# changelog

author: Kamil Dudka <kdudka@redhat.com> - 1:4.5.10-7
changelog:
  - fix specfile issues reported by the fedora-review script
  - do not use the AM_C_PROTOTYPES macro (removed in Automake 1.12)
  - do not require gets() to be declared


author: Tomas Hozza <thozza@redhat.com> - 0.17-49
changelog:
  - Compile finger with Full RELRO
  - Explicitly use gcc
  - Use only RPM_OPT_FLAGS and RPM_LD_FLAGS
  - Add systemd as BuildRequires because of unitdir macro


author: Adam Williamson <awilliam@redhat.com> - 3.0-3
changelog:
  - Re-enable ceph deps on ppc64 (it's building again)
  - Disable RDMA support on 32-bit ARM (#1484155)


author: Tomas Mraz <tmraz@redhat.com> - 1.2.0-1
changelog:
  - add lib subpackage to avoid multilib on the base package
  - add ability to compute hmacs on multiple files at once
  - improved debugging with FIPSCHECK_DEBUG


author: Martin Stransky <stransky@redhat.com> - 24.4.0-3
changelog:
  - Added a workaround for Bug 1054242 - RHEVM: Extremely high memory
    usage in Firefox 24 ESR on RHEL 6.5


author: Zubkov <izubkov@cloudlinux.com> - 24.5.0-1.cloudlinux
changelog:
  - Set general.useragent.vendor to CloudLinux
  - Set startup.homepage_override_url to http://www.cloudlinux.com
  - Set startup.homepage_welcome_url to http://www.cloudlinux.com


author: Jiri Popelka <jpopelka@redhat.com> - 0.3.6.2-1
changelog:
  - firewall-offline-cmd: --forward-port 'toaddr' is optional (RHBZ#1014958)
  - firewall-cmd: fix variable name (RHBZ#1015011)


author: Jiri Popelka <jpopelka@redhat.com> - 0.3.7-1
changelog:
  - Don't fail on missing ip[6]tables/ebtables table. (RHBZ#967376)
  - bash-completion: --permanent --direct options
  - firewall/core/fw.py: fix checking for iptables & ip6tables (RHBZ#1017087)
  - firewall-cmd: use client's exception_handler instead of catching exceptions ourselves
  - FirewallClientZoneSettings: fix {add|remove|query}RichRule()
  - Extend amanda-client service with 10080/tcp (RHBZ#1016867)
  - Simplify Rich_Rule()_lexer() by using functions.splitArgs()
  - Fix encoding problems in exception handling (RHBZ#1015941)


author: Jiri Popelka <jpopelka@redhat.com> - 0.3.8-1
changelog:
  - fix memory leaks
  - New option --debug-gc
  - Python3 compatibility
  - Better non-ascii support
  - several firewall-config & firewall-applet fixes
  - New --remove-rules commands for firewall-cmd and removeRules methods for D-Bus
  - Fixed FirewallDirect.get_rules to return proper list
  - Fixed LastUpdatedOrderedDict.keys()
  - Enable rich rule usage in trusted zone (RHBZ#994144)
  - New error codes: INVALID_CONTEXT, INVALID_COMMAND, INVALID_USER and INVALID_UID


author: Thomas Woerner <twoerner@redhat.com> - 0.3.9-1
changelog:
  - rebase to 0.3.9 version:
  - translation updates
  - New IPv6_rpfilter setting to enable source address validation (RHBZ#847707)
  - Do not mix original and customized zones in case of target changes,
    apply only used zones
  - firewall-cmd: fix --*_lockdown_whitelist_uid to work with uid 0
  - Don't show main window maximized. (RHBZ#1046811)
  - Use rmmod instead of 'modprobe -r' (RHBZ#1031102)
  - Deprecate 'enabled' attribute of 'masquerade' element
  - firewall-config: new zone was added twice to the list
  - firewalld.dbus(5)
  - Enable python shebang fix again
  - firewall/client: handle_exceptions: Use loop in decorator
  - firewall-offline-cmd: Do not mask firewalld service with disabled option
  - firewall-config: richRuleDialogActionRejectType Entry -> ComboBox
  - Rich_Rule: fix parsing of reject element (RHBZ#1027373)
  - Show combined zones in permanent configuration (RHBZ#1002016)
  - firewall-cmd(1): document exit code 2 and colored output (RHBZ#1028507)
  - firewall-config: fix RHBZ#1028853


