669395
  - Use a better icon for RHEL >= 7 guests
    resolves: rhbz#1679482
  - v2v: improve the architecture detection of Linux kernel modules
    resolves: rhbz#1690574
  - v2v: ship a newer version of rhev-apt.exe
    resolves: rhbz#1688155
  - v2v: update nbdkit information in documentation
    resolves: rhbz#1605242
  - v2v: warn when a guest has 'direct' network interfaces
    resolves: rhbz#1151902
  - v2v: use proper SELinux label for nbdkit sockets
    resolves: rhbz#1698437


author: Pino Toscano <ptoscano@redhat.com> - 1:1.40.2-5.el7_7.1
changelog:
  - v2v: fix a couple of Python 2 porting issues in the nbdkit Python script
    for 'rhv-upload'
    resolves: rhbz#1726168


author: Pino Toscano <ptoscano@redhat.com> - 1:1.40.2-7
changelog:
  - v2v: -o rhv-upload: improve wait logic after finalize
    resolves: rhbz#1680361
  - v2v: fix DISKTYPE value in generated .ovf files
    resolves: rhbz#1750719


author: Richard W.M. Jones <rjones@redhat.com> - 7.0-2
changelog:
  - Resync against Rawhide package (ntfs-3g 2013.1.13).
  - Drop HAL file since HAL is dead.
    resolves: rhbz#819939


author: Richard W.M. Jones <rjones@redhat.com> - 7.1-2
changelog:
  - New package for RHEL 7.1
  - Rebase to ntfs-3g 2014.2.15
    resolves: rhbz#1100319
  - Change the package so it works with supermin5.
  - Remove dependency on external FUSE.


author: Richard W.M. Jones <rjones@redhat.com> - 7.2-2
changelog:
  - Fix for handling guest filenames with invalid or incomplete
    multibyte or wide characters
    resolves: rhbz#1301593


author: Richard W.M. Jones <rjones@redhat.com> - 7.2-3
changelog:
  - Fix for CVE-2019-9755
    (heap-based buffer overflow leads to local root privilege escalation)
    resolves: rhbz#1698502


author: Marek Kasik <mkasik@redhat.com> - 0.2.4-1
changelog:
  - Update to 0.2.4
  - Backport several important patches from current master
  - Revert addition of GXPSImage (it would change ABI)
  - Resolves: #1384959


author: Marek Kasik <mkasik@redhat.com> - 0.2.5-1
changelog:
  - Update to newly released 0.2.5
  - Preserve ABI by exporting the same set of methods as before
  - Resolves: #1384959


author: Marek Kasik <mkasik@redhat.com> - 0.3.0-2
changelog:
  - Ensure gxps_archive_read_entry() fills the GError in case of failure
  - Handle errors returned by archive_read_data()
  - Resolves: #1574844


author: Peter Hutterer <peter.hutterer@redhat.com> 1.6.3-3
changelog:
  - Fix touchpad tap timestamps (#1491525)
  - Fix missing show-keycodes entry in man page (#1491532)
  - Change palm detection thresholds (#1491537)
  - Ignore tap motion threshold for nfingers > nslots (#1491533)
  - Fix a memory leak on destroy
  - Ignore hovering touches while tapping
  - Fix a man page typo


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.1
changelog:
  - Resolves: rhbz#1854317 - sssd crashes after last update to sssd-common-1.16.4-37.el7_8.1 with servers configured with multiple domains [rhel-7.9.z]
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.2
changelog:
  - Resolves: rhbz#1854317 - sssd crashes after last update to sssd-common-1.16.4-37.el7_8.1 with servers configured with multiple domains [rhel-7.9.z]
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
  - just bumping the version to build for proper target


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.3
changelog:
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
    (Previous attempt to fix this issue was incomplete)


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.4
changelog:
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
    (Previous attempt to fix this issue was incomplete (again))


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.5
changelog:
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
    (Previous attempt to fix this issue was incomplete (again))
  - just bumping the version to build for proper target


