# changelog

author: Colin Walters <walters@verbum.org> - 2022.10.86.gd8f0c67a-3
changelog:
  - Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
    https://github.com/coreos/rpm-ostree/commit/d8f0c67a0eba32281c9f2782a286e06486a4b909
    Resolves: rhbz#2105414


author: Colin Walters <walters@verbum.org> - 2022.10.90.g4abaf4b4-4
changelog:
  - Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
    https://github.com/coreos/rpm-ostree/commit/4abaf4b4
    Resolves: rhbz#2118774


author: Colin Walters <walters@verbum.org> - 2022.10.94.g89f58028-2
changelog:
  - Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
    https://github.com/coreos/rpm-ostree/commit/89f58028f0bea5b6fa59bdb3506078e09957ec00
  - Resolves: rhbz#2122289
  - Resolves: rhbz#2122299


author: Colin Walters <walters@verbum.org> - 2022.10.97.gade6df33-2
changelog:
  - Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
    https://github.com/coreos/rpm-ostree/commit/ac182cb920f84946bb155e9cf061db7f5f26e917
  - Resolves: rhbz#2122289


author: Colin Walters <walters@verbum.org> - 2022.10.112.g3d0ac35b-3
changelog:
  - Cherry pick
    https://github.com/coreos/rpm-ostree/pull/4311/commits/a0f1275dfbd835b704355d095e610ac1f1254f25
    Resolves: rhbz#2170579


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2022.10.117.g52714b51-2
changelog:
  - Backport fb97c48f3 & eae7e1d8
    https://github.com/coreos/rpm-ostree/commit/fb97c48f3cd070c1ad559f3f43f86ad6548f6b02
    https://github.com/coreos/rpm-ostree/commit/eae7e1d8d692b5ce6d3d6eef29abbd7512ae4682
    Resolves: rhbz#2229804


author: Colin Walters <walters@verbum.org> - 2022.10.90.g4abaf4b4-5
changelog:
  - Backport
    https://github.com/coreos/rpm-ostree/commit/0049dbdd91cc0c1900132374645c5114063db04d
    Resolves: rhbz#2137905


author: Joseph Marrero <jmarrero@redhat.com> - 2022.10.90.g4abaf4b4-6
changelog:
  - Backport
    https://github.com/coreos/rpm-ostree/commit/9dc5dcd0594d122172493695e31b0c63e7ea2e74
    Resolves: rhbz#2167476


author: Thomas Woerner <twoerner@redhat.com> - 8.10-7
changelog:
  - removed fakeroot requirement and all qa_robot scripts (RHBZ#1615605)
  - Fixed missing build requires for python3-devel


author: Michal Domonkos <mdomonko@redhat.com> - 8.10-8
changelog:
  - spectool: ignore query string in URL (RHBZ#1826299)
  - Fix TypeError in rpmdev-rmdevelrpms and rpmdev-checksig (RHBZ#1851499)


author: Todd Zullinger <tmz@pobox.com> - 1.10-9
changelog:
  - Update UsrLibBinaryException config to include .build-id
  - Ignore useless-provides on debuginfo provides (bz1489096)


author: Thomas Woerner <twoerner@redhat.com> - 1.10.13.1
changelog:
  - Fix unit test: use platform-python, py.test-3, no flake8 (RHBZ#1576803)
  - Update of ValidShells (RHBZ#1633698)
  - Remove Python2 paths from TagsCheck.py (RHBZ#1633698)
  - Enable bash-competion scripts (RHBZ#1577890)


author: Tom Callaway <spot@fedoraproject.org> - 1.10-4
changelog:
  - fix SSL_CTX_set_cipher_list waiver
  - use raw strings in config file to silence python3 deprecation warnings


author: Liming Sun <lsun@mellanox.com> - 2.0.1-1
changelog:
  - Rename bfrshim to rshim
  - Remove rshim.spec since it's auto-generated from rshim.spec.in
  - Fix warnings reported by coverity
  - Add rhel/rshim.spec.in for fedora
  - Move rshim to sbin and move man page to man8


author: Liming Sun <lsun@mellanox.com> - 2.0.2-1
changelog:
  - Remove unnecessary dependency in .spec and use make_build
  - Add package build for debian/ubuntu
  - Fix some format in the man page
  - Add check for syslog headers


author: Liming Sun <lsun@mellanox.com> - 2.0.3-1
changelog:
  - Enable pci device during probing
  - Map the pci resource0 file instead of /dev/mem
  - Add copyright header in bootstrap.sh
  - Add 'Requires' tag check in the rpm .spec for kernel-modules-extra
  - Fix the 'rshim --version' output


author: Liming Sun <lsun@mellanox.com> - 2.0.4-1
changelog:
  - Update .spec file according to review comments
  - Fix the 'KillMode' in rshim.service
  - Support process termination by SIGTERM
  - Fix some compiling warnings and configure issue for FreeBSD
  - Fix a read()/write() issue in rshim_pcie.c caused by optimization


author: Dean Nelson <dnelson@redhat.com> - 2.0.4-4
changelog:
  - Expose gating.yaml file in order to enable manual CI gating for rshim
    in RHEL-8.4, by bumping release and doing a Brew build.
  - Partially resolves: rhbz#1912248


author: Dean Nelson <dnelson@redhat.com> - 2.0.5-1
changelog:
  - Update user-space rshim driver source to version 2.0.5.
  - Modify rshim.spec accordingly.
  - Resolves: rhbz#1950425


author: Dean Nelson <dnelson@redhat.com> - 2.0.5-2
changelog:
  - Add sysconfig/rshim file and update rshim.service to source it.
  - jbastian made the first cut of this patch, which needed to be
    modified due to the update to 2.0.5. And I chose to go with
    %autosetup to handle Patch0, instead of sticking with %setup.
  - Resolves: rhbz#1946349


author: Dean Nelson <dnelson@redhat.com> - 2.0.8-1
changelog:
  - Update user-space rshim driver source to version 2.0.8
  - Modify rshim.spec accordingly
  - Resolves: rhbz#2196852


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-10
changelog:
  RHEL 8.1.0 ERRATUM
  - added option for imfile endmsg.regex
    resolves: rhbz#1627941
  - added patch enhancing imfile rotation detection
    resolves: rhbz#1674471
  - added patch fixing msgOffset datatype preventing crash on
    message with too long other fields
    resolves: rhbz#1677037
  - added patch introducing "preservecase" option for imudp/imtcp
    resolves: rhbz#1614181


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-11
changelog:
  RHEL 8.1.0 ERRATUM
  - fixed memory leak in imjournal by proper cursor releasing
    resolves: rhbz#1716867


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-12
changelog:
  RHEL 8.1.0 ERRATUM
  - edited imjournal memleak patch to not cause double-free crash
    resolves: rhbz#1729995
  - added patch calling journald API only when there are no
    preceeding errors
    resolves: rhbz#1722165
  - added patch fixing imrelp module when invoked with old syntax
    resolves: rhbz#1724218


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-13
changelog:
  RHEL 8.1.0 ERRATUM
  - added patch enabling stricter TLS certs checking conforming to 
    common criteria requirements
    resolves: rhbz#1733244


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-1
changelog:
  RHEL 8.2.0 ERRATUM
  - rebased to 8.1911.0 upstream version, removed, previously
    upstreamed patches
    resolves: rhbz#1740683
    resolves: rhbz#1659383
    resolves: rhbz#1746876
    resolves: rhbz#1676559
    resolves: rhbz#1692072
    resolves: rhbz#1692073
    resolves: rhbz#1692074
    resolves: rhbz#1699242
    resolves: rhbz#1738213
    resolves: rhbz#1744691
    resolves: rhbz#1755218
    resolves: rhbz#1768321
    resolves: rhbz#1768324
  - added patch fixing imfile stefiles naming
    resolves: rhbz#1763757


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-3
changelog:
  RHEL 8.2.0 ERRATUM
  - added patch reverting rejecting expired certs by default
    resolves: rhbz#1782353
  - added patch silencing false errors on config.enabled statement
    resolves: rhbz#1659383


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-5
changelog:
  RHEL 8.3.0 ERRATUM
  - added qpid-proton as another source and enabled omamqp1 module
    in a separate sub-package with it statically linked
    resolves: rhbz#1713427
  - extended config.enabled patch to cover rest of the cases 
    resolves: rhbz#1659383
  - added patch making json serialization thread-safe
    resolves: rhbz#1789675
  - added another patch for imfile state-files id
    resolves: rhbz#1793569
  - fixed typo in commend-out part of default rsyslog.conf


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-6
changelog:
  RHEL 8.3.0 ERRATUM
  - added patch preventing imfile crash when selinux blocks symlink
    access
    resolves: rhbz#1843994
  - fixed config-enabled patch
    resolves: rhbz#1659383


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-13
changelog:
  RHEL 8.1.0 ERRATUM
  - added patch enabling stricter TLS certs checking conforming to
    common criteria requirements
    resolves: rhbz#1733244


author: Jiri Vymazal <jvymazal@redhat.com> - 8.1911.0-5
changelog:
  RHEL 8.3.0 ERRATUM
  - added qpid-proton as another source and enabled omamqp1 module
    in a separate sub-package with it statically linked
    resolves: rhbz#1713427
  - extended config.enabled patch to cover rest of the cases
    resolves: rhbz#1659383
  - added patch making json serialization thread-safe
    resolves: rhbz#1789675
  - added another patch for imfile state-files id
    resolves: rhbz#1793569
  - fixed typo in commend-out part of default rsyslog.conf


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-2
changelog:
  RHEL 8.5.0 ERRATUM
  - rebase to 8.2102.0
    resolves: rhbz#1932795
  - Enable openssl
    resolves: rhbz#1891458
  - EKU check for client cert on server side
    resolves: rhbz#1783348
  - Use GNUTLS_SHUT_WR when ending TLS connections
    resolves: rhbz#1880434
  - Use librelp with openssl enabled
    resolves: rhbz#1795607
  - Close dir when fsync=on
    resolves: rhbz#1960536


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-3
changelog:
  - Priority field must have valid length
    resolves: rhbz#1866877
  - Allocate more memory on too large groups
    resolves: rhbz#1944718


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-5
changelog:
  - Do not exit when user/group can not be found
    resolves: rhbz#1984489
  - Remove abortOnIDResolution fail


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-9
changelog:
  - Add deleteStateOnFileMove imfile module option
    resolves: rhbz#1909639
  - Add inotify_rm_watch() inotify API call when object needs to be destroyed
    resolves: rhbz#2052403


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-10
changelog:
  - openssl: Correct gnutlsPriorityString (custom ciphers) behaviour
  - Fix error handling in gtlsRecordRecv that can cause 100 percent CPU usage
    resolves: rhbz#2046158
  - Address CVE-2022-24903, Heap-based overflow in TCP syslog server
    resolves: rhbz#2081401


author: Attila Lakatos <alaktos@redhat.com> - 8.2102.0-13
changelog:
  - Make rsyslog-relp require librelp>= 1.9.0
    resolves: rhbz#2029352
  - Reorder logrotate parameters to work with POSIXLY_CORRECT env var
    resolves: rhbz#2070496


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-14
changelog:
  - Fix wrong type conversion in cstrLen()
    resolves: rhbz#2157804
  - imjournal: by default retrieves _PID from journal as PID number
    resolves: rhbz#2176398
  - Systemd service file hardening
    resolves: rhbz#2176404


author: Attila Lakatos <alakatos@redhat.com> - 8.2102.0-15
changelog:
  - omelasticsearch: make compatible with elasticsearch>=8
  - add new action specific parameter esversion.major
    resolves: rhbz#2192955


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-5
changelog:
  - rebuild for rebased dependencies
  - dependency cleanup and sorted sub-packages in spec
    resolves: rhbz#1613880


author: Jiri Vymazal <jvymazal@redhat.com> - 8.37.0-1
changelog:
  - rebase to 8.37.0
    resolves: rhbz#1613880
    resolves: rhbz#1564054
    resolves: rhbz#1598218
    - dropped invalid statefile patch - upstreamed
    - dropped imjournal duplicates patch - upstreamed
    resolves: rhbz#1544394
  - renumbered default tag patch and fitted onto rebased version


author: Stephen Gallagher <sgallagh@redhat.com> - 0.11-15
changelog:
  - Temporarily disable -Werror=format-security to unbreak the build
  - Build with verbose command-line visible in the logs
  - Resolves: rhbz#1424270


author: John Kacur <jkacur@redhat.com> - 5.14.0-3
changelog:
  - Fix exit status when returning from calls to usage()
  Resolves: rhbz#2161423
  jiraProject == RHELPLAN-145250


author: John Kacur <jkacur@redhat.com> - 5.14.0-6
changelog:
  - Forward port the tests directory for ci testing
  Resolves: rhbz#2196611
  jiraProject == RHELPLAN-156801


author: John Kacur <jkacur@redhat.com> - 6.6.0-1
changelog:
  Update to rtla in linux-6.6.0
  - Add patch to use SYS_gettid and add -lpthread to the Makefile
  Resolves: RHEL-10081


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-97
changelog:
  - Fix TLS 1.3 issues.
    * ruby-2.6.0-fix-test-failure-with-TLS-1.3.patch
    * ruby-2.6.0-net-http-net-ftp-fix-session-resumption-with-TLS-1.3.patch
    Related: rhbz#1616213


author: Jun Aruga <jaruga@redhat.com> - 2.5.1-99
changelog:
  - Fix generated rdoc template issues.
    * ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch
    Resolves: rhbz#1612026


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-99
changelog:
  - Additional OpenSSL 1.1.1 fixes.
    * ruby-2.6.0-fix-test-failure-with-TLS-1.3-maint.patch
    * ruby-2.6.0-config-support-include-directive.patch
    * ruby-2.6.0-use-larger-keys-for-SSL-tests.patch
    Related: rhbz#1616213


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-100
changelog:
  - Properly harden package using -fstack-protector-strong.
    * ruby-2.6.0-configure-fstack-protector-strong.patch
    Resolves: rhbz#1624168


author: Vít Ondruch <vondruch@redhat.com> - 2.5.5-104
changelog:
  - Update to Ruby 2.5.5.
    * Remove Patch25: ruby-2.6.0-Update-for-tzdata-2018f.patch; subsumed
    * Remove Patch11: ruby-2.6.0-Try-to-update-cert.patch; subsumed
    * Remove Patch19: ruby-2.6.0-net-http-net-ftp-fix-session-resumption-with
        -TLS-1.3.patch; subsumed
    Resolves: rhbz#1688758
  - Don't ship .stp files when SystemTap support is disabled.
    Related: rhbz#1657915
  - Fix CovScan issues.
    Resolves: rhbz#1628592


author: Jun Aruga <jaruga@redhat.com> - 2.5.5-105
changelog:
  - Use ffi_closure_alloc to avoid segmentation fault by libffi on aarch64.
    Resolves: rhbz#1727832
  - Properly support %prerelease in %gemspec_ macros.
    Related: rhbz#1688758
  - Fix rdoc gzipped javascript pages are not the same across multilib.
    Resolves: rhbz#1719647


author: Pavel Valena <pvalena@redhat.com> - 2.5.9-107
changelog:
  - Update to Ruby 2.5.9.
    * Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed
    Resolves: rhbz#1952626
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
    contains leading zero
    Resolves: rhbz#1955010


author: Pavel Valena <pvalena@redhat.com> - 2.5.9-107
changelog:
  - Update to Ruby 2.5.9.
    * Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed
    Resolves: rhbz#1757844
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
    contains leading zero
    Resolves: rhbz#1950308


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-108
changelog:
  - Fix command injection vulnerability in RDoc.
    Resolves: CVE-2021-31799
  - Fix StartTLS stripping vulnerability in Net::IMAP
    Resolves: CVE-2021-32066
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    Resolves: CVE-2021-31810


author: Jun Aruga <jaruga@redhat.com> - 2.5.9-110
changelog:
  - Fix FTBFS due to an incompatible load directive.
  - Fix a fiddle import test on an optimized glibc on Power 9.
  - Fix by adding length limit option for methods that parses date strings.
    Resolves: CVE-2021-41817
  - CGI::Cookie.parse no longer decodes cookie names to prevent spoofing security
    prefixes in cookie names.
    Resolves: CVE-2021-41819


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-111
changelog:
  - Fix HTTP response splitting in CGI.
    Resolves: CVE-2021-33621
  - Fix Buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739
  - Fix ReDoS vulnerability in URI.
    Resolves: CVE-2023-28755
  - Fix ReDoS vulnerability in Time.
    Resolves: CVE-2023-28756


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-112
changelog:
  - Fix ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755.
    (CVE-2023-36617)
    Resolves: RHEL-5614
  - Fix Buffer overread vulnerability in StringIO.
    (CVE-2024-27280)
    Resolves: RHEL-34125
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    (CVE-2024-27281)
    Resolves: RHEL-34117
  - Fix Arbitrary memory address read vulnerability with Regex search.
    (CVE-2024-27282)
    Resolves: RHEL-33867
  - Fix REXML DoS parsing an XML with many `<`s in an attribute value.
    (CVE-2024-35176)
    Resolves: RHEL-37877


author: Vít Ondruch <vondruch@redhat.com> - 2.5.9-114
changelog:
  - Fix integer overflow in search_in_range function in regexec.c (CVE-2019-19012).
    Resolves: RHEL-87505


author: Jun Aruga <jaruga@redhat.com> - 2.6.3-105
changelog:
  - Update to Ruby 2.6.3 by merging Fedora master branch (commit: 1cc2a49)
    * Properly generate "ruby(rubygems)" versioned dependencies.
    * Extract composition of dependecy strings into helper.
    * Loosen RDoc dependency.
    * Upstream fix adding -C flag instead of changing directory for gem build.
    * Remove obsolete Group tag
    * Fix ".include =" support in openssl.cnf.
    * Link IRB back to StdLib.
    * Link IRB files instead of directories.
    * Exclude irb.rb from ruby-libs.
    Resolves: rhbz#1672575


author: Jun Aruga <jaruga@redhat.com> - 2.6.3-106
changelog:
  - Use ffi_closure_alloc to avoid segmentation fault by libffi on aarch64.
    Resolves: rhbz#1727832
  - Properly support %prerelease in %gemspec_ macros.
    Related: rhbz#1672575


author: Jarek Prokop <jprokop@redhat.com> - 2.6.7-107
changelog:
  - Upgrade to Ruby 2.6.7.
    Resolves: rhbz#1757846
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given an address
    containing leading zero
    Resolves: rhbz#1950307
  - Fix: Rubygem-bundler: Don't use insecure tmp directory as home
    allows for execution of malicious code.
    Resolves: CVE-2019-3881


author: Jun Aruga <jaruga@redhat.com> - 2.6.9-108
changelog:
  - Upgrade to Ruby 2.6.9.
  - Skip JIT tests in RHEL 8.
  - Fix the issues required to start the "make test-bundler" itself.
  - Fix Bundler dependency confusion.
    Resolves: CVE-2020-36327


author: Vít Ondruch <vondruch@redhat.com> - 2.6.10-109
changelog:
  - Upgrade to Ruby 2.6.10.
    Resolves: rhbz#2088415
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739
  - Fix FTBFS due to an incompatible load directive.
  - Fix a fiddle import test on an optimized glibc on Power 9.


author: Jarek Prokop <jprokop@redhat.com> - 2.6.7-107
changelog:
  - Upgrade to Ruby 2.6.7.
    Resolves: rhbz#1952627
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given an address
    containing leading zero
    Resolves: rhbz#1954968
  - Fix: Rubygem-bundler: Don't use insecure tmp directory as home
    allows for execution of malicious code.
    Resolves: rhbz#1954969


author: Jun Aruga <jaruga@redhat.com> - 2.7.1-132
changelog:
  - Update to Ruby 2.7.1 by merging Fedora master branch (commit: 2981648)
    * Skip unstable tests on s390x.
    * Skip JIT tests in RHEL 8.
    Resolves: rhbz#1817135


author: Vít Ondruch <vondruch@redhat.com> - 2.7.1-133
changelog:
  - Fix `require` behavior allowing to load libraries multiple times.
    Resolves: rhbz#1842989
  - Add ruby-default-gems dependency on irb.


author: Pavel Valena <pvalena@redhat.com> - 2.7.3-136
changelog:
  - Upgrade to Ruby 2.7.3.
    Resolves: rhbz#1951999
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
    contains leading zero
    Resolves: rhbz#1952000


author: Jun Aruga <jaruga@redhat.com> - 2.7.4-137
changelog:
  - Upgrade to Ruby 2.7.4.
  - Fix command injection vulnerability in RDoc.
    Resolves: rhbz#1986768
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    Resolves: rhbz#1986812
  - Fix StartTLS stripping vulnerability in Net::IMAP.
    Resolves: rhbz#1986813
  - Upgrade to Bundler 2.2.24.
    Resolves: CVE-2020-36327


author: Pavel Valena <pvalena@redhat.com> - 2.7.3-136
changelog:
  - Upgrade to Ruby 2.7.3.
    Resolves: rhbz#1947938
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
    contains leading zero
    Resolves: rhbz#1944227


author: Jun Aruga <jaruga@redhat.com> - 2.7.4-137
changelog:
  - Upgrade to Ruby 2.7.4.
  - Fix command injection vulnerability in RDoc.
    Resolves: CVE-2021-31799
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    Resolves: CVE-2021-31810
  - Fix StartTLS stripping vulnerability in Net::IMAP.
    Resolves: CVE-2021-32066
  - Upgrade to Bundler 2.2.24.
    Resolves: CVE-2020-36327


author: Jarek Prokop <jprokop@redhat.com> - 2.7.6-138
changelog:
  - Upgrade to Ruby 2.7.6.
    Resolves: rhbz#2109424
  - Fix FTBFS due to an incompatible load directive.
    Related: rhbz#2109424
  - Fix a fiddle import test on an optimized glibc on Power 9.
    Related: rhbz#2109424
  - Fix regular Expression Denial of Service Vulnerability of Date Parsing Methods.
    Resolves: CVE-2021-41817
  - Fix cookie prefix spoofing in CGI::Cookie.parse.
    Resolves: CVE-2021-41819
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739


author: Jarek Prokop <jprokop@redhat.com> - 2.7.8-139
changelog:
  - Upgrade to Ruby 2.7.8.
    Resolves: rhbz#2149262
  - Fix HTTP response splitting in CGI.
    Resolves: CVE-2021-33621
  - Fix ReDoS vulnerability in URI.
    Resolves: CVE-2023-28755
  - Fix ReDoS vulnerability in Time.
    Resolves: CVE-2023-28756


author: Jarek Prokop <jprokop@redhat.com> - 3.0.1-138
changelog:
  - Upgrade to Ruby 3.0.1 by merging Fedora rawhide branch (commit: 6b2ff68).
    * Add missing `rubygem-` prefix for bundled provide of 'connection_pool'.
    * Pass ldflags to gem install via CONFIGURE_ARGS
    * Remove IRB dependency from rubygem-rdoc.
    * Fix flaky excon test suite.
    * Properly support DWARF5 debug information.
        Related: rhbz#1920533
    * Bundle OpenSSL into StdLib.
    * Fix SEGFAULT in rubygem-shoulda-matchers test suite.
    * Provide `gem.build_complete` file for binary gems.
    * Re-enable test suite.
    * ruby-default-gems have to depend on rubygem(io-console) due to reline.
    * Fix SEGFAULT preventing rubygem-unicode to build on armv7hl.
    * Add support for reworked RubyGems plugins.
    * Use proper path for plugin wrappers.
    * Extract RSS and REXML into separate subpackages, because they were moved from
       default gems to bundled gems.
    * Drop Net::Telnet and XMLRPC packages, because they were dropped from Ruby.
    Resolves: rhbz#1938942
  - Fix FTBFS due to an incompatible load directive.


author: Jarek Prokop <jprokop@redhat.com> - 3.0.2-139
changelog:
  - Upgrade to Ruby 3.0.2.
    Related: rhbz#1938942
  - Fix command injection vulnerability in RDoc. (CVE-2021-31799)
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    (CVE-2021-31810)
  - Fix StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)
  - Fix dependencies of gems with explicit source installed from a
    different source. (CVE-2020-36327)
  - Pass ldflags to gem install via CONFIGURE_ARGS.
    The same comment on the changelog 3.0.1-138 was wrong.


author: Jarek Prokop <jprokop@redhat.com> - 3.0.2-140
changelog:
  - Fix rubygem-irb upgrade not working due to directory -> symlink conversion.
    Resolves: rhbz#2010403


author: Jarek Prokop <jprokop@redhat.com> - 3.0.2-140
changelog:
  - Fix rubygem-irb upgrade not working due to directory -> symlink conversion.
    Resolves: rhbz#2010949


author: Jarek Prokop <jprokop@redhat.com> - 3.0.4-141
changelog:
  - Upgrade to Ruby 3.0.4.
    Resolves: rhbz#2109431
    Resolves: rhbz#2110981
  - Fix double free in Regexp compilation.
    Resolves: CVE-2022-28738
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739


author: Jarek Prokop <jprokop@redhat.com> - 3.0.4-141
changelog:
  - Upgrade to Ruby 3.0.4.
    Resolves: rhbz#2096346
    Resolves: rhbz#2000056
  - Fix double free in Regexp compilation.
    Resolves: CVE-2022-28738
  - Fix buffer overrun in String-to-Float conversion.
    Resolves: CVE-2022-28739


author: Jun Aruga <jaruga@redhat.com> - 3.0.7-142
changelog:
  - Upgrade to Ruby 3.0.7.
    Resolves: RHEL-36189
  - Fix HTTP response splitting in CGI.
    Resolves: RHEL-36193
  - Fix ReDoS vulnerability in URI.
    Resolves: RHEL-36196
  - Fix ReDoS vulnerability in Time.
    Resolves: RHEL-36205
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-36198
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-36200
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-36203


author: Jarek Prokop <jprokop@redhat.com> - 3.1.4-142
changelog:
  - Upgrade to Ruby 3.1.4.
    Resolves: RHEL-28565
  - Fix HTTP response splitting in CGI.
    Resolves: RHEL-28564
  - Fix ReDos vulnerability in URI.
    Resolves: RHEL-28567
    Resolves: RHEL-28576
  - Fix ReDos vulnerability in Time.
    Resolves: RHEL-28566
  - Make RDoc soft dependency in IRB.
    Resolves: RHEL-28569


author: Jarek Prokop <jprokop@redhat.com> - 3.1.4-142
changelog:
  - Upgrade to Ruby 3.1.4.
    Resolves: RHEL-5584
  - Fix HTTP response splitting in CGI.
    Resolves: CVE-2021-33621
  - Fix ReDos vulnerability in URI.
    Resolves: CVE-2023-28755
    Resolves: CVE-2023-36617
  - Fix ReDos vulnerability in Time.
    Resolves: CVE-2023-28756
  - Make RDoc soft dependency in IRB.
    Resolves: RHEL-5615


author: Jun Aruga <jaruga@redhat.com> - 3.1.5-143
changelog:
  - Upgrade to Ruby 3.1.5.
    Resolves: RHEL-35748
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-35749
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-35750
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-35751


author: Jarek Prokop <jprokop@redhat.com> - 3.1.7-145
changelog:
  - Upgrade to Ruby 3.1.7.
    Resolves: RHEL-55408
  - Fix DoS vulnerability in REXML. (CVE-2024-39908)
    Resolves: RHEL-57051
  - Fix DoS vulnerability in REXML. (CVE-2024-43398)
    Resolves: RHEL-56002


author: Jarek Prokop <jprokop@redhat.com> - 3.3.1-2
changelog:
  - Upgrade to Ruby 3.3.1.
    Resolves: RHEL-37446
  - Fix buffer overread vulnerability in StringIO.
    (CVE-2024-27280)
    Resolves: RHEL-37448
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    (CVE-2024-27281)
    Resolves: RHEL-37449
  - Fix Arbitrary memory address read vulnerability with Regex search.
    (CVE-2024-27282)
    Resolves: RHEL-37447


author: Jarek Prokop <jprokop@redhat.com> - 3.3.5-3
changelog:
  - Upgrade to Ruby 3.3.5
    Resolves: RHEL-55409
  - Fix DoS vulnerability in rexml.
    (CVE-2024-39908)
    (CVE-2024-41946)
    (CVE-2024-43398)
    Resolves: RHEL-57049
    Resolves: RHEL-57054
    Resolves: RHEL-57069
  - Fix REXML DoS when parsing an XML having many specific characters such as
    whitespace character, >] and ]>.
    (CVE-2024-41123)
    Resolves: RHEL-52783


author: Jarek Prokop <jprokop@redhat.com> - 3.3.8-4
changelog:
  - Upgrade to Ruby 3.3.8.
    Resolves: RHEL-68632
  - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186)
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
  - Fix userinfo leakage in URI#join, URI#merge and URI#+. (CVE-2025-27221)


author: Jun Aruga <jaruga@redhat.com> - 3.3.10-5
changelog:
  - Upgrade to Ruby 3.3.10.
    Resolves: RHEL-106820
  - Fix possible denial of service in resolv gem (CVE-2025-24294)
  - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594)
  - Fix REXML denial of service. (CVE-2025-58767)
    Resolves: RHEL-122012


author: Jun Aruga <jaruga@redhat.com> - 0.5.2-1
changelog:
  - New upstream release 0.5.2 by merging Fedora master branch (commit: cc15309)
    Resolves: rhbz#1672575


author: Jun Aruga <jaruga@redhat.com> - 0.5.3-1
changelog:
  - New upstream release 0.5.3 by merging Fedora master branch (commit: 674d475)
    Resolves: rhbz#1817135


author: Jarek Prokop <jprokop@redhat.com> 0.5.3-2
changelog:
  - Update by merging Fedora rawhide branch (commit: 81e2cc9)
  - Fix Mysql2::Result test for Ruby 3.1.
  - Remove gem_make.out and mkmf.log files from the binary RPM package.
  - Fix test assertion for mariadb-connector-c.
    Related: rhbz#2063772


author: Jun Aruga <jaruga@redhat.com> - 1.1.4-1
changelog:
  - Update to pg 1.1.4 by merging Fedora master branch (commit: 397796e)
    * BuildRequires: s/postgresql-devel/libpq-devel/
    * Add marking lines at the start and end of the setup.log
    Resolves: rhbz#1672575


author: Dan Walsh <dwalsh@redhat.com> - 2:1.0.0-40.rc5.dev.gitad0f525
changelog:
  - Remove sysclt handling, not needed in RHEL8
  - Make sure package built with seccomp flags
  - Remove rectty
  - Add completions


author: Dan Walsh <dwalsh@redhat.name> - 2:1.0.0-46.dev.gitb4e2ecb
changelog:
  - Add patch https://github.com/opencontainers/runc/pull/1807 to allow
  - runc and podman to work with sd_notify


