# changelog

author: Steve Dickson <steved@redhat.com> 1.2.1-13
changelog:
  - mount.nfs: Configuration file parser ignoring options
  - mount.nfs: Set the default family for lookups based on 
      defaultproto= setting
  - Enabled ipv6


author: Steve Dickson <steved@redhat.com> 1.2.3-2
changelog:
  - Initscripts do not conform to LSB specification (bz 621562)
  - sm-notify needs to call res_init() before each try (bz 625531)
  - exports(5) man page duplicated paragraphs (bz 590921)


author: Steve Dickson <steved@redhat.com> 1.2.3-4
changelog:
  - The nfs service is not stopped on reboot or halt (bz 652786)
  - Removed obsolete configuration values (bz 653765)


author: Steve Dickson <steved@redhat.com> 1.2.3-7
changelog:
  - Updated to latest upstream release: nfs-utils-1-2-4-rc5
  - Add initscripts changes needed for rpcbind to be running when nfs is started
  - Initscripts changes needed to support NFS over RDMA
  - Allow the setting of the NFSv4 grace period (bz 665387)


author: J. Bruce Fields <bfields@redhat.com> 1.2.4-1
changelog:
  - Rely on crypto module autoloading in init scripts
  - initscripts: just try to mount rpc_pipefs always


author: Steve Dickson <steved@redhat.com> 1.2.4-4
changelog:
  - Converted init scrips to systemd services. (bz 699040)
  - Made nfsnobody's uid/gid to always be a 16-bit value of -2
  - mount: fix for libmount from util-linux >= 2.20


author: Steve Dickson <steved@redhat.com> 1.2.4-7
changelog:
  - Added StandardError=syslog+console to all the service files
    so startup errors will be logged. 
  - Changed exportfs to only log errors on existing /etc/export.d 
    directory, which eliminates a needless syslog entry.
  - Automount /proc/fs/nfsd for rpc.nfsd


author: Steve Dickson <steved@redhat.com> 1.2.4-9
changelog:
  - Both the nfs.lock and nfs.idmap services should always
    enabled on both installs and upgrades (bz 699040)
  - Fixed the paths to the server scriptlets (bz 733531)


author: Steve Dickson <steved@redhat.com> 1.2.5-1
changelog:
  - Update to upstream RC release: nfs-utils-1.2.6-rc1
  - Added named.service to After list in nfs-server.service (bz 742746)


author: Steve Dickson <steved@redhat.com> 1.2.5-2
changelog:
  - Removed SUID bits on mount commands (bz 528498)
  - Fixed a few typos in a couple man pages (bz 668124, 673818, 664330)
  - Fixed a I/0 problem in rpc.idmapd (bz 684308)


author: Steve Dickson <steved@redhat.com> 1.2.5-5
changelog:
  - Ensured nfs-idmap service is started after the network up (bz 748275)
  - Update to upstream RC release: nfs-utils-1.2.6-rc3 (bz 746497)


author: Steve Dickson <steved@redhat.com> 1.2.5-6
changelog:
  - Remove RQUOTAD_PORT and RQUOTAD from /etc/sysconfig/nfs (bz 754496)
  - Ensured nfs-idmap service is started after the named is up (bz 748275)


author: Steve Dickson <steved@redhat.com> 1.2.5-7
changelog:
  - Enabled new idmaping by installing the id_resolver.conf file.
  - Update to upstream RC release: nfs-utils-1.2.6-rc4


author: Steve Dickson <steved@redhat.com> 1.2.5-11
changelog:
  - Update to upstream RC release: nfs-utils-1.2.6-rc6
  - Reworked how the nfsd service requires the rpcbind service (bz 768550)


author: Steve Dickson <steved@redhat.com> 1.2.5-13
changelog:
  - Make sure statd is start before NFS mounts (bz 786050)
  - rpc.idmap: Hide global symbols from libidmap plugins (bz 797332)
  - nfsd: Bump up the default to 8 nprocs (bz 757452)


author: Steve Dickson <steved@redhat.com> 1.2.5-14
changelog:
  - gssd: Look for user creds in user defined directory (bz 786993)
  - gssd: Don't link with libgssapi_krb5 (bz 784908)


author: Steve Dickson <steved@redhat.com> 1.2.6-0
changelog:
  - Update to the latest upstream release: nfs-utils-1.2.6 (bz 821673)
  - Split out NFS server daemons into individual service files (bz 769879) 
  - Removed Wants= from nfs-lock.service (bz 817895)
  - Only enable services if they are enabled on upgrades (bz 807020)


author: Steve Dickson <steved@redhat.com> 1.2.6-1
changelog:
  - Correctly search for the existence of nfsnobody (bz 816149)
  - Correctly change the default group id for nfsnobody (bz 816149)


author: Steve Dickson <steved@redhat.com> 1.2.6-12
changelog:
  - Added FedFS support by added a BuildRequires for fedfs-utils-devel
  - Introduce new systemd-rpm macros (bz 850227)
  - Updated to latest upstream RC release: nfs-utils.1.2.7-rc5 (bz 833024)


author: Steve Dickson <steved@redhat.com> 1.2.6-14
changelog:
  - Allow the service to start when RPCNFSDCOUNT is comment out. (bz 870143)
  - Removed some old cruft from the spec file (bz 226198)


author: Steve Dickson <steved@redhat.com> 1.2.7-3
changelog:
  - Updated to latest upstream RC release: nfs-utils.1.2.8-rc3
  - Took ownership of /usr/lib/nfs-utils (bz 894535)


author: Steve Dickson <steved@redhat.com> 1.2.7-5
changelog:
  - Updated to latest upstream RC release: nfs-utils.1.2.8-rc4
  - Added nfs-lock.service to After line in nfs-server.service (bz 914792)


author: Steve Dickson <steved@redhat.com> 1.2.8-2.0
changelog:
  - Update to latest upstream RC release: nfs-utils.1.2.9-rc1
  - Added GSS_USE_PROXY variable to nfs.sysconfig (bz 967112)


author: Steve Dickson <steved@redhat.com> 1.2.9-0.5
changelog:
  - Reverted patch for bz1029573. The kernel can now detect 
    when rpc.gssd is or is not running (bz1031197)
  - gssd: always reply to rpc-pipe requests from kernel. (bz1031197)


author: Steve Dickson <steved@redhat.com> 1.2.9-2.0
changelog:
  - Updated to the latest upstream RC release nfs-utils-1.2.10-rc2
    - mount.nfs: Eliminated long delays during mount (bz 1031643)
    - exportfs: Corrected erroneously error messages (bz 1049589)


author: Steve Dickson <steved@redhat.com> 1.2.9-3.0
changelog:
  - Updated to the latest upstream RC release nfs-utils-1.2.10-rc3
    - exportfs: Exit with correct value when an error occurs (bz 1053933)
    - mount.nfs: Removed supported flag from usage string (bz 1000989)
    - gssd: Improve first attempt at acquiring GSS credentials (bz 1053877)
    - rpc.idmapd: Remove no longer supported flags from man page (bz 1003513)
    - rpc.statd: Allow usage messages to be displayed when statd is running. (bz 1037044)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.0
changelog:
  - Updated to latest upstream release: nfs-utils-1-3-0
    - mount.nfs: Fix fallback from tcp to udp (bz 984901)
    - nfsidmap: Keys need to be invalidated instead of revoked (bz 1080505)
  - Removed RDMA_PORT stub from /etc/sysconfig/nfs (bz 1078792)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.1
changelog:
  - Added configurable timeout to rpc.gssd (bz 1009528)
  - Added callback to sm_notify (bz 1108105)
  - mountd: Fixed path in start-statd (bz 1116794)
  - rpc.gssd: Fixed silent error message (bz 1117384)
  - rpc.gssd: add the acceptor name to the info passed in downcall (bz 1088011)
  - nfs-utils.spec: fixed runtime configuration files (bz 1118177)
  - exportfs: fix test of NULL pointer in host_pton() (bz 1083018)
  - gssd: Fixed errno typo in get_servername() (bz 1082480)
  - nfsiostat: documented the output better (bz 1109864)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.2
changelog:
  - Upgrade to latest upstream systemd scripts  (bz 1144440)
  - Taught start-statd to use systemd  (bz 1144440)
  - Repaced rpc.svcgssd with gssproxy (bz 1082746)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.6
changelog:
  - Corrected argument names in the systemd scripts (bz 1170364)
  - Added RELRO check (bz 1092543)
  - Properly parse IPv6 literal strings with null termination (bz 1161490)
  - Added the 'nordirplus' export flag to disable v3 readdirplus (bz 1161458)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.8
changelog:
  - Stop sm-notify from running in HA environments (bz 1182692)
  - Set the GSS_USE_PROXY variable in nfs-utils_env.sh (bz 1183821)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.10
changelog:
  - Updated mountstats to latest upstream version (bz 1215808)
  - Enable all auth flavors on pseudofs exports (bz 1187223)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.11
changelog:
  - Added the rpcuser group before adding the rpcuser uid (bz 1190874)
  - Added back variables to help get through firewalls (bz 1208488)
  - Made the postuns conditional (bz 1200713)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.12
changelog:
  - Fixed nfs-idmap start race (bz 1164064)
  - Updated nfsdcltrack v2 schema (bz 1234598)
  - Added missing arguments in rpc.mountd man page (bz 1003558)
  - Added nfsconfig.conf to nfs.man and mount.nfs.man (bz 1196646)
  - nfs-server now Requires rpcbind.service (bz 1171603)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.18
changelog:
  - Stop gssd from silenty reaps cache (bz 1256469)
  - Remove errant echo call from spec file (bz 1257144)
  - Add more symlinks to make systemd scripts backwards compatible (bz 1159183)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.21
changelog:
  - Stop gssd from flooding the KDC with TGT fetches (bz 1264999)
  - Decouple the start/stop of rpcbind with nfs-server and rpc-statd (bz 1266993)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.21_2
changelog:
  - exportfs: Restore the EAI_NONAME check in host_pton() (bz 1288435)
  - gssd: Don't assume the machine account will be in uppercase (bz 1288433)


author: Christopher Aillon <caillon@redhat.com> 4.6-4
changelog:
  - Use the NSPR version numbering scheme reported by NSPR,
    which unfortunately is not exactly the same as the real
    version (4.6 != 4.6.0 according to RPM and pkgconfig).


author: Christopher Aillon <caillon@redhat.com>
changelog:
  - Stop shipping static libraries; NSS and dependencies no longer
    require static libraries to build.


author: Kai Engert <kengert@redhat.com> 4.6.1-2
changelog:
  - Do not use -ansi when compiling, because of a compilation
    problem with latest glibc and anonymous unions.
    See also bugzilla.mozilla.org # 322427.


author: Kai Engert <kengert@redhat.com> - 4.6.5-2
changelog:
  - Update to latest ipv6 upstream patch
  - Add upstream patch to fix a thread cleanup issue
  - Now requires pkgconfig


author: Kai Engert <kengert@redhat.com> - 4.6.6-2
changelog:
  - Update thread-cleanup patch to latest upstream version
  - Add upstream patch to support PR_STATIC_ASSERT


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-1
changelog:
  - Update to NSPR_4_10_2_RTM
  - Avoid unsigned integer wrapping in PL_ArenaAllocate
  - Resolves: rhbz#1031465 - CVE-2013-5607


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-2
changelog:
  - Restore previously used s390x patch as it isn't upstream yet
  - Related: rhbz#1031465 - CVE-2013-5607


author: Elio Maldonado <emaldona@redhat.com> 4.10.6-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1126243 - Ensure nspr is built for 64 bit on ppc64le


author: Elio Maldonado <emaldona@redhat.com> - 4.10.6-3
changelog:
  - Restore s390x related patch as it hasn't been applied upstream yet
  - Resolves: Bug 1103250 - Rebase RHEL 7.1 to NSPR 4.10.6 (for FF 31)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269363 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Christopher Aillon <caillon@redhat.com> 3.11-0.cvs
changelog:
  - Initial import into Fedora Core, based on a CVS snapshot of
    the NSS_3_11_RTM tag
  - Fix up the pkcs11-devel subpackage to contain the proper headers
  - Build with RPM_OPT_FLAGS
  - No need to have rpath of /usr/lib in the pc file


author: Kai Engert <kengert@redhat.com> - 3.11.3-2
changelog:
  - Revert the attempt to require latest NSPR, as it is not yet available
    in the build infrastructure.


author: Kai Engert <kengert@redhat.com> - 3.11.5-1
changelog:
  - Update to 3.11.5
  - This update fixes two security vulnerabilities with SSL 2
  - Do not use -rpath link option
  - Added several unsupported tools to tools package


author: Kai Engert <kengert@redhat.com> - 3.11.5-2
changelog:
  - Fix rhbz#230545, failure to enable FIPS mode
  - Fix rhbz#220542, make NSS more tolerant of resets when in the 
    middle of prompting for a user password.


author: Kai Engert <kengert@redhat.com> - 3.11.7-2
changelog:
  - Update to 3.11.7, but freebl/softokn remain at 3.11.5.
  - Use a workaround to avoid mozilla bug 51429.


author: Kai Engert <kengert@redhat.com> - 3.11.7-10
changelog:
  - Add /etc/prelink.conf.d/nss-prelink.conf in order to blacklist
    our signed libraries and protect them from modification.


author: Kai Engert <kengert@redhat.com> - 3.11.99.3-2
changelog:
  - Build against gcc 4.3.0, use workaround for bug 432146
  - Run the test suite after the build and abort on failures.


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-3
changelog:
  - nss package should own /etc/prelink.conf.d folder, rhbz#452062
  - use upstream patch to fix test suite abort


author: Kai Engert <kaie@redhat.com> - 3.12.3-3
changelog:
  - ship .chk files instead of running shlibsign at install time
  - include .chk file in softokn-freebl subpackage
  - add patch for upstream nss bug 488350


author: Kai Engert <kaie@redhat.com> - 3.12.3-7
changelog:
  - re-enable test suite
  - add patch for upstream bug 488646 and add newer paypal
    certs in order to make the test suite pass


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-5
changelog:
  - updated pem module incorporates various patches
  - fix off-by-one error when computing size to reduce memory leak. (483855)
  - fix data type to work on x86_64 systems. (429175)
  - fix various memory leaks and free internal objects on module unload. (501080)
  - fix to not clone internal objects in collect_objects().  (501118)
  - fix to not bypass initialization if module arguments are omitted. (501058)
  - fix numerous gcc warnings. (500815)
  - fix to support arbitrarily long password while loading a private key. (500180) 
  - fix memory leak in make_key and memory leaks and return values in pem_mdSession_Login (501191)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.3.99.3-10
changelog:
  - must install libnssutil3.since nss-util is untagged at the moment
  - preserve time stamps when installing various files


author: Elio Maldonado+emaldona@redhat.com - 3.12.3.99.3-11
changelog:
  - split off nss-softokn and nss-util as subpackages with their own rpms
  - first phase of splitting nss-softokn and nss-util as their own packages


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - remove patches that are now in nss-softokn and
  - remove spurious exec-permissions for nss.pc per rpmlint
  - single requires line in nss.pc.in


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-22
changelog:
  - Fix nss-config not to include nssutil
  - Add BuildRequires on nss-softokn and nss-util since build also runs the test suite


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-25
changelog:
  - Remove nss-prelink.conf as signed all shared libraries moved to nss-softokn
  - Add a temprary hack to nss.pc.in to unblock builds


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-29
changelog:
  - Restoring patches 2 and 7 as we still compile all sources
  - Applying the nss-nolocalsql.patch solves nss-tools sqlite dependency problems


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-30
changelog:
  - Fix FORTIFY_SOURCE buffer overflows in test suite on ppc and ppc64 - bug 519766
  - Fixed requires and buildrequires as per recommendations in spec file review


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-2
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - No rpath-link in nss-softokn-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - PEM module implements memory management for internal objects - 509705
  - PEM module doesn't crash when processing malformed key files - 512019


author: Elio Maldonado<emaldona@redhat.com - 3.12.4-9
changelog:
  - Install blank databases and configuration file for system shared database
  - nsssysinit queries system for fips mode before relying on environment variable


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13
changelog:
  - User no longer prompted for a password when listing keys an empty system db (#527048)
  - Fix setup-nsssysinit to handle more general formats (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-13.1
changelog:
  - Require nss-softoken of same architecture as nss (#527867)
  - Merge setup-nsssysinit.sh improvements from F-12 (#527051)


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1
changelog:
  - Update to 3.12.5
  - Patch to allow ssl/tls clients to interoperate with servers that require renogiation


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.5
changelog:
  - Fix nsssysinit to set the default flags on the crypto module (#545779)
  - Remove redundant header from the pem module


author: Elio Maldonado<emaldona@redhat.com> - 3.12.5-1.6
changelog:
  - Fix nsssysinit to enable apps to use system cert store, patch contributed by David Woodhouse (#546221)
  - Fix spec so sysinit requires coreutils for post install scriplet (#547067)
  - Fix segmentation fault when listing keys or certs in the database, patch contributed by Kamil Dudka (#540387)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-1.1
changelog:
  - Using SSL_RENEGOTIATE_TRANSITIONAL as default while on transition period
  - Disabling ssl tests suites until bug 539183 is resolved


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-3
changelog:
  - Add sed to sysinit requires as setup-nsssysinit.sh requires it (#576071)
  - Update PayPalEE test cert with unexpired one (#580207)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-5
changelog:
  - Update pem source tar to pick up the following bug fixes:
  - PEM - Allow collect objects to search through all objects
  - PEM - Make CopyObject return a new shallow copy
  - PEM - Fix memory leak in pem_mdCryptoOperationRSAPriv


author: Elio Maldonado <emaldona@redhat.com> - 3.12.7-2
changelog:
  - Define NSS_USE_SYSTEM_SQLITE and remove unneeded patch
  - Add comments regarding an unversioned provides which triggers rpmlint warning
  - Build requires nss-softokn-devel >= 3.12.7


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Prevent disabling of nss-sysinit on package upgrade (#636787)
  - Create pkcs11.txt with correct permissions regardless of umask (#636792) 
  - Setup-nsssysinit.sh reports whether nss-sysinit is turned on or off (#636801)
  - Added provides pkcs11-devel-static to comply with packaging guidelines (#609612)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-3
changelog:
  - Replace posttrans sysinit scriptlet with a triggerpostun one (#636787)
  - Fix and cleanup the setup-nsssysinit.sh script (#636792, #636801)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8.99.2-1
changelog:
  - Update to NSS_3_12_9_BETA2
  - Fix libpnsspem crash when cacert dir contains other directories (#642433)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-5
changelog:
  - Fix the earlier infinite recursion patch (#499444)
  - Remove a header that now nss-softokn-freebl-devel ships


author: Christopher Aillon <caillon@redhat.com> - 3.12.9-6
changelog:
  - Revert patches for 499444 as they use a C++ reserved word and
    cause compilation of Firefox to fail


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-10
changelog:
  - Fix cms headers to not use c++ reserved words (#676036)
  - Reenabling Bug 499444 patches
  - Fix to swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.10-4
changelog:
  - Enable pluggable ecc support (#712556)
  - Disable the nssdb write-access-on-read-only-dir tests when user is root (#646045)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.11-3
changelog:
  - Fix attempt to free initilized pointer (#717338)
  - Fix leak on pem_CreateObject when given non-existing file name (#734760)
  - Fix pem_Initialize to return CKR_CANT_LOCK on multi-treaded calls (#736410)


author: Elio Maldonado Batiz <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Rebuild with nss-softokn from 3.12 in the buildroot
  - Allows the pem module to statically link against 3.12.x freebl
  - Required for using nss-3.13.x with nss-softokn-3.12.y for a merge inrto rhel git repo
  - Build will be temprarily placed on buildroot override but not pushed in bodhi


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-5
changelog:
  - Statically link the pem module against system freebl found in buildroot
  - Disabling sha224-related powerup selftest until we update softokn
  - Disable sha224 and pss tests which nss-softokn 3.12.x doesn't support


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-6
changelog:
  - Removed unwanted /usr/include/nss3 in front of the normal cflags include path
  - Removed unnecessary patch dealing with CERTDB_TERMINAL_RECORD, it's visible


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-7
changelog:
  - Resolves: Bug 750376 - nss 3.13 breaks sssd TLS
  - Fix how pem is built so that nss-3.13.x works with nss-softokn-3.12.y
  - Only patch blapitest for the lack of sha224 on system freebl
  - Completed the patch to make pem link against system freebl


author: elio maldonado <emaldona@redhat.com> - 3.13.1-9
changelog:
  - Revert to using current nss_softokn_version
  - Patch to deal with lack of sha224 is no longer needed


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-10
changelog:
  - Resolves: Bug 770682 - nss update breaks pidgin-sipe connectivity
  - NSS_SSL_CBC_RANDOM_IV set to 0 by default and changed to 1 on user request


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Pick up fixes from RHEL
  - Resolves: rhbz#800674 - Unable to contact LDAP Server during winsync
  - Resolves: rhbz#800682 - Qpid AMQP daemon fails to load after nss update
  - Resolves: rhbz#800676 - NSS workaround for freebl bug that causes openswan to drop connections


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-1
changelog:
  - Update to NSS_3_13_4_RTM
  - Update the nss-pem source archive to the latest version
  - Remove no longer needed patches
  - Resolves: Bug 806043 - use pem files interchangeably in a single process
  - Resolves: Bug 806051 - PEM various flaws detected by Coverity
  - Resolves: Bug 806058 - PEM pem_CreateObject leaks memory given a non-existing file name


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-2
changelog:
  - Resolves: Bug 805723 - Library needs partial RELRO support added
  - Patch coreconf/Linux.mk as done on RHEL 6.2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-4
changelog:
  - Resolves: Bug 830410 - Missing Requires %{?_isa}
  - Use Requires: %{name}%{?_isa} = %{version}-%{release} on tools
  - Drop zlib requires which rpmlint reports as error E: explicit-lib-dependency zlib
  - Enable sha224 portion of powerup selftest when running test suites
  - Require nspr 4.9.1


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-8
changelog:
  - Rebase pem sources to fedora-hosted upstream to pick up two fixes from rhel-6.3
  - Resolves: rhbz#847460 - Fix invalid read and free on invalid cert load
  - Resolves: rhbz#847462 - PEM module may attempt to free uninitialized pointer 
  - Remove unneeded fix gcc 4.7 c++ issue in secmodt.h that actually undoes the upstream fix


author: Elio Maldonado <emaldona@redhat.com> - 3.14-0.1.rc.1
changelog:
  - Update to NSS_3_14_RC1
  - update nss-589636.patch to apply to httpdserv
  - turn off ocsp tests for now
  - remove no longer needed patches
  - remove headers shipped by nss-util


author: Elio Maldonado <emaldona@redhat.com> - 3.14-2
changelog:
  - Add secmodt.h to the headers installed by nss-devel
  - nss-devel must install secmodt.h which moved from softoken to pk11wrap with nss-3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-5
changelog:
  - Fix the spec file so sechash.h gets installed
  - Resolves: rhbz#871882 - missing header: sechash.h in nss 3.14


author: Elio Maldonado <emaldona@redhat.com> - 3.14-6
changelog:
  - Fix a previous unwanted merge from f18
  - Update the SS_SSL_CBC_RANDOM_IV patch to match new sources while
  - Keeping the patch disabled while we are still in rawhide and
  - State in comment that patch is needed for both stable and beta branches
  - Update .gitignore to download only the new sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-7
changelog:
  - Add a dummy source file for testing /preventing fedpkg breakage
  - Helps test the fedpkg new-sources and upload commands for breakage by nss updates
  - Related to Bug 872124 - nss 3.14 breaks fedpkg new-sources


author: Elio Maldonado <emaldona@redhat.com> - 3.14-8
changelog:
  - Fix pk11wrap locking which fixes 'fedpkg new-sources' and 'fedpkg update' hangs
  - Bug 872124 - nss-3.14 breaks fedpkg new-sources
  - Fix should be considered preliminary since the patch may change upon upstream approval


author: Elio Maldonado <emaldona@redhat.com> - 3.14-9
changelog:
  - Disable bypass code at build time and return failure on attempts to enable at runtime
  - Bug 806588 - Disable SSL PKCS #11 bypass at build time


author: Elio Maldonado <emaldona@redhat.com> - 3.14-11
changelog:
  - Bug 879978 - Install the nssck.api header template in a place where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3


author: Elio Maldonado <emaldona@redhat.com> - 3.14-12
changelog:
  - Bug 879978 - Install the nssck.api header template where mod_revocator can access it
  - Install nssck.api in /usr/includes/nss3/templates


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - sync up pem rsawrapr.c with softoken upstream changes for nss-3.14.3
  - Resolves: rhbz#908257 - CVE-2013-1620 nss: TLS CBC padding timing attack
  - Resolves: rhbz#896651 - PEM module trashes private keys if login fails
  - Resolves: rhbz#909775 - specfile support for AArch64
  - Resolves: rhbz#910584 - certutil -a does not produce ASCII output


author: Kai Engert <kaie@redhat.com> - 3.14.3-9
changelog:
  - Configure libnssckbi.so to use the alternatives system
    in order to prepare for a drop in replacement.


author: Elio Maldonado <emaldona@redhat.com> - 3.15-5
changelog:
  - Install man pages for nss-tools and the nss-config and setup-nsssysinit scripts
  - Resolves: rhbz#606020 - nss security tools lack man pages


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-2
changelog:
  - Update to NSS_3_15_1_RTM
  - Apply various fixes to the man pages and add new ones
  - Enable the iquote.patch to access newly introduced types
  - Add man page for pkcs11.txt configuration file and cert and key databases
  - Add missing option descriptions for {cert|cms|crl}util
  - Resolves: rhbz#948495 - Man page scan results for nss
  - Resolves: rhbz#982723 - Fix path to script in man page for nss-sysinit


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-4
changelog:
  - Install symlink to nss-sysinit.sh without the .sh suffix
  - Resolves: rhbz#982723 - nss-sysinit man page has wrong path for the script


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
  - Rebase to nss-3.15.2
  - Resolves: rhbz#1012656 - pick up NSS 3.15.2 to fix CVE-2013-1739 and disable MD5 in OCSP/CRL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-2
changelog:
  - Add description of the certutil's --email option to it's manpage
  - Resolves: rhbz#Bug 948495 - Man page scan results for nss


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-4
changelog:
  - Enable fips when system is in fips mode
  - Resolves: rhbz#852023 - FIPS mode detection does not work


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-6
changelog:
  - Fix errors in ssl disabling patches for both library and tests
  - Add s390x to the multilib_arches definition used for alt_ckbi
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-7
changelog:
  - Fix bash syntax error in patch for disabling ssl2 tests
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-8
changelog:
  - Fix patch for disabling ssl2 in ssl to correctly set error code
  - Fix syntax error reported in the build.log even tough it succeeds
  - Add patch top ignore setpolicy result 
  - Resolves: rhbz#1001841 - Disable SSL2 and the export cipher suites
  - Resolves: rhbz#1026677 - Attempt to run ipa-client-install fails


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-9
changelog:
  - Fix certutil man page options names to be consistent with help
  - Resolves: rhbz#948495 - man page scan results for nss
  - Remove incorrect count argument in status description in nss-sysinit man page
  - Resolves: rhbz#982723 - man page of nss-sysinit incorrect option descriptions


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-10
changelog:
  - Fix path to script and remove -- from some options in nss-sysinit man page
  - Resolves: rhbz#982723 - man page of nss-sysinit worong path and other flaws


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1040284 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-7.0]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Improve pluggable ECC support for ECDSA
  - Resolves: Bug 752980 - [7.0 FEAT] Support ECDSA algorithm in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - Fix a coverity scan compile time warning for the pem module
  - Resolves: Bug 1002271 - NSS pem module should not require unique base file names


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-7
changelog:
  - Move several nss-sysinit manpages tar archives to the %files
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-8
changelog:
  - Fix the spec file to apply the nss ecc list patch for bug 752980
  - Resolves: Bug 752980 - Support ECDSA algorithm in the nss package via puggable ecc


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-9
changelog:
  - Rebase to nss-3.15.4
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue
  - Remove no longer needed patches for manpages that were applied upstream
  - Remove no longer needed patch to disable ocsp stapling tests
  - Update iquote.patch on account of upstream changes
  - Update and rename patch to pem/rsawrapr.c on account of upstream changes
  - Use the pristine upstream sources for nss without repackaging
  - Avoid unneeded manual step which may introduce errors


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-3
changelog:
  - Remove spurious man5 wildcard entry as all manpages are listed by name
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-4
changelog:
  - Update pem sources to latest from nss-pem upstream
  - Pick up pem module fixes verified on RHEL and applied upstream
  - Remove no loger needed pem patches on acccount on this update
  - Add comments documenting the iquote.patch 
  - Resolves: Bug 1054457 - CVE-2013-1740


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-5
changelog:
  - Pick up a fix from rhel-6 and fix an rpm conflict
  - Don't hold issuer cert handles in crl cache
  - Resolves: Bug 1034409 - deadlock in trust domain and object lock
  - Move nss shared db files to the main package
  - Resolves: Bug 1050163 - Same files in two packages create rpm conflict


author: Elio Maldonado <emaldona@redhat.com> - 3.15.4-6
changelog:
  - Disallow disabling the internal module
  - Resolves: Bug 1056036 - nss segfaults with opencryptoki module


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
changelog:
  - Rebase to nss-3.16.2
  - Resolves: Bug 1103252 - Rebase RHEL 7.1 to at least NSS 3.16.1 (FF 31)
  - Fix test failure detection in the %check section
  - Move removal of unwanted source directories to the end of the %prep section
  - Update various patches on account of the rebase
  - Remove unused patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-2
changelog:
  - Fix libssl and test patches that disable ssl2 support
  - Resolves: Bug 1123435
  - Replace expired PayPal test certificate with current one


author: Elio Maldonado <pbrobinson@redhat.com> 3.16.2-3
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1125619 - nss fails to build on arch: ppc64le (missing dependencies)
  - Fix contributed by Peter Robinson <pbrobinson@redhat.com>


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-10
changelog:
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Support TLS_FALLBACK_SCSV in tstclnt and ssltap


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Restore patch for certutil man page
  - supply missing options descriptions
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-4
changelog:
  - Fix race condition
  - Resolves: Bug 1094468 - 389-ds-base server reported crash in stan_GetCERTCertificate
  - under the replication replay failure condition


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-5
changelog:
  - Reverse the sense of a test in patch to fix pk12util segfault
  - Resolves: Bug 1174527 - Segfault in pk12util when using -l option with certain .p12 files


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Fix shell syntax error on nss/tests/all.sh
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-4
changelog:
  - Add support for sha384 tls cipher suites
  - Add support for server-side hde key exchange
  - Add support for DSS+SHA256 ciphersuites


author: Kai Engert <kaie@redhat.com> - 3.19.1-5
changelog:
  - Incremental patches to fix SSL/TLS test suite execution,
    fix the earlier SHA384 patch, and inform clients to use SHA384 with
    certificate_verify if required by NSS.


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-9
changelog:
  - Fix checks to skip ssl2/export cipher suites tests to not skip needed tests
  - Fix libssl ssl2/export disabling patch to handle NULL cipher cases
  - Enable additional cipher suites by default


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-12
changelog:
  - Support TLS > 1.0 by support while still allowing to connect to SSL3 only servers
  - Enable ECDSA cipher suites by default, a subset of the ones requested


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-13
changelog:
  - Reorder the cipher suites and enable two more by default
  - Fix some of the ssauth sni and ocsp stapling tests


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-14
changelog:
  - Update the required_softokn_build_version to -14
  - Add references to bugs filed upstream for new patches
  - Merge ocsp stapling and sslauth sni tests patches into one


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-16
changelog:
  - Fix check for public key size of DSA certificates
  - Use size of prime P not the size of dsa.publicValue


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-17
changelog:
  - Change the required_softokn_build_version back to -13
  - Ensure we use nss-softokn-3.16.2.3-13.el7_1


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-19
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Resolves: Bug 1289883


author: Elio Maldonado@<emaldona@redhat.com> - 3.12.3.99.3-19
changelog:
  - Determine NSSUTIL_INCLUDE_DIR and NSSUTIL_LIB_DIR with a pkg-config query on nss-util
  - Remove the release 17 hack


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symblic links to shared libraries from devel, rhbz#521155
  - Apply the nss-nolocalsql patch
  - No rpath-link in nss-softokn-config


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-16
changelog:
  - allow prelink of softoken and freebl. Change the verify code to use
    prelink -u if prelink is installed. Fix by Robert Relyea rhbz#504949


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-19
changelog:
  - Consider the system as not fips enabled when /proc/sys/crypto/fips_enabled isn't present (rhbz#590199)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-20
changelog:
  - Add %{?_isa} to the requires in the devel packages (#596840)
  - Fix typo in the package description (#598295)
  - Update nspr version to 4.8.4


author: Elio Maldonado <emaldona@redhat.com> - 3.12.7-2
changelog:
  - Define NSS_USE_SYSTEM_SQLITE and remove nss-nolocalsql patch
  - Fix rpmlint warnings about macros in comments and changelog


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Adhere to static library packaging guidelines (#609613)
  - Fix nss-util-devel version dependency line
  - Shorten freebl and freebl subpackages descriptions


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-4
changelog:
  - Add blapit.h to headers provided by nss-softokn-freebl-devel (#675196)
  - Expand the freebl-devel package description


author: Elio Maldonado <emaldona@redhat.com> - 3.12.10-2
changelog:
  - Fix intel optimized aes code to deal with case where input and ouput are in the same buffer (#709517)


author: Elio Maldonado <emaldona@redhat.com> - 3.13-0.1.rc0.3
changelog:
  - Update to NSS_3_13_RC0 post bootstrapping
  - Don't incude util in sources for the lookaside cache
  - Reenable building the fipstest tool
  - Restore full cli argument parsing in the sectool library


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-11
changelog:
  - Downgrading to 3.12.9 for a merge into new RHEL git repo
  - This build is for the buildroot for a limited time only
  - Do not not push it to update-testing


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-13
changelog:
  - Bug 757005 Build nss-softokn for rhel 7
  - Make it almost like nss-softokn-3.12.9 in rhel 6.2
  - Added a patch to build with Linux 3 and higher
  - Meant to work with nss and nss-utul 3.1.3.1
  - Download only the 3.12.9 sources from the lookaside cache


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-14
changelog:
  - Restore the update to 3.13.1
  - Update the patch for freebl to deal with prelinked shared libraries
  - Add additional dbrg power-up self-tests as required by fips
  - Reactivate the tests


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-15
changelog:
  - Bug 770999 - Fix segmentation violation when turning on fips mode
  - Reintroduce the iquote patch but don't apply it unless needed


author: Tom Callaway <spot@fedoraproject.org> 3.13.1-19.1
changelog:
  - fix issue with gcc 4.7 in secmodt.h and C++11 user-defined literals
  - temporarily revert /usrmove changes. they will be restored in -20 for the f17-usrmove tag.


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Remove unneeded fix for gcc 4.7 c++ issue in secmodt.h which undoes the upstream fix
  - Fix Libs: line on nss-softokn.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.14-0.1.rc.1
changelog:
  - Update to NSS_3_14_RC1
  - Remove patches rendered obsolete by this update and update others
  - Temporarily modifiy the spec file while bootstrapping the buildroot a follows:
  - Remove unwanted headers that we lo loger ship
  - Modified the post install scriplet to ensure the in-tree freebl library is loaded


author: Elio Maldonado <emaldona@redhat.com> - 3.14-4
changelog:
  - Apply the bug 829088 patch in question
  - Adjust the patch to account for code changes in nss-3.14
  - Resolves: rhbz#829088 - Fix failure in sha244 self-test


author: Elio Maldonado <emaldona@redhat.com> - 3.14-5
changelog:
  - Truly apply the bug 829088 patch this time
  - Resolves: rhbz#829088 - Fix failure in sha244 self-test


author: Elio Maldonado <emaldona@redhat.com> - 3.14.2-2
changelog:
  - Update to NSS_3_14_2_RTM
  - Restore comments on how to transition when signing algorithm changes
  - Remove unused patches


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta.1
changelog:
  - Update to NSS_3_15_BETA1
  - Update spec file, patches, and helper scrips on account of a shallwer source tree


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta.2
changelog:
  - Add lowhashtest and pk11gcmtest as unsupported tools
  - Modify nss-softoken-split script to include them in the split


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Add export NSS_ENABLE_ECC=1 rto the %build and %check sections
  - Resolves: rhbz#752980 - [7.0 FEAT] Support ECDSA algorithm in the nss packag


author: Elio Maldonado <emaldona@redhat.com> - 3.15.2-1
changelog:
  - Rebase to nss-softoken from nss-3.15.2
  - Resolves: rhbz#1012679 - pick up NSS-SOFTOKN 3.15.2 (required for bug 1012656)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Fix to allow level 1 fips mode if the db has no password
  - Resolves: Bug 852023 - FIPS mode detection does not work


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Rebase to nss-3.15.4
  - Resolves: Bug 1054457 - CVE-2013-1740
  - Update softokn splitting script to oparate on the upstream pristine source
  - Using the .gz archives directly, not repackaging as .bz2 ones
  - Avoid unneeded manual steps that could introduce errors
  - Update the iquote and build softoken only patches on account of the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
changelog:
  - Update to nss-3.16.2
  - Resolves: Bug 1103925 - Rebase RHEL 7.1 to at least NSS-SOFTOKN 3.16.1 (FF 31)


author: Elio Maldonado <emaldona@redhat.com> 3.16.2-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1125620 - nss-softokn fails to build on arch: ppc64le (build failure)
  - Fix contributed by Peter Robinson <pbrobinson@redhat.com>


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-5-
changelog:
  - Fix incorrect path in the %check section
  - Add way to skip test suite execution during development work
  - Resolves: Bug 1145434 - CVE-2014-1568


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-6
changelog:
  - Add lowhash to the softoken tests to run as done on rhel-6.6
  - Adapt suboptimal shell code in nss.spec fix from bug 108750
  - Resolves: Bug 1145434 - CVE-2014-1568


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2-7
changelog:
  - Change RSA_PrivateKeyCheck to not require p > q
  - Resolves: Bug 1150645 - Importing an RSA private key fails if p < q


author: Robert Relyea <rrelyea@redhat.com> 3.16.2-12
changelog:
  - Add support for encrypt_derive.
  - Allow us to init database at level1 while already in FIPS mode.
  - Allow UserDBOpen'ed FIPS tokens to do all the mechanisms as well as
    the main fips token.
  - Silence SIGCHLD when prelink is used.


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Remove temporary workaround for brew build problems now resolved
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Robert Relyea <rrelyea@redhat.com> - 3.16.2.3-3
changelog:
  - Resolves: Bug 1153602 - libfreebl3.so runs prelink during the initialization phase
  - Decouple libfreebl3.so from the actual library.
  - Blacklist the freebl libraries
  - Turn off calling prelink to unprelink the binary


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-5
changelog:
  - Skip the fips checks if the action is newslot or delslot.
  - Resolves: Bug 1156406 - NSS fails to access sql:/etc/pki/nssdb in system FIPS mode


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-6
changelog:
  - Update fix for flaws reported by coverity scan  
  - Resolves: Bug 1154764 - Defects found in nss-softokn


author: Robert Relyea <rrelyea@redhat.com> - 3.16.2.3-7
changelog:
  - Use RHEL-7 dracut semantics rather than RHEL-6
  - fix dependencies so nss-softokn pulls in nss-softokn-freebl
  - keep dummy libfreebl3.chk for dracut kernel.


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-8
changelog:
  - fix permissions on dracut install file.
  - Resolves: Bug 1169957 - curl unable to download url when url is https and environment is dracut


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-14
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Dennis Gilmore <dennis@ausil.us> 3.12.3.99.3-10
changelog:
  - dont include the headers in nss-util only in the -devel package
  - nss-util-devel Requires nss-devel since its only providing a subset of the headers.


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-11
changelog:
  - Remove spurious executable permissions from nss-util-config
  - Shorten some descriptions to keep rpmlint happy


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - Apply nss-nolocalsql patch subset for nss-util
  - No rpath-link in nss-util-config


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-0.1.beta.1
changelog:
  - Update to NSS_3_13_4_BETA1
  - Improve steps to splitting off util from the nss
  - Add executable attribute to the splitting script


author: Elio Maldonado <emaldona@redhat.com> - 3.13.4-2
changelog:
  - Resolves: Bug 805716 - Library needs partial RELRO support added
  - Patch coreconf/Linux.mk as done on RHEL 6.2


author: Elio Maldonado <emaldona@redhat.com> - 3.15.beta1-0.1.beta.1
changelog:
  - Update to NSS_3_15_BETA1
  - Update spec file, patches, and helper scripts on account of a shallower source tree


author: Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta1.2
changelog:
  - Don't include prtypes.h from hasht.t
  - Resolves: rhbz#953277 - rawhide build of glibc fails due to fatal error from nss3/hasht.h


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Add the nss-util portion of a fix for a bug in nss and nss-util
  - Resolves: Bug 752980 - Support ECDSA via pluggable ECC in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Update to nss-3.15.4
  - Modified the nss-split-util script to use the nss upstream pristine sources
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue [rhel-7.0]


author: Peter Robinson <pbrobinson@redhat.com> 3.16.2-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1126244 - Ensure nss-util is built for 64 bit on ppc64le
  - Fix contributed by Peter Robinson <pbrobinson@redhat.com>


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Bump the release number to be higher than the one for rhel-7.0
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - comment out default values for keys, warn about starting with -A (#19316).
  - take out -A from ntpd startup as well.
  - update to 4.0.99k.


author: Preston Brown <pbrown@redhat.com>
changelog:
  - allow comments in %{_sysconfdir}/ntp/step-tickers file (#28786).
  - need patch0 (glibc patch) on ia64 too


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - require/buildprereq libcap/libcap-devel
  - use 'ntp' user, tune the pre/post scripts, %files
  - add $OPTIONS to the init script


author: Pekka Savola <pekkas@netcore.fi>
changelog:
  - Add the remote root exploit patch (based on ntp-hackers).
  - Enhance droproot patch (more documentation, etc.) <Jarno.Huuskonen@uku.fi>
  - Tweak the droproot patch to include sys/prctl.h, not linux/prctl.h
  (implicit declarations)
  - Remote groupdel commands, shouldn't be needed.
  - Removed -Wcast-qual and -Wconversion due to excessive warnings (hackish).
  - Make ntp compilable with both glibc 2.1 and 2.2.x (very dirty hack)
  - Add %{_sysconfdir}/sysconfig/ntpd which drops root privs by default


author: Harald Hoyer <harald@redhat.de>
changelog:
  - new snapshot
  - removed typos and security patch (already there)
  - commented multicastclient in config file


author: Harald Hoyer <harald@redhat.de> 4.1.0-1
changelog:
  - wow, how stupid can a man be ;).. fixed #50698 
  - updated to 4.1.0 (changes are small and in non-critical regions)


author: Harald Hoyer <harald@redhat.de> 4.1.0b-4
changelog:
  - created drift with dummy value #58294
  - grep for timeservers in ntp.conf also for ntpdate #57837
  - check return value of ntpdate #58836


author: Harald Hoyer <harald@redhat.de> 4.1.1b-1
changelog:
  - updated to version 4.1.1b
  - improved initscript - use ntpdate on -x
  - improved initscript - open firewall only for timeservers
  - ntp-4.1.1a-adjtime.patch removed (already in source)
  - ntp-4.1.1a-mfp.patch removed (already in source)
  - ntp-4.0.99j-vsnprintf.patch removed (already in source)


author: Harald Hoyer <harald@redhat.com> - 4.2.0.a.20040617-4
changelog:
  - removed firewall hole punching from the initscript; rely on iptables
    ESTABLISHED,RELATED or manual firewall configuration


author: Jindrich Novy <jnovy@redhat.com> 4.2.0.a.20050816-1
changelog:
  - update to the latest stable 4.2.0.a.20050816
  - drop upstreamed .gcc4, .vsnprintf patches
  - remove obsolete .autofoo patch
  - make patch numbering less chaotic
  - don't package backup for .droproot patch


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-2
changelog:
  - Fix fails on upgrade, if ntpd is disabled (#166773)
  - A cosmetic patch. There are some comments and braces '{' '}' added.
  - One unprintable character was converted to octal-form .
  - It can be removed anytime (conversion of the cvs-projets for C-Frame 121,
  - (auto-debug, auto-trace for cfr-printnet server).