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.6
changelog:
  - Resolves: rhbz#1899593 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr() [rhel-7.9.z]
  - Resolves: rhbz#1888409 - sssd component logging is now too generic in syslog/journal [rhel-7.9.z]
  - Resolves: rhbz#1852659 - sssd service is starting even though it is disabled state [rhel-7.9.z]
  - Resolves: rhbz#1893443 - User lookups over the InfoPipe responder fail intermittently [rhel-7.9.z]
  - Resolves: rhbz#1871288 - krb5_child denies ssh users when pki device detected [rhel-7.9.z]
  - Resolves: rhbz#1853703 - Unexpected behavior and issue with filter_users/filter_groups option [rhel-7.9.z]
  - Resolves: rhbz#1756240 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains [rhel-7.9.z]
  - Resolves: rhbz#1851112 - LDAP bind can fail due to unconfigurable DNS server timeouts that inhibit SSSD failover [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.7
changelog:
  - Resolves: rhbz#1875514 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [rhel-7.9.z]
  - Resolves: rhbz#1772513 - SSSD is generating lot of LDAP queries in a very large environment [rhel-7.9.z]
  - Resolves: rhbz#1736845 - [RFE] Backporting certificate matching rules for files, AD and LDAP provider [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.8
changelog:
  - Resolves: rhbz#1910131 - sssd throwing error " Unable to parse name test' [1432158283]: The internal name format cannot be parsed" at debug_level 2 [rhel-7.9.z]
  - Resolves: rhbz#1922244 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0. [rhel-7.9.z]
  - Resolves: rhbz#1935685 - SSSD not detecting subdomain from AD forest (7.9z)
  - Resolves: rhbz#1945552 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-7.9.z]
  - Resolves: rhbz#1839972 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.9
changelog:
  - Resolves: rhbz#1988463 - Missing search index for `originalADgidNumber` [rhel-7.9.z]
  - Resolves: rhbz#1968330 - id lookup is failing intermittently
  - Resolves: rhbz#1964415 - Memory leak in the simple access provider
  - Resolves: rhbz#1985457 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.11
changelog:
  - Resolves: rhbz#1968316 - SSSD: User authentication failing after server reboot.
  - Resolves: rhbz#2000238 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#1984591 - After sssd update to 1.16.5-10.el7_9.8.x86_64 the customer is facing slow connection/authentication (due to discovery of unexpected AD domains)


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.12
changelog:
  - Resolves: rhbz#2006382 - IPA Intermittence fetching groups
  - Resolves: rhbz#2006866 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2031729 - IPA clients fail to resolve override group names.
  - Resolves: rhbz#2032867 - AD Domain in the AD Forest Missing after sssd latest update


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.13
changelog:
  - Resolves: rhbz#2079441 - SSSD update prompts for smartcard pin twice - After update to 7.9 [rhel-7.9.z]
  - Resolves: rhbz#2073352 - Use right sdap_domain in ad_domain_info_send [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.14
changelog:
  - Resolves: rhbz#2097014 - SSSD -> sssd_be and sssd_ifp coredump [rhel-7.9.z]
  - Resolves: rhbz#2107380 - sssd timezone issues sudonotafter [rhel-7.9.z]
  - Resolves: rhbz#2116207 - SSSD starting offline after reboot [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.15
changelog:
  - Resolves: rhbz#2149703 - smartcards: special characters must be escaped when building search filter [rhel-7.9.z]
  - Resolves: rhbz#2149902 - EMBARGOED CVE-2022-4254 sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters [rhel-7.9.z]


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> 1.16.5-10.16
changelog:
  - Resolves: RHEL-16003 - sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy [rhel-7.9.z]


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-6
changelog:
  - Resolves: rhbz#1819013 - pam_sss reports PAM_CRED_ERR when providing wrong password for an existing IPA user, but this error's description is misleading
  - Resolves: rhbz#1800571 - Multiples Kerberos ticket on RHEL 7.7 after lock and unlock screen


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-7
changelog:
  - Resolves: rhbz#1835813 - sssd boots offline if symlink for /etc/resolv.conf is broken/missing
  - Resolves: rhbz#1837545 - Users must be informed better when internal WATCHDOG terminates process.


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-8
changelog:
  - Resolves: rhbz#1553784 - Document how to prevent invalid selinux context for default home directories in SSSD-AD direct integration.
  - Resolves: rhbz#1836910 - Rhel7.7 server have an issue regarding dyndns update for PTR-records which is done by sssd on active directory DNS servers.
                             It is done in two steps (two different nsupdate messages).


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-10
changelog:
  - Resolves: rhbz#1804005 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1773409 - sssd is failing to discover other subdomains in the forest if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1551077 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1507683 - GDM password prompt when cert mapped to multiple users and promptusername is False


author: Nikola Forró <nforro@redhat.com> - 1.2.90-7
changelog:
  - Fix CVE-2018-11212 (#1586062)
  - Fix CVE-2016-3616 (#1318509), CVE-2018-11213 (#1589091)
    and CVE-2018-11214 (#1589110)
  - Fix CVE-2018-11813 (#1591203)


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-0.4.alpha
changelog:
  - Avoid 'test/md5.c:126:3: warning: dereferencing type-punned pointer
    will break strict-aliasing rules' by adding -fno-strict-aliasing flag.