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.0.0-55.rc5.dev.git2abd837
changelog:
  - Resolves: #1665770 - rootfs: umount all procfs and sysfs with --no-pivot
  - Resolves: CVE-2019-5736


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-68.rc92
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-73.rc95
changelog:
  - fix podman run --pid=host command causes OCI permission error
  - rc95 fixes CVE-2021-30465
  - Related: #2070961


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-73.rc95
changelog:
  - fix podman run --pid=host command causes OCI permission error
  - rc95 fixes CVE-2021-30465
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.10-1
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.1.10
  - require container-selinux >= 2.224.0 for dmz feature
  - Related: Jira:RHEL-2110


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.3-3
changelog:
  - fix "Error: runc: exec failed: unable to start container process:
    open /dev/pts/0: operation not permitted: OCI permission denied"
  - Resolves: #2117928


author: Stoil Barzakov <stoil.barzakov@oracle.com> - 1:1.1.4-1.0.1
changelog:
  - rootless: fix /sys/fs/cgroup mounts to prevent CVE-2023-25809
  - rootfs: prohibit symlinks that conflicts with readonlyPaths
            and/or maskedPaths to prevent CVE-2023-27561
  - Prohibit /proc and /sys to be symlinks to prevent CVE-2023-28642
  - JIRA: OLDIS-25589


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0.3-6
changelog:
  - Fix every podman run invocation generates two "Couldn't stat device
    /dev/char/10:200: No such file or directory" lines in the journal
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.3-3
changelog:
  - fix "Error: runc: exec failed: unable to start container process:
    open /dev/pts/0: operation not permitted: OCI permission denied"
  - Related: #2061390


author: Andreas Schneider <asn@redhat.com> - 4.9.1-5
changelog:
  - resolves: #1644327 - Segfault if wrong 'passdb backend' is configured
  - resolves: #1647959 - Segfault in the debug system with hardended build


author: Andreas Schneider <asn@redhat.com> - 4.9.1-6
changelog:
  - resolves: #1642092 - Harden [homes] share export
  - resolves: #1648846 - Fix out of bound array access in ctdb
  - resolves: #1657266 - Fix tmp directory creation in /run


author: Andreas Schneider <asn@redhat.com> - 4.9.1-7
changelog:
  - resolves: #1658690 - Add smbc_setOptionProtocols()
  - resolves: #1658678 - Fix spoolss client operations against Windows


author: Andreas Schneider <asn@redhat.com> - 4.10.4-0
changelog:
  - related: #1638001 - Rebase to Samba version 4.10.4
  - resolves: #1597298 - Build Samba with python3
  - resolves: #1658558 - Add 'net ads leave --keep-account' option
  - resolves: #1669004 - Fix systemd status notifications
  - resolves: #1672167 - Fix printing cache timeout in debug output
  - resolves: #1696525 - Fix CVE-2019-3880


author: Andreas Schneider <asn@redhat.com> - 4.10.4-1
changelog:
  - resolves: #1712378 - Fix smbspool CUPS backend
  - resolves: #1696612 - Fix 'net ads join -U admin@parentdomain'


author: Andreas Schneider <asn@redhat.com> - 4.10.4-100
changelog:
  - resolves: #1760824 - Avoid overlinking with librt and libpthread
  - resolves: #1759236 - Fix forest trusts enumeration
  - resolves: #1761719 - Fix CUPS username/password authentication with smbspool


author: Andreas Schneider <asn@redhat.com> - 4.11.2-4
changelog:
  - related: #1754409 - Add patch to avoid overlinking with libnsl and libsocket
  - related: #1754409 - Fix permissions for pidl
  - related: #1754409 - Fix logrotate script
  - related: #1754409 - Add missing README files


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.11.2-10
changelog:
  - resolves: #1790353 - Fix access check in DsRGetForestTrustInformation
  - resolves: #1791209 - Fix CVE-2019-14907


author: Andreas Schneider <asn@redhat.com> - 4.11.2-12
changelog:
  - related: #1781232 - Improve debug output of smbclient
  - resolves: #1794461 - Do not return bogus inode numbers in
                         cli_qpathinfo2()/cli_qpathinfo3() for SMB1
  - resolves: #1794442 - Fix segfault in smbd_do_qfilepathinfo()


author: Sushmita Bhattacharya <sushmita.bhattacharya@oracle.com> - 4.11.2-13.0.1
changelog:
  - Fix issues with join using netbios name [Orabug: 31546649]
  - related : samba bug #14116 - Join using netbios name and realm instead of machine fqdn
  - resolves: samba bug #14396 - Add msDS-AdditionalDnsHostName to the keytab and add net-ads-join dnshostname option
  - resolves: samba bug #14406 - Fix adding msDS-AdditionalDnsHostName to keytab with Windows DC


author: Isaac Boukris <iboukris@redhat.com> - 4.12.3-4
changelog:
  - resolves: #1850980 - Add "additional dns hostname" to keytab
  - resolves: #1850981 - Add net-ads-join dnshostname=fqdn option


author: Andreas Schneider <asn@redhat.com> - 4.12.3-5
changelog:
  - resolves: #1823612 - Fix segfault in 'net ads dns gethostbyname'
  - resolves: #1792553 - Fix 'net ads join createcomputer=OU'


author: Andreas Schneider <asn@redhat.com> - 4.12.3-7
changelog:
  - resolves: #1855711 - Fix 'require_membership_of' documentation in
                         pam_winbind manpage


author: Andreas Schneider <asn@redhat.com> - 4.12.3-9
changelog:
  - related: #1817557 - Move DECRPC mdssvc data files to correct package
  - resolves: #1856676 - Fix lookuprids in winbind


author: Andreas Schneider <asn@redhat.com> - 4.13.2-1
changelog:
  - resolves: #1878109 - Rebase Samba to version 4.13.2
  - resolves: #1872833 - Add samba-winexe subpackage
  - resolves: #1891688 - Fix CVE-2020-14323
  - resolves: #1892633 - Fix CVE-2020-14318
  - resolves: #1892639 - Fix CVE-2020-14383
  - resolves: #1879835 - Fix CVE-2020-1472
  - resolves: #1888990 - Update smb.conf manpages to describe how to apply
                         config changes.
  - resolves: #1869702 - Fix %U substitution for 'valid users' option
  - resolves: #1818038 - Improve FIPS compliance


author: Andreas Schneider <asn@redhat.com> - 4.13.2-2
changelog:
  - related: #1869702 - Fix spoolss crash
  - resolves: #1896736 - Fix name lookups of FreeIPA users
  - resolves: #1899113 - Fix DFS links


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.13.3-4
changelog:
  - resolves: #1964314 - Fix ldconfig warning about libsmbldap.so.2
  - resolves: #1964398 - Fix smbd trying to delete files with wrong permissions
  - resolves: #1969831 - Fix memory leak in RPC server


author: Andreas Schneider <asn@redhat.com> - 4.14.4-0
changelog:
  - related: rhbz#1944657 - Update to version 4.14.5
  - resolves: rhbz#1969787 - Fix memory leak in RPC server
  - resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
  - resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
  - resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
  - resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags


author: Andreas Schneider <asn@redhat.com> - 4.14.4-1
changelog:
  - resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
  - resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message


author: Andreas Schneider <asn@redhat.com> - 4.14.4-4
changelog:
  - resolves: rhbz#2021163
    Fix CVE-2016-2124
  - resolves: rhbz#2021167
    Fix CVE-2021-23192
  - resolves: rhbz#2021171
    Fix CVE-2020-25717


author: Andreas Schneider <asn@redhat.com> - 4.14.5-5
changelog:
  - resolves: rhbz#2021493 - Add missing PAC buffer types to krb5pac.idl
  - related: rbhz#2021171 - Fix regression with 'allow trusted domains = no'


author: Andreas Schneider <asn@redhat.com> - 4.14.5-9
changelog:
  - resolves: rhbz#2046174 - Fix username map script regression of CVE-2020-25717
  - resolves: rhbz#2046160 - Fix possible segfault while joining a domain
  - resolves: rhbz#2046152 - Fix CVE-2021-44142


author: Andreas Schneider <asn@redhat.com> - 4.14.4-2
changelog:
  - resolves: rhbz#1944657 - Update to version 4.14.4
  - resolves: rhbz#1949445 - Fix CVE-2021-20254
  - resolves: rhbz#1947945 - Fix libsmbldap.so.2 not being a symbolic link
  - resolves: rhbz#1908506 - Fix creating the gencache user directory
  - resolves: rhbz#1901029 - Build the vfs_io_uring module


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-0
changelog:
  - Update to Samba 4.15.5
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2046127 - Fix CVE-2021-44141
  - resolves: rhbz#2046153 - Fix CVE-2021-44142
  - resolves: rhbz#2044404 - Printing no longer works on Windows 7
  - resolves: rhbz#2043154 - Fix systemd notifications
  - resolves: rhbz#2049602 - Disable NTLMSSP for ldap client connections (e.g. libads)


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-1
changelog:
  - resolves: #1995849 - [RFE] Change change password change prompt phrasing
  - resolves: #2029417 - virusfilter_vfs_openat: Not scanned: Directory or special file


author: Andreas Schneider <asn@redhat.com> - 4.15.5-5
changelog:
  - resolves: rhbz#2064325 - Fix 'create krb5 conf = yes` when a KDC has a
                             single IP address.


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-8
changelog:
  - resolves: rhbz#2079303 - Fix username map for unix groups
  - resolves: rhbz#2079299 - PAM Kerberos authentication fails with a clock skew error
  - resolves: rhbz#2079304 - Fix UPNs handling in lookup_name*() calls


author: EL Errata <el-errata_ww@oracle.com> - 4.15.5-10.0.1
changelog:
  - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs
    in OL8 [Orabug: 30205755]


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.2-1
changelog:
  - resolves: rhbz#2013596 - Rebase to version 4.15.2
  - resolves: rhbz#1999294 - Remove noisy error message in winbindd
  - resolves: rhbz#1958881 - Don't require winbind being online for krb5 auth
                             with one-way trusts
  - resolves: rhbz#2019461 - Fix deleting directories with dangling symlinks


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.3-1
changelog:
  - related: rhbz#2013596 - Rebase to version 4.15.3
  - resolves: rhbz#2028029 - Fix possible null pointer dereference in winbind
  - resolves: rhbz#1912549 - Winexe: Kerberos Auth is respected via --use-kerberos=desired


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.4-0
changelog:
  - Update to Samba 4.15.4
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2039153 - Fix CVE-2021-20316
  - resolves: rhbz#1912549 - Winexe: Kerberos flag not invoking Kerberos Auth
  - resolves: rhbz#2039157 - Fix CVE-2021-43566
  - resolves: rhbz#2038148 - Failed to authenticate users after upgrade samba package to release samba-4.14.5-7
  - resolves: rhbz#2035528 - [smb] Segmentation fault when joining the domain
  - resolves: rhbz#2038796 - filename_convert_internal: open_pathref_fsp [xxx] failed: NT_STATUS_ACCESS_DENIED


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-6
changelog:
  - resolves: rhbz#2059151 - Fix username map for unix groups
  - resolves: rhbz#2065212 - Fix 'create krb5 conf = yes` when a KDC has a single IP address.


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.3-0
changelog:
  - related: rhbz#2077468 - Rebase Samba to 4.16.3
  - resolves: rhbz#2106672 - The pcap background queue process should not be stopped
  - resolves: rhbz#2106263 - Fix crash in rpcd_classic
  - resolves: rhbz#2100093 - Fix net ads info returns LDAP server and LDAP server name


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.4-5
changelog:
  - resolves: rhbz#2170394 - Fix share enum
  - resolves: rhbz#2170467 - Add to package ctdb dependency for package samba-winbind-clients
  - resolves: rhbz#2170468 - Add package dcerpc - fix winbind to retrieve user groups from AD
  - resolves: rhbz#2170469 - Create package samba-tools


author: EL Errata <el-errata_ww@oracle.com> - 4.16.4-6.0.1
changelog:
  - Fix memleak in _nss_winbind_initgroups_dyn [Orabug: 34727815]
  - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs
    in OL8 [Orabug: 30205755]


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: Darren Archibald <darren.archibald@oracle.com> - 4.17.5-3
changelog:
  - resolves: rhbz#2223601 - Fix trust relationship between workstation and DC
  - resolves: rhbz#2222895 - Fix CVE-2023-3347


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.4-1
changelog:
  - resolves: rhbz#2221594 - Fix broken symlink for libwbclient
  - resolves: rhbz#2221600 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
  - resolves: rhbz#2175385 - Fix access of Samba share with veto files = /.*/
  - resolves: rhbz#2218237 - Fix Python tarfile extraction to avoid a warning


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-0
changelog:
  - resolves: rhbz#2222894 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-1
changelog:
  - related: rhbz#2190417 - Update to version 4.18.6
  - resolves: rhbz#2232564 - Fix the rpc dsgetinfo command


author: Mark Will <mark.will@oracle.com> - 4.18.6-2.0.1
changelog:
  - resolves: RHEL-11937
    Fix CVE-2023-3961 - smbd must check the pipename
  - resolves: RHEL-11937
    Fix CVE-2023-4091 - SMB clients can truncate files
  - resolves: RHEL-11937
    Fix CVE-2023-42669 - Remove rpcecho server


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-10
changelog:
  - resolves: RHEL-101902 - Fix DC discovery after Windows netlogon hardening - follow-up
  - resolves: RHEL-111318 - Fix winbind fork bomb in 'IPA with AD trust' environment


author: EL Errata <el-errata_ww@oracle.com> - 4.19.4-10.0.1
changelog:
  - s3: winbindd: winbindd_pam: fix leak in extract_pac_vrfy_sigs [Orabug: 36518285]
  - s3:passdb: Do not leak memory in pdb_tdb [Orabug: 36371377]
  - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs in OL8 [Orabug: 30205755]


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.3-1
changelog:
  - resolves: RHEL-16483 - Update to version 4.19.3
  - resolves: RHEL-11361
              - Fix CVE-2023-3961 CVE-2023-4091 CVE-2023-42669
  - resolves: RHEL-2228  - Logging Format Enhancement
  - resolves: RHEL-1965  - Fix smbget issues with DFS shares
  - resolves: RHEL-2108  - Fix force user/group issues with 'allow trusted domains = yes'
  - resolves: RHEL-17122 - Fix memory corruption in libnss_winbind


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-2
changelog:
  - Fix error in PREIN scriptlet in rpm package samba-common
  - related: RHEL-16483 - Update to version 4.19.4


author: Darren Archibald <darren.archibald@oracle.com> - 4.19.4-3.0.1
changelog:
  - s3:passdb: Do not leak memory in pdb_tdb [Orabug: 36371377]
  - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs
    in OL8 [Orabug: 30205755]


author: Akshata Konala <akshata.konala@oracle.com> - 4.19.4-4.0.1
changelog:
  - s3: winbindd: winbindd_pam: fix leak in extract_pac_vrfy_sigs [Orabug: 36518285]
  - s3:passdb: Do not leak memory in pdb_tdb [Orabug: 36371377]
  - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs
    in OL8 [Orabug: 30205755]


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.0.27-15
changelog:
  - 1554032 - saned doesn't have permissions to write on usb port
  - updated README.Fedora - mention epson official drivers


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.0.27-19.1
changelog:
  - 1852468, 1852467, 1852466, 1852465 - prevent buffer overflow in esci2_img
  - 1852668, 1852667, 1852666, 1852665 - disable autodiscovery for epsonds backend


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.5.0-4
changelog:
  - Python 2 binary package renamed to python2-sanlock
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Matej Habrnal <mhabrnal@redhat.com> 0.21-1
changelog:
  - New upstream version
    - Introduce 'serial' field in uReport
    - normalization: actualize list of functions


author: Jakub Filak <jakub@thefilaks.net> 0.22-1
changelog:
  - New upstream version
    - Added support fof JavaScript (V8) stack traces
    - Most parts of the in-hook core unwinder callable under unprivileged user
    - GDB core unwinder limits number of unwound frames
    - Fixed a pair of compile warnings - Chris Redmon <credmonster@gmail.com>


author: Matej Habrnal <mhabrnal@redhat.com> 0.23-1
changelog:
  - New upstream version
    - Allow rpm to be optional at build time
    - Do not use deprecated fedorahosted.org


author: Julius Milan <jmilan@redhat.com> 0.24-1
changelog:
  - New upstream version
    - Allow to report unpackaged problems
    - apidoc: generate html docs using doxygen
    - Fix parsing of subset of arm kernel oopses


author: Martin Kutlak <mkutlak@redhat.com> 0.25-1
changelog:
  - New upstream version
   - Normalization: actualize list of functions
   - Fix some compilation warnings
   - Allow to build python3 for rhel8
   - Makefile: add make release-* subcommands
   - Elfutils: Add missing stubs from earlier commit


author: Matej Habrnal <mhabrnal@redhat.com> 0.26-1
changelog:
  - spec: fix Allow python2 to be optional at build time
  - Allow python2 to be optional at build time
  - normalization: actualize list of functions
  - Append Python interpreter as related package
  - makefile: create .tar.xz with make release


author: <kwenning@redhat.com> - 1.3.1-9
changelog:
  - use cib-api directly as get_cib_copy gone with
    pacemaker 2.0.0
  - add sys/sysmacros.h to build with glibc-2.25
  - enlarge string buffer to satisfy newer gcc
  - no corosync 1 support with pacemaker 2.0.0
  - set default to LOG_NOTICE + overhaul levels
  - refactor proc-parsing
  - adaptions for daemon-names changed with
    pacemaker 2.0.0 rc3
  - added .do-not-sync-with-fedora
    Resolves: rhbz#1571797


author: <kwenning@redhat.com> - 1.3.1-10
changelog:
  - removed unneeded python build-dependency
  - updated legacy corosync-devel to corosynclib-devel

    Resolves: rhbz#1595856


author: Klaus Wenninger <kwenning@redhat.com> - 1.3.1-15
changelog:
  - rebuild against new versions of libqb (1.0.3-7.el8),
    corosync (2.99.3-4.el8) and pacemaker (2.0.0-9.el8)

    Related: rhbz#1615945


author: Klaus Wenninger <kwenning@redhat.com> - 1.3.1-18.1
changelog:
  - assume graceful pacemaker exit if leftovers are unmanaged
  - make handling of cib-connection loss more robust

    Resolves: rhbz#1734061


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.0-5
changelog:
  - rebase to upstream v1.4.0
  - finalize cmap connection if disconnected from cluster
  - make handling of cib-connection loss more robust
  - add ci test files
  - use generic term cluster-services in doc
  - stress in doc that on-disk metadata watchdog-timeout
    takes precedence
  - fail earlier on invalid servants to make gcc 9 happy

    Resolves: rhbz#1698056
    Resolves: rhbz#1682137


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.0-9
changelog:
  - assume graceful pacemaker exit if leftovers are unmanaged
  - query corosync liveness via votequorum-api

    Resolves: rhbz#1702727
    Resolves: rhbz#1718296


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.1-2
changelog:
  - silence coverity regarding inconsistent parameter passing
  - adapt fence-agents-dependency from upstream to distribution

    Resolves: rhbz#1769305


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.1-6
changelog:
  - match qdevice-sync_timeout against wd-timeout
  - sync startup/shutdown via pacemakerd-api

    Resolves: rhbz#1703128
    Resolves: rhbz#1743726


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.1-7
changelog:
  - conflict with pacemaker-libs < 2.0.4-5 instead of requiring
    a minimum pacemaker version

    Resolves: rhbz#1861713


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.2-1
changelog:
  - rebase to upstream v1.4.2
  - make sbd default to do pacemakerd-api handshake
  - conflict with pacemaker-libs < 2.0.5-4 to assure pacemaker
    is defaulting to pacemakerd-api handshake

    Resolves: rhbz#1903730
    Resolves: rhbz#1873135


author: Klaus Wenninger <kwenning@redhat.com> - 1.4.2-3
changelog:
  - change the default for SBD_WATCHDOG_TIMEOUT to 10s
    s390(x) stays at 15s as before

    Resolves: rhbz#1922143


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.0-2
changelog:
  - reverted watchdog_timeout_default to 5s
    (slipped in via an unreleased change on 8.4.0 branch)

    Resolves: rhbz#1980797


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-1
changelog:
  - rebase to upstream v1.5.2
  - convert license naming to SPDX
  - make static analysis happy with a few checks & rearanges with
    dynamic-memory-management

    Resolves: rhbz#2168567


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-2
changelog:
  - add required tests subdirectory in addition to gating.yaml
    that had already been brought over before

    Related: rhbz#2168567


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-10
changelog:
  - Fix docdir patch (patch Makefile.am, not Makefile.in)
  - Use correct short name for Eclipse Public License 1.0
  - Use %license
  - Add explicit dependencies for libraries in Makefile.am (fixes FTBFS)
    Resolves: #1606302


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-14
changelog:
  - Fix getting of InstallDate property, improve it to work on non en_US locales
    and update support for recent Fedora distributions
    Resolves: #1776670


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.9-24
changelog:
  - Fix important coverity issues
    Resolves: #1989603
  - Fix incorrect use of temporary paths
    Resolves: #1989605


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.5.0-1
changelog:
  - Update to latest upstream version
  - Change license to Eclipse Public License 1.0
  - Use %license
  - Fix URL


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-10
changelog:
  - Fix null pointer (DoS) vulnerability via POST request to /cimom (CVE-2018-6644)
    (patch by Adam Majer)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-16
changelog:
  - Use %license for file which contains the text of the license
  - Change versioned docdir to unversioned and rename the docdir to match
    the package name
  - Remove %defattr
    Resolves: #1638007


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.8-9
changelog:
  - Use %license for file which contains the text of the license
  - Change versioned docdir to unversioned and rename the docdir to match
    the package name
  - Fix license tag
    Resolves: #1638015


author: Michael Simacek <msimacek@redhat.com> - 2.10.6-7
changelog:
  - Port from deprecated add_maven_depmap to mvn_install
  - Remove unused BR felix-framework
  - Fix unowned directory


author: Michael Simacek <msimacek@redhat.com> - 2.10.6-11
changelog:
  - Correct license tag to include CC0 and Public Domain
  - Repack tarball to remove possibly proprietary binaries
  - Use %license macro


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 2.10.6-13
changelog:
  - Stop scaladoc from trying to bundle non-existent resources
  - Temporarly disable docs generation during build


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.38-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.38 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.38


author: Jan Černý <jcerny@redhat.com> - 0.1.39-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.39 release:
    https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.39
  - Fix spec file to build using Python 3
  - Fix License because upstream changed to BSD-3


author: Watson Sato <wsato@redhat.com> - 0.1.40-3
changelog:
  - Use explicit path BuildRequires to get /usr/bin/python3 inside the buildroot
  - Only build content for rhel8 products


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.41-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.41 release:
    https://github.com/ComplianceAsCode/content/releases/tag/v0.1.41
  - Add RHEL8 Product with OSPP4.2 and PCI-DSS Profiles


author: Ilya Okomin <ilya.okomin@oracle.com> - 0.1.43-1.0.2
changelog:
  - Fix broken OL gpg keys URL
  - Use separate rule for each audit syscall in pci-dss
  - Add efi boot loader rules support
  - Update OL8 profiles
  - Implement smartcards auth in OL8 via sssd
  - Update ensure_oracle_gpgkey_installed for OL8
  - Fix deprecated IncludeConfig directive in rsyslog_files OVALs
  - Enable audit_unsuccessful_file_modification remediation for OL


author: Matěj Týč <matyc@redhat.com> - 0.1.42-9
changelog:
  - Fixed Crypto Policy OVAL for NSS
  - Got rid of rules requiring packages dropped in RHEL8.
  - Profile descriptions fixes.