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-3
changelog:
  - A similar patch as ntp-4.0.99j-vsnprintf.patch in FEDORA CORE 4
  - (current patch is ntp-stable-4.2.0a-20050816-vsnprintf.patch)


author: Petr Raszyk <praszyk@redhat.com> 4.2.0.a.20050816-10
changelog:
  - ntpd does not submit his local clock (if there is no peer).
    ntpdate->ntpd #163862 , Patch13: ntp-stable-4.2.0a-20050816-loconly.patch


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-11
changelog:
  - update man pages (#153195, #162856)
  - drop C-Frame-121, vsnprintf, minusTi and loconly patch
  - prevent segfault when loopback interface is not configured (#159056)
  - spec cleanup


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-12
changelog:
  - fix initscript:
    - replace -U with -u in getopts (#187003)
    - don't pass group to ntpdate -U argument and ignore -i in options (#142926)
    - set ntpconf for -c
    - remove -p 8 from ntpdate arguments
    - don't call ntpdate when step-tickers doesn't contain anything useful
      and -x isn't in options
  - fix default keyfile for ntpdate (#183196)


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.2.0.a.20050816-14
changelog:
  - modify ntp.conf, change default restrict, remove broadcastdelay,
    use fedora.pool.ntp.org (#189667)
  - don't install drift file
  - remove unsupported options from ntptrace manpage (#137717)
  - fix default paths in manpages for ntp-keygen and ntpdate


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2-3
changelog:
  - fix manycast support in ntpdate (#194329)
  - reply to manycast requests with null refid
  - enable mlockall (#195617)
  - correct threshold value in ntpdate manpage


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p4-1
changelog:
  - update to 4.2.2p4
  - fix buffer overflow in WWV Audio driver (#216309)
  - don't mark init script as config


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-1
changelog:
  - update to 4.2.4 (#146884)
  - don't use local clock in default config
  - autogenerate man pages from HTML
  - clean up spec a bit


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-3
changelog:
  - disable autoopts option preset mechanisms for ntpd
  - document -I option of ntpd
  - generate makewhatis friendly man pages


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4-4
changelog:
  - don't wake up every second (#204748)
  - add option to enable memory locking (#195617)
  - fix broadcast client
  - use option values in ntp-keygen
  - improve man pages


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p0-1
changelog:
  - update to 4.2.4p0
  - fix init script
    - don't add second -g to ntpd options (#228424)
    - update getopts
    - skip all refclocks when parsing ntp.conf
  - spec cleanup


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p0-3
changelog:
  - fix interface updates with -I or -L option (#240254)
  - accept multiple -I options
  - fix broadcast client/server to accept/allow sending
    broadcasts on 255.255.255.255 (#226958)
  - fix return codes in init script (#240120)
  - exit with nonzero code if ntpd -q did not set clock (#240134)
  - drop revert452 patch, fixed in kernel 2.6.19
  - make with _smp_mflags


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p2-2
changelog:
  - ignore tentative addresses (#246297)
  - improve init script (#247003)
  - fix sleep patch
  - ease Autokey setup (#139673)
    - change default keysdir to /etc/ntp/crypto
    - set crypto password in /etc/ntp/crypto/pw
    - don't use randfile if /dev/urandom is used by OpenSSL
  - change default statsdir to /var/log/ntpstats/, use statistics type
    as default filename
  - package more doc files


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p2-5
changelog:
  - avoid use of uninitialized floating-point values in clock_select
  - update license tag (Tom "spot" Callaway)
  - drop sntp, MSNTP license is non-free


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-1
changelog:
  - update to 4.2.4p4
  - fix default NTP version for outgoing packets in ntpdate man page
    (#245408)
  - replace BSD with advertising code in ntpdc and ntpq


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-4
changelog:
  - reset kernel frequency when -x option is used
  - create separate init script for ntpdate
  - add note about paths and exit codes to ntpd man page


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-5
changelog:
  - fix building IPv6 support with new glibc-headers (#436713)
  - avoid unaligned memory access (#435301)
  - fix receiving broadcasts on 255.255.255.255


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p4-7
changelog:
  - reload resolv.conf after temporary failure in name resolution (#456743)
  - use clock_gettime
  - make subpackages for perl scripts and ntpdate (#452097, #456116)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p5-2
changelog:
  - retry failed name resolution few times before giving up (#460561)
  - don't write drift file upon exit
  - run ntpq with full path in ntp-wait script


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p6-1
changelog:
  - update to 4.2.4p6 (CVE-2009-0021)
  - include dhclient script (David Cantrell)
  - convert COPYRIGHT to UTF-8


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p6-4
changelog:
  - don't restart ntpd in dhclient script with every renewal
  - fix buffer overflow in ntpq (#490617)
  - check status in condrestart (#481261)
  - don't crash when compiled with HAVE_TIMER_CREATE (#486217)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-1
changelog:
  - update to 4.2.4p7 (CVE-2009-1252)
  - improve PLL response when kernel discipline is disabled
  - don't log STA_MODE changes
  - enable nanokernel support
  - allow minpoll 3
  - increase memlock limit
  - move html documentation to -doc subpackage (#492444)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-2
changelog:
  - fix frequency calculation when starting with no drift file
  - reduce phase adjustments beyond Allan intercept in daemon PLL


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.4p7-3
changelog:
  - handle system time jumps better
  - don't wake up every second for refclocks without timer
  - don't crash in ntpstat when unknown clock type is received (#505564)
  - make ntpstat process first packet in multipacket response
  - switch to editline
  - set pool.ntp.org vendor zone in spec (#512711)
  - compile with -fno-strict-aliasing


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p1-0.1.rc5
changelog:
  - update to 4.2.6p1-RC5
  - support NTPSERVERARGS variable in dhclient script (#558110)
  - don't use deprecated egrep (#548182)
  - don't verify ntp.conf (#481151)
  - compile with PPS API support
  - include new sntp


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p1-2
changelog:
  - update ntpstat to use current system variable names (#588067)
  - print synchronization distance instead of dispersion in ntpstat
  - clarify ntpd -q description


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p2-2
changelog:
  - add support for systemd (#617328)
  - retry few times in ntpdate init script before giving up (#445229)
  - add fourth pool server to default ntp.conf and use iburst


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p2-5
changelog:
  - remove systemctl dependency for now
  - suppress chkconfig output in %post (#629285)
  - generate ntp_decode(5) man page (#632300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p3-0.1.rc10
changelog:
  - update to 4.2.6p3-RC10
  - fix system peer unmarking when unreachable
  - fix broadcastdelay option
  - fix automatic broadcast delay calibration
  - fix ntp-keygen -V crash
  - avoid unnecessary timeout in ntpdate
  - drop nano patch
  - convert ChangeLog to UTF-8


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p3-3
changelog:
  - pull in time-sync.target from ntpdate.service (Lennart Poettering)
  - link with -Wl,-z,relro,-z,now options
  - fix typo in ntpq man page (#664525)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-2
changelog:
  - update service file for systemd-timedated-ntp target (#816495)
  - allow service to set realtime scheduler (#810801)
  - drop comment enabling local driver in default config


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-4
changelog:
  - start ntpdate service after nss-lookup.target (#837486)
  - update systemd-timedated integration (#846077)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - fix crash in FIPS mode (#839280)
  - use systemd macros if available (#850235)
  - remove obsolete macros


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-6
changelog:
  - bind broadcast client to new interfaces (#722690)
  - decode hex encoded passwords in ntpq/ntpdc
  - remove sample MD5 keys from default keys config


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-7
changelog:
  - allow selection of cipher for private key files
  - set identity modulus size in ntp-keygen
  - create sntp subpackage
  - add sntp service
  - use system libopts
  - add Wants=ntp-wait.service to ntpd service
  - don't fail when /etc/sysconfig/ntpd is missing
  - modify mlock and multiopts patches to use autogen
  - make perl subpackage noarch


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-11
changelog:
  - avoid rereading /etc/services (#768804)
  - remove ntp-wait dependency from ntpd service (#906753)
  - add missing and remove unrecognized options in documentation
  - update comments in some config files


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12
changelog:
  - workaround failing autogen
  - move files from /lib
  - don't own ntp-units.d directory
  - drop old systemd scriptlets
  - fix dates in changelog


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-13
changelog:
  - ignore duplicate servers from dhclient
  - don't use -Wstrict-overflow with -fno-strict-overflow
  - buildrequire systemd-units
  - remove pie test


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-16
changelog:
  - refresh peers on routing updates (#1048132)
  - fix calculation of root dispersion (#1045377)
  - remove unnecessary IPv6 restrict line from default ntp.conf (#1048255)
  - remove kod from default restrict in ntp.conf (#1048255)
  - update logconfig documentation for patched default (#1048252)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-19
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-20
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems (CVE-2015-3405)
  - add option to set Differentiated Services Code Point (DSCP) (#1202828)
  - add nanosecond support to SHM refclock (#1117702)
  - allow creating all SHM segments with owner-only access (#1122012)
  - allow different thresholds for forward and backward step (#1193154)
  - allow symmetric keys up to 32 bytes again (#1191111)
  - don't step clock for leap second with -x option (#1191122)
  - don't drop packets with source port below 123 (#1171640)
  - retry joining multicast groups (#1207014)
  - increase memlock limit again (#1053569)
  - warn when monitor can't be disabled due to limited restrict (#1191108)
  - use larger RSA exponent in ntp-keygen (#1191116)
  - fix crash in ntpq mreadvar command (#1180721)
  - move sntp kod database to allow SELinux labeling (#1082934)
  - fix typos in ntpd man page (#1195211)
  - improve documentation of restrict command (#1213953)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22.el7_2.2
changelog:
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Ade Lee <alee@redhat.com> 1.0.0-14
changelog:
  - Resolves: #643546 - [RFE] Add nuxwdog to RHEL.
  - Remove old encryption scheme
  - Store passwords in kernel keyring


author: Ade Lee <alee@redhat.com> - 1.0.1-10
changelog:
  - Resolves: rhbz#1117072 -  ppc64le is missing from ExcludeArch
  - reverted the previous change.  ppc64le now removed from ExcludeArch


author: Ade Lee <alee@redhat.com> 1.0.2-1
changelog:
  - Allow passwords to be retrieved post-init phase
  - Fix null termination issue on returned stored passwords


author: Toshio Kuratomi <toshio-tiki-lounge.com> - 3.08.3-4
changelog:
  - Fix for gcc4 and the 32 bit assembly in otherlibs/num.
  - Fix to allow compilation with RPM_OPT_FLAG defined -O level.


author: Richard W.M. Jones <rjones@redhat.com> - 3.10.0-5
changelog:
  - Don't include the release number in fedora-ocaml-release file, so
    that packages built against this won't depend on the Fedora release.


author: Richard W.M. Jones <rjones@redhat.com> - 3.10.0-6
changelog:
  - ocaml-runtime provides ocaml(runtime) = 3.10.0, and
    ocaml-find-requires.sh modified so that it adds this requires
    to other packages.  Now can upgrade base ocaml packages without
    needing to rebuild everything else.


author: Richard W.M. Jones <rjones@redhat.com> - 3.10.0-7
changelog:
  - Run chrpath to delete rpaths used on some of the stublibs.
  - Ignore Parsetree module in dependency calculation.
  - Fixed ocaml-find-{requires,provides}.sh regexp calculation so it doesn't
    over-match module names.


author: Richard W.M. Jones <rjones@redhat.com> - 3.10.2-3
changelog:
  - ocaml-ocamldoc provides ocamldoc (bz #449931).
  - REMOVED provides of labltk, camlp4.  Those are libraries and all
    packages should now depend on ocaml-labltk / ocaml-camlp4 / -devel
    as appropriate.


author: Richard W.M. Jones <rjones@redhat.com> - 3.11.1-1
changelog:
  - OCaml 3.11.1 (this is virtually the same as the release candidate
    that we were using for Fedora 12).


author: Richard W.M. Jones <rjones@redhat.com> - 3.11.1-2
changelog:
  - ocaml-find-requires.sh: Calculate runtime version using ocamlrun
    -version instead of fedora-ocaml-release file.


author: Richard W.M. Jones <rjones@redhat.com> - 3.11.1-7
changelog:
  - Remove ocaml-find-{requires,provides}.sh from this package.  These are
    now in upstream RPM 4.8 (RHBZ#545116).
  - define -> global in a few places.


author: Richard W.M. Jones <rjones@redhat.com> - 3.12.0-1
changelog:
  - New upstream version 3.12.0.
    http://fedoraproject.org/wiki/Features/OCaml3.12
  - Remove ppc64 support patch.
  - Rebase rpath removal patch.
  - ocamlobjinfo is now an official tool, so no need to compile it by hand.
    Add objinfo_helper.
  - Disable ocamlplugininfo.
  - Remove addlabels, scrapelabels.
  - Remove ocaml/stublibs/dlltkanim.so.


author: Richard W.M. Jones <rjones@redhat.com> - 3.12.0-2
changelog:
  - Try depending on OCaml BR to fix:
    /usr/lib/rpm/ocaml-find-provides.sh: /builddir/build/BUILDROOT/ocaml-3.12.0-1.fc15.i386/usr/bin/ocamlobjinfo: /usr/bin/ocamlrun: bad interpreter: No such file or directory


author: Richard W.M. Jones <rjones@redhat.com> - 3.12.0-7
changelog:
  - Allow this package to be compiled on platforms without native
    support and/or natdynlink, specifically ppc64.  This updates (and
    hopefully does not break) DJ's previous *.cmxs change for arm.


author: Richard W.M. Jones <rjones@redhat.com> 3.12.1-2
changelog:
  - add back ocaml-ppc64.patch for ppc secondary arch, drop .cmxs files
    from file list on ppc (cherry picked from F16 - this should have
    gone into Rawhide originally then been cherry picked back to F16)


author: Richard W.M. Jones <rjones@redhat.com> 3.12.1-3
changelog:
  - New ARM backend by Benedikt Meurer, backported to OCaml 3.12.1.
    This has several advantages, including enabling natdynlink on ARM.
  - Provide updated config.guess and config.sub (from OCaml upstream tree).


author: Richard W.M. Jones <rjones@redhat.com> 3.12.1-6
changelog:
  - Move patches to external git repo:
    http://git.fedorahosted.org/git/?p=fedora-ocaml.git
    There should be no change introduced here.


author: Richard W.M. Jones <rjones@redhat.com> 3.12.1-8
changelog:
  - Modify the ppc64 patch to reduce the delta between power64 and
    upstream power backends.
  - Clean up the spec file and bring it up to modern standards.
    * Remove patch fuzz directive.
    * Remove buildroot directive.
    * Rearrange source unpacking.
    * Remove chmod of GNU config.* files, since git does it.
    * Don't need to remove buildroot in install section.
    * Remove clean section.
    * git am </dev/null to avoid hang (thanks Adam Jackson).
  - Note there is no functional change in the above.


author: Richard W.M. Jones <rjones@redhat.com> 3.12.1-9
changelog:
  - Include svn rev 12548 to fix invalid generation of Thumb-2 branch
    instruction TBH (upstream PR#5623, RHBZ#821153).


author: Richard W.M. Jones <rjones@redhat.com> 3.12.1-10
changelog:
  - Include patch to link dllthreads.so with -lpthread explicitly, to
    fix problem with 'pthread_atfork' symbol missing (statically linked)
    on ppc64.


author: Richard W.M. Jones <rjones@redhat.com> 3.12.1-11
changelog:
  - ppc64: Fix position of stack arguments to external C functions
    when there are more than 8 parameters.


author: Richard W.M. Jones <rjones@redhat.com> 3.12.1-12
changelog:
  - ppc64: Include fix for minor heap corruption because of unaligned
    minor heap register (RHBZ#826649).
  - Unset MAKEFLAGS before running build.


author: Richard W.M. Jones <rjones@redhat.com> 4.00.0-0.3.beta2
changelog:
  - Upgrade to OCaml 4.00.0 beta 2.
  - The language is now officially called OCaml (not Objective Caml, O'Caml etc)
  - Rebase patches on top:
    . New ARM backend patch no longer required, since upstream.
    . Replacement config.guess, config.sub no longer required, since upstream
      versions are newer.
  - PPC64 backend rebased and fixed.
    . Increase the default size of the stack when compiling.
  - New tool: ocamloptp (ocamlopt profiler).
  - New VERSION file in ocaml-runtime package.
  - New ocaml-compiler-libs subpackage.
  - Rearrange ExclusiveArch alphanumerically.
  - alpha, ia64 native backends have been removed upstream, so they are
    no longer supported as native compiler targets.
  - Remove defattr.
  - Make OCaml dependency generator self-contained so it doesn't need
    previous version of OCaml around.


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-1
changelog:
  - Update to new major version OCaml 4.01.0.
  - Rebase patches.
  - Remove bogus Requires 'ncurses-devel'.  The base ocaml package already
    pulls in the library implicitly.
  - Remove bogus Requires 'gdbm-devel'.  Nothing in the source mentions gdbm.
  - Use mkstemp instead of mktemp in ocamlyacc.
  - Add LICENSE as doc to some subpackages to keep rpmlint happy.
  - Remove .ignore file from some packages.
  - Remove period from end of Summary.


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-4
changelog:
  - Add bundled(md5-plumb) (thanks: Tomas Mraz).
  - Add NON-upstream (but being sent upstream) patch to allow --flag=arg
    as an alternative to --flag arg (RHBZ#1028650).


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-8
changelog:
  - Don't use ifarch around Patch lines, as it means the patch files
    don't get included in the spec file.


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-14
changelog:
  - Remove ExclusiveArch.
  - Add ocaml-srpm-macros subpackage containing arch macros.
  - See: RHBZ#1087794


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-22
changelog:
  - Update to last 4.01 version from OCaml git.
  - Fix bug in argument parsing
    resolves: rhbz#1139803


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-22.2
changelog:
  - Use -fno-strict-aliasing when building the compiler
  - ppc, ppc64, ppc64le: Mark stack as non-executable.
    resolves: rhbz#990521
  - Provides ocaml(runtime) 4.01.1.
    related: rhbz#1098459


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.2.2-2
changelog:
  - Modified SPEC to follow the conventions and guidelines.
  - Addressed review comments from Mohamed El Morabity.
  - Added systemd script.
  - Verified and built the RPMS for Fedora 18.
  - Fixed rpmlint warnings.
  - Split the UX components in a separate package for desktops.
  - Split the help files in a separate package for help.
  - Split the guestlib headers in a separate devel package.


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.2.2-3
changelog:
  - Applied review fixes patch from Simone Caronni.
  - Added missing *.a and *.so files for devel package.
  - Removed unnecessary *.la plugin files from base package.


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.2.2-4
changelog:
  - Applied part of review fixes patch from Simone Caronni for systemd setup.
  - Replaced tabs with spaces all over.


author: Simone Caronni <negativo17@gmail.com> - 9.2.2-5
changelog:
  - Added RHEL 5/6 init script.
  - Renamed SysV init script / systemd service file to vmtoolsd.
  - Fixed ownership of files from review.
  - Moved api documentation in devel subpackage.
  - Removed static libraries.


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.2.2-6
changelog:
  - Replaced vmtoolsd with a variable.
  - Changed summary for subpackages to be more specific.
  - Removed drivers.txt file as we don't really need it.
  - Fixed vmGuestLib ownership for devel package.
  - Removed systemd-sysv from Requires for Fedora 18+ and RHEL 7+.
  - Made all "if" conditions consistent.


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.2.2-7
changelog:
  - Applied patch from Simone for removal of --docdir option from configure.
  - Removed unnecessary --enable-docs option from configure.
  - Removed doxygen dependency.


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.2.2-8
changelog:
  - Removed FreeSans.ttf font file from packaging.
  - Added 'rm' command to remove font file in %check section because
    'make check' adds it back.
  - Added doxygen dependency back.


author: Simone Caronni <negativo17@gmail.com> - 9.2.2-9
changelog:
  - Removed rm command in %check section.
  - Remove blank character at the beginning of each changelog line.


author: Ravindra Kumar <ravindrakumar at vmware.com> - 9.2.2-10
changelog:
  - Addressed formal review comments from Simone Caronni.
  - Removed %check section because 'make check' brings font file back.


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.2.2-12
changelog:
  - Removed %defattr and BuildRoot.
  - Added ExclusiveArch.
  - Replaced /usr/sbin/ldconfig with /sbin/ldconfig.


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.2.3-1
changelog:
  - Package new upstream version open-vm-tools-9.2.3-1031360.
  - Removed configure options CUSTOM_PROCPS_NAME (for libproc) and
    -Wno-deprecated-declarations as these have been addressed in
    open-vm-tools-9.2.3-1031360.


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.2.3-5
changelog:
  - Renamed source file open-vm-tools.service -> vmtoolsd.service
    to match it with the service name.


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.2.3-10
changelog:
  - Added options for hardening build (bug 990549). 
  - Excluded unwanted file mount.vmhgfs from packaging (bug 990547).
  - Removed deprecated key "Encoding" from "Desktop Entry" (bug 990552).


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.4.0-1
changelog:
  - Package new upstream version open-vm-tools-9.4.0-1280544.
  - Added CUSTOM_PROCPS_NAME=procps and -Wno-deprecated-declarations
    for version 9.4.0.


author: Richard W.M. Jones <rjones@redhat.com> - 9.4.0-4
changelog:
  - Removed unnecessary package dependency on 'dbus'
  - Moved 'vm-support' script to /usr/bin
  - Added a call to 'tools.set.version' RPC to inform VMware
    platform when open-vm-tools has been uninstalled
  - Add missing package dependency on 'which' (BZ#1045709)
  - Add missing package dependencies (BZ#1045709, BZ#1077320)


author: Ravindra Kumar <ravindrakumar@vmware.com> - 9.10.2-1
changelog:
  - Package new upstream version open-vm-tools-9.10.2-2822639
  - Removed the patches that are no longer needed
    resolves: rhbz#1172833


author: Brad Hards <bradh@frogmouth.net> - 0:0.8-0.2.svnr674.fc10
changelog:
  - Bump version
  - Install documentation / man pages correctly
  - Remove epoch (per https://bugzilla.redhat.com/show_bug.cgi?id=453395)
  - Remove %post and %postun (per https://bugzilla.redhat.com/show_bug.cgi?id=453395)
  - Remove talloc dependency (per https://bugzilla.redhat.com/show_bug.cgi?id=453395)
  - Take out libmapiproxy, because we aren't up to server side yet.


author: Simo Sorce <ssorce@redhat.com> - 0.10.9-2
changelog:
  - New snapshot that avoid bison issues.
  - Also add patch that fix build (previously erroneously preapplied in the
    snapshot tarball)
  - Fix timestamps in tarball
  - Fix specfile's install and files section to cope with newer version changes


author: Matthew Barnes <mbarnes@redhat.com> - 0.10.9-3
changelog:
  - Move libmapiproxy.so, libmapistore.so and mapistore backend libraries
    to the main package so the client subpackage is installable.


author: Matthew Barnes <mbarnes@redhat.com> - 0.10.9-4
changelog:
  - OpenChange relies on a private Samba 4 library (libsamba-util-common).
    Add extra linker flags to libmapi.pc to compensate.


author: Milan Crha <mcrha@redhat.com> - 0.11-1
changelog:
  - Update to OpenChange 0.11 Transporter upstream release
  - Remove unnecessary build modification patches.
  - Add patch to not use mapi_ctx->session as a TALLOC_CTX (OpenChange issue #366)
  - Add patch to read/write PidNameKeywords (OpenChange issue #367)


author: Milan Crha <mcrha@redhat.com> - 1.0-1
changelog:
  - Update to 1.0
  - Enable packages for server part and python bindings
  - Skip man3 pages, which are generated incomplete (use devhelp instead)


author: Milan Crha <mcrha@redhat.com> - 1.0-7
changelog:
  - Add patch to use system's popt.h
  - Add patch to compile only certain parts of the package
  - Disable openchange-server for rawhide too (due to samba4 changes)


author: Milan Crha <mcrha@redhat.com> - 1.0-8
changelog:
  - Add patch for OpenChange bug #397 (crash under MAPIUninitialize)
  - Disable build of python and mapiproxy


author: Michal Schmidt <mschmidt@redhat.com> - 2.2.8-4
changelog:
  - Return support for crypto hw on s390.
  - Renamed to opencryptoki.
  - Simplified multilib by putting libs in subpackage as suggested by Dan Horák.


author: Dan Horák <dan[at]danny.cz> - 2.4.1-1
changelog:
  - new upstream release 2.4.1
  - convert from initscript to systemd unit
  - import fixes from RHEL-6 about root's group membership (#732756, #730903)


author: Dan Horák <dan[at]danny.cz> - 2.4.2-3
changelog:
  - add virtual opencryptoki(token) Provides to token modules and as Requires
    to main package (#904986)


author: Dan Horák <dan[at]danny.cz> - 3.0-8
changelog:
  - include token specific directories (#1013017, #1045775, #1054442)
  - fix pkcsconf crash for non-root users (#1054661)
  - the libs subpackage must care of creating the pkcs11 group, it's the first to be installed
  - fix build with -Werror=format-security (#1037228)
  - Resolves: #1054442, #1054661


author: Petr Lautrbach <plautrba@redhat.com> 3.2-3
changelog:
  - Correctly declare OAEP parameter in RSA Wrap tests to prevent a possible
    scope issue (#1088512)
  - several fixes for pkcsep11_migrate


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 1.2.7
  - fix some bugs from bugzilla (#4885, #4887, #4888, #4967)
  - take include files out of base package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add -D_REENTRANT to make threaded stuff more stable, even though it looks
    like the sources define it, too
  - mark *.ph files in migration tools as config files


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move the defaults for databases and whatnot to /var/lib/ldap (bug #10714)
  - fix some possible string-handling problems


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.10
  - add revamped version of patch from kos@bastard.net to allow execution as
    any non-root user
  - remove test suite from %build because of weirdness in the build system


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - more minimalistic fix for bug #11111 after consultation with OpenLDAP team
  - backport replacement for the ldapuser patch


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 1.2.11
  - add condrestart logic to init script
  - munge migration scripts so that you don't have to be
    /usr/share/openldap/migration to run them
  - add code to create pid files in /var/run


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak init script to return error codes properly
  - change initscripts dependency to one on /etc/init.d


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - switch to gdbm; I'm getting off the db merry-go-round
  - tweak the init script some more
  - add instdir to @INC in migration scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - split off clients and servers to shrink down the package and remove the
    base package's dependency on Perl
  - make certain that the binaries have sane permissions


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build a semistatic slurpd with threads, everything else without
  - disable reverse lookups, per email on OpenLDAP mailing lists
  - make sure the execute bits are set on the shared libraries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add the nis.schema and inetorgperson.schema to the default server config
  - make ldapadd a hard link to ldapmodify because they're identical binaries


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.0.6
  - add buildprereq on cyrus-sasl-devel, krb5-devel, openssl-devel
  - take the -s flag off of slapadd invocations in migration tools
  - add the cosine.schema to the default server config, needed by inetorgperson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - try adding the suffix first when doing online migrations
  - force ldapadd to use simple authentication in migration scripts
  - add indexing of a few attributes to the default configuration
  - add commented-out section on using TLS to default configuration


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add missing required attributes to conversion scripts to comply with schema
  - add schema for mail aliases, autofs, and kerberosSecurityObject rooted in
    our own OID tree to define attributes and classes migration scripts expect
  - tweak automounter migration script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - reorganize the patch list to separate MigrationTools and OpenLDAP patches
  - switch to Luke Howard's rfc822MailMember schema instead of the aliases.schema
  - configure slapd to run as the non-root user "ldap" (#19370)
  - chdir() before chroot() (we don't use chroot, though) (#19369)
  - disable saving of the pid file because the parent thread which saves it and
    the child thread which listens have different pids


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add Norbert Klasen's patch (via Del) to fix searches using ldaps URLs
    (OpenLDAP ITS #889)
  - add "-h ldaps:///" to server init when TLS is enabled, in order to support
    ldaps in addition to the regular STARTTLS (suggested by Del)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change automount object OID from 1.3.6.1.1.1.2.9 to 1.3.6.1.1.1.2.13,
    per mail from the ldap-nis mailing list


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add support for additional OPTIONS, SLAPD_OPTIONS, and SLURPD_OPTIONS in
    a /etc/sysconfig/ldap file (#23549)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - back out pidfile patches, which interact weirdly with Linux threads
  - mark non-standard schema as such by moving them to a different directory


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build dummy certificate in %post, use it in default config
  - configure-time shenanigans to help a confused configure script


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move shared libraries to /lib
  - redo init script for better internationalization (#26154)
  - don't use ldaprc files in the current directory (#38402) (patch from
    hps@intermeta.de)
  - add BuildPrereq on tcp wrappers since we configure with
    --enable-wrappers (#43707)
  - don't overflow debug buffer in mail500 (#41751)
  - don't call krb5_free_creds instead of krb5_free_cred_contents any
    more (#43159)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - require cyrus-sasl-md5 (support for DIGEST-MD5 is required for RFC
    compliance) by name (follows from #43079, which split cyrus-sasl's
    cram-md5 and digest-md5 modules out into cyrus-sasl-md5)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a build-time requirement on pam-devel
  - add a build-time requirement on a sufficiently-new libtool to link
    shared libraries to other shared libraries (which is needed in order
    for prelinking to work)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.12-1
changelog:
  - update to 2.0.12 to pull in fixes for setting of default TLS options, among
    other things
  - update to migration tools 39
  - drop tls patch, which was fixed better in this release


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable kbind support (deprecated, and I suspect unused)
  - configure with --with-kerberos=k5only instead of --with-kerberos=k5
  - build slapd with threads


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.20-2
changelog:
  - temporarily disable optimizations for ia64 arches
  - specify pthreads at configure-time instead of letting configure guess


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.22-2
changelog:
  - switch to an internalized Berkeley DB as the ldbm back-end  (NOTE: this breaks
    access to existing on-disk directory data)
  - add slapcat/slapadd with gdbm for migration purposes
  - remove Kerberos dependency in client libs (the direct Kerberos dependency
    is used by the server for checking {kerberos} passwords)


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-1
changelog:
  - update to 2.0.25 "stable", ldbm-over-gdbm (putting off migration of LDBM
    slapd databases until we move to 2.1.x)
  - use %{_smp_mflags} when running make
  - update to MigrationTools 44
  - enable dynamic module support in slapd


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.25-2
changelog:
  - change LD_FLAGS to refer to /usr/kerberos/_libdir instead of
    /usr/kerberos/lib, which might not be right on some arches


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - incorporate fixes from SuSE's security audit, except for fixes to ITS 1963,
    1936, 2007, 2009, which were included in 2.0.26.
  - add two more patches for db 4.1.24 from sleepycat's updates page
  - use openssl pkgconfig data, if any is available


author: Nalin Dahyabhai <nalin@redhat.com> 2.0.27-8
changelog:
  - back down to db 4.0.x, which 2.0.x can compile with in ldbm-over-db setups
  - tweak SuSE patch to fix a few copy-paste errors and a NULL dereference


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.1.17
  - disable the shell backend, not expected to work well with threads
  - drop the kerberosSecurityObject schema, the krbName attribute it
    contains is only used if slapd is built with v2 kbind support


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - install the db utils for the bundled libdb as %{_sbindir}/slapd_db_*
  - install slapcat/slapadd from 2.0.x for migration purposes


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-0
changelog:
  - 2.1.22 now badged stable
  - be more aggressive in what we index by default
  - use/require libtool 1.5


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - actually require newer libtool, as was intended back in 2.1.22-0, noted as
    missed by Jim Richardson


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - build bundled libdb for slapd dynamically to make the package smaller,
    among other things
  - on tls-capable arches, build libdb both with and without shared posix
    mutexes, otherwise just without
  - disable posix mutexes unconditionally for db 4.0, which shouldn't need
    them for the migration cases where it's used
  - update to MigrationTools 45


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.22-8
changelog:
  - add another section to the ABI note for the TLS libdb so that it's marked as
    not needing an executable stack (from Arjan Van de Ven)


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-1
changelog:
  - change logging facility used from daemon to local4 (#112730, reversing #11047)
    BEHAVIOR CHANGE - SHOULD BE MENTIONED IN THE RELEASE NOTES.


author: Nalin Dahyabhai <nalin@redhat.com> 2.1.25-2
changelog:
  - fix incorrect use of find when attempting to detect a common permissions
    error in the init script (#114866)


author: Thomas Woerner <twoerner@redhat.com> 2.1.29-3
changelog:
  - removed rpath
  - added pie patch: slapd and slurpd are now pie
  - requires libtool >= 1.5.6-2 (PIC libltdl.a)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-1
changelog:
  - add compat-openldap subpackage
  - default to bdb, as upstream does, gambling that we're only going to be
    on systems with nptl now


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.13-2
changelog:
  - build a separate, static set of libraries for openldap-devel with the
    non-standard ntlm bind patch applied, for use by the evolution-connector
    package (#125579), and installing them under
    evolution_connector_prefix)
  - provide openldap-evolution-devel = version-release in openldap-devel
    so that evolution-connector's source package can require a version of
    openldap-devel which provides what it wants


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move slapd startup to earlier in the boot sequence (#103160)
  - update to 2.2.15 (stable-20040822)
  - change version number on compat-openldap to include the non-compat version
    from which it's compiled, otherwise would have to start 2.2.15 at release 3
    so that it upgrades correctly


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.17 (stable-20040923) (#135188)
  - move nptl libraries into arch-specific subdirectories on x86 boxes
  - require a newer glibc which can provide nptl libpthread on i486/i586


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.20-1
changelog:
  - update to 2.2.20 (stable-20050103)
  - warn about unreadable krb5 keytab files containing "ldap" keys
  - warn about unreadable TLS-related files
  - own a ref to subdirectories which we create under _libdir/tls


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.23-1
changelog:
  - update to 2.2.23 (stable-20050125)
  - update notes on upgrading from earlier versions
  - drop slapcat variations for 2.0/2.1, which choke on 2.2's config files


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.24-1
changelog:
  - update to 2.2.24 (stable 20050318)
  - export KRB5_KTNAME in the init script, in case it was set in the sysconfig
    file but not exported


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.2.26 (stable 20050429)
  - enable the lmpasswd scheme
  - print a warning if slaptest fails, slaptest -u succeeds, and one of the
    directories listed as the storage location for a given suffix in slapd.conf
    contains a readable file named __db.001 (#118678)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.26-1
changelog:
  - run slaptest with the -u flag if no id2entry db files are found, because
    you can't check for read-write access to a non-existent database (#156787)
  - add _sysconfdir/openldap/cacerts, which authconfig sets as the
    TLS_CACERTDIR path in /etc/openldap/ldap.conf now
  - use a temporary wrapper script to launch slapd, in case we have arguments
    with embedded whitespace (#158111)


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Add the tls-fix-connection-test patch to close
    bz#161991 openldap password disclosure issue
  - add the hop patches to prevent infinite looping when chasing referrals.
    OpenLDAP ITS #3578


author: Jay Fenlason <fenlason@redhat.com> 2.2.26-2
changelog:
  - Move the slapd.pem file to /etc/pki/tls/certs
    and edit the -config patch to match to close
    bz#143393  Creates certificates + keys at an insecure/bad place
  - also use _sysconfdir instead of hard-coding /etc


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-2
changelog:
  - Upgrade to 2.3.11, which upstream now considers stable.
  - Switch compat-openldap to 2.2.29
  - remove references to nss_ldap_build from the spec file
  - remove references to 2.0 and 2.1 from the spec file.
  - reorganize the build() function slightly in the spec file to limit the
    number of redundant and conflicting options passedto configure.
  - Remove the attempt to hardlink ldapmodify and ldapadd together, since
    the current make install make ldapadd a symlink to ldapmodify.
  - Include the -ads patches to allow SASL binds to an Active Directory
    server to work.  Nalin <nalin@redhat.com> wrote the patch, based on my
    broken first attempt.


author: Jay Fenlason <fenlason@redhat.com> 2.3.11-3
changelog:
  - Remove Requires: cyrus-sasl and cyrus-sasl-md5 from openldap- and
    compat-openldap- to close
    bz#173313 Remove exlicit 'Requires: cyrus-sasl" + 'Requires: cyrus-sasl-md5'


author: Jay Fenlason <fenlason@redhat.com> 2.3.19-2
changelog:
  - Upgrade to 2.3.19, which upstream now considers stable
  - Modify the -config.patch, ldap.init, and this spec file to put the
    pid file and args file in an ldap-owned openldap subdirectory under
    /var/run.
  - Move back_sql* out of _sbindir/openldap , which requires
    hand-moving slapd and slurpd to _sbindir, and recreating symlinks
    by hand.
  - Retire openldap-2.3.11-ads.patch, which went upstream.
  - Update the ldap.init script to run slaptest as the ldap user rather
    than as root.  This solves
    bz#150172 Startup failure after database problem
  - Add to the servers post and preun scriptlets so that on preun, the
    database is slapcatted to /var/lib/ldap/upgrade.ldif and the
    database files are saved to /var/lib/ldap/rpmorig.  On post, if
    /var/lib/ldap/upgrade.ldif exists, it is slapadded.  This means that
    on upgrades from 2.3.16-2 to higher versions, the database files may
    be automatically upgraded.  Unfortunatly, because of the changes to
    the preun scriptlet, users have to do the slapcat, etc by hand when
    upgrading to 2.3.16-2.  Also note that the /var/lib/ldap/rpmorig
    files need to be removed by hand because automatically removing your
    emergency fallback files is a bad idea.
  - Upgrade internal bdb to db-4.4.20.  For a clean upgrade, this will
    require that users slapcat their databases into a temp file, move
    /var/lib/ldap someplace safe, upgrade the openldap rpms, then
    slapadd the temp file.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-2
changelog:
  - New upstream release
  - Include the gethostbyname_r patch so that nss_ldap won't hang
    on recursive attemts to ldap_initialize.


author: Jay Fenlason <fenlason@redhat.com> 2.3.27-3
changelog:
  - Include --enable-multimaster to close
    bz#185821: adding slapd_multimaster to the configure options
  - Upgade guide.html to the correct one for openladp-2.3.27, closing
    bz#190383: openldap 2.3 packages contain the administrator's guide for 2.2
  - Remove the quotes from around the slaptestflags in ldap.init
    This closes one part of
    bz#204593: service ldap fails after having added entries to ldap
  - include __db.* in the list of files to check ownership of in
    ldap.init, as suggested in
    bz#199322: RFE: perform cleanup in ldap.init


author: Thomas Woerner <twoerner@redhat.com> 2.3.30-1.1
changelog:
  - tcp_wrappers has a new devel and libs sub package, therefore changing build
    requirement for tcp_wrappers to tcp_wrappers-devel


author: Jay Fenlason <fenlason<redhat.com> 2.3.34-1
changelog:
  - New upstream release
  - Upgrade the scripts for migrating the database so that they might
    actually work.
  - change bind-libbind-devel to bind-devel in BuildPreReq


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-2
changelog:
  - slapadd during package update is now quiet (bz#224581)
  - use _localstatedir instead of var/ during build (bz#220970)
  - bind-libbind-devel removed from BuildRequires (bz#216851)
  - slaptest is now quiet during service ldap start, if
    there is no error/warning (bz#143697)
  - libldap_r.so now links with pthread (bz#198226)
  - do not strip binaries to produce correct .debuginfo packages
    (bz#152516)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-3
changelog:
  - do not create script in /tmp on startup (bz#188298)
  - add compat-slapcat to openldap-compat (bz#179378)
  - do not import ddp services with migrate_services.pl
    (bz#201183)
  - sort the hosts by adders, preventing duplicities
    in migrate*nis*.pl (bz#201540)
  - start slupd for each replicated database (bz#210155)
  - add ldconfig to devel post/postun (bz#240253)
  - include misc.schema in default slapd.conf (bz#147805)


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-4
changelog:
  - Fix initscript return codes (#242667)
  - Provide overlays (as modules; #246036, #245896)
  - Add available modules to config file


author: Jan Safranek <jsafranek@redhat.com> 2.3.34-6
changelog:
  - fix compat-slapcat compilation. Now it can be found in
    /usr/lib/compat-openldap/slapcat, because the tool checks argv[0]
    (#246581)


author: Jan Safranek <jsafranek@redhat.com> 2.3.37-2
changelog:
  - do not use specific automake and autoconf
  - do not distinguish between NPTL and non-NPTL platforms, we have NPTL
    everywhere
  - db-4.6.18 integrated
  - updated openldap-servers License: field to reference BDB license


author: Jan Safranek <jsafranek@redhat.com> 2.3.38-2
changelog:
  - skeleton /etc/sysconfig/ldap added
  - new SLAPD_LDAP option to turn off listening on ldap:/// (#292591)
  - fixed checking of SSL (#292611)
  - fixed upgrade with empty database


author: Jan Safranek <jsafranek@redhat.com> 2.4.7-4
changelog:
  - fixed rpmlint warnings and errors
    - /etc/openldap/schema/README moved to /usr/share/doc/openldap


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-3
changelog:
  - reworked the upgrade logic, slapcat/slapadd of the whole database
    is needed only if minor version changes (2.3.x -> 2.4.y)
  - do not try to save database in LDIF format, if openldap-servers package
    is  being removed (it's up to the admin to do so manually)


author: Jan Safranek <jsafranek@redhat.com> 2.4.8-4
changelog:
  - bdb upgraded to 4.6.21
  - reworked upgrade logic again to run db_upgrade when bdb version
    changes


author: Jan Safranek <jsafranek@redhat.com> 2.4.11-3
changelog:
  - add SLAPD_SHUTDOWN_TIMEOUT to /etc/sysconfig/ldap, allowing admins
    to set non-default slapd shutdown timeout
  - add checkpoint to default slapd.conf file (#458679)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.15-3
changelog:
  - extended previous patch (#481310) to remove options cfMP
    from some client tools
  - correction of patch setugid (#494330)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.16-1
changelog:
  - rebase of openldap to 2.4.16
  - fixed minor issue in spec file (output looking interactive
    when installing servers)


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-2
changelog:
  - changed configuration approach. Instead od slapd.conf slapd
    is using slapd.d directory now
  - fix of some issues caused by renaming of init script
  - fix of buffer overflow issue in ldif.c pointed out by new glibc


author: Jan Zeleny <jzeleny@redhat.com> 2.4.18-4
changelog:
  - updated smbk5pwd patch to be linked with libldap (#526500)
  - the last buffer overflow patch replaced with the one from upstream
  - added /etc/openldap/slapd.d and /etc/openldap/slapd.conf.bak
    to files owned by openldap-servers