author: Thomas Woerner <twoerner@redhat.com> - 0.3.9-2
changelog:
  - fixed rich rules (RHBZ#1054270)
  - fixed small defects in firewall-cmd and firewall-config (RHBZ#1054289)


author: Thomas Woerner <twoerner@redhat.com> - 0.3.9-4
changelog:
  - firewall-config creates unloadable config; port forwarding broken
    (RHBZ#1057628)
  - Network connection is lost after changing Zones Default Target to DROP
    (RHBZ#1057629)
  - permanently adding rich rule with audit creates unloadable config XML
    (RHBZ#1057684)
  - firewalld input_zones has default rule for public zone (RHBZ#1058339)
  - firewall-cmd is not able to add and remove zones, services and icmptypes
    (RHBZ#1064386)
  - firewall-config leaves deleted services shown if they were in use
    (RHBZ#1058853)
  - firewall-cmd does not allow user to change zone default target (RHBZ#1058791)
  - firewall-cmd man page has a typo in --help description (RHBZ#1064401)


author: Thomas Woerner <twoerner@redhat.com> - 0.3.9-5
changelog:
  - fixed rich language log level (RHBZ#993740)
  - firewall-config: use simple tool to change zones for connections (RHBZ#993782)
  - translations update (RHBZ#1030330)
  - firewall-config: fixed service and icmptype name dulications (RHBZ#1067639)
  - allow router advertisements for IPv6 rpfilter (RHBZ#1067652)
  - firewall-applet: allow to bind connections to the defaut zone (RHBZ#1068148)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.1-1
changelog:
  - Rebase to 0.4.3.1
  - firewall.command: Fix python3 DBusException message not interable error
  - src/Makefile.am: Fix path in firewall-[offline-]cmd_test.sh while installing
  - firewallctl: Do not trace back on list command without further arguments
  - firewallctl (man1): Added remaining sections zone, service, ..
  - firewallctl: Added runtime-to-permanent, interface and source parser,
    IndividualCalls setting
  - firewall.server.config: Allow to set IndividualCalls property in config
    interface
  - Fix missing icmp rules for some zones
  - runProg: Fix issue with running programs
  - firewall-offline-cmd: Fix issues with missing system-config-firewall
  - firewall.core.ipXtables: Split up source and dest addresses for transaction
  - firewall.server.config: Log error in case of loading malformed files in
    watcher
  - Install and package the firewallctl man page


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-1
changelog:
  - Rebase to 0.4.3.2
  - Fix regression with unavailable optional commands
  - All missing backend messages should be warnings
  - Individual calls for missing restore commands
  - Only one authenticate call for add and remove options and also sequences
  - RH-Satellite-6 service now upstream
  - Conflict for selinux-policy needed to be updated to newer release
    (RHBZ#1304723)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-2
changelog:
  - Updated conflict for selinux-policy (RHBZ#1304723)
  - Fixed exit codes in command line clients (RHBZ#1357050)
  - Fixed traceback in firewall-cmd without args (RHBZ#1357063)
  - Fixed source docs in man pages and help output (RHBZ#1357888)
  - Fixed rebuild of changed man pages (RHBZ#1360362)
  - Use stderr for errors and warnings in command line tools (RHBZ#1360894)
  - Fixed lockdown not denying invalid commands (RHBZ#1360871)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-3
changelog:
  - Fix test suite for command change (RHBZ#1360871)
  - Fix test suite with stderr usage (RHBZ#1360894)
  - Rebuild for wrong docdir without version (RHBZ#1057327#c7)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-4
changelog:
  - Fixed firewall-config gettext usage (RHBZ#1361612)
  - Fixed ifcfg file reader and writer (RHBZ#1362171)
  - Fixed loading ipset entries from file in commands (RHBZ#1365198)
  - Added conflicts to old main package to sub packages (RHBZ#1361669)
  - Do not show settings of zones etc. without authentication (RHBZ#1357098)
  - Fixed CVE-2016-5410 (RHBZ#1359296)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-5
changelog:
  - Print errors and warnings to stderr additional patch (RHBZ#1360894)
  - Fixed trace back in firewallctl (RHBZ#1367155)
  - Fix client crash if systembus can not be aquired (RHBZ#1367038)
  - Make ALREADY_ENABLED a warning (RHBZ#1366654)
  - Added conflict to old squid package providing the squid.service file
    (RHBZ#1366308)
  - Fixed firewall-cmd help typo (RHBZ#1367171)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-6
changelog:
  - Do not use exit code 254 for {ALREADY,NOT}_ENABLED sequences (RHBZ#1366654)
  - Fail with NOT_AUTHORIZED if authorization fails (RHBZ#1368549)
  - firewall-cmd: Fix get and set description for permanent zones (RHBZ#1368949)
  - Fix loading of service helpers in active zones (RHBZ#1371116)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-7
changelog:
  - Tolerate ipv6_rpfilter fail (RHBZ#1285769)
  - Fix set_rules to copy the rule before extracting the table (RHBZ#1373260)
  - Translation update (RHBZ#1273296)
  - Conflict with NetworkManager < 1:1.4.0-3.el7 (RHBZ#1366288)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.4-4
changelog:
  - Add services for oVirt: ovirt-imageio, ovirt-vmconsole, ovirt-storageconsole,
    ctbc and nrpe (RHBZ#1449158)
  - Fix policy issue with the choice policies by using the .policy.choice
    extension (RHBZ#1449754)