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-0.6.alpha
changelog:
  - Fixes for CVE-2018-14679 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682
  - resolves: rhbz#1611550 rhbz#1611551 rhbz#1611552 rhbz#1611553


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.1.0-3
changelog:
  - Resolves: rhbz#1712458 - [machines] The function of 'Auto-detect guest
                             operating system' is not available on rhel 7.7


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.1.0-4
changelog:
  - Resolves: rhbz#1727842 - CVE-2019-13313 libosinfo: osinfo-install-script
                             option leaks password via command line argument


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-4
changelog:
  - disable TPACKET_V3 memory mapped packet capture on AF_PACKET socket, use TPACKET_V2 instead (#1085096)


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-5
changelog:
  - display also first packet when capturing in cooked mode (#1176612)
  - make sure that userland bpf filter interpreter is given snaplen such that size of
    cooked header is account for


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-6
changelog:
  - libpcap now correctly recognizes Netlink datalink type (#1031974)
  - fix vlan tagged packet filtering (#1079525)


author: Tom Lane <tgl@redhat.com> 2:1.5.10-3
changelog:
  - Remove compat subpackage (it's now a separate package "libpng12")
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: Tom Lane <tgl@redhat.com> 2:1.5.12-1
changelog:
  - Update to libpng 1.5.12 for minor bug fixes
  - Activate chunk size limits by default, with a very generous default limit


author: Petr Hracek <phracek@redhat.com> - 2:1.5.13-7
changelog:
  - Security fix for CVE-2015-8126
  - Changing png_ptr to info_ptr base on upstream
  - Related: #1283575


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-2
changelog:
  Detect IPC Shared memory corruption in peek as well as read. Prevents
    the mainloop from spinning if multithreaded IPC (which is currently 
    not supported) is attempted without locking.
    Resolves: rhbz#1422454


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-3
changelog:
  Allow IPC system to use filesystem sockets instead of abstract
    sockets if a configuration file exists.
    Resolves: rhbz#1446254


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-4
changelog:
  Revert git patch 189ca28 which caused problems with pacemaker CIB
    closing down.
    Resolves: rhbz#1459276


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-5
changelog:
  Put backpatch 189ca28 as it's not the culprit
    
    Don't truncate IPC files in the client as it can cause servers to crash.
    I've also had to (for this release) disable one of the tests as it checks
    for truncated files.
    Resolves: rhbz#1459276


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-7
changelog:
  Prevent crashes when client truncates SHM segment
    I've reverted the patch for 1459276 which is no longer needed as this
    is a proper fix.
    Resolves: rhbz#1473695


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.12-1
changelog:
  - downloader: Allow max one resume + nicer message if xattr cannot be set (RhBug: 1130685)
  - downloader: Resume only files that were originaly downloaded by Librepo (RhBug: 1130685)
  - downloader: Show also calculated checksums in error message about bad checksum
  - Python: Return all strings in unicode


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.13-1
changelog:
  - Fix ABI compatibility (RhBug: 1185180)
  - fastestmirror: Add LRO_FASTESTMIRRORTIMEOUT option
  - downloader: Move broken mirror at the end of the list of mirrors (RhBug: 1183998)
  - Make building tests and docs optional
  - librepo: Don't download remote mirrorlist/metalink when LRO_LOCAL is specified (Resolves #41)


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.14-1
changelog:
  - tests: Use g_assert_cmpuint instead of ck_assert_uint_eq (Pullrequest #43)
  - Add LRO_OFFLINE
  - Python: Handle: Raise ValueError instead of TypeError when an unknown option is specified
  - Python: Result: Use ValueError instead of TypeError when an unknown option value is specified
  - Add LR_VERSION constant with version string
  - python: Import contants from C librepo module in a loop
  - repoconf: Add support for failover and skip_if_unavailable options
  - handle: Change of LRO_LOCAL causes invalidation of internal mirrorlist (related to RhBug: 1188600)
  - Load local mirrorlists when LRO_LOCAL is on (related to RhBug: 1188600)
  - util: Add lr_is_local_path()
  - New module repoconf for reading *.repo files
  - Add LRO_HTTPHEADER option (RhBug: 1181123)