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.19-2
changelog:
  - fixed tls connection accepting when TLSVerifyClient = allow
  - /etc/openldap/ldap.conf removed from files owned by openldap-servers
  - minor changes in spec file to supress warnings
  - some changes in init script, so it would be possible to use it when
    using old configuration style


author: Jan Zeleny <jzeleny@redhat.com> - 2.4.22-1
changelog:
  - rebased to 2.4.22 (mostly bugfixes, added back-ldif, back-null testing support)
  - due to some possible issues pointed out in last update testing phase, I'm
    pulling back the last change (slapd can't be moved since it depends on /usr
    possibly mounted from network)


author: Rich Megginson <rmeggins@redhat.com> - 2.4.22-3
changelog:
  - added ldif.h to the public api in the devel package
  - added -lldif to the public api
  - added HAVE_MOZNSS and other flags to use Mozilla NSS for crypto


author: Jan Vcelak <jvcelak@redhat.com> - 2.4.22-6
changelog:
  - CVE-2010-0211 openldap: modrdn processing uninitialized pointer free (#605448)
  - CVE-2010-0212 openldap: modrdn processing IA5StringNormalize NULL pointer dereference (#605452)
  - obsolete configuration file moved to /usr/share/openldap-servers (#612602)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.22-7
changelog:
  - Mozilla NSS - delay token auth until needed (#616552)
  - Mozilla NSS - support use of self signed CA certs as server certs (#614545)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-1
changelog:
  - rebase to 2.4.23
  - embeded db4 library removed
  - removed bogus links in "SEE ALSO" in several man-pages (#624616)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-2
changelog:
  - fix possible infinite loop when checking permissions of TLS files (#641946)
  - removed outdated autofs.schema (#643045)
  - removed outdated README.upgrade
  - removed relics of migrationtools


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-3
changelog:
  - add support for multiple prefixed Mozilla NSS database files in TLS_CACERTDIR
  - reject non-file keyfiles in TLS_CACERTDIR (#652315)
  - TLS_CACERTDIR precedence over TLS_CACERT (#652304)
  - accept only files in hash.0 format in TLS_CACERTDIR (#650288)
  - improve SSL/TLS trace messages (#652818)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-4
changelog:
  - Mozilla NSS - implement full non-blocking semantics
    ldapsearch -Z hangs server if starttls fails (#652822)
  - updated list of all overlays in slapd.conf (#655899)
  - fix database upgrade process (#656257)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-5
changelog:
  - initscript: slaptest with '-u' to skip database opening (#667768)
  - removed slurpd options from sysconfig/ldap
  - fix: verification of self issued certificates (#657984)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-6
changelog:
  - fix: some server certificates refused with inadequate type error (#668899)
  - fix: default encryption strength dropped in switch to using NSS (#669446)
  - systemd compatibility: add configuration file (#656647, #668223)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-7
changelog:
  - fix: openldap can't use TLS after a fork() (#636956)
  - fix: openldap-server upgrade gets stuck when the database is damaged (#664433)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.24-2
changelog:
  - new: system resource limiting for slapd using ulimit
  - fix update: openldap can't use TLS after a fork() (#636956)
  - fix: possible null pointer dereference in NSS implementation
  - fix: openldap-servers upgrade hangs or do not upgrade the database (#664433)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.25-1
changelog:
  - rebase to new upstream release
  - change default database type from BDB to HDB
  - enable ldapi:/// interface by default
  - set cn=config management ACLs for root user, SASL external schema (#712495)
  - fix: server scriptlets require initscripts package (#716857)
  - fix: connection fails if TLS_CACERTDIR doesn't exist but TLS_REQCERT
    is set to 'never' (#716854)
  - fix: segmentation fault caused by double-free in ldapexop (#699683)
  - fix: segmentation fault of client tool when input line in LDIF file
    is splitted but indented incorrectly (#716855)
  - fix: segmentation fault of client tool when LDIF input file is not terminated
    by a new line character (#716858)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-2
changelog:
  - security hardening: library needs partial RELRO support added (#733071)
  - fix: NSS_Init* functions are not thread safe (#731112)
  - fix: incorrect behavior of allow/try options of VerifyCert and TLS_REQCERT (#725819)
  - fix: memleak - free the return of tlsm_find_and_verify_cert_key (#725818)
  - fix: conversion of constraint overlay settings to cn=config is incorrect (#733067)
  - fix: DDS overlay tolerance parametr doesn't function and breakes default TTL (#733069)
  - manpage fix: errors in manual page slapo-unique (#733070)
  - fix: matching wildcard hostnames in certificate Subject field does not work (#733073)
  - new feature: honor priority/weight with ldap_domain2hostlist (#733078)
  - manpage fix: wrong ldap_sync_destroy() prototype in ldap_sync(3) manpage (#717722)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-3
changelog:
  - fix: SSL_ForceHandshake function is not thread safe (#701678)
  - fix: allow unsetting of tls_* syncrepl options (#734187)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-5
changelog:
  - rebuild: openldap does not work after libdb rebase (#743824)
  - regression fix: openldap built without tcp_wrappers (#743213)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.26-6
changelog:
  - package cleanup:
    + hardened build: switch from LDFLAGS to RPM macros
    + remove old provides and obsoletes
    + add new slapd maintainance scripts
    + drop defattr macros, clean up permissions in specfile
    + fix rpmlint warnings: macros in comments/changelog
    + fix rpmlint warnings: non UTF-8 documentation
    + rename environment file to be more consistent (ldap -> slapd)
  - replace sysv initscript with systemd service file (#
  - new format of environment file due to switch to systemd
    (automatic conversion is performed)
  - patch OpenLDAP to skip empty command line arguments
    (arguments expansion in systemd works different than in shell)
  - CVE-2011-4079: one-byte buffer overflow in slapd (#749324)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.28-1
changelog:
  - new upstream release
    + server: support for delta-syncrepl in multi master replication
    + server: add experimental backend - MDB
    + server: dynamic configuration for passwd, perl, shell, sock, and sql backends
    + server: support passwords in APR1
    + library: support for Wahl (draft)
    + a lot of bugfixes
  - remove patches which were merged upstream
  - compile backends as modules (except BDB, HDB, and monitor)
  - reload systemd daemon after installation


author: Jan Vcelak <jvcelak@redhat.com> 2.4.28-3
changelog:
  - fix: replication (syncrepl) with TLS causes segfault (#783431)
  - fix: slapd segfaults when PEM certificate is used and key is not set (#772890)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-1
changelog:
  - new upstream release
    + MozNSS fixes
    + connection handling fixes
    + server: buxfixes in mdb backend
    + server: buxfixes in overlays (syncrepl, meta, monitor, perl, sql, dds, rwm)
  - openldap-servers now provide ldib2ldbm (#437104)
  - certificates management improvements
    + create empty Mozilla NSS certificate database during installation
    + enable builtin Root CA in generated database (#789088)
    + generate server certificate using Mozilla NSS tools instead of OpenSSL tools
    + fix: correct path to check-config.sh in service file (Jan Synáček <jsynacek@redhat.com>)
  - temporarily disable certificates checking in check-config.sh script
  - fix: check-config.sh get stuck when executing command as a ldap user


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-2
changelog:
  - fix update: provide ldif2ldbm, not ldib2ldbm (#437104)
  - Jan Synáček <jsynacek@redhat.com>:
    + unify systemctl binary paths throughout the specfile and make them usrmove compliant
    + make path to chkconfig binary usrmove compliant


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-3
changelog:
  - fix: ldap_result does not succeed for sssd (#771484)
  - Jan Synáček <jsynacek@redhat.com>:
    + fix: count constraint broken when using multiple modifications (#795766)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.29-4
changelog:
  - fix: missing options in manual pages of client tools (#796232)
  - fix: SASL_NOCANON option missing in ldap.conf manual page (#732915)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.30-1
changelog:
  - new upstream release
    + server: fixes in mdb backend
    + server: fixes in manual pages
    + server: fixes in syncprov, syncrepl, and pcache
  - removed patches which were merged upstream


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-1
changelog:
  - new upstream release
    + library: IPv6 url detection
    + library: rebinding to failed connections
    + server: various fixes in mdb backend
    + server: various fixes in replication
    + server: various fixes in overlays and minor backends
    + documentation fixes
  - remove patches which were merged upstream


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-2
changelog:
  - fix: nss-tools package is required by the base package, not the server subpackage
  - fix: MozNSS CA certdir does not work together with PEM CA cert file (#819536)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-3
changelog:
  - update fix: count constraint broken when using multiple modifications (#795766)
  - fix: invalid order of TLS shutdown operations (#808464)
  - fix: TLS error messages overwriting in tlsm_verify_cert() (#810462)
  - fix: reading pin from file can make all TLS connections hang (#829317)
  - CVE-2012-2668: cipher suite selection by name can be ignored (#825875)
  - fix: slapd fails to start on reboot (#829272)
  - fix: default cipher suite is always selected (#828790)
  - fix: less influence between individual TLS contexts:
    - replication with TLS does not work (#795763)
    - possibly others


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-4
changelog:
  - modify the package build process
    + fix autoconfig files to detect Mozilla NSS library using pkg-config
    + remove compiler flags which are not needed currently
    + build server, client and library together
    + avoid stray dependencies by using --as-needed linker flag
    + enable SLAPI interface in slapd


author: Jan Vcelak <jvcelak@redhat.com> 2.4.31-5
changelog:
  - fix: querying for IPv6 DNS records when IPv6 is disabled on the host (#835013)
  - fix: smbk5pwd module computes invalid LM hashes (#841560)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-1
changelog:
  - new upstream release
    + library: double free, SASL handling
    + tools: read SASL_NOCANON from config file
    + slapd: config index renumbering, duplicate error response
    + backends: various fixes in mdb, bdb/hdb, ldap
    + accesslog, syncprov: fix memory leaks in with replication
    + sha2: portability, thread safety, support SSHA256,384,512
    + documentation fixes


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-2
changelog:
  - enhancement: TLS, prefer private keys from authenticated slots
  - enhancement: TLS, allow certificate specification including token name
  - resolve TLS failures in replication in 389 Directory Server


author: Jan Vcelak <jvcelak@redhat.com> 2.4.32-3
changelog:
  - fix: some TLS ciphers cannot be enabled (#852338)
  - fix: connection hangs after fallback to second server when certificate hostname verification fails (#852476)
  - fix: not all certificates in OpenSSL compatible CA certificate directory format are loaded (#852786)
  - fix: MozNSS certificate database in SQL format cannot be used (#857373)
  - fix: libldap does not load PEM certificate if certdb is used as TLS_CACERTDIR (#857455)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.33-1
changelog:
  - new upstream release:
    + slapd: ACLs, syncrepl
    + backends: locking and memory management in MDB
    + manpages: slapo-refint
  - patch update: MozNSS certificate database in SQL format cannot be used (#860317)
  - fix: slapd.service should not use /tmp (#859019)


author: Jan Vcelak <jvcelak@fedoraproject.org> 2.4.34-1
changelog:
  - new upstream release (#917603)
  - fix: slapcat segfaults if cn=config.ldif not present (#872784)
  - use systemd-rpm macros in spec file (#850247)


author: Jan Synáček <jsynacek@redhat.com> 2.4.34-1
changelog:
  - enable perl backend (#820547)
  - package ppolicy-check-password (#829749)
  - add perl specific BuildRequires
  - fix bogus dates


author: Jan Synáček <jsynacek@redhat.com> 2.4.34-2
changelog:
  - fix: syncrepl push DELETE operation does not recover (#920482)
  - run autoreconf every build, drop autoreconf patch (#926280)


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-1
changelog:
  - new upstream release (#947235)
  - fix: slapd.service should ensure that network is up before starting (#946921)
  - fix: NSS related resource leak (#929357)


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-3
changelog:
  - fix: minor documentation fixes
  - set SASL_NOCANON to on by default (#949864)
  - remove trailing spaces


author: Jan Synáček <jsynacek@redhat.com> 2.4.35-4
changelog:
  - do not needlessly run ldconfig after installing openldap-devel
  - fix: LDAPI with GSSAPI does not work if SASL_NOCANON=on (#960222)
  - fix: lt_dlopen() with back_perl (#960048)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-4
changelog:
  - support TLS 1.1 and later (#1160468)
  - fix: /etc/openldap/certs directory is empty after installation (#1064251)
  - fix: Typo in script to generate /usr/libexec/openldap/generate-server-cert.sh (#1087490)
  - fix: remove correct tmp file when generating server cert (#1103101)
  - fix: slapd.ldif olcFrontend missing important/required objectclass (#1132094)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-5
changelog:
  - add documentation reference to service file (#1087288)
  - fix: tls_reqcert try has bad behavior (#1027613)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-1
changelog:
  - new upstream release (#1147982)
  - fix: PIE and RELRO check (#1092562)
  - fix: slaptest doesn't convert perlModuleConfig lines (#1184585)
  - fix: OpenLDAP crash in NSS shutdown handling (#1158005)
  - fix: slapd.service may fail to start if binding to NIC ip (#1198781)
  - fix: deadlock during SSL_ForceHandshake when getting connection to replica (#1125152)
  - improve check_password (#1174723, #1196243)
  - provide an unversioned symlink to check_password.so.1.1 (#1174634)
  - add findutils to requires (#1209229)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-5
changelog:
  - enhancement: support TLS 1.1 and later (#1231522,#1160467)
  - fix: openldap ciphersuite parsing code handles masks incorrectly (#1231522)
  - fix the patch in commit da1b5c (fix: OpenLDAP crash in NSS shutdown handling) (#1231228)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-7
changelog:
  - Merge two MozNSS cipher suite definition patches into one. (#1245279)
  - Use what NSS considers default for DEFAULT cipher string. (#1245279)
  - Remove unnecesary defaults from ciphers' definitions (#1245279)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-8
changelog:
  - NSS does not support string ordering (#1231522)
  - implement and correct order of parsing attributes (#1231522)
  - add multi_mask and multi_strength to correctly handle sets of attributes (#1231522)
  - add new cipher suites and correct AES-GCM attributes (#1245279)
  - correct DEFAULT ciphers handling to exclude eNULL cipher suites (#1245279)


author: Šimon Lukašík <slukasik@redhat.com> - 0.9.13-7
changelog:
  - do not obsolete openscap-conten just drop it (#1028706)
    scap-security-guide will bring the Obsoletes tag


author: Šimon Lukašík <slukasik@redhat.com> - 1.0.0-2
changelog:
  - dlopen libopenscap_sce.so.{current-age} explicitly
    That allows for SCE to work without openscap-engine-sce-devel


author: Šimon Lukašík <slukasik@redhat.com> - 1.1.1-2
changelog:
  - STIG-generated results contain var_ref without var_check (#1159289)
  - Probes failed to stop by USR1 signal as specified (#1165139)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
changelog:
  - merge sshd initscript patches
  - kill all ssh sessions when stop is called in halt or reboot runlevel
  - remove -TERM option from killproc so we don't race on sshd restart


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
changelog:
  - support mls on labeled networks (#220487)
  - support mls level selection on unlabeled networks
  - allow / in usernames in scp (only beginning /, ./, and ../ is special)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
changelog:
  - fix sftp client problems on write error (#247802)
  - allow disabling autocreation of server keys (#235466)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
changelog:
  - upgrade to latest upstream
  - use libedit in sftp (#203009)
  - fixed audit log injection problem (CVE-2007-3102)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
changelog:
  - do not copy /etc/localtime into the chroot as it is not
    necessary anymore (#193184)
  - call setkeycreatecon when selinux context is established
  - test for NULL privk when freeing key (#391871) - patch by
    Pierre Ossman


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
changelog:
  - set FD_CLOEXEC on client socket
  - apply real fix for window size problem (#286181) from upstream
  - apply fix for the spurious failed bind from upstream
  - apply open handle leak in sftp fix from upstream


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
changelog:
  - fix race on control master and cleanup stale control socket (#436311)
    patches by David Woodhouse


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
changelog:
  - upgrade to new upstream (#441066)
  - prevent initscript from killing itself on halt with upstart (#438449)
  - initscript status should show that the daemon is running
    only when the main daemon is still alive (#430882)


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
changelog:
  - add LANGUAGE to accepted/sent environment variables (#443231)
  - use pam_selinux to obtain the user context instead of doing it itself
  - unbreak server keep alive settings (patch from upstream)
  - small addition to scp manpage


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
changelog:
  - upgrade to new upstream release
  - fixed a problem with public key authentication and explicitely
    specified SELinux role


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
changelog:
  - set FD_CLOEXEC on channel sockets (#475866)
  - adjust summary
  - adjust nss-keys patch so it is applicable without selinux patches (#470859)


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
changelog:
  - remove obsolete --with-rsh (#478298)
  - add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
  - move system-auth after pam_selinux in the session stack


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
changelog:
  - merged xmodifiers to redhat patch
  - merged gssapi-role to selinux patch
  - merged cve-2007_3102 to audit patch
  - sesftp patch only with WITH_SELINUX flag
  - rearange sesftp patch according to upstream request


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
changelog:
  - Repair initscript to be acord to guidelines (#521860)
  - Add bugzilla# to application of edns and xmodifiers patch


author: Jan F. Chadima <jchadima@redhat.com> - 5.5p1-10 + 0.9.2-26
changelog:
  - Repair the reference in man ssh-ldap-helper(8)
  - Repair the PubkeyAgent section in sshd_config(5)
  - Provide example ldap.conf


author: Jan F. Chadima <jchadima@redhat.com> - 5.6p1-20 + 0.9.2-29
changelog:
  - reapair clientloop crash (#627332)
  - properly restore euid in case connect to the ssh-agent socket fails


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-18 + 0.9.2-30
changelog:
  - add periodical reseeding of random generator 
  - change selinux contex for internal sftp in do_usercontext
  - exit(0) after sigterm


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-20 + 0.9.2-30
changelog:
  - use /dev/random or /dev/urandom for seeding prng
  - improve periodical reseeding of random generator


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p2-12 + 0.9.2-31
changelog:
  - Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
  - Split out the host keygen into their own command, to ease future migration
    to systemd. Compatitbility with the init script was kept.
  - Migrate the package to full native systemd unit files, according to the Fedora
    packaging guidelines.
  - Prepate the unit files for running an ondemand server. (do not add it actually)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-11 + 0.9.2-32
changelog:
  - remove unnecessary requires on initscripts
  - set VerifyHostKeyDNS to ask in the default configuration (#739856)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-12 + 0.9.2-32
changelog:
  - still support /etc/sysconfig/sshd loading in sshd service (#754732)
  - fix incorrect key permissions generated by sshd-keygen script (#754779)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-13 + 0.9.2-32
changelog:
  - add back the restorecon call to ssh-copy-id - it might be needed on older
    distributions (#739989)


author: Petr Lautrbach <plautrba@redhat.com> 5.9p1-18 + 0.9.2-32
changelog:
  - replace TwoFactorAuth with RequiredAuthentications[12]
    https://bugzilla.mindrot.org/show_bug.cgi?id=983


author: Tomas Mraz <tmraz@redhat.com> 5.9p1-23 + 0.9.3-1
changelog:
  - fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
    is not running, most probably not exploitable
  - update pam_ssh_agent_auth to 0.9.3 upstream version


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-1 + 0.9.3-3
changelog:
  - new upstream release (#852651)
  - use DIR: kerberos type cache (#848228)
  - don't use chroot_user_t for chrooted users (#830237)
  - replace scriptlets with systemd macros (#850249)
  - don't use /bin and /sbin paths (#856590)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-2
changelog:
  - add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port (#861400)
  - drop required chkconfig (#865498)
  - drop openssh-5.9p1-sftp-chroot.patch (#830237)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-3 + 0.9.3-3
changelog:
  - replace RequiredAuthentications2 with AuthenticationMethods based on upstream
  - obsolete RequiredAuthentications[12] options
  - fix openssh-6.1p1-privsep-selinux.patch


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-2 + 0.9.3-4
changelog:
  - keep track of which IndentityFile options were manually supplied and
    which were default options, and don't warn if the latter are missing.
    (mindrot#2084)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-3 + 0.9.3-4
changelog:
  - sshd.service: use KillMode=process (#890376)
  - add latest config.{sub,guess} to support aarch64 (#926284)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-4 + 0.9.3-5
changelog:
  - don't show Success for EAI_SYSTEM (#985964)
  - make sftp's libedit interface marginally multibyte aware (#841771)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-7 + 0.9.3-5
changelog:
  - use hmac_suffix for ssh{,d} hmac checksums
  - bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A
  - automatically restart sshd.service on-failure after 42s interval


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-8 + 0.9.3-5
changelog:
  - sshd-keygen: generate only RSA keys by default (#1010361)
  - use dist tag in suffixes for hmac checksum files


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-9 + 0.9.3-5
changelog:
  - use dracut-fips package to determine if a FIPS module is installed (#1001566)
  - revert -fips subpackages and hmac files suffixes


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-2 + 0.9.3-6
changelog:
  - use default_ccache_name from /etc/krb5.conf for a kerberos cache (#991186)
  - increase the size of the Diffie-Hellman groups (#1010607)
  - sshd-keygen to generate ECDSA keys <i.grok@comcast.net> (#1019222)


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-4 + 0.9.3-7
changelog:
  - adjust gss kex mechanism to the upstream changes (#1024004)
  - don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> (#1024965)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-2 + 0.9.3-1
changelog:
  - fix fatal() cleanup in the audit patch (#1029074)
  - fix parsing logic of ldap.conf file (#1033662)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-3 + 0.9.3-8
changelog:
  - sshd-keygen - use correct permissions on ecdsa host key (#1023945)
  - use only rsa and ecdsa host keys by default


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-5 + 0.9.3-8
changelog:
  - use tty allocation for a remote scp (#985650)
  - run ssh-copy-id in the legacy mode when SSH_COPY_ID_LEGACY variable is set (#969375)
  - FIPS mode - adjust the key echange DH groups and ssh-keygen according toSP800-131A (#1001748)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-7 + 0.9.3-8
changelog:
  - log fipscheck verification message into syslog authpriv
  - ssh-keygen - relative-specified certificate expiry time should be relative
    to current time and not the validity start time (#1058234)
  - use the size of security of 3des for DH (#1053107)
  - ssh-copy-id.1 man page fix (#1058792)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-1 + 0.9.3-9
changelog:
  - new upstream release (#1059667)
  - prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)
  - make /etc/ssh/moduli file public (#1134448)
  - test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service
  - don't clean up gssapi credentials by default (#1134447)
  - ssh-agent - try CLOCK_BOOTTIME with fallback (#1134449)
  - disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6
  - add support for ED25519 keys to sshd-keygen and sshd.sysconfig
  - standardise on NI_MAXHOST for gethostname() string lengths (#1097665)
  - set a client's address right after a connection is set (mindrot#2257) (#912792)
  - apply RFC3454 stringprep to banners when possible (mindrot#2058) (#1104662)
  - don't consider a partial success as a failure (mindrot#2270) (#1112972)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-2 + 0.9.3-9
changelog:
  - slightly change systemd units logic - use sshd-keygen.service (#1066615)
  - log when a client requests an interactive session and only sftp is allowed (#1130198)
  - sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode (#1143867)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-4 + 0.9.3-9
changelog:
  - revert the default of KerberosUseKuserok back to yes
  - fix kuserok patch which checked for the existence of .k5login unconditionally
    and hence prevented other mechanisms to be used properly


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-8 + 0.9.3-9
changelog:
  - increase size of AUDIT_LOG_SIZE to 256 (#1171163)
  - record pfs= field in CRYPTO_SESSION audit event (#1171248)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-9
changelog:
  - add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278
    (#1169843)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-13 + 0.9.3-9
changelog:
  - Increase limit of files for glob match in sftp (#1160377)
  - Add pam_reauthorize.so to /etc/pam.d/sshd (#1204233)
  - Show all config values in sshd test mode (#1187597)
  - Document required selinux boolean for working ssh-ldap-helper (#1178116)
  - Consistent usage of pam_namespace in sshd (#1125110)
  - Fix auditing when using combination of ForcedCommand and PTY (#1199112)
  - Add sftp option to force mode of created files (#1197989)
  - Ability to specify an arbitrary LDAP filter in ldap.conf for ssh-ldap-helper (#1201753)
  - Provide documentation line for systemd service and socket (#1181591)
  - Provide LDIF version of LPK schema (#1184938)
  - Document TERM environment variable (#1162683)
  - Fix ssh-copy-id on non-sh remote shells (#1201758)
  - Do not read RSA1 hostkeys for HostBased authentication in FIPS (#1197666)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-14 + 0.9.3-9
changelog:
  - Fix ldif schema to have correct spacing on newlines (#1184938)
  - Add missing values for sshd test mode (#1187597)
  - ssh-copy-id: tcsh doesnt work with multiline strings (#1201758)
  - Fix memory problems with newkeys and array transfers (#1223218)
  - Enhance AllowGroups documentation in man page (#1150007)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-15 + 0.9.3-9
changelog:
  - One more typo in manual page documenting TERM variable (#1162683)
  - Fix race condition with auditing messages answers (#1240613)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-17 + 0.9.3-9
changelog:
  - Security fixes released with openssh-6.9 (CVE-2015-5352) (#1247864)
   - XSECURITY restrictions bypass under certain conditions in ssh(1) (#1238231)
   - weakness of agent locking (ssh-add -x) to password guessing (#1238238)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-20 + 0.9.3-9
changelog:
  - Fix vulnerabilities published with openssh-7.0 (#1265807)
   - Privilege separation weakness related to PAM support
   - Use-after-free bug related to PAM support


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-23 + 0.9.3-9
changelog:
  - Disable undocumented feauture Roaming for good (#1298218)
  - prevents CVE-2016-0777 and CVE-2016-0778


author: Bernhard Rosenkrdnzer <bero@redhat.de>
changelog:
  - inital packaging
  - changes from base:
    - Move /usr/local/ssl to /usr/share/ssl for FHS compliance
    - handle RPM_OPT_FLAGS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.5a, modified for U.S.
  - add perl as a build-time requirement
  - move certificate makefile to another package
  - disable RC5, IDEA, RSA support
  - remove optimizations for now


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - byte-compile python extensions without the build-root
  - adjust the makefile to not remove temporary files (like .key files when
    building .csr files) by marking them as .PRECIOUS


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove -Wa,* and -m* compiler flags from the default Configure file (#20656)
  - add the CA.pl man page to the perl subpackage


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - disable some inline assembly, which on x86 is Pentium-specific
  - re-enable MD2 (see http://www.ietf.org/ietf/IPR/RSA-MD-all)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - re-disable MD2 -- the EVP_MD_CTX structure would grow from 100 to 152
    bytes or so, causing EVP_DigestInit() to zero out stack variables in
    apps built against a version of the library without it


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6
  - enable MD2
  - use the libcrypto.so and libssl.so targets to build shared libs with
  - bump the soversion to 1 because we're no longer compatible with any of
    the various 0.9.5a packages circulating around, which provide lib*.so.0


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 0.9.6a
  - use the build-shared target to build shared libraries
  - bump the soversion to 2 because we're no longer compatible with
    our 0.9.5a packages or our 0.9.6 packages
  - drop the patch for making rsatest a no-op when rsa null support is used
  - put all man pages into <section>ssl instead of <section>
  - break the m2crypto modules into a separate package


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add a script for creating dummy certificates
  - move man pages from %{_mandir}/man?/foo.?ssl to %{_mandir}/man?ssl/foo.?


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-3
changelog:
  - add patches for AEP hardware support
  - add patch to keep trying when we fail to load a cert from a file and
    there are more in the file
  - add missing prototype for ENGINE_ubsec() in engine_int.h


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-4
changelog:
  - move man pages back to %{_mandir}/man?/foo.?ssl from
    %{_mandir}/man?ssl/foo.?
  - add an [ engine ] section to the default configuration file


author: Gary Benson <gbenson@redhat.com> stronghold-0.9.6c-1
changelog:
  - upgrade to 0.9.6c
  - bump BuildArch to i686 and enable assembler on all platforms
  - synchronise with shrimpy and rawhide
  - bump soversion to 3


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.6b-30
changelog:
  - add configuration stanza for x86_64 and use it on x86_64
  - build for linux-ppc on ppc
  - start running the self-tests again


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-6
changelog:
  - EVP_DecryptInit should call EVP_CipherInit() instead of EVP_CipherInit_ex(),
    to get the right behavior when passed uninitialized context structures
    (#83766)
  - build with -mcpu=ev5 on alpha family (#83828)


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7-8
changelog:
  - add fix to guard against attempts to allocate negative amounts of memory
  - add patch for CAN-2003-0078, fixing a timing attack


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-5
changelog:
  - add patch to harden against Klima-Pokorny-Rosa extension of Bleichenbacher's
    attack (CAN-2003-0131)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - backport fix for engine-used-for-everything from 0.9.7b
  - backport fix for prng not being seeded causing problems, also from 0.9.7b
  - add a check at build-time to ensure that RSA is thread-safe
  - keep perlpath from stomping on the libica configure scripts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add security fixes for protocol parsing bugs (CAN-2003-0543, CAN-2003-0544)
    and heap corruption (CAN-2003-0545)
  - update RHNS-CA-CERT files
  - ease back on the number of threads used in the threading test


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-22
changelog:
  - add -Wa,--noexecstack to RPM_OPT_FLAGS so that assembled modules get tagged
    as not needing executable stacks


author: Phil Knirsch <pknirsch@redhat.com> 0.9.7a-24
changelog:
  - Use /dev/urandom instead of PRNG for libica.
  - Apply libica-1.3.5 fix for /dev/urandom in icalinux.c
  - Use latest ICA engine patch from IBM.


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-25
changelog:
  - add dependency on zlib-devel for the -devel package, which depends on zlib
    symbols because we enable zlib for libssl (#102962)


author: Joe Orton <jorton@redhat.com> 0.9.7a-27
changelog:
  - updated ca-bundle.crt: removed expired GeoTrust roots, added
    freessl.com root, removed trustcenter.de Class 0 root


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.7a-33
changelog:
  - add an intermediate <openssl/opensslconf.h> which points to the right
    arch-specific opensslconf.h on multilib arches


author: Tomas Mraz <tmraz@redhat.com> 0.9.7e-1
changelog:
  - new upstream source, updated patches
  - added patch so we are hopefully ABI compatible with upcoming
    0.9.7f


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
changelog:
  - reenable optimizations on ppc64 and assembly code on ia64
  - upgrade to new upstream version (no soname bump needed)
  - disable thread test - it was testing the backport of the
    RSA blinding - no longer needed
  - added support for changing serial number to
    Makefile.certificate (#151188)
  - make ca-bundle.crt a config file (#118903)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-2
changelog:
  - add back RC4_CHAR on ia64 and x86_64 so the ABI isn't broken
  - disable broken bignum assembly on x86_64


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-3
changelog:
  - uninitialized variable mustn't be used as input in inline
    assembly
  - reenable the x86_64 assembly again


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-4
changelog:
  - move certificates to _sysconfdir/pki/tls (#143392)
  - move CA directories to _sysconfdir/pki/CA
  - patch the CA script and the default config so it points to the
    CA directories


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-6
changelog:
  - use poll instead of select in rand (#128285)
  - fix Makefile.certificate to point to /etc/pki/tls
  - change the default string mask in ASN1 to PrintableString+UTF8String


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-7
changelog:
  - fix CAN-2005-0109 - use constant time/memory access mod_exp
    so bits of private key aren't leaked by cache eviction (#157631)
  - a few more fixes from upstream 0.9.7g


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-9
changelog:
  - add *.so.soversion as symlinks in /lib (#165264)
  - remove unpackaged symlinks (#159595)
  - fixes from upstream (constant time fixes for DSA,
    bn assembler div on ppc arch, initialize memory on realloc)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-10
changelog:
  - fix CAN-2005-2969 - remove SSL_OP_MSIE_SSLV2_RSA_PADDING which
    disables the countermeasure against man in the middle attack in SSLv2
    (#169863)
  - use sha1 as default for CA and cert requests - CAN-2005-2946 (#169803)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8a-4
changelog:
  - fix build (-lcrypto was erroneusly dropped) of the updated libica
  - updated ICA engine to 1.3.6-rc3


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8a-6
changelog:
  - fix stale open handles in libica (#177155)
  - fix build if 'rand' or 'passwd' in buildroot path (#178782)
  - initialize VIA Padlock engine (#186857)


author: Tomas Mraz <tmraz@redhat.com> - 0.9.8b-1
changelog:
  - upgrade to new version, stays ABI compatible
  - there is no more linux/config.h (it was empty anyway)


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - add ipv6 support to s_client and s_server (by Jan Pazdziora) (#198737)
  - add patches for BN threadsafety, AES cache collision attack hazard fix and
    pkcs7 code memleak fix from upstream CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-7
changelog:
  - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
  - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
  - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
  - fix CVE-2006-4343 - sslv2 client DoS (#206940)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-13
changelog:
  - allow building on ARM architectures (#245417)
  - use reference timestamps to prevent multilib conflicts (#218064)
  - -devel package must require pkgconfig (#241031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-14
changelog:
  - use localhost in testsuite, hopefully fixes slow build in koji
  - CVE-2007-3108 - fix side channel attack on private keys (#250577)
  - make ssl session cache id matching strict (#233599)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-16
changelog:
  - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309801)
  - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321191)
  - add alpha sub-archs (#296031)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-2
changelog:
  - enable some new crypto algorithms and features
  - add some more important bug fixes from openssl CVS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-3
changelog:
  - set default paths when no explicit paths are set (#418771)
  - do not add tls extensions to client hello for SSLv3 (#422081)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8g-9
changelog:
  - fix CVE-2008-0891 - server name extension crash (#448492)
  - fix CVE-2008-1672 - server key exchange message omit crash (#448495)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-1
changelog:
  - new upstream version with necessary soname bump (#455753)
  - temporarily provide symlink to old soname to make it possible to rebuild
    the dependent packages in rawhide
  - add eap-fast support (#428181)
  - add possibility to disable zlib by setting
  - add fips mode support for testing purposes
  - do not null dereference on some invalid smime files
  - add buildrequires pkgconfig (#479493)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-6
changelog:
  - drop the temporary triggerpostun and symlinking in post
  - fix the pkgconfig files and drop the unnecessary buildrequires
    on pkgconfig as it is a rpmbuild dependency (#481419)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8j-7
changelog:
  - must also verify checksum of libssl.so in the FIPS mode
  - obtain the seed for FIPS rng directly from the kernel device
  - drop the temporary symlinks


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-1
changelog:
  - update to new upstream release (minor bug fixes, security
    fixes and machine code optimizations only)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8k-6
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS
  - make CA dir absolute path (#445344)
  - change default length for RSA key generation to 2048 (#484101)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.11.beta4
changelog:
  - update to new upstream version, no soname bump needed
  - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used
    so the compatibility with unfixed clients is not broken. The
    protocol extension is also not final.


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.12.beta4
changelog:
  - keep the beta status in version number at 3 so we do not have to rebuild
    openssh and possibly other dependencies with too strict version check


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.13.beta4
changelog:
  - disable enforcement of the renegotiation extension on the client (#537962)
  - add fixes from the current upstream snapshot


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.17.beta4
changelog:
  - upstream fix compression handling on session resumption
  - various null checks and other small fixes from upstream
  - upstream changes for the renegotiation info according to the latest draft


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.19.beta4
changelog:
  - fix CVE-2009-4355 - leak in applications incorrectly calling
    CRYPTO_free_all_ex_data() before application exit (#546707)
  - upstream fix for future TLS protocol version handling


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-0.21.beta5
changelog:
  - gracefully handle zero length in assembler implementations of
    OPENSSL_cleanse (#564029)
  - do not fail in s_server if client hostname not resolvable (#561260)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0c-2
changelog:
  - listen on ipv6 wildcard in s_server so we accept connections
    from both ipv4 and ipv6 (#601612)
  - fix openssl speed command so it can be used in the FIPS mode
    with FIPS allowed ciphers


author: Tomas Mraz <tmraz@redhat.com> 1.0.0c-3
changelog:
  - add -x931 parameter to openssl genrsa command to use the ANSI X9.31
    key generation method
  - use FIPS-186-3 method for DSA parameter generation
  - add OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW environment variable
    to allow using MD5 when the system is in the maintenance state
    even if the /proc fips flag is on
  - make openssl pkcs12 command work by default in the FIPS mode


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-3
changelog:
  - add support for VIA Padlock on 64bit arch from upstream (#617539)
  - do not return bogus values from load_certs (#652286)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-6
changelog:
  - add support for newest Intel acceleration improvements backported
    from upstream by Intel in form of a separate engine


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-7
changelog:
  - correct openssl cms help output (#636266)
  - more tolerant starttls detection in XMPP protocol (#608239)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0d-8
changelog:
  - drop the separate engine for Intel acceleration improvements
    and merge in the AES-NI, SHA1, and RC4 optimizations
  - add support for OPENSSL_DISABLE_AES_NI environment variable
    that disables the AES-NI support


author: Tomas Mraz <tmraz@redhat.com> 1.0.0e-3
changelog:
  - do not use AVX instructions when osxsave bit not set
  - add direct known answer tests for SHA2 algorithms


author: Tomas Mraz <tmraz@redhat.com> 1.0.0g-1
changelog:
  - new upstream release fixing CVE-2012-0050 - DoS regression in
    DTLS support introduced by the previous release (#782795)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-0.1.beta2
changelog:
  - new upstream release from the 1.0.1 branch, ABI compatible
  - add documentation for the -no_ign_eof option


author: Tomas Mraz <tmraz@redhat.com> 1.0.1-0.2.beta3
changelog:
  - epoch bumped to 1 due to revert to 1.0.0g on Fedora 17
  - new upstream release from the 1.0.1 branch
  - fix s390x build (#798411)
  - versioning for the SSLeay symbol (#794950)
  - add -DPURIFY to build flags (#797323)
  - filter engine provides
  - split the libraries to a separate -libs package
  - add make to requires on the base package (#783446)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-3
changelog:
  - fix DSA key generation in FIPS mode (#833866)
  - allow duplicate FIPS_mode_set(1)
  - enable build on ppc64 subarch (#834652)


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-4
changelog:
  - do not move libcrypto to /lib
  - do not use environment variables if __libc_enable_secure is on
  - fix strict aliasing problems in modes


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-7
changelog:
  - add missing initialization of str in aes_ccm_init_key (#853963)
  - add important patches from upstream CVS
  - use the secure_getenv() with new glibc


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-8
changelog:
  - use 1024 bit DH parameters in s_server as 512 bit is not allowed
    in FIPS mode and it is quite weak anyway


author: Tomas Mraz <tmraz@redhat.com> 1.0.1c-11
changelog:
  - add script for renewal of a self-signed cert by Philip Prindeville (#871566)
  - allow X509_issuer_and_serial_hash() produce correct result in
    the FIPS mode (#881336)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-20
changelog:
  - document the nextprotoneg option in manual pages
    original patch by Hubert Kario
  - try to avoid some races when updating the -fips subpackage


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-21
changelog:
  - make DTLS1 work in FIPS mode
  - avoid RSA and DSA 512 bits and Whirlpool in 'openssl speed' in FIPS mode
  - drop the -fips subpackage, installation of dracut-fips marks that the FIPS
    module is installed
  - avoid dlopening libssl.so from libcrypto
  - fix small memory leak in FIPS aes selftest
  - fix segfault in openssl speed hmac in the FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-24
changelog:
  - additional changes required for FIPS validation
  - disable verification of certificate, CRL, and OCSP signatures
    using MD5 if OPENSSL_ENABLE_MD5_VERIFY environment variable
    is not set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-26
changelog:
  - fix CVE-2013-6449 - crash when version in SSL structure is incorrect
  - drop weak ciphers from the default TLS ciphersuite list
  - add back some symbols that were dropped with update to 1.0.1 branch
  - more FIPS validation requirement changes


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-28
changelog:
  - fix CVE-2013-4353 - Invalid TLS handshake crash
  - fix CVE-2013-6450 - possible MiTM attack on DTLS1


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-31
changelog:
  - print ephemeral key size negotiated in TLS handshake (#1057715)
  - add DH_compute_key_padded needed for FIPS CAVS testing
  - make expiration and key length changeable by DAYS and KEYLEN
    variables in the certificate Makefile (#1058108)
  - change default hash to sha256 (#1062325)
  - lower the actual 3des strength so it is sorted behind aes128 (#1056616)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34.3
changelog:
  - fix CVE-2010-5298 - possible use of memory after free
  - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment
  - fix CVE-2014-0198 - possible NULL pointer dereference
  - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet
  - fix CVE-2014-0224 - SSL/TLS MITM vulnerability
  - fix CVE-2014-3470 - client-side DoS when using anonymous ECDH


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
changelog:
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3507 - avoid memory leak in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3509 - fix race condition when parsing server hello
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
  - fix CVE-2014-3511 - disallow protocol downgrade via fragmentation


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - add support for RFC 5649 (#1119738)
  - do not pass the FIPS integrity check if the .hmac files are empty (#1128849)
  - add ECC TLS extensions to DTLS (#1119803)
  - do not send ECC ciphersuites in SSLv2 client hello (#1090955)
  - properly propagate encryption failure in BIO_f_cipher (#1072439)
  - fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
  - improve documentation of ciphersuites - patch by Hubert Kario (#1108026)
  - use case insensitive comparison for servername in s_server (#1081163)
  - add support for automatic ECDH curve selection on server (#1080128)
  - FIPS mode: make the limitations on DSA, DH, and RSA keygen
    length enforced only if OPENSSL_ENFORCE_MODULUS_BITS environment
    variable is set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2014-3567 - memory leak when handling session tickets
  - fix CVE-2014-3513 - memory leak in srtp support
  - add support for fallback SCSV to partially mitigate CVE-2014-3566
    (padding attack on SSL3)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - use FIPS approved method for computation of d in RSA
  - copy digest algorithm when handling SNI context switch


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - fix CVE-2014-3570 - incorrect computation in BN_sqr()
  - fix CVE-2014-3571 - possible crash in dtls1_get_record()
  - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
  - fix CVE-2014-8275 - various certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
  - fix CVE-2015-0206 - possible memory leak when buffering DTLS records


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42
changelog:
  - test in the non-FIPS RSA keygen for minimal distance of p and q
    similarly to the FIPS RSA keygen


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-44
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-46
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-47
changelog:
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48
changelog:
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-49
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-50
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-51.1
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-51.4
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-51.5
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO
  - fix CVE-2016-0799 - memory issues in BIO_printf


author: Tomas Mraz <tmraz@redhat.com> 0.9.7f-1
changelog:
  - reenable optimizations on ppc64 and assembly code on ia64
  - upgrade to new upstream version (no soname bump needed)
  - disable thread test - it was testing the backport of the
    RSA blinding - no longer needed
  - added support for changing serial number to 
    Makefile.certificate (#151188)
  - make ca-bundle.crt a config file (#118903)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-9
changelog:
  - fix CVE-2007-3108 - side channel attack on private keys (#250581)
  - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309881)
  - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321221)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-10
changelog:
  - compile with -march=z900 on s390 for performance improvements (#250818)
  - make ssl session ID matching strict (#233599)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-2
changelog:
  - more changes for FIPS validation (#444800)
  - correctly initialize default CA paths (#450987)
  - allow disabling zlib support through environment (#442624)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-5
changelog:
  - implement the integrity checking inside libcrypto so OpenSSL
    can be used in FIPS mode by the fipscheck library


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-8
changelog:
  - support multiple CRLs with same subject in a store (#457134)
  - fix CVE-2009-0590 - reject incorrectly encoded ASN.1 strings (#492304)
  - seed FIPS rng directly from kernel random device
  - do not require fipscheck to build the package (#475798)
  - call pairwise key tests in FIPS mode only (#479817)
  - do not crash when parsing bad mime data (#472440)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-12
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-13
changelog:
  - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
  - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data()
    is called prematurely by application (#546707)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-14
changelog:
  - fix CVE-2009-3555 - support the safe renegotiation extension and
    do not allow legacy renegotiation on the server by default (#533125)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-15
changelog:
  - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
    in the RHEL-5 and newer versions will crash in such case (#569774)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-27
changelog:
  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
  - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
  - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
    environment variable is set (fixes CVE-2012-4929 #857051)
  - use secure_getenv() everywhere instead of getenv() (#839735)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-29.3
changelog:
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server
  - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement
  - disable SSLv2 in the generic TLS method