author: Eric Garver <egarver@redhat.com> - 0.4.4.4-7
changelog:
  - firewall.functions: New function get_nf_nat_helpers (RHBZ#1452681)
  - firewall.core.fw: Get NAT helpers and store them internally. (RHBZ#1452681)
  - firewall.core.fw_zone: Load NAT helpers with conntrack helpers (RHBZ#1452681)
  - firewalld.dbus: Add missing properties nf_conntrach_helper_setting and
    nf_conntrack_helpers (RHBZ#1452681)
  - D-Bus interfaces: Fix GetAll for interfaces without properties (RHBZ#1452017)
  - firewall.server.firewalld: New property for NAT helpers supported by the
    kernel (RHBZ#1452681)


author: Phil Sutter - 0.4.4.4-11
changelog:
  - core: Log unsupported ICMP types as informational only (RHBZ#1479951)
  - doc: firewall-cmd: Document --query-* options return codes (RHBZ#1372716)
  - doc: firewall-cmd: Document quirk in --reload option (RHBZ#1452137)
  - firewall-cmd: Use colors only if output is a TTY (RHBZ#1368544)
  - firewall-offline-cmd: Don't require root for help output (RHBZ#1445214)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.3-1
changelog:
  - Rebase to firewalld-0.4.4.3 (RHBZ#1414584)
  - Support disabled automatic helper assignment in firewalld (RHBZ#1006225)
  - Fix masquerade rules to be created always the same (RHBZ#1374001)
  - Properly handle quoted ifcfg file values (RHBZ#1395348)
  - Fix extension of ifcfg backup files (RHBZ#1400478)
  - Complete icmp types list (RHBZ#1401978)
  - Fix LOG rule placement for LogDenied (RHBZ#1402932)
  - Show error messages from NM and do not trace back (RHBZ#1405562)
  - Support icmp-type usage in rich rules (RHBZ#1409544)
  - New service file for freeipa-trust (RHBZ#1411650)
  - Fix --{set,get}-{short,description} for ipset in commands (RHBZ#1416325)
  - Speed up large ipset file loading and import (RHBZ#1416817)
  - Improve support for ipsets in firewalld (RHBZ#1419058)
  - ALREADY_ errors should result in warnings and zero exit code (RHBZ#1420457)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.4-1
changelog:
  - Rebase to firewalld-0.4.4.4
    http://www.firewalld.org/2017/03/firewalld-0-4-4-4-release
  - Drop references to fedorahosted.org from spec file and Makefile.am, use
    archive from github
  - Fix inconsistent ordering of rules in INPUT_ZONE_SOURCE (issue#166)
    (RHBZ#1421222)
  - Fix ipset overloading from /etc/firewalld/ipsets (RHBZ#1423941)
  - Fix permanent rich rules using icmp-type elements (RHBZ#1434763)
  - firewall-config: Deactivate edit, remove, .. buttons if there are no items
  - Check if ICMP types are supported by kernel before trying to use them
    (RHBZ#1401978)
  - firewall-config: Show invalid ipset type in the ipset configuration dialog
    in a special label (RHBZ#1419058)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.4-2
changelog:
  - Add support for sctp and dccp in ports, source-ports and forward-ports
    (RHBZ#1429808)
  - Fix firewall-offline-cmd --remove-service-from-zone= option (RHBZ#1438127)