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.15-1
changelog:
  - Do not inlude header in the body output (RhBug: 1207685)
  - metalink: Proper error handling
  - New LRR_RPMMD_* contants
  - Support for client certificates
  - Use 'metadata in the rpm-md format' instead of 'yum metadata' (Issue #51)
  - CMakeLists.txt: do not check for CXX
  - build: Use solely pkg-config to find glib


author: Colin Walters <tmlcoch@redhat.com> - 1.7.16-1
changelog:
  - Add LRI_LOWSPEEDTIME and LRI_LOWSPEEDLIMIT
  - downloader: Don't consider CURLE_RECV_ERROR and CURLE_SEND_ERROR as fatal errors (RhBug: 1219817)
  - test_repoconf: Fix SIGSEGV in repoconf_assert_na (RhBug: 1222471)
  - repoconf: Proper handling of gint64 and guint64 types
  - build: Be compatible with cmake 2.8
  - handle: Do not free temporary error msg if there is no one (RhBug: 1219822)
  - utils/make_rpm.sh: Accept rpmbuild options as second argument (Issue #49)
  - Python: call lr_global_init() during module initialization
  - Add global function log_set_file that allow user to set a file where logs will be written (Issue #53)
  - util: Honor RFC 3986 (Issue #55)


author: Marek Blaha <mblaha@redhat.com> - 1.8.1-1
changelog:
  - Add yumrecord substitution mechanism (mluscon)
  - Fix a memory leak in signature verification (cwalters)
  - Add new option LRO_FTPUSEEPSV
  - downloader prepare_next_transfer(): simplify long line
  - downloader prepare_next_transfer(): add missing error check
  - downloader prepare_next_transfer(): cleanup error path
  - downloader prepare_next_transfer() - fix memory leak on error path (Alan Jenkins)
  - handle: Don't use proxy cache for downloads of metalink/mirrorlist
  - handle: Don't set CURLOPT_HTTPHEADER into curl handle immediately when specified
  - downloader: Implement logic for no_cache param in LrDownloadTarget (RhBug: 1297762)
  - Add no_cache param to LrDownloadTarget and lr_downloadtarget_new()
  - New test: always try to download from the fastest mirror (Alexander Todorov)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Patch: 9993-anaconda-not-tuv-report.patch
  -->  Don't try and open any support cases in anaconda
  - Added Source: libreport-SPEC_dont-use-rh-support.patch
  -->  Don't require rh support resources
  - Added Patch: 9991-Don-t-use-upstream-bugzilla-by-default.patch
  -->  Don't use upstream bugzilla by default
  - Added Patch: 9992-Don-t-try-and-open-any-support-cases-upstream.patch
  -->  Don't try and open any support cases upstream
  - Added Source: libreport.ini
  -->  Config file for automated patch script


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-36
changelog:
  - introduce 'stop_on_not_reportable' option
  - fix a double free of config at exit in reporter-rhtsupport
  - Related: #1373094, #1257159


author: Martin Kutlak <mkutlak@redhat.com> - 2.1.11-39
changelog:
  - Introduce workflow for adding data to existing case
  - Change default URL to the FAF server
  - wizard: fix 'Show log' window not displaying correctly
  - augeas: fix parsing spaces in configuration files
  - Related: #1303326, #1435256, #1463313


author: Martin Kutlak <mkutlak@redhat.com> - 2.1.11-43
changelog:
  - dd: extend the scope of DD_DONT_WAIT_FOR_LOCK
  - dd: log lock warning only once not x times per sec
  - dd: add functions for opening dd item
  - testsuite: Add macros for value comparison
  - testsuite: assert for common function results
  - testsuite: expose the last check result
  - testsuite: fix dd_open_item_file test
  - tests: include testsuite.h in the dist archive
  - spec: include testsuite headers in the devel package
  - Related: #1588272, #1613236


author: Paul Wouters <pwouters@redhat.com> - 3.23-2
changelog:
  - Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
  - Resolves: rhbz#1375750 SECCOMP support for libreswan [updated]


author: Paul Wouters <pwouters@redhat.com> - 3.23-4
changelog:
  - Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
  - Resolves: rhbz#1553406 IKEv2 liveness false positive on IKEv2 idle connections causes tunnel to be restarted
  - Resolves: rhbz#1572425 shared IKE SA leads to rekey interop issues


author: Paul Wouters <pwouters@redhat.com> - 3.25-1
changelog:
  - Resolves: rhbz#1591817 rebase libreswan to 3.25
  - Resolves: rhbz#1536404 CERT_PKCS7_WRAPPED_X509 error
  - Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
  - Resolves: rhbz#1574011 libreswan is missing a Requires: unbound-libs >= 1.6.6