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-2
changelog:
  - Reference authors from the project AUTHORS file instead of listing in description
  - Change Source0 to reference the project's Mercurial repo
  - Cleaned up the summaries and descriptions
  - Incorporate the results of Fedora package self-review


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.4-3
changelog:
  - Include an AUTHORS and license file in each package
  - Change the library package name to pacemaker-libs to be more
    Fedora compliant
  - Remove execute permissions from xml related files
  - Reference the new cluster-glue devel package name
  - Update the tarball from upstream to version c9120a53a6ae
    + High: PE: Only prevent migration if the clone dependancy is stopping/starting on the target node
    + High: PE: Bug 2160 - Dont shuffle clones due to colocation
    + High: PE: New implementation of the resource migration (not stop/start) logic
    + Medium: Tools: crm_resource - Prevent use-of-NULL by requiring a resource name for the -A and -a options
    + Medium: PE: Prevent use-of-NULL in find_first_action()
    + Low: Build: Include licensing files


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-0.4.c9120a53a6ae.hg
changelog:
  - Incorporate the feedback from the cluster-glue review
  - Realistically, the version is a 1.0.5 pre-release
  - Use the global directive instead of define for variables
  - Use the haclient/hacluster group/user instead of daemon
  - Use the _configure macro
  - Fix install dependancies


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-1
changelog:
  - Add dependancy on resource-agents
  - Use the version of the configure macro that supplies --prefix, --libdir, etc
  - Update the tarball from upstream to version 462f1569a437 (Pacemaker 1.0.5 final)
    + High: Tools: crm_resource - Advertise --move instead of --migrate
    + Medium: Extra: New node connectivity RA that uses system ping and attrd_updater
    + Medium: crmd: Note that dc-deadtime can be used to mask the brokeness of some switches


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-2
changelog:
  - Add versioned perl dependancy as specified by
      https://fedoraproject.org/wiki/Packaging/Perl#Packages_that_link_to_libperl
  - No longer remove RPATH data, it prevents us finding libperl.so and no other
    libraries were being hardcoded
  - Compile in support for heartbeat
  - Conditionally add heartbeat-devel and corosynclib-devel to the -devel requirements
    depending on which stacks are supported


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-4
changelog:
  - Include the fixes from CoroSync integration testing
  - Move the resource templates - they are not documentation
  - Ensure documentation is placed in a standard location
  - Exclude documentation that is included elsewhere in the package

  - Update the tarball from upstream to version ee19d8e83c2a
    + High: cib: Correctly clean up when both plaintext and tls remote ports are requested
    + High: PE: Bug bnc#515172 - Provide better defaults for lt(e) and gt(e) comparisions
    + High: PE: Bug lf#2197 - Allow master instances placemaker to be influenced by colocation constraints
    + High: PE: Make sure promote/demote pseudo actions are created correctly
    + High: PE: Prevent target-role from promoting more than master-max instances
    + High: ais: Bug lf#2199 - Prevent expected-quorum-votes from being populated with garbage
    + High: ais: Prevent deadlock - dont try to release IPC message if the connection failed
    + High: cib: For validation errors, send back the full CIB so the client can display the errors
    + High: cib: Prevent use-after-free for remote plaintext connections
    + High: crmd: Bug lf#2201 - Prevent use-of-NULL when running heartbeat
    + High: Core: Bug lf#2169 - Allow dtd/schema validation to be disabled
    + High: PE: Bug lf#2106 - Not all anonymous clone children are restarted after configuration change
    + High: PE: Bug lf#2170 - stop-all-resources option had no effect
    + High: PE: Bug lf#2171 - Prevent groups from starting if they depend on a complex resource which cannot
    + High: PE: Disable resource management if stonith-enabled=true and no stonith resources are defined
    + High: PE: Do not include master score if it would prevent allocation
    + High: ais: Avoid excessive load by checking for dead children every 1s (instead of 100ms)
    + High: ais: Bug rh#525589 - Prevent shutdown deadlocks when running on CoroSync
    + High: ais: Gracefully handle changes to the AIS nodeid
    + High: crmd: Bug bnc#527530 - Wait for the transition to complete before leaving S_TRANSITION_ENGINE
    + High: crmd: Prevent use-after-free with LOG_DEBUG_3
    + Medium: xml: Mask the "symmetrical" attribute on rsc_colocation constraints (bnc#540672)
    + Medium (bnc#520707): Tools: crm: new templates ocfs2 and clvm
    + Medium: Build: Invert the disable ais/heartbeat logic so that --without (ais|heartbeat) is available to rpmbuild
    + Medium: PE: Bug lf#2178 - Indicate unmanaged clones
    + Medium: PE: Bug lf#2180 - Include node information for all failed ops
    + Medium: PE: Bug lf#2189 - Incorrect error message when unpacking simple ordering constraint
    + Medium: PE: Correctly log resources that would like to start but cannot
    + Medium: PE: Stop ptest from logging to syslog
    + Medium: ais: Include version details in plugin name
    + Medium: crmd: Requery the resource metadata after every start operation


author: Andrew Beekhof <andrew@beekhof.net> - 1.0.5-5
changelog:
  - Include patch of changeset 66b7bfd467f3:
    Some clients such as gfs_controld want a cluster name, allow one to be specified in corosync.conf


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.1-0.1-60b7753f7310.hg
changelog:
  - Update the tarball from upstream to version 60b7753f7310
    + First public release of the 1.1 series


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.2-1
changelog:
  - Update the tarball from the upstream 1.1.2 release
    + High: ais: Bug lf#2340 - Force rogue child processes to terminate after waiting 2.5 minutes
    + High: ais: Bug lf#2359 - Default expected votes to 2 inside Corosync/OpenAIS plugin
    + High: ais: Bug lf#2359 - expected-quorum-votes not correctly updated after membership change
    + High: ais: Bug rhbz#525552 - Move non-threadsafe calls to setenv() to after the fork()
    + High: ais: Do not count votes from offline nodes and calculate current votes before sending quorum data
    + High: ais: Ensure the list of active processes sent to clients is always up-to-date
    + High: ais: Fix previous commit, actually return a result in get_process_list()
    + High: ais: Fix two more uses of getpwnam() in non-thread-safe locations
    + High: ais: Look for the correct conf variable for turning on file logging
    + High: ais: Need to find a better and thread-safe way to set core_uses_pid. Disable for now.
    + High: ais: Use the threadsafe version of getpwnam
    + High: Core: Bug lf#2414 - Prevent use-after-free reported by valgrind when doing xpath based deletions
    + High: Core: Bump the feature set due to the new failcount expiry feature
    + High: Core: Fix memory leak in replace_xml_child() reported by valgrind
    + High: Core: fix memory leaks exposed by valgrind
    + High: crmd: Bug 2401 - Improved detection of partially active peers
    + High: crmd: Bug bnc#578644 - Improve handling of cancelled operations caused by resource cleanup
    + High: crmd: Bug lf#2379 - Ensure the cluster terminates when the PE is not available
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the PE connection after it dies
    + High: crmd: Bug lf#2414 - Prevent use-after-free of the stonith-ng connection
    + High: crmd: Do not allow the target_rc to be misused by resource agents
    + High: crmd: Do not ignore action timeouts based on FSA state
    + High: crmd: Ensure we dont get stuck in S_PENDING if we loose an election to someone that never talks to us again
    + High: crmd: Fix memory leaks exposed by valgrind
    + High: crmd: Remove race condition that could lead to multiple instances of a clone being active on a machine
    + High: crmd: Send erase_status_tag() calls to the local CIB when the DC is fenced, since there is no DC to accept them
    + High: crmd: Use global fencing notifications to prevent secondary fencing operations of the DC
    + High: fencing: Account for stonith_get_info() always returning a pointer to the same static buffer
    + High: PE: Allow startup probes to be disabled - their calculation is a major bottleneck for very large clusters
    + High: PE: Bug lf#2317 - Avoid needless restart of primitive depending on a clone
    + High: PE: Bug lf#2358 - Fix master-master anti-colocation
    + High: PE: Bug lf#2361 - Ensure clones observe mandatory ordering constraints if the LHS is unrunnable
    + High: PE: Bug lf#2383 - Combine failcounts for all instances of an anonymous clone on a host
    + High: PE: Bug lf#2384 - Fix intra-set colocation and ordering
    + High: PE: Bug lf#2403 - Enforce mandatory promotion (colocation) constraints
    + High: PE: Bug lf#2412 - Correctly locate clone instances by their prefix
    + High: PE: Correctly implement optional colocation between primitives and clone resources
    + High: PE: Do not be so quick to pull the trigger on nodes that are coming up
    + High: PE: Fix memory leaks exposed by valgrind
    + High: PE: Fix memory leaks reported by valgrind
    + High: PE: Repair handling of unordered groups in RHS ordering constraints
    + High: PE: Rewrite native_merge_weights() to avoid Fix use-after-free
    + High: PE: Suppress duplicate ordering constraints to achieve orders of magnitude speed increases for large clusters
    + High: Shell: add support for xml in cli
    + High: Shell: always reload status if working with the cluster (bnc#590035)
    + High: Shell: check timeouts also against the default-action-timeout property
    + High: Shell: Default to using the status section from the live CIB (bnc#592762)
    + High: Shell: edit multiple meta_attributes sets in resource management (lf#2315)
    + High: Shell: enable comments (lf#2221)
    + High: Shell: implement new cibstatus interface and commands (bnc#580492)
    + High: Shell: improve configure commit (lf#2336)
    + High: Shell: new cibstatus import command (bnc#585471)
    + High: Shell: new configure filter command
    + High: Shell: restore error reporting in options
    + High: Shell: split shell into modules
    + High: Shell: support for the utilization element (old patch for the new structure)
    + High: Shell: update previous node lookup procedure to include the id where necessary
    + High: Tools: crm_mon - fix memory leaks exposed by valgrind


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.2-2
changelog:
  - Resolves rhbz#602239 - Added patch to documentation so that it passes validation
  - High: Core: Bug lf#2401 - Backed out changeset 6e6980376f01


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.3-0.1-b3cb4f4a30ae.hg
changelog:
  - Pre-release version of 1.1.3
    + High: ais: Bug lf2401 - Improved processing when the peer crmd processes join/leave
    + High: ais: fix list of active processes sent to clients (bnc#603685)
    + High: ais: Move the code for finding uid before the fork so that the child does no logging
    + High: ais: Resolve coverity CONSTANT_EXPRESSION_RESULT defects
    + High: cib: Also free query result for xpath operations that return more than one hit
    + High: cib: Attempt to resolve memory corruption when forking a child to write the cib to disk
    + High: cib: Correctly free memory when writing out the cib to disk
    + High: cib: Fix the application of unversioned diffs
    + High: cib: Remove old developmental error logging
    + High: cib: Restructure the 'valid peer' check for deciding which instructions to ignore
    + High: Core: Bug lf#2401 - Backed out changeset 6e6980376f01
    + High: Core: Correctly unpack HA_Messages containing multiple entries with the same name
    + High: Core: crm_count_member() should only track nodes that have the full stack up
    + High: Core: New developmental logging system inspired by the kernel and a PoC from Lars Ellenberg
    + High: crmd: All nodes should see status updates, not just he DC
    + High: crmd: Allow non-DC nodes to clear failcounts too
    + High: crmd: Base DC election on process relative uptime
    + High: crmd: Bug lf#2439 - cancel_op() can also return HA_RSCBUSY
    + High: crmd: Bug lf#2439 - Handle asynchronous notification of resource deletion events
    + High: crmd: Fix assertion failure when performing async resource failures
    + High: crmd: Fix handling of async resource deletion results
    + High: crmd: Include the action for crm graph operations
    + High: crmd: Make sure the membership cache is accurate after a sucessful fencing operation
    + High: crmd: Make sure we always poke the FSA after a transition to clear any TE_HALT actions
    + High: crmd: Offer crm-level membership once the peer starts the crmd process
    + High: crmd: Only need to request quorum update for plugin based clusters
    + High: crmd: Prevent everyone from loosing DC elections by correctly initializing all relevant variables
    + High: crmd: Prevent segmentation fault
    + High: crmd: several fixes for async resource delete
    + High: mcp: Add missing headers when built without heartbeat support
    + High: mcp: New master control process for (re)spawning pacemaker daemons
    + High: PE: Avoid creating invalid ordering constraints for probes that are not needed
    + High: PE: Bug lf#1959 - Fail unmanaged resources should not prevent other services from shutting down
    + High: PE: Bug lf#2422 - Ordering dependencies on partially active groups not observed properly
    + High: PE: Bug lf#2424 - Use notify oepration definition if it exists in the configuration
    + High: PE: Bug lf#2433 - No services should be stopped until probes finish
    + High: PE: Bug lf#2453 - Enforce clone ordering in the absense of colocation constraints
    + High: PE: Correctly detect when there is a real failcount that expired and needs to be cleared
    + High: PE: Correctly handle pseudo action creation
    + High: PE: Correctly order clone startup after group/clone start
    + High: PE: Fix colocation for interleaved clones
    + High: PE: Fix colocation with partially active groups
    + High: PE: Fix potential use-after-free defect from coverity
    + High: PE: Fix previous merge
    + High: PE: Fix use-after-free in order_actions() reported by valgrind
    + High: PE: Prevent endless loop when looking for operation definitions in the configuration
    + High: Resolve coverity RESOURCE_LEAK defects
    + High: Shell: Complete the transition to using crm_attribute instead of crm_failcount and crm_standby
    + High: stonith: Advertise stonith-ng options in the metadata
    + High: stonith: Correctly parse pcmk_host_list parameters that appear on a single line
    + High: stonith: Map poweron/poweroff back to on/off expected by the stonith tool from cluster-glue
    + High: stonith: pass the configuration to the stonith program via environment variables (bnc#620781)
    + High: Support starting plugin-based Pacemaker clusters with the MCP as well
    + High: tools: crm_report - corosync.conf wont necessarily contain the text 'pacemaker' anymore
    + High: tools: crm_simulate - Resolve coverity USE_AFTER_FREE defect
    + High: Tools: Drop the 'pingd' daemon and resource agent in favor of ocf:pacemaker:ping
    + High: Tools: Fix recently introduced use-of-NULL
    + High: Tools: Fix use-after-free defect from coverity


author: Andrew Beekhof <andrew@beekhof.net> - 1.1.3-1
changelog:
  - Upstream release of 1.1.3
    + High: crmd: Use the correct define/size for lrm resource IDs
    + High: crmd: Bug lf#2458 - Ensure stop actions always have the relevant resource attributes
    + High: crmd: Ensure we activate the DC timer if we detect an alternate DC
    + High: mcp: Correctly initialize the string containing the list of active daemons
    + High: mcp: Fix the expansion of the pid file in the init script
    + High: mcp: Tell chkconfig we need to shut down early on
    + High: PE: Bug lf#2476 - Repair on-fail=block for groups and primitive resources
    + High: PE: Do not demote resources because something that requires it can't run
    + High: PE: Rewrite the ordering constraint logic to be simplicity, clarity and maintainability
    + High: PE: Wait until stonith is available, don't fall back to shutdown for nodes requesting termination
    + High: PE: Prevent segfault by ensuring the arguments to do_calculations() are initialized
    + High: stonith: Bug lf#2461 - Prevent segfault by not looking up operations if the hashtable hasn't been initialized yet
    + High: Stonith: Bug lf#2473 - Ensure stonith operations complete within the timeout and are terminated if they run too long
    + High: stonith: Bug lf#2473 - Gracefully handle remote operations that arrive late (after we've done notifications)
    + High: stonith: Bug lf#2473 - Add the timeout at the top level where the daemon is looking for it
    + High: stonith: Bug lf#2473 - Ensure timeouts are included for fencing operations
    + High: Stonith: Use the timeout specified by the user
    + High: Tools: Bug lf#2456 - Fix assertion failure in crm_resource


author: Andrew Beekhof <andrew@beekhof.net> 1.1.4-1
changelog:
  - Upstream release of 1.1.4
  - See included ChangeLog file or http://hg.clusterlabs.org/pacemaker/1.1/file/tip/ChangeLog for details


author: Andrew Beekhof <andrew@beekhof.net> 1.1.6-1
changelog:
  - Upstream release of 1.1.6
  - See included ChangeLog file or http://hg.clusterlabs.org/pacemaker/1.1/file/tip/ChangeLog for details

  - Disabled eSMTP and SNMP support.  Painful to configure and rarely used.
  - Created cli sub-package for non-cluster usage


author: Andrew Beekhof <andrew@beekhof.net> 1.1.6-2
changelog:
  - Do not build in support for heartbeat, snmp, esmtp by default
  - Create a package for cluster unaware libraries to minimze our
    footprint on non-cluster nodes
  - Better package descriptions


author: Andrew Beekhof <andrew@beekhof.net> 1.1.7-0.1-bc7c125.git
changelog:
  - New upstream tarball: bc7c125
  - Pre-release 1.1.7 build to deal with the removal of cman and support for corosync plugins
  - Add libqb as a dependancy


author: Andrew Beekhof <andrew@beekhof.net> 1.1.7-0.3-7742926.git
changelog:
  - New upstream tarball: 7742926
  - Additional Provides and Obsoletes directives to enable upgrading from heartbeat
  - Rebuild now that the Corosync CFG API has been removed


author: Andrew Beekhof <andrew@beekhof.net> Pacemaker-1.1.7-1
changelog:
  - Update source tarball to upstream release: Pacemaker-1.1.7
  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for details


author: Andrew Beekhof <andrew@beekhof.net> 1.1.8-1
changelog:
  - Rebuild for upstream 1.1.8 release
  - Documentation disabled pending a functional publican/ImageMagick combination

  - Statistics:
    Changesets: 1019
    Diff:       2107 files changed, 117258 insertions(+), 73606 deletions(-)

  - See included ChangeLog file or https://raw.github.com/ClusterLabs/pacemaker/master/ChangeLog for full details

    + New IPC implementation from libqb
    + New logging implementation from libqb
    + Quieter - info, debug and trace logs are no longer sent to syslog
    + Dropped dependancy on cluster-glue
    + Config and core directories no longer located in heartbeat directories
    + Support for managing systemd services
    + Rewritten local resource management daemon
    + Version bumps for every shared library due to API cleanups
    + Removes crm shell, install/use pcs shell and GUI instead


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.8-4
changelog:
  - Update for new upstream tarball: 5db5f53

    + High: mcp: Re-attach to existing pacemaker components when pacemakerd fails
    + High: pengine: cl#5111 - When clone/master child rsc has on-fail=stop, insure all children stop on failure.
    + High: Replace the use of the insecure mktemp(3) with mkstemp(3)
    + High: Core: Correctly process XML diff's involving element removal
    + High: PE: Correctly unpack active anonymous clones
    + High: PE: Fix clone_zero() and clone_strip() for single character resource names
    + High: IPC: Bug cl#5110 - Prevent 100% CPU usage when looking for synchronous replies
    + High: PE: Bug cl#5101 - Ensure stop order is preserved for partially active groups
    + High: fencing: On failure, only try a topology device once from the remote level.
    + High: fencing: Retry stonith device for duration of action's timeout period.
    + High: PE: Fix memory leak on processing message (bnc#780224)
    + High: fencing: Support 'on_target' option in fencing device metadata for forcing unfence on target node
    + High: PE: Support resources that require unfencing before start
    + High: PE: Support a 'requires' resource meta-attribute for controlling whether it needs quorum, fencing or nothing
    + High: mcp: Only define HA_DEBUGLOG to avoid agent calls to ocf_log printing everything twice
    + High: fencing: Do not start fencing until entire device topology is found or query results timeout.
    + High: Cluster: Allow cman and corosync 2.0 nodes to use a name other than uname()


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-1
changelog:
  - Update for new upstream tarball: Pacemaker-1.1.10-rc1
  - Features added since Pacemaker-1.1.8
    + Performance enhancements for supporting 16 node clusters
    + corosync: Use queues to avoid blocking when sending CPG messages
    + ipc: Compress messages that exceed the configured IPC message limit
    + ipc: Use queues to prevent slow clients from blocking the server
    + ipc: Use shared memory by default
    + lrmd: Support nagios remote monitoring
    + lrmd: Pacemaker Remote Daemon for extending pacemaker functionality outside corosync cluster.
    + pengine: Check for master/slave resources that are not OCF agents
    + pengine: Support a 'requires' resource meta-attribute for controlling whether it needs quorum, fencing or nothing
    + pengine: Support for resource containers
    + pengine: Support resources that require unfencing before start

  - Changes since Pacemaker-1.1.8
    + attrd: Correctly handle deletion of non-existant attributes
    + Bug cl#5135 - Improved detection of the active cluster type
    + Bug rhbz#913093 - Use crm_node instead of uname
    + cib: Prevent ordering changes when applying xml diffs
    + cib: Remove text nodes from cib replace operations
    + crmd: Prevent election storms caused by getrusage() values being too close
    + date/time: Bug cl#5118 - Correctly convert seconds-since-epoch to the current time
    + fencing: Attempt to provide more information that just 'generic error' for failed actions
    + fencing: Correctly record completed but previously unknown fencing operations
    + fencing: Correctly terminate when all device options have been exhausted
    + fencing: cov#739453 - String not null terminated
    + fencing: Do not merge new fencing requests with stale ones from dead nodes
    + fencing: Do not start fencing until entire device topology is found or query results timeout.
    + fencing: Do not wait for the query timeout if all replies have arrived
    + fencing: Fix passing of parameters from CMAN containing '='
    + fencing: Fix non-comparison when sorting devices by priority
    + fencing: On failure, only try a topology device once from the remote level.
    + fencing: Only try peers for non-topology based operations once
    + fencing: Retry stonith device for duration of action's timeout period.
    + ipc: Bug cl#5110 - Prevent 100% CPU usage when looking for synchronous replies
    + mcp: Re-attach to existing pacemaker components when mcp fails
    + pengine: Any location constraint for the slave role applies to all roles
    + pengine: Bug cl#5101 - Ensure stop order is preserved for partially active groups
    + pengine: Bug cl#5140 - Allow set members to be stopped when the subseqent set has require-all=false
    + pengine: Bug cl#5143 - Prevent shuffling of anonymous master/slave instances
    + pengine: Bug rhbz#880249 - Ensure orphan masters are demoted before being stopped
    + pengine: Bug rhbz#880249 - Teach the PE how to recover masters into primitives
    + pengine: cl#5025 - Automatically clear failcount for start/monitor failures after resource parameters change
    + pengine: cl#5099 - Probe operation uses the timeout value from the minimum interval monitor by default (#bnc776386)
    + pengine: cl#5111 - When clone/master child rsc has on-fail=stop, insure all children stop on failure.
    + pengine: cl#5142 - Do not delete orphaned children of an anonymous clone
    + pengine: Correctly unpack active anonymous clones
    + pengine: Ensure previous migrations are closed out before attempting another one
    + pengine: rhbz#902459 - Remove rsc node status for orphan resources
    + Replace the use of the insecure mktemp(3) with mkstemp(3)


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-2
changelog:
  - Update for new upstream tarball: Pacemaker-1.1.10-rc4

  - Features in Pacemaker-1.1.10-rc4:
    + PE: Display a list of nodes on which stopped anonymous clones are not active instead of meaningless clone IDs
    + crm_error: Add the ability to list and print error symbols
    + crm_resource: Implement --ban for moving resources away from nodes and --clear (replaces --unmove)
    + crm_resource: Support OCF tracing when using --force-(check|start|stop)

  - Changes since Pacemaker-1.1.10-rc1

    + Bug cl#5133 - pengine: Correctly observe on-fail=block for failed demote operation
    + Bug cl#5152 - Correctly clean up fenced nodes during membership changes
    + Bug cl#5153 - Correctly display clone failcounts in crm_mon
    + Bug cl#5154 - Do not expire failures when on-fail=block is present
    + Bug pengine: cl#5155 - Block the stop of resources if any depending resource is unmanaged
    + crm_report: Correctly collect logs when 'uname -n' reports fully qualified names
    + Check for and replace non-printing characters with their octal equivalent while exporting xml text
    + Convert all exit codes to positive errno values
    + Core: Ensure the blackbox is saved on abnormal program termination
    + corosync: Detect the loss of members for which we only know the nodeid
    + corosync: Nodes that can persist in sending CPG messages must be alive afterall
    + crmd: Do not get stuck in S_POLICY_ENGINE if a node we couldn't fence returns
    + crmd: Ensure all membership operations can complete while trying to cancel a transition
    + crmd: Everyone who gets a fencing notification should mark the node as down
    + crmd: Initiate node shutdown if another node claims to have successfully fenced us
    + crm_resource: Gracefully fail when --force-* is attempted for stonith resources
    + fencing: Restore the ability to manually confirm that fencing completed
    + pengine: Correctly handle resources that recover before we operate on them
    + pengine: Ensure per-node resource parameters are used during probes
    + pengine: Implement the rest of get_timet_now() and rename to get_effective_time
    + pengine: Mark unrunnable stop actions as "blocked"
    + pengine: Re-initiate active recurring monitors that previously failed but have timed out
    + xml: Restore the ability to embed comments in the cib


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-3
changelog:
  - Update to upstream 838e41e

    + Feature: pengine: Allow active nodes in our current membership to be fenced without quorum
    + Fix: attrd: Fixes deleted attributes during dc election
    + Fix: corosync: Fall back to uname for local nodes
    + Fix: crm_report: Find logs in compressed files
    + Fix: pengine: If fencing is unavailable or disabled, block further recovery for resources that fail to stop
    + Fix: systemd: Ensure we get shut down correctly by systemd


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-5
changelog:
  - Streamline spec file

  - Upstream patch for:
    + cman: Only build migration tools for targets that may use them
    + cib: Ensure we set up hacluster's groups in stand-alone mode

  - Update for new upstream tarball: Pacemaker-1.1.10-rc7

    + Bug cl#5157 - Allow migration in the absence of some colocation constraints
    + Bug cl#5168 - Prevent clones from being bounced around the cluster due to location constraints
    + Bug cl#5170 - Correctly support on-fail=block for clones
    + crmd: CID#1036761 Dereference null return value
    + crmd: cl#5164 - Fixes crmd crash when using pacemaker-remote
    + crmd: Ensure operations for cleaned up resources don't block recovery
    + crmd: Prevent messages for remote crmd clients from being relayed to wrong daemons
    + crmd: Properly handle recurring monitor operations for remote-node agent
    + fencing: Correctly detect existing device entries when registering a new one
    + logging: If SIGTRAP is sent before tracing is turned on, turn it on
    + lrmd: Prevent use-of-NULL in client library
    + pengine: cl#5128 - Support maintenance mode for a single node
    + pengine: cl#5164 - Pengine segfault when calculating transition with remote-nodes.
    + pengine: Do the right thing when admins specify the internal resource instead of the clone
    + systemd: Turn off auto-respawning of systemd services when the cluster starts them


author: Andrew Beekhof <andrew@beekhof.net> Pacemaker-1.1.10-6
changelog:
  - Update source tarball to revision: 368c726 (Pacemaker-1.1.10-rc7)
  - Changesets: 18
  - Diff:       9 files changed, 245 insertions(+), 170 deletions(-)

  - Features added since Pacemaker-1.1.10-rc7
    + crm_resource: Allow options to be set recursively

  - Changes since Pacemaker-1.1.10-rc7
    + Bug cl#5161 - crmd: Prevent memory leak in operation cache
    + cib: Correctly read back archived configurations if the primary is corrupted


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-10
changelog:
  + Fix: pengine: Do not re-allocate clone instances that are blocked in the Stopped state
    + Fix: pengine: Do not allow colocation with blocked clone instances


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-11
changelog:
  + Fix: systemd: Prevent glib assertion - only call g_error_free() with non-NULL arguments
    + Fix: systemd: Prevent additional assertions in g_error_free
    + Fix: logging: glib CRIT messages should not produce core files by default
    + Doc: controld: Update the description
    + Fix: pengine: Correctly account for the location preferences of things colocated with a group
    + Fix: cib: Correctly log short-form xml diffs
    + Fix: crmd: Correcty update the history cache when recurring ops change their return code
    + Log: pengine: Better indicate when a resource has failed
    + Log: crm_mon: Unmunge the output for failed operations


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-13
changelog:
  + Fencing: Support agents that need the host to be unfenced at startup
      Resolves: rhbz#996576
    + crm_report: Collect corosync quorum data
      Resolves: rhbz#839342


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-14
changelog:
  + Fix: xml: Location constraints are allowed to specify a role
    + Bug rhbz#902407 - crm_resource: Handle --ban for master/slave resources as advertised
      Resolves: rhbz#902407


author: David Vossel <dvossel@redhat.com> - 1.1.10-15
changelog:
  + Fix: crmd: Allow transient attributes to be set on remote-nodes.
    + Fix: pengine: Handle orphaned remote-nodes properly
    + Low: cts: Add RemoteLXC regression test.

    Resolves: rhbz#1006465
    Resolves: rhbz#1006471


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-16
changelog:
  - Remove unsupported resource agent
  - Log: crmd: Supply arguments in the correct order
  - Fix: crm_report: Correctly redirect error message to /dev/null
  - Fix: Bug rhbz#1011618 - Consistently use 'Slave' as the role for unpromoted master/slave resources
  - Fix: pengine: Location constraints with role=Started should prevent masters from running at all
  - Fix: crm_resource: Observe --master modifier for --move
  - Provide a meaningful error if --master is used for primitives and groups
  - Fix: Fencing: Observe pcmk_host_list during automatic unfencing
      Resolves: rhbz#996576


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-17
changelog:
  Resolves: rhbz#720543

  - Fix: core: Do not enabled blackbox for cli tools
  - Fix: Command-line tools should stop after an assertion failure
  - Fix: crmd: Dont add node_state to cib, if we have not seen or fenced this node yet
  - Fix: crmd: Correctly update expected state when the previous DC shuts down
  - Fix: crmd: Cache rsc_info retrieved from lrmd and pacemaker_remoted
  - Fix: crmd: Pad internal lrmd rsc_info and metadata retrieval timeout
  - Fix: crm_attribute: Detect orphaned remote-nodes when setting attributes
  - Fix: crm_mon: Prevent use-of-NULL when ping resources do not define a host list
  - Fix: crm_report: Record the output of the collector
  - Fix: crm_report: Do not print garbage when collecting from the local node
  - Fix: crm_resource: Wait for all replies when cleaning up resources
  - Fix: fencing: Do not broadcast suicide if the on action is being executed
  - Fix: fencing: Allow fencing for node after topology entries are deleted
  - Fix: fencing: Deep copy current topology level list on remote op
  - Fix: lrmd: Correctly cancel monitor actions for lsb/systemd/service resources on cleaning up
  - Fix: pengine: Dont prevent clones from running due to dependant resources
  - Fix: pengine: Probe containers not expected to be up
  - Fix: ipc: Raise the default buffer size to 128k
  - Fix: ipc: Use the higher of the configured buffer size or the default
  - Fix: iso8601: Prevent dates from jumping backwards a day in some timezones
  - Fix: remote: Properly version the remote connection protocol
  - Fix: remote: Handle endian changes between client and server and improve forward compatibility
      Resolves: rhbz#720543


author: David Vossel <dvossel@redhat.com> - 1.1.10-19
changelog:
  - Fix: controld: Use the correct variant of dlm_controld for
    corosync-2 clusters

      Resolves: rhbz#1028627


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-20
changelog:
  - Fix: tools: Fixes formatting of remote-nodes in crm_mon and crm_simulate
  - Fix: Corosync: Attempt to retrieve a peers node name if it is not already known
      Resolves: rhbz#720543


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-23
changelog:
  - mcp: Tell systemd not to respawn us if we return 100
  - services: Detect missing agents and permission errors before forking
  - Use native DBus library for systemd support to avoid problematic use of threads
      Resolves: rhbz#720543 (aka. 1057697)


author: David Vossel <dvossel@redhat.com> - 1.1.10-24
changelog:
  - controld: handling startup fencing within the controld agent, not the dlm
      Resolves: rhbz#1064519
  - controld: Do not consider the dlm up until the address list is present
      Resolves: rhbz#1067536


author: David Vossel <dvossel@redhat.com> - 1.1.10-25
changelog:
  - pengine: cl#5187 - Prevent resources in an anti-colocation from even temporarily running on a same node
      Resolves: rhbz#1069284


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-26
changelog:
  - Run automated regression tests after every build
  - Fencing: Send details of stonith_api_time() and stonith_api_kick() to syslog
  - Fencing: Pass the correct options when looking up the history by node name
  - Fencing: stonith_api_time_helper now returns when the most recent fencing operation completed
  - crm_report: Additional dlm detail if dlm_controld is running
  - crmd: Gracefully handle actions that cannot be initiated
  - pengine: Gracefully handle bad values for XML_ATTR_TRANSITION_MAGIC
      Resolves: rhbz#1070916


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.10-27
changelog:
  - crm_resource: Prevent use-of-NULL
  - systemd: Prevent use-of-NULL when determining if an agent exists
  - Fencing: Remove shadow definition and use of variable 'progress'
      Resolves: rhbz#1070916


author: David Vossel <dvossel@redhat.com> - 1.1.10-28
changelog:
  - pengine: fixes invalid transition caused by clones with more than 10 instances
      Resolves: rhbz#1078504


author: Andrew Beekhof <abeekhof@redhat.com> 1.1.10-30
changelog:
  - crmd: Do not erase the status section for unfenced nodes
  - crmd: Correctly react to successful unfencing operations
  - crmd: Report unsuccessful unfencing operations
  - crmd: Do not overwrite existing node state when fencing completes
  - fencing: Correctly record which peer performed the fencing operation
  - fencing: Automatically switch from 'list' to 'status' to 'static-list' if those actions are not advertised in the metadata
  - fencing: Filter self-fencing at the peers to allow unfencing to work correctly
  - pengine: Automatically re-unfence a node if the fencing device definition changes
  - pengine: Fencing devices default to only requiring quorum in order to start
  - pengine: Delay unfencing until after we know the state of all resources that require unfencing
  - pengine: Ensure unfencing occurs before fencing devices are (re-)probed
  - pengine: Ensure unfencing only happens once, even if the transition is interrupted
  - pengine: Do not unfence nodes that are offline, unclean or shutting down
  - pengine: Unfencing is based on device probes, there is no need to unfence when normal resources are found active
  - logging: daemons always get a log file, unless explicitly set to configured 'none'
  - lrmd: Expose logging variables expected by OCF agents
  - crm_report: Suppress logging errors after the target directory has been compressed
  - crm_resource: Wait for the correct number of replies when cleaning up resources
      Resolves: rhbz#1078078


author: David Vossel <dvossel@redhat.com> - 1.1.10-31
changelog:
  - fencing: Fence using all required devices
  - fencing: Execute all required fencing devices regardless of what topology level they are at
  - fencing: default to 'off' when agent does not advertise 'reboot' in metadata
      Resolves: rhbz#1078078


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.10-32
changelog:
  - Fix: lrmd: Handle systemd reporting 'done' before a resource is actually stopped
      Resolves: rhbz#1111747


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-5
changelog:
  - Update patch level to upstream 031e46c
    - Prevent glib assert triggered by timers being removed from mainloop more than once 
    - Allow rsc discovery to be disabled in certain situations
    - Allow remote-nodes to be placed in maintenance mode
    - Improved sbd integration


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-9
changelog:
  - Update patch level to upstream fb94901
  - Prevent blocking by performing systemd reloads asynchronously


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-10
changelog:
  - Update patch level to upstream 98b6688
  - Support an intelligent resource restart operation
  - Exclusive discovery implies running the resource is only possible on the listed nodes


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-11
changelog:
  - Update patch level to upstream 7dd9022
  - Ensure all internal caches are updated when nodes are removed from the cluster
    Resolves: rhbz#1162727


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-13
changelog:
  - Update patch level to upstream a433de6
  - Ensure we wait for long running systemd stop operations to complete
    Resolves: rhbz#1165423


author: David Vossel <dvossel@redhat.com> - 1.1.12-18
changelog:
  - clone order constraint require-all option.
  - fix memory leaks in crmd and pacemakerd

    Resolves: rhbz#1176210


author: David Vossel <dvossel@redhat.com> - 1.1.12-19
changelog:
  - Imply stop on actions within containers during host fencing
  - acl correctly implement the reference acl direct

    Resolves: rhbz#1117341


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.13-10.1
changelog:
  - Prevent lrmd crash when logging certain systemd operation failures
  - Handle systemd shutdown properly
  - Don't delete fence device when deleting an attribute
  - Handle new top output format in HealthCPU resource
  - Implement graceful stopping of pacemaker_remote
  - Update CTS to match applied code patches
  - Resolves: rhbz#1299339
  - Resolves: rhbz#1299340
  - Resolves: rhbz#1299341
  - Resolves: rhbz#1299342
  - Resolves: rhbz#1299348


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.13-10.4
changelog:
  - Fix multiple issues with crm_resource --restart
  - Properly handle descendents of unrunnable clones
  - Resolves: rhbz#1347806
  - Resolves: rhbz#1349493


author: Tomas Hoger <thoger@redhat.com> - 7.3-3
changelog:
  - Backport patch from upstream pcre 7.6 to address buffer overflow
    caused by "a character class containing a very large number of
    characters with codepoints greater than 255 (in UTF-8 mode)"
    CVE-2008-0674, #431660
  - Try re-enabling make check again.


author: Lubomir Rintel <lkundrak@v3.sk> - 7.8-1
changelog:
  - Update to 7.8, drop upstreamed patches
  - Fix destination of documentation (#427763)
  - Use buildroot macro consistently
  - Separate the static library, as per current Guidelines
  - Satisfy rpmlint


author: Petr Pisar <ppisar@redhat.com> - 8.10-1
changelog:
  - 8.10 bump (bug #612635)
  - Add LICENCE to static subpackage because COPYING refers to it
  - Remove useless rpath by using new libtool (simple sed does not work anymore
    because tests need to link against just-compiled library in %check phase)


author: Petr Pisar <ppisar@redhat.com> - 8.11-1
changelog:
  - 8.11 bump
  - See ChangeLog for changes. Namely changes have been made to the way
    PCRE_PARTIAL_HARD affects the matching of $, \z, \Z, \b, and \B.
  - Fix typo in pcreprecompile(3) manual
  - Document why shared library is not under /usr


author: Petr Pisar <ppisar@redhat.com> - 8.12-4
changelog:
  - Fix caseless reference matching in UTF-8 mode when the upper/lower case
    characters have different lengths (bug #702623)


author: Petr Pisar <ppisar@redhat.com> - 8.13-1
changelog:
  - 8.13 bump: Bug-fix version, Unicode tables updated to 6.0.0, new pcregrep
    option --buffer-size to adjust to long lines, new feature is passing of
    *MARK information to callouts.
  - Should fix crash back-tracking over unicode sequence (bug #691319)


author: Petr Pisar <ppisar@redhat.com> - 8.13-2
changelog:
  - Separate utilities from libraries
  - Move pcre-config(1) manual to pcre-devel sub-package
  - Remove explicit defattr from spec code
  - Compile pcretest with readline support


author: Petr Pisar <ppisar@redhat.com> - 8.21-2
changelog:
  - Fix unmatched subpattern to not become wildcard (bug #769597)
  - Fix NULL pointer derefernce in pcre_free_study() (upstream bug #1186)


author: Petr Pisar <ppisar@redhat.com> - 8.30-0.1.RC1
changelog:
  - 8.30 Relase candidate 1 with UTF-16 support and *API change*
  - Enable UTF-16 variant of PCRE library
  - The pcre_info() function has been removed from pcre library.
  - Loading compiled pattern does not fix endianity anymore. Instead an errror
    is returned and the application can use pcre_pattern_to_host_byte_order() to
    convert the pattern.
  - Surrogates (0xD800---0xDFFF) are forbidden in UTF-8 mode now.