author: Thomas Woerner <twoerner@redhat.com> - 0.4.4.4-3
changelog:
  - Fix --{set,get}-{short,description} for zones (RHBZ#1416325)
  - Man pages: Add sctp and dccp for ports, ... (RHBZ#1429808)
  - Add support for new wait option in restore commands (RHBZ#1446162)


author: Eric Garver <egarver@redhat.com> - 0.6.3-1
changelog:
  - rebase package to v0.6.3, include recent stable fixes
  - use QT4 patch for firewall-applet
  - remove cockpit service definition, cockpit package still ships their own
  - remove testsuite force of LC_ALL=C.UTF-8. RHEL-7 doesn't have C.UTF-8
  - remove nftables support


author: Eric Garver <egarver@redhat.com> - 0.6.3-2
changelog:
  - backport recent upstream stable fixes
  - backport fix to enable IP forwarding only if toaddr specified


author: Eric Garver <egarver@redhat.com> - 0.6.3-3
changelog:
  - backport recent upstream stable fixes
  - backport fix --remove-rules deleting all direct rules
  - backport fix unable to delete rich rule forward-port
  - backport fix forward-port for external zone hijacking internal zone
  - backport fix testsuite iptables locking


author: Martin Kolman <mkolman@redhat.com> 19.9-3
changelog:
  - Fix exception handling (#952633) (mkolman@redhat.com)
    Resolves: rhbz#952633
  - Replace Finish with Done on the next button (#1107887) (mkolman@redhat.com)
    Resolves: rhbz#1107887


author: Martin Kolman <mkolman@redhat.com> 19.9-4
changelog:
  - Handle next button naming also if there is only one module (#1107887) (mkolman@redhat.com)
    Related: rhbz#1107887


author: Martin Kolman <mkolman@redhat.com> 19.9-6
changelog:
  - Make Firstboot architecture specific due to s390-only files (#1162567) (mkolman@redhat.com)
    Resolves: rhbz#1162567


author: Martin Kolman <mkolman@redhat.com> 19.10-1
changelog:
  - Switch from Transifex to Zanata (#1273359) (mkolman@redhat.com)
    Related: rhbz#1273359
  - Update translations (#1273359) (mkolman@redhat.com)
    Resolves: rhbz#1273359


author: Martin Sivak <msivak@redhat.com> 19.1-1
changelog:
  - Remove all modules that are going to be provided by anaconda and initial-
    setup (msivak@redhat.com)


author: Martin Sivak <msivak@redhat.com> 19.2-1
changelog:
  - Fix a typo in variable name (sherr@redhat.com)
  - Fix one two year old refactoring leftover.. (msivak@redhat.com)


author: Vratislav Podzimek <vpodzime@redhat.com> 19.3-1
changelog:
  - Run after the initial-setup-graphical.service (if enabled) (vpodzime)
  - ABRT now uses a different directory for problem data (#952633) (vpodzime)
  - Make firstboot a noarch package (#921509) (vpodzime)
  - Use /usr/bin/python instead of /usr/bin/env python (#987016) (vpodzime)
  - Remove an unused import causing tracebacks (#965748) (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> 19.6-1
changelog:
  - Exit the main process correctly even if reboot is required (vpodzime)
    Resolves: rhbz#903579
    Resolves: rhbz#1042666
  - Translate the error message if not run as root (vpodzime)
    Related: rhbz#1044339


author: Miroslav Lichvar <mlichvar@redhat.com> 1.2.1-11.20121204gita43f56
changelog:
  - update to 20121204gita43f56
  - create libs subpackage
  - split documentation to base and devel subpackages
  - drop defattr macros
  - add GFDL to License tag


author: Miroslav Lichvar <mlichvar@redhat.com> 1.3.0-5
changelog:
  - fix buffer overflow when processing ID3v2 metadata (CVE-2014-8962)
  - fix buffer overflow with invalid blocksize (CVE-2014-9028)


author: Akemi Yagi <toracat@elrepo.org> - 0.0-2
changelog:
  - Packaging style now conforms to the ELRepo standard. [Alan Bartlett]
  - Built against kernel 2.6.32-220.el6.