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.42-11
changelog:
  - Assign CCE to rules from OSPP profile which were missing the identifier.
  - Fix regular expression for Audit rules ordering
  - Account for Audit rules flags parameter position within syscall
  - Add remediations for Audit rules file path
  - Add Audit rules for modification of /etc/shadow and /etc/gshadow
  - Add Ansible and Bash remediations for directory_access_var_log_audit rule
  - Add a Bash remediation for Audit rules that require ordering


author: Matěj Týč <matyc@redhat.com> - 0.1.44-2
changelog:
  - Ported changelog from late 8.0 builds.
  - Disabled build of the OL8 product, updated other components of the cmake invocation.


author: Milan Lysonek <mlysonek@redhat.com> - 0.1.45-2
changelog:
  - Use crypto-policy rules in OSPP profile.
  - Re-enable FIREFOX and JRE product in build.
  - Change test suite logging message about missing profile from ERROR to WARNING.
  - Build only one version of SCAP content at a time.


author: Watson Sato <wsato@redhat.com> - 0.1.46-1
changelog:
  - Update to latest upstream SCAP-Security-Guide-0.1.46 release
  - Align OSPP Profile with Common Criteria Requirements (RHBZ#1714798)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.48-4
changelog:
  - Drop rsyslog rules from OSPP profile
  - Update COBIT URI
  - Add rules for strong source of RNG entropy
  - Enable build of RHEL8 STIG Profile (RHBZ#1755447)
  - STIG profile: added rsyslog rules and updated SRG mappings
  - Split audit rules according to audit component (RHBZ#1791312)


author: Ilya Okomin <ilya.okomin@oracle.com> - 0.1.48-7.0.1
changelog:
  - Update PCI-DSS version to v3.2.1 [Orabug: 30871518]
  - Add OL support to accounts user_umask rules [Orabug: 30871518]
  - Add OL support to audit_rules_for_ospp rule [Orabug: 30871518]
  - Add OL support to disable_users_coredumps rule [Orabug: 30871518]
  - Add OL support to kernel_module_cramfs_disabled rule [Orabug: 30871518]
  - Add OL support to the partitions mount rules [Orabug: 30871518]
  - Add OL support to package_pigz_removed rule [Orabug: 30871518]
  - Add OL8 support to partition_for_var_tmp rule [Orabug: 30871518]
  - Add OL8 support to service_fapolicyd_enabled rule [Orabug: 30871518]
  - Add OL support to configuring_ipv6 rules [Orabug: 30871518]
  - Adjust OL8 OSPP profile [Orabug: 30871518]
  - Add OL support to permissions_within_important_dirs rules [Orabug: 30871518]
  - Add OL support to network_sniffer_disabled rule [Orabug: 30871518]
  - Add OL support to package_quagga_removed rule [Orabug: 30871518]
  - Add OL support to disabling_squid rules [Orabug: 30871518]
  - Update rpm_verification group rules [Orabug: 30871518]
  - Add OL support to service_avahi-daemon_disabled rule [Orabug: 30871518]
  - Add OL support to software sudo rules [Orabug: 30871518]
  - Use the DEFAULT:NO-SHA1 Crypto Policy for the E8 profile. [Orabug: 30871518]
  - Add OL8 Essential Eight profile [Orabug: 30871518]
  - Add rsyslog include object support in rsyslog_files OVALs [Orabug: 30871518]
  - Make audit_file_modification remediation content product intependent [Orabug: 30871518]
  - Fix grub2_bootloader_argument bash template comment [Orabug: 30871518]
  - Make audit_file_modification ansible content product intependent [Orabug: 30871518]
  - Add OL support to missing ospp profile packages rules [Orabug: 31256140]
  - Update GNOME group text for OL products [Orabug: 31256140]
  - Enable rule installed_OS_is_FIPS_certified in OL8 [Orabug: 31256140]
  - Add OL support to var_accounts_user_umask_as_number [Orabug: 31256140]
  - Add OL support to stig rules [Orabug: 31256140]
  - Add draft OL8 stig profile [Orabug: 31256140]
  - Remove kickstart and html tables not available for OL8 [Orabug: 31256140]


author: Matěj Týč <matyc@redhat.com> - 0.1.50-10
changelog:
  - Update the scapval invocation (RHBZ#1815007)
  - Re-added the SSH Crypto Policy rule to OSPP, and added an SRG to the rule (RHBZ#1815007)
  - Change the spec file macro invocation from patch to Patch
  - Fix the rekey limit in ssh/sshd rules (RHBZ#1813066)


author: Matěj Týč <matyc@redhat.com> - 0.1.50-11
changelog:
  - fixed link in a grub2 rule description (rhbz#1854854)
  - fixed selinux_all_devicefiles_labeled rule (rhbz#1852367)
  - fixed no_shelllogin_for_systemaccounts on ubi8 (rhbz#1836873)


author: Ilya Okomin <ilya.okomin@oracle.com> - 0.1.50-14.0.1
changelog:
  - Extend OL8 stig profile with dconf rules [Orabug: 31747827]
  - Add draft OL8 stig profile [Orabug: 31256140]


author: Watson Sato <wsato@redhat.com> - 0.1.50-15
changelog:
  - Add and select zIPL bootloader rules in OSPP (rhbz#1886318)
  - Add support for remediation platforms


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.53-3
changelog:
  - Enforce pam_wheel for "su" in the OSPP profile (RHBZ#1884062)
  - Fix case insensitive checking in rsyslog_remote_tls (RHBZ#1899032)
  - Exclude kernel_trust_cpu_rng related rules on s390x (RHBZ#1899041)
  - Create a SSH_USE_STRONG_RNG rule for SSH client and select it in OSPP profile (RHBZ#1884067)
  - Disable usbguard rules on s390x architecture (RHBZ#1899059)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.53-4
changelog:
  - Fix description of rule installed_OS_is_vendor_supported (RHBZ#1914193)
  - Fix RHEL6 CPE dictionary (RHBZ#1899059)
  - Fix SRG mapping references for ssh_client_rekey_limit and use_pam_wheel_for_su (RHBZ#1914853)


author: Watson Sato <wsato@redhat.com> - 0.1.54-1
changelog:
  - Update to the latest upstream release (RHBZ#1889344)
  - Add Minimal, Intermediary and Enhanced ANSSI Profiles (RHBZ#1778188)


author: Federico Ramirez <federico.r.ramirez@oracle.com> - 0.1.54-5.0.1
changelog:
  - Add draft OL8 stig profile [Orabug: 31256140]
  - Extend OL8 stig profile with dconf rules [Orabug: 31747827]
  - Update OL standard profiles [Orabug: 32748007]
  - Update OL pci-dss profiles [Orabug: 32748007]
  - Add missing OL platform in remediations [Orabug: 32748007]
  - Update OL ospp profiles [Orabug: 32748007]
  - Update OL hipaa profiles [Orabug: 32748007]
  - Update OL cui profiles [Orabug: 32748007]
  - Add OL anssi profiles [Orabug: 32748007]
  - Update OL e8 profiles [Orabug: 32748007]
  - Update OL cjis profiles [Orabug: 32748007]


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.57-1
changelog:
  - Update to the latest upstream release (RHBZ#1997634)
  - Update RHEL8 STIG profile to V1R3 (RHBZ#1997634)
  - Enable RHEL8 STIG with GUI profile (RHBZ#2005431)
  - Enable the ISM profile (RHBZ#2005891)
  - Reestructure RHEL7 and RHEL8 CIS profiles according to the policy (RHBZ#2005427)
  - Enable ANSSI High Profile (RHBZ#2005429)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.57-3
changelog:
  - Reintroduce docker_selinux_enabled rule to RHEL8.
  - Set package_rear_installed not applicable on s390x arch. (RHBZ#2013553)


author: Federico Ramírez <federico.r.ramirez@oracle.com> - 0.1.57-3.0.1
changelog:
  - Add draft OL8 stig profile [Orabug: 31256140]
  - Extend OL8 stig profile with dconf rules [Orabug: 31747827]


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.57-2
changelog:
  - Update Ansible login banner fixes to avoid unnecessary updates (RHBZ#1857179)
  - Include tests for Ansible Playbooks that remove and reintroduce files.
  - Update RHEL8 STIG profile to V1R3 (RHBZ#1993056) 
  - Improve Audit Rules remediation to group similar syscalls (RHBZ#1876483)
  - Reestructure RHEL7 and RHEL8 CIS profiles according to the policy (RHBZ#1993197)
  - Add Kickstart files for ISM profile (RHBZ#1955373)
  - Fix broken RHEL7 documentation links (RHBZ#1966577)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.57-3
changelog:
  - Fix remaining audit rules file permissions (RHBZ#1993056)
  - Mark a STIG service rule as machine only (RHBZ#1993056)
  - Fix a remaining broken RHEL7 documentation link. (RHBZ#1966577)


author: EL Errata <el-errata_ww@oracle.com> - 0.1.57-5.0.1
changelog:
  - Add draft OL8 stig profile [Orabug: 33484710]
  - Extend OL8 stig profile with dconf rules [Orabug: 33484710]
  - Add ol8 ospp profile reference [Orabug: 33484710]
  - Add ol8 pci-dss profile reference [Orabug: 33484710]
  - Update ol8 anssi_bp28 profiles version [Orabug: 33484710]


author: Federico Ramírez <federico.r.ramirez@oracle.com> - 0.1.57-5.0.2
changelog:
  - Add references to existing OL8 profiles [Orabug: 33484710]
  - Remove DRAFT status from ANSSI bp28 high profile [Orabug: 33484710]
  - Add initial OL8 stig profile [Orabug: 33676051]
  - Add OL8 prodtype and platform to rules and remediations [Orabug: 33676051]


author: Federico Ramírez <federico.r.ramirez@oracle.com> - 0.1.57-5.0.3
changelog:
  - Remove bash remediation for accounts_authorized_local_users [Orabug: 33793054]
  - Introduce the stig_gui profile for OL8 [Orabug: 33846896]


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.57-2
changelog:
  - Update Ansible login banner fixes to avoid unnecessary updates (RHBZ#1857179)
  - Include tests for Ansible Playbooks that remove and reintroduce files.
  - Update RHEL8 STIG profile to V1R3 (RHBZ#1993056)
  - Improve Audit Rules remediation to group similar syscalls (RHBZ#1876483)
  - Reestructure RHEL7 and RHEL8 CIS profiles according to the policy (RHBZ#1993197)
  - Add Kickstart files for ISM profile (RHBZ#1955373)
  - Fix broken RHEL7 documentation links (RHBZ#1966577)


author: Federico Ramírez <federico.r.ramirez@oracle.com> - 0.1.57-9.0.1
changelog:
  - Remove bash remediation for accounts_authorized_local_users [Orabug: 33793054]
  - Introduce the stig_gui profile for OL8 [Orabug: 33846896]
  - Add references to existing OL8 profiles [Orabug: 33484710]
  - Remove DRAFT status from ANSSI bp28 high profile [Orabug: 33484710]
  - Add initial OL8 stig profile [Orabug: 33676051]
  - Add OL8 prodtype and platform to rules and remediations [Orabug: 33676051]
  - Add ol8 ospp profile reference [Orabug: 33484710]
  - Add ol8 pci-dss profile reference [Orabug: 33484710]
  - Update ol8 anssi_bp28 profiles version [Orabug: 33484710]
  - Update automation content for library directories rules [Orabug: 34124494]


author: Matej Tyc <matyc@redhat.com> - 0.1.58-1
changelog:
  - Rebase to a new upstream release. (RHBZ#2014485)
  - Add a VM wait handling to fix issues with tests.


author: Watson Sato <wsato@redhat.com> - 0.1.60-2
changelog:
  - Update RHEL8 STIG profile to V1R5 (RHBZ#2049555)
  - Align audit rules for OSPP profile (RHBZ#2000264)
  - Fix rule selection in ANSSI Enhanced profile (RHBZ#2053587)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.60-3
changelog:
  - Update sudoers rules in RHEL8 STIG V1R5 (RHBZ#2049555)
  - Add missing SRG references in RHEL8 STIG V1R5 rules (RHBZ#2049555)
  - Update chronyd_or_ntpd_set_maxpoll to disregard server and poll directives (RHBZ#2026301)
  - Fix GRUB2 rule template to configure the module correctly on RHEL8 (RHBZ#2030966)
  - Update GRUB2 rule descriptions (RHBZ#2014485)
  - Make package_rear_installed not applicable on AARCH64 (RHBZ#2014485)


author: Watson Sato <wsato@redhat.com> - 0.1.60-4
changelog:
  - Fix Ansible service disabled tasks (RHBZ#2014485)
  - Set rule package_krb5-workstation_removed as not applicable on RHV (RHBZ#2055149)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.60-5
changelog:
  - Remove tmux process runinng check in configure_bashrc_exec_tmux (RHBZ#2055860)
  - Fix issue with getting STIG items in create_scap_delta_tailoring.py (RHBZ#2014485)
  - Update rule enable_fips_mode to check only for technical state (RHBZ#2014485)


author: Federico Ramírez <federico.r.ramirez@oracle.com> 0.1.60-7.0.1
changelog:
  - Remove bash remediation for accounts_authorized_local_users [Orabug: 33793054]
  - Introduce the stig_gui profile for OL8 [Orabug: 33846896]
  - Remove remediation content for file_ownership_library_dirs [Orabug: 34060540]
  - Allow configuration of PAMs pwquality module on its own file [Orabug: 34060591]


author: Watson Sato <wsato@redhat.com> - 0.1.60-8
changelog:
  - Update to ensure a sysctl option is not defined in multiple files (RHBZ#2082556)
  - Update RHEL8 STIG profile to V1R6 (RHBZ#2082556)


author: Watson Sato <wsato@redhat.com> - 0.1.60-9
changelog:
  - Fix validation of OVAL 5.10 content (RHBZ#2082556)
  - Fix Ansible sysctl remediation (RHBZ#2082556)


author: Federico Ramírez <federico.r.ramirez@oracle.com> - 0.1.60-9.0.1
changelog:
  - Remove bash remediation for accounts_authorized_local_users [Orabug: 33793054]
  - Introduce the stig_gui profile for OL8 [Orabug: 33846896]
  - Update automation content for library dirs rules [Orabug: 34124494]
  - Allow configuration of PAMs pwquality module on its own file [Orabug: 34060591]
  - Remove the draft status from the OL8 stig profile and sync rules
    severities with the ones defined by DISA [Orabug: 34243180]


author: Watson Sato <wsato@redhat.com> - 0.1.63-1
changelog:
  - Update to the latest upstream release (RHBZ#2116347)
  - Update RHEL8 STIG profile to V1R7 (RHBZ#2116408)
  - Select grub2_disable_recovery in OSPP Profile (RHBZ#2117308)
  - Use authselect minimal profile in OSPP Profile (RHBZ#2117306)
  - Improve rules for CIS level1 partition options (RHBZ#2117510)


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.63.1.0.1
changelog:
  - Update rules related to pam pwhistory remember module to allow both
   requisite and required control values [Orabug: 34604895]
  - Update accounts_password_pam_retry rule to align it with DISA requirements
   OL08-00-020102, OL08-00-020103, and OL08-00-020104 [Orabug: 34604895]
  - Create mount_option_home and use it in OL8 [Orabug: 34604895]
  - Update rule no_empty_passwords to include the password-auth file in
   OVAL check and rule wording [Orabug: 34604895]
  - Introduce the rule accounts_passwords_pam_faillock_dir to cover
   DISA requirements OL08-00-020016 and OL08-00-020017 [Orabug: 34604895]
  - Introduce rule account_disable_inactivity_system_auth to cover
   DISA requirement OL08-00-020260 [Orabug: 34604895]
  - Add automation content to rule accounts_passwords_pam_faillock_audit and include
   it in the OL8 stig profile [Orabug: 34604895]
  - Add OVAL content to rule fapolicy_default_deny and include it on the
   OL8 stig profile [Orabug: 34604895]
  - Add automation content to rule rule account_password_selinux_faillock_dir
   and include it on the OL8 stig profile [Orabug: 34604895]
  - Create rule to cover DISA requirements OL08-00-020018 and OL08-00-020019 [Orabug: 34604895]
  - Update sysctl template OVAL [Orabug: 34604895]
  - Update accounts_password template OVAL [Orabug: 34604895]


author: Watson Sato <wsato@redhat.com> - 0.1.60-8
changelog:
  - Update to ensure a sysctl option is not defined in multiple files (RHBZ#2079241)
  - Update RHEL8 STIG profile to V1R6 (RHBZ#2079241)


author: Watson Sato <wsato@redhat.com> - 0.1.60-9
changelog:
  - Fix validation of OVAL 5.10 content (RHBZ#2079241)
  - Fix Ansible sysctl remediation (RHBZ#2079241)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.63-2
changelog:
  - aligning with the latest STIG update (RHBZ#2112937)
  - OSPP: use Authselect minimal profile (RHBZ#2117192)
  - OSPP: change rules for protecting of boot (RHBZ#2116440)
  - add warning about configuring of TCP queues to rsyslog_remote_loghost (RHBZ#2078974)
  - fix handling of Defaults clause in sudoers (RHBZ#2083109)
  - make rules checking for mount options of /tmp and /var/tmp applicable only when the partition really exists (RHBZ#2032403)
  - fix handling of Rsyslog include directives (RHBZ#2075384)


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.63-4.0.1
changelog:
  - Update rules related to pam pwhistory remember module to allow both
   requisite and required control values [Orabug: 34660199]
  - Update accounts_password_pam_retry rule to align it with DISA requirements
   OL08-00-020102, OL08-00-020103, and OL08-00-020104 [Orabug: 34660199]
  - Create mount_option_home and use it in OL8 [Orabug: 34660199]
  - Update rule no_empty_passwords to include the password-auth file in
   OVAL check and rule wording [Orabug: 34660199]
  - Introduce the rule accounts_passwords_pam_faillock_dir to cover
   DISA requirements OL08-00-020016 and OL08-00-020017 [Orabug: 34660199]
  - Introduce rule account_disable_inactivity_system_auth to cover
   DISA requirement OL08-00-020260 [Orabug: 34660199]
  - Add automation content to rule accounts_passwords_pam_faillock_audit and include
   it in the OL8 stig profile [Orabug: 34660199]
  - Add OVAL content to rule fapolicy_default_deny and include it on the
   OL8 stig profile [Orabug: 34660199]
  - Add automation content to rule rule account_password_selinux_faillock_dir
   and include it on the OL8 stig profile [Orabug: 34660199]
  - Create rule to cover DISA requirements OL08-00-020018 and OL08-00-020019 [Orabug: 34660199]
  - Update sysctl template OVAL [Orabug: 34660199]
  - Update accounts_password template OVAL [Orabug: 34660199]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.63-4.0.2
changelog:
  - Update rules that modify pwquality.conf to delete confs in pwquality.conf.d
   so it ensures no wrong confs exist [Orabug: 34893225]
  - Allow several non-conflicting entries of the timestamp_timeout config entry
   in sudoers files [Orabug: 34893225]
  - Update fapolicy_default_deny to look into compiled.rules [Orabug: 34893225]
  - Align OL08-00-020352 better by ignoring .bash_history file, and OL08-00-010120
   by better detect locked passwords [Orabug: 34893225]
  - Update rules dealing with sshd_config to look into files added to the include
   keyword [Orabug: 34893225]
  - Update remediations in two rules which wasn't letting the system boot when
   running anssi-high profile [Orabug: 34893225]
  - Update STIG version to V1R4 [Orabug: 34893225]
  - Update  rules accounts_password_set_min_life_existing and
   accounts_password_set_max_life_existing to ignore non-interactive users
   [Orabug: 34905591]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.63-4.0.3
changelog:
  - Update OL stig profile rule selection, add aide_build_database and remove
   sshd_disable_compression [Orabug: 35017186]
  - Introduce new rules, sshd_use_approved_kex_ordered_stig, configure_bashrc_tmux,
   configure_tmux_lock_keybinding [Orabug: 35017186]
  - Update rules modifying pam files to handle /etc/pam.d/system-auth precedence over
   other configuration files [Orabug: 35017186]
  - Update version of stig profiles to V1R5 [Orabug: 35017186]


author: Watson Sato <wsato@redhat.com> - 0.1.66-1
changelog:
  - Rebase to a new upstream release 0.1.66 (RHBZ#2168079)
  - Update RHEL8 STIG profile to V1R9 (RHBZ#2168075)
  - Fix levels of CIS rules (RHBZ#2168072)
  - Remove unused RHEL8 STIG control file (RHBZ#2168069)
  - Fix handling of space in sudo_require_reauthentication (RHBZ#2168066)
  - Add rule for audit immutable login uids (RHBZ#2168063)
  - Fix remediation of audit watch rules (RHBZ#2168060)
  - Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2168057)
  - Fix applicability of kerberos rules (RHBZ#2168054)
  - Add support rainer scripts in rsyslog rules (RHBZ#2168050)


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.66-2.0.1
changelog:
  - Update rules dealing with sshd_config to look into files added to the include
   keyword [Orabug: 34893225]
  - Update remediation in sebool_secure_mode_insmod which wasn't letting the system boot when
   running anssi-high profile [Orabug: 34893225]
  - Update OL stig profile rule selection remove sshd_disable_compression [Orabug: 35017186]
  - Introduce new rules, sshd_use_approved_kex_ordered_stig, configure_bashrc_tmux,
   configure_tmux_lock_keybinding [Orabug: 35017186]
  - Update rules modifying pam files to handle /etc/pam.d/system-auth precedence over
   other configuration files [Orabug: 35017186]
  - Update version of stig profiles to V1R5 [Orabug: 35017186]


author: Federico Ramírez <federico.r.ramirez@oracle.com> - 0.1.66-2.0.2
changelog:
  - Introduce a new OVAL macro to consistently identify interactive users [Orabug: 35214522]
  - Update accounts_user_dot_no_world_writable_programs rule to look for
   initialization files on the user's homedirs only and to prevent the search for
   world-writables to descend to other file systems [Orabug: 35214522]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.66-2.0.3
changelog:
  - Fix ansible to content to manage correctly binary dirs when they have hardlinks. And
    manage correctly fstab entries where the mount point has a blank space in mount
    point [Orabug: 35338979]
  - Update OVAL content to allow spaces in postfix configuration. And recognize locked
    accounts with hashed password in /etc/passwd [Orabug: 35338979]
  - Add rule package_mailx_installed and ensure_oracle_gpgkey_installed to stig profile
    to cover new STIG ids OL08-00-010358 and OL08-00-010019 [Orabug: 35338979]
  - Update references to reflect STIG V1R6 compliance [Orabug: 35338979]
  - Update bash condition to recognize uefi applicability [Orabug: 35338979]


author: Watson Sato <wsato@redhat.com> - 0.1.63-5
changelog:
  - Update RHEL8 STIG profile to V1R8 (RHBZ#2148446)
  - Add rule warning for sysctl IPv4 forwarding config (RHBZ#2118758)
  - Fix remediation for firewalld_sshd_port_enabled (RHBZ#2116474)
  - Fix compatibility with Ansible 2.14


author: Watson Sato <wsato@redhat.com> - 0.1.66-1
changelog:
  - Rebase to a new upstream release 0.1.66 (RHBZ#2158404)
  - Update RHEL8 STIG profile to V1R9 (RHBZ#2152658)
  - Fix levels of CIS rules (RHBZ#2162803)
  - Remove unused RHEL8 STIG control file (RHBZ#2156192)
  - Fix accounts_password_pam_unix_remember's check and remediations (RHBZ#2153547)
  - Fix handling of space in sudo_require_reauthentication (RHBZ#2152208)
  - Add rule for audit immutable login uids (RHBZ#2151553)
  - Fix remediation of audit watch rules (RHBZ#2119356)
  - Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2115343)
  - Fix applicability of kerberos rules (RHBZ#2099394)
  - Add support rainer scripts in rsyslog rules (RHBZ#2072444)


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.66-2.0.5
changelog:
  - Update STIG rule selection [Orabug: 35663552]
  - Update STIG id references so all rules in STIG profile have a STIG ID assigned
    and only those [Orabug: 35663552]
  - Add automation content for file_permission_user_init_files [Orabug: 35663552]
  - Update applicability of rules bios_enable_execution_restrictions, service_rngd_enabled
    logind_session_timeout & sysctl_kernel_kexec_load_disabled [Orabug: 35663552]
  - Fix issue when adding entries in fstab of type iso9660. When running a STIG remediation
    there were wrong entries being added to fstab when there were a cdrom mounted
    [Orabug: 35663552]
  - Update url for remote content when using --fetch-remote-resources. This frees up
    some memory due to more specific OVAL checks [Orabug: 35663552]
  - Update ssh MACs and Ciphers allowed by STIG profile [Orabug: 35663552]
  - Update references to reflect STIG V1R7 compliance [Orabug: 35663552]
  - Fix unreachable code in sssd_enable_smartcards bash remediation [Orabug: 35663552]
  - Update regex to better find included files in sshd_config [Orabug: 35663552]


author: Jan Černý <jcerny@redhat.com> - 0.1.69-1
changelog:
  - Rebase to a new upstream release 0.1.69 (RHBZ#2221695)
  - Fixed CCE link URL (RHBZ#2178516)
  - align remediations with rule description for rule configuring OpenSSL cryptopolicy (RHBZ#2192893)
  - Add rule audit_rules_login_events_faillock to STIG profile (RHBZ#2167999)
  - Fixed rules related to AIDE configuration (RHBZ#2175684)
  - Allow default permissions for files stored on EFI FAT partitions (RHBZ#2184487)
  - Add appropriate STIGID to accounts_passwords_pam_faillock_interval rule (RHBZ#2209073)
  - improved and unified OVAL checks checking for interactive users (RHBZ#2157877)
  - update ANSSI BP-028 profiles to be aligned with version 2.0 (RHBZ#2155789)
  - unify OVAL checks to correctly identify interactive users (RHBZ#2178740)
  - make rule checking for Postfix unrestricted relay accept more variants of valid configuration syntax (RHBZ#2170530)
  - Fixed excess quotes in journald configuration files (RHBZ#2169857)
  - rules related to polyinstantiated directories are not applied when building images for Image Builder (RHBZ#2130182)
  - evaluation and remediation of rules related to mount points have been enhanced for Image Builder (RHBZ#2130185)
  - do not enable FIPS mode when creating hardened images for Image Builder (RHBZ#2130181)
  - Correct URL used to download CVE checks (RHBZ#2222583)
  - mention exact required configuration value in description of some PAM related rules (RHBZ#2175882)
  - make mount point related rules not applicable when no such mount points exist (RHBZ#2176008)
  - improve checks determining if FIPS mode is enabled (RHBZ#2129100)


author: Federico Ramírez <federico.r.ramirez@oracle.com> - 0.1.69-2.0.1
changelog:
  - Update STIG rule selection [Orabug: 35663552]
  - Update ssh MACs and Ciphers allowed by STIG profile [Orabug: 35663552]
  - Update references to reflect STIG V1R7 compliance [Orabug: 35663552]
  - Fix unreachable code in sssd_enable_smartcards bash remediation [Orabug: 35663552]
  - Update regex to better find included files in sshd_config [Orabug: 35663552]
  - Fix false-negatives in sshd_use_approved_kex_ordered_stig OVAL [Orabug: 35876286]
  - Update regex in ansible for sshd_lineinfile template to take into account
    leading blank space [Orabug: 35875779]
  - Fix regex in remediation content for accounts_umask rules [Orabug: 35875779]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.69-2.0.2
changelog:
  - Update stig profiles to latest DISA standard, v1r9 for OL8 and V2r14 
    for OL7 [Orabug: 36237375]
  - Add automation content for account_password_pam_faillock_system_auth
    & account_password_pam_faillock_password_auth rules [Orabug: 36237375]
  - Make sssd rules look into /etc/sssd/conf.d/*.conf files for the desired
    configuration [Orabug: 36237375]
  - Enable OL9 content build [Orabug: 36237513]


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.72-1
changelog:
  - Rebase to a new upstream release 0.1.72 (RHEL-25250)
  - Increase CIS standards coverage regarding SSH and cron (RHEL-1314)
  - Increase compatibility of accounts_tmout rule for ksh (RHEL-16896 and RHEL-1811)
  - Align Ansible and Bash remediation in sssd_certificate_verification rule (RHEL-1313)
  - Add a warning to rule service_rngd_enabled about rule applicability (RHEL-1819)
  - Add rule to terminate idle user sessions after defined time (RHEL-1801)
  - Allow spaces around equal sign in /etc/sudoers (RHEL-1904)
  - Add remediation for rule fapolicy_default_deny (RHEL-1817)
  - Fix invalid syntax in file /usr/share/scap-security-guide/ansible/rhel8-playbook-ospp.yml (RHEL-19127)
  - Refactor ensure_pam_wheel_group_empty (RHEL-1905)
  - Prevent remediation of display_login_attempts rule from creating redundant configuration entries (RHEL-1809)
  - Update PCI-DSS to v4 (RHEL-1808)
  - Fix regex in Ansible remediation of configure_ssh_crypto_policy (RHEL-1820)