author: Petr Pisar <ppisar@redhat.com> - 8.32-4
changelog:
  - Fix forward search in JIT when link size is 3 or greater
  - Fix buffer over-read in UTF-16 and UTF-32 modes with JIT


author: Petr Pisar <ppisar@redhat.com> - 8.32-5
changelog:
  - Fix bad handling of empty lines in pcregrep tool (bug #961789)
  - Fix possible pcretest crash with a data line longer than 65536 bytes


author: Petr Pisar <ppisar@redhat.com> - 8.32-13
changelog:
  - Disable unsupported JIT mode on little-endian 64-bit PowerPC platform
    (bug #1125642)
  - Raise optimization level to 3 on little-endian 64-bit PowerPC (bug #1123498)


author: Petr Pisar <ppisar@redhat.com> - 8.32-15
changelog:
  - Fix compiling expression where start-anchored character with more than one
    other case follows circumflex in multiline UTF mode (bug #1110621)
  - Fix character class with a literal quotation (bug #1111091)
  - Fix empty-matching possessive zero-repeat groups in interpreted mode
    (bug #1119320)
  - Fix compiler crash for zero-repeated groups with a recursive back reference
    (bug #1119356)
  - Reset non-matched groups within capturing group up to forced match
    (bug #1161597)
  - Fix static linking (bug #1217111)
  - Package pcredemo.c as a documentation for pcre-devel (bug #1217118)


author: Petr Pisar <ppisar@redhat.com> - 8.32-15.1
changelog:
  - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive
    reference in a group with indefinite repeat) (bug #1330508)
  - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to
    duplicate group number) (bug #1330508)
  - Fix CVE-2015-8386 (buffer overflow caused by lookbehind assertion)
    (bug #1330508)
  - Fix CVE-2015-3217 (stack overflow caused by mishandled group empty match)
    (bug #1330508)
  - Fix CVE-2015-5073 and CVE-2015-8388 (buffer overflow for forward reference
    within backward assertion with excess closing parenthesis) (bug #1330508)
  - Fix CVE-2015-8391 (inefficient posix character class syntax check)
    (bug #1330508)
  - Fix CVE-2016-3191 (workspace overflow for (*ACCEPT) with deeply nested
    parentheses) (bug #1330508)


author: Tom Callaway <tcallawa@redhat.com>
changelog:
  - bump to 5.0.0
  - add patch to prevent clobbering struct re_registers from regex.h
  - remove domxml references, replaced with dom now built-in
  - fix php.ini to refer to php5 not php4


author: Joe Orton <jorton@redhat.com> 5.0.1-1
changelog:
  - update to 5.0.1
  - only build shared modules once
  - put dom extension in php-dom subpackage again
  - move extension modules into %{_libdir}/php/modules
  - don't use --with-regex=system, it's ignored for the apache* SAPIs


author: Joe Orton <jorton@redhat.com> 5.0.2-4
changelog:
  - update to 5.0.2 (#127980)
  - build against mysqlclient10-devel
  - use new RTLD_DEEPBIND to load extension modules
  - drop explicit requirement for elfutils-devel
  - use AddHandler in default conf.d/php.conf (#135664)
  - "fix" round() fudging for recent gcc on x86
  - disable sqlite pending audit of warnings and subpackage split


author: Joe Orton <jorton@redhat.com> 5.0.2-5
changelog:
  - fix phpize installation for lib64 platforms
  - add fix for segfault in variable parsing introduced in 5.0.2


author: Joe Orton <jorton@redhat.com> 5.0.2-7
changelog:
  - truncate changelog at 4.3.1-1
  - merge from 4.3.x package:
   - enable mime_magic extension and Require: file (#130276)


author: Joe Orton <jorton@redhat.com> 5.0.3-1
changelog:
  - update to 5.0.3 (thanks to Robert Scheck et al, #143101)
  - enable xsl extension (#142174)
  - package both the xsl and dom extensions in php-xml
  - enable soap extension, shared (php-soap package) (#142901)
  - add patches from upstream 5.0 branch:
   * Zend_strtod.c compile fixes
   * correct php_sprintf return value usage


author: Joe Orton <jorton@redhat.com> 5.0.3-2
changelog:
  - install the ext/gd headers (#145891)
  - enable pcntl extension in /usr/bin/php (#142903)
  - add libmbfl array arithmetic fix (dcb314@hotmail.com, #143795)
  - add BuildRequire for recent pcre-devel (#147448)


author: Joe Orton <jorton@redhat.com> 5.0.3-4
changelog:
  - package mysqli extension in php-mysql
  - really enable pcntl (#142903)
  - don't build with --enable-safe-mode (#148969)
  - use "Instant Client" libraries for oci8 module (Kai Bolay, #149873)


author: Joe Orton <jorton@redhat.com> 5.0.3-5
changelog:
  - BuildRequire mysql-devel >= 4.1
  - don't mark php.ini as noreplace to make upgrades work (#152171)
  - fix subpackage descriptions (#152628)
  - fix memset(,,0) in Zend (thanks to Dave Jones)
  - fix various compiler warnings in Zend


author: Joe Orton <jorton@redhat.com> 5.0.4-1
changelog:
  - update to 5.0.4 (#153068)
  - add .phps AddType to php.conf (#152973)
  - better gcc4 fix for libxmlrpc


author: Joe Orton <jorton@redhat.com> 5.0.4-4
changelog:
  - bundle from PEAR: HTTP, Mail, XML_Parser, Net_Socket, Net_SMTP
  - snmp: disable MSHUTDOWN function to prevent error_log noise (#153988)
  - mysqli: add fix for crash on x86_64 (Georg Richter, upstream #32282)


author: Joe Orton <jorton@redhat.com> 5.0.4-6
changelog:
  - build /usr/bin/php with the CLI SAPI, and add /usr/bin/php-cgi,
    built with the CGI SAPI (thanks to Edward Rudd, #137704)
  - add php(1) man page for CLI
  - fix more test cases to use -n when invoking php


author: Joe Orton <jorton@redhat.com> 5.0.4-7
changelog:
  - split out dba and bcmath extensions into subpackages
  - BuildRequire gcc-c++ to avoid AC_PROG_CXX{,CPP} failure (#155221)
  - pear: update to DB-1.7.6
  - enable FastCGI support in /usr/bin/php-cgi (#149596)


author: Joe Orton <jorton@redhat.com> 5.0.4-9
changelog:
  - build simplexml_import_dom even with shared dom (#156434)
  - prevent truncation of copied files to ~2Mb (#155916)
  - install /usr/bin/php from CLI build alongside CGI
  - enable sysvmsg extension (#142988)


author: Joe Orton <jorton@redhat.com> 5.0.5-3
changelog:
  - update to 5.0.5
  - add fix for upstream #34435
  - devel: require autoconf, automake (#159283)
  - pear: update to HTTP-1.3.6, Mail-1.1.8, Net_SMTP-1.2.7, XML_RPC-1.4.1
  - fix imagettftext et al (upstream, #161001)


author: Joe Orton <jorton@redhat.com> 5.1.1-2
changelog:
  - update to 5.1.1
  - remove pear subpackage
  - enable pdo extensions (php-pdo subpackage)
  - remove non-standard conditional module builds
  - enable xmlreader extension


author: Joe Orton <jorton@redhat.com> 5.1.2-5
changelog:
  - provide php-api (#183227)
  - add provides for all builtin modules (Tim Jackson, #173804)
  - own %{_libdir}/php/pear for PEAR packages (per #176733)
  - add obsoletes to allow upgrade from FE4 PDO packages (#181863)


author: Joe Orton <jorton@redhat.com> 5.1.4-5
changelog:
  - provide mod_php (#187891)
  - provide php-cli (#192196)
  - use correct LDAP fix (#181518)
  - define _GNU_SOURCE in php_config.h and leave it defined
  - drop (circular) dependency on php-pear


author: Joe Orton <jorton@redhat.com> 5.1.4-8
changelog:
  - Provide php-posix (#194583)
  - only provide php-pcntl from -cli subpackage
  - add missing defattr's (thanks to Matthias Saou)


author: Joe Orton <jorton@redhat.com> 5.2.0-3
changelog:
  - update to 5.2.0 (#213837)
  - php-xml provides php-domxml (#215656)
  - fix php-pdo-abi provide (#214281)


author: Joe Orton <jorton@redhat.com> 5.2.0-4
changelog:
  - provide php-zend-abi (#212804)
  - add /etc/rpm/macros.php exporting interface versions
  - synch with upstream recommended php.ini


author: Joe Orton <jorton@redhat.com> 5.2.0-5
changelog:
  - build json and zip shared, in -common (Remi Collet, #215966)
  - obsolete php-json and php-pecl-zip
  - build readline extension into /usr/bin/php* (#210585)
  - change module subpackages to require php-common not php (#177821)


author: Joe Orton <jorton@redhat.com> 5.2.0-9
changelog:
  - add php(api), php(zend-abi) provides (#221302)
  - package /usr/share/php and append to default include_path (#225434)


author: Joe Orton <jorton@redhat.com> 5.2.0-10
changelog:
  - bump default memory_limit to 32M (#220821)
  - mark config files noreplace again (#174251)
  - drop trailing dots from Summary fields
  - use standard BuildRoot
  - drop libtool15 patch (#226294)


author: Joe Orton <jorton@redhat.com> 5.2.3-3
changelog:
  - add mcrypt, mhash, tidy, mssql subpackages (Dmitry Butskoy)
  - enable dbase extension and package in -common


author: Joe Orton <jorton@redhat.com> 5.2.6-3
changelog:
  - update to 5.2.6
  - sync default php.ini with upstream
  - drop extension_dir from default php.ini, rely on hard-coded
    default, to make php-common multilib-safe (#455091)
  - update to r3 of systzdata patch


author: Joe Orton <jorton@redhat.com> 5.2.6-6
changelog:
  - move gd_README to php-gd
  - update to r4 of systzdata patch; introduces a default timezone
    name of "System/Localtime", which uses /etc/localtime (#469532)


author: Joe Orton <jorton@redhat.com> 5.2.8-4
changelog:
  - move wddx to php-xml, build curl shared in -common
  - remove BR for expat-devel, bogus configure option


author: Joe Orton <jorton@redhat.com> 5.2.8-9
changelog:
  - add recode support, -recode subpackage (#106755)
  - add -zts subpackage with ZTS-enabled build of httpd SAPI
  - adjust php.conf to use -zts SAPI build for worker MPM


author: Remi Collet <Fedora@famillecollet.com> 5.3.0-1
changelog:
  - update to 5.3.0
  - remove ncurses, dbase, mhash extensions
  - add enchant, sqlite3, intl, phar, fileinfo extensions
  - raise sqlite version to 3.6.0 (for sqlite3, build with --enable-load-extension)
  - sync with upstream "production" php.ini


author: Joe Orton <jorton@redhat.com> 5.3.0-2
changelog:
  - update to v5 of systzdata patch; parses zone.tab and extracts
    timezone->{country-code,long/lat,comment} mapping table


author: Remi Collet <Fedora@famillecollet.com> 5.3.1-1
changelog:
  - update to 5.3.1
  - remove openssl patch (merged upstream)
  - add provides for php-pecl-json
  - add prod/devel php.ini in doc


author: Remi Collet <Fedora@famillecollet.com> 5.3.2-1
changelog:
  - PHP 5.3.2 Released!
  - remove mime_magic option (now provided by fileinfo, by emu)
  - add patch for http://bugs.php.net/50578
  - remove patch for libedit (upstream)
  - add runselftest option to allow build without test suite


author: Remi Collet <remi@fedoraproject.org> 5.3.8-2
changelog:
  - add mysqlnd sub-package
  - drop patch4, use --libdir to use /usr/lib*/php/build
  - add patch to redirect mysql.sock (in mysqlnd)


author: Remi Collet <remi@fedoraproject.org> 5.3.8-3
changelog:
  - revert is_a() to php <= 5.3.6 behavior (from upstream)
    with new option (allow_string) for new behavior


author: Remi Collet <remi@fedoraproject.org> 5.4.0-0.3.RC7
changelog:
  - update to PHP 5.4.0RC7
  - provides env file for php-fpm (#784770)
  - add patch to use system libzip (thanks to spot)
  - don't provide INSTALL file


author: Remi Collet <remi@fedoraproject.org> 5.4.0-5
changelog:
  - fix Loadmodule with MPM event (use ZTS if not MPM worker)
  - split conf.d/php.conf + conf.modules.d/10-php.conf with httpd 2.4


author: Remi Collet <remi@fedoraproject.org> 5.4.4-1
changelog:
  - update to 5.4.4 (CVE-2012-2143, CVE-2012-2386)
  - use /usr/lib/tmpfiles.d instead of /etc/tmpfiles.d
  - use /run/php-fpm instead of /var/run/php-fpm


author: Remi Collet <rcollet@redhat.com> 5.4.7-8
changelog:
  - systemd integration, https://bugs.php.net/63085
  - no odbc call during timeout, https://bugs.php.net/63171
  - check sqlite3_column_table_name, https://bugs.php.net/63149


author: Remi Collet <remi@fedoraproject.org> 5.4.7-9
changelog:
  - php-fpm: enable PrivateTmp
  - php-fpm: new systemd macros (#850268)
  - php-fpm: add upstream patch for startup issue (#846858)


author: Remi Collet <remi@fedoraproject.org> 5.4.8-1
changelog:
  - update to 5.4.8
  - define both session.save_handler and session.save_path
  - fix possible segfault in libxml (#828526)
  - php-fpm: create apache user if needed
  - use SKIP_ONLINE_TEST during make test
  - php-devel requires pcre-devel and php-cli (instead of php)


author: Remi Collet <rcollet@redhat.com> 5.4.8-6
changelog:
  - clarify Licenses
  - missing provides xmlreader and xmlwriter
  - modernize spec
  - change php embedded library soname version to 5.4


author: Remi Collet <rcollet@redhat.com> 5.4.9-0.1.RC1
changelog:
  - update to 5.4.9RC1
  - improves php.conf (use FilesMatch + SetHandler)
  - improves filter (httpd module)
  - apply ldap_r patch on fedora >= 18 only


author: Remi Collet <remi@fedoraproject.org> 5.4.12-1
changelog:
  - update to 5.4.12
  - security fix for CVE-2013-1635
  - enable tokyocabinet dba handler
  - upstream patch (5.4.13) to fix dval to lval conversion
    https://bugs.php.net/64142
  - upstream patch (5.4.13) for 2 failed tests
  - fix buit-in web server on ppc64 (fdset usage)
    https://bugs.php.net/64128


author: Remi Collet <rcollet@redhat.com> 5.4.13-1
changelog:
  - update to 5.4.13
  - security fix for CVE-2013-1643
  - Hardened build (links with -z now option)
  - Remove %config from /etc/rpm/macros.php


author: Remi Collet <rcollet@redhat.com> 5.4.16-1
changelog:
  - update to 5.4.16
  - switch systemd unit to Type=notify
  - patch for upstream Bug #64915 error_log ignored when daemonize=0
  - patch for upstream Bug #64949 Buffer overflow in _pdo_pgsql_error
  - patch for upstream bug #64960 Segfault in gc_zval_possible_root
  - add version to "Obsoletes"
  - own /usr/share/fpm


author: Remi Collet <rcollet@redhat.com> - 5.4.16-4
changelog:
  - improve mod_php, pgsql and ldap description
  - add provides php(pdo-abi) for consistency with php(api) and php(zend-abi)
  - use %__isa_bits instead of %__isa in ABI suffix


author: Remi Collet <rcollet@redhat.com> - 5.4.16-19
changelog:
  - fix memory leak introduce in patch for CVE-2014-1943
  - fix heap-based buffer over-read in DateInterval CVE-2013-6712


author: Remi Collet <rcollet@redhat.com> - 5.4.16-23
changelog:
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238
  - fileinfo: cdf_check_stream_offset insufficient boundary
    check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check
    CVE-2014-3480
  - fileinfo: cdf_read_short_sector insufficient boundary
    check. CVE-2014-0207
  - fileinfo: cdf_read_property_info insufficient boundary
    check. CVE-2014-3487
  - fileinfo: fix extensive backtracking CVE-2013-7345
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - core: fix heap-based buffer overflow in DNS TXT record
    parsing. CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage
    type confusion flaw. CVE-2014-3515


author: Remi Collet <rcollet@redhat.com> - 5.4.16-27
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
    CVE-2014-2497
  - gd: fix NUL byte injection in file names. CVE-2014-5120
  - fileinfo: fix extensive backtracking in regular expression
    (incomplete fix for CVE-2013-7345). CVE-2014-3538
  - fileinfo: fix mconvert incorrect handling of truncated
    pascal string size. CVE-2014-3478
  - fileinfo: fix cdf_read_property_info
    (incomplete fix for CVE-2012-1571). CVE-2014-3587
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - network: fix segfault in dns_get_record
    (incomplete fix for CVE-2014-4049). CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.4.16-29
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.4.16-33
changelog:
  - core: use after free vulnerability in unserialize()
    CVE-2014-8142 and CVE-2015-0231
  - core: fix use-after-free in unserialize CVE-2015-2787
  - core: fix NUL byte injection in file name argument of
    move_uploaded_file() CVE-2015-2348
  - date: use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - exif: free called on unitialized pointer CVE-2015-0232
  - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
  - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.4.16-34
changelog:
  - fix memory corruption in fileinfo module on big endian
    machines #1082624
  - fix segfault in pdo_odbc on x86_64 #1159892
  - fix segfault in gmp allocator #1154760


author: Remi Collet <rcollet@redhat.com> - 5.4.16-35
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4025, CVE-2015-4026, #1213407
  - fileinfo: fix denial of service when processing a crafted
    file #1213442
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: fix type confusion through unserialize #1222538
  - apache2handler: fix pipelined request executed in deinitialized
    interpreter under httpd 2.4 CVE-2015-3330


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.0-2
changelog:
  - Bugzilla Bug #668839 - Review Request: pki-core
  -   Added component versioning comments
  -   Updated JSS from "4.2.6-10" to "4.2.6-12"
  -   Modified installation section to preserve timestamps
  -   Removed sectional comments


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.0-3
changelog:
  - Bugzilla Bug #668839 - Review Request: pki-core
  -   Removed empty "pre" from "pki-ca"
  -   Consolidated directory ownership
  -   Corrected file ownership within subpackages
  -   Removed all versioning from NSS and NSPR packages


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-1
changelog:
  - Allow 'pki-native-tools' to be installed independently of 'pki-setup'
  - Removed explicit 'pki-setup' requirement from 'pki-ca'
    (since it already requires 'pki-common')
  - 'pki-setup'
  -     Bugzilla Bug #223343 - pkicreate: should add 'pkiuser' to nfast group
  -     Bugzilla Bug #629377 - Selinux errors during pkicreate CA, KRA, OCSP
        and TKS.
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from
        OpenLDAP instead of the Mozldap
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #658926 - org.apache.commons.lang class not found on F13
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #665388 - jakarta-* jars have been renamed to apache-*,
        pkicreate fails Fedora 14 and above
  -     Bugzilla Bug #23346 - Two conflicting ACL list definitions in source
        repository
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  - 'pki-symkey'
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #644056 - CS build contains warnings
  - 'pki-native-tools'
  -     template change
  -     Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from
        OpenLDAP instead of the Mozldap
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #644056 - CS build contains warnings
  - 'pki-util'
  -     Bugzilla Bug #615814 - rhcs80 - profile policyConstraintsCritical
        cannot be set to true
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #635033 - At installation wizard selecting key types other
        than CA's signing cert will fail
  -     Bugzilla Bug #645874 - rfe ecc - add ecc curve name support in JSS and
        CS interface
  -     Bugzilla Bug #488253 - com.netscape.cmsutil.ocsp.BasicOCSPResponse
        ASN.1 encoding/decoding is broken
  -     Bugzilla Bug #551410 - com.netscape.cmsutil.ocsp.TBSRequest ASN.1
        encoding/decoding is incomplete
  -     Bugzilla Bug #550331 - com.netscape.cmsutil.ocsp.ResponseData ASN.1
        encoding/decoding is incomplete
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #658188 - remove remaining references to tomcat5
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #223319 - Certificate Status inconsistency between token
        db and CA
  -     Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory
        During CRL Generation
  - 'pki-java-tools'
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #662156 - HttpClient is hard-coded to handle only up to
        5000 bytes
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  - 'pki-common'
  -     Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review
  -     Bugzilla Bug #623745 - SessionTimer with LDAPSecurityDomainSessionTable
        started before configuration completed
  -     Bugzilla Bug #620925 - CC: auditor needs to be able to download audit
        logs in the java subsystems
  -     Bugzilla Bug #615827 - rhcs80 - profile policies need more than 5
        policy mappings (seem hardcoded)
  -     Bugzilla Bug #224945 - javadocs has missing descriptions, contains
        empty packages
  -     Bugzilla Bug #548699 - subCA's admin certificate should be generated by
        itself
  -     Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA
  -     Bugzilla Bug #563386 - rhcs80 ca crash on invalid inputs to profile
        caAgentServerCert (null cert_request)
  -     Bugzilla Bug #621339 - SCEP one-time PIN can be used an unlimited
        number of times
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #629677 - TPS: token enrollment fails.
  -     Bugzilla Bug #621350 - Unauthenticated user can decrypt a one-time PIN
        in a SCEP request
  -     Bugzilla Bug #503838 - rhcs71-80 external publishing ldap connection
        pools not reliable - improve connections or discovery
  -     Bugzilla Bug #629769 - password decryption logs plain text password
  -     Bugzilla Bug #583823 - CC: Auditing issues found as result of
        CC - interface review
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #586700 - OCSP Server throws fatal error while using
        OCSP console for renewing SSL Server certificate.
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #607380 - CC: Make sure Java Console can configure all
        security relevant config items
  -     Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be
        generated on TKS instead of TPS.
  -     Bugzilla Bug #489342 -
        com.netscape.cms.servlet.common.CMCOutputTemplate.java
        doesn't support EC
  -     Bugzilla Bug #630121 - OCSP responder lacking option to delete or
        disable a CA that it serves
  -     Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #635033 - At installation wizard selecting key types other
        than CA's signing cert will fail
  -     Bugzilla Bug #621341 - Add CA support for new SCEP key pair dedicated
        for SCEP signing and encryption.
  -     Bugzilla Bug #223336 - ECC: unable to clone a ECC CA
  -     Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned
        by Reason Code - onlySomeReasons ?
  -     Bugzilla Bug #637330 - CC feature: Key Management - provide signature
        verification functions (JAVA subsystems)
  -     Bugzilla Bug #223313 - should do random generated IV param
        for symmetric keys
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #630176 - Improve reliability of the LdapAnonConnFactory
  -     Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on
        ECC curve names (not on key sizes).
  -     Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple
        Certificates from the Same Request
  -     Bugzilla Bug #648757 - expose and use updated cert verification
        function in JSS
  -     Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection
        of signature algorithm; and for ECC curves
  -     Bugzilla Bug #451874 - RFE - Java console - Certificate Wizard missing
        e.c. support
  -     Bugzilla Bug #651040 - cloning shoud not include sslserver
  -     Bugzilla Bug #542863 - RHCS8: Default cert audit nickname written to
        CS.cfg files imcomplete when the cert is stored on a hsm
  -     Bugzilla Bug #360721 - New Feature: Profile Integrity Check . . .
  -     Bugzilla Bug #651916 - kra and ocsp are using incorrect ports
        to talk to CA and complete configuration in DonePanel
  -     Bugzilla Bug #642359 - CC Feature - need to verify certificate when it
        is added
  -     Bugzilla Bug #653713 - CC: setting trust on a CIMC cert requires
        auditing
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #499494 - change CA defaults to SHA2
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #649910 - Console: an auditor or agent can be added to
        an administrator group.
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets
        as expected
  -     Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for
        validity
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1
  -     Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with
        Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA.
  -     Bugzilla Bug #661889 - The Servlet TPSRevokeCert of the CA returns an
        error to TPS even if certificate in question is already revoked.
  -     Bugzilla Bug #663546 - Disable the functionalities that are not exposed
        in the console
  -     Bugzilla Bug #661514 - CMAKE build system requires rules to make
        javadocs
  -     Bugzilla Bug #658188 - remove remaining references to tomcat5
  -     Bugzilla Bug #649343 - Publishing queue should recover from CA crash.
  -     Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and
        pkiCA, obsolete 2252 and 2256
  -     Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #661142 - Verification should fail when
        a revoked certificate is added
  -     Bugzilla Bug #642741 - CS build uses deprecated functions
  -     Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error
  -     Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time
        interface is no longer available through console
  - 'pki-selinux'
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #667153 - store nuxwdog passwords in kernel ring buffer -
        selinux changes
  - 'pki-ca'
  -     Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review
  -     Bugzilla Bug #620925 - CC: auditor needs to be able to download audit
        logs in the java subsystems
  -     Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA
  -     Bugzilla Bug #583824 - CC: Duplicate servlet mappings found as part of
        CC interface doc review
  -     Bugzilla Bug #621602 - pkiconsole: Click on 'Publishing' option with
        admin privilege throws error "You are not authorized to perform this
        operation".
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #583823 - CC: Auditing issues found as result of
        CC - interface review
  -     Bugzilla Bug #519291 - Deleting a CRL Issuing Point after edits throws
        'Internal Server Error'.
  -     Bugzilla Bug #586700 - OCSP Server throws fatal error while using
        OCSP console for renewing SSL Server certificate.
  -     Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes.
  -     Bugzilla Bug #621338 - Include a server randomly-generated 16 byte
        senderNonce in all signed SCEP responses.
  -     Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be
        generated on TKS instead of TPS.
  -     Bugzilla Bug #630121 - OCSP responder lacking option to delete or
        disable a CA that it serves
  -     Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1
  -     Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade
        attack in SCEP
  -     Bugzilla Bug #621334 - Provide an option to set default hash algorithm
        for signing SCEP response messages.
  -     Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned
        by Reason Code - onlySomeReasons ?
  -     Bugzilla Bug #637330 - CC feature: Key Management - provide signature
        verification functions (JAVA subsystems)
  -     Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port
        fowarding for agent services
  -     Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on
        ECC curve names (not on key sizes).
  -     Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple
        Certificates from the Same Request
  -     Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection
        of signature algorithm; and for ECC curves
  -     Bugzilla Bug #529945 - (Instructions and sample only) CS 8.0 GA
        release -- DRM and TKS do not seem to have CRL checking enabled
  -     Bugzilla Bug #609641 - CC: need procedure (and possibly tools) to help
        correctly set up CC environment
  -     Bugzilla Bug #509481 - RFE: support sMIMECapabilities extensions in
        certificates (RFC 4262)
  -     Bugzilla Bug #651916 - kra and ocsp are using incorrect ports
        to talk to CA and complete configuration in DonePanel
  -     Bugzilla Bug #511990 - rhcs 7.3, 8.0 - re-activate missing object
        signing support in RHCS
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #499494 - change CA defaults to SHA2
  -     Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit
        policy extension to 5 only
  -     Bugzilla Bug #649910 - Console: an auditor or agent can be added to
        an administrator group.
  -     Bugzilla Bug #632425 - Port to tomcat6
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets
        as expected
  -     Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for
        validity
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #661128 - incorrect CA ports used for revoke, unrevoke
        certs in TPS
  -     Bugzilla Bug #512496 - RFE rhcs80 - crl updates and scheduling feature 
  -     Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with
        Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA.
  -     Bugzilla Bug #649343 - Publishing queue should recover from CA crash.
  -     Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and
        pkiCA, obsolete 2252 and 2256
  -     Bugzilla Bug #223346 - Two conflicting ACL list definitions in source
        repository
  -     Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #661142 - Verification should fail when
        a revoked certificate is added
  -     Bugzilla Bug #668100 - DRM storage cert has OCSP signing extended key
        usage
  -     Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time
        interface is no longer available through console
  -     Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory
        During CRL Generation
  - 'pki-silent'
  -     Bugzilla Bug #627309 - pkisilent subca configuration fails.
  -     Bugzilla Bug #640091 - pkisilent panels need to match with changed java
        subsystems
  -     Bugzilla Bug #527322 - pkisilent ConfigureDRM should configure DRM
        Clone.
  -     Bugzilla Bug #643053 - pkisilent DRM configuration fails
  -     Bugzilla Bug #583754 - pki-silent needs an option to configure signing
        algorithm for CA certificates
  -     Bugzilla Bug #489385 - references to rhpki
  -     Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI
        interface
  -     Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml)
  -     Bugzilla Bug #640042 - TPS Installlation Wizard: need to move Module
        Panel up to before Security Domain Panel
  -     Bugzilla Bug #643206 - New CMake based build system for Dogtag
  -     Bugzilla Bug #588323 - Failed to enable cipher 0xc001
  -     Bugzilla Bug #656733 - Standardize jar install location and jar names
  -     Bugzilla Bug #645895 - pkisilent: add ability to select ECC curves,
        signing algorithm
  -     Bugzilla Bug #658641 - pkisilent doesn't not properly handle passwords
        with special characters
  -     Bugzilla Bug #642741 - CS build uses deprecated functions


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-2
changelog:
  - 'pki-symkey'
  -     Bugzilla Bug #671265 - pki-symkey jar version incorrect
  - 'pki-common'
  -     Bugzilla Bug #564207 - Searches for completed requests in the agent
        interface returns zero entries


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.1-3
changelog:
  - Bugzilla Bug #656661 - Please Update Spec File to use 'ghost' on files
    in /var/run and /var/lock


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.2-1
changelog:
  - Bugzilla Bug #673233 - Rebase pki-core to pick the latest features and fixes
  - 'pki-setup'
  -     Bugzilla Bug #673638 - Installation within IPA hangs
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package
  - 'pki-common'
  -     Bugzilla Bug #672291 - CA is not publishing certificates issued using
        "Manual User Dual-Use Certificate Enrollment"
  -     Bugzilla Bug #670337 - CA Clone configuration throws TCP connection
        error.
  -     Bugzilla Bug #504056 - Completed SCEP requests are assigned to the
        "begin" state instead of "complete".
  -     Bugzilla Bug #504055 - SCEP requests are not properly populated
  -     Bugzilla Bug #564207 - Searches for completed requests in the agent
        interface returns zero entries
  -     Bugzilla Bug #672291 - CA is not publishing certificates issued using
        "Manual User Dual-Use Certificate Enrollment" -
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package
  -     Bugzilla Bug #672920 - CA console: adding policy to a profile throws
        'Duplicate policy' error in some cases.
  -     Bugzilla Bug #673199 - init script returns control before web apps have
        started
  -     Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI
        subsystem instances
  - 'pki-selinux'
  - 'pki-ca'
  -     Bugzilla Bug #504013 - sscep request is rejected due to authentication
        error if submitted through one time pin router certificate enrollment.
  -     Bugzilla Bug #672111 - CC doc: certServer.usrgrp.administration missing
        information
  -     Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml
        as part of CC interface review
  -     Bugzilla Bug #672333 - Creation of RA agent fails in IPA installation
  -     Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI
        subsystem instances
  - 'pki-silent'
  -     Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided
        by 'netscape.security.provider' package


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-1
changelog:
  - 'pki-common'
  -     Bugzilla Bug #674894 - ipactl restart : an annoy output line
  -     Bugzilla Bug #675179 - ipactl restart : an annoy output line


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-2
changelog:
  - 'pki-common'
  -     Bugzilla Bug #676051 - IPA installation failing - Fails to create CA
        instance
  -     Bugzilla Bug #676182 - IPA installation failing - Fails to create CA
        instance


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.4-1
changelog:
  - Bugzilla Bug #688763 - Rebase updated Dogtag Packages for Fedora 15 (alpha)
  - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA
    instance
  - Bugzilla Bug #675742 - Profile caIPAserviceCert Not Found
  - 'pki-setup'
  -     Bugzilla Bug #678157 - uninitialized variable warnings from Perl
  -     Bugzilla Bug #679574 - Velocity fails to load all dependent classes
  -     Bugzilla Bug #680420 - xml-commons-apis.jar dependency
  -     Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's
        classpath
  -     Bugzilla Bug #673508 - CS8 64 bit pkicreate script uses wrong library
        name for SafeNet LunaSA
  - 'pki-common'
  -     Bugzilla Bug #673638 - Installation within IPA hangs
  -     Bugzilla Bug #678715 - netstat loop fixes needed
  -     Bugzilla Bug #673609 - CC: authorize() call needs to be added to
        getStats servlet
  - 'pki-selinux'
  -     Bugzilla Bug #674195: SELinux error message thrown during token
        enrollment
  - 'pki-ca'
  -     Bugzilla Bug #673638 - Installation within IPA hangs
  -     Bugzilla Bug #673609 - CC: authorize() call needs to be added to
        getStats servlet
  -     Bugzilla Bug #676330 - init script cannot start service
  - 'pki-silent'
  -     Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's
        classpath


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.5-1
changelog:
  - Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta)
  - Require "jss >= 4.2.6-15" as a build and runtime requirement
  - Require "tomcatjss >= 2.1.1" as a build and runtime requirement
    for Fedora 15 and later platforms
  - 'pki-setup'
  -     Bugzilla Bug #688287 - Add "deprecation" notice regarding using
        "shared ports" in pkicreate -help . . .
  -     Bugzilla Bug #688251 - Dogtag installation under IPA takes
        too much time - SELinux policy compilation
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #689501 - ExtJoiner tool fails to join the multiple
        extensions
  - 'pki-common'
  -     Bugzilla Bug #683581 - CA configuration with ECC(Default
        EC curve-nistp521) CA fails with 'signing operation failed'
  -     Bugzilla Bug #689662 - ocsp publishing needs to be re-enabled
        on the EE port
  - 'pki-selinux'
  -     Bugzilla Bug #684871 - ldaps selinux link change
  - 'pki-ca'
  -     Bugzilla Bug #683581 - CA configuration with ECC(Default
        EC curve-nistp521) CA fails with 'signing operation failed'
  -     Bugzilla Bug #684381 - CS.cfg specifies incorrect type of comments
  -     Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port
        throws file not found exception.(profile and CS.cfg only)
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.6-1
changelog:
  - Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta)
  - Bugzilla Bug #693327 - Missing requires: tomcatjss
  - 'pki-setup'
  -     Bugzilla Bug #690626 - pkiremove removes the registry entry for
        all instances on a machine
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port
        throws file not found exception.
  - 'pki-common'
  -     Bugzilla Bug #692990 - Audit log messages needed to match CC doc:
        DRM Recovery audit log messages
  - 'pki-selinux'
  - 'pki-ca'
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.7-1
changelog:
  - 'pki-setup'
  -     Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
  -     Bugzilla Bug #694569 - parameter used by pkiremove not updated
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  - 'pki-common'
  -     Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs
        throws 'Invalid protocol' for OCSP subsystems
  -     Bugzilla Bug #694569 - parameter used by pkiremove not updated
  -     Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
        populated in the CA signedAudit messages
  -     Bugzilla Bug #694143 - CA Agent not returning specified request
  -     Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
        populated in the CA signedAudit messages
  -     Bugzilla Bug #698885 - Race conditions during IPA installation
  - 'pki-selinux'
  - 'pki-ca'
  -     Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
  -     Bugzilla Bug #699837 - service command is not fully backwards compatible
        with Dogtag pki subsystems
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.8-1
changelog:
  - 'pki-setup'
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Bugzilla Bug #532548 - Tool to do DRM re-key
  - 'pki-common'
  - 'pki-selinux'
  - 'pki-ca'
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.8-2
changelog:
  - 'pki-setup'
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -     Added 'DRMTool.cfg' configuration file to inventory
  - 'pki-common'
  - 'pki-selinux'
  - 'pki-ca'
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.9-1
changelog:
  - Updated release of 'jss'
  - Updated release of 'tomcatjss' for Fedora 15
  - 'pki-setup'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
         (jdennis)
  -      Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-symkey'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-native-tools'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #717765 - TPS configuration: logging into security domain
         from tps does not work with clientauth=want. (alee)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-util'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-java-tools'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #532548 - Tool to do DRM re-key (mharmsen)
  -      Bugzilla Bug #532548 - Tool to do DRM re-key (config file and record
         processing) (mharmsen)
  -      Bugzilla Bug #532548 - Tool to do DRM re-key (tweaks) (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-common'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #695403 - Editing signedaudit or transaction, system
         logs throws 'Invalid protocol' for OCSP subsystems (alee)
  -      Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee)
  -      Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
         populated in the CA signedAudit messages (alee)
  -      Bugzilla Bug #694143 - CA Agent not returning specified request (awnuk)
  -      Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
         populated in the CA signedAudit messages (jmagne)
  -      Bugzilla Bug #698885 - Race conditions during IPA installation (alee)
  -      Bugzilla Bug #704792 - CC_LAB_EVAL: CA agent interface:
         SubjectID=$Unidentified$ fails audit evaluation (jmagne)
  -      Bugzilla Bug #705914 - SCEP mishandles nicknames when processing
         subsequent SCEP requests. (awnuk)
  -      Bugzilla Bug #661142 - Verification should fail when a revoked
         certificate is added. (jmagne)
  -      Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs
         for modify/add (alee)
  -      Bugzilla Bug #707416 - additional audit messages for GetCookie (alee)
  -      Bugzilla Bug #707607 - Published certificate summary has list of
         non-published certificates with succeeded status (jmagne)
  -      Bugzilla Bug #717813 - EV_AUDIT_LOG_SHUTDOWN audit log not generated
         for tps and ca on server shutdown (jmagne)
  -      Bugzilla Bug #697939 - DRM signed audit log message - operation should
         be read instead of modify (jmagne)
  -      Bugzilla Bug #718427 - When audit log is full, server continue to
         function. (alee)
  -      Bugzilla Bug #718607 - CC_LAB_EVAL: No AUTH message is generated in
         CA's signedaudit log when a directory based user enrollment is
         performed (jmagne)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-selinux'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #720503 - RA and TPS require additional SELinux
         permissions to run in "Enforcing" mode (alee)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-ca'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser
         (jdennis)
  -      Bugzilla Bug #699837 - service command is not fully backwards
         compatible with Dogtag pki subsystems (mharmsen)
  -      Bugzilla Bug #649910 - Console: an auditor or agent can be added to an
         administrator group. (jmagne)
  -      Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs
         for modify/add (alee)
  -      Bugzilla Bug #716269 - make ra authenticated profiles non-visible on ee
         pages (alee)
  -      Bugzilla Bug #718621 - CC_LAB_EVAL: PRIVATE_KEY_ARCHIVE_REQUEST occurs
         for a revocation invoked by EE user (awnuk)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)
  - 'pki-silent'
  -      Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.
         (mharmsen)
  -      Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.10-1
changelog:
  - 'pki-setup'
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  -      Bugzilla Bug #719007 - Key Constraint keyParameter being ignored
         using an ECC CA to generate ECC certs from CRMF. (jmagne)
  -      Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding
         for any component value which is equal to its default value (alee)
  - 'pki-java-tools'
  - 'pki-common'
  -      Bugzilla Bug #720510 - Console: Adding a certificate into nethsm
         throws Token not found error. (jmagne)
  -      Bugzilla Bug #719007 - Key Constraint keyParameter being ignored
         using an ECC CA to generate ECC certs from CRMF. (jmagne)
  -      Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding
         for any component value which is equal to its default value (alee)
  -      Bugzilla Bug #722989 - Registering an agent when a subsystem is
         created - does not log AUTHZ_SUCCESS event. (alee)
  - 'pki-selinux'
  - 'pki-ca'
  -      Bugzilla Bug #719113 - Add client usage flag to caIPAserviceCert
         (awnuk)
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.11-1
changelog:
  - 'pki-setup'
  -      Bugzilla Bug #689909 - Dogtag installation under IPA takes too much
         time - remove the inefficient sleeps (alee)
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  - 'pki-java-tools'
  -      Bugzilla Bug #724861 - DRMTool: fix duplicate "dn:" records by
         renumbering "cn=<value>" (mharmsen)
  - 'pki-common'
  -      Bugzilla Bug #717041 - Improve escaping of some enrollment inputs like
         (jmagne, awnuk)
  -      Bugzilla Bug #689909 - Dogtag installation under IPA takes too much
         time - remove the inefficient sleeps (alee)
  -      Bugzilla Bug #708075 - Clone installation does not work over NAT
         (alee)
  -      Bugzilla Bug #726785 - If replication fails while setting up a clone
         it will wait forever (alee)
  -      Bugzilla Bug #728332 - xml output has changed on cert requests (awnuk)
  -      Bugzilla Bug #700505 - pki tomcat6 instances currently running
         unconfined (alee)
  - 'pki-selinux'
  -      Bugzilla Bug #700505 - pki tomcat6 instances currently running
         unconfined (alee)
  - 'pki-ca'
  -      Bugzilla Bug #728605 - RFE: increase default validity from 6mo to 2yrs
         in IPA profile (awnuk)
  - 'pki-silent'
  -      Bugzilla Bug #689909 - Dogtag installation under IPA takes too much
         time - remove the inefficient sleeps (alee)


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.12-1
changelog:
  - 'pki-setup'
  -      Bugzilla Bug #712931 - CS requires too many ports
         to be open in the FW (alee)
  - 'pki-symkey'
  - 'pki-native-tools'
  -      Bugzilla Bug #717643 - Fopen without NULL check and other Coverity
         issues (awnuk)
  -      Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk)
  - 'pki-util'
  - 'pki-java-tools'
  - 'pki-common'
  -      Bugzilla Bug #700522 - pki tomcat6 instances currently running
         unconfined, allow server to come up when selinux disabled (alee)
  -      Bugzilla Bug #731741 - some CS.cfg nickname parameters not updated
         correctly when subsystem cloned (using hsm) (alee)
  -      Bugzilla Bug #712931 - CS requires too many ports
         to be open in the FW (alee)
  - 'pki-selinux'
  -      Bugzilla Bug #712931 - CS requires too many ports
         to be open in the FW (alee)
  - 'pki-ca'
  -      Bugzilla Bug #712931 - CS requires too many ports
         to be open in the FW (alee)
  - 'pki-silent'


author: Ade Lee <alee@redhat.com> 9.0.13-1
changelog:
  - 'pki-setup'
  -      Bugzilla Bug #699809 - Convert CS to use systemd (alee)
  - 'pki-ca'
  -      Bugzilla Bug #699809 - Convert CS to use systemd (alee)
  - 'pki-common'
  -      Bugzilla Bug #699809 - Convert CS to use systemd (alee)


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.14-1
changelog:
  - 'pki-setup'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  - 'pki-symkey'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  - 'pki-native-tools'
  - 'pki-util'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  - 'pki-java-tools'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  - 'pki-common'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  - 'pki-selinux'
  - 'pki-ca'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .
  -      Bugzilla Bug #699809 - Convert CS to use systemd (alee)
  - 'pki-silent'
  -      Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.15-1
changelog:
  - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . (mharmsen)
  - Bugzilla Bug #699809 - Convert CS to use systemd (alee)
  - 'pki-setup'
  -      Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS
         mode (cfu)
  -      Bugzilla Bug #737192 - Need script to upgrade proxy configuration (alee)
  - 'pki-symkey'
  -      Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode
         (hsm+NSS). (jmagne)
  - 'pki-native-tools'
  -      Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk)
  -      Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS
         mode (cfu)
  - 'pki-util'
  -      Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS
         mode (cfu)
  - 'pki-java-tools'
  - 'pki-common'
  -      Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS
         mode (cfu)
  -      Bugzilla Bug #737218 - Incorrect request attribute name matching
         ignores request attributes during request parsing. (awnuk)
  -      Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode
         (hsm+NSS). (jmagne)
  - 'pki-selinux'
  -      Bugzilla Bug #739708 - pki-selinux lacks rules in F16 (alee)
  - 'pki-ca'
  -      Bugzilla Bug #712931 - CS requires too many ports
         to be open in the FW (alee)
  -      Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS
         mode (cfu)
  - 'pki-silent'
  -      Bugzilla Bug #739201 - pkisilent does not take arch into account
         as Java packages migrated to arch-dependent directories (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.16-1
changelog:
  - 'pki-setup'
  - 'pki-symkey'
  - 'pki-native-tools'
  - 'pki-util'
  -      Bugzilla Bug #737122 - DRM: during archiving and recovering,
         wrapping unwrapping keys should be done in the token (cfu)
  - 'pki-java-tools'
  - 'pki-common'
  -      Bugzilla Bug #744797 - KRA key recovery (retrieve pkcs#12) fails after
         the in-place upgrade( CS 8.0->8.1) (cfu)
  - 'pki-selinux'
  - 'pki-ca'
  -      Bugzilla Bug #746367 - Typo in the profile name. (jmagne)
  -      Bugzilla Bug #737122 - DRM: during archiving and recovering,
         wrapping unwrapping keys should be done in the token (cfu)
  -      Bugzilla Bug #749927 - Java class conflicts using Java 7 in Fedora 17
         (rawhide) . . . (mharmsen)
  -      Bugzilla Bug #749945 - Installation error reported during CA, DRM,
         OCSP, and TKS package installation . . . (mharmsen)
  - 'pki-silent'


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.2.a1
changelog:
  - Integrated 'pki-kra' into 'pki-core'
  - Integrated 'pki-ocsp' into 'pki-core'
  - Integrated 'pki-tks' into 'pki-core'
  - Bugzilla Bug #788787 - added 'junit'/'junit4' build-time requirements


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.3.a1
changelog:
  - Add '-DSYSTEMD_LIB_INSTALL_DIR' override flag to 'cmake' to address changes
    in fundamental path structure in Fedora 17
  - 'pki-setup'
  -      Hard-code Perl dependencies to protect against bugs such as
         Bugzilla Bug #772699 - Adapt perl and python fileattrs to
         changed file 5.10 magics
  - 'pki-selinux'
  -      Bugzilla Bug #795966 - pki-selinux policy is kind of a mess


author: Ade Lee <alee@redhat.com> 10.0.0-0.5.a1
changelog:
  - 'pki-selinux'
  -      Added platform-dependent patches for SELinux component
  -      Bugzilla Bug #739708 - Selinux fix for ephemeral ports (F16)
  -      Bugzilla Bug #795966 - pki-selinux policy is kind of a mess (F17)


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.7.a1
changelog:
  - For 'mock' purposes, removed platform-specific logic from around
    the 'patch' files so that ALL 'patch' files will be included in
    the SRPM.


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.9.a1
changelog:
  - Initial attempt at PKI deployment framework described in
    'http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment'.


author: Ade Lee <alee@redhat.com> 10.0.0-0.11.a1
changelog:
  - BZ 802396 - Change location of TOMCAT_LOG to match tomcat6 changes
  - Corrected patch selected for selinux f17 rules


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.16.a1
changelog:
  - Integration of Tomcat 7
  - Addition of centralized 'pki-tomcatd' systemd functionality to the
    PKI Deployment strategy
  - Removal of 'pki_flavor' attribute


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.23.a1
changelog:
  - Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 17
  - Changed Dogtag 10 build-time and runtime requirements for 'pki-deploy'
  - Altered PKI Package Dependency Chain (top-to-bottom):
    pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy --> pki-common


author: Endi S. Dewata <edewata@redhat.com> 10.0.0-0.24.a1
changelog:
  - Split pki-common into pki-base and pki-server.
  - Merged pki-util into pki-base.
  - Merged pki-deploy into pki-server.


author: Endi S. Dewata <edewata@redhat.com> 10.0.0-0.25.a1
changelog:
  - Merged pki-native-tools and pki-java-tools into pki-tools.
  - Modified pki-server to depend on pki-tools.


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.32.a1
changelog:
  - TRAC Ticket #312 - Dogtag 10: Automatically restart any running instances
    upon RPM "update" . . .
  - TRAC Ticket #317 - Dogtag 10: Move "pkispawn"/"pkidestroy"
    from /usr/bin to /usr/sbin . . .


author: Ade Lee <alee@redhat.com> 10.0.0-0.53.b3
changelog:
  - Cleaned up spec file to provide only support rhel 7+, f17+
  - Added resteasy-base dependency for rhel 7
  - Update cmake version


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-0.56.b3
changelog:
  - TRAC Ticket #315 - Man pages for pkispawn/pkidestroy.
  - Added place-holders for 'pki.1' and 'pki_default.cfg.5' man pages.