author: Akemi Yagi <toracat@elrepo.org> - 0.0-4
changelog:
  - Updated to flashcache-stable_v2.
  - Provides: /sbin/flashcache_create flashcache_destroy flashcache_load flashcache_scan 
    flashcache_setioctl flashstat get_agsize and /usr/lib/ocf/resource.d/flashcache


author: David King <dking@redhat.com> - 0.8.4-2
changelog:
  - Sync bzip2 dependency with Fedora package
  - Make the libs subpackage depend on the base package for libostree
  - Fix multilib issues with XML-based documentation


author: Colin Walters <walters@verbum.org> - 0.8.7-3
changelog:
  - Fix libostree bundling:
    Ensure we do not Provide or Require libostree.
    Move the shared library into flatpak-libs so flatpak always
    depends on it.
    Keep the shared library filename as libostree, but put it
    under a private directory.  Renaming the file on disk did not
    really do much since the dynamic linker and RPM work from the
    soname.
    Resolves: #1476905


author: Ray Strode <rstrode@redhat.com> - 0.8.8-2
changelog:
  - Fix crasher in xdg-desktop-portal
    Resolves: #1503579
  - Tweak spec file so it still builds even though we need to
    autoreconf.


author: Petr Machata <pmachata@redhat.com> - 2.5.35-15
changelog:
  - Rename flex-static to flex-devel so that it gets to repositories of
    minor multi-lib arch (i386 on x86_64 etc.)
  - Resolves: #674301


author: Petr Machata <pmachata@redhat.com> - 2.5.36-1
changelog:
  - Rebase to 2.5.36
    - Drop flex-2.5.35-sign.patch, flex-2.5.35-hardening.patch,
      flex-2.5.35-gcc44.patch, flex-2.5.35-missing-prototypes.patch
    - Add flex-2.5.36-bison-2.6.1.patch
    - Add a subpackage doc
  - Resolves #842073


author: Francois Aucamp <faucamp@fedoraproject.org> - 1.3-16
changelog:
  - Added patch declaring explicit libm linking dependency (RHBZ #564899)
  - Updated source and URL tags


author: Akira TAGOH <tagoh@redhat.com> - 2.10.94-1
changelog:
  - New upstream release.
  - migrate the configuration for XDG Base Directory spec automatically (#882267)


author: Akira TAGOH <tagoh@redhat.com> - 2.10.95-5
changelog:
  - Fix the race condition issue on updating cache (#1011510)
  - Fix crash issue in FcFontSort()
  - Fix an issue not copying all values from the font.


author: Akira TAGOH <tagoh@redhat.com> - 2.13.0-4.1
changelog:
  - Rebase to 2.13.0 (#1576501)
  - Rename fc-cache binary to fc-cache-{32,64} for multilib. (#1568968)
  - backport some fixes related to Flatpak.
  - Drop new syntax in config for compatibility.
  - Requires dejavu-sans-fonts instead of font(:lang=en) (#1484094)


author: Parag Nemade <pnemade AT redhat DOT com> - 20120731b-9
changelog:
  - Added cflags -Wstrict-aliasing
  - Fixed some compile-time errors from invalid Makefile rules
  - Fixed bogus date in changelog


author: Parag Nemade <pnemade AT redhat DOT com> - 20120731b-10
changelog:
  - Revert previously added -Wstrict-aliasing cflags
  - We actaully need -fno-strict-aliasing (rh#903288)
  - Remove %defattr() (rh#1003518)
  - fontforge.xml should not be executable (rh#1003518)


author: Akira TAGOH <tagoh@redhat.com> - 0.1.4-1
changelog:
  - New upstream release.
    - Fix file writing issue when the classification filter is turned off.
      (#886330)


author: Akira TAGOH <tagoh@redhat.com> - 2.3-1
changelog:
  - New upstream release. (Paul Williams, #599281)
    - drop upstreamed patch.
    - correct man page location.
  - Update the spec file to keep consistensy of usage in the macro as far as possible.


author: Jiri Popelka <jpopelka@redhat.com> 4.0-30.20120103
changelog:
  - Updated to foomatic-db-4.0-20120103
  - spec modernized
  - Device IDs for:
    - Brother MFC-8840D (#678065)
    - HP LaserJet M1522nf MFP (#745499)
    - Lexmark C453 (#770169)


author: Michal Srb <msrb@redhat.com> - 1.1-1
changelog:
  - Update to upstream version 1.1
  - Replace proprietary color profile with free CP from icc-profiles-openicc package
  - Resolves: rhbz#848659


author: Weinan Li <weli@redhat.com> - 5-2
changelog:
  - Add the license source note
  - Cleanup the svn metadata in source
  - Add the full instructions for creating the tar in the comment


author: Weinan Li <weli@redhat.com> - 5-3
changelog:
  - Each package must consistently use macros, use rm instead of all %{_rm}
  - Add Requires: jpackage-utils


author: Ray Strode <rstrode@redhat.com> 0.2.0-2
changelog:
  - Don't allow pam module to ever get unmapped, since that causes
    crashes in dbus-glib, gobject, etc.