author: Paul Wouters <pwouters@redhat.com> - 3.25-2
changelog:
  - Resolves: rhbz#1597322 Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors


author: Paul Wouters <pwouters@redhat.com> - 3.25-5
changelog:
  - Resolves: rhbz#1639404 Unable to verify certificate with non-empty Extended Key Usage which does not include serverAuth or clientAuth
  - Resolves: rhbz#1630355 Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N
  - Resolves: rhbz#1629902 libreswan assertion failed when OAKLEY_KEY_LENGTH is zero for IKE using AES_CBC
  - Resolves: rhbz#1623279 [abrt] [faf] libreswan: strncpy(): /usr/libexec/ipsec/pluto killed by 11
  - Resolves: rhbz#1625303 config: recursive include check doesn't work
  - Resolves: rhbz#1664521 libreswan 3.25 in FIPS mode is incorrectly rejecting X.509 public keys that are >= 3072 bits


author: Paul Wouters <pwouters@redhat.com> - 3.25-6
changelog:
  - Resolves: rhbz#1630355 Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N [updated]
  - Resolves: rhbz#1679735 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure


author: Paul Wouters <pwouters@redhat.com> - 3.25-7
changelog:
  - Resolves: rhbz#1673105 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart


author: Paul Wouters <pwouters@redhat.com> - 3.25-8
changelog:
  - Resolves: rhbz#1686991 IKEv1 traffic interruption when responder deletes SAs 60 seconds before EVENT_SA_REPLACE


author: Paul Wouters <pwouters@redhat.com> - 3.25-8.1
changelog:
  - Resolves: rhbz#1746052 libreswan: XFRM policy for OE/32 peer is deleted when shunts for previous half-open state expire [rhel-7.7.z]


author: Paul Wouters <pwouters@redhat.com> - 3.25-9
changelog:
  - Resolves: rhbz#1724200 libreswan: XFRM policy for OE/32 peer is deleted when shunts for previous half-open state expire


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-10
changelog:
  - Add missing av_permission values (#1025931)
  - Set an appropriate errno in booleans.c (#1402140)
  - Change matchpathcon usage to match with matchpathcon manpage (#1412797)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-8
changelog:
  - Save linked policy, skip re-link when possible
  - Replace access(,F_OK) checks to make setuid programs work (#1186431)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-9
changelog:
  - Update semanage to allow runtime labeling of Infiniband Pkeys (#1466274)
  - Update semanage to allow runtime labeling of ibendports (#1466274)
  - Keep copy of file_contexts.homedirs in policy store (#1409813)
  - Add support for listing fcontext.homedirs file (#1409813)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-12
changelog:
  - Do not change file mode of seusers and users_extra (#1512639)
  - Improve warning for installing disabled module (#1337199)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-14
changelog:
  - Include user name in ROLE_REMOVE audit events (#1622045)
  - Improve "reset umask before creating directories"


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Correctly detect unknown classes in sepol_string_to_security_class
  - Sort object files for deterministic linking order
  - Fix neverallowxperm checking on attributes
  - Remove libsepol.map when cleaning
  - Add high-level language line marking support to CIL
  - Change logic of bounds checking to match change in kernel
  - Fix multiple spelling errors
  - Only apply bounds checking to source types in rules
  - Fix CIL and not add an attribute as a type in the attr_type_map
  - Build policy on systems not supporting DCCP protocol
  - Fix extended permissions neverallow checking
  - Fix CIL neverallow and bounds checking
  - Android.mk: Add -D_GNU_SOURCE to common_cflags


author: Petr Lautrbach <plautrba@redhat.com> 2.5-5
changelog:
  - Warn instead of fail if permission is not resolved
  - Ignore object_r when adding userrole mappings to policydb


author: Petr Lautrbach <plautrba@redhat.com> 2.5-6
changelog:
  - Fix memory leak in expand.c
  - Fix invalid read when policy file is corrupt
  - Fix possible use of uninitialized variables


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-7
changelog:
  - Define cgroup_seclabel policy capability (rhbz#1493517)
  - Fix unitialized jmp and invalid dereference