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.0-4
changelog:
  - TRAC Ticket #469 - Dogtag 10: Fix tomcatjss issue in pki-core.spec and
    dogtag-pki.spec . . .
  - TRAC Ticket #468 - pkispawn throws exception


author: Ade Lee <alee@redhat.com> 10.0.1-1
changelog:
  - TRAC Ticket 214 - Missing error description for duplicate user
  - TRAC Ticket 213 - Add nonces for cert revocation
  - TRAC Ticket 367 - pkidestroy does not remove connector
  - TRAC Ticket #430 - License for 3rd party code
  - Bugzilla Bug 839426 - [RFE] ECC CRL support for OCSP
  - Fix spec file to allow f17 to work with latest tomcatjss
  - TRAC Ticket 466 - Increase root CA validity to 20 years
  - TRAC Ticket 469 - Fix tomcatjss issue in spec files
  - TRAC Ticket 468 - pkispawn throws exception
  - TRAC Ticket 191 - Mapping HTTP Exceptions to HTTP error codes
  - TRAC Ticket 271 - Dogtag 10: Fix 'status' command in 'pkidaemon' . . .
  - TRAC Ticket 437 - Make admin cert p12 file location configurable
  - TRAC Ticket 393 - pkispawn fails when selinux is disabled
  - Punctuation and formatting changes in man pages
  - Revert to using default config file for pkidestroy
  - Hardcode setting of resteasy-lib for instance
  - TRAC Ticket 436 - Interpolation for pki_subsystem
  - TRAC Ticket 433 - Interpolation for paths
  - TRAC Ticket 435 - Identical instance id and instance name
  - TRAC Ticket 406 - Replace file dependencies with package dependencies


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.1-2
changelog:
  - Removed runtime dependency on 'pki-server-theme' to resolve
    Bugzilla Bug #916134 - unresolved dependency in pki-server: pki-server-theme


author: Matthew Harmsen <mharmsen@redhat.com> 10.0.1-3
changelog:
  - TRAC Ticket #517 - Clean up theme dependencies
  - TRAC Ticket #518 - Remove UI dependencies from pkispawn . . .


author: Endi S. Dewata <edewata@redhat.com> 10.0.1-9
changelog:
  - Renamed base/deploy to base/server.
  - Moved pki.conf into pki-base.
  - Removed redundant pki/server folder declaration.


author: Endi S. Dewata <edewata@redhat.com> 10.0.2-0.7
changelog:
  - Added pki-server-upgrade script and pki.server module.
  - Call upgrade scripts in %post for pki-base and pki-server.


author: Endi S. Dewata <edewata@redhat.com> 10.0.2-2
changelog:
  - Added default pki.conf in /usr/share/pki/etc
  - Create upgrade tracker on install and remove it on uninstall


author: Matthew Harmsen <mharmsen@redhat.com> 10.1.0-0.2
changelog:
  - TRAC Ticket 606 - add restart / start at boot info to pkispawn man page
  - TRAC Ticket 610 - Document limitation in using GUI install
  - TRAC Ticket 629 - Package ownership of '/usr/share/pki/etc/' directory


author: Abhishek Koneru <akoneru@redhat.com> 10.1.0.0.9
changelog:
  - Listed new packages required during build, due to issues reported
    by pylint.
  - Packages added: python-requests, python-ldap, libselinux-python,
                    policycoreutils-python


author: Ade Lee <alee@redhat.com> 10.1.0-1
changelog:
  - Trac Ticket 788 - Clean up spec files
  - Update release number for release build
  - Updated requirements for resteasy


author: Dogtag Team <pki-devel@redhat.com> 10.2.0-0.1
changelog:
  - Added option to build without server packages.
  - Replaced Jettison with Jackson.
  - Added python-nss build requirement
  - Bugzilla Bug #1057959 - pkispawn requires policycoreutils-python
  - TRAC Ticket #840 - pkispawn requires policycoreutils-python
  - Updated requirements for resteasy
  - Added template files for archive, retrieve and generate key
    requests to the client package.


author: Matthew Harmsen <mharmsen@redhat.com> - 10.2.0-0.6
changelog:
  - Bugzilla Bug #1120045 - pki-core: Switch to java-headless (build)requires --
    drop dependency on java-atk-wrapper
  - Removed 'java-atk-wrapper' dependency from 'pki-server'


author: Matthew Harmsen <mharmsen@redhat.com> - 10.2.0-0.9
changelog:
  - Merged jmagne@redhat.com's spec file changes from the stand-alone
    'pki-tps-client' package needed to build/run the native 'tpsclient'
    command line utility into this 'pki-core' spec file under the 'tps' package.
  - Original tps libararies must be built to support this native utility.
  - Modifies tps package from 'noarch' into 'architecture-specific' package


author: Ade Lee <alee@redhat.com> 10.2.0-3
changelog:
  - Disable pylint dependency for RHEL builds
  - Added jakarta-commons-httpclient requirements
  - Added tomcat version for RHEL build
  - Added resteasy-base-client for RHEL build


author: Christina Fu <cfu@redhat.com> 10.2.0-4
changelog:
  - Ticket 1198 Bugzilla 1158410 add TLS range support to server.xml by default and upgrade
  - up the release number to 4


author: Matthew Harmsen <mharmsen@redhat.com> - 10.2.0-5
changelog:
  - Bugzilla Bug #1165351 - Errata TPS test fails due to dependent packages not
    found (mharmsen)
  - PKI Trac Ticket #1211 - New release overwrites old source tarball (mharmsen)
  - Bugzilla Bug #1151147 - issuerDN encoding correction (cfu)


author: Matthew Harmsen <mharmsen@redhat.com> - 10.2.0-6
changelog:
  - Bugzilla Bug #1160435 - Remove obsolete packages from CS 9.0
  - PKI TRAC Ticket #1187 - mod_perl should be removed from requirements for 10.2
  - PKI TRAC Ticket #1205 - Outdated selinux-policy dependency.
  - Removed perl(XML::LibXML), perl-Crypt-SSLeay, and perl-Mozilla-LDAP runtime
    dependencies


author: Dogtag Team <pki-devel@redhat.com> 10.2.1-1
changelog:
  - Change resteasy dependencies for F22+
  - Added CLIs to simplify generating user certificates
  - Added enhancements to KRA Python API
  - Added a man page for pki ca-profile commands.
  - Added python api docs
  - Update release number for release build
  - Updated Resteasy and Jackson dependencies.


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-3
changelog:
  - Dogtag 10.2.5-3 patch for RHEL 7.2 Re-base
  -   git format-patch cc97f8628b23f8ea75308bb97a31307cb4f162b9^..
      ac5447a8e0bac5112882be700a17a9274e322adc --stdout > pki-core-rhel-7-2.patch
  -   remove e5c4e87ac5ce881efa160352ce87ad81026f3446 (QE test)
  - Contents of 'pki-core-rhel-7-2.patch':
  -   PKI TRAC Ticket #1249 -	Misleading self test log message [edewata]
  -   PKI TRAC Ticket #1444 - pkispawn: installation aborts when HSM contains
      empty slots [edewata]
  -   PKI TRAC Ticket #995 - Provide more info on how to use --input with pki
      cert-find in the man page [edewata]
  -   PKI TRAC Ticket #1122 - Need to describe paging options in 'pki' man page
      [edewata]
  -   Cleaned up SystemConfigService.validateRequest() [edewata]
  -   Cleaned up SystemConfigService.configureClone() [edewata]
  -   PKI TRAC Ticket #1438 - pkispawn: SSL_ForceHandshake issue for non-CA on
      HSM on both shared and nonshared tomcat instances [cfu]
  -   PKI TRAC Ticket #1442 - Ability to toggle profile usablity in Web vs CLI
      tools [jmagne]
  -   PKI TRAC Ticket #1441 - Lack of Interactive Installation Support
     (Cloning, Subordinates, Externals, HSMs, ECC) [mharmsen]
  -   PKI TRAC Ticket #1446 - Unable to select ECC Curves from EE [jmagne]
  -   Fixed pki help CLI [edewata]
  -   Fixed NPE in key-archive CLI [edewata]
  -   PKI TRAC Ticket #891 - Missing fail-over code in HttpConnection [edewata]
  -   PKI TRAC Ticket #1447 - pkispawn: findCertByNickname fails to find cert in
      creating shared tomcat subsystems on HSM [cfu]
  -   PKI TRAC Ticket #1425 - pkispawn CA with HSM - if the config file has
      pki_client related params the dir is not created and the admin cert p12
      file is stored nowhere [mharmsen]
  -   PKI TRAC Ticket #1358 - Retrying failed OCSP clone results duplicate
      replecation id and a failure [jmagne]
  -   PKI TRAC Ticket #1462 - profile update in raw format accepts bad config
      [ftweedal]
  -   PKI TRAC Ticket #1449 - pki cert-find could be time consuming: add VLV
      index for new installations [edewata]


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-4
changelog:
  - Bugzilla Bug #1143067 - The pkiuser user/group should be created in
    rpm %pre, and ideally with fixed uid/gid [cheimes]


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-5
changelog:
  - Bugzilla Bug #1253045 - handle_exceptions() raises JSONDecodeError [cheimes]
    'pki-core-handle-JSON-decode-error.patch'
  -    modified for RHEL 7.2 by removing changes to '.gitignore',
       'tests/python/test_pki.py', and 'tox.ini' [mharmsen]
  - Bugzilla Bug #1253047 - issues in cloning from dogtag 9 to 10 [alee]
    'pki-core-fix-exception-when-talking-to-Dogtag-9-systems.patch'


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-6
changelog:
  - Bugzilla Bug #1258630 - Upgraded CA lacks ca.sslserver.certreq
    in CS.cfg [edewata]
  - Bugzilla Bug #1258634 - CA fails to authenticate to KRA for
    archival [edewata]


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-7
changelog:
  - Bugzilla Bug #1289323 -  [RFE] Provide the user the ability to import their
    own CA certificate with private key [edewata]
  - Bugzilla Bug #1277691 - ipa-cacert-manage renew failed with validity
    out of range [edewata]
  - PKI TRAC Ticket #2040 - Determine supported javadoc options [mharmsen]


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-9
changelog:
  - Bugzilla Bug #1318302 - pkispawn ignores 3rd-party CA certs in
    pki_clone_pkcs12_path
  - Bugzilla Bug #1320580 - IPA replica installation fails if password
    has % character in it.


author: Dogtag Team <pki-devel@redhat.com> 10.2.5-10
changelog:
  - Bugzilla Bug #1318302 - pkispawn ignores 3rd-party CA certs in
    pki_clone_pkcs12_path (python hash fix)


author: David Zeuthen <davidz@redhat.com> - 0.94-3
changelog:
  - Add desktop_admin_r and desktop_user_r groups along with a first cut
    of default authorizations for users in these groups.


author: David Zeuthen <davidz@redhat.com> - 0.94-4
changelog:
  - Add some patches from git master
  - Sort pkaction(1) output
  - Bug 23867 – UnixProcess vs. SystemBusName aliasing


author: David Zeuthen <davidz@redhat.com> - 0.95-0.git20090913
changelog:
  - Update to git snapshot
  - Drop upstreamed patches
  - Turn on GObject introspection
  - Don't delete desktop_admin_r and desktop_user_r groups when
    uninstalling polkit-desktop-policy


author: David Zeuthen <davidz@redhat.com> - 0.95-0.git20090913.1
changelog:
  - Add bugfix for polkit_unix_process_new_full() (thanks Bastien Nocera)
  - Obsolete old PolicyKit packages


author: David Zeuthen <davidz@redhat.com> - 0.97-1
changelog:
  - Update to 0.97. This release contains a port from EggDBus to the
    GDBus code available in recent GLib releases.


author: David Zeuthen <davidz@redhat.com> - 0.97-3
changelog:
  - Add a patch to make pkcheck(1) work the way libvirtd uses it (#623257)
  - Require GLib >= 2.25.12 instead of 2.25.11
  - Ensure polkit-gnome packages earlier than 0.97 are not used with
    these packages


author: David Zeuthen <davidz@redhat.com> - 0.101-2
changelog:
  - Nuke desktop_admin_r and desktop_user_r groups - just use the
    wheel group instead (#688363)
  - Update the set of configuration directives that gives users
    in the wheel group extra privileges


author: David Zeuthen <davidz@redhat.com> 0.102-2.el7_2
changelog:
  - Add patch to neuter the annoying systemd behavior where stdout/stderr
    is sent to the system logs


author: David Zeuthen <davidz@redhat.com> 0.103-1.el7_2
changelog:
  - Update to upstream release 0.103
  - Drop upstreamed patch
  - Drop Fedora-specific policy, it is now upstream (fdo #41008)


author: David Zeuthen <davidz@redhat.com> 0.104-1.el7_2
changelog:
  - Update to upstream release 0.104
  - Force usage of systemd (instead of ConsoleKit) for session tracking


author: David Zeuthen <davidz@redhat.com> 0.105-1.el7_2
changelog:
  - Update to upstream release 0.105
  - Nuke patches that are now upstream
  - Change 'PolicyKit' to 'polkit' in summary and descriptions


author: David Zeuthen <davidz@redhat.com> 0.106-1.el7_2
changelog:
  - Update to upstream release 0.106
  - Authorizations are no longer controlled by .pkla files - from now
    on, use the new .rules files described in the polkit(8) man page


author: David Zeuthen <davidz@redhat.com> 0.108-1.el7_2
changelog:
  - Update to upstream release 0.108
  - Drop upstreamed patches
  - This release dynamically loads the JavaScript interpreter and can
    cope with it not being available. In this case, polkit authorization
    rules are not processed and the defaults for an action - as defined
    in its .policy file - are used for authorization decisions.
  - Add new meta-package, polkit-js-engine, that pulls in the required
    JavaScript bits to make polkit authorization rules work. The default
    install - not the minimal install - should include this package


author: David Zeuthen <davidz@redhat.com> 0.108-3.el7_2
changelog:
  - Attempt to open the correct libmozjs185 library, otherwise polkit
    authz rules will not work unless js-devel is installed (fdo #57146)


author: Miloslav Trmač <mitr@redhat.com> - 0.110-4
changelog:
  - Make the JavaScript engine mandatory.  The polkit-js-engine package has been
    removed, main polkit package Provides:polkit-js-engine for compatibility.
  - Add Requires: polkit-pkla-compat
    Resolves: #908808


author: Miloslav Trmač <mitr@redhat.com> - 0.110-4
changelog:
  - Shut up rpmlint about Summary:
  - Build with V=1
  - Use %{_unitdir} instead of hard-coding the path
  - Use the new systemd macros, primarily to run (systemctl daemon-reload)
    Resolves: #857382


author: Miloslav Trmač <mitr@redhat.com> - 0.111-1
changelog:
  - Update to polkit-0.111
    Resolves: #917888
  - Use SpiderMonkey from mozjs17 instead of js
  - Ship the signature in the srpm
  - Try to preserve timestamps in (make install)


author: Miloslav Trmač <mitr@redhat.com> - 0.112-2
changelog:
  - Workaround pam_systemd setting broken XDG_RUNTIME_DIR
    Resolves: #1033774
  - Always use mozjs-17.0 even if js-devel is installed


author: Kaj J. Niemi <kajtzu@fi.basen.net> 7.4-0.1
changelog:
  - 7.4
  - Fixed Patch #1 (now rpm-pgsql-7.4.patch)
  - Fixed Patch #2 (now rpm-multilib-7.4.patch):
  - Patch #4 is unnecessary (upstream)
  - Fixed Patch #6 (now postgresql-7.4-src-tutorial.patch)
  - Added Patch #8 (postgresql-7.4-com_err.patch) as com_err()
    is provided by e2fsprogs and CPPFLAGS gets lost somewhere
    inside configure (bad macro?)
  - No 7.4 PDF docs available yet (Source #17)
  - PyGreSQL is separated from the upstream distribution but
    we include it as usual (Source #18)
  - Default to compiling libpq and ECPG as fully thread-safe

  - 7.4 Origin.  See previous spec files for previous history. Adapted
  - from Red Hat and PGDG's 7.3.4 RPM, directly descended from 
  - postgresql-7.3.4-2 as shipped in Fedora Core 1.


author: Lamar Owen <lowen@pari.edu> <lamar.owen@wgcr.org>
changelog:
  - 7.4-0.1PGDG
  - Development JDBC jars in addition to the 7.3 jars; will replace the
  - 7.3 jars once 7.4 official jars are released.
  - Changed to use the bzip2 source to save a little size.
  - Removed some commented out portions of the specfile.
  - Removed the 7.3.4 PDF docs.  Will replace with 7.4 PDF's once they
  - are ready.


author: David Jee <djee@redhat.com> 7.4-4
changelog:
  - Add PyGreSQL patch for deprecated column pg_type.typprtlen [Bug #111263]
  - Add headers patch which moves ecpg headers to /usr/include/ecpg
    [Bug #111195]


author: Lamar Owen <lowen@pari.edu>
changelog:
  - 7.4.1-1PGDG
  - Merge Sander Steffann's changes up to 7.4-0.5PGDG
  - Proper 7.4.1 JDBC jars this time.
  - Patch for no pl/python from Alvaro


author: Tom Lane <tgl@redhat.com> 7.4.2-1
changelog:
  - Update to PostgreSQL 7.4.2; sync with community SRPM as much as possible.
  - Support PGOPTS from /etc/sysconfig/pgsql, per bug 111504.
  - Fix permissions on /etc/sysconfig/pgsql, per bug 115278.
  - SELinux patch in init file: always su </dev/null, per bug 117901.
  - Rebuilt


author: Tom Lane <tgl@redhat.com> 7.4.3-1
changelog:
  - Update to PostgreSQL 7.4.3.
  - Uninstalling server RPM stops postmaster first, per bug 114846.
  - Fix su commands to not assume PG user's shell is sh-like, per bug 124024.
  - Fix permissions on postgresql-python doc files, per bug 124822.
  - Minor postgresql.init improvements.


author: Tom Lane <tgl@redhat.com> 7.4.3-3
changelog:
  - Undo ill-considered chkconfig change that causes server to start
    immediately upon install.  Mea culpa (bug 127552).


author: Tom Lane <tgl@redhat.com> 7.4.5-1
changelog:
  - Update to PostgreSQL 7.4.5.
  - Update JDBC jars to driver build 215.
  - Add Obsoletes: entries for rh-postgresql packages, per bug 129278.


author: Tom Lane <tgl@redhat.com> 7.4.5-3
changelog:
  - Solve the stale lockfile problem (bugs 71295, 96981, 134090)
  - Use runuser instead of su for SELinux (bug 134588)


author: Tom Lane <tgl@redhat.com> 7.4.5-4
changelog:
  - Remove contrib/oidjoins stuff from installed fileset; it's of no use
    to ordinary users and has a security issue (bugs 136300, 136301)
  - adjust chkconfig priority (bug 128852)


author: Tom Lane <tgl@redhat.com> 7.4.6-1
changelog:
  - Update to PostgreSQL 7.4.6 (bugs 136947, 136949)
  - Make init script more paranoid about mkdir step of initializing a new
    database (bugs 136947, 136949)


author: Tom Lane <tgl@redhat.com> 7.4.6-3
changelog:
  - Update to PyGreSQL 3.6 (to fix bug #142711)
  - Adjust a few file permissions (bug #142431)
  - Assign %{_libdir}/pgsql to base package instead of -server (bug #74003)


author: Tom Lane <tgl@redhat.com> 8.0.0-1
changelog:
  - Update to PostgreSQL 8.0.0, PyGreSQL 3.6.1, pgtcl 1.5.2,
    and jdbc driver build 309.
  - Extensive cleanout of obsolete cruft in patch set.
  - Regression tests are run during RPM build (NOTE: cannot build as root when
    this is enabled).
  - Postmaster stderr goes someplace useful, not /dev/null (bz#76503, #103767)
  - Make init script return a useful exit status (bz#80782)
  - Move docs' tutorial directory to %{_libdir}/pgsql/tutorial, since it
    includes .so files that surely do not belong under /usr/share.
  - Remove useless .sgml files from docs RPM (bz#134450)
  - Put regression tests under /usr/lib64 on 64-bit archs, since .so files
    are not architecture-independent.


author: Tom Lane <tgl@redhat.com> 8.0.1-2
changelog:
  - Repair improper error message in init script when PGVERSION doesn't match.
  - Arrange for auto update of version embedded in init script.


author: Tom Lane <tgl@redhat.com> 8.0.1-4
changelog:
  - Attach Obsoletes: declarations for rh-postgresql to subpackages (bz#144435)
  - Make Requires: and Prereq: package linkages specify release not only
    version, as per recent mailing list discussion.


author: Tom Lane <tgl@redhat.com> 8.0.3-1
changelog:
  - Update to PostgreSQL 8.0.3 (includes security and data-loss fixes; see
    bz#156727, CAN-2005-1409, CAN-2005-1410)
  - Update to jdbc driver build 311
  - Recreate postgres user after superseding an rh-postgresql install (bug #151911)
  - Ensure postgresql server is restarted if running during an upgrade


author: Tom Lane <tgl@redhat.com> 8.0.4-1
changelog:
  - Update to PostgreSQL 8.0.4, PyGreSQL 3.6.2, and jdbc driver build 312
  - Adjust pgtcl link command to ensure it binds to correct libpq (bug #166665)
  - Remove obsolete Conflicts: against other python versions (bug #166754)
  - Add /etc/pam.d/postgresql (bug #167040)
  - Include contrib/xml2 in build (bug #167492)


author: Tom Lane <tgl@redhat.com> 8.1.0-1
changelog:
  - Update to PostgreSQL 8.1.0, PyGreSQL 3.7, and jdbc driver build 404
  - Fix PAM config file (must have account not only auth) (bug #167040)
  - Add BuildPrereq: libxslt-devel (bug #170141)
  - Sync with PGDG SRPM as much as feasible


author: Tom Lane <tgl@redhat.com> 8.1.1-1
changelog:
  - Update to PostgreSQL 8.1.1
  - Make pg_config.h architecture-independent for multilib installs;
    put the original pg_config.h into pg_config_$ARCH.h


author: Tom Lane <tgl@redhat.com> 8.1.1-3
changelog:
  - fix pg_config.h for 64-bit and ppc platforms
  - update Makefile.regress (needs to --load-language=plpgsql)


author: Tom Lane <tgl@redhat.com> 8.1.2-1
changelog:
  - Update to PostgreSQL 8.1.2
  - Repair extraneous quote in pgtcl configure script ... odd that bash
    didn't use to spit up on this.


author: Tom Lane <tgl@redhat.com> 8.1.3-1
changelog:
  - Update to PostgreSQL 8.1.3 (fixes bug #180617, CVE-2006-0553)
  - Update to jdbc driver build 405
  - Modify multilib header hack to not break non-RH arches, per bug #177564


author: Tom Lane <tgl@redhat.com> 8.1.4-1
changelog:
  - Update to PostgreSQL 8.1.4 (includes fixes for CVE-2006-2313, CVE-2006-2314;
    see bug #192173)
  - Update to PyGreSQL 3.8
  - Suppress noise from chcon, per bug #187744


author: Tom Lane <tgl@redhat.com> 8.2.0-1
changelog:
  - Update to PostgreSQL 8.2.0
  - Update to PyGreSQL 3.8.1
  - Fix chcon arguments in test/regress/Makefile
  Related: #201035
  - Adjust init script to not fool /etc/rc.d/rc
  Resolves: #161470
  - Change init script to not do initdb automatically, but require
    manual "service postgresql initdb" for safety.  Per upstream discussions.


author: Tom Lane <tgl@redhat.com> 8.2.1-1
changelog:
  - Update to PostgreSQL 8.2.1
  - Update to pgtcl 1.5.3
  - Be sure we link to libncurses, not libtermcap which is disappearing in Fedora


author: Tom Lane <tgl@redhat.com> 8.2.1-2
changelog:
  - Split -pl subpackage into three new packages to reduce dependencies
    and track upstream project's packaging.


author: Tom Lane <tgl@redhat.com> 8.2.4-2
changelog:
  - Fix oversight in postgresql-test makefile: pg_regress isn't a shell script
    anymore.  Per upstream bug 3398.


author: Tom Lane <tgl@redhat.com> 8.2.4-4
changelog:
  - Use tzdata package's data files instead of private copy, so that
    postgresql-server need not be turned for routine timezone updates
  - Don't remove postgres user/group during RPM uninstall, per Fedora
    packaging guidelines
  - Seems we need an explicit BuildRequires on gawk now
  - Rebuild to fix Fedora toolchain issues


author: Tom Lane <tgl@redhat.com> 8.2.4-5
changelog:
  - Use nicer solution for tzdata file substitution: upstream discussion
    concluded that hardwiring the path was better than a symlink after all.


author: Tom Lane <tgl@redhat.com> 8.2.6-1
changelog:
  - Update to PostgreSQL 8.2.6 to fix CVE-2007-4769, CVE-2007-4772,
    CVE-2007-6067, CVE-2007-6600, CVE-2007-6601
  - Make initscript and pam config files be installed unconditionally;
    seems new buildroots don't necessarily have those directories in place


author: Tom Lane <tgl@redhat.com> 8.3RC2-1
changelog:
  - Update to PostgreSQL 8.3RC2 (not waiting for 8.3.0 because Fedora 9 alpha
    should be 8.3-based not 8.2-based).
  - Update to pgtcl 1.6.2


author: Tom Lane <tgl@redhat.com> 8.3.1-2
changelog:
  - Clean up cross-subpackage Requires: to ensure that updating any one
    subpackage brings in the matching versions of others.
  Resolves: #444271


author: Tom Lane <tgl@redhat.com> 8.3.1-4
changelog:
  - Enable LDAP support
  Resolves: #445315
  - Use -Wl,--as-needed to suppress bogus dependencies for libraries that
    are really only needed by some of the subpackages


author: Tom Lane <tgl@redhat.com> 8.3.3-1
changelog:
  - Update to PostgreSQL 8.3.3.
  - Remove postgresql-prefer-ncurses.patch, no longer needed in recent
    Fedora releases because libtermcap is gone.


author: Tom Lane <tgl@redhat.com> 8.3.3-2
changelog:
  - Install Pgtcl in /usr/lib/tcl$TCL_VERSION, not directly in /usr/lib.
    Needed because tcl 8.5 no longer puts /usr/lib into its package search path.
    NOTE: do not back-port this change into branches using pre-8.5 tcl, because
    /usr/lib/tcl8.4 had been a symlink to /usr/share/tcl8.4, and /usr/share
    is exactly where we must not put Pgtcl.
  Resolves: #228263


author: Tom Lane <tgl@redhat.com> 8.3.5-1
changelog:
  - Update to PostgreSQL 8.3.5.
  - Improve display from init script's initdb action, per Michael Schwendt


author: Tom Lane <tgl@redhat.com> 8.3.6-1
changelog:
  - Update to PostgreSQL 8.3.6, for various fixes described at
    http://www.postgresql.org/docs/8.3/static/release-8-3-6.html


author: Tom Lane <tgl@redhat.com> 8.3.6-4
changelog:
  - Prevent dependent packages from needing to include sys/sdt.h
    (unintended side effect of previous patch)
  - Use -O1 on alpha, per report from Oliver Falk; -O2 tickles gcc bugs


author: Tom Lane <tgl@redhat.com> 8.3.7-1
changelog:
  - Update to PostgreSQL 8.3.7, for various fixes described at
    http://www.postgresql.org/docs/8.3/static/release-8-3-7.html
    notably the fix for CVE-2009-0922


author: Tom Lane <tgl@redhat.com> 8.4.0-1
changelog:
  - Update to PostgreSQL 8.4.0.  See release notes at
    http://www.postgresql.org/docs/8.4/static/release-8-4.html


author: Tom "spot" Callaway <tcallawa@redhat.com> 8.4.0-2
changelog:
  - update License tag to MIT (PostgreSQL calls it "BSD", but it is MIT)
  - Note: This changes nothing from a license compatibility perspective.


author: Tom Lane <tgl@redhat.com> 8.4.1-1
changelog:
  - Update to PostgreSQL 8.4.1, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-1.html
    including two security issues
  Related: #522085
  Related: #522092


author: Tom Lane <tgl@redhat.com> 8.4.2-1
changelog:
  - Update to PostgreSQL 8.4.2, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-2.html
    including two security issues
  Related: #546321
  Related: #547662
  - Use -N not the obsolete -n in useradd call
  Resolves: #495727
  - Clean up specfile to eliminate rpmlint gripes, mainly by removing
    no-longer-needed provisions for superseding rh-postgresql


author: Tom Lane <tgl@redhat.com> 8.4.2-2
changelog:
  - Remove static libraries (.a files) from package, per packaging guidelines
  - Change %define to %global, per packaging guidelines


author: Tom Lane <tgl@redhat.com> 8.4.2-3
changelog:
  - Remove the postgresql-python and postgresql-tcl subpackages.  These files
    are now broken out as their own packages (PyGreSQL and tcl-pgtcl,
    respectively), to reflect the now longstanding split of upstream projects.
  Related: #452306, #452321


author: Tom Lane <tgl@redhat.com> 8.4.2-4
changelog:
  - Arrange for the postmaster, but not any of its child processes, to be run
    with oom_adj -17.  This compensates for the OOM killer not being smart about
    accounting for shared memory usage.


author: Tom Lane <tgl@redhat.com> 8.4.2-5
changelog:
  - Latest version of systemtap needs the probes.o file to be built again
  Resolves: #557266
  - Provide script and instructions for building the documentation PDF


author: Tom Lane <tgl@redhat.com> 8.4.3-1
changelog:
  - Update to PostgreSQL 8.4.3, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-3.html


author: Tom Lane <tgl@redhat.com> 8.4.4-1
changelog:
  - Update to PostgreSQL 8.4.4, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-4.html
    including fixes for CVE-2010-1169 and CVE-2010-1170
  Resolves: #593032


author: Orcan Ogetbil <oget[dot]fedora[at]gmail[dot]com> - 8.4.4-3
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild
  - Duplicate COPYRIGHT in -libs subpackage, per revised packaging guidelines


author: Tom Lane <tgl@redhat.com> 8.4.5-1
changelog:
  - Update to PostgreSQL 8.4.5, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-5.html
    including the fix for CVE-2010-3433
  Related: #639371
  - Add -p "$pidfile" to initscript's status call to improve corner cases.
  Related: #561010


author: Tom Lane <tgl@redhat.com> 8.4.6-1
changelog:
  - Update to PostgreSQL 8.4.6, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-6.html
  - Ensure we don't package any .gitignore files from the source tarball
  Related: #642210


author: Tom Lane <tgl@redhat.com> 9.0.2-1
changelog:
  - Update to PostgreSQL 9.0.2 (major version bump)
  - Create infrastructure for in-place database upgrade using pg_upgrade
  Resolves: #398221


author: Tom Lane <tgl@redhat.com> 9.0.3-1
changelog:
  - Update to PostgreSQL 9.0.3, for various fixes described at
    http://www.postgresql.org/docs/9.0/static/release-9-0-3.html
    including the fix for CVE-2010-4015
  Resolves: #674296


author: Tom Lane <tgl@redhat.com> 9.0.3-2
changelog:
  - Remove filter-requires-perl-Pg.sh, which doesn't seem to be needed now that
    PyGreSQL has been split out; and our use of it isn't compatible with rpm 4.9
    anyway


author: Tom Lane <tgl@redhat.com> 9.0.4-1
changelog:
  - Update to PostgreSQL 9.0.4, for various fixes described at
    http://www.postgresql.org/docs/9.0/static/release-9-0-4.html
  - Add %{?_isa} to cross-subpackage Requires, per latest packaging guidelines


author: Tom Lane <tgl@redhat.com> 9.1.0-1
changelog:
  - Update to PostgreSQL 9.1.0 (major version bump);
    in-place upgrade support now works from 9.0.x as the previous version


author: Tom Lane <tgl@redhat.com> 9.1.1-1
changelog:
  - Update to PostgreSQL 9.1.1, for various fixes described at
    http://www.postgresql.org/docs/9.1/static/release-9-1-1.html
  - Enable build (but not test) of contrib/sepgsql
  - Clean up specfile build options so that turning options off works again


author: Honza Horak <hhorak@redhat.com> 9.1.1-2
changelog:
  - Create a symlink of pg_regress instead of full copy;
    Don't strip symbols from regress libs
  Related: #729012


author: Tom Lane <tgl@redhat.com> 9.1.2-1
changelog:
  - Update to PostgreSQL 9.1.2, for various fixes described at
    http://www.postgresql.org/docs/9.1/static/release-9-1-2.html


author: Tom Lane <tgl@redhat.com> 9.1.2-2
changelog:
  - Make systemd unit file more user-friendly by resurrecting the old init
    script's checks for data directory presence and version match
  Resolves: #771496


author: Tom Lane <tgl@redhat.com> 9.1.3-1
changelog:
  - Update to PostgreSQL 9.1.3, for various fixes described at
    http://www.postgresql.org/docs/9.1/static/release-9-1-3.html
    including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868
  Resolves: #797918


author: Tom Lane <tgl@redhat.com> 9.1.3-2
changelog:
  - Fix postgresql-setup to look for unit file in /usr/lib and to ignore
    comments therein
  Resolves: #802835
  - Resurrect a now-mostly-dummy postgresql init script, so that people can
    keep on using "service postgresql initdb" if they wish
  Resolves: #800416


author: Tom Lane <tgl@redhat.com> 9.1.3-3
changelog:
  - Fix postgresql-setup to rely on systemd to parse the unit file, instead
    of using ad-hoc code
  Resolves: #804290


author: Tom Lane <tgl@redhat.com> 9.1.4-1
changelog:
  - Update to PostgreSQL 9.1.4, for various fixes described at
    http://www.postgresql.org/docs/9.1/static/release-9-1-4.html
    including the fixes for CVE-2012-2143, CVE-2012-2655
  Resolves: #826606
  - Update previous version (embedded in postgresql-upgrade) to 9.0.8
    because fix in whole-row variable dumping could be needed for upgrades
  - Revert fix for bug #800416, per fedora-packaging discussion at
    http://lists.fedoraproject.org/pipermail/packaging/2012-April/008314.html
    "service postgresql initdb" is dead and will stay that way


author: Tom Lane <tgl@redhat.com> 9.1.4-3
changelog:
  - Update code to use oom_score_adj not oom_adj, thereby suppressing
    whining in the kernel log
  - Add "legacy action" scripts to support "service postgresql initdb" and
    "service postgresql upgrade" in a now-approved fashion (requires a
    recent version of initscripts to work)
  Resolves: #800416


author: Tom Lane <tgl@redhat.com> 9.1.4-5
changelog:
  - Back-port upstream support for postmaster listening on multiple Unix sockets
  - Configure postmaster to create sockets in both /var/run/postgresql and /tmp;
    the former is now the default place for libpq to contact the postmaster.
  Resolves: #825448
  - Annotate postgresql.conf about not setting port number there
  - Minor specfile cleanup per suggestions from Tom Callaway
  Related: #845110


author: Tom Lane <tgl@redhat.com> 9.1.5-1
changelog:
  - Update to PostgreSQL 9.1.5, for various fixes described at
    http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
    including the fixes for CVE-2012-3488, CVE-2012-3489


author: Tom Lane <tgl@redhat.com> 9.2.0-1
changelog:
  - Update to PostgreSQL 9.2.0 (major version bump);
    in-place upgrade support now works from 9.1.x as the previous version
  - Add postgresql-plpython3 subpackage with PL/Python built against Python 3


author: Tom Lane <tgl@redhat.com> 9.2.1-1
changelog:
  - Update to PostgreSQL 9.2.1, for various fixes described at
    http://www.postgresql.org/docs/9.2/static/release-9-2-1.html
    including a nasty data-loss bug
  - Adopt new systemd macros for server package install/uninstall triggers
  Resolves: #850277


author: Tom Lane <tgl@redhat.com> 9.2.2-1
changelog:
  - Update to PostgreSQL 9.2.2, for various fixes described at
    http://www.postgresql.org/docs/9.2/static/release-9-2-2.html
  - Use new systemd install/uninstall trigger macros conditionally,
    so that package can still be installed on pre-F18 branches


author: Tom Lane <tgl@redhat.com> 9.2.2-3
changelog:
  - Prevent creation of TCP socket during pg_upgrade regression test, so that
    concurrent RPM builds on the same machine won't fail
  Resolves: #891531
  - Make sure $PGDATA/pg_log/ gets the right SELinux label in postgresql-setup
  Resolves: #891547


author: Tom Lane <tgl@redhat.com> 9.2.3-1
changelog:
  - Update to PostgreSQL 9.2.3, for various fixes described at
    http://www.postgresql.org/docs/9.2/static/release-9-2-3.html
    including the fix for CVE-2013-0255
  Resolves: #908722
  - Make the package build with selinux option disabled
  Resolves: #894367
  - Include old version of pg_controldata in postgresql-upgrade subpackage
  Related: #896161


author: Tom Lane <tgl@redhat.com> 9.2.4-1
changelog:
  - Update to PostgreSQL 9.2.4, for various fixes described at
    http://www.postgresql.org/docs/9.2/static/release-9-2-4.html
    including the fixes for CVE-2013-1899, CVE-2013-1900, CVE-2013-1901
  Resolves: #929223, #929255, #929328
  - fix build for aarch64 and ppc64p7


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.4-2
changelog:
  - postgresql-setup: don't create whole path to server's data to make sure that
    the parent directory has correct permissions (#972425)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.4-3
changelog:
  - add atomic operations support for aarch64 to preupgrade version also (#970661)
  - apply the forgotten man-page-day patch (#948933)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.4-5
changelog:
  - %beta implies debug everywhere (also in upgrade part of build)
  - allow `rpmbuild -bi --short-circuit`
  - upgrade: setup previous (RHEL6) version as 8.14.3
  - upgrade: start old postgres with socket file in /var/run/postgresql


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.4-6
changelog:
  - disable aggressive loop optimizations for old codebase (#993532)
  - upgrade: stop old server in case of permissions problem (#896161)


author: Jozef Mlich <jmlich@redhat.com> - 9.2.5-1
changelog:
  - rebase postgresql to 9.2.5 #1019762 
    http://www.postgresql.org/docs/9.2/static/release-9-2-5.html


author: Jozef Mlich <jmlich@redhat.com> - 9.2.5-2
changelog:
  - Resolves: #1019762 
  - additionally fixes rpmdiff filelist problem with
    /usr/share/doc/postgresql-9.2.5/html/bookindex.html.orig


author: Jozef Mlich <jmlich@redhat.com> - 9.2.6-1
changelog:
  - Resolves #1038688
  - rebase to 9.2.6 see changes at
    http://www.postgresql.org/docs/9.2/static/release-9-2-6.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.7-1
changelog:
  - update to 9.2.7 per release notes (#1065845)
    http://www.postgresql.org/docs/9.2/static/release-9-2-7.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.10-1
changelog:
  - update to 9.2.10 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-10.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-9.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-8.html
    (rhbz#1198672 rhbz#1198673)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.11-1
changelog:
  - update to 9.2.11 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-11.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.12-1
changelog:
  - update to 9.2.12 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-12.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.13-1
changelog:
  - update to 9.2.13 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-13.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.14-1
changelog:
  - update to 9.2.14 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-14.html


author: Pavel Kajaba <pkajaba@redhat.com> - 9.2.15-1
changelog:
  - update to 9.2.15 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-15.html


author: Jaromir Capik <jcapik@redhat.com> - 3.3.2-2
changelog:
  - Fixing requires in the devel subpackage (missing (x86-64) macro)
  - License statement clarification (upstream patch referrenced in the spec header)


author: Jaromir Capik <jcapik@redhat.com> - 3.3.4-2
changelog:
  - fixing the following regressions:
  -   negative ETIME field in ps (#871819)
  -   procps states a bug is hit when receiving a signal (#871824)
  -   allow core file generation by ps command (#871825)


author: Jaromir Capik <jcapik@redhat.com> - 3.3.6-1
changelog:
  - Update to 3.3.6
  - Changing URL/Source from gitorious to recently created sourceforge page
  - Replacing autogen.sh with autoreconf


author: Jaromir Capik <jcapik@redhat.com> - 3.3.8-7
changelog:
  - Disabling screen content restoration when exiting 'top' (#977561)
  - Enabling SIGWINCH flood prevention


author: Jaromir Capik <jcapik@redhat.com> - 3.3.8-11
changelog:
  - Support for libselinux (#975459)
  - Support for systemd (#994457)
  - Support for 'Shmem' in free (#993271)


author: Jaromir Capik <jcapik@redhat.com> - 3.3.9-5
changelog:
  - Support for timestamps & wide diskstat (#1053428, #1025833)
  - Fixing fd leak in watch
  - Fixing format-security build issues
  - Skipping trailing zeros in read_unvectored (#1057600)
  - Resolves: rhbz#1053428, Related: rhbz#1025833


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-1
changelog:
  - Upgrading to 3.3.10
  - top.1: physical memory - has used / is using (#1119263)
  - Include man pages for openproc, readproc and readproctab (#1119260)
  - ps -p cycles over all PIDs instead of just one (#1060715)
  - Remove explicit dependency on systemd-libs package (#1113206)
  - Allow longer usernames to display in ps output (#1112734)
  - w doesn't display FROM by default (#1078310)
  - Return value of pgrep is incorrect (#1116309)
  - Should shared memory be accounted in cached in free output? (#1070736)
  - Resolves: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Resolves: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-2
changelog:
  - Replacing RC tarball with final 3.3.10 release
  - Related: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Related: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jaromir Capik <jcapik@redhat.com> - 3.3.10-3
changelog:
  - Disabling translated man pages due to conflicts with man-pages-*
  - Removing /etc/sysctl.d (quietly stolen by systemd)
  - Related: rhbz#1119263 rhbz#1119260 rhbz#1060715 rhbz#1113206
  - Related: rhbz#1112734 rhbz#1078310 rhbz#1116309 rhbz#1070736


author: Jeremy Hylton <jeremy@beopen.com>
changelog:
  - Version 2 of 2.0b1
  - Make the package relocatable.  Thanks to Suchandra Thapa.
  - Exclude Tkinter from main RPM.  If it is in a separate RPM, it is
    easier to track Tk releases.


author: Jeremy Hylton <jeremy@beopen.com>
changelog:
  - updated for 2.0c1
  - build audioop, imageop, and rgbimg extension modules
  - include xml.parsers subpackage
  - add test.xml.out to files list


author: Matt Wilson <msw@redhat.com>
changelog:
  - modify all files to use "python2.0" as the intrepter
  - don't build the Expat bindings
  - build against db1


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - fix the "requires" clause, it lacked a space causing problems
  - use %{_tmppath}
  - don't define name, version etc
  - add the available patches from the Python home page


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-0.4a4
changelog:
  - 2.2a4
  - Enable UCS4 support
  - Enable IPv6
  - Provide distutils
  - Include msgfmt.py and pygettext.py


author: Matt Wilson <msw@redhat.com> 2.2-0.9b2
changelog:
  - changed DESTDIR to point to / so that distutils will install dynload
    modules properly in the installroot


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-0.11c1
changelog:
  - 2.2 RC 1
  - Don't include the _tkinter module in the main package - it's 
    already in the tkiter packace
  - Turn off the mpzmodule, something broke in the buildroot


author: Nalin Dahyabhai <nalin@redhat.com> 2.2-5
changelog:
  - disable ndbm support, which is db2 in disguise (really interesting things
    can happen when you mix db2 and db4 in a single application)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-8
changelog:
  - Make files in /usr/bin install side by side with python 1.5 when
  - Drop explicit requirement of db4
    built as python2


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2-16
changelog:
  - the same, but in builddirs - this will remove them from the 
    docs package, which doesn't look in the buildroot for files.


author: Mihai Ibanescu <misa@redhat.com>
changelog:
  - builds as python2 require a different libdb
  - changed the buildroot name of python to match python2 builds


author: Mihai Ibanescu <misa@redhat.com>
changelog:
  2.2.2-2
  - Fix #76912 (python-tools contains idle, which uses tkinter, but there is no
    requirement of tkinter from python-tools).
  - Fix #74013 (rpm is missing the /usr/lib/python2.2/test directory)


author: Mihai Ibanescu <misa@redhat.com>
changelog:
  2.2.2-3.*
  - Merged patch from Karsten Hopp <karsten@redhat.de> from 2.2.1-17hammer to
    use %{_libdir}
  - Added XFree86-libs as BuildRequires (because of tkinter)
  - Fixed duplicate listing of plat-linux2
  - Fixed exclusion of lib-dynload/japanese
  - Added lib64 patch for the japanese codecs
  - Use setup magic instead of using tar directly on JapaneseCodecs


author: Mihai Ibanescu <misa@redhat.com>
changelog:
  2.2.2-5
  - Fixed configuration patch to add -lcrypt when compiling cryptmodule.c

  2.2.2-4
  - Spec file change from Matt Wilson <msw@redhat.com> to disable linking 
    with the C++ compiler.


author: Mihai Ibanescu <misa@redhat.com>
changelog:
  2.2.2-3.7.3
  - Recompiled for 7.3 (to fix the -lcrypt bug)
  - Fix for the spurious error message at the end of the build (build-requires
    gets confused by executable files starting with """"): make the tests
    non-executable.