author: Tomas Smetana <tsmetana@redhat.com> - 2.8.0-6
changelog:
  - fix #831336: fix broken menus; patch backported from upstream SVN revision
    1375 by Manfred Spraul


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.5-1
changelog:
  - Updated to freeipmi-1.2.5:
   - Support Supermicro X9SPU-F-O OEM sensors and events.
   - Support Supermicro X9DRI-LN4F+ OEM intepretations (previously
     forgotten).


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.6-1
changelog:
  - Updated to freeipmi-1.2.6
   - Support HP Proliant DL160 G8 OEM sensors.
   - Support Supermicro X9SCM-iiF OEM sensors and events.
   - Support output of temperature sampling period to ipmi-dcmi.
   - Clarify error message when SOL session cannot be stolen in
     ipmiconsole/libipmiconsole.
   - Fix dcmi rolling average time period output error
   - Fix ipmi-dcmi output errors with --get-dcmi-sensor-info.
   - Fix corner case in calculation of confidentiality pad length with
     AES-CBC-128 encryption.  Incorrect pad effects some vendor firmware
     implementations.
   - Send IPMI 2.0 packets differently than IPMI 1.5 packets, as the
     former does not require legacy pad data to be appended to payloads.
   - Fix Intel OEM SEL buffer overflow.
   - Fix out of trunk source build.
   - Support new ipmi_rmcpplus_sendto() and ipmi_rmcpplus_recvfrom()
     functions.
   - Support new HP Proliant DL160 G8 OEM sensor events.


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.6-2
changelog:
  - spec update by Christopher Meng <rpm@cicku.me>
   - hardened build flags should include PIE also for bmc-watchdog.


author: Ales Ledvinka <aledvink@redhat.com> - 1.2.9-1
changelog:
  - Updated to upstream freeipmi-1.2.9
   - Fix threshold output corner case in ipmi-sensors.
   - Fix invalid declaration in libipmimonitoring header.
   - Fix older compiler build problems.
   -
   - Fix portability build bug on ARM systems.
   - Add 'internal IPMI error' troubleshooting to manpages.
   - Fix bmc-info corner case on Bull 510 systems.


author: Josef Ridky <jridky@redhat.com> - 1.5.7-1
changelog:
  - Rebase to the latest upstream release 1.5.7 (#1435848)
  - Fix manpage command examples (#1353981) in separate commit


author: John Dennis <jdennis@redhat.com> - 3.0.0-4
changelog:
  - resolves: bug#1031035
    remove radeapclient man page,
    upstream no longer supports radeapclient, use eapol_test instead
  - resolves: bug#1031061
    rlm_eap_leap memory corruption, see freeradius-rlm_leap.patch
  - move man pages for utils into utils subpackage from doc subpackage
  - fix HAVE_EC_CRYPTO test to include f20
  - add new directory /var/run/radiusd/tmp
    update mods-available/eap so tls-common.verify.tmpdir to point to it


author: John Dennis <jdennis@redhat.com> - 3.0.1-1
changelog:
  - Upgrade to upstream 3.0.1 release, full config compatible with 3.0.0.
    This is a roll-up of all upstream bugs fixes found in 3.0.0
    See upstream ChangeLog for details (in freeradius-doc subpackage)
  - resolves: bug#1052450 (fedora 1053020)
  - resolves: bug#1044748 (fedora 1044747)
  - resolves: bug#1048475 (fedora 1048474)
  - resolves: bug#1043037 (fedora 1043036)


author: John Dennis <jdennis@redhat.com> - 3.0.1-3
changelog:
  - resolves: bug#1055073 (fedora 1055072)
    rlm_ippool; bad config file attribute and fails to send reply attributes
  - resolves: bug#1055567 (fedora 1056227)
    bad mysql sql syntax
  - change CFLAGS -imacros to -include to address gcc/gdb bug 1004526
    where gdb will not display source information, only <command-line>


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.1-6
changelog:
  - Fix CVE-2014-2015 "freeradius: stack-based buffer overflow flaw in rlm_pap
    module"
  - resolves: bug#1066984 (fedora 1066763)