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-8.1
changelog:
  - Define nnp_nosuid_transition policy capability (rhbz#1480519)
  - use IN6ADDR_ANY_INIT to initialize IPv6 addresses
  - Allow runtime labeling of ibendports (rhbz#1464489)
  - Allow runtime labeling of Infiniband Pkeys (rhbz#1464489)
  - Add IB end port handling to CIL (rhbz#1464489)
  - Add ibendport ocontext handling (rhbz#1464489)
  - Add support for ibendportcon labels (rhbz#1464489)
  - Add Infiniband Pkey handling to CIL (rhbz#1464489)
  - Add ibpkey ocontext handling (rhbz#1464489)
  - Add support for ibpkeycon labels (rhbz#1464489)
  - Remove unused attribute on a used argument from avrule_read() (rhbz#1464489)
  - Add binary module support for xperms
  - Add support for converting extended permissions to CIL


author: Peter Jones <pjones@redhat.com> - 2.3.3-6
changelog:
  - Pull in all the coverity fixes we sent upstream.  I had thought these
    made it in to this release; they did not, but the 2.4.0 release they are
    in is also the python 3 switchover, so we need these as patches.
    Related: rhbz#1463329


author: Peter Jones <pjones@redhat.com> - 2.3.3-8
changelog:
  - Fix smbios-sys-info-lite crashes when an asset tag is not set
    Resolves: rhbz#1562440
  - Fix vestigial c++ artifacts included in the package
    Resolves: rhbz#1562440


author: Ville Skyttä <ville.skytta@iki.fi> - 1.0.25-2
changelog:
  - Patch to use system libgsm instead of a bundled copy.
  - Make main package dep in -devel ISA qualified.
  - Drop -octave Provides (not actually built with octave > 3.0).
  - Don't build throwaway static lib.
  - Run test suite during build.


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.25-12.1
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985024)


author: Jaroslav Mracek <jmracek@redhat.com> - 0.6.34-3
changelog:
  - Make sure that targeted updates don't do reinstalls
  - Resolves: bug#1668256
  - Fix NULL pointer dereference (CVE-2018-20532, CVE-2018-20533)
  - Resolves: bug#1669562
  - Resolves: bug#1669576
  - Fix illegal address access in pool_whatprovides (CVE-2018-20534)
  - Resolves: bug#1670453


author: Milan Crha <mcrha@redhat.com> - 2.62.2-2
changelog:
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c: get_cookies() on empty hostnames
  - Resolves: #1598838


author: Jan Grulich <jgrulich@redhat.com> - 1.4.4-11.20101004cvs
changelog:
  - Fix global buffer overflow
    Resolves: bz#1301202

  - Fix improper handling of CSRC count and extension header length in RTP header
    Resolves: bz#1323705

  - Fix buffer overflow in application of crypto profiles
    Resolves: bz#1141897


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-9
changelog:
  - curl consumes too much memory during scp download (#1080459)
  - prevent a not-connected agent from closing STDIN (#1147717)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-12
changelog:
  - session: avoid printing misleading debug messages (#1503294)
  - scp: send valid commands for remote execution (#1489733)


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-2
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)
  - fix out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
  - fix zero-byte allocation in SFTP packet processing resulting in out-of-bounds read (CVE-2019-3858)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Tony Asleson <tasleson@redhat.com> - 1.8.1-2
changelog:
  - https://bugzilla.redhat.com/show_bug.cgi?id=1872745
  - https://bugzilla.redhat.com/show_bug.cgi?id=1903665


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.8-1
changelog:
  - Rebase to libtalloc 2.1.8
  - Resolves: rhbz#1393811 - Rebase libtalloc to enable samba rebase to
                             version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.9-1
changelog:
  - Rebase to libtalloc 2.1.9
  - Resolves: rhbz#1393811 - Rebase libtalloc to enable samba rebase to
                             version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.10-1
changelog:
  - Rebase to libtalloc 2.1.10
  - Resolves: rhbz#1470053 - Rebase libtalloc to enable samba rebase to
                             version 4.7.x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.6-2
changelog:
  - Resolves: rhbz#1241015 - tdb deadlocks if you acquire allrecord_lock
                             and start two traverses


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.12-2
changelog:
  - Resolves: rhbz#1441231 - The tdb robust mutexes runtime check is not thread safe and ends in a deadlock


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.15-1
changelog:
  - Resolves: rhbz#1470049 - Rebase libtdb to enable samba rebase to
                             version 4.7.x


author: Marcelo Ricardo Leitner <mleitner@redhat.com> - 1.25-2
changelog:
  - Updated to 1.25 [1286840 1286063]
  - Added patch teamd-LACP-runner-does-not-set-Agg-bit-on-first-slav.patch [1347818]