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-7
changelog:
  - Fix bug #79647 (Rebuild of SRPM fails if python isn't installed)
  - Added a bunch of missing BuildRequires found while fixing the
    above-mentioned bug


author: Jeremy Katz <katzj@redhat.com> 2.2.2-8
changelog:
  - urllib2 didn't support non-anonymous ftp.  add support based on how 
    urllib did it (#80676, #78168)


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-11.7.3
changelog:
  - Fixed bug #82544: Errata removes most tools
  - Fixed bug #82435: Python 2.2.2 errata breaks redhat-config-users
  - Removed .lib64 and - files that get installed after we fix the multilib
    .py files.


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-13
changelog:
  - Attempt to look both in /usr/lib64 and /usr/lib/python2.2/site-packages/:
    some work on python-2.2.2-lib64.patch


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-22
changelog:
  - Using newer Japanese codecs (1.4.9). Thanks to 
    Peter Bowen <pzb@datastacks.com> for pointing this out.


author: Jeremy Katz <katzj@redhat.com> 2.2.2-23
changelog:
  - ftp uri's should be able to specify being rooted at the root instead of 
    where you login via ftp (#84692)


author: Mihai Ibanescu <misa@redhat.com> 2.2.2-25
changelog:
  - Fixed bug #84886: pydoc dies when run w/o arguments
  - Fixed bug #84205: add python shm module back (used to be shipped with 1.5.2)
  - Fixed bug #84966: path in byte-compiled code still wrong


author: Mihai Ibanescu <misa@redhat.com> 2.3-0.2
changelog:
  - Building python 2.3
  - Added more BuildRequires
  - Updated the startup files for modulator and pynche; idle installs its own
    now.


author: Mihai Ibanescu <misa@redhat.com> 2.3.3-4
changelog:
  - Fix for bug #122304 : splitting the domain name fails on 64-bit arches
  - Fix for bug #120879 : including Makefile into the main package

  - Requires XFree86-devel instead of -libs (see bug #118442)


author: Mihai Ibanescu <misa@redhat.com> 2.3.3-6
changelog:
  - Correct fix for #122304 from upstream:
    http://sourceforge.net/tracker/?func=detail&atid=105470&aid=931848&group_id=5470


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-1
changelog:
  - Updated to 2.3.4-1 with Robert Scheck's help (bug #124764)
  - Added BuildRequires: tix-devel (bug #124918)


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-3
changelog:
  - Added an optik.py that provides the same interface from optparse for
    backward compatibility; obsoleting python-optik


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-6
changelog:
  - Fixed #128030 (help() not printing anything)
  - Fixed #125472 (distutils.sysconfig.get_python_lib() not returning the right
    path on 64-bit systems)
  - Fixed #127357 (building python as a shared library)
  - Fixed  #19347 (including the contents of Tools/scripts/ in python-tools)


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-7
changelog:
  - Including html documentation for non-i386 arches
  - Fixed #125362 (python-doc html files have japanese character encoding)
  - Fixed #128923 (missing dependency between python and python-devel)


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-8
changelog:
  - Fixed bug #129769: Makefile in new python conflicts with older version found
    in old python-devel
  - Reorganized the spec file to get rid of the aspython2 define; __python_ver
    is more powerful.


author: Mihai Ibanescu <misa@redhat.com> 2.3.4-10
changelog:
  - Fixed bug #77418 (Demo dir not packaged)
  - More tweaking on #19347 (Moved Tools/ under /usr/lib/python2.3/Tools)


author: Jeff Johnson <jbj@jbj.org> 2.4-2
changelog:
  - db-4.3.21 returns DB_BUFFER_SMALL rather than ENOMEM (#141994).
  - add Provide: python(abi) = 2.4
  - include msgfmt/pygettext *.pyc and *.pyo from brp-python-bytecompile.


author: Mihai Ibanescu <misa@redhat.com> 2.4-6
changelog:
  - building the docs from a different source rpm, to decouple bootstrapping
    python from having tetex installed


author: Mihai Ibanescu <misa@redhat.com> 2.4.1-2
changelog:
  - Fixed bug #143667 (python should own /usr/lib/python* on 64-bit systems, for
    noarch packages)
  - Fixed bug #143419 (BuildRequires db4 is not versioned)


author: Mihai Ibanescu <misa@redhat.com> 2.4.1-7
changelog:
  - Fixed bug #169046 (realpath is unsafe); thanks to 
    Peter Jones <pjones@redhat.com> and Arjan van de Ven <arjanv@redhat.com> for
    diagnosing and the patch.


author: Mihai Ibanescu <misa@redhat.com> 2.4.1-10
changelog:
  - Fixed bug #169159 (don't let python core dump if no arguments are passed in)
    Reworked the patch from -8 a bit more.


author: Peter Jones <pjones@redhat.com> 2.4.1-12
changelog:
  - Fixed bug #169159 (check for argc>0 and argv[0] == NULL, not just
      argv[0][0]='\0')
    Reworked the patch from -8 a bit more.


author: Mihai Ibanescu <misa@redhat.com> - 2.4.3-6
changelog:
  - Fixed bug #192592 (too aggressive assertion fails) - SF#1257960
  - Fixed bug #167468 (Doc/tools not included) - added in the python-tools package


author: Mihai Ibanescu <misa@redhat.com> - 2.4.99.c1
changelog:
  - Updated to 2.5c1. Merged fixes from FC6 too:
  - Fixed bug #199373 (on some platforms CFLAGS is needed when linking)
  - Fixed bug #198971 (case conversion not locale safe in logging library)
  - Verified bug #201434 (distutils.sysconfig is confused by the change to make
    python-devel multilib friendly) is fixed upstream


author: Jeremy Katz <katzj@redhat.com>
changelog:
  - fix _md5 and _sha modules (Robert Sheck)
  - no longer provide optik compat; it's been a couple of years now
  - no longer provide the old shm module; if this is still needed, let's 
    build it separately
  - no longer provide japanese codecs; should be a separate package


author: Jeremy Katz <katzj@redhat.com>
changelog:
  - support db 4.5
  - obsolete python-elementtree; since it requires some code tweaks, don't 
    provide it
  - obsolete old python-sqlite; provide the version that's actually included


author: Jeremy Katz <katzj@redhat.com> - 2.5.3-3
changelog:
  - fix atexit traceback with failed syslog logger (#218214)
  - split libpython into python-libs subpackage for multilib apps 
    embedding python interpreters


author: Jeremy Katz <katzj@redhat.com> - 2.5.3-8
changelog:
  - fix extensions to use shared libpython (#219564)
  - all 64bit platforms need the regex fix (#122304)


author: Jeremy Katz <katzj@redhat.com> - 2.5.1-4
changelog:
  - fix _elementtree.so build (#245703)
  - ensure that extension modules we expect are actually built rather than 
    having them silently fall out of the package


author: James Antill <jantill@redhat.com> - 2.5.1-13
changelog:
  - Add tix buildprereq
  - Add tkinter patch
  - Resolves: #281751
  - Fix ctypes loading of libraries, add requires on binutils
  - Resolves: #307221
  - Possible fix for CVE-2007-4965 possible exploitable integer overflow
  - Resolves: #295971


author: James Antill <jantill@redhat.com> - 2.5.1-15
changelog:
  - Do codec lowercase in C Locale.
  - Resolves: 207134 191096
  - Fix stupid namespacing in pysqlite, minimal upgrade to 2.3.3 pysqlite
  - Resolves: 263221


author: James Antill <jantill@redhat.com> - 2.5.1-16
changelog:
  - Fix pyconfig.h comment typo.
  - Add back test_support.py and the __init__.py file.
  - Resolves: rhbz#387401


author: James Antill <jantill@redhat.com> - 2.5.1-18
changelog:
  - Create a python-test sub-module, over 3MB of stuff noone wants.
  - Don't remove egginfo files, try this see what happens ... may revert.
  - Resolves: rhbz#414711


author: James Antill <jantill@redhat.com> - 2.5.1-20
changelog:
  - Add valgrind support files, as doc, to python-devel
  - Relates: rhbz#418621
  - Add new API from 2.6, set_wakeup_fd ... use at own risk, presumably won't
  - change but I have no control to guarantee that.
  - Resolves: rhbz#427794
  - Add gdbinit support file, as doc, to python-devel


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-2
changelog:
  - "Makefile" and the config-32/64.h file are needed by distutils/sysconfig.py
  _init_posix(), so we include them in the core package, along with their parent
  directories (bug 531901)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-3
changelog:
  - fixup the build when __python_ver is set (Zach Sadecki; bug 533989); use
  pybasever in the files section


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-4
changelog:
  - automatically disable arena allocator when run under valgrind (upstream
  issue 2422; patch 52)
  - add patch from Josh Boyer containing diff against upstream PyBSDDB to make
  the bsddb module compile against db-4.8 (patch 53, #544275); bump the necessary
  version of db4-devel to 4.8
  - patch setup.py so that it searches for db-4.8, and enable debug output for
  said search; make Setup.dist use db-4.8 (patch 54)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-5
changelog:
  - replace usage of %define with %global
  - use the %{_isa} macro to ensure that the python-devel dependency on python
  is for the correct multilib arch (#555943)
  - delete bundled copy of libffi to make sure we use the system one
  - replace references to /usr with %{_prefix}; replace references to
  /usr/include with %{_includedir}


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-6
changelog:
  - patch Makefile.pre.in to avoid building static library (patch111, bug 556092)
  - split up the "configure" invocation flags onto individual lines


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-9
changelog:
  - change python-2.6.2-config.patch to remove our downstream change to curses
  configuration in Modules/Setup.dist, so that the curses modules are built using
  setup.py with the downstream default (linking against libncursesw.so, rather
  than libncurses.so), rather than within the Makefile; add a test to %install
  to verify the dso files that the curses module is linked against the correct
  DSO (bug 539917; changes _cursesmodule.so -> _curses.so)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-10
changelog:
  - introduce macros for 3 directories, replacing expanded references throughout:
  %{pylibdir}, %{dynload_dir}, %{site_packages}
  - explicitly list all lib-dynload files, rather than dynamically gathering the
  payload into a temporary text file, so that we can be sure what we are
  shipping; remove now-redundant testing for presence of certain .so files
  - remove embedded copy of zlib from source tree before building


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-11
changelog:
  - update python-2.6.2-config.patch to remove downstream customization of build
  of pyexpat and elementtree modules
  - add patch adapted from upstream (patch 3) to add support for building against
  system expat; add --with-system-expat to "configure" invocation
  - remove embedded copy of expat from source tree during "prep"


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-12
changelog:
  - Address some of the issues identified in package review (bug 226342):
    - update libs requirement on base package to use %{name} for consistency's
  sake
    - convert from backticks to $() syntax throughout
    - wrap value of LD_LIBRARY_PATH in quotes
    - convert "/usr/bin/find" requirement to "findutils"
    - remove trailing periods from summaries of -devel and -tools subpackages
    - fix spelling mistake in description of -test subpackage
    - convert usage of $$RPM_BUILD_ROOT to %{buildroot} throughout, for
  stylistic consistency
    - supply dirmode arguments to defattr directives


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-15
changelog:
  - work around bug 562906 by supplying a fixed version of pythondeps.sh
  - set %{_python_bytecompile_errors_terminate_build} to 0 to prevent the broken
  test files from killing the build on buildroots where python is installed


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-16
changelog:
  - move the -gdb.py file from %{_libdir}/INSTSONAME-gdb.py to
  %{_prefix}/lib/debug/%{_libdir}/INSTSONAME.debug-gdb.py to avoid noise from
  ldconfig (bug 562980), and which should also ensure it becomes part of the
  debuginfo subpackage, rather than the libs subpackage
  - introduce %{py_SOVERSION} and %{py_INSTSONAME} to reflect the upstream
  configure script, and to avoid fragile scripts that try to figure this out
  dynamically (e.g. for the -gdb.py change)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-17
changelog:
  - add systemtap static probes (wcohen; patch 55; rh bug #545179)
  - update some comments in specfile relating to gdb work
  - manually byte-compile the gdb.py file with the freshly-built python to ensure
  that .pyx and .pyo files make it into the debuginfo manifest if they are later
  byte-compiled after find-debuginfo.sh is run


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-18
changelog:
  - add a systemtap tapset defining "python.function.entry" and
  "python.function.return" to make it easy to use the static probepoint within
  Python; add an example of using the tapset to the docs


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-19
changelog:
  - revise the systemtap patch (patch 55:python-2.6.4-dtrace.patch) to the
  new version by mjw in attachment 390110 of rhbz:545179, as this should
  eliminate the performance penalty for the case where the probes aren't in
  use, and eliminate all architecture-specific code (rhbz:563541; except on
  sparc)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-20
changelog:
  - avoid having the "test" subdirectory and the files within it that are in the
  core subpackage also be owned by the test subpackage (rhbz:467588)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-22
changelog:
  - add pyfuntop.stp; allow systemtap support to be disabled
  - remove trailing period from tkinter summary
  - don't own /usr/bin/python-config if you're not the main python


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-23
changelog:
  - fixup distutils/unixccompiler.py to remove standard library path from
  rpath (patch 17)
  - delete DOS batch files


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-1
changelog:
  - update to 2.6.5: http://www.python.org/download/releases/2.6.5/
  - replace our patch to compile against db4.8 with a patch from
  upstream (patch 53, from r78974); update patch 54 since part of it is now in
  that upstream patch
  - update patch 110 so that it still applies in the face of upstream r78380


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-4
changelog:
  - update python-gdb.py from v3 to v4 (fixing infinite recursion on reference
  cycles and tracebacks on bytes 0x80-0xff in strings, adding handlers for sets
  and exceptions)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-6
changelog:
  - move the "bdist_wininst" command's template .exe files from the core package
  to the devel subpackage, to save space (rhbz:525469)
  - fix stray doublelisting of config directory wildcard in devel subpackage


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-9
changelog:
  - build and install two different configurations of Python: debug and standard,
  packaging the debug build in a new "python-debug" subpackage (patch 112)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-10
changelog:
  - add configure-time support for COUNT_ALLOCS and CALL_PROFILE debug options
  (patch 113); enable them and the WITH_TSC option within the debug build


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-13
changelog:
  - ensure that the compiler is invoked with "-fwrapv" (rhbz#594819)
  - CVE-2010-1634: fix various integer overflow checks in the audioop
  module (patch 116)
  - CVE-2010-2089: further checks within the audioop module (patch 117)
  - CVE-2008-5983: the new PySys_SetArgvEx entry point from r81399 (patch 118)


author: Dan Horák <dan[at]danny.cz> - 2.6.5-14
changelog:
  - reading the timestamp counter is available only on some arches (see Python/ceval.c)
  - disable --with-valgrind on s390(x) arches


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-16
changelog:
  - Fix an incompatibility between pyexpat and the system expat-2.0.1 that led to
  a segfault running test_pyexpat.py (patch 119; upstream issue 9054)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-17
changelog:
  - Stop python bailing out with an assertion failure when UnicodeDecodeErrors
  occur on very large buffers (patch 120, upstream issue 9058)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-0.1.rc1
changelog:
  - 2.7rc1:
    - rework patches to apply against 2.7 (which among other changes has had a
  whitespace cleanup of the .c code): .rhconfig (patch0), .binutils-no-dep
  (patch10), .ascii-tolower (patch11), .socketmodule (patch13), .socketmodule2
  (patch14), .systemtap (patch55), .lib64 (patch102), .selinux (patch110),
  .no-static-lib (patch111), .debug-build (patch112), .statvfs-f-flag-constants
  (patch114), ..CVE-2010-2089 (patch117)
    - drop upstream patches: .expat (patch3), .brprpm (patch51), .valgrind
  (patch52), .db48 (patch53), .CVE-2010-1634 (patch 116), .CVE-2008-5983 (patch
  118)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-0.1.rc2
changelog:
  - 2.7rc2
  - revert r79310 (patch 121)
  - remove modulator: upstream removed it in r78338
  - rename mathmodule(_d).so to math(_d).so in manifests (appears to be changed
  by r76861)
  - _bytesio(_d).so and _filesio(_d).so were consolidated into _io(_d).so in
  r73394 (upstream issue 6215)
  - use the gdb hooks from the upstream tarball, rather than keeping our own
  copy. The upstream version has some whitespace changes, a new write_repr for
  unicode objects, and various bulletproofings for being run on older gdbs


author: David Malcolm <dmalcolm@redhat.com> - 2.7-1
changelog:
  - 2.7 final; drop alphatag
  - drop patch 117 (upstream), patch 120 (upstreamed)
  - fix the commented-out __python_ver from 26 to 27


author: David Malcolm <dmalcolm@redhat.com> - 2.7-2
changelog:
  - add machinery for regenerating the "configure" script in the face of
  mismatching autoconf versions (patch 300)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-4
changelog:
  - fix reference to pyconfig.h in sysconfig that led to failure on startup if
  python-devel was not installed


author: David Malcolm <dmalcolm@redhat.com> - 2.7-5
changelog:
  - disable systemtap for now (dtrace is failing on startup due to the bug
  mentioned in 2.7-4)
  - provide relative path to python binary when running pathfix.py
  - fix parallel make (patch 122)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-6
changelog:
  - re-enable systemtap
  - cherrypick upstream patch to 2to3 for "from itertools import *"
  traceback (patch 123)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-8
changelog:
  - add %check section
  - update lib64 patch (patch 102) to fix expected output in test_site.py on
  64-bit systems
  - patch test_commands.py to work with SELinux (patch 124)
  - patch the debug build's usage of COUNT_ALLOCS to be less verbose (patch 125)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-9
changelog:
  - move most of the payload of the core package to the libs subpackage, given
  that the libs aren't meaningfully usable without the standard libraries


author: David Malcolm <dmalcolm@redhat.com> - 2.7.1-1
changelog:
  - 2.7.1, reworking patch 0 (config), patch 102 (lib64); drop upstream
  patch 56 (cfgparse), patch 110 (ctypes/SELinux/noexecmem), patch 119 (expat
  compat), patch 123 (2to3 on "from itertools import *")
  - fix test_abc's test_cache_leak in the debug build (patch 128)
  - drop _weakref.so from manifest (_weakref became a core module in r84230)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.1-4
changelog:
  - for now, drop "obsoletes" of python-argparse, since it interracts badly with
  multilib (rhbz#667984)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-1
changelog:
  - 2.7.2; drop upstreamed patches: patch 122 (parallel make fix), patch 124
  (test_commands and SELinux), patch 130 (ppc preprocessor macro in debug
  build); patch 131 (decimal in Turkish locale); regenerate the autotool
  intermediates patch (patch 300)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-3
changelog:
  - reorganize test exclusions (test_openpty and test_pty seem to be failing on
  every arch, not just the explicitly-listed ones)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-7
changelog:
  - re-enable and fix the --with-tsc option on ppc64, and rework it on 32-bit
  ppc to avoid aliasing violations (patch 129; rhbz#698726)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-10
changelog:
  - rewrite of "check", introducing downstream-only hooks for skipping specific
  cases in an rpmbuild (patch 132), and fixing/skipping failing tests in a more
  fine-grained manner than before (patches 104, 133-142)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-11
changelog:
  - rename and renumber patches for consistency with python3.spec (55, 111, 113,
  114, 125, 131, 129 to 143)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-14
changelog:
  - support OpenSSL FIPS mode in _hashlib and hashlib; don't build the _md5 and
  _sha* modules, relying on _hashlib in hashlib, and thus within md5 etc
  (rhbz#563986; patch 146)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-1
changelog:
  - 2.7.3: refresh patch 102 (lib64); drop upstream patches 11 (ascii-to-lower),
  115 (pydoc robustness), 145 (linux2), 148 (gdbm magic values), 151 (deadlock
  in fork); refresh patch 112 (debug build); revise patch 127
  (test_structmember); fix test_gdb (patch 153); refresh patch 137 (distutils
  tests); add python2.pc to python-devel; regenerate the autotool intermediates
  patch (patch 300)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-4
changelog:
  - avoid allocating thunks in ctypes unless absolutely necessary, to avoid
  generating SELinux denials on "import ctypes" and "import uuid" when embedding
  Python within httpd (patch 155; rhbz#814391)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-8
changelog:
  - update uid/gid handling to avoid int overflows seen with uid/gid
  values >= 2^31 on 32-bit architectures (patch 157; rhbz#697470)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.3-11
changelog:
  - fix memory leak in module _hashlib (patch 158, rhbz#836285)
  - fix db4 include path for libdb4 package (f18 and above) (patch 159)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-17
changelog:
  - remove "_default_patch_fuzz" directive to avoid patches being silently
  misapplied (refresh patch 1, patch 101, patch 102, patch 111, patch 121,
  patch 158; rename patch 1, patch 101, patch 121; apply patch 54 before the
  lib64 patches to avoid fuzz problems caused by the conditional application
  of the lib64 patches)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-19
changelog:
  - bulletproof the gdb debugging hooks against a failure seen in ARM builds
  (patch 166; rhbz#912025)
  - re-enable make check on ARM (rhbz#912025)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-22
changelog:
  - fix a problem with distutils.sysconfig when CFLAGS is defined in the
  environment (patch 168; rhbz#849994)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-23
changelog:
  - use SHA-256 rather than implicitly using MD5 within the challenge handling
  in multiprocessing.connection (patch 169; rhbz#879695)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-25
changelog:
  - in debug builds, try to print repr() when a C-level assert fails in the
  garbage collector (typically indicating a reference-counting error somewhere
  else e.g in an extension module) (patch 170; rhbz#850013)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-27
changelog:
  - port _multiprocessing.Connection.poll() to use the "poll" syscall, rather
  than "select", allowing large numbers of subprocesses (patch 172;
  rhbz#849992)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-34
changelog:
  - restrict scope of workaround for cmpi-bindings issue to avoid breaking
  in-tree running of test_sys and test_subprocess (rhbz#817554)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.4-1
changelog:
  - Updated to Python 2.7.4.
  - Refreshed patches: 0 (config), 7 (sqlite encoding), 16 (rpath in config),
  55 (systemtap), 111 (no static lib), 112 (debug build), 113 (more
  configuration flags), 130 (add extension to python config), 134 (fix
  COUNT_ALLOCS in test_sys), 146 (haslib FIPS), 147 (add debug malloc stats),
  153 (fix gdb test noise), 157 (uid, gid overflow - fixed upstream, just
  keeping few more downstream tests), 165 (crypt module salt backport),
  175 (fix configure Wformat), 5000 (regenerated autotooling patch)
  - Dropped patches: 101 (lib64 regex; merged upstream), 171 (exception on
  missing /dev/urandom; merged upstream), 172 (poll for multiprocessing socket
  connection; merged upstream)


author: Kalev Lember <kalevlember@gmail.com> - 2.7.4-2
changelog:
  - Build with libdb 5.3 instead of libdb4
  - Refreshed patches: 0 (config), 102 (lib64)
  - Dropped patches: 54 (db4 version), 159 (db4 include path adjustment)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.5-1
changelog:
  - Updated to Python 2.7.5.
  - Refreshed patches: 0 (config), 102 (lib64), 121 (add Modules to build path),
  153 (gdb test noise)
  - Dropped patches: 126, 127 (big endian issues, both fixed upstream),
  175 (configure -Wformat, fixed upstream)
  - Synced patch numbers with python3.spec.


author: Matej Stuchlik <mstuchli@redhat.com> - 2.7.5-2
changelog:
  - Pulled patch fixing build with libffi containing multilib wrapper for ffi.h
      from Fedora (rhbz#979696)


author: Matej Stuchlik <mstuchli@redhat.com> - 2.7.5-23
changelog:
  - Fixed CVE-2013-1753, CVE-2013-1752, CVE-2014-4616, CVE-2014-4650, CVE-2014-7185
  Resolves: rhbz#1206574


author: Robert Kuska <rkuska@redhat.com> - 2.7.5-32
changelog:
  - Backport SSLSocket.version function
  - Temporary disable test_gdb on ppc64le rhbz#1260558
  Resolves: rhbz#1259421


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-36
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346356


author: David Woodhouse <dwmw2@infradead.org> 0.7.0-2
changelog:
  - Proper fix for GCC 4 putting 'blr' or 'ret' in the middle of the function,
    for i386, x86_64 and PPC.


author: David Woodhouse <dwmw2@infradead.org> 0.8.0-3
changelog:
  - Use -mcpu= instead of -mtune= on x86_64 too
  - Disable SPARC targets on x86_64, because dyngen doesn't like fnegs


author: Matthias Saou <http://freshrpms.net/> 0.8.2-1
changelog:
  - Update to 0.8.2 (#200065).
  - Drop upstreamed syscall-macros patch2.
  - Put correct scriplet dependencies.
  - Force install mode for the init script to avoid umask problems.
  - Add %postun condrestart for changes to the init script to be applied if any.
  - Update description with the latest "about" from the web page (more current).
  - Update URL to qemu.org one like the Source.
  - Add which build requirement.
  - Don't include texi files in %doc since we ship them in html.
  - Switch to using gcc34 on devel, FC5 still has gcc32.
  - Add kernheaders patch to fix linux/compiler.h inclusion.
  - Add target-sparc patch to fix compiling on ppc (some int32 to float).


author: Matthias Saou <http://freshrpms.net/> 0.8.2-2
changelog:
  - Remove the target-list iteration for x86_64 since they all build again.
  - Make gcc32 vs. gcc34 conditional on %{fedora} to share the same spec for
    FC5 and FC6.


author: Hans de Goede <j.w.r.degoede@hhs.nl> 0.9.0-2
changelog:
  - Fix direct loading of a linux kernel with -kernel & -initrd (bz 234681)
  - Remove spurious execute bits from manpages (bz 222573)


author: Daniel P. Berrange <berrange@redhat.com> - 0.9.0-3.fc8
changelog:
  - Added backport of VNC password auth, and TLS+x509 cert auth
  - Switch to rtl8139 NIC by default for linkstate reporting
  - Fix rtl8139 mmio region mappings with multiple NICs


author: Glauber Costa <glommer@redhat.com> - 1.0-0.1.svn6666
changelog:
  - Updated to tip svn (release 6666). Featuring split packages for qemu.
    Unfortunately, still using binary blobs for the bioses.


author: Glauber Costa <glommer@redhat.com> - 0.10-0.1.kvm20090303git
changelog:
  - Set Epoch to 1
  - Build KVM (basic build, no tools yet)
  - Set ppc in ExcludeArch. This is temporary, just to fix one issue at a time.
    ppc users (IBM ? ;-)) please wait a little bit.


author: Glauber Costa <glommer@redhat.com> - 0.92-0.1.kvm20090303git
changelog:
  - Set Epoch to 2
  - Set version to 0.92. It seems upstream keep changing minds here, so pick the lowest
  - Provides KVM, Obsoletes KVM
  - Only install qemu-kvm in ix86 and x86_64
  - Remove pkgdesc macros, as they were generating bogus output for rpm -qi.
  - fix ppc and ppc64 builds


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.5.kvm20090303git
changelog:
  - kvm.modules were being wrongly mentioned at %install.
  - update description for the x86 system package to include kvm support
  - build kvm's own bios. It is still necessary while kvm uses a slightly different
    irq routing mechanism


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.8.kvm20090310git
changelog:
  - fix Obsolete/Provides pair
  - Use kvm bios from bochs-bios package.
  - Using RPM_OPT_FLAGS in configure
  - Picked back audio-drv-list from kvm package


author: Glauber Costa <glommer@redhat.com> - 2:0.10-0.11.kvm20090323git
changelog:
  - Update to snapshot kvm20090323.
  - Removed patch2 (upstream).
  - use upstream's new split package.
  - --with-patched-kernel flag not needed anymore
  - Tell how to get the sources.


author: Glauber Costa <glommer@redhat.com> - 2:0.10-1
changelog:
  - Include debuginfo for qemu-img
  - Do not require qemu-common for qemu-img
  - Explicitly own each of the firmware files
  - remove firmwares for ppc and sparc. They should be provided by an external package.
    Not that the packages exists for sparc in the secondary arch repo as noarch, but they
    don't automatically get into main repos. Unfortunately it's the best we can do right
    now.
  - rollback a bit in time. Snapshot from avi's maint/2.6.30
    - this requires the sasl patches to come back.
    - with-patched-kernel comes back.


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10-5
changelog:
  - Fix vga segfault under kvm-autotest (#494002)
  - Kill kernelrelease hack; it's not needed
  - Build with "make V=1" for more verbose logs


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-1.kvm85
changelog:
  - Update to qemu-kvm-devel-85
  - kvm-85 is based on qemu development branch, currently version 0.10.50
  - Include new qemu-io utility in qemu-img package
  - Re-instate -help string for boot=on to fix virtio booting with libvirt
  - Drop upstreamed patches
  - Fix missing kernel/include/asm symlink in upstream tarball
  - Fix target-arm build
  - Fix build on ppc
  - Disable preadv()/pwritev() until bug #497429 is fixed
  - Kill more .kernelrelease uselessness
  - Make non-kvm qemu build verbose


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-5.kvm86
changelog:
  - Prevent locked cdrom eject - fixes hang at end of anaconda installs (#501412)
  - Avoid harmless 'unhandled wrmsr' warnings (#499712)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-6.kvm86
changelog:
  - Fix 'kernel requires an x86-64 CPU' error
  - BuildRequires ncurses-devel to enable '-curses' option (#504226)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-7.kvm87
changelog:
  - Update to kvm-87
  - Drop upstreamed patches
  - Cherry-pick new ppc build fix from upstream
  - Work around broken linux-user build on ppc
  - Fix hw/pcspk.c build with --disable-kvm
  - Re-enable preadv()/pwritev() since #497429 is long since fixed
  - Kill petalogix-s3adsp1800.dtb, since we don't ship the microblaze target


author: Daniel Berrange <berrange@lettuce.camlab.fab.redhat.com> - 2:0.10.50-10.kvm87
changelog:
  - Add udev rules to make /dev/kvm world accessible & group=kvm (rhbz #497341)
  - Create a kvm group if it doesn't exist (rhbz #346151)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-11.kvm88
changelog:
  - Update to kvm-88, see http://www.linux-kvm.org/page/ChangeLog
  - Package mutiboot.bin
  - Update for how extboot is built
  - Fix sf.net source URL
  - Drop qemu-fix-ppc-softmmu-kvm-disabled-build.patch
  - Drop qemu-fix-pcspk-build-with-kvm-disabled.patch
  - Cherry-pick fix for esound support build failure


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.1.rc1.rc0
changelog:
  - Update to qemu-kvm-0.11.0-rc1-rc0
  - This is a pre-release of the official -rc1
  - A vista installer regression is blocking the official -rc1 release
  - Drop qemu-prefer-sysfs-for-usb-host-devices.patch
  - Drop qemu-fix-build-for-esd-audio.patch
  - Drop qemu-slirp-Fix-guestfwd-for-incoming-data.patch
  - Add patch to ensure extboot.bin is installed


author: Mark McLoughlin <markmc@redhat.com> - 2:0.10.92-1
changelog:
  - Update to qemu-kvm-0.11.0-rc2
  - Drop upstreamed patches
  - extboot install now fixed upstream
  - Re-place TCG init fix (#516543) with the one gone upstream


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-4
changelog:
  - Use rtl8029 PXE rom for ne2k_pci, not ne (#526777)
  - Also, replace the gpxe-roms-qemu pkg requires with file-based requires


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-6
changelog:
  - Fix fs errors with virtio and qcow2 backing file (#524734)
  - Fix ksm initscript errors on kernel missing ksm (#527653)
  - Add missing Requires(post): getent, useradd, groupadd (#527087)


author: Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-12
changelog:
  - Fix a use-after-free crasher in the slirp code (#539583)
  - Fix overflow in the parallels image format support (#533573)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.2-5
changelog:
  - Avoid creating too large iovecs in multiwrite merge (#559717)
  - Don't try to set max_kernel_pages during ksm init on newer kernels (#558281)
  - Add logfile options for ksmtuned debug.


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-1
changelog:
  - Update to 0.12.3 upstream
  - vhost-net migration/restart fixes
  - Add F-13 machine type
  - virtio-serial fixes


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-6
changelog:
  - Change requires to the noarch seabios-bin
  - Add ownership of docdir to qemu-common (#572110)
  - Fix "Cannot boot from non-existent NIC" error when using virt-install (#577851)


author: Dan Horák <dan[at]danny.cz> - 2:0.12.3-8
changelog:
  - Add avoid-llseek patch from upstream needed for building on s390(x)
  - Don't use parallel make on s390(x)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-0.3.20100809git25fdf4a
changelog:
  - Updates from upstream towards 0.13 stable
  - Fix requires on gpxe
  - enable spice now that buildreqs are in the repository.
  - ksmtrace has moved to a separate upstream package


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.13.0-1
changelog:
  - Update to 0.13.0 upstream release
  - Fixes for vhost
  - Fix mouse in certain guests (#636887)
  - Fix issues with WinXP guest install (#579348)
  - Resolve build issues with S390 (#639471)
  - Fix Windows XP on Raw Devices (#631591)


author: Daniel P. Berrange <berrange@redhat.com> - 2:0.13.0-2
changelog:
  - Revert previous change
  - Make qemu-common own the /etc/qemu directory
  - Add /etc/qemu/target-x86_64.conf to qemu-system-x86 regardless
    of host architecture.


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.14.0-0.1.20110210git7aa8c46
changelog:
  - Update git snapshot
  - Temporarily disable qemu-cris and qemu-sparc due to build errors (to be resolved shorly)


author: Richard W.M. Jones <rjones@redhat.com> - 2:0.14.0-9
changelog:
  - Add BR libattr-devel.  This caused the -fstype option to be disabled.
    https://www.redhat.com/archives/libvir-list/2011-June/thread.html#01017


author: Hans de Goede <hdegoede@redhat.com> - 2:0.15.0-0.2.20110718525e3df
changelog:
  - Add support usb redirection over the network, see:
    http://fedoraproject.org/wiki/Features/UsbNetworkRedirection
  - Restore chardev flow control patches


author: Richard W.M. Jones <rjones@redhat.com> - 2:0.15.0-2
changelog:
  - Add upstream qemu patch 'Allow to leave type on default in -machine'
    (2645c6dcaf6ea2a51a3b6dfa407dd203004e4d11).


author: Daniel P. Berrange <berrange@redhat.com> - 2:0.15.0-4
changelog:
  - Enable DTrace tracing backend for SystemTAP (rhbz #737763)
  - Enable build with curl (rhbz #737006)


author: Justin M. Forbes <jforbes@redhat.com> - 2:0.15.1-1
changelog:
  - Require seabios-bin >= 0.6.0-2 (#741992)
  - Replace init scripts with systemd units (#741920)
  - Update to 0.15.1 stable upstream


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-4
changelog:
  - Disable tests since they hang intermittently.
  - Add kvmvapic.bin (replaces vapic.bin).
  - Add cpus-x86_64.conf.  qemu now creates /etc/qemu/target-x86_64.conf
    as an empty file.
  - Add qemu-icon.bmp.
  - Add qemu-bridge-helper.
  - Build and include virtfs-proxy-helper + man page (thanks Hans de Goede).


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.1.0-7
changelog:
  - Add patch to fix default machine options.  This fixes libvirt
    detection of qemu.
  - Back out patch 1 which conflicts.


author: Cole Robinson <crobinso@redhat.com> - 1.1.1-1
changelog:
  - Upstream stable release 1.1.1
  - Fix systemtap tapsets (bz 831763)
  - Fix VNC audio tunnelling (bz 840653)
  - Don't renable ksm on update (bz 815156)
  - Bump usbredir dep (bz 812097)
  - Fix RPM install error on non-virt machines (bz 660629)
  - Obsolete openbios to fix upgrade dependency issues (bz 694802)


author: Adam Jackson <ajax@redhat.com> 1.2.0-0.5.rc1
changelog:
  - Flip Requires: ceph >= foo to Conflicts: ceph < foo, so we pull in only the
    libraries which we need and not the rest of ceph which we don't.


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-1
changelog:
  - New upstream release 1.2.0 final
  - Add support for Spice seamless migration
  - Add support for Spice dynamic monitors
  - Add support for usb-redir live migration


author: Richard W.M. Jones <rjones@redhat.com> - 2:1.2.0-8
changelog:
  - Use 'global' instead of 'define', and underscore in definition name,
    n-v-r, and 'dist' tag of SLOF, all to fix RHBZ#855252.