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-2
changelog:
  - Do not fail logrotate if radiusd is not running.
    Resolves: Bug#1365226 error running non-shared postrotate script for
                          /var/log/radius/radius.log of
                          '/var/log/radius/radius.log '
  - Fix output to log file specified with -l option.
    Resolves: Bug#1421207 radiusd does not work with log file specified by -l
                          option
  - Fix long hostnames interpreted as IP addresses.
    Resolves: Bug#1420359 radclient does not detect 4. level and higher domain
                          name as a domain name
  - Avoid clashes with libtool library symbols.
    Resolves: Bug#1391960 undefined symbol: get_vtable in
                          /usr/lib64/libtdsodbc.so.0 with freeradius-unixODBC
  - Remove mentions of Auth-Type = System from docs.
    Resolves: Bug#1420293 Freeradius does not know Auth-Type = System
  - Improve ip/v4/v6/addr documentation.
    Resolves: Bug#1179736 add description for ipaddr = hostname from DNS with A
                          and AAAA entries


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-1
changelog:
  - Upgrade to upstream v3.0.13 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
    Resolves: Bug#1329181 freeradius-python fix libpython2.7.so dependency at
                          compile time
    Resolves: Bug#1425869 Radiusd does not trigger modules.sql.fail trap if it
                          can't connect to mysql server
    Resolves: Bug#1427829 Stack overflow when passing bare IPv6 to radclient


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-2
changelog:
  - Fix some issues found with static analyzers.
    Resolves: Bug#1432103 FreeRADIUS fails covscan checks
  - Revert rlm_eap_tnc removal, because the tncfhh package is still in RHEL.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-3
changelog:
  - Explicitly disable rlm_cache_memcached to avoid error when the module's
    dependencies are installed, and it is built, but not packaged.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
  - Prevent segfaults by adding a missing handling of connection errors in
    rlm_ldap.
    Resolves: Bug#1437409 [abrt] freeradius: radiusd killed by SIGSEGV
  - Make radtest use Cleartext-Password for EAP, fixing its support for eap-md5.
    Resolves: Bug#1436619 radtest does not work with eap-md5


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-4
changelog:
  - Disable internal OpenSSL cache.
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass
  - Check sizeof(*packet), not sizeof(packet) in EAP-PWD
    Resolves: Bug#1459073 Potential buffer overflow in FreeRADIUS EAP-PWD
  - Parse port as well as address for dhcpclient destination
    Resolves: Bug#1457825 dhcpclient does no accept IP:PORT


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-5
changelog:
  - Refer to correct package version in configuration comments for Bug#1458746
    (CVE-2017-9148) fix.
    Related: Bug#1458746  CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-6
changelog:
  - Avoid race condition when creating session cache file
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-7
changelog:
  - Resolves: Bug#1469408 CVE-2017-10978 freeradius: Out-of-bounds read/write due
                          to improper output buffer size check in make_secret()
  - Resolves: Bug#1469412 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63
  - Resolves: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                          data2vp_wimax()
  - Resolves: Bug#1469416 CVE-2017-10985 freeradius: Infinite loop and memory
                          exhaustion with 'concat' attributes
  - Resolves: Bug#1469419 CVE-2017-10986 freeradius: Infinite read in
                          dhcp_attr2vp()
  - Resolves: Bug#1469422 CVE-2017-10987 freeradius: Buffer over-read in
                          fr_dhcp_decode_suboptions()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-9
changelog:
  - Fix double free in rlm_sql acct_redundant
    Resolves: Bug#1551069 Radius service crashes with "Bad talloc magic value -
                          unknown value" when using module sql rlm_sql


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-10
changelog:
  - Fixes two EAP-PWD security issues
    Resolves: bz#1699413 authentication bypass with an invalid curve attack


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-10
changelog:
  - Fixes two EAP-PWD security issues
    Resolves: bz#1699414 authentication bypass with an invalid curve attack
    Resolves: bz#1699419 fake authentication using reflection


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-11
changelog:
  - Fixes logrotate, EAP-PWD vulnerability
    Resolves: bz#1719368 privilege escalation due to insecure logrotate configuration
    Resolves: bz#1751796 eap-pwd: Information leak due to aborting when needing more than 10 iterations


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-15
changelog:
  - Fixes EAP-PWD: DoS issues due to multithreaded BN_CTX access
    Resolves: bz#1818808

    * Fri Feb 7 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.13-14
  - Fixes receiving of multiple RADIUS packets under load
    Resolves: bz#1630684