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.72-2.0.1
changelog:
  - Rebase oracle patches to 0.1.72-2 [Orabug: 36343817]
  - Add automation content for account_password_pam_faillock_system_auth
    & account_password_pam_faillock_password_auth rules [Orabug: 36237375]
  - Make sssd rules look into /etc/sssd/conf.d/*.conf files for the desired
    configuration [Orabug: 36237375]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.72-2.0.2
changelog:
  - Synchronize OL profiles with latest changes in the upstream project [Orabug: 36550633]
  - Update pci-dss update to v4 [Orabug: 36550633]
  - Update OL8 stig profile to DISA STIG V1R10 [Orabug: 36550633]


author: Jan Černý <jcerny@redhat.com> - 0.1.73-1
changelog:
  - Rebase scap-security-guide package to version 0.1.73 (RHEL-36733)
  - Change crypto policy used in the CUI profile to FIPS (RHEL-30346)
  - Fix file path identification in Rsyslog configuration (RHEL-17202)
  - Use a correct chrony server address in STIG profile (RHEL-1814)
  - Don't BuildRequire /usr/bin/python3 (RHEL-2244)


author: Armando Acosta <armando.acosta@oracle.com> - 0.1.73-1.0.1
changelog:
  - Rebase oracle patches to v0.1.73-1 [Orabug: 36702208]
  - Update OL8 to implement OL9 STIG profile to match DISA STIG draft for OL9 [Orabug: 36680605]


author: Armando Acosta <armando.acosta@oracle.com> - 0.1.73-1.0.2
changelog:
  - Update stig profile version to v2r1 for ol8 [Orabug: 36879143]
  - Add ansible remediation to
    accounts_user_dot_no_world_writable_programs
    no_tmux_in_shells 
    account_password_selinux_faillock_dir
    configure_usbguard_auditbackend [Orabug: 36879143]
  - Fix bash bug account_disable_inactivity* [Orabug: 36879143]


author: Matthew Burket <mburket@redhat.com> - 0.1.74-1
changelog:
  - Rebase to a new upstream release 0.1.74 (RHEL-53913)
  - Improve Rsyslog rules to support RainerScript syntax (RHEL-1816)
  - Update password hashing settings for ANSSI-BP-028 (RHEL-54390)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.74-3
changelog:
  - fix build
  - keep firefox and rhel8 ds-1.2 files in the package in form of symbolic links to regular ds files


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.74-3.0.1
changelog:
  - Rebase Oracle patches to 0.1.74.openela.1.0 [Orabug: 36996310]
  - Fix bash bug for rules account_disable_inactivity* [Orabug: 36879143]
  - Finish ansible implementation for OL9 STIG [Orabug: 37006303]
  - Create ISM profile for OL9 [Orabug: 37006308]
  - Hide CJIS profile in OL8 [Orabug: 36996310]


author: Matthew Burket <mburket@redhat.com> - 0.1.75-1
changelog:
  - Rebase scap-security-guide to the latest upstream version (RHEL-66153)
  - detection of Grub2 kernel command line arguments has been enhanced to cover more use cases (RHEL-53365)


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.75-1.0.1
changelog:
  - Remove rules notapplicable to OL [Orabug: 37373437]
  - Remove references to other vendors [Orabug: 37373437]
  - Add default tailoring file [Orabug: 37373453]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.75-1.0.3
changelog:
  - Update OL9 STIG alignment  [Orabug: 37556437]
  - Add CCN profile for OL9 [Orabug: 37556437]
  - Update all OL8 profiles, align STIG with V2R3 and align the others
    with upstream [Orabug: 37545300]


author: Edgar Aguilar <edgar.aguilar@oracle.com> - 0.1.76-1.0.1
changelog:
  - Update OL9 profiles [Orabug: 37763534]
  - Update bash for rules modifying sudo to allow the '/'
    character [Orabug: 37763534]
  - Support Rainerscrypt syntax in rsyslog rules [Orabug: 37763534]
  - Remove unnecesary rules from OL8 STIG [Orabug: 37763534]


author: Matthew Burket <mburket@redhat.com> - 0.1.77-1
changelog:
  - Rebase scap-security-guide to the latest upstream version 0.1.76 (RHEL-94802)
  - STIG: do not remediate rule disabling user namespaces (RHEL-76750)


author: Matthew Burket <mburket@redhat.com> - 0.1.77-1
changelog:
  - Rebase scap-security-guide to the latest upstream version 0.1.77 (RHEL-94802)
  - STIG: do not remediate rule disabling user namespaces (RHEL-76750)


author: Matthew Burket <mburket@redhat.com> - 0.1.78-1
changelog:
  - Rebase scap-security-guide to the latest upstream version 0.1.78 (RHEL-111011)
  - Rule service_rngd_enabled is now evaluated on RHEL >= 8.4 in case kernel is not in FIPS mode (RHEL-95188)
  - Use default order in rule configure_gnutls_tls_crypto_policy (RHEL-1821)
  - Renable building of bash scripts (RHEL-105501)


author: Armando Acosta <armando.acosta@oracle.com> - 0.1.78-1.0.1
changelog:
  - Update OL8 STIG to V2R5 [Orabug: 38490523]
  - Update OL9 STIG to V1R2 [Orabug: 38490523]
  - Fix accounts password pwquality and faillock behavior [Orabug: 38490523]


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 1:2.0.2-9
changelog:
  - use %{?dist} instead of %{dist} (#1725774)
  - scl-utils-build own the pkgconfig directory by %scl_files (#1431962)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 1:2.0.2-10
changelog:
  - use %__python3 instead of macro %__python (#1733526)
  - corrected unescaped per-cent character in the changelog (#1734103)


author: Daniel Kopecek <dkopecek@redhat.com> - 2.5.2-14
changelog:
  Resolves: rhbz#1689897 - Missing '--extent-only' patch
  Resolves: rhbz#1630298 - Removal of component scrub or its crypto from RHEL


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 1.11.0-1.el8
changelog:
  - Creating RHEL-8.0 initial branch based on 1.11.0
  - Resolves: bz#1515300
  - (Prepare seabios for RHEL-8.0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.12.0-1.el8
changelog:
  - Rebase to 1.12.0 [bz#1666134]
  - Resolves: bz#1666134
    (Rebase seabios for RHEL-AV release in virt:8.0.0 stream)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.12.0-3.el8
changelog:
  - seabios-rh-add-configs-for-ramfb-and-bochs-display.patch [bz#1724098]
  - Resolves: bz#1724098
    (enable device: bochs-display (seabios))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.12.0-4.el8
changelog:
  - seabios-tpm-Check-for-TPM-related-ACPI-tables-before-attempt.patch [bz#1705212]
  - seabios-usb-ehci-Clear-pipe-token-on-pipe-reallocate.patch [bz#1705212]
  - Resolves: bz#1705212
    (Backport 1.12.1 patches to RHEL-AV 8.1.0)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.12.0-5.el8
changelog:
  - seabios-add-get_keystroke_full-helper.patch [bz#1693031]
  - seabios-bootmenu-add-support-for-more-than-9-entries.patch [bz#1693031]
  - Resolves: bz#1693031
    (On systems with more than 10 available boot devices, keys are uninintuitive)


author: Jon Maloy <jmaloy@redhat.com> - 1.15.0-1.el8
changelog:
  - pci-reserve-resources-for-pcie-pci-bridge-to-fix-reg.patch [bz#2001921]
  - pci: let firmware reserve IO for pcie-pci-bridge.patch [bz#2001921]
  - Resolves: bz#2001921


author: Camilla Conte <cconte@redhat.com> - 1.15.0-2
changelog:
  - seabios-shortcut-skip-unbootable-disks-optimitation.patch [bz#1924972]
  - Resolves: bz#1924972
    (Guest whose os is installed multiple disks but boot partition is installed on single disk can't boot into OS on RHEL 8)


author: Paweł Poławski <ppolawsk@redhat.com> - 1.16.0-1
changelog:
  - Rebase to upstream 1.16 tag [bz#2066828]
  - Resolves: bz#2066828
    (rebase seabios to 1.16 release)


author: Jon Maloy <jmaloy@redhat.com> - 1.16.0-2
changelog:
  - seabios-shortcut-skip-unbootable-disks-optimitation.patch [bz#2073012]
  - seabios-pci-refactor-the-pci_config_-functions.patch [bz#2083884]
  - seabios-reset-force-standard-PCI-configuration-access.patch [bz#2083884]
  - Resolves: bz#2073012
    (Guest whose os is installed multiple disks but boot partition is installed on single disk can't boot into OS on RHEL 8 [rhel-8.7.0])
  - Resolves: bz#2083884
    (qemu reboot problem with seabios 1.16.0)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.16.0-3
changelog:
  - seabios-virtio-blk-use-larger-default-request-size.patch [bz#2101787]
  - Resolves: bz#2101787
    ([rhel.8.7] Loading a kernel/initrd is sometimes very slow)


author: Jon Maloy <jmaloy@redhat.com> - 1.16.0-4
changelog:
  - seabios-malloc-use-variable-for-ZoneHigh-size.patch [bz#2227373]
  - seabios-malloc-use-large-ZoneHigh-when-there-is-enough-memor.patch [bz#2227373]
  - Resolves: bz#2227373
    ("No bootable device" with OS boot disk interface VirtIO-SCSI and with more than 9 VirtIO disks.)


author: Robert Scheck <robert@fedoraproject.org> - 8.15.2-27
changelog:
  - Use SSL_CTX_use_certificate_chain_file() to handle intermediate
    certificates passed additionally in confSERVER_CERT (#1565341)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.15.2-30
changelog:
  - Dropped sysvinit support
    Resolves: rhbz#1610287
  - Dropped hesiod support
    Resolves: rhbz#1638491


author: Vit Mojzis <vmojzis@redhat.com> - 4.2.1-3
changelog:
  - Use 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-1
changelog:
  - SETools 4.3.0 release (#1820079)
  - Revised sediff method for TE rules. This drastically reduced memory and run time.
  - Added infiniband context support to seinfo, sediff, and apol.
  - Added apol configuration for location of Qt assistant.
  - Fixed sediff issue where properties header would display when not requested.
  - Fixed sediff issue with type_transition file name comparison.
  - Fixed permission map socket sendto information flow direction.
  - Added methods to TypeAttribute class to make it a complete Python collection.
  - Genfscon now will look up classes rather than using fixed values which
    were dropped from libsepol.
  - setools requires -console, -console-analyses and -gui packages (#1820078)


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-4
changelog:
  - Disable/remove neverallow options in frontends (#2184141)
  - AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.16-1
changelog:
  - Do not show status_icon when there's no alert (#1543758)
  - Run seapplet only on SELinux enabled system (#1541631)
  - Use context in Gio.AppInfo.launch (#1542156)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.17-1
changelog:
  - Set auto_save_interval to 5 (#1548913,#1523406,#1539180)
  - seapplet: Try send and close notifications (#1541624,#1541719,#1544222,#1539367)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.18-1
changelog:
  - Move sedispatch.conf to /etc/audit/plugins.d/
  - Fix summary and "if" text for AVCs with unknown target path


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.19-2
changelog:
  - Update "missing" scripts to automake-1.15
  - Add active polling for acquiring policy file
  - Fix translation of hex values in AVCs (#1477236, #1709742)
  - require initscripts to ensure that "service" call works properly


author: Natalya Naumova <natalya.naumova@oracle.com> - 3.3.20-2.0.1
changelog:
  - Add setroubleshoot-oracle-enterprise.patch to change bug reporting
    URL to linux.oracle.com [Orabug: 29870389]


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.21-1
changelog:
  - Use dbus.mainloop.glib.DBusGMainLoop() instead of dbus.glib
  - Fix AVC.__typeMatch to handle aliases properly
  - Handle sockets with abstract path properly (#1775135)


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.22-2
changelog:
  - Log plugin exception traceback when log level is DEBUG
  - sepolicy.info() returns a generator, not a list (#1784564)


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.23-1
changelog:
  - browser: Check return value of Gdk.Screen().get_default() (#1574434)
  - Improve and unify error messages (#1763982)
  - setroubleshoot.util: Catch exceptions from sepolicy import
  - Add dpkg support
  - Do not refer to hardcoded selinux-policy rpm in signature
  - Make date/time format locale specific (#1812674)
  - Improve speed of plugin evaluation (#1794807)
  - Do not try to report a bug on None package
  - sealert: Drop unused import slib.dbus.service
  - Drop updater.py - it's not used and doesn't work
  - root user doesn't need to use SetroubleshootPrivileged API
  - Use pydbus, a modern Python dbus API, for SetroubleshootPrivileged
  - Report bug on a package which owns the related SELinux domain (#1811644)
    https://pagure.io/setroubleshoot/issue/18
  - Add Local SELinux policy package version to analyses reports
  - setroubleshoot.utils.get_rpm_nvr_by_scontext add option to use DBUS method
  - Export setroubleshoot.utils.get_rpm_nvr_by_scontext via DBUS
  - setroubleshoot.util: get_rpm_nvr_by_type() and get_rpm_nvr_by_scontext()


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.24-1
changelog:
  - Add 'fur' into shipped locales
  - Update translations (#1820570)
  - Log full reports with correct syslog identifier
  - Cancel pending alarm during AVC analyses


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.24-2
changelog:
  - Optimize get_rpm_nvr_by_type by adding a cache (#1794807)
  - Stop building seappletlegacy (#1878792)
  - Update translations


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-1
changelog:
  - Revert "Replace pydbus with dasbus"
  - Fix typos in --help, man pages and developer's guide (#2028226)
  - Do not use Python slip package
  - Stop SetroubleshootFixit after 10 seconds of inactivity
  - Fix plugin exception reporting
  - export alert dbus signal
  - Make sure local_policy_package is not None
  - sealert: add "Last Seen" column to alert list


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-4
changelog:
  - Decrease setroubleshootd priority and limit RAM utilization to 1GB (#2064727)
  - doc: Document performance related changes


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.26-6
changelog:
  - Fix shebang of SetroubleshootPrivileged.py (#2231023)
  - Check that SELinux is enabled before running (#2178950)


author: Darren Archibald <darren.archibald@oracle.com> - 3.3.26-6.0.1
changelog:
  - Update bug reporting URLs [Orabug: 35479051]
  - Add setroubleshoot-oracle-enterprise.patch to change bug reporting
    URL to linux.oracle.com [Orabug: 29870389]


author: Petr Lautrbach <plautrba@redhat.com> 3.3.6-1
changelog:
  - Fix catchall plugin message for capability2 (#1360392)
  - Stop executing restorecon plugin on specified path prefixes (#1270778)
  - Update translations


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.7-1
changelog:
  - cvs_data: Add "fix_cmd" and enable "fix" button
  - chrome: Update "fix_cmd" and enable "fix" button
  - automount_exec_config: Update messages and enable "fix" button
  - allow_ftpd_use_*: Update messages and enable "fix" button
  - allow_execmod: Update messages and enable "fix" button
  - catchall_boolean: fix import of boolean_desc (#1444549)
  - restorecon: fix "then" text
  - Spelling fixes


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.8-1
changelog:
  - Do not split If sentences to framework and plugins - requires
    setroubleshoot 3.3.13 at least - (rhbz#1210243, rhbz#1322734, rhbz#1115510)
  - Update translations


author: Petr Lautrbach <plautrba@redhat.com> - 3.3.10-1
changelog:
  - Handle no "allowed_target_types" properly
  - bind_ports: Do not use when there are no allowed_target_types
  - Fix summary and "if" text for AVCs with unknown target path
  - plugins: Update translations


author: Edward Leung <edward.leung@oracle.com> - 3.3.10-1.0.1
changelog:
  - Add setroubleshoot-plugins-oracle-config.patch to use oracle url
  - Add setroubleshoot-plugins-oracle-po.patch to use oracle url for po


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.10-2
changelog:
  - update "file" plugin (#1649818)
  - Update "xen_image" plugin (#1649831)
  - Update qemu_blk_image and qemu_file_image (#1649838)


author: Vit Mojzis <vmojzis@redhat.com> - 3.3.12-1
changelog:
  - Use get_package_nvr* functions instead of get_rpm_nvr*
  - Update deprecated type references (#1829306)


author: Nathan Scott <nathans@redhat.com> - 0.6.2-1
changelog:
  - Switch to enabling the Java 8+ maven modules only now.
  - Add unitsofmeasurement prefix to package name.
  - Update to latest upstream sources.


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.0-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/2817510)
  - Related: #2123641


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.0-0.2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/8e09e64)
  - Related: #2123641


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.0-0.3
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/fe15a36)
  - Related: #2123641


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.0-1
changelog:
  - update to https://github.com/containers/skopeo/releases/tag/v1.11.0
    (https://github.com/containers/skopeo/commit/968670116c56023d37e9e98b48346478599c6801)
  - Related: #2123641


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.2-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.11
    (https://github.com/containers/skopeo/commit/3f98753)
  - Related: #2123641


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.2-0.4
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.11
    (https://github.com/containers/skopeo/commit/8191ef3)
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.3-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.11
    (https://github.com/containers/skopeo/commit/d79588e)
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:1.11.3-0.2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.11
    (https://github.com/containers/skopeo/commit/7e11ab4)
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:1.12.0-2
changelog:
  - rebuild for following CVEs:
  CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
  - Resolves: #2179951
  - Resolves: #2187319
  - Resolves: #2187367
  - Resolves: #2203682
  - Resolves: #2207513


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.0-2
changelog:
  - update to latest content of https://github.com/containers/skopeo/releases/tag/1.14.0
    (https://github.com/containers/skopeo/commit/6abf96bb82666fbb3d4ad9faf1812e5ae2d31a74)


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.3-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/1c2ab99)
  - Related: Jira:RHEL-2110


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.3-0.2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/d0a0f1a)
  - Resolves: RHEL-28226


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:1.14.3-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/4a2bc3a)
  - Resolves: RHEL-28226


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.3-2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/5f2b9af)
  - Resolves: RHEL-28728


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.4-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/78d9c9a)
  - Resolves: RHEL-40852


author: Jindrich Novy <jnovy@redhat.com> - 2:1.14.5-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14
    (https://github.com/containers/skopeo/commit/072072b)
  - Resolves: RHEL-40801


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.0-7
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.4
    (https://github.com/containers/skopeo/commit/ea32394)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.4
    (https://github.com/containers/skopeo/commit/130f32f)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.2-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.4
    (https://github.com/containers/skopeo/commit/01e51ce)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.1-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/fc81803)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.1-0.2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/116e75f)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.1-0.3
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/main
    (https://github.com/containers/skopeo/commit/9c9a9f3)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/540efb3)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/4336972)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-3
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/4414e52)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-4
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/f952195)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-5
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/c20c32d)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-6
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/2b16a1c)
  - Related: #2129766


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-7
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.6
    (https://github.com/containers/skopeo/commit/2b16a1c)
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 2:1.6.2-8
changelog:
  - rebuild for following CVEs:
  CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
  - Resolves: #2179946
  - Resolves: #2187316
  - Resolves: #2187362
  - Resolves: #2203679
  - Resolves: #2207508


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.2-1
changelog:
  - New upstream release
  - Update links to the upstream project page and releases
  - Use extended SSSD API to signal that an entry should not be cached anymore
  - Add support for timeout-based NSS queries with libsss_nss_idmap


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.2-3
changelog:
  - Do not build on i686 in Fedora 28 or later as 389-ds-base is not available there anymore
  - Resolves rhbz#1556448
  - Remove outdated ExclusiveArch for RHEL6


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.2-5
changelog:
  - Link with libnsl explicitly in Fedora 28 or later
  - Require libnsl2-devel for build
  - Resolves rhbz#1573636


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-1
changelog:
  - Upstream release 0.56.5
  - Resolves: rhbz#1751295: (2) When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming
  - Resolves: rhbz#1768156: ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.6-2
changelog:
  - CVE 2021-3480:  idm:DL1/slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1944713


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.6-3
changelog:
  - Resolves: rhbz#1958909 - fix regression for scoped searches in compat tree
  - Resolves: rhbz#1978189 - better handle error response from libsss_nss_idmap


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Resolves: rhbz#2121324
    Release adds following fixes:
    - Fix ID views integration
    - Fix base scope lookups
    - Bump NIS max dgram size to 8KB by default instead of 1KB
    - Allow to rebuild the compat tree


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Resolves: rhbz#1984010
    Fix ID views integration
  - Fix base scope lookups
  - Resolves: rhbz#1784172
    Bump NIS max dgram size to 8KB by default instead of 1KB
  - Resolves: rhbz#2070575
    Allow to rebuild the compat tree


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-4
changelog:
  - Ignore updates from non-tracked subtrees during modify/modrdn/update
    to avoid deadlocks with retro changelog
  - Resolves: RHEL-5134


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-4
changelog:
  - Ignore updates from non-tracked subtrees during modify/modrdn/update
    to avoid deadlocks with retro changelog
  - Resolves: RHEL-11984


author: Jindrich Novy <jnovy@redhat.com> - 0.4.0-1
changelog:
  - update to v.0.4.0
  - sync with fedora spec
  - drop applied CVE-2019-14378 patch
  - Resolves: #1766774


author: Jindrich Novy <jnovy@redhat.com> - 0.4.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/archive/v0.4.3.tar.gz
  - Related: RHELPLAN-39206


author: Jindrich Novy <jnovy@redhat.com> - 1.0.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/archive/v1.0.1.tar.gz
  - Related: RHELPLAN-39206


author: Jindrich Novy <jnovy@redhat.com> - 1.0.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/archive/v1.0.1.tar.gz
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.0
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.1
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.2
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.3
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.4-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.4
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.6-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.6
  - Related: #1888571


author: Jindrich Novy <jnovy@redhat.com> - 1.1.7-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.7
  - Related: #1888571


author: Jindrich Novy <jnovy@redhat.com> - 1.1.8-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.8
  - Related: #1888571


author: Jindrich Novy <jnovy@redhat.com> - 1.1.6-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.6
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.7-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.7
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.8-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.8
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.2.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.1
  - Related: #2176055


author: Jindrich Novy <jnovy@redhat.com> - 1.2.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.2
  - Related: Jira:RHEL-2110


author: Jindrich Novy <jnovy@redhat.com> - 1.2.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3
  - Related: Jira:RHEL-2110


author: Rajeesh K V <rajeeshknambiar@fedoraproject.org> 6.1-1
changelog:
  - New upstream release with many enhancements and bugfixes
  - Metainfo file for AppData/Software Center
  - Drop patch for Fedora bug#803234 which is fixed upstream


author: Rajeesh K V <rajeeshknambiar@fedoraproject.org> 6.1-3
changelog:
  - Updated license for AnjaliOldLipi to OFL 1.1
  - Drop the email confirmation on AnjaliOldLipi license


author: Paul Wouters <pwouters@redhat.com> - 1.7.3.2-1
changelog:
  - Resolves rhbz#1404290 socat build failure on rawhide
  - Resolves rhbz#1416597 socat-1.7.3.2 is available
  - Resolves rhbz#1417483 Failed DNS resolution causes SIGSEGV and endless loop
  - Removed obsoleted patch


author: Paul Wouters <pwouters@redhat.com> - 1.7.4.1-1
changelog:
  - Resolves: rhbz#1805132 socat does not recognize IP addresses of the SAN extensions in ssl mode
  - Resolves: rhbz#1870279 Transfer via socat fails with openssl enabled
  - Resolves: rhbz#1914989 Socat udp4-recvfrom cause endless loop error when target is not vaild


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.2.0-2
changelog:
  - Increased the level of messages that go to syslog, thus softhsm
    will no longer write on syslog when it cannot open the shared DB (#1425135)
  - Allow users in the 'ods' group to store their keys in /var/lib/softhsm/tokens/
    while at the same time disallow deleting other users' keys (using the
    sticky bit). Prevent users in the 'ods' group from writing in /var/lib/softhsm.


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.3.0-3
changelog:
  - Remove softhsm2-pk11install. Software modules are to be registered with
    p11-kit as in https://fedoraproject.org/wiki/PackagingDrafts/Pkcs11Support (#1541095).


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.6.0-1
changelog:
  - Fixes: rhbz#1818877 - rebase to softhsm 2.6.0+
  - Fixes: rhbz#1701233 - support setting supported signature methods on the token


author: Alexander Bokovoy <abokovoy@redhat.com> - 2.6.0-3
changelog:
  - Fixes: rhbz#1834909 - softhsm use-after-free on process exit
  - Synchronize the final fix with Fedora


author: Jake Hunsaker <jhunsake@redhat.com> - 1.6-3
changelog:
  - Initial RHEL 8 release based on upstream 1.6
  - Drops paramiko dependency in favor of OpenSSH ControlPersist


author: Jake Hunsaker <jhunsake@redhat.com> - 1.6-1
changelog:
  - Drop paramiko dependency, use OpenSSH ControlPersist instead
  - Layered cluster profiles can now accept base profile options
  - Debian/Ubuntu hosts now supported


author: Jake Hunsaker <jhunsake@redhat.com> - 1.7-1
changelog:
  - New upstream release
  - Overhaul mechanism of execution of sosreport in containers
  - Added RHCOS support
  - Added a 'none' cluster type


author: Jake Hunsaker <jhunsake@redhat.com> - 1.7-2
changelog:
  - Fix 'none' cluster type enablement
  - Update RHCOS image to RHEL 8 version
  - Fix execution from within a container


author: Sérgio Basto <sergio@serjux.com> - 1.9.2-1
changelog:
  - Update to 1.9.2 (#961876).
  - Modernize spec file.
  - Makefile.am handles mmx and sse flags well, so no need patch 01 and sed anymore.
  - Patch 02 disabled, I hope we already have asm fixed on X86_64.


author: Sérgio Basto <sergio@serjux.com> - 1.9.2-2
changelog:
  - Add license tag.
  - Add back sed on -O3 .
  - Not modify soundtouch_config.h because looks correct, just have one line !.


author: Gennadii Altukhov <galt@redhat.com> 2.5.1-1
changelog:
  - Adapt spacewalk-client-cert for Python 2/3 compatibility
  - Bumping package versions for 2.5.
  - Bumping package versions for 2.4.


author: Jan Dobes 2.7.1-1
changelog:
  - Updated links to github in spec files
  - Migrating Fedorahosted to GitHub
  - Bumping package versions for 2.7.
  - Bumping package versions for 2.6.


author: Tomas Kasparek <tkasparek@redhat.com> 2.8.4-4
changelog:
  - Related: #1577219 - explicitly require pygpgme (tkasparek@redhat.com)
  - Resolves: #1577219 - fix build macro for python3 (tkasparek@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.8.4-5
changelog:
  - Related: #1633532 - require python-gpg instead of python-gpgme where possible
    (tkasparek@redhat.com)
  - Resolves: #1633532 - use python-gpg instead of python-gpgme where possible
    (tkasparek@redhat.com)


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.2-1
changelog:
  - New version
  - Fixes CVE-2017-15705, CVE-2018-11780 and CVE-2018-11781
  - Resolves: rhbz#1629523
  - Resolves: rhbz#1629535
  - Resolves: rhbz#1629538


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.2-2
changelog:
  - Support systemd, not SysV init, drop initscripts requirement
  - Resolves: rhbz#1610288
  - Fix issues found by Coverity Scan
  - Resolves: rhbz#1602695


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.2-10
changelog:
  - Fixed CVE-2018-11805
  - Resolves: rhbz#1787514
  - Fixed CVE-2020-1930
  - Resolves: rhbz#1820649
  - Fixed CVE-2020-1931
  - Resolves: rhbz#1820650


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.2.0-1
changelog:
  - update to 1.2.0
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - include soname in file list
  - use license macro


author: Victor Toso <victortoso@redhat.com> - 0.38-2
changelog:
  - Brings some post releases fixes and disables celt051 that is
    deprecated in spice-protocol 0.14.2
  - Possibly related to rhbz#1688737 rhbz#1746239
    Related: rhbz#1817471
  - Fix mouse pointer on relative mouse mode
    Resolves: rhbz#1674311
  - Handle detailed errors from guest agent
    Related:  rhbz#1520393


author: Uri Lublin <uril@redhat.com> - 0.38-4
changelog:
  - Fix some static analyzer issues
    Resolves: rhbz#1839104
  - Fix spice-usbredir-redirect-on-connect
    Resolves: rhbz#1874740


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.10-1
changelog:
  - Update to 0.12.10 - Add python scripts and .proto files used
    to generate spice-gtk/spice-server marshalling C code


author: Julien Ropé <jrope@redhat.com> - 0.20.0-3
changelog:
  - Fix mouse problems in multi-monitor environments under Wayland
    Resolves: rhbz#1790904 rhbz#1824610


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-6
changelog:
  - Resolves: #1679526 - Missing detailed configuration file
  - Resolves: #1703117 - RHEL 7 to 8 fails with squid installed because dirs
    changed to symlinks
  - Resolves: #1691741 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1683527 - "Reloading" message on a fresh reboot after enabling
    squid


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-8
changelog:
  - Resolves: # 1738485 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow
    in HttpHeader::getAuth