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-11
changelog:
  - Rebuild against latest spice-server and spice-protocol
  - Fix non-seamless migration failing with vms with usb-redir devices,
    to allow boxes to load such vms from disk


author: Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-13
changelog:
  - Add ppc support to kvm.modules (original patch by David Gibson)
  - Replace x86only build with kvmonly build: add separate defines and
    conditionals for all packages, so that they can be chosen and
    renamed in kvmonly builds and so that qemu has the appropriate requires
  - Automatically pick libfdt dependancy
  - Add knob to disable spice+seccomp


author: Paolo Bonzini <pbonzini@redhat.com> - 2:1.2.0-16
changelog:
  - add s390x KVM support
  - distribute pre-built firmware or device trees for Alpha, Microblaze, S390
  - add missing system targets
  - add missing linux-user targets
  - fix previous commit


author: Cole Robinson <crobinso@redhat.com> - 2:1.2.0-18
changelog:
  - Fix loading arm initrd if kernel is very large (bz #862766)
  - Don't use reserved word 'function' in systemtap files (bz #870972)
  - Drop assertion that was triggering when pausing guests w/ qxl (bz


author: Hans de Goede <hdegoede@redhat.com> - 2:1.2.0-19
changelog:
  - Sync spice patches with upstream, minor bugfixes and set the qxl pci
    device revision to 4 by default, so that guests know they can use
    the new features


author: Cole Robinson <crobinso@redhat.com> - 2:1.3.0-1
changelog:
  - Switch base tarball from qemu-kvm to qemu
  - qemu 1.3 release
  - Option to use linux VFIO driver to assign PCI devices
  - Many USB3 improvements
  - New paravirtualized hardware random number generator device.
  - Support for Glusterfs volumes with "gluster://" -drive URI
  - Block job commands for live block commit and storage migration


author: Michal Novotny <minovotn@redhat.com> - 2:1.3.0-3
changelog:
  - Remove dependency on bogus qemu-kvm-kvm package [bz#870343]
  - Resolves: bz#870343
    (qemu-kvm-1.2.0-16.el7 cant be installed)


author: Michal Novotny <minovotn@redhat.com> - 2:1.3.0-5
changelog:
  - Fix patch contents for usb-redir (bz#895491)
  - Resolves: bz#895491
    (PATCH: 0110-usb-redir-Add-flow-control-support.patch has been mangled on rebase !!)


author: Alon Levy <alevy@redhat.com> - 3:1.3.0-6
changelog:
  - Bump epoch back to 3 since there has already been a 3 package release:
    3:1.2.0-20.el7 https://brewweb.devel.redhat.com/buildinfo?buildID=244866
  - Mark explicit libcacard dependency on new enough qemu-img to avoid conflict
    since /usr/bin/vscclient was moved from qemu-img to libcacard subpackage.


author: Michal Novotny <minovotn@redhat.com> - 3:1.3.0-8
changelog:
  - Missing package qemu-system-x86 in hardware certification kvm testing (bz#912433)
  - Resolves: bz#912433
    (Missing package qemu-system-x86 in hardware certification kvm testing)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3:1.4.0-4
changelog:
  - Enable build of libcacard subpackage for non-x86_64 archs (bz #873174)
  - Enable build of qemu-img subpackage for non-x86_64 archs (bz #873174)
  - Enable build of qemu-guest-agent subpackage for non-x86_64 archs (bz #873174)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3:1.5.0-2
changelog:
  - Enable werror (bz #948290)
  - Enable nbd driver (bz #875871)
  - Fix udev rules file location (bz #958860)
  - Remove +x bit from systemd unit files (bz #965000)
  - Drop unneeded kvm.modules on x86 (bz #963642)
  - Fix build flags
  - Enable libusb


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.1-2
changelog:
  - Fix package package version info (bz #952996)
  - pc: Replace upstream machine types by RHEL-7 types (bz #977864)
  - target-i386: Update model values on Conroe/Penryn/Nehalem CPU model (bz #861210)
  - target-i386: Set level=4 on Conroe/Penryn/Nehalem (bz #861210)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-2
changelog:
  - SPEC file prepared for RHEL/RHEV split (rhbz #987165)
  - RHEL guest( sata disk ) can not boot up (rhbz #981723)
  - Kill the "use flash device for BIOS unless KVM" misfeature (rhbz #963280)
  - Provide RHEL-6 machine types (rhbz #983991)
  - Change s3/s4 default to "disable". (rhbz #980840)  
  - Support Virtual Memory Disk Format in qemu (rhbz #836675)
  - Glusterfs backend for QEMU (rhbz #805139)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-3
changelog:
  - query mem info from monitor would cause qemu-kvm hang [RHEL-7] (rhbz #970047)
  - Throttle-down guest to help with live migration convergence (backport to RHEL7.0) (rhbz #985958)
  - disable (for now) EFI-enabled roms (rhbz #962563)
  - qemu-kvm "vPMU passthrough" mode breaks migration, shouldn't be enabled by default (rhbz #853101)
  - Remove pending watches after virtserialport unplug (rhbz #992900)
  - Containment of error when an SR-IOV device encounters an error... (rhbz #984604)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10:1.5.2-4
changelog:
  - qemu: guest agent creates files with insecure permissions in deamon mode [rhel-7.0] (rhbz 974444)
  - update qemu-ga config & init script in RHEL7 wrt. fsfreeze hook (rhbz 969942)
  - RHEL7 does not have equivalent functionality for __com.redhat_qxl_screendump (rhbz 903910)
  - SEP flag behavior for CPU models of RHEL6 machine types should be compatible (rhbz 960216)
  - crash command can not read the dump-guest-memory file when paging=false [RHEL-7] (rhbz 981582)
  - RHEL 7 qemu-kvm fails to build on F19 host due to libusb deprecated API (rhbz 996469)
  - Live migration support in virtio-blk-data-plane (rhbz 995030)
  - qemu-img resize can execute successfully even input invalid syntax (rhbz 992935)


author: Miroslav Rezanina <mrezanin@redhat.com> - qemu-kvm-1.5.3-2.el7
changelog:
  - kvm-osdep-add-qemu_get_local_state_pathname.patch [bz#964304]
  - kvm-qga-determine-default-state-dir-and-pidfile-dynamica.patch [bz#964304]
  - kvm-configure-don-t-save-any-fixed-local_statedir-for-wi.patch [bz#964304]
  - kvm-qga-create-state-directory-on-win32.patch [bz#964304]
  - kvm-qga-save-state-directory-in-ga_install_service-RHEL-.patch [bz#964304]
  - kvm-Makefile-create-.-var-run-when-installing-the-POSIX-.patch [bz#964304]
  - kvm-qemu-option-Fix-qemu_opts_find-for-null-id-arguments.patch [bz#980782]
  - kvm-qemu-option-Fix-qemu_opts_set_defaults-for-corner-ca.patch [bz#980782]
  - kvm-vl-New-qemu_get_machine_opts.patch [bz#980782]
  - kvm-Fix-machine-options-accel-kernel_irqchip-kvm_shadow_.patch [bz#980782]
  - kvm-microblaze-Fix-latent-bug-with-default-DTB-lookup.patch [bz#980782]
  - kvm-Simplify-machine-option-queries-with-qemu_get_machin.patch [bz#980782]
  - kvm-pci-add-VMSTATE_MSIX.patch [bz#838170]
  - kvm-xhci-add-XHCISlot-addressed.patch [bz#838170]
  - kvm-xhci-add-xhci_alloc_epctx.patch [bz#838170]
  - kvm-xhci-add-xhci_init_epctx.patch [bz#838170]
  - kvm-xhci-add-live-migration-support.patch [bz#838170]
  - kvm-pc-set-level-xlevel-correctly-on-486-qemu32-CPU-mode.patch [bz#918907]
  - kvm-pc-Remove-incorrect-rhel6.x-compat-model-value-for-C.patch [bz#918907]
  - kvm-pc-rhel6.x-has-x2apic-present-on-Conroe-Penryn-Nehal.patch [bz#918907]
  - kvm-pc-set-compat-CPUID-0x80000001-.EDX-bits-on-Westmere.patch [bz#918907]
  - kvm-pc-Remove-PCLMULQDQ-from-Westmere-on-rhel6.x-machine.patch [bz#918907]
  - kvm-pc-SandyBridge-rhel6.x-compat-fixes.patch [bz#918907]
  - kvm-pc-Haswell-doesn-t-have-rdtscp-on-rhel6.x.patch [bz#918907]
  - kvm-i386-fix-LAPIC-TSC-deadline-timer-save-restore.patch [bz#972433]
  - kvm-all.c-max_cpus-should-not-exceed-KVM-vcpu-limit.patch [bz#996258]
  - kvm-add-timestamp-to-error_report.patch [bz#906937]
  - kvm-Convert-stderr-message-calling-error_get_pretty-to-e.patch [bz#906937]
  - Resolves: bz#838170
    (Add live migration support for USB [xhci, usb-uas])
  - Resolves: bz#906937
    ([Hitachi 7.0 FEAT][QEMU]Add a time stamp to error message (*))
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#964304
    (Windows guest agent service failed to be started)
  - Resolves: bz#972433
    ("INFO: rcu_sched detected stalls" after RHEL7 kvm vm migrated)
  - Resolves: bz#980782
    (kernel_irqchip defaults to off instead of on without -machine)
  - Resolves: bz#996258
    (boot guest with maxcpu=255 successfully but actually max number of vcpu is 160)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-1.5.3-4.el7
changelog:
  - kvm-block-package-preparation-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-move-input-parsing-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-package-committing-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-package-rollback-code-in-qmp_transaction.patch [bz#1005818]
  - kvm-block-make-all-steps-in-qmp_transaction-as-callback.patch [bz#1005818]
  - kvm-blockdev-drop-redundant-proto_drv-check.patch [bz#1005818]
  - kvm-block-Don-t-parse-protocol-from-file.filename.patch [bz#1005818]
  - kvm-Revert-block-Disable-driver-specific-options-for-1.5.patch [bz#1005818]
  - kvm-qcow2-Add-refcount-update-reason-to-all-callers.patch [bz#1005818]
  - kvm-qcow2-Options-to-enable-discard-for-freed-clusters.patch [bz#1005818]
  - kvm-qcow2-Batch-discards.patch [bz#1005818]
  - kvm-block-Always-enable-discard-on-the-protocol-level.patch [bz#1005818]
  - kvm-qapi.py-Avoid-code-duplication.patch [bz#1005818]
  - kvm-qapi.py-Allow-top-level-type-reference-for-command-d.patch [bz#1005818]
  - kvm-qapi-schema-Use-BlockdevSnapshot-type-for-blockdev-s.patch [bz#1005818]
  - kvm-qapi-types.py-Implement-base-for-unions.patch [bz#1005818]
  - kvm-qapi-visit.py-Split-off-generate_visit_struct_fields.patch [bz#1005818]
  - kvm-qapi-visit.py-Implement-base-for-unions.patch [bz#1005818]
  - kvm-docs-Document-QAPI-union-types.patch [bz#1005818]
  - kvm-qapi-Add-visitor-for-implicit-structs.patch [bz#1005818]
  - kvm-qapi-Flat-unions-with-arbitrary-discriminator.patch [bz#1005818]
  - kvm-qapi-Add-consume-argument-to-qmp_input_get_object.patch [bz#1005818]
  - kvm-qapi.py-Maintain-a-list-of-union-types.patch [bz#1005818]
  - kvm-qapi-qapi-types.py-native-list-support.patch [bz#1005818]
  - kvm-qapi-Anonymous-unions.patch [bz#1005818]
  - kvm-block-Allow-driver-option-on-the-top-level.patch [bz#1005818]
  - kvm-QemuOpts-Add-qemu_opt_unset.patch [bz#1005818]
  - kvm-blockdev-Rename-I-O-throttling-options-for-QMP.patch [bz#1005818]
  - kvm-qemu-iotests-Update-051-reference-output.patch [bz#1005818]
  - kvm-blockdev-Rename-readonly-option-to-read-only.patch [bz#1005818]
  - kvm-blockdev-Split-up-cache-option.patch [bz#1005818]
  - kvm-qcow2-Use-dashes-instead-of-underscores-in-options.patch [bz#1005818]
  - kvm-qemu-iotests-filter-QEMU-version-in-monitor-banner.patch [bz#1006959]
  - kvm-tests-set-MALLOC_PERTURB_-to-expose-memory-bugs.patch [bz#1006959]
  - kvm-qemu-iotests-Whitespace-cleanup.patch [bz#1006959]
  - kvm-qemu-iotests-Fixed-test-case-026.patch [bz#1006959]
  - kvm-qemu-iotests-Fix-test-038.patch [bz#1006959]
  - kvm-qemu-iotests-Remove-lsi53c895a-tests-from-051.patch [bz#1006959]
  - Resolves: bz#1005818
    (qcow2: Backport discard command line options)
  - Resolves: bz#1006959
    (qemu-iotests false positives)


author: Miroslav Rezanina <mrezanin@redhat.com> - qemu-kvm-1.5.3-7.el7
changelog:
  - kvm-spice-fix-display-initialization.patch [bz#974887]
  - kvm-Remove-i82550-network-card-emulation.patch [bz#921983]
  - kvm-Remove-usb-wacom-tablet.patch [bz#903914]
  - kvm-Disable-usb-uas.patch [bz#903914]
  - kvm-Disable-vhost-scsi.patch [bz#994642]
  - kvm-Remove-no-hpet-option.patch [bz#947441]
  - kvm-Disable-isa-parallel.patch [bz#1002286]
  - kvm-xhci-implement-warm-port-reset.patch [bz#949514]
  - kvm-usb-add-serial-bus-property.patch [bz#953304]
  - kvm-rhel6-compat-usb-serial-numbers.patch [bz#953304]
  - kvm-vmdk-fix-comment-for-vmdk_co_write_zeroes.patch [bz#995866]
  - kvm-gluster-Add-image-resize-support.patch [bz#1007226]
  - kvm-block-Introduce-bs-zero_beyond_eof.patch [bz#1007226]
  - kvm-block-Produce-zeros-when-protocols-reading-beyond-en.patch [bz#1007226]
  - kvm-gluster-Abort-on-AIO-completion-failure.patch [bz#1007226]
  - kvm-Preparation-for-usb-bt-dongle-conditional-build.patch [bz#1001131]
  - kvm-Remove-dev-bluetooth.c-dependency-from-vl.c.patch [bz#1001131]
  - kvm-exec-Fix-Xen-RAM-allocation-with-unusual-options.patch [bz#1009328]
  - kvm-exec-Clean-up-fall-back-when-mem-path-allocation-fai.patch [bz#1009328]
  - kvm-exec-Reduce-ifdeffery-around-mem-path.patch [bz#1009328]
  - kvm-exec-Simplify-the-guest-physical-memory-allocation-h.patch [bz#1009328]
  - kvm-exec-Drop-incorrect-dead-S390-code-in-qemu_ram_remap.patch [bz#1009328]
  - kvm-exec-Clean-up-unnecessary-S390-ifdeffery.patch [bz#1009328]
  - kvm-exec-Don-t-abort-when-we-can-t-allocate-guest-memory.patch [bz#1009328]
  - kvm-pc_sysfw-Fix-ISA-BIOS-init-for-ridiculously-big-flas.patch [bz#1009328]
  - kvm-virtio-scsi-Make-type-virtio-scsi-common-abstract.patch [bz#903918]
  - kvm-qga-move-logfiles-to-new-directory-for-easier-SELinu.patch [bz#1009491]
  - kvm-target-i386-add-cpu64-rhel6-CPU-model.patch [bz#918907]
  - kvm-fix-steal-time-MSR-vmsd-callback-to-proper-opaque-ty.patch [bz#903889]
  - Resolves: bz#1001131
    (Disable or remove device usb-bt-dongle)
  - Resolves: bz#1002286
    (Disable or remove device isa-parallel)
  - Resolves: bz#1007226
    (Introduce bs->zero_beyond_eof)
  - Resolves: bz#1009328
    ([RFE] Nicer error report when qemu-kvm can't allocate guest RAM)
  - Resolves: bz#1009491
    (move qga logfiles to new /var/log/qemu-ga/ directory [RHEL-7])
  - Resolves: bz#903889
    (The value of steal time in "top" command always is "0.0% st" after guest migration)
  - Resolves: bz#903914
    (Disable or remove usb related devices that we will not support)
  - Resolves: bz#903918
    (Disable or remove emulated SCSI devices we will not support)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#921983
    (Disable or remove emulated network devices that we will not support)
  - Resolves: bz#947441
    (HPET device must be disabled)
  - Resolves: bz#949514
    (fail to passthrough the USB3.0 stick to windows guest with xHCI controller under pc-i440fx-1.4)
  - Resolves: bz#953304
    (Serial number of some USB devices must be fixed for older RHEL machine types)
  - Resolves: bz#974887
    (the screen of guest fail to display correctly when use spice + qxl driver)
  - Resolves: bz#994642
    (should disable vhost-scsi)
  - Resolves: bz#995866
    (fix vmdk support to ESX images)


author: Miroslav Rezanina <mrezanin@redhat.com> - qemu-kvm-1.5.3-8.el7
changelog:
  - kvm-vmdk-Make-VMDK3Header-and-VmdkGrainMarker-QEMU_PACKE.patch [bz#995866]
  - kvm-vmdk-use-unsigned-values-for-on-disk-header-fields.patch [bz#995866]
  - kvm-qemu-iotests-add-poke_file-utility-function.patch [bz#995866]
  - kvm-qemu-iotests-add-empty-test-case-for-vmdk.patch [bz#995866]
  - kvm-vmdk-check-granularity-field-in-opening.patch [bz#995866]
  - kvm-vmdk-check-l2-table-size-when-opening.patch [bz#995866]
  - kvm-vmdk-check-l1-size-before-opening-image.patch [bz#995866]
  - kvm-vmdk-use-heap-allocation-for-whole_grain.patch [bz#995866]
  - kvm-vmdk-rename-num_gtes_per_gte-to-num_gtes_per_gt.patch [bz#995866]
  - kvm-vmdk-Move-l1_size-check-into-vmdk_add_extent.patch [bz#995866]
  - kvm-vmdk-fix-L1-and-L2-table-size-in-vmdk3-open.patch [bz#995866]
  - kvm-vmdk-support-vmfsSparse-files.patch [bz#995866]
  - kvm-vmdk-support-vmfs-files.patch [bz#995866]
  - Resolves: bz#995866
    (fix vmdk support to ESX images)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-9.el7
changelog:
  - kvm-qxl-fix-local-renderer.patch [bz#1005036]
  - kvm-spec-include-userspace-iSCSI-initiator-in-block-driv.patch [bz#923843]
  - kvm-linux-headers-update-to-kernel-3.10.0-26.el7.patch [bz#1008987]
  - kvm-target-i386-add-feature-kvm_pv_unhalt.patch [bz#1008987]
  - kvm-warn-if-num-cpus-is-greater-than-num-recommended.patch [bz#1010881]
  - kvm-char-move-backends-io-watch-tag-to-CharDriverState.patch [bz#1007222]
  - kvm-char-use-common-function-to-disable-callbacks-on-cha.patch [bz#1007222]
  - kvm-char-remove-watch-callback-on-chardev-detach-from-fr.patch [bz#1007222]
  - kvm-block-don-t-lose-data-from-last-incomplete-sector.patch [bz#1017049]
  - kvm-vmdk-fix-cluster-size-check-for-flat-extents.patch [bz#1017049]
  - kvm-qemu-iotests-add-monolithicFlat-creation-test-to-059.patch [bz#1017049]
  - Resolves: bz#1005036
    (When using “-vga qxl” together with “-display vnc=:5” or “-display  sdl” qemu displays  pixel garbage)
  - Resolves: bz#1007222
    (QEMU core dumped when do hot-unplug virtio serial port during transfer file between host to guest with virtio serial through TCP socket)
  - Resolves: bz#1008987
    (pvticketlocks: add kvm feature kvm_pv_unhalt)
  - Resolves: bz#1010881
    (backport vcpu soft limit warning)
  - Resolves: bz#1017049
    (qemu-img refuses to open the vmdk format image its created)
  - Resolves: bz#923843
    (include userspace iSCSI initiator in block driver whitelist)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-10.el7
changelog:
  - kvm-xhci-fix-endpoint-interval-calculation.patch [bz#1001604]
  - kvm-xhci-emulate-intr-endpoint-intervals-correctly.patch [bz#1001604]
  - kvm-xhci-reset-port-when-disabling-slot.patch [bz#1001604]
  - kvm-Revert-usb-hub-report-status-changes-only-once.patch [bz#1001604]
  - kvm-target-i386-Set-model-6-on-qemu64-qemu32-CPU-models.patch [bz#1004290]
  - kvm-pc-rhel6-doesn-t-have-APIC-on-pentium-CPU-models.patch [bz#918907]
  - kvm-pc-RHEL-6-had-x2apic-set-on-Opteron_G-123.patch [bz#918907]
  - kvm-pc-RHEL-6-don-t-have-RDTSCP.patch [bz#918907]
  - kvm-scsi-Fix-scsi_bus_legacy_add_drive-scsi-generic-with.patch [bz#1009285]
  - kvm-seccomp-fine-tuning-whitelist-by-adding-times.patch [bz#1004175]
  - kvm-block-add-bdrv_write_zeroes.patch [bz#921465]
  - kvm-block-raw-add-bdrv_co_write_zeroes.patch [bz#921465]
  - kvm-rdma-export-qemu_fflush.patch [bz#921465]
  - kvm-block-migration-efficiently-encode-zero-blocks.patch [bz#921465]
  - kvm-Fix-real-mode-guest-migration.patch [bz#921465]
  - kvm-Fix-real-mode-guest-segments-dpl-value-in-savevm.patch [bz#921465]
  - kvm-migration-add-autoconvergence-documentation.patch [bz#921465]
  - kvm-migration-send-total-time-in-QMP-at-completed-stage.patch [bz#921465]
  - kvm-migration-don-t-use-uninitialized-variables.patch [bz#921465]
  - kvm-pc-drop-external-DSDT-loading.patch [bz#921465]
  - kvm-hda-codec-refactor-common-definitions-into-a-header-.patch [bz#954195]
  - kvm-hda-codec-make-mixemu-selectable-at-runtime.patch [bz#954195]
  - kvm-audio-remove-CONFIG_MIXEMU-configure-option.patch [bz#954195]
  - kvm-pc_piix-disable-mixer-for-6.4.0-machine-types-and-be.patch [bz#954195]
  - kvm-spec-mixemu-config-option-is-no-longer-supported-and.patch [bz#954195]
  - Resolves: bz#1001604
    (usb hub doesn't work properly (win7 sees downstream port #1 only).)
  - Resolves: bz#1004175
    ('-sandbox on'  option  cause  qemu-kvm process hang)
  - Resolves: bz#1004290
    (Use model 6 for qemu64 and intel cpus)
  - Resolves: bz#1009285
    (-device usb-storage,serial=... crashes with SCSI generic drive)
  - Resolves: bz#918907
    (provide backwards-compatible RHEL specific machine types in QEMU - CPU features)
  - Resolves: bz#921465
    (Migration can not finished even the "remaining ram" is already 0 kb)
  - Resolves: bz#954195
    (RHEL machines <=6.4 should not use mixemu)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-11.el7
changelog:
  - kvm-chardev-fix-pty_chr_timer.patch [bz#994414]
  - kvm-qemu-socket-zero-initialize-SocketAddress.patch [bz#922010]
  - kvm-qemu-socket-drop-pointless-allocation.patch [bz#922010]
  - kvm-qemu-socket-catch-monitor_get_fd-failures.patch [bz#922010]
  - kvm-qemu-char-check-optional-fields-using-has_.patch [bz#922010]
  - kvm-error-add-error_setg_file_open-helper.patch [bz#922010]
  - kvm-qemu-char-use-more-specific-error_setg_-variants.patch [bz#922010]
  - kvm-qemu-char-print-notification-to-stderr.patch [bz#922010]
  - kvm-qemu-char-fix-documentation-for-telnet-wait-socket-f.patch [bz#922010]
  - kvm-qemu-char-don-t-leak-opts-on-error.patch [bz#922010]
  - kvm-qemu-char-use-ChardevBackendKind-in-CharDriver.patch [bz#922010]
  - kvm-qemu-char-minor-mux-chardev-fixes.patch [bz#922010]
  - kvm-qemu-char-add-chardev-mux-support.patch [bz#922010]
  - kvm-qemu-char-report-udp-backend-errors.patch [bz#922010]
  - kvm-qemu-socket-don-t-leak-opts-on-error.patch [bz#922010]
  - kvm-chardev-handle-qmp_chardev_add-KIND_MUX-failure.patch [bz#922010]
  - kvm-acpi-piix4-Enable-qemu-kvm-compatibility-mode.patch [bz#1019474]
  - kvm-target-i386-support-loading-of-cpu-xsave-subsection.patch [bz#1004743]
  - Resolves: bz#1004743
    (XSAVE migration format not compatible between RHEL6 and RHEL7)
  - Resolves: bz#1019474
    (RHEL-7 can't load piix4_pm migration section from RHEL-6.5)
  - Resolves: bz#922010
    (RFE: support hotplugging chardev & serial ports)
  - Resolves: bz#994414
    (hot-unplug chardev with pty backend caused qemu Segmentation fault)


author: Michal Novotny <minovotn@redhat.com> - 1.5.3-12.el7
changelog:
  - kvm-vl-Clean-up-parsing-of-boot-option-argument.patch [bz#997817]
  - kvm-qemu-option-check_params-is-now-unused-drop-it.patch [bz#997817]
  - kvm-vl-Fix-boot-order-and-once-regressions-and-related-b.patch [bz#997817]
  - kvm-vl-Rename-boot_devices-to-boot_order-for-consistency.patch [bz#997817]
  - kvm-pc-Make-no-fd-bootchk-stick-across-boot-order-change.patch [bz#997817]
  - kvm-doc-Drop-ref-to-Bochs-from-no-fd-bootchk-documentati.patch [bz#997817]
  - kvm-libqtest-Plug-fd-and-memory-leaks-in-qtest_quit.patch [bz#997817]
  - kvm-libqtest-New-qtest_end-to-go-with-qtest_start.patch [bz#997817]
  - kvm-qtest-Don-t-reset-on-qtest-chardev-connect.patch [bz#997817]
  - kvm-boot-order-test-New-covering-just-PC-for-now.patch [bz#997817]
  - kvm-qemu-ga-execute-fsfreeze-freeze-in-reverse-order-of-.patch [bz#1019352]
  - kvm-rbd-link-and-load-librbd-dynamically.patch [bz#989608]
  - kvm-rbd-Only-look-for-qemu-specific-copy-of-librbd.so.1.patch [bz#989608]
  - kvm-spec-Whitelist-rbd-block-driver.patch [bz#989608]
  - Resolves: bz#1019352
    (qemu-guest-agent: "guest-fsfreeze-freeze" deadlocks if the guest have mounted disk images)
  - Resolves: bz#989608
    ([7.0 FEAT] qemu runtime support for librbd backend (ceph))
  - Resolves: bz#997817
    (-boot order and -boot once regressed since RHEL-6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-13.el7
changelog:
  - kvm-seabios-paravirt-allow-more-than-1TB-in-x86-guest.patch [bz#989677]
  - kvm-scsi-prefer-UUID-to-VM-name-for-the-initiator-name.patch [bz#1006468]
  - kvm-Fix-incorrect-rhel_rhev_conflicts-macro-usage.patch [bz#1017693]
  - Resolves: bz#1006468
    (libiscsi initiator name should use vm UUID)
  - Resolves: bz#1017693
    (incorrect use of rhel_rhev_conflicts)
  - Resolves: bz#989677
    ([HP 7.0 FEAT]: Increase KVM guest supported memory to 4TiB)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-14.el7
changelog:
  - kvm-target-i386-remove-tabs-from-target-i386-cpu.h.patch [bz#928867]
  - kvm-migrate-vPMU-state.patch [bz#928867]
  - kvm-blockdev-do-not-default-cache.no-flush-to-true.patch [bz#1009993]
  - kvm-virtio-blk-do-not-relay-a-previous-driver-s-WCE-conf.patch [bz#1009993]
  - kvm-rng-random-use-error_setg_file_open.patch [bz#907743]
  - kvm-block-mirror_complete-use-error_setg_file_open.patch [bz#907743]
  - kvm-blockdev-use-error_setg_file_open.patch [bz#907743]
  - kvm-cpus-use-error_setg_file_open.patch [bz#907743]
  - kvm-dump-qmp_dump_guest_memory-use-error_setg_file_open.patch [bz#907743]
  - kvm-savevm-qmp_xen_save_devices_state-use-error_setg_fil.patch [bz#907743]
  - kvm-block-bdrv_reopen_prepare-don-t-use-QERR_OPEN_FILE_F.patch [bz#907743]
  - kvm-qerror-drop-QERR_OPEN_FILE_FAILED-macro.patch [bz#907743]
  - kvm-rhel-Drop-ivshmem-device.patch [bz#787463]
  - kvm-usb-remove-old-usb-host-code.patch [bz#1001144]
  - kvm-Add-rhel6-pxe-roms-files.patch [bz#997702]
  - kvm-Add-rhel6-pxe-rom-to-redhat-rpm.patch [bz#997702]
  - kvm-Fix-migration-from-rhel6.5-to-rhel7-with-ipxe.patch [bz#997702]
  - kvm-pc-Don-t-prematurely-explode-QEMUMachineInitArgs.patch [bz#994490]
  - kvm-pc-Don-t-explode-QEMUMachineInitArgs-into-local-vari.patch [bz#994490]
  - kvm-smbios-Normalize-smbios_entry_add-s-error-handling-t.patch [bz#994490]
  - kvm-smbios-Convert-to-QemuOpts.patch [bz#994490]
  - kvm-smbios-Improve-diagnostics-for-conflicting-entries.patch [bz#994490]
  - kvm-smbios-Make-multiple-smbios-type-accumulate-sanely.patch [bz#994490]
  - kvm-smbios-Factor-out-smbios_maybe_add_str.patch [bz#994490]
  - kvm-hw-Pass-QEMUMachine-to-its-init-method.patch [bz#994490]
  - kvm-smbios-Set-system-manufacturer-product-version-by-de.patch [bz#994490]
  - kvm-smbios-Decouple-system-product-from-QEMUMachine.patch [bz#994490]
  - kvm-rhel-SMBIOS-type-1-branding.patch [bz#994490]
  - kvm-Add-disable-rhev-features-option-to-configure.patch []
  - Resolves: bz#1001144
    (Disable or remove device usb-host-linux)
  - Resolves: bz#1009993
    (RHEL7 guests do not issue fdatasyncs on virtio-blk)
  - Resolves: bz#787463
    (disable ivshmem (was: [Hitachi 7.0 FEAT] Support ivshmem (Inter-VM Shared Memory)))
  - Resolves: bz#907743
    (qemu-ga: empty reason string for OpenFileFailed error)
  - Resolves: bz#928867
    (Virtual PMU support during live migration - qemu-kvm)
  - Resolves: bz#994490
    (Set per-machine-type SMBIOS strings)
  - Resolves: bz#997702
    (Migration from RHEL6.5 host to RHEL7.0 host is failed with virtio-net device)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-15.el7
changelog:
  - kvm-cow-make-reads-go-at-a-decent-speed.patch [bz#989646]
  - kvm-cow-make-writes-go-at-a-less-indecent-speed.patch [bz#989646]
  - kvm-cow-do-not-call-bdrv_co_is_allocated.patch [bz#989646]
  - kvm-block-keep-bs-total_sectors-up-to-date-even-for-grow.patch [bz#989646]
  - kvm-block-make-bdrv_co_is_allocated-static.patch [bz#989646]
  - kvm-block-do-not-use-total_sectors-in-bdrv_co_is_allocat.patch [bz#989646]
  - kvm-block-remove-bdrv_is_allocated_above-bdrv_co_is_allo.patch [bz#989646]
  - kvm-block-expect-errors-from-bdrv_co_is_allocated.patch [bz#989646]
  - kvm-block-Fix-compiler-warning-Werror-uninitialized.patch [bz#989646]
  - kvm-qemu-img-always-probe-the-input-image-for-allocated-.patch [bz#989646]
  - kvm-block-make-bdrv_has_zero_init-return-false-for-copy-.patch [bz#989646]
  - kvm-block-introduce-bdrv_get_block_status-API.patch [bz#989646]
  - kvm-block-define-get_block_status-return-value.patch [bz#989646]
  - kvm-block-return-get_block_status-data-and-flags-for-for.patch [bz#989646]
  - kvm-block-use-bdrv_has_zero_init-to-return-BDRV_BLOCK_ZE.patch [bz#989646]
  - kvm-block-return-BDRV_BLOCK_ZERO-past-end-of-backing-fil.patch [bz#989646]
  - kvm-qemu-img-add-a-map-subcommand.patch [bz#989646]
  - kvm-docs-qapi-document-qemu-img-map.patch [bz#989646]
  - kvm-raw-posix-return-get_block_status-data-and-flags.patch [bz#989646]
  - kvm-raw-posix-report-unwritten-extents-as-zero.patch [bz#989646]
  - kvm-block-add-default-get_block_status-implementation-fo.patch [bz#989646]
  - kvm-block-look-for-zero-blocks-in-bs-file.patch [bz#989646]
  - kvm-qemu-img-fix-invalid-JSON.patch [bz#989646]
  - kvm-block-get_block_status-set-pnum-0-on-error.patch [bz#989646]
  - kvm-block-get_block_status-avoid-segfault-if-there-is-no.patch [bz#989646]
  - kvm-block-get_block_status-avoid-redundant-callouts-on-r.patch [bz#989646]
  - kvm-qcow2-Restore-total_sectors-value-in-save_vmstate.patch [bz#1025740]
  - kvm-qcow2-Unset-zero_beyond_eof-in-save_vmstate.patch [bz#1025740]
  - kvm-qemu-iotests-Test-for-loading-VM-state-from-qcow2.patch [bz#1025740]
  - kvm-apic-rename-apic-specific-bitopts.patch [bz#1001216]
  - kvm-hw-import-bitmap-operations-in-qdev-core-header.patch [bz#1001216]
  - kvm-qemu-help-Sort-devices-by-logical-functionality.patch [bz#1001216]
  - kvm-devices-Associate-devices-to-their-logical-category.patch [bz#1001216]
  - kvm-Mostly-revert-qemu-help-Sort-devices-by-logical-func.patch [bz#1001216]
  - kvm-qdev-monitor-Group-device_add-help-and-info-qdm-by-c.patch [bz#1001216]
  - kvm-qdev-Replace-no_user-by-cannot_instantiate_with_devi.patch [bz#1001216]
  - kvm-sysbus-Set-cannot_instantiate_with_device_add_yet.patch [bz#1001216]
  - kvm-cpu-Document-why-cannot_instantiate_with_device_add_.patch [bz#1001216]
  - kvm-apic-Document-why-cannot_instantiate_with_device_add.patch [bz#1001216]
  - kvm-pci-host-Consistently-set-cannot_instantiate_with_de.patch [bz#1001216]
  - kvm-ich9-Document-why-cannot_instantiate_with_device_add.patch [bz#1001216]
  - kvm-piix3-piix4-Clean-up-use-of-cannot_instantiate_with_.patch [bz#1001216]
  - kvm-vt82c686-Clean-up-use-of-cannot_instantiate_with_dev.patch [bz#1001216]
  - kvm-isa-Clean-up-use-of-cannot_instantiate_with_device_a.patch [bz#1001216]
  - kvm-qdev-Do-not-let-the-user-try-to-device_add-when-it-c.patch [bz#1001216]
  - kvm-rhel-Revert-unwanted-cannot_instantiate_with_device_.patch [bz#1001216]
  - kvm-rhel-Revert-downstream-changes-to-unused-default-con.patch [bz#1001076]
  - kvm-rhel-Drop-cfi.pflash01-and-isa-ide-device.patch [bz#1001076]
  - kvm-rhel-Drop-isa-vga-device.patch [bz#1001088]
  - kvm-rhel-Make-isa-cirrus-vga-device-unavailable.patch [bz#1001088]
  - kvm-rhel-Make-ccid-card-emulated-device-unavailable.patch [bz#1001123]
  - kvm-x86-fix-migration-from-pre-version-12.patch [bz#1005695]
  - kvm-x86-cpuid-reconstruct-leaf-0Dh-data.patch [bz#1005695]
  - kvm-kvmvapic-Catch-invalid-ROM-size.patch [bz#920021]
  - kvm-kvmvapic-Enter-inactive-state-on-hardware-reset.patch [bz#920021]
  - kvm-kvmvapic-Clear-also-physical-ROM-address-when-enteri.patch [bz#920021]
  - kvm-block-optionally-disable-live-block-jobs.patch [bz#987582]
  - kvm-rpm-spec-template-disable-live-block-ops-for-rhel-en.patch [bz#987582]
  - kvm-migration-disable-live-block-migration-b-i-for-rhel-.patch [bz#1022392]
  - kvm-Build-ceph-rbd-only-for-rhev.patch [bz#987583]
  - kvm-spec-Disable-host-cdrom-RHEL-only.patch [bz#760885]
  - kvm-rhel-Make-pci-serial-2x-and-pci-serial-4x-device-una.patch [bz#1001180]
  - kvm-usb-host-libusb-Fix-reset-handling.patch [bz#980415]
  - kvm-usb-host-libusb-Configuration-0-may-be-a-valid-confi.patch [bz#980383]
  - kvm-usb-host-libusb-Detach-kernel-drivers-earlier.patch [bz#980383]
  - kvm-monitor-Remove-pci_add-command-for-Red-Hat-Enterpris.patch [bz#1010858]
  - kvm-monitor-Remove-pci_del-command-for-Red-Hat-Enterpris.patch [bz#1010858]
  - kvm-monitor-Remove-usb_add-del-commands-for-Red-Hat-Ente.patch [bz#1010858]
  - kvm-monitor-Remove-host_net_add-remove-for-Red-Hat-Enter.patch [bz#1010858]
  - kvm-fw_cfg-add-API-to-find-FW-cfg-object.patch [bz#990601]
  - kvm-pvpanic-use-FWCfgState-explicitly.patch [bz#990601]
  - kvm-pvpanic-initialization-cleanup.patch [bz#990601]
  - kvm-pvpanic-fix-fwcfg-for-big-endian-hosts.patch [bz#990601]
  - kvm-hw-misc-make-pvpanic-known-to-user.patch [bz#990601]
  - kvm-gdbstub-do-not-restart-crashed-guest.patch [bz#990601]
  - kvm-gdbstub-fix-for-commit-87f25c12bfeaaa0c41fb857713bbc.patch [bz#990601]
  - kvm-vl-allow-cont-from-panicked-state.patch [bz#990601]
  - kvm-hw-misc-don-t-create-pvpanic-device-by-default.patch [bz#990601]
  - kvm-block-vhdx-add-migration-blocker.patch [bz#1007176]
  - kvm-qemu-kvm.spec-add-vhdx-to-the-read-only-block-driver.patch [bz#1007176]
  - kvm-qemu-kvm.spec-Add-VPC-VHD-driver-to-the-block-read-o.patch [bz#1007176]
  - Resolves: bz#1001076
    (Disable or remove other block devices we won't support)
  - Resolves: bz#1001088
    (Disable or remove display devices we won't support)
  - Resolves: bz#1001123
    (Disable or remove device ccid-card-emulated)
  - Resolves: bz#1001180
    (Disable or remove devices pci-serial-2x, pci-serial-4x)
  - Resolves: bz#1001216
    (Fix no_user or provide another way make devices unavailable with -device / device_add)
  - Resolves: bz#1005695
    (QEMU should hide CPUID.0Dh values that it does not support)
  - Resolves: bz#1007176
    (Add VPC and VHDX file formats as supported in qemu-kvm (read-only))
  - Resolves: bz#1010858
    (Disable unused human monitor commands)
  - Resolves: bz#1022392
    (Disable live-storage-migration in qemu-kvm (migrate -b/-i))
  - Resolves: bz#1025740
    (Saving VM state on qcow2 images results in VM state corruption)
  - Resolves: bz#760885
    (Disable host cdrom passthrough)
  - Resolves: bz#920021
    (qemu-kvm segment fault when reboot guest after hot unplug device with option ROM)
  - Resolves: bz#980383
    (The usb3.0 stick can't be returned back to host after shutdown guest with usb3.0 pass-through)
  - Resolves: bz#980415
    (libusbx: error [_open_sysfs_attr] open /sys/bus/usb/devices/4-1/bConfigurationValue failed ret=-1 errno=2)
  - Resolves: bz#987582
    (Initial Virtualization Differentiation for RHEL7 (Live snapshots))
  - Resolves: bz#987583
    (Initial Virtualization Differentiation for RHEL7 (Ceph enablement))
  - Resolves: bz#989646
    (Support backup vendors in qemu to access qcow disk readonly)
  - Resolves: bz#990601
    (pvpanic device triggers guest bugs when present by default)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-16.el7
changelog:
  - kvm-block-drop-bs_snapshots-global-variable.patch [bz#1026524]
  - kvm-block-move-snapshot-code-in-block.c-to-block-snapsho.patch [bz#1026524]
  - kvm-block-fix-vvfat-error-path-for-enable_write_target.patch [bz#1026524]
  - kvm-block-Bugfix-format-and-snapshot-used-in-drive-optio.patch [bz#1026524]
  - kvm-iscsi-use-bdrv_new-instead-of-stack-structure.patch [bz#1026524]
  - kvm-qcow2-Add-corrupt-bit.patch [bz#1004347]
  - kvm-qcow2-Metadata-overlap-checks.patch [bz#1004347]
  - kvm-qcow2-Employ-metadata-overlap-checks.patch [bz#1004347]
  - kvm-qcow2-refcount-Move-OFLAG_COPIED-checks.patch [bz#1004347]
  - kvm-qcow2-refcount-Repair-OFLAG_COPIED-errors.patch [bz#1004347]
  - kvm-qcow2-refcount-Repair-shared-refcount-blocks.patch [bz#1004347]
  - kvm-qcow2_check-Mark-image-consistent.patch [bz#1004347]
  - kvm-qemu-iotests-Overlapping-cluster-allocations.patch [bz#1004347]
  - kvm-w32-Fix-access-to-host-devices-regression.patch [bz#1026524]
  - kvm-add-qemu-img-convert-n-option-skip-target-volume-cre.patch [bz#1026524]
  - kvm-bdrv-Use-Error-for-opening-images.patch [bz#1026524]
  - kvm-bdrv-Use-Error-for-creating-images.patch [bz#1026524]
  - kvm-block-Error-parameter-for-open-functions.patch [bz#1026524]
  - kvm-block-Error-parameter-for-create-functions.patch [bz#1026524]
  - kvm-qemu-img-create-Emit-filename-on-error.patch [bz#1026524]
  - kvm-qcow2-Use-Error-parameter.patch [bz#1026524]
  - kvm-qemu-iotests-Adjustments-due-to-error-propagation.patch [bz#1026524]
  - kvm-block-raw-Employ-error-parameter.patch [bz#1026524]
  - kvm-block-raw-win32-Employ-error-parameter.patch [bz#1026524]
  - kvm-blkdebug-Employ-error-parameter.patch [bz#1026524]
  - kvm-blkverify-Employ-error-parameter.patch [bz#1026524]
  - kvm-block-raw-posix-Employ-error-parameter.patch [bz#1026524]
  - kvm-block-raw-win32-Always-use-errno-in-hdev_open.patch [bz#1026524]
  - kvm-qmp-Documentation-for-BLOCK_IMAGE_CORRUPTED.patch [bz#1004347]
  - kvm-qcow2-Correct-snapshots-size-for-overlap-check.patch [bz#1004347]
  - kvm-qcow2-CHECK_OFLAG_COPIED-is-obsolete.patch [bz#1004347]
  - kvm-qcow2-Correct-endianness-in-overlap-check.patch [bz#1004347]
  - kvm-qcow2-Switch-L1-table-in-a-single-sequence.patch [bz#1004347]
  - kvm-qcow2-Use-pread-for-inactive-L1-in-overlap-check.patch [bz#1004347]
  - kvm-qcow2-Remove-wrong-metadata-overlap-check.patch [bz#1004347]
  - kvm-qcow2-Use-negated-overflow-check-mask.patch [bz#1004347]
  - kvm-qcow2-Make-overlap-check-mask-variable.patch [bz#1004347]
  - kvm-qcow2-Add-overlap-check-options.patch [bz#1004347]
  - kvm-qcow2-Array-assigning-options-to-OL-check-bits.patch [bz#1004347]
  - kvm-qcow2-Add-more-overlap-check-bitmask-macros.patch [bz#1004347]
  - kvm-qcow2-Evaluate-overlap-check-options.patch [bz#1004347]
  - kvm-qapi-types.py-Split-off-generate_struct_fields.patch [bz#978402]
  - kvm-qapi-types.py-Fix-enum-struct-sizes-on-i686.patch [bz#978402]
  - kvm-qapi-types-visit.py-Pass-whole-expr-dict-for-structs.patch [bz#978402]
  - kvm-qapi-types-visit.py-Inheritance-for-structs.patch [bz#978402]
  - kvm-blockdev-Introduce-DriveInfo.enable_auto_del.patch [bz#978402]
  - kvm-Implement-qdict_flatten.patch [bz#978402]
  - kvm-blockdev-blockdev-add-QMP-command.patch [bz#978402]
  - kvm-blockdev-Separate-ID-generation-from-DriveInfo-creat.patch [bz#978402]
  - kvm-blockdev-Pass-QDict-to-blockdev_init.patch [bz#978402]
  - kvm-blockdev-Move-parsing-of-media-option-to-drive_init.patch [bz#978402]
  - kvm-blockdev-Move-parsing-of-if-option-to-drive_init.patch [bz#978402]
  - kvm-blockdev-Moving-parsing-of-geometry-options-to-drive.patch [bz#978402]
  - kvm-blockdev-Move-parsing-of-boot-option-to-drive_init.patch [bz#978402]
  - kvm-blockdev-Move-bus-unit-index-processing-to-drive_ini.patch [bz#978402]
  - kvm-blockdev-Move-virtio-blk-device-creation-to-drive_in.patch [bz#978402]
  - kvm-blockdev-Remove-IF_-check-for-read-only-blockdev_ini.patch [bz#978402]
  - kvm-qemu-iotests-Check-autodel-behaviour-for-device_del.patch [bz#978402]
  - kvm-blockdev-Remove-media-parameter-from-blockdev_init.patch [bz#978402]
  - kvm-blockdev-Don-t-disable-COR-automatically-with-blockd.patch [bz#978402]
  - kvm-blockdev-blockdev_init-error-conversion.patch [bz#978402]
  - kvm-sd-Avoid-access-to-NULL-BlockDriverState.patch [bz#978402]
  - kvm-blockdev-fix-cdrom-read_only-flag.patch [bz#978402]
  - kvm-block-fix-backing-file-overriding.patch [bz#978402]
  - kvm-block-Disable-BDRV_O_COPY_ON_READ-for-the-backing-fi.patch [bz#978402]
  - kvm-block-Don-t-copy-backing-file-name-on-error.patch [bz#978402]
  - kvm-qemu-iotests-Try-creating-huge-qcow2-image.patch [bz#980771]
  - kvm-block-move-qmp-and-info-dump-related-code-to-block-q.patch [bz#980771]
  - kvm-block-dump-snapshot-and-image-info-to-specified-outp.patch [bz#980771]
  - kvm-block-add-snapshot-info-query-function-bdrv_query_sn.patch [bz#980771]
  - kvm-block-add-image-info-query-function-bdrv_query_image.patch [bz#980771]
  - kvm-qmp-add-ImageInfo-in-BlockDeviceInfo-used-by-query-b.patch [bz#980771]
  - kvm-vmdk-Implement-.bdrv_has_zero_init.patch [bz#980771]
  - kvm-qemu-iotests-Add-basic-ability-to-use-binary-sample-.patch [bz#980771]
  - kvm-qemu-iotests-Quote-TEST_IMG-and-TEST_DIR-usage.patch [bz#980771]
  - kvm-qemu-iotests-fix-test-case-059.patch [bz#980771]
  - kvm-qapi-Add-ImageInfoSpecific-type.patch [bz#980771]
  - kvm-block-Add-bdrv_get_specific_info.patch [bz#980771]
  - kvm-block-qapi-Human-readable-ImageInfoSpecific-dump.patch [bz#980771]
  - kvm-qcow2-Add-support-for-ImageInfoSpecific.patch [bz#980771]
  - kvm-qemu-iotests-Discard-specific-info-in-_img_info.patch [bz#980771]
  - kvm-qemu-iotests-Additional-info-from-qemu-img-info.patch [bz#980771]
  - kvm-vmdk-convert-error-code-to-use-errp.patch [bz#980771]
  - kvm-vmdk-refuse-enabling-zeroed-grain-with-flat-images.patch [bz#980771]
  - kvm-qapi-Add-optional-field-compressed-to-ImageInfo.patch [bz#980771]
  - kvm-vmdk-Only-read-cid-from-image-file-when-opening.patch [bz#980771]
  - kvm-vmdk-Implment-bdrv_get_specific_info.patch [bz#980771]
  - Resolves: bz#1004347
    (Backport qcow2 corruption prevention patches)
  - Resolves: bz#1026524
    (Backport block layer error parameter patches)
  - Resolves: bz#978402
    ([RFE] Add discard support to qemu-kvm layer)
  - Resolves: bz#980771
    ([RFE]  qemu-img should be able to tell the compat version of a qcow2 image)