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-9
changelog:
  - Resolves: #1738583 - CVE-2019-12525 squid:4/squid: parsing of header
    Proxy-Authentication leads to memory corruption
  - Resolves: #1828369 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828370 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-1
changelog:
  - new version 4.11
  - libsystemd integration
  - Resolves: #1829467 - squid:4 rebase
  - Resolves: #1828378 - CVE-2019-12521 squid:4/squid: off-by-one error in
    addStackElement allows for a heap buffer overflow and a crash
  - Resolves: #1828377 - CVE-2019-12520 squid:4/squid: improper input validation
    in request allows for proxy manipulation
  - Resolves: #1828375 - CVE-2019-12524 squid:4/squid: improper access restriction
    in url_regex may lead to security bypass
  - Resolves: #1820664 - CVE-2019-18860 squid: mishandles HTML in the host
    parameter to cachemgr.cgi which could result in squid behaving in unsecure way
  - Resolves: #1802514 - CVE-2020-8449 squid:4/squid: Improper input validation
    issues in HTTP Request processing
  - Resolves: #1802513 - CVE-2020-8450 squid:4/squid: Buffer overflow in a Squid
    acting as reverse-proxy
  - Resolves: #1802512 - CVE-2019-12528 squid:4/squid: Information Disclosure
    issue in FTP Gateway
  - Resolves: #1771288 - CVE-2019-18678 squid:4/squid: HTTP Request Splitting
    issue in HTTP message processing
  - Resolves: #1771283 - CVE-2019-18679 squid:4/squid: Information Disclosure
    issue in HTTP Digest Authentication
  - Resolves: #1771280 - CVE-2019-18677 squid:4/squid: Cross-Site Request Forgery
    issue in HTTP Request processing
  - Resolves: #1771275 - CVE-2019-12523 squid:4/squid: Improper input validation
    in URI processor
  - Resolves: #1771272 - CVE-2019-18676 squid:4/squid: Buffer overflow in URI
    processor
  - Resolves: #1771264 - CVE-2019-12526 squid:4/squid: Heap overflow issue in URN
    processing
  - Resolves: #1738581 - CVE-2019-12529 squid: OOB read in Proxy-Authorization
    header causes DoS


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-2
changelog:
  - Resolves: #1853130 - CVE-2020-15049 squid:4/squid: request smuggling and
    poisoning attack against the HTTP cache
  - Resolves: #1853136 - CVE-2020-14058 squid:4/squid: DoS in TLS handshake


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-3
changelog:
  - Resolves: #1871705 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1871702 - CVE-2020-15811 squid: HTTP Request Splitting could result
    in cache poisoning
  - Resolves: #1871700 - CVE-2020-15810 squid: HTTP Request Smuggling could result
    in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-4.2
changelog:
  - Resolves: #1944260 - CVE-2020-25097 squid:4/squid: improper input validation
    may allow a trusted client to perform HTTP Request Smuggling


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.11-5
changelog:
  - Resolves: #1944261 - CVE-2020-25097 squid:4/squid: improper input validation
    may allow a trusted client to perform HTTP Request Smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-2
changelog:
  - Resolves: #2006121 - SQUID shortens FTP Link wrong that contains a semi-colon
    and as a result is not able to download zip file.CODE 404 TO CLIENT)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-3
changelog:
  - Resolves: #1941506 - CVE-2021-28116 squid:4/squid: out-of-bounds read in WCCP
    protocol data may lead to information disclosure


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-5
changelog:
  - Resolves: #2130260 - CVE-2022-41318 squid:4/squid: buffer-over-read in SSPI and SMB
    authentication


author: Tomas Korbar <tkorbar@redhat.com> - 4.15-6
changelog:
  - Resolves: #2072988 - [RFE] Add the "IP_BIND_ADDRESS_NO_PORT"
    flag to sockets created for outgoing connections in the squid source code.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-8
changelog:
  - Resolves: RHEL-18351 - squid:4/squid: Buffer over-read in the HTTP Message
    processing feature (CVE-2023-49285)
  - Resolves: RHEL-18342 - squid:4/squid: Incorrect Check of Function Return
    Value In Helper Process management (CVE-2023-49286)
  - Resolves: RHEL-18230 - squid:4/squid: Denial of Service in SSL Certificate
    validation (CVE-2023-46724)
  - Resolves: RHEL-15911 - squid:4/squid: NULL pointer dereference in the gopher
    protocol code (CVE-2023-46728)
  - Resolves: RHEL-18251 - squid crashes in assertion when a parent peer exists
  - Resolves: RHEL-14794 - squid: squid multiple issues in HTTP response caching
    (CVE-2023-5824)
  - Resolves: RHEL-14803 - squid: squid: Denial of Service in HTTP Digest
    Authentication (CVE-2023-46847)
  - Resolves: RHEL-14777 - squid: squid: Request/Response smuggling in HTTP/1.1
    and ICAP (CVE-2023-46846)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-9
changelog:
  - Resolves: RHEL-19552 - squid:4/squid: denial of service in HTTP request 
    parsing (CVE-2023-50269)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10
changelog:
  - Resolves: RHEL-28529 - squid:4/squid: Denial of Service in HTTP Chunked
    Decoding (CVE-2024-25111)
  - Resolves: RHEL-26088 - squid:4/squid: denial of service in HTTP header
    parser (CVE-2024-25617)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.1
changelog:
  - Resolves: RHEL-56024 - (Regression) Transfer-encoding:chunked data is not sent
    to the client in its complementary


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.2
changelog:
  - Disable ESI support
  - Resolves: RHEL-65075 - CVE-2024-45802 squid:4/squid: Denial of Service
    processing ESI response content


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.3
changelog:
  - Resolves: RHEL-22593 - CVE-2024-23638 squid:4/squid: vulnerable to
    a Denial of Service attack against Cache Manager error responses


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.6
changelog:
  - Resolves: RHEL-84420 - A squid child process causes a memory reference error
    and the squid service terminates abnormally


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-10.9
changelog:
  - Resolves: RHEL-122484 - squid: Squid vulnerable to information disclosure via
    authentication credential leakage in error handling (CVE-2025-62168)


author: John McWalters <john.mcwalters.com> - 4.15-6.0.1
changelog:
  - Improve HTTP chunked encoding compliance (CVE-2023-46846)
  - Fix stack buffer overflow when parsing Digest Authorization (CVE-2023-46847)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-7.1
changelog:
  - Resolves: RHEL-14801 - squid: squid: Denial of Service in HTTP Digest
    Authentication
  - Resolves: RHEL-14776 - squid: squid: Request/Response smuggling in HTTP/1.1
    and ICAP


author: Tianyue Lan <tianyue.lan@oracle.com> - 7:4.15-7.5
changelog:
  - Fix squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)
  - Fix squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)
  - Fix squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)
  - Fix squid: Incorrect Check of Function Return Value In Helper Process management(CVE-2023-49286)


author: Tomas Korbar <tkorbar@redhat.com> - 7:4.15-7.3
changelog:
  - Related: RHEL-14792 - squid: squid multiple issues in HTTP response caching
  - Fix mistake in the patch


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-7.4
changelog:
  - Resolves: RHEL-16764 - squid:4/squid: Denial of Service in SSL Certificate
    validation (CVE-2023-46724)
  - Resolves: RHEL-16775 - squid:4/squid: NULL pointer dereference in the gopher
    protocol code (CVE-2023-46728)
  - Resolves: RHEL-18257 - squid crashes in assertion when a parent peer exists


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-7.5
changelog:
  - Resolves: RHEL-18483 - squid:4/squid: Buffer over-read in the HTTP Message
    processing feature (CVE-2023-49285)
  - Resolves: RHEL-18485 - squid:4/squid: Incorrect Check of Function Return
    Value In Helper Process management (CVE-2023-49286)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-7.9
changelog:
  - Resolves: RHEL-28611 - squid:4/squid: Denial of Service in HTTP Chunked
    Decoding (CVE-2024-25111)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.15-7.10
changelog:
  - Resolves: RHEL-19551 - squid:4/squid: denial of service in HTTP request
    parsing (CVE-2023-50269)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.0.23-5
changelog:
  - Resolves: #1585617 - Build against libdb only instead of libdb4
  - disabled strict checking for now (squid can not be built with GCC8)


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-1
changelog:
  - Resolves: #1656871 - squid rebase to 4.4
  - Resolves: #1645148 - CVE-2018-19131 squid: Cross-Site Scripting when
    generating HTTPS response messages about TLS errors
  - Resolves: #1645156 - CVE-2018-19132 squid: Memory leak in SNMP query
    rejection code


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-5
changelog:
  - Resolves: #1744672 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow
    in HttpHeader::getAuth


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-8.1
changelog:
  - Resolves: #1828368 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow
  - Resolves: #1828367 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1829402 - CVE-2019-12525 squid:4/squid: parsing of header
    Proxy-Authentication leads to memory corruption


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-8.2
changelog:
  - Resolves: #1872345 - CVE-2020-15811 squid:4/squid: HTTP Request Splitting
    could result in cache poisoning
  - Resolves: #1872330 - CVE-2020-15810 squid:4/squid: HTTP Request Smuggling
    could result in cache poisoning


author: Stephen Gallagher <sgallagh@redhat.com> - 2.3.3-5
changelog:
  - Autodetect the minimum key strength from the system security level.
  - Autodetect the hash algorithm to use from the system security level.
  - Disallow setting a key strength below the system minimum.
  - Resolves: rhbz#1653323


author: Stephen Gallagher <sgallagh@redhat.com> - 2.3.0-1
changelog:
  - Update to 2.3.0
  - Switch to meson build system
  - Add support for non-DNS subjectAlternativeName values (issue #4)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4.1
changelog:
  - Resolves: rhbz#2128544 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict) [rhel-8.7.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4.2
changelog:
  - Resolves: rhbz#2139871 - Analyzer: Optimize and remove duplicate messages in verbose list [rhel-8.7.0.z]
  - Resolves: rhbz#2142961 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged [rhel-8.7.0.z]
  - Resolves: rhbz#2148989 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around [rhel-8.7.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4.3
changelog:
  - Resolves: rhbz#2152883 - authenticating against external IdP services okta (native app) with OAuth client secret failed [rhel-8.7.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Craig Guiller <craig.guiller@oracle.com> - 2.8.2-3.0.2
changelog:
  - [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'. (BZ#2196838)
  - SSSD enters failed state after heavy load in the system. (BZ#2219351)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
  - Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
  - Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
  - Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
  - Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
  - Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
  - Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
  - Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
  - Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
  - Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
  - Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 2.9.1-3
changelog:
  - Resolves: rhbz#2236414 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237302 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 2.9.1-4
changelog:
  - Related: rhbz#2236414 - dbus and crond getting terminated with SIGBUS in sss_client code
    Handle all invalidations consistently
    Supply a valid pointer to `sss_mmap_cache_validate_or_reinit()`, not a pointer to a local var


author: Darren Archibald <darren.archibald@oracle.com> - 2.9.1-4.0.1.5
changelog:
  - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest (JIRA:RHEL-19212)
  - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users (JIRA:RHEL-19994)
  - SSSD GPO lacks group resolution on hosts (JIRA:RHEL-21085)
  - Make sure 8.9.z/9.3.z doesn't build 'passkey' code (JIRA:RHEL-21164)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
  - Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
  - Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
  - Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
  - Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
  - Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
  - Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
  - Resolves: RHEL-10721 - very bad performance when requesting service tickets
  - Resolves: RHEL-19011 - Invalid handling groups from child domain
  - Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
  - Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
  - Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.1
changelog:
  - Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
  - Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
  - Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
  - Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
  - Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
  - Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.2
changelog:
  - Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
  - Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
  - Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]


author: EL Errata <el-errata_ww@oracle.com> - 2.9.4-5.0.2.2
changelog:
  - Missing ntohs to service port [Orabug: 37389651]
  - Restore default debug level for sss_cache [Orabug: 32810448]


author: Alejandro López <allopez@redhat.com> - 2.9.4-5.3
changelog:
  - Resolves: RHEL-112455 - p11_child currently has an infinite timeout [rhel-8.10.z]
  - Resolves: RHEL-120292 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-8.10.z]


author: Clark Williams <williams@redhat.com> - 1.2-1
changelog:
  - utils.c: added info() functions
  - detect and correctly parse old-style /proc/sched_debug
  - src/stalld: Fix an retval check while reading sched_debug
  - src/throttling: Fix a compilation warning
  - ensure we only count task lines in old-format sched_debug info
  - Add comments, clean up trailing whitespace
  - src/utils: Fix runtime parameters check
  - stalld: Do not take actions if log_only is set
  - remove warning from parse_old_task_format


author: Clark Williams <williams@redhat.com> - 1.3-1
changelog:
  - Readme: Add information about repositories
  - Add version management and version option
  - create doc and scripts directory and add info on releases


author: Clark Williams <williams@redhat.com> - 1.4-1
changelog:
  - stalld: Set rt_runtime to -1 before trying the SCHED_DEADLINE
  - Fix incorrect recursion of specfile version field


author: Clark Williams <williams@redhat.com> - 1.7-1
changelog:
  - rework detect_task_format and buffer_size logic
  - make CFLAGS for local compile match rpmbuild CFLAGS


author: Clark Williams <williams@redhat.com> - 1.8-1
changelog:
  - Fix Readiness Protocol Mismatch with systemd
  - test01:  update to use buildin atomic operations
  - test01: add throttling check


author: Clark Williams <williams@redhat.com> - 1.9-1
changelog:
  - Set starvation threshold default to 30 seconds
  - rework read buffer allocation to properly find page size
  - Add the -g/--granularity option
  - Change the default granularity to five seconds
  - Implement idle detection
  - Implement the single-threaded mode
  - Add HRTICK_DL support


author: Clark Williams <williams@redhat.com> - 1.10-1
changelog:
  - utils: Fix bounds check on cpu and end_cpu variables
  - stalld: Support denylisting of tasks in stalld
  - src/utils: use right argument for warning printf


author: Clark Williams <williams@redhat.com> - 1.11-1
changelog:
  - redhat/stalld.spec: pick up gating test version for changelog
  - utils.c: set daemon umask to restrict global write/execute (1934586)
  - hardening fixes from coverity scan (1934590)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.12-1
changelog:
  - stalld.8: fix diff cruft left in manpage source
  - stalld.c: clean up handling of nr_running
  - stalld.c: remove duplicate parameter to fill_waiting_task() (1934582)
  - stalld.service: Run stalld as sched_fifo via systemd
  - stalld: Add error handling in get_cpu_idle_time() (1966259)
  - packaging: clean up Makefiles and rpm specfile (1972806)
  - stalld: Always print current function for info messages
  - stalld: Always print current function for warn messages
  - stalld: Always print current function for die messages
  - utils: change PATHMAX to 4096 (1934581)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.13-1
changelog:
  - stalld: Fix log message on boost_cpu_starving_vector()
  - stalld: Add the overload control to the single-threaded mode
  - stalld: Add the adaptive mode option
  - stalld: Use the last mode set in the cmdline
  - stalld: Fallback to the adaptive mode if force_fifo is selected
  - stalld: Make single-threaded mode the default one (1920041)
  - stalld.service: Always restart stalld on exit
  - utils.c: Fail if user is not root
  - utils.c: Make the path to sched_debug path dynamic (1977663)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.14.1-1
changelog:
  - stalld: Coding style cleanup
  - stalld: spaces in place of <TAB>
  - throttling: Use RT_RUNTIME_PATH in rt_throttling_is_off()
  - throttling: Check open() on turn_off_rt_throttling
  - throttling: Adjust variables in restore_rt_throttling()
  - stalld.c: utils.c: Remove complex assignments from variable declarations
  - stalld.h: Define MAX_PATH/DIR_PATH/FILE_NAME and use them
  - stalld: Adjust variables in parse_old_task_format()
  - utils.c: Use MAX_PATH for pidfile
  - stalld.c: Remove variable declaration from the middle of  the function
  - stalld: Respect -l option in single threaded mode (1983100)
  - utils: s/try_to_open_file/check_file_exists/
  - utils: use check_file_exists in setup_hr_tick()
  - utils: Check for the new sched_features path


author: Fernando Pacheco <fpacheco@redhat.com> - 1.15-1
changelog:
  - stalld: Fix incorrect open() return value checks
  - stalld: Pass errno to strerror() on sig*set() failures
  - throttling: Always null terminate sched_rt_runtime_us output
  - stalld: Remove unreachable statement in detect_task_format()
  - tests: Fix uninitialized value action.sa_mask
  - utils: Bail if malloc() returns null in parse_cpu_list()
  - stalld: Use correct format specifier for long types
    Resolves: rhbz#1990057, rhbz#1996799, rhbz#1996825


author: Fernando Pacheco <fpacheco@redhat.com> - 1.16-1
changelog:
  - stald/utils: Space, lines and voids clenaups
  - stalld: Add an option to easily set stalld as SCHED_DEADLINE
  - stalld: Comments cleanup
  - src/utils: Comments cleanup
  - src/throttling: Comments cleanup
  - src/stalld.h Comments cleanup
    Resolves: rhbz#2068549


author: Leah Leshchinsky <lleshchi@redhat.com> - 1.17.1-1
changelog:
  - stalld: Fix memory leak in print_boosted_info()
  - utils: Check if the system is in lockdown mode
  - stalld: print process comm and cpu when boosting
  Resolves: rhbz#2120800


author: Leah Leshchinsky <lleshchi@redhat.com> - 1.17.1-1
changelog:
  - stalld: Fix memory leak in print_boosted_info()
  - utils: Check if the system is in lockdown mode
  - stalld: print process comm and cpu when boosting
  Resolves: rhbz#2136559


author: Clark Williams <williams@redhat.com> - 1.1-1
changelog:
  - Fix an option in README.md; consistency in user facing docs.
  - Makefile: add 'static' target to link stalld statically
  - gitignore: ignore object files and the stalld executable
  - use FIFO for boosting (v3)
  - stalld.c: fix sched_debug parsing and modify waiting task parsing
  - redhat:  update release for features and bugfix
  - stalld: Do not die if sched_debug returns an invalid value
  - src/stalld: Do not die if the comm is too large
  - src/stalld: Do not die if cannot write a message to the log
  - src/stalld: Do not die if the main runs while a thread is monitoring the CPU
  - implement RT throttling management and refactor source files
  - more refactoring
  - src/stalld: Reuse already read nr_running nr_rt_running
  - src/stalld: Gracefully handle CPUs not found on sched_debug
  - src/stalld: Use dynamically allocated memory to read sched_debug
  - src/utils: Die with a divizion by zero if verbose
  - src/stalld: Add config_buffer_size variable
  - src/stalld: Increase the sched_debug read buffer if it gets too small
  - src/stalld: Fix an retval check while reading sched_debug
  - src/throttling: Fix a compilation warning


author: Parag Nemade <pnemade AT redhat DOT com> - 1.1.0-7
changelog:
  - Add metainfo file to show this font in gnome-software
  - Remove %clean section which is optional now
  - Remove buildroot which is optional now
  - Remove removal of buildroot in %install
  - Remove group tag


author: Dennis Keefe <dkeefe@redhat.com> - 2.0.0-2
changelog:
  - Update to 2.0.0
  - Allow the user to interact with the daemon under conditions
    where a pool, filesystem, or blockdev is not fully functional.
  - Resolves: rhbz#1730493
  - Establish an environment variable for D-Bus timeout parameter.
  - Resolves: rhbz#1678631
  - Return detailed error messages on all error-appearing user actions.
  - Resolves: rhbz#1642393
  - Resolves: rhbz#1687869
  - Exit with error code 0 and error message on stderr for all command-line
    parsing errors.
  - Resolves: rhbz#1747564
  - Show more complete error messages on D-Bus method call failures.
  - Resolves: rhbz#1717460
  - Add version numbers to required packages
  - Resolves: rhbz#1717489


author: Dennis Keefe <dkeefe@redhat.com> - 2.1.1-6
changelog:
  - Update to 2.1.1
  - Resolves: rhbz#1791472
  - Update RPM spec file
  - Resolves: rhbz#1827360
  - Error messages when creating a pool are more helpful
  - Resolves: rhbz#1734496
  - Support per-pool encryption of devices that form a pools data tier
  - Resolves: rhbz#1768580
  - Improve error handling on partial unlock failure of encrypted pools
  - Resolves: rhbz#1855520


author: Bryan Gurney <bgurney@redhat.com> - 2.4.2-1
changelog:
  - Update to 2.4.2
  - Resolves: rhbz#1931670
  - Remove requirement for python3-semantic_version
  - Resolves: rhbz#1972355
  - Remove unnecessary keyutils Requires line


author: Dennis Keefe <dkeefe@redhat.com> - 2.0.0-4
changelog:
  - Update to 2.0.0
  - Resolves: rhbz#1760906
  - Fix a bug where last update time for variable length metadata was not set
    properly on startup:
  - Resolves: rhbz#1720399
  - Specify path of PID file as "/run/stratisd.pid" instead of 
    "/var/run/stratisd.pid".
  - Resolves: rhbz#1754649
  - For a particular log entry, reduce log level from INFO to DEBUG and make the
    log message more detailed:
  - Resolves: rhbz#1680052


author: Dennis Keefe <dkeefe@redhat.com> - 2.1.0-1
changelog:
  - Update to 2.1.0
  - Resolves: rhbz#1791473
  - Update Stratis RPM Spec File
  - Resolves: rhbz#1828487
  - Support per-pool encryption of the devices that form a pool's data tier
  - Resolves: rhbz#1768580
  - Improve systemd unit file description
  - Resolves: rhbz#1756525


author: Dennis Keefe <dkeefe@redhat.com> - 2.3.0-2
changelog:
  - Update to 2.3.0
  - Resolves: rhbz#1885328
  - Stratis devices inhabit an existing root directory path
  - Resolves: rhbz#1798244
  - Add Clevis Support
  - Resolves: rhbz#1868100
  - Improve stratisd log levels
  - Resolves: rhbz#1757976


author: Bryan Gurney <bgurney@redhat.com> - 2.4.0-3
changelog:
  - Update to 2.4.0
  - Resolves: rhbz#1931671
  - Improve stratis by adding Multi-threading
  - Resolves: rhbz#1927485
  - Dump stratis configuration on demand or in debug
  - Resolves: rhbz#1735475
  - Add noalign option to XFS creation on MDV
  - Resolves: rhbz#1908318
  - Cap thinpool metadata device size at devicemapper-set limit
  - Resolves: rhbz#1707461


author: Bryan Gurney <bgurney@redhat.com> - 2.4.2-1
changelog:
  - Update to 2.4.2
  - Resolves: rhbz#1931671
  - Ensure that binaries are installed with proper features enabled
  - Split dracut modules out to subpackage
  - Add additional dependencies in dracut module


author: John Kacur <jkacur@redhat.com> - 0.15.00-1
changelog:
  - Rebase to upstream V0.15.00
  - Add the following upstream patches
  - stress-shm: move /dev/shm check to earlier in the setup phase
  - stress-shm: skip stressor if /dev/shm is not mounted with tmpfs on linux
  - stress-sysfs: check for zero sysfs entries after pruning the directory
  Resolves: rhbz#2144068


author: Richard W.M. Jones <rjones@redhat.com> - 5.1.18-4
changelog:
  - Fix supermin crash with truncated vmlinuz file (RHBZ#1477758).
  - Include all upstream patches since 5.1.18.


author: Michael Catanzaro <mcatanzaro@redhat.com> - 3.28.3-3
changelog:
  - Use autosetup so WebKitGTK patch actually gets applied, and rewrite the patch to work
    Resolves: RHEL-26699


author: Tom Stellard <tstellar@redhat.com> - 4.0.2-2
changelog:
  - Use make macros
    https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Disable Go tests


author: Bastien Nocera <bnocera@redhat.com> - 1.1-1
changelog:
  + switcheroo-control-1.1-1
  - Update to 1.1
  - Don't throw errors when the machine doesn't have dual-GPU (#1391212)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.0-2.20200828git0c238a2
changelog:
  - Backport fixes from 0.4.0 stable branch. Resolves: rhbz#1868375
    (fixes usage of swtpm-localca with passwords when signing keys)


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.4.2-1.20201201git2df14e3
changelog:
  - Update to 0.4.2, to address potential symlink vulnerabilities (CVE-2020-28407).
    Resolves: rhbz#1906043


author: Michal Sekletár <msekleta@redhat.com> - 11.7.3-2
changelog:
  - sysstat's buildsystem doesn't really use LDFLAGS, we have to merge CFLAGS and LDFLAGS to get binaries with full RELRO (#1624177)


author: <msekleta@redhat.com> - 11.7.3-7
changelog:
  - Don't trigger autofs mounts when running sadc (#2000910)
  - sar: Add missing %gnice CPU value for tickless CPU (#2000916)
  - sadf: Fix seg fault on empty data files (#1910841)
  - sar: Fix typo in manual page (#1877836)


author: psimovec <psimovec@redhat.com> - 11.7.3-11
changelog:
  - fix the arithmetic overflow in allocate_structures() that is still possible on some 32 bit systems (CVE-2023-33204)


author: Lukáš Zaoral <lzaoral@redhat.com> - 11.7.3-13
changelog:
  - fix memory allocation errors with malformed sa files (RHEL-35511)
  - reorder patches to prevent errors during their application


author: Siddhi Katage <siddhi.katage@oracle.com> - 11.7.3-13.0.2
changelog:
  - pidstat: Fix bogus %usr values in pidstat output. [Orabug: 36577834]
  - pidstat: Check if user time values are greater than guest time ones to prevent bogus values being displayed. [Orabug: 36577834]


author: sagar sagar <sagar.sagar@oracle.com> - 11.7.3-5.0.1
changelog:
  - Fixed seg fault while trying to display XML or JSON data from empty sar data files [Orabug: 32734276]


author: <msekleta@redhat.com> - 11.7.3-6
changelog:
  - Don't trigger autofs mounts when running sadc (#1954793)
  - sar: Add missing %gnice CPU value for tickless CPU (#1908996)


author: Frank Ch. Eigler <fche@redhat.com> - 4.4-2
changelog:
  - rhbz1898288: stability for exhausted UTRACE_TASK_WORK_POOL
  - rhbz1873492 related: mokutil parser robustness for RH keys


author: Stan Cox <scox@redhat.com> - 4.7-1
changelog:
  - Upstream release, see wiki page below for detailed notes.
    https://sourceware.org/systemtap/wiki/SystemTapReleases


author: Frank Ch. Eigler <fche@redhat.com> - 4.8-2
changelog:
  - rhbz2156092 = rhbz1997192
  - rhbz2145241 = rhbz2145242
  - rhbz2156093 = rhbz2149223
  - rhbz2156095 = rhbz2149666
  - rhbz2156094 = rhbz2154430


author: Gulam Mohamed <gulam.mohamed@oracle.com> - 2.1.53-2.0.2
changelog:
  - Exit only in non interactive mode on error [Orabug: 38118569]
  - Restart targetclid on post install and stop before uninstall [Orabug: 38118757]


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.6-2
changelog:
  - Splitted documentation to the doc subpackage
    Resolves: rhbz#1380291
  - Fixed whitespace
  - Dropped obsoleted defattr


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.8-2
changelog:
  - Reverted _module_build macro check which fixes systemtap probes on RHEL-8
    Resolves: rhbz#1579386


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Removing build-time dependency on sharutils(rhbz#1587877)
  - Changing git dependency to smaller git-core


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-6
changelog:
  - Resolves: #1715423 - tcpdump pre creates user and groups unconditionally
  - Resolves: #1655622 - CVE-2018-19519 Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-2
changelog:
  - Resolves: #1860216 - tcpdump can not parse mptcp options
  - Resolves: #1901635 - ppp decapsulator can be convinced to allocate a large amount of memory
  - Adding tedude test to gating


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.20.00-5
changelog:
  - Added multiple upstream patches:
      tcsh-6.20.00-004-do-not-use-old-pointer-tricks.patch
      tcsh-6.20.00-005-reset-fixes-numbering.patch
      tcsh-6.20.00-006-cleanup-in-readme-files.patch
      tcsh-6.20.00-007-look-for-tgetent-in-libtinfo.patch
      tcsh-6.20.00-008-guard-ascii-only-reversion.patch
      tcsh-6.20.00-009-fix-regexp-for-backlash-quoting-tests.patch (bug #1424082)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.20.00-2
changelog:
  - Added multiple upstream patches:
      tcsh-6.20.00-000-add-all-flags-for-gethost-build.patch
      tcsh-6.20.00-001-delay-arginp-interpreting.patch
      tcsh-6.20.00-002-type-of-read-in-prompt-confirm.patch (bug #1386129)


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-69
changelog:
  - Resolves: #1445259 - telnet won't build with latest gcc
  - added note about address resolution in manpage


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-73
changelog:
  - Resolves: #1602711 - Please review important issues found by covscan
  - Resolves: #1637085 - Option -i is missing in telnet in el8 but is available in el7


author: Parag Nemade <pnemade AT redhat DOT com> - 0.1-20
changelog:
  - Resolves:rh#921852 - Four culmus subpackages are not listed in build require
  - Added BR: and R: for the following packages
  - culmus-hadasim-clm-fonts, culmus-simple-clm-fonts
  - culmus-stamashkenaz-clm-fonts, culmus-stamsefarad-clm-fonts


author: Than Ngo <than@redhat.com> - 7:20180414-12
changelog:
  - texconfig is needed in texconfig-sys, added Requirement texlive-texconfig
  - multilib issue detected by rpmdiff
  - drop obsoleted patch for poppler-0.58
  - XML validity issue
    Related: #1602712


author: Lukáš Zaoral <lzaoral@redhat.com> - 5.2-25
changelog:
  - Fix inconsistent --map-file option spelling in manual (rhbz#2066853)
  - Fix memory corruption in tftpd when filename remapping with macro \x
    is used (rhbz#2066862)


author: Parag Nemade <pnemade AT redhat DOT com> - 0.5.0-9
changelog:
  - Add metainfo file to show this font in gnome-software
  - Remove group tag
  - Replace %define with %global


author: EL Errata <el-errata_ww@oracle.com> - 128.10.0-1.0.1
changelog:
  - Fix prefs for new nss [Orabug: 37079820]
  - Add Oracle prefs file
  - Force use of gcc-toolset-13 due to clang dependency


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: Jan Grulich <jgrulich@redhat.com> - 1.10.1-5
changelog:
  - Install the HOWTO file to correct location
  - Add /usr/bin/vncserver file informing users to read the HOWTO.md file
    Resolves: bz#1790443


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-1
changelog:
  - Update to 1.11.0
    Resolves: bz#1880985
  - Backport fix to allow Tigervnc use boolean values in config files
    Resolves: bz#1883415


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-2
changelog:
  - Revert removal of vncserver
    Resolves: bz#1897504
  - Correctly start vncsession as a daemon
    Resolves: bz#1897498


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-10
changelog:
  - Rebuild for xorg-x11-server CVEs
    Resolves: CVE-2022-4283 (bz#2154233)
    Resolves: CVE-2022-46340 (bz#2154220)
    Resolves: CVE-2022-46341 (bz#2154223)
    Resolves: CVE-2022-46342 (bz#2154225)
    Resolves: CVE-2022-46343 (bz#2154227)
    Resolves: CVE-2022-46344 (bz#2154229)


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-12
changelog:
  - xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
    Resolves: bz#2167058


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-15
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
    Resolves: bz#2180305


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-4
changelog:
  - Added vncsession-restore script for SELinux policy migration
    Fix SELinux context for root user
    Resolves: bz#2021892


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-9
changelog:
  - xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
    Resolves: bz#2167057


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-9.3
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
    Resolves: bz#2180304


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-1
changelog:
  - 1.13.1
    Resolves: bz#2175748
  - Restore "--fallbacktofreeport" option in the vncserver script
    Resolves: bz#2174398


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege
    Escalation Vulnerability
    Resolves: bz#2180306


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-4
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
    Resolves: RHEL-15236

  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15230


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-5
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18410
  - Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18422


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-7
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20388
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20382
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20530
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21214


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-9
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-30755
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30767
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-10
changelog:
  - Drop patches that are already part of xorg-x11-server
    Resolves: RHEL-30755
    Resolves: RHEL-30767
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com>
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-61999


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-15
changelog:
  - Fix CVE-2025-26594 xorg-x11-server Use-after-free of the root cursor
    Resolves: RHEL-79397
  - Fix CVE-2025-26595 xorg-x11-server Buffer overflow in XkbVModMaskText()
    Resolves: RHEL-79401
  - Fix CVE-2025-26596 xorg-x11-server Heap overflow in XkbWriteKeySyms()
    Resolves: RHEL-79386
  - Fix CVE-2025-26597 xorg-x11-server Buffer overflow in XkbChangeTypesOfKey()
    Resolves: RHEL-79380
  - Fix CVE-2025-26598 xorg-x11-server Out-of-bounds write in CreatePointerBarrierClient()
    Resolves: RHEL-79369
  - Fix CVE-2025-26599 xorg-x11-server Use of uninitialized pointer in compRedirectWindow()
    Resolves: RHEL-79364
  - Fix CVE-2025-26600 xorg-x11-server Use-after-free in PlayReleasedEvents()
    Resolves: RHEL-79360
  - Fix CVE-2025-26601 xorg-x11-server Use-after-free in SyncInitTrigger()
    Resolves: RHEL-79348


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.1
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15229


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.2
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18409
  - Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18421


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.4
changelog:
  - Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18409


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-3.5
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20432
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20420
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20583
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21252


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-3.6
changelog:
  - Don't try to get pointer position when the pointer becomes a floating device
    Resolves: RHEL-20432


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-3.7
changelog:
  - Fix use after free related to CVE-2024-21886
    Resolves: RHEL-20432
  - Fix copy/paste error in the DeviceStateNotify
    Resolves: RHEL-20583


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.8
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-31011
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30981
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30998


author: Darren Archibald <darren.archibald@oracle.com> - 1.13.1-2.4
changelog:
  - xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367)
  - xorg-x11-server: Use-after-free bug in DestroyWindow (CVE-2023-5380)
  - xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions (CVE-2023-6377)
  - xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty (CVE-2023-6478)


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-4
changelog:
  - Add option "ApproveLoggedUserOnly" allowing to connect only the user
    owning the running session
    Resolves: RHEL-91104


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-6
changelog:
  - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors
    Resolves: RHEL-97268
  - Fix CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97294
  - Fix CVE-2025-49178: xorg-x11-server: Unprocessed Client Request Due to Bytes to Ignore
    Resolves: RHEL-97364
  - Fix CVE-2025-49179: xorg-x11-server: Integer overflow in X Record extension
    Resolves: RHEL-97397
  - Fix CVE-2025-49180: xorg-x11-server: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension
    Resolves: RHEL-97232


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-7
changelog:
  - Additional fix to CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97294


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-8
changelog:
  - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation
    Resolves: RHEL-119979

  - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal
    Resolves: RHEL-120001

  - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb extension XkbSetCompatMap()
    Resolves: RHEL-120762


author: Jan Grulich <jgrulich@redhat.com> - 1.9.0-7
changelog:
  - Improve coverity scan fixes
    Resolves: bz#1602714

    Inform whether view-only password is used or not
    Resolves: bz#1639169

    Backport fixes from RHEL 7
    Resolves: bz#1651254


author: Jan Grulich <jgrulich@redhat.com> - 1.9.0-13
changelog:
  - Fix stack buffer overflow in CMsgReader::readSetCursor
    Resolves: bz#1819877

  - Fix heap buffer overflow in DecodeManager::decodeRect
    Resolves: bz#1819879

  - Fix heap buffer overflow in TightDecoder::FilterGradient
    Resolves: bz#1819882

  - Fix heap-based buffer overflow triggered from CopyRectDecoder
    Resolves: bz#1819886

  - Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
    Resolves: bz#1819884


author: Jan Grulich <jgrulich@redhat.com> - 1.9.0-14
changelog:
  - Bump build version
    Resolves: bz#1819877
    Resolves: bz#1819879
    Resolves: bz#1819882
    Resolves: bz#1819886
    Resolves: bz#1819884


author: Kirill Glebov <kgliebov@redhat.com> - 5-1
changelog:
  - Release v5. Added features and implemented fixes follow. See README.md and
    manpages for documentation of new features.
  - Implement support for --configuration option for all programs.
    The option makes the program output its configuration in JSON and then
    exit.
  - Add BuildDependencies to allow yum-builddep.
  - Open JSON writer file with euid/egid. To allow creating protected log files
    with tlog-rec-session, open the JSON writer's file with the EUID and
    GUID the program was started with.
  - Installing Packages with the APT Addon instead of apt-get.
  - Switch to using TLOG_ERRS_RAISE macros.
  - Fix tlog-play cleanup-path segfault.
  - Modify command-line option parsing.
  - Remove "fields" field from ES query URL to fix compatibility with
    Elasticsearch 5.
  - Remove unused _source parameter from ES query URL.
  - Fix tlog-rec-session file permissions bug.
  - Use CLOCK_MONOTONIC for rate-limiting writing.
  - Filter out some more input control sequences.


author: Justin Stephenson <jstephen@redhat.com> - 6-1
changelog:
  - Release v6. Added features and implemented fixes follow. See README.md and
    manpages for documentation of new features.
  - Add integration tests for end-to-end test coverage.
  - Fix compiler type comparison error with json-c json_object_array_length
    return value.
  - Fix a distribution issue causing incorrect M4_CONF_PATH expansion.
  - Log more detailed error when systemd journal is not present.


author: Justin Stephenson <jstephen@redhat.com> - 7-1
changelog:
  - Release v7
  - Allow tlog-play redirection of stdout
  - Add -i/--interactive option to tlog-rec-session. Allows login
    programs to call tlog-rec-session more transparently.
  - Make in_txt/out_txt fields optional. This handles missing fields
    when reading from Elasticsearch or other backends.


author: Justin Stephenson <jstephen@redhat.com> - 8-1
changelog:
  - Release v8
  - Spec file fixes for EL6
  - Spec file improvements for Debian/Ubuntu pkg-config
  - Tlog-play improve authentication options
  - Handle piped in I/O from stdin and improve the main recording transfer exit
    condition.
  - Use empty string on hostname resolution failure


author: Justin Stephenson <jstephen@redhat.com> - 9-1
changelog:
  - Release v9
  - Add libutempter support
  - Require journal match filter
  - Add file reader match functionality
  - Restore cursor visibility and color attributes on tlog-play exit
  - Add "time" real clock timestamp message field
  - Various upstream CI improvements


author: Justin Stephenson <jstephen@redhat.com> - 11-1
changelog:
  - Fire SIGCHLD after utempter_add_record since it probably eats it.
  - Correct suse rpmbuild
  - Update debbuild for travis CI


author: Justin Stephenson <jstephen@redhat.com> - 12-1
changelog:
  - Release v12
  - Prevent infinite transfer loop on GDM login.
  - tlog-play: add journal namespace support.
  - tlitest: extend delay for limit-action delay test.


author: Justin Stephenson <jstephen@redhat.com> - 12.1
changelog:
  - Exit transfer loop when output fd is closed
  - Revert "Prevent infinite transfer loop on GDM login"


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 1-1
changelog:
  - Release v1. Not ready for production. Following features are included.
  - Recording of user input, program output and window size changes.
  - Support for writing into syslog and files.
  - Tlog-rec configuration through system-wide configuration file
    /etc/tlog/tlog-rec.conf, environment variables and command line.
  - Very basic playback directly from ElasticSearch.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2-1
changelog:
  - Release v2. Not ready for production. Following features are added.
  - Fully-fledged command-line interface to tlog-play, along with config file
    and man pages.
  - Support for playback from file in tlog-play.
  - Make tlog-play follow mode controllable and off by default.
  - Get tlog-rec shell also from TLOG_REC_SHELL environment variable.
  - Support non-TTY stdin/stdout in tlog-rec, allowing its use with
    non-interactive SSH sessions.
  - Support building on and packaging for EPEL5.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3-1
changelog:
  - Release v3. Added features and implemented fixes follow.
  - Make each JSON message timing data start with window size.
    This makes it possible to pick up the stream from any message and also
    combine messages, with window size known and preserved at all times.
  - Add "term" field to JSON messages, specifying terminal type.
  - Add "ver" field to JSON messages, specifying message format version.
  - Set "SHELL" environment variable to actual user shell in tlog-rec.
  - Check for locale's charset and abort tlog-rec if it's anything but the only
    supported UTF-8.
  - Add -v/--version option support to tlog-rec and tlog-play.
  - Fix tlog-rec and tlog-play error output by accumulating error messages and
    outputting them only after terminal settings are restored, on exit. Output
    startup warnings before switching to raw terminal settings.
  - Output a newline after restoring terminal settings in tlog-rec and
    tlog-play, so that following output is not stuck to the end of the last line
    of the raw output.
  - Add an Elasticsearch mapping to documentation directory.
  - Disable input logging by default to avoid storing passwords. Please enable
    it explicitly in configuration, or on the command line, if necessary.
  - Close log file written by tlog-rec on executing the shell in the child to
    prevent log modification by the recorded user.
  - Support running tlog-rec SUID/SGID to prevent recorded users from killing or
    modifying it. Make tlog-rec SUID/SGID to user "tlog" in the RPM package.
  - Add session locking to tlog-rec. This prevents tlog-rec from recording if
    the audit session is already recorded by creating per-audit-session lock
    files in /var/run/tlog. This only makes sense with tlog-rec SUID/SGID.
    When certain failures occur while creating a lock file, session is assumed
    unlocked and is recorded anyway, as it is safer to record a session than
    not. Add corresponding setup to the RPM package.
  - Reproduce the recorded program (shell) exit status in tlog-rec similarly to
    how Bash reproduces the last executed command status.
  - Update and expand README.md to describe secure log message filtering with
    rsyslog, and playback directly from Elasticsearch, among other, smaller
    additions.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 4-1
changelog:
  - Release v4. Added features and implemented fixes follow. See README.md and
    manpages for documentation of new features.
  - Extract user session recording functionality from tlog-rec into a new tool:
    tlog-rec-session. It should be used as the user's login shell now, and
    tlog-rec should be used as a general recording and testing tool.
  - Add (optional) support for writing to and reading from Systemd Journal - the
    "journal" reader and writer.
  - Make tlog-rec default to "file" writer, and tlog-rec-session to "journal",
    if built with Journal support, and to "syslog" otherwise.
  - Add "-o" option to tlog-rec as an alias to "--file-path".
  - Add "-i" option to tlog-play as an alias to "--file-path".
  - Assume locale charset is UTF-8, if ASCII charset is detected, since that is
    a likely indication the locale settings were lost. E.g. upon console login
    or "su -" on Fedora and RHEL.
  - Switch the "ver" JSON field type to string. Now it should be two numbers
    separated by a dot. The increase of the first number indicates
    forward-incompatible changes, the increase of the second number -
    forward-compatible. If the dot and the second number are omitted, the second
    number is considered to be zero. Bump the format version to "2".
  - Add a new JSON field: "rec", containing an opaque host-unique recording ID.
    Bump the format version to "2.1".
  - Add support for playback controls, both through the command line and via
    playback-time control keys, including: speed adjustment, pause/resume,
    fast-forward to a time, and packet-by-packet stepping through the recording.
  - Add optional rate-limiting of logged messages. Both throttling and dropping
    messages are supported.
  - Add "--lax" option to tlog-play to allow playing back recordings with
    missing messages.
  - Fix input being ignored when there is a lot of output, while recording.
  - Remove addition of tlog-rec (tlog-rec-session) to /etc/shells from RPM
    packaging to prevent users from changing their shells themselves once it has
    been assigned.
  - Add support for specifying the shell to start via the tlog-rec-session
    executable name. E.g. by making a tlog-rec-session-shell-bin-zsh ->
    tlog-rec-session symlink and executing it. That can be used to specify
    particular shells to be recorded for specific users by assigning these
    symlinks as their login shells.
  - Make error messages from all the tools a bit less noisy and more readable.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 4-1
changelog:
  - Release v4. Added features and implemented fixes follow. See README.md and
    manpages for documentation of new features.
  - Extract user session recording functionality from tlog-rec into a new tool:
    tlog-rec-session. It should be used as the user's login shell now, and
    tlog-rec should be used as a general recording and testing tool.
  - Add (optional) support for writing to and reading from Systemd Journal - the
    "journal" reader and writer.
  - Make tlog-rec default to "file" writer, and tlog-rec-session to "journal",
    if built with Journal support, and to "syslog" otherwise.
  - Add "-o" option to tlog-rec as an alias to "--file-path".
  - Add "-i" option to tlog-play as an alias to "--file-path".
  - Assume locale charset is UTF-8, if ASCII charset is detected, since that is
    a likely indication the locale settings were lost. E.g. upon console login
    or "su -" on Fedora and RHEL.
  - Switch the "ver" JSON field type to string. Now it should be two numbers
    separated by a dot. The increase of the first number indicates
    forward-incompatible changes, the increase of the second number -
    forward-compatible. If the dot and the second number are omitted, the second
    number is considered to be zero. Bump the format version to "2".
  - Add a new JSON field: "rec", containing an opaque host-unique recording ID.
    Bump the format version to "2.1".
  - Add support for playback controls, both through the command line and via
    playback-time control keys, including: speed adjustment, pause/resume,
    fast-forward to a time, and packet-by-packet stepping through the recording.
  - Add optional rate-limiting of logged messages. Both throttling and dropping
    messages are supported.
  - Add "--lax" option to tlog-play to allow playing back recordings with
    missing messages.
  - Fix input being ignored when there is a lot of output, while recording.
  - Remove addition of tlog-rec (tlog-rec-session) to /etc/shells from RPM
    packaging to prevent users from changing their shells themselves once it has
    been assigned.
  - Add support for specifying the shell to start via the tlog-rec-session
    executable name. E.g. by making a tlog-rec-session-shell-zsh ->
    tlog-rec-session symlink and executing it. That can be used to specify
    particular shells to be recorded for specific users by assigning these
    symlinks as their login shells.
  - Make error messages from all the tools a bit less noisy and more readable.


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-36
changelog:
  - Move SSL certificates to more convenient place, update related scripts
    and README.RedHat.SSL
    Related: #1308809


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-10
changelog:
  - Resolves: #2210630 CVE-2023-28709 tomcat
  - Resolves: #2181448 CVE-2023-28708 tomcat: not including the secure attribute causes information disclosure


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-16
changelog:
  - Resolves: RHEL-12543 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
  - Remove JDK subpackges which are unused


author: Alan Steinberg <alan.steinberg@oracle.com> - 1:9.0.62-27.2
changelog:
  - Open Redirect vulnerability in FORM authentication (CVE-2023-41080)
  - FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)
  - improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)
  - incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-7
changelog:
  - Related: #2173874 Tomcat installs older java even though newer java is installed
  - Bump release number


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-28
changelog:
  - Resolves: RHEL-13907
  - Resolves: RHEL-13904
  - Resolves: RHEL-12951
  - Resolves: RHEL-12544
  - Resolves: RHEL-2386


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 1:9.0.62-5.2
changelog:
  - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
    (CVE-2023-44487)


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-16
changelog:
  - Resolves: RHEL-12543
    tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  - Remove JDK subpackges which are unused


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-27
changelog:
  - Related: RHEL-12543
    tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  - Bump release number


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-28
changelog:
  - Resolves: RHEL-13907
    tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)
  - Resolves: RHEL-13904
    tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)
  - Resolves: RHEL-12951
    tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)
  - Resolves: RHEL-12544
    tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  - Resolves: RHEL-2386
    tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-29
changelog:
  - Resolves: RHEL-17602
    tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)
  - tomcat: Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)


author: Sokratis Zappis <szappis@redhat.com> - 1:9.0.87-1.el8_10.1
changelog:
  - Resolves: RHEL-38548 - Amend tomcat package's changelog so that fixed CVEs are mentioned explicitly
  - Resolves: RHEL-35813 - Rebase tomcat to version 9.0.87
  - Resolves: RHEL-29255
    tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)
  - Resolves: RHEL-29250
    tomcat: Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.3
changelog:
  - Resolves: RHEL-82934
    tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
  - Resolves: RHEL-71708
    tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.4
changelog:
  - Resolves: RHEL-91761
    tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)
  - Resolves: RHEL-71971
    tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.5
changelog:
  - Resolves: RHEL-108486
    tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976)
  - Resolves: RHEL-108494
    tomcat: Dos in multipart upload (CVE-2025-48988)
  - Resolves: RHEL-108502
    tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  - Resolves: RHEL-108510
    tomcat: Denial of service (CVE-2025-52434)
  - Resolves: RHEL-108524
    tomcat: Denial of service (CVE-2025-52520)
  - Resolves: RHEL-108518
    tomcat: Denial of service (CVE-2025-53506)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.6
changelog:
  - Resolves: RHEL-102193
    tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.7
changelog:
  - Resolves: RHEL-124507
    tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
  - Resolves: RHEL-91743
    tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)


author: David Brown <david.brown@pnnl.gov> - 4.2.10-9
changelog:
  - Resolve dependencies for rawhide (#1308192)
  - Fix port and args environment variables for el5/6 (#1254301)


author: Honggang Li <honli@redhat.com> - 4.2.10-25
changelog:
  - Rebase to latest Fedora release
  - Fix file conflicts in torque-devel multilib packages
  - Resolve: bz1853167


author: James Cheng <james.cheng@oracle.com> - 2.10.0-15.0.1
changelog:
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Masud Khandker <masud.khandker@oracle.com> - 2.10.0-15.0.2
changelog:
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)


author: Tianyue Lan <tianyue.lan@oracle.com> - 2.10.0-15.0.3
changelog:
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.


author: James Cheng <james.cheng@oracle.com> - 2.10.0-15.0.5
changelog:
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM


author: Frank Deng <frank.deng@oracle.com> - 2.10.0-15.0.7
changelog:
  - Differ archs and x86 CPU vendors in plugin cpu
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.12.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1685585
    - sap-netweaver: changed values of kernel.shmall and kernel.shmmax to RHEL-8 defaults
      resolves: rhbz#1708418
    - sap-netweaver: changed value of kernel.sem to RHEL-8 default
      resolves: rhbz#1701394
    - sap-hana-vmware: dropped profile
      resolves: rhbz#1715541
    - s2kb function: fixed to be compatible with python3
      resolves: rhbz#1684122
    - do fallback to the powersave governor (balanced and powersave profiles)
      resolves: rhbz#1679205
    - added support for negation of CPU list
      resolves: rhbz#1676588
    - switched from sysctl tool to own implementation
      resolves: rhbz#1666678
    - realtime-virtual-host: added tsc-deadline=on to qemu cmdline
      resolves: rhbz#1554458
    - fixed handling of devices that have been removed and re-attached
      resolves: rhbz#1677730


author: Tianyue Lan <tianyue.lan@oracle.com> - 2.12.0-3.0.1
changelog:
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.13.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1738250
    - cpu: fixed checking if EPB is supported
      resolves: rhbz#1690929
    - scheduler: fixed IRQ SMP affinity verification to respect ignore_missing
      resolves: rhbz#1729936
    - realtime: enabled ktimer_lockless_check
      resolves: rhbz#1734096
    - plugins: support cpuinfo_regex and uname_regex matching
      resolves: rhbz#1748965
    - sysctl: made reapply_sysctl ignore configs from /usr
      resolves: rhbz#1759597
    - added support for multiple include directives
      resolves: rhbz#1760390
    - realtime: added nowatchdog kernel command line option
      resolves: rhbz#1767614


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.13.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1738250
    - sap-hana: updated tuning
      resolves: rhbz#1779821
    - latency-performance: updated tuning
      resolves: rhbz#1779759


author: EL Errata <el-errata_ww@oracle.com> - 2.13.0-6.0.1.el8
changelog:
  - Do not use python-dmidecode [Orabug: 30730976]
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1792264
    - oracle: turned off NUMA balancing
      resolves: rhbz#1782233
    - man: documented the possibility to apply multiple profiles
      resolves: rhbz#1794337
    - cpu-partitioning: disabled kernel.timer_migration
      resolves: rhbz#1797629
    - profiles: new profile optimize-serial-console
      resolves: rhbz#1840689
    - added support for a post-loaded profile
      resolves: rhbz#1798183
    - plugins: new irqbalance plugin
      resolves: rhbz#1784645
    - throughput-performance: added architecture specific tuning for Marvell ThunderX
      resolves: rhbz#1746961
    - throughput-performance: added architecture specific tuning for AMD
      resolves: rhbz#1746957
    - scheduler: added support for cgroups
      resolves: rhbz#1784648


author: EL Errata <el-errata_ww@oracle.com> - 2.14.0-3.0.1
changelog:
  - Updated patch with the more recent version [Orabug: 30730976]
  - Do not use python-dmidecode [Orabug: 30730976]
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-3.1
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1884544


author: Jing-Yao Chen <jing-yao.chen@oracle.com> - 2.14.0-3.0.2.el8_3.2
changelog:
  - Fix RPS/XPS and busy polling optimization not getting applied [Orabug: 32153315]
  - Fix error in uninstalling tuned [Orabug: 351528377]


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-4
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1845717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.15.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1874052
    - added plugin service for linux services control
      resolves: rhbz#1869991
    - scheduler: added default_irq_smp_affinity option
      resolves: rhbz#1896348
    - bootloader: skip boom managed BLS snippets
      resolves: rhbz#1901532
    - scheduler: added perf_process_fork option to enable processing of fork
      resolves: rhbz#1894610
    - scheduler: added perf_mmap_pages option to set perf buffer size
      resolves: rhbz#1890219
    - bootloader: fixed cmdline duplication with BLS and grub2-mkconfig
      resolves: rhbz#1777874


author: EL Errata <el-errata_ww@oracle.com> - 2.15.0-2.0.1
changelog:
  - Fix RPS/XPS and busy polling optimization not getting applied [Orabug: 32153315]
  - Fix error in uninstalling tuned [Orabug: 351528377]
  - Updated patch with the more recent version [Orabug: 30730976]
  - Set AMD CPU freq governor to ondemand when unapplying cpu tunings [Orabug: 30033199]
  - Restored the system rules in recommend.conf [Orabug: 29962987]
  - Added oci-nic profile and updated profiles-oci-recommend [Orabug: 29869969]
    for increasing combined channels to 16 on NICs with bnxt_en driver on BM
  - Do not access xps_cpus on single queue devices [Orabug: 29894296]
  - OL8 does not support System Purpose [Orabug: 29443881]
    Remove syspurpose_role option in recommend.conf.
  - Added profiles-oci-recommend package [Orabug: 29632202]
  - Modified the patch for ol8 [Orabug: 29560068] (james.cheng@oracle.com)
  - Added iscsi plugin, and
    - added oci-rps-xps profile [Orabug: 28397039]
    - added oci-busy-polling profile [Orabug: 28748149]
    - added oci-cpu-power profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.16.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1936426
    - realtime: "isolate_managed_irq=Y" should be mentioned in
      "/etc/tuned/realtime-virtual-*-variables.conf"
      resolves: rhbz#1817827
    - realtime: changed tuned default to "isolcpus=domain,managed_irq,X-Y"
      resolves: rhbz#1820626
    - applying a profile with multiple inheritance where parents include a common
      ancestor fails
      resolves: rhbz#1825882
    - failure in moving i40e IRQ threads to housekeeping CPUs from isolated CPUs
      resolves: rhbz#1933069
    - sort network devices before matching by regex
      resolves: rhbz#1939970
    - net: fixed traceback while adjusting the netdev queue count
      resolves: rhbz#1943291
    - net: fixed traceback if the first listed device returns netlink error
      resolves: rhbz#1944686
    - realtime: improve verification
      resolves: rhbz#1947858
    - bootloader: add support for the rpm-ostree
      resolves: rhbz#1950164
    - net: fixed traceback if a device channel contains n/a
      resolves: rhbz#1974071
    - mssql: updated the profile
      resolves: rhbz#1942733


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2003833
    - profiles: fix improper parsing of include directive
      resolves: rhbz#2017924
    - disk: added support for the nvme
      resolves: rhbz#1854816
    - cpu: extended cstate force_latency syntax to allow skipping zero latency
      resolves: rhbz#2002744
    - net: added support for the txqueuelen
      resolves: rhbz#2015044
    - bootloader: on s390(x) remove TuneD variables from the BLS
      resolves: rhbz#1978786
    - daemon: don't do full rollback on systemd failure
      resolves: rhbz#2011459


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#2003833
    - tuned-gui: fixed creation of new profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.19.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2057602
    - fixed parsing of inline comments
      resolves: rhbz#2060138
    - added support for quotes in isolated_cores specification
      resolves: rhbz#1891036
    - recommend: preset balanced profile for notebook, laptop or portable if
      syspurpose is not defined
      resolves: rhbz#1896717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2133814
    - systemd: relax polkit requirement
      resolves: rhbz#2065591
    - sysvinit: fixed path
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - do not exit on duplicate config lines
      resolves: rhbz#2071418
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - API: add support for moving devices between instances
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - throughput-performance: set net.core.somaxconn to at least 2048
      resolves: rhbz#1998310
    - plugin_scheduler: do not leak FDs from the perf
      resolves: rhbz#2080227
    - plugin_cpu: added support for intel_pstate scaling driver
    - added support for the API access through the Unix Domain Socket


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.21.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2182119
    - sap-hana: new profile sap-hana-kvm-guest
      resolves: rhbz#2173740
    - serialized SIGHUP handler to prevent possible bootcmdline corruption
      resolves: rhbz#2215298


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-17119
    - print all arguments of failing commands in error messages
    - plugin_sysctl: added support for sysctl names with slash
    - tuned-adm: added support for moving devices between plugin instances
    - api: added methods for retrieval of plugin instances and devices
    - plugin_cpu: amd-pstate mentioned instead of just intel_pstate
    - hotplug: do not report ENOENT errors on device remove
    - plugin_sysctl: expand variables when reporting overrides
    - plugin_acpi: new plugin which handles ACPI platform_profile
    - plugin_bootloader: skip calling rpm-ostree kargs in no-op case
    - plugin_cpu: support cstate settings of pm_qos_resume_latency_us
    - scheduler: add option for ignoring IRQs affinity
    - plugin_intel_uncore: new plugin for uncore setting


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-17119
    - lower CPU usage by using runtime=0 in profiles using scheduler plugin
      resolves: RHEL-6869


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-17119
    - renamed intel_uncore plugin to uncore
    - network-throughput: increased net.ipv4.tcp_rmem default value


author: Pavol Žáčik <pzacik@redhat.com> - 2.22.1-6
changelog:
  - Make hdparm device checks lazy
    Resolves: RHEL-71457
  - Disable the amd.scheduler plug-in instance in the postgresql profile
    Resolves: RHEL-70470


author: Wim Taymans <wtaymans@redhat.com> - 0.3.13-12
changelog:
  - Add explicit Requires for the -libs package.
  - Do NVR bump to move twolame-devel from buildroot to CRB
  - Resolves: rhbz#1843275


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018.
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds.
    - Includes two patches to deal with build issues.


author: Patsy Franklin <pfrankli@redhat.com> - 2018c-1
changelog:
  - Rebase to tzdata-2018c:
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d:
    - DST for Asia/Gaza and Asia/Hebron has changed 
      from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-1
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.
  - Include changes introduced in tzdata-2018f
    - Volgograd will change from UTC+03 to UTC+04 on 2018-10-28 at 02:00.
    - Fiji will end DST on 2019-01-13 instead of the 2019-01-20 as
      previously predicted.
    - Most of Chile will end DST on the first Saturday in April at 24:00
      and restart DST on the first Saturday in September at 24:00.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-2
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
  - Rebase to tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c - supersedes tzdata-2021b
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.
  - Includes changes in tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not -03-26.
    - zdump -v now outputs better failure information
    - fixes for code that reads corrupted TZif data


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
  - Rebase to tzdata-2022d
    - Palestine's DST transition will be on October 29, 2022,
      not October 28, 2022.
    - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Darren Archibald <darren.archibald@oracle.com> - 2024a-1.0.1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.


author: Patsy Griffin <pats@redhat.com> - 2025a-1
changelog:
  Update to tzdata-2025a (RHEL-74309)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Patsy Griffin <patsy@redhat.com> - 2025b-1
changelog:
  - Update to tzdata-2025b (RHEL-84748)
    - Chile's Aysén Region moves from -04/-03
      to -03 year-round, diverging from America/Santiago and
      creating a new zone America/Coyhaique.


author: Jiri Kucera <jkucera@redhat.com> - 2.3-2
changelog:
  - wrudf: Fix parsing Volume Descriptor Sequence
  - wrudf: Exit on allocation failure
    Related: #1882531


author: Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-1
changelog:
  - Fix capability allow rules when capabilities are specified in JSON file
  - Add additional SELinux allow rules to base container template to allow container to read proc_type types.


author: Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-3
changelog:
  - Improve capability parsing for docker containers
  - Update small changes in manpage, like issue with mandatory option '-c' for docker containers
  - Fix parsing Mountpoints in docker inspect JSON file


author: Lukas Vrabec <lvrabec@redhat.com> - 0.1.3-4
changelog:
  - Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8
  - Add check if runtimes are installed on the system


author: Lukas Vrabec <lvrabec@redhat.com> - 0.1.4-1
changelog:
  - Fix minor problems reported by pylint #11
  - Catch FileNotFoundError when inspecting containers #12
  - Create basic tests #13
  - Restore working directory #14
  - udica cannot use the container ID once it is provided #10


author: Lukas Vrabec <lvrabec@redhat.com> - 0.1.5-1
changelog:
  - Create mock selinux and semanage module
  - Update testing section in README
  - Add travis file for Travis CI
  - Grammar fixes in the udica.8 manpage file
  - Support port ranges (Resolves: #16)
  - Test port ranges


author: Jindrich Novy <jnovy@redhat.com> - 0.2.5-2
changelog:
  - New rebase https://github.com/containers/udica/releases/tag/v0.2.5 (#1995041)
  - Replace capability dictionary with str.lower()
  - Enable udica to generate policies with fifo class
  - Sort container inspect data before processing
  - Update templates to work properly with new cil parser
  - Related: #1934415


author: Richard Hughes <rhughes@redhat.com> - 0.99.5-1
changelog:
  - New upstream release
  - Add BatteryLevel property for devices with a finite number of power levels
  - Add support for pausing and resuming of the daemon poll
  - Do not spin in a loop when /proc/timer_stats cannot be written
  - Fix reading and writing the keyboard brightness level
  - Get a serial number for device batteries
  - Refresh devices after waking up from sleep
  - Lower initial power usage when iDevice isn't accessible


author: Richard Hughes <rhughes@redhat.com> - 0.99.6-1
changelog:
  - New upstream release
  - Detect joysticks as gaming input devices
  - Fix crash when '@' is present in the device name
  - Grab the model name from device if unavailable from battery


author: Bastien Nocera <bnocera@redhat.com> - 0.99.7-1
changelog:
  + upower-0.99.7-1
  - Update to 0.99.7
  - Add Bluetooth LE battery support
  - Fix critical action after resume from hibernate


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 20170801-1
changelog:
  - rebase to 20170801 version
  - removed urw-* string from subpackages
  - fontconfig priority value updated to 35
  - error messages from 'xset fp rehash' suppressed (bug #1466254)
  - AppStream files added into (sub)packages
  - fontconfig files added into (sub)packages
  - fixed fonts path during %install
  - source location updated to point at github.com


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 20170801-2
changelog:
  - urw-base35-fonts-20170801-000-split-urw-fallback.patch added
  - decrease the fontconfig priority/ordering value to 60 (bug #1494850)
  - set same priority value for urw-fallback.conf as for other files (bug #1495199)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> 20170801-3
changelog:
  - *-devel subpackage added
  - typos & syntax fixed for AppStream files
  - NimbusSansNarrow-BdOblique.* renamed to *-BoldOblique
  - *-nimbus-sans-narrow subpackage dropped
  - priority/ordering decreased [60->61]
  - ship *.otf format files as well


author: Daniel Kopeček <dkopecek@redhat.com> - 0.7.2-1
changelog:
  - Update to 0.7.2
  - Don't use --enable-werror downstream
  - Removed patches related to compiler warnings


author: Attila Lakatos <alakatos@redhat.com> - 0.7.8-4
changelog:
  - RHEL 8.3.0 ERRATUM
  - Spec file clean up
  - Rebase to 0.7.8
  Resolves: rhbz#1738590
  - Added selinux subpackage
  Resolves: rhbz#1683567
  - Added notifier subpackage
  - Installing /etc/usbguard/rules.d/
  Resolves: rhbz#1667395
  - Fixed sigwaitinfo handling
  Resolves: rhbz#1835210


author: Radovan Sroka <rsroka@redhat.com> - 0.7.8-5
changelog:
  - RHEL 8.3.0 ERRATUM
  - Use old-fasioned forking style in unit file
  Resolves: rhbz#1846885
  - Allow usbguard to read /proc/cpuinfo
  Resolves: rhbz#1847870
  - Removed notifier's Requires for usbguard-devel
  Resolves: rhbz#1667395
  - Allow usbguard to read /dev/urandom
  Resolves: rhbz#1848618


author: Radovan Sroka <rsroka@redhat.com> - 0.7.8-6
changelog:
  - RHEL 8.3.0 ERRATUM
  - Removed execstack from .spec
  - Removed AuthorizedDefault=wired from the usbguard
  Resolves: rhbz#1852539
  - Missing error message on bad configuration
  Resolves: rhbz#1857299
  - /etc/usbguard/usbguard-daemon.conf file does not contain all default options
  Resolves: rhbz#1862907


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-1
changelog:
  - Rebase to 1.0.0
  Resolves: rhbz#1887448
  - Filtering rules by attribute
  Resolves: rhbz#1873953
  - Change device policy of multiple devices using rule instead of ID
  Resolves: rhbz#1852568


author: Zoltan Fridrich <zfridric@redhat.com> - 1.0.0-8
changelog:
  - change usbguard icon injection
  - fix DSP module definition in spec file
  Resolves: rhbz#2014441
  - add execstack to spec
  - remove IPAddressDeny from usbguard service
  Resolves: rhbz#1929364
  - fix file conflict when installing usbguard on rhel
  Resolves: rhbz#1963271
  - fix IPC access control files override
  Resolves: rhbz#2004511
  - validate ACL permission existence
  Resolves: rhbz#2005020
  - decrease usbguard-notifier spam when denied connection
  Resolves: rhbz#2000000


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-10
changelog:
  - Fix unauthorized access via D-bus
  - Fix memory leaks on connection failure to D-bus
  Resolves: rhbz#2059067


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-13
changelog:
  - Set OOMScoreAdjust to -1000 in service file
  Resolves: rhbz#2159411
  - Fix race condition in usbguard-daemon when forking
  Resolves: rhbz#2159409
  - Add missing files to documentation
  Resolves: rhbz#2159412
  - Disable logging to console, logging to syslog is still enabled
  - Store permanent rules even if RuleFile is not set but RuleFolder is
  - Neither RuleFolder nor RuleFile exists bugfix
  Resolves: rhbz#2159413
  - Remove build for i686 arch
  Resolves: rhbz#2105091


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-8.2
changelog:
  - Fix unauthorized access via D-bus
  - Fix memory leak on D-bus connection failure
  Resolves: rhbz#2127848


author: Bastien Nocera <bnocera@redhat.com> - 1.1.0-13
changelog:
  + usbmuxd-1.1.0-13
  - Fix usbmuxd not starting up a second time, and properties being lost
    with kernel >= 4.12


author: Victor Toso <victortoso@redhat.com> - 0.12.0-3
changelog:
  - Fixes 100% CPU usage when usbredirect used as TCP server.
    Related: rhbz#2157521
  - Fixes USB redirection of identical devices.
    Resolves: rhbz#2157521


author: Miloslav Trmač <mitr@redhat.com> - 1.111-10
changelog:
  - Fix a FBFS with  -Werror=format-security
    Resolves #1444750
  - Fix inconsistent dates in %changelog


author: Jiri Kucera <jkucera@redhat.com> - 1.112-2
changelog:
  - Dropped need to run autotools
  - <sys/sysmacros.h> must be now included manually
    Resolves #1611752
  - Fixed bad FSF address


author: Jiri Kucera <jkucera@redhat.com> - 1.113-2
changelog:
  - Fix typo in pam-panel-icon manpage
    Do not use deprecated selinux API
    Do not use fexecve
    Resolves: #1775931


author: Matias Kreder <mkreder@gmail.com> - 1.6.2-34
changelog:
  - Removed uuid-php subpackage since php(api) is no longer provided on
  - PHP 7 and there is a replacement (pecl/uuid extension)


author: Mark Wielaard <mjw@redhat.com> - 3.14.0-2
changelog:
  - Add valgrind-3.14.0-s390x-fix-reg-alloc-vr-vs-fpr.patch.
  - Add valgrind-3.14.0-s390x-sign-extend-lochi.patch.
  - Add valgrind-3.14.0-s390x-vec-reg-vgdb.patch.
  - Add valgrind-3.14.0-s390x-vec-float-point-code.patch
    and valgrind-3.14.0-s390x-vec-float-point-tests.patch
  - Only run full regtests on x86_64 on fedora or latest rhel.


author: Mark Wielaard <mjw@redhat.com> - 3.14.0-4
changelog:
  - Add valgrind-3.14.0-get_otrack_shadow_offset_wrk-ppc.patch,
    valgrind-3.14.0-new-strlen-IROps.patch,
    valgrind-3.14.0-ppc-instr-new-IROps.patch,
    valgrind-3.14.0-memcheck-new-IROps.patch,
    valgrind-3.14.0-ppc-frontend-new-IROps.patch,
    valgrind-3.14.0-transform-popcount64-ctznat64.patch and
    valgrind-3.14.0-enable-ppc-Iop_Sar_Shr8.patch (#1532205)


author: Mark Wielaard <mjw@redhat.com>
changelog:
  - Add valgrind-3.14.0-wcsncmp.patch (#1655642)

  - Replace valgrind-3.14.0-s390x-vec-float-point-{code,test}.patch
    with upstream versions. (#1525405)


author: Mark Wielaard <mjw@redhat.com> - 3.14.0-6
changelog:
  - Add valgrind-3.14.0-final_tidyup.patch
  - Add valgrind-3.14.0-ppc64-ldbrx.patch
  - Add valgrind-3.14.0-ppc64-unaligned-words.patch
  - Add valgrind-3.14.0-ppc64-lxvd2x.patch
  - Add valgrind-3.14.0-ppc64-unaligned-vecs.patch
  - Add valgrind-3.14.0-ppc64-lxvb16x.patch
  - Add valgrind-3.14.0-set_AV_CR6.patch
  - Add valgrind-3.14.0-undef_malloc_args.patch
  - Add valgrind-3.14.0-jm-vmx-constraints.patch
  - Add valgrind-3.14.0-sigkill.patch
  - Add valgrind-3.14.0-ppc64-ptrace.patch


author: Mark Wielaard <mjw@redhat.com> - 3.17.0-5
changelog:
  - Add valgrind-3.17.0-s390-prep.patch
  - Add valgrind-3.17.0-s390-z15.patch
  - Add valgrind-3.17.0-s390-z13-vec-fix.patch


author: Mark Wielaard <mjw@redhat.com> - 3.18.1-5
changelog:
  - Add valgrind-3.18.1-dhat-tests-copy.patch
  - Add valgrind-3.18.1-s390x-EXRL.patch
  - Add valgrind-3.18.1-ppc64-lxsibzx-lxsihzx.patch
  - Add valgrind-3.18.1-ppc-pstq.patch
  - Add valgrind-3.18.1-ppc-pstq-tests.patch
  - Add valgrind-3.18.1-gdbserver_tests-hwcap.patch
  - Add valgrind-3.18.1-rust-v0-demangle.patch
  - Add valgrind-3.18.1-arm64-doubleword-cas.patch
  - Add valgrind-3.18.1-arm64-ldaxp-stlxp.patch
  - Add valgrind-3.18.1-arm64-atomic-align.patch
  - Add valgrind-3.18.1-amd64-more-spec-rules.patch
  - Add valgrind-3.18.1-condvar.patch
  - Add valgrind-3.18.1-demangle-namespace.patch


author: Mark Wielaard <mjw@redhat.com> - 3.21.0-2
changelog:
  - Upgrade to upstream 3.21.0
  - Remove upstreamed patches
  - Add valgrind-3.21.0-no-memcpy-replace-check.patch


author: Mark Wielaard <mjw@redhat.com> - 3.21.0-7
changelog:
  - Add valgrind-3.21.0-callgrind_control-no-strict.patch
  - Add valgrind-3.21.0-realloc-again.patch
  - Update valgrind-3.21.0-no-memcpy-replace-check.patch (memcpy_chk)
  - Add valgrind-3.21.0-vgm.patch and valgrind-3.21.0-vgm-tests.patch
  - Add valgrind-3.21.0-pgste.patch


author: Mark Wielaard <mjw@redhat.com> - 3.22.0-1
changelog:
  - Upstream 3.22.0 final
  - BuildRequires elfutils-debuginfod for testing
  - Remove all upstreamed patches
  - Adjust valgrind-3.16.0-some-stack-protector.patch
  - Adjust valgrind-3.16.0-some-Wl-z-now.patch
  - Add cachegrind.h to valgrind-devel package
  - Use %patch -Pn instead of deprecated %patchn


author: Mark Wielaard <mjw@redhat.com> - 3.22.0-3
changelog:
  - Split main valgrind package into several subpackages:
    - valgrind now contains just the core tools.
    - valgrind-scripts contains the post-processing scripts for callgrind,
      cachegrind, massif and dhat which depend on perl and python.
    - valgrind-gdb contains the debuginfo client/server and (v)gdb support.
    - valgrind-docs contains the man pages, html and pdf manual.
  - Adjust Requires/Recommends to subpackages can be installed independently.
    - valgrind-devel now Recommends, instead of Requires, valgrind.
    - valgrind-gdb Requires valgrind
    - valgrind-scripts Recommends valgrind-gdb
    - valgrind-gdb Recommends gdb


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 6.0.0-1
changelog:
  - New upstream release
  - Added a patch that fixes _FORTIFY_SOURCE=2 on copr/el6
  - Added a patch fixing compilation on epel6
  - Fresh checkout of pkg-varnish-cache
  - Updated find-requires sed fix to update variant and moved it to prep
  - Removed -libs subpackage
  - varnish_reload_vcl changed name to varnishreload, as in upstream
  - varnish.params is gone. To override startup configuration,
    use /etc/systemd/system/varnish.service
  - Dropped patch and sed fixes for find-provides, as it is fixed upstream
  - Dropped patch for test vsv00002, as it is fixed upstream
  - Droppet patch for python3, as it is included upstream
  - Dropped buildreq on groff, as tarball includes prebuilt manpages
  - Dropped systemv to systemd helpers
  - Updated project url
  - Use prebuilt html files for docs subpackage
  - Dropped unnecessary explicit require of initscripts, closes #1592398


author: Lubos Uhliarik <luhliari@redhat.com> - 6.0.6-2
changelog:
  - new version 6.0.6
  - Resolves: #1795673 - RFE: rebase varnish:6 to latest 6.0.x LTS
  - Resolves: #1790907 - CVE-2019-20637 varnish: not clearing pointer between two
    client requests leads to information disclosure
  - Resolves: #1763958 - CVE-2019-15892 varnish:6/varnish: denial of service 
    handling certain crafted HTTP/1 requests


author: Luboš Uhliarik <luhliari@redhat.com> - 6.0.8-1
changelog:
  - new version 6.0.8
  - Resolves: #1982862 - CVE-2021-36740 varnish:6/varnish: HTTP/2 request
    smuggling attack via a large Content-Length header for a POST request


author: Luboš Uhliarik <luhliari@redhat.com> - 6.0.8-1.1
changelog:
  - Resolves: #2047648 - CVE-2022-23959 varnish:6/varnish: Varnish HTTP/1 Request
    Smuggling Vulnerability


author: Tomas Korbar <tkorbar@redhat.com> - 6.0.8-4
changelog:
  - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487
  - CVE-2022-45060 varnish:6/varnish: Request Forgery
  - Resolves: RHEL-12814


author: Luboš Uhliarik <luhliari@redhat.com> - 6.0.13-1
changelog:
  - new version 6.0.13
  - Resolves: RHEL-30379 - varnish:6/varnish: HTTP/2 Broken Window Attack may
    result in denial of service (CVE-2024-30156)


author: Luboš Uhliarik <luhliari@redhat.com> - 6.0.13-1
changelog:
  - new version 6.0.13
  - Resolves: RHEL-30378 - varnish:6/varnish: HTTP/2 Broken Window Attack may
    result in denial of service (CVE-2024-30156)


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 5.2.1-1
changelog:
  - New upstream release. A security release
    Includes fix for CVE-2017-8807, closes 1512798, 1513523, 1513524


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 5.2.1-3
changelog:
  - Disabled running make check again. Too many timing issues. All tests run
    successfully on all arches from time to time, but seldom in a single
    run while all redhat builders are loaded.


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 5.2.1-4
changelog:
  - Disabled pcre-jit on x86_64 and arm in rawhide for now. It does not
    work, and makes other varnish dependant packages crash
    (upstream bug #2521)


author: Luboš Uhliarik <luhliari@redhat.com> - 6.0.6-2.1
changelog:
  - Resolves: #1982861 - CVE-2021-36740 varnish:6/varnish: HTTP/2 request
    smuggling attack via a large Content-Length header for a POST request


author: Luboš Uhliarik <luhliari@redhat.com> - 6.0.8-2
changelog:
  - Resolves: #2047650 - CVE-2022-23959 varnish:6/varnish: Varnish HTTP/1 Request
    Smuggling Vulnerability


author: Lubos Uhliarik <luhliari@redhat.com> - 0.15.0-1
changelog:
  - updated to newer version (0.15.0)
  - Drop EPEL and older Fedora releases support
  - Drop broken manual ABI dependency to Varnish
  - Drop commented out references to past patches
  - Verbose test suite
  - Simplified configure step
  - Dependencies cleanup


author: gil cattaneo <puntogil@libero.it> 0:1.7-18
changelog:
  - fix FTBFS rhbz#1240035
  - fix BR list, change log4j with log4j12
  - set javac source/target to 1.6
  - disable Java8doc doclint
  - remove werken-xpath Import/Export refences in manifest file
  - resolve some rpmlint problems
  - remove zero-length file
  - introduce license macro


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-17
changelog:
  - Remove ldconfig
    https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/SU3LJVDZ7LUSJGZR5MS72BMRAFP3PQQL/


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1763-2
changelog:
  - 1576470 - Suggest correct packages to get embedded interpreters working
  - add libappstream-glib for appstream-util
  - 1576483 - Vim needs Python2 to build


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-8
changelog:
  - 1640919 - augroup fedora, test case failure: /CoreOS/vim/Regression/bz241308-use-augroup-for-rh-autocmds


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16
changelog:
  - 2004974 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-8.5.0]
  - 2004891 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-8.5.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16.4
changelog:
  - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read
  - CVE-2021-4192 vim: vulnerable to Use After Free


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16.5
changelog:
  - CVE-2022-0261 vim: Heap-based Buffer Overflow in block_insert() in src/ops.c
  - CVE-2022-0318 vim: heap-based buffer overflow in utf_head_off() in mbyte.c


author: Tomas Korbar <tkorbar@redhat.com> - 2:8.0.1763-16.8
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - Resolves: rhbz#2049403


author: Tomas Korbar <tkorbar@redhat.com> - 2:8.0.1763-16.9
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - Improve fix
  - Resolves: rhbz#2049403


author: Tomas Korbar <tkorbar@redhat.com> - 2:8.0.1763-16.11
changelog:
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c
  - Fix specfile problems
  - Resolves: rhbz#2048525


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16.3
changelog:
  - 2028341 - CVE-2021-3984 vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow [rhel-8.6.0]
  - 2028430 - CVE-2021-4019 vim: heap-based buffer overflow in find_help_tags() in src/help.c [rhel-8.6.0]


author: Alex Burmashev <alexander.burmashev@oracle.com> 8.0.1763-16.0.2.13
changelog:
  - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984]
  - Cleaned up changelog entry


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-17
changelog:
  - 2016201 - CVE-2021-3872 vim: heap-based buffer overflow in win_redr_status() drawscreen.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - fix test suite after fix for CVE-2022-0318
  - CVE-2022-0359 vim: heap-based buffer overflow in init_ccline() in ex_getln.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c


author: Darren Archibald <darren.archibald@oracle.com> - 2:8.0.1763-19.0.1.2
changelog:
  - Remove upstream references [Orabug: 31197557]
  - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-19.3
changelog:
  - CVE-2022-1785 vim: Out-of-bounds Write
  - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
  - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-21
changelog:
  - RHEL-112003 CVE-2025-53905 vim: Vim path traversial
  - RHEL-112007 CVE-2025-53906 vim: Vim path traversal


author: Marek Kasik <mkasik@redhat.com> - 3.22.0-22
changelog:
  - Rebuild due to new version of FreeRDP
  - Fix an issue when RDP connection shows just black screen
  - Resolves: #1839744


author: Cole Robinson <crobinso@redhat.com> - 1.5.0-1
changelog:
  - Rebased to version 1.5.0
  - python3 prep work (Radostin Stoyanov, Cole Robinson, Cédric Bosdonnat)
  - Switch --location ISO to use isoinfo (Andrew Wong)
  - virt-install: add --cpu numa distance handling (Menno Lageman)
  - virt-install: fix --disk for rbd volumes with auth (Rauno Väli)
  - virt-install: add --cputune vcpupin handling (Wim ten Have)
  - details ui: Showing attached scsi devices per controller (Lin Ma)
  - network ui: Show details about SR-IOV VF pool (Lin Ma)
  - Greatly expand UI test suite coverage


author: Pavel Hrdina <phrdina@redhat.com> - 2.0.0-2
changelog:
  - virt-install: Fix description for --os-variant (rhbz#1649406)
  - virt-install: Add "Guest OS" options group (rhbz#1649406)
  - virt-xml: Accept --os-variant option (rhbz#1649406)
  - tests: Add some tests for virt-xml with KVM (rhbz#1649406)
  - virt-xml: Start using --os-variant (rhbz#1649406)
  - cli: s390x+graphics specified, use video=virtio (bz #1654994) (rhbz#1654994)


author: Pavel Hrdina <phrdina@redhat.com> - 2.0.0-5.1.el8
changelog:
  - cli: Fix pool=default when path belongs to another pool (bz 1692489) (rhbz#1714752)
  - tests: clitest: Add a test case for the last commit (rhbz#1714752)
  - domcapabilities: introduce get_cpu_security_features (rhbz#1716402)
  - domain: cpu: introduce set_model function (rhbz#1716402)
  - domain: cpu: automatically add CPU security features for "custom" mode (rhbz#1716402)
  - domcapabilities: remove recommended CPU features from security features (rhbz#1716402)
  - domcapabilities: fix typo in function name (rhbz#1716402)
  - cli: introduce CPU secure parameter (rhbz#1716402)
  - domcapabilities: add caching of CPU security features (rhbz#1716402)
  - virt-manager: add new checkbox to control CPU security features (rhbz#1716402)
  - DomainCpu: fix detection of CPU security features (rhbz#1716402)
  - DomainCpu: check CPU model name only if model exists (rhbz#1716402)
  - domcapabilities: detect MDS new vulnerability (rhbz#1716402)
  - cli: fix cpu secure option to actually work (rhbz#1716402)


author: Pavel Hrdina <phrdina@redhat.com> - 2.2.0-1
changelog:
  - Rebased to virt-manager-2.2.0 (rhbz#1721001)
  - The rebase also fixes the following bugs:
      rhbz#1718065, rhbz#1714304, rhbz#1709857, rhbz#1707379, rhbz#1700354
      rhbz#1692489, rhbz#1690687, rhbz#1690685, rhbz#1683609, rhbz#1679018
      rhbz#1677019, rhbz#1671599, rhbz#1667025, rhbz#1666597, rhbz#1663430
      rhbz#1661867, rhbz#1660467, rhbz#1660123, rhbz#1659354, rhbz#1658511
      rhbz#1648939, rhbz#1599139, rhbz#1508147, rhbz#1501608
  - spec: add build dependencies that are now required for build (rhbz#1721001)


author: Pavel Hrdina <phrdina@redhat.com> - 2.2.0-2
changelog:
  - xmleditor: Handle gtksourceview3 as well as gtksourceview4 (rhbz#1722820)
  - xmleditor: Fix the gtksource version checking (rhbz#1722820)
  - spec: add gtksourceview3 dependency introduced by upstream (rhbz#1722820)


author: Pavel Hrdina <phrdina@redhat.com> - 2.2.1-1
changelog:
  - Rebased to virt-manager-2.2.1 (rhbz#1726535)
  - The rebase also fixes the following bugs:
      rhbz#1727881, rhbz#1724287, rhbz#1727811
  - spec: add gtksourceview3 dependency introduced by upstream (rhbz#1722820)
  - guest: fix warning message when machine type is changed for secure boot (rhbz#1727811)


author: Pavel Hrdina <phrdina@redhat.com> - 2.2.1-3
changelog:
  - guest: Drop set_capabilities_defaults call from get_uefi_path (rhbz#1753644)
  - devices: video: Simplify model hvm check (rhbz#1753644)
  - domcapabilities: Get video devices (rhbz#1753644)
  - domcapabilities: Add supports_video_bochs() (rhbz#1753644)
  - video: Prefer "bochs" when it's supported. (rhbz#1753644)
  - addhardware: Add "bochs" display to the video list (rhbz#1753644)
  - osdict: Always return the most generic tree (rhbz#1749865)
  - osdict: Choose the most appropriate tree when a profile is set (rhbz#1749865)


author: Pavel Hrdina <phrdina@redhat.com> - 2.2.1-4
changelog:
  - virt-install: Use minutes instead of seconds on get_time_string() (rhbz#1777664)
  - details: Fix showing the firmware type in case of firmware auto selection (rhbz#1857069)
  - details: fix detection of firmware auto-selection (rhbz#1857069)
  - domain: Fix VM deletion with firmare='efi' (rhbz#1869135)
  - virt-xml: fix defined_xml_is_unchanged (rhbz#1857504)


author: Jonathon Jongsma <jjongsma@redhat.com> - 3.2.0-1
changelog:
  - Rebased to virt-manager-3.2.0 (rhbz#2009080)
  - The rebase also fixes the following bugs:
      rhbz#2001794
  - cli: introduce --resource fibrechannel.appid option (rhbz#2011327)
  - virt-install: add mediated device (rhbz#1995125)
  - virt-xml: add support for mediated devices (rhbz#1995125)
  - hostdev: use method get_mdev_uuid() (rhbz#1995125)
  - tests: verify MDEV support (rhbz#1995125)
  - virt-manager: enable MDEV support (rhbz#1995125)
  - Handle new nodedev name for mediated devices (rhbz#2020241)


author: Pavel Hrdina <phrdina@redhat.com> - 3.2.0-4.1.el8_10
changelog:
  - cli: Add basic --audio type=XXX,id=Y support (RHEL-17435)
  - virtinst: unify detection of duplicate console when removing device (RHEL-17435)
  - virtinst: fix compare for audio devices (RHEL-17435)
  - testsuite: add test-spice vm definition (RHEL-17435)
  - virtinst: remove spice devices when removing last spice graphics (RHEL-17435)
  - guest: add convert_to_vnc() (RHEL-17435)
  - guest: remove spiceport devices when spice is removed (RHEL-17435)
  - guest: convert_to_vnc: convert video device (RHEL-17435)
  - virt-xml: Add `--edit --convert-to-vnc` (RHEL-17435)


author: Pino Toscano <ptoscano@redhat.com> - 1:1.42.0-4
changelog:
  - Copy %description also for the source, so tools are less confused
    about it.
  - Fix the "extra" addition to the version to refer to rhel.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.8-37
changelog:
  - Fix "Input/output error" in journal
    resolves: rhbz#2149139
  - Store the patches in an upstream branch in git.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-11
changelog:
  - v2v: windows: Allow qxldod.inf as synonym for qxl.inf
    resolves: rhbz#1926102
  - v2v: Increase required free space in Windows to 100 MB
    resolves: rhbz#1949147
  - docs: Document how to remove "Out of HTTP sessions" limit
  - v2v: Disable readahead for VMware curl sources too
    resolves: rhbz#1848862
  - v2v: Allow output to block devices
    resolves: rhbz#1868690
  - docs: -o openstack: Clarify name of file containing OpenStack auth
    resolves: rhbz#1871754
  - docs: UEFI guest conversion to -o openstack is supported
    resolves: rhbz#1872100
  - v2v: Turn pnp_wait.exe warning into a debug message
    resolves: rhbz#1903960
  - v2v: windows: Fix schtasks /SD parameter
    resolves: rhbz#1895323


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-13
changelog:
  - docs: Fix version of virt-v2v which added UEFI for OpenStack
    related: rhbz#1872100
  - v2v: Increase Linux minimum root filesystem to 100 MB
    resolves: rhbz#1764569


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-17
changelog:
  - Correct regexps used to fix schtasks command
  - Fix backing file specified without backing format
    resolves: rhbz#2023279, rhbz#2025769


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-21
changelog:
  - Fix assertion failure when parsing OVA dir with trailing slash
    resolves: rhbz#2028823
  - For -o rhv-upload wait for VM creation task
    resolves: rhbz#1985827
  - If listing RPM applications fails, rebuild DB and retry (2089623)
  - Fix CVE-2022-2211 Denial of Service in --key parameter
    resolves: rhbz#2102720


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.42.0-22
changelog:
  - RHEL 8: If setfiles fails fall back to autorelabel
    resolves: rhbz#XXX
  - Reapply patches since we are using git format-patch --submodule=diff


author: Uri Lublin <uril@redhat.com> - 9.0-5
changelog:
  - More specific key accelerator description for cursor release
    Resolves: rhbz#1548371
  - Report detailed error when file transfer fails
    Resolves: rhbz#1753563
  - Update copyright year in "about ui"
    Resolves: rhbz#1848267
  - Show an error dialog upon vnc-error
    Resolves: rhbz#1448151
  - Fix warning by Coverity
    Resolves: rhbz#1876719


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 9.0-1
changelog:
  - Rebase to latest upstream
    Resolves: rhbz#1837489
  - Do not filter out DATA storage domains
    Resolves: rhbz#1835640


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.3.9-16
changelog:
  - Python 2 binary package renamed to python2-volume_key
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Jiri Kucera <jkucera@redhat.com>
changelog:
  - fixed License
  - Requires: /usr/bin/gpg2 in libs subpackage
  - Added support for opening all types of LUKS devices
    Resolves: #1626974


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.3-25
changelog:
  - Add config option log_die allowing to pass error messages to syslog
  - Add config option bind_retries allowing to change the max number
  - of attempts to find a listening port for the PASV/EPSV command
  - Resolves: rhbz#1318198


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.3-32
changelog:
  - Removed a hint about the ftp_home_dir SELinux boolean from the config file
  - Resolves: rhbz#1623424


author: Artem Egorenkov <aegorenk@redhat.com> - 3.0.3-33
changelog:
  - Enable support for wide-character strings in logs
  - Replace unprintables with HEX code, not question marks
  - Resolves: rhbz#1947900


author: José Expósito <jexposit@redhat.com> - 1.3.283.0-3
changelog:
  - Provides/Obsoletes vulkan-validation-layers-devel
    Resolves: https://issues.redhat.com/browse/RHEL-54290


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.30.2-2
changelog:
  - Try to fix coverity build by disabling docs (thanks to Kamil Dudka <kdudka@redhat.com>!)
  - Related: #1883304


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.1-1
changelog:
  - Update to 2.36.1
    Related: #2061994
  - Resolves: #2075492
  - Resolves: #2075494
  - Resolves: #2075496


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1.4
changelog:
  - Add patch for CVE-2023-28204
    Resolves: #2209744
  - Add patch for CVE-2023-32373
    Resolves: #2209727


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.5-1
changelog:
  - Upgrade to 2.40.5. Also, disable JIT
    Resolves: #2176269
    Resolves: #2185742
    Resolves: #2209728
    Resolves: #2209745
    Resolves: #2218649
    Resolves: #2218651
    Resolves: #2224611


author: Brian C. Lane <bcl@redhat.com> - 35.5-1
changelog:
  - New release: 35.5 (bcl)
    Resolves: rhbz#2052604
  - docs: Explain how to undo blueprints delete (bcl)
  - test: server status no longer returns devel (bcl)
  - Use GetFrozenBlueprintsTOML for blueprints freeze save (bcl)
  - Add a test for float uid/gid in frozen blueprint (bcl)
  - Use GetBlueprintsTOML for blueprints save (bcl)
  - test: Add a test for float uid/gid in saved blueprint (bcl)
  - build(deps): bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0 (49699333+dependabot[bot])
  - tests: trigger on push to main (jrusz)
  - build(deps): bump github.com/spf13/cobra from 1.2.1 to 1.3.0 (49699333+dependabot[bot])
  - ci: add keystore for sonarqube (jrusz)
  - spec: Switch to using %gobuild macro on Fedora (bcl)
  - ci: change workflow name (jrusz)
  - ci: add gitlab-ci and sonarqube (jrusz)
  - doc: fix example links from the README (tdecacqu)
  - build(deps): bump actions/checkout from 2.3.4 to 2.4.0 (49699333+dependabot[bot])
  - ci: Enable Coverity Scan tool (atodorov)


author: Brian C. Lane <bcl@redhat.com> - 35.9-1
changelog:
  - Copy rhel-88.json test repository from osbuild-composer
  - Update osbuild-composer test repositories from osbuild-composer
  - New release: 35.9 (bcl)
    Resolves: rhbz#2168666
  - tests: Replace os.MkdirTemp with t.TempDir (bcl)
  - blueprint save: Allow overriding bad blueprint names (bcl)
  - tests: Clean up checking err in tests (bcl)
  - composer-cli: Implement blueprints diff (bcl)
  - saveBlueprint: Return the filename to the caller (bcl)
  - composer-cli: Add tests for using --commit with old servers (bcl)
  - weldr: Return error about the blueprints change route (bcl)
  - weldr: Save the http status code as part of APIResponse (bcl)
  - Add --commit support to blueprints save (bcl)
  - Add --commit to blueprints show (bcl)
  - gitleaks: Exclude the test password used in tests (bcl)
  - ci: add tags to AWS instances (tlavocat)
  - Update github.com/BurntSushi/toml to 1.2.1
  - Update github.com/stretchr/testify to 1.8.1
  - Update bump github.com/spf13/cobra to 1.6.1
  - New release: 35.8 (bcl)
  - completion: Remove providers from bash completion script (bcl)
  - completion: Filter out new headers from compose list (bcl)
  - docs: Remove unneeded Long descriptions (bcl)
  - docs: Use a custom help template (bcl)
  - docs: Add more command documentation (bcl)
  - cmdline: Add package glob support to modules list command (bcl)
  - workflow: Add govulncheck on go v1.18 (bcl)
  - tests: Update to use golangci-lint 1.49.0 (bcl)
  - New release: 35.7 (bcl)
  - spec: Move %gometa macro above %gourl (bcl)
  - weldr: When starting a compose pass size as bytes, not MiB (bcl)
  - tests: Use correct size value in bytes for test (bcl)
  - workflow: Add Go 1.18 to text matrix (bcl)
  - Replace deprecated ioutil functions (bcl)
  - New release: 35.6 (bcl)
  - tests: Update tests for osbuild-composer changes (bcl)
  - CMD: Compose status format (eloy.coto)
  - CMD: Compose list format (eloy.coto)
  - tests: Update tests to check for JSON list output (bcl)
  - composer-cli: Change JSON output to be a list of objects (bcl)
  - weldr: Simplify the old ComposeLog, etc. functions (bcl)
  - composer-cli: Add --filename to blueprints freeze save command (bcl)
  - composer-cli: Add --filename to blueprints save command (bcl)
  - composer-cli: Add --filename to compose logs command (bcl)
  - composer-cli: Add --filename to compose image command (bcl)
  - composer-cli: Add --filename to compose metadata command (bcl)
  - composer-cli: Add --filename to compose results command (bcl)
  - weldr: Add saving to a new filename to GetFilePath function (bcl)
  - github: Fix issue with codecov and forced pushes in PRs (bcl)
  - Use golangci-lint 1.45.2 in workflow (bcl)
  - Run workflow tests for go 1.16.x and 1.17.x (bcl)
  - Move go.mod to go 1.16 (bcl)
  - workflows/trigger-gitlab: run Gitlab CI in new image-builder project (jrusz)
  - Update GitHub actions/setup-go to 3
  - Update GitHub actions/checkout to 3


author: Brian C. Lane <bcl@redhat.com> - 35.12-1
changelog:
  - Copy rhel-8.10.json test repository from osbuild-composer
  - New release: 35.12 (bcl)
    Resolves: RHEL-1770
  - Add support for compose start warning messages (bcl)
  - Update documentation urls for new locations (bcl)
  - weldr: go fmt changes to a couple comments (bcl)
  - weldr: Update ostree test for parentid with no url (bcl)
  - Makefile: Turn off seccomp for build-in-podman (bcl)
  - composer-cli: Update doc links (simon.steinbeiss)
  - docs: fix typo/formatting in HACKING.md (idiez)
  - Add release creation documentation (bcl)
  - spec: Require createrepo_c for weldr-client-tests package (bcl)
  - spec: migrate the license field to SPDX (ondrej)
  - Go: Switch to go 1.19 (bcl)
  - CI: Update terraform hash (bcl)
  - Actions: add workflow for marking and closing stale issues and PRs (thozza)
  - workflows: Stop using golint (bcl)
  - workflows: Add Go 1.21 and 1.22 to test matrix (bcl)
  - workflows: Update to golangci-lint 1.56.2 (bcl)
  - workflow: Ignore govulncheck failures (bcl)
  - workflow: Switch to testing on go 1.18, 1.19, 1.20 (bcl)
  - build(deps): bump actions/setup-go from 3 to 5 (49699333+dependabot[bot])
  - build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.8.0 (49699333+dependabot[bot])
  - build(deps): bump actions/checkout from 3 to 4 (49699333+dependabot[bot])
  - build(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 (49699333+dependabot[bot])
  - build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.4 (49699333+dependabot[bot])


author: Brian C. Lane <bcl@redhat.com> - 35.12-3
changelog:
  - Update test repository snapshot urls rhel 8.10 and remove cs8 repos
    The snapshots for cs8 have been removed from the service
  - Rebuild for CVE-2025-22871
    Resolves: RHEL-89289


author: Michal Ruprich <mruprich@redhat.com> - 1:2.6.2-7
changelog:
  - Resolves: #1642919 - CVE-2018-12086, CVE-2018-18225, CVE-2018-18226, CVE-2018-18227
  - Resolves: #1656342 - CVE-2018-19623
  - Resolves: #1657634 - CVE-2018-19625
  - Resolves: #1657211 - CVE-2018-19626
  - Resolves: #1657184 - CVE-2018-19627
  - Resolves: #1657190 - CVE-2018-19628
  - fixes CVE-2018-19622, CVE-2018-19624


author: Michal Ruprich <mruprich@redhat.com> - 1:2.6.2-15
changelog:
  - Resolves: #2119126 - Wireshark source rpm fails to build due to looking for incorrect libssh header files


author: Michal Ruprich <mruprich@redhat.com> - 1:2.6.2-16
changelog:
  - Resolves: #2210866 - VMS TCPIPtrace file parser crash
  - Resolves: #2210867 - NetScaler file parser crash
  - Resolves: #2210869 - RTPS dissector crash


author: Michal Ruprich <mruprich@redhat.com> - 1:2.6.2-1
changelog:
  - New version 2.6.2
  - Contains fixes for CVE-2018-14339, CVE-2018-14340, CVE-2018-14341, CVE-2018-14342, CVE-2018-14343, CVE-2018-14344, CVE-2018-14367, CVE-2018-14368, CVE-2018-14369, CVE-2018-14370


author: Tomas Popela <tpopela@redhat.com> - 1.6.0-5
changelog:
  - Drop PipeWire 0.2 requirement as Chrom[e|ium] 90 now depends on PipeWire 0.3
  - Resolves: rhbz#1949809


author: Jonas Ådahl <jadahl@redhat.com> - 1.6.0-1
changelog:
  - Rebase to 1.6.0 (#1837413)
  - Bump supported Mutter screen cast API version (#1837413)
  - Backport bugfix (#1837413)


author: Debarshi Ray <rishi@fedoraproject.org> - 1.8.0-1
changelog:
  - Rebase to 1.8.0
  - Remove unnecessary non-arch-specific explicit library Requires
  Resolves: #2062432


author: Rex Dieter <rdieter@fedoraproject.org> 1.1.1-4
changelog:
  - save mimetype defaults to ~/.config/mimeapps.list
    (instead of ~/.local/share/applications/mimeapps.list)


author: Peter Hutterer <peter.hutterer@redhat.com> 2.24-3
changelog:
  - Remove high-keycode removal patches, xkbcomp 1.4.2 has been in stable for
    long enough (related #1587998)


author: Ville Skyttä <ville.skytta@iki.fi> - 0:1.2-15
changelog:
  - Use %jpackage_script to generate scripts.
  - Add OSGi metadata to manifest instead of discarding everything else in it.
  - Drop dependency on xml-commons-api, add one on java(-headless).
  - Crosslink javadocs with Java's.
  - Include NOTICE* in docs.
  - Update URLs.
  - Specfile cleanups.


author: Ondrej Vasik <ovasik@redhat.com> 0.0.27-1
changelog:
  - New version 0.0.27
  - remove several bashisms in scripts
  - add new option --profile for preprocessing documents
    with profiling stylesheet
  - fix several potential crashes in xmlif (found by static analysis)


author: Simone Caronni <negativo17@gmail.com> - 1.7.1-1
changelog:
  - Update to 1.7.1.
  - Skip PDF document generation through fop. It fixes FTBFS on Fedora 22. Tarball
    is not yet compatible with Fedora xmlgraphics-commons >= 2.0.
  - Remove useless db files.


author: Adam Jackson <ajax@redhat.com> - 1.7.1-5
changelog:
  - Drop BuildRequires: java-devel. Originally that was to force a specific
    JDK version, which we no longer need to do.


author: Hans de Goede <hdegoede@redhat.com> - 7.7-18
changelog:
  - Drop xorg-x11-drv-vmmouse there is a kernel driver for this which makes the
    device show up as a regular evdev input device now, and which does not need
    iopl


author: Michel Dänzer <mdaenzer@redhat.com> - 19.1.0-1
changelog:
  - ati 19.1.0 (#1728818)
  - Drop patch 0001-Don-t-set-up-black-scanout-buffer-if-LeaveVT-is-call.patch,
    merged upstream
  - Add patches 0001-Handle-NULL-fb_ptr-in-pixmap_get_fb.patch &
    0002-Don-t-crash-X-server-if-GPU-acceleration-is-not-avai.patch from
    upstream Git master, fixing crashes with ShadowFB


author: Hans de Goede <hdegoede@redhat.com> - 1.0.12-4
changelog:
  - Fix the crtc not being turned off, causing the dgpu to not suspend,
    after using a dgpu attached output


author: Christophe Fergeau <cfergeau@redhat.com> - 0.1.5-7
changelog:
  - Add upstream patches for Python 3 support
  - Validate RANDR output property atoms
  - Add patch fixing crash with multiple QXL devices
  - This syncs the RHEL branch with both current rawhide and RHEL 7.6


author: Adam Jackson <ajax@redhat.com> - 2.4.0-3
changelog:
  - Restore no-virt-shadowfb patch
  - Refuse to run if there's a UEFI framebuffer; use fbdev or a native driver


author: Hans de Goede <hdegoede@redhat.com> - 7.5-11
changelog:
  - Update most fonts:
     -encodings-1.0.4
     -font-adobe-100dpi-1.0.3
     -font-adobe-75dpi-1.0.3
     -font-adobe-utopia-100dpi-1.0.4
     -font-adobe-utopia-75dpi-1.0.4
     -font-adobe-utopia-type1-1.0.4
     -font-arabic-misc-1.0.3
     -font-bh-100dpi-1.0.3
     -font-bh-75dpi-1.0.3
     -font-bh-lucidatypewriter-100dpi-1.0.3
     -font-bh-lucidatypewriter-75dpi-1.0.3
     -font-bitstream-100dpi-1.0.3
     -font-bitstream-75dpi-1.0.3
     -font-bitstream-type1-1.0.3
     -font-cronyx-cyrillic-1.0.3
     -font-cursor-misc-1.0.3
     -font-daewoo-misc-1.0.3
     -font-dec-misc-1.0.3
     -font-isas-misc-1.0.3
     -font-jis-misc-1.0.3
     -font-micro-misc-1.0.3
     -font-misc-cyrillic-1.0.3
     -font-misc-ethiopic-1.0.3
     -font-misc-misc-1.1.2
     -font-mutt-misc-1.0.3
     -font-schumacher-misc-1.1.2
     -font-screen-cyrillic-1.0.4
     -font-sony-misc-1.0.3
     -font-sun-misc-1.0.3
     -font-winitzki-cyrillic-1.0.3
     -font-xfree86-type1-1.0.4
  - Fix a bug in jisx0201.1976-0.enc (#1009350)


author: Simone Caronni <negativo17@gmail.com> - 7.5-12
changelog:
  - Clean up SPEC file, remove obsolete tags, fix all rpmlint warnings.
  - Rework build/install section to be like other xorg packages.
  - Remove all obsolete provides/obsoletes/conflicts.
  - Simplify build requirements.
  - Simplify build, it has not changed since 2008.


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-3
changelog:
  - Downgrade modesetting "glamor initialization failed" X_ERROR → X_INFO
    Resolves: #1724573
  - Xwayland / Present leak fixes for #1728684


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-5
changelog:
  - xwayland: Hold a pixmap reference in struct xwl_present_event
    Related: #1728684
  - glamor: Fix glamor_poly_fill_rect_gl xRectangle::width/height handling
    Resolves: #1740250


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-8
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872391), CVE-2020-14346 (#1872395),
    CVE-2020-14361 (#1872402), CVE-2020-14362 (#1872409)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-9
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2108156, rhbz#2108161


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-11
changelog:
  - CVE fix for: CVE-2022-4283 (#2151799), CVE-2022-46340 (#2151774),
    CVE-2022-46341 (#2151779), CVE-2022-46342 (#2151784),
    CVE-2022-46343 (#2151789), CVE-2022-46344 (#2151794)


author: José Expósito <jexposit@redhat.com> - 1.20.11-20
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18321
    Resolves: https://issues.redhat.com/browse/RHEL-18327


author: José Expósito <jexposit@redhat.com> - 1.20.11-21
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21207
    Resolves: https://issues.redhat.com/browse/RHEL-20528
    Resolves: https://issues.redhat.com/browse/RHEL-20378
    Resolves: https://issues.redhat.com/browse/RHEL-20384
    Resolves: https://issues.redhat.com/browse/RHEL-21191
    Resolves: https://issues.redhat.com/browse/RHEL-21198


author: José Expósito <jexposit@redhat.com> - 1.20.14-23
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-26
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97273), CVE-2025-49176 (RHEL-97329),
                 CVE-2025-49178 (RHEL-97369), CVE-2025-49179 (RHEL-97422),
                 CVE-2025-49180 (RHEL-97235)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-27
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119953), CVE-2025-62230 (RHEL-120027),
                 CVE-2025-62231 (RHEL-124993)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-4
changelog:
  - CVE fix for: CVE-2021-4008 (#2030162), CVE-2021-4009 (#2030172),
    CVE-2021-4010 (#2030175), CVE-2021-4011 (#2030181)


author: Ben Crocker <bcrocker@redhat.com> - 1.20.3-5
changelog:
  - Add Eric Anholt's patch e50c85f4ebf559 from upstream:
  - Fix segfault on probing a non-PCI platform device on a system with PCI
  - NOTE: also pertains on a system with no PCI, e.g. s390x.
    Resolves: #1652013


author: Olivier Fourdan <ofourdan@redhat.com> - 21.0.99.902-1
changelog:
  - xwayland 21.0.99.902
  - Remove xdmcp, udev, udev_kms build options
  - Stop overriding the vendor name, same as xorg-x11-server


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-2
changelog:
  - CVE fix for: CVE-2021-4008 (#2038066), CVE-2021-4009 (#2038068),
    CVE-2021-4010 (#2038071), CVE-2021-4011 (#2038073)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-6
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2110442, rhbz#2110437


author: Peter Hutterer <peter.hutterer@redhat.com> - 21.1.3-8
changelog:
  - CVE fix for: CVE-2022-4283 (#2151802), CVE-2022-46340 (#2151777),
    CVE-2022-46341 (#2151782), CVE-2022-46342 (#2151785),
    CVE-2022-46343 (#2151792), CVE-2022-46344 (#2151795)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-15
changelog:
  Fix for CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408, CVE-2024-0409


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-18
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97278), CVE-2025-49176 (RHEL-97299,
                 CVE-2025-49178 (RHEL-97374), CVE-2025-49179 (RHEL-97417),
                 CVE-2025-49180 (RHEL-97249)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-19
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119967), CVE-2025-62230 (RHEL-120015),
                 CVE-2025-62231 (RHEL-125007)


author: Adam Jackson <ajax@redhat.com> - 7.7-25
changelog:
  - iceauth 1.0.8
  - xkill 1.0.5
  - xrdb 1.1.1
  - xrefresh 1.0.6
  - xset 1.2.4
  - xsetroot 1.1.2
  - HTTPS URLs


author: Adam Jackson <ajax@redhat.com> - 1.0.9-12
changelog:
  - Nerf the python-related BuildRequires. They're only needed for 'make check',
    and cmdtest is not yet a python3 package.


author: Hans de Goede <hdegoede@redhat.com> - 1.3.4-12
changelog:
  - Drop 0001-startx-Pass-nolisten-tcp-by-default.patch this is the
    server default now
  - Check for SSH_AUTH_SOCK not SSH_AGENT in xinitrc-common (rhbz#1352339)


author: Hans de Goede <hdegoede@redhat.com> - 1.3.4-13
changelog:
  - Check for all 3 of SSH_AGENT, SSH_AGENT_PID and SSH_AUTH_SOCK to fix
    a regression introduced by the previous fix (rhbz#1352339)


author: Adam Jackson <ajax@redhat.com> - 7.7-24
changelog:
  - Make -devel Require the base package, so the pc file will point to an
    xkbcomp that actually exists.


author: Zdenek Dohnal <zdohnal@redhat.com> - 0.999-28
changelog:
  - remove dependency on ImageMagick and netpbm-progs, because they were needed for
    tests during %build phase, which were removed in commit SHA 0595c15da29


author: Vladis Dronov <vdronov@redhat.com> - 0.8.2-1
changelog:
  - Update to version 0.8.2
  - Drop patch 1-fix-man-page-installation.patch
  - Use SPDX license identifiers


author: Tomas Popela <tpopela@redhat.com> - 2:3.28.1-3
changelog:
  - Add the Quit entry to the app menu
  - Handle Ctrl+Q shortcut for quitting the application
  - Resolves: rhbz#1638876


author: Matej Mužila <mmuzila@redhat.com> - 3:2.4-5
changelog:
  - Add "Wants" dependency on network-online.target
  - Remove "After" dependency on NetworkManager-wait-online.service


author: Kamil Dudka <kdudka@redhat.com> - 5.4.2-7
changelog:
  - avoid crash when copying empty hash table (CVE-2018-7549)
  - avoid NULL dereference when using ${(PA)...} on an empty array (CVE-2018-7548)


author: Kamil Dudka <kdudka@redhat.com> - 5.5-1
changelog:
  - update to latest upstream release, which fixes the following vulnerabilities:
      CVE-2018-1100 - stack-based buffer overflow in utils.c:checkmailpath()
      CVE-2018-1083 - stack-based buffer overflow in compctl.c:gen_matches_files()
      CVE-2018-1071 - stack-based buffer overflow in exec.c:hashcmd()


author: Jakub Martisko <jamartis@redhat.com> - 0.13.68-6
changelog:
  - Fix multilib regression by adding a 32bit version of the multilib patch
  - Properly bump the release number in the previous changelog message
  - Resolves: #1638337


author: Jakub Martisko <jamartis@redhat.com> - 0.13.68-11
changelog:
  - Use /usr/libexec/platform-python macro during the config phase (used for doc generation)
    Resolves: RHEL-22880


author: Jakub Martisko <jamartis@redhat.com> - 0.13.68-3
changelog:
  - Fix CVEs 2018-7725, 2018-7726, 2018-7727, 2018-6484, 2018-6869 
  - Resolves: 1555082
  - Resolves: 1545818