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.11-1
changelog:
  - Upgrade to upstream v3.0.11 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Resolves: Bug#1197551
    Resolves: Bug#1179745
    Resolves: Bug#1202751 Rebase FreeRADIUS to 3.0.7 or later minor release
    Resolves: Bug#1289849 FreeRadius should start after ldap, ipa and krb5kdc
    Resolves: Bug#1208886 Add the latest Mikrotik dictionary into Freeradius
    Resolves: Bug#1198620 radutmp should not rotate
    Resolves: Bug#1180979 Freeradius is installing files under /etc/tmpfiles.d/
    Resolves: Bug#1187904 radiusd logrotate config file contains old style
                          "/sbin/service radius reload" reload call
    Resolves: Bug#1167846 radiusd fails to load clients from ldap
    Resolves: Bug#1422018 /usr/lib/systemd/system/radiusd.service is marked
                          executable. Please remove executable permission bits
    Resolves: Bug#1167843 support for older style generic attributes in
                          rlm_ldap doesn't work
    Resolves: Bug#1354234 home servers are marked as dead by radiusd


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-1
changelog:
  - Upgrade to upstream v3.0.12 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.7 or later minor release
    Resolves: Bug#1358989 FreeRADIUS stops reading the accounting packets from the
                          detail file
    Resolves: Bug#1269217 FreeRADIUS triggers mprotect with large radius reply
    Resolves: Bug#1344183 radiusd crashed in rbtree_find() after receiving a packet
    Resolves: Bug#1370431 FreeRADIUS fails to establish LDAP connections under
                          load
    Resolves: Bug#1397981 [abrt] freeradius: radiusd killed by SIGSEGV


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-7
changelog:
  - Resolves: Bug#1469409 CVE-2017-10978 freeradius: Out-of-bounds read/write due
                          to improper output buffer size check in make_secret()
  - Resolves: Bug#1469413 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63
  - Resolves: Bug#1469414 CVE-2017-10984 freeradius: Out-of-bounds write in
                          data2vp_wimax()
  - Resolves: Bug#1469417 CVE-2017-10985 freeradius: Infinite loop and memory
                          exhaustion with 'concat' attributes
  - Resolves: Bug#1469418 CVE-2017-10986 freeradius: Infinite read in
                          dhcp_attr2vp()
  - Resolves: Bug#1469421 CVE-2017-10987 freeradius: Buffer over-read in
                          fr_dhcp_decode_suboptions()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469414 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Soren Sandmann <ssp@redhat.com> - 1.0.2-3
changelog:
  - Man page fixes
    - Document that multiple connections don't work (988294)
    - Document the list of plugins (988307, 988308)


author: Ondrej Holy <oholy@redhat.com> - 1.0.2-11
changelog:
  - Use boolean types defined stdbool.h (#1404575)
  - Prevent stucked keys on focus out and unmap events (#1415069)
  - Fix crashes when copying images (#1417536)
  - Enable TLS 1.1 connections and later (#1312967)


author: Ondrej Holy <oholy@redhat.com> - 2.0.0-4.rc4
changelog:
  - CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
  - CVE-2020-11523: Fix integer overflow in region.c (#1837622)
  - CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-3
changelog:
  - Fix emboldening:
      - split out MSB function
      - fix integer overflows
      - fix broken emboldening at small sizes
  - Resolves: #891457


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-11
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197740


author: Ernestas Kulik <ekulik@redhat.com> - 1.0-3
changelog:
  - Drop recordmydesktop sub-package (rhbz#1647170)
  - Load version 3.0 of Gtk namespace, silence a PyGObject warning (rhbz#1647170)


author: Jan Synáček <jsynacek@redhat.com> - 0.17-58
changelog:
  - Extend the input line buffer and the argument storage buffer
  - Prettify spec some more and remove trailing space


author: Sergey Fokin <sfokin@cloudlinux.com> - 0.9.2-1
changelog:
  - update to 0.9.2
  - add alt-libcurlssl-devel instead of curl-devel to BuildRequires
  - add fix-build-with-alt-libcurlssl.patch


author: Richard Hughes <richard@hughsie.com> 1.0.1-1
changelog:
  - Rebase to 1.0.1, specifically the wip/hughsie/rhel75 branch which adds
    back the automake build system and lowers the required versions of deps.
  - This also un-neuters fwupd so that most of the plugins are functional,
    for instance allowing updates of Thunderbolt controllers and Logitech
    Unifying devices. However, the LVFS is still disabled.
  - Resolves: #1313086


author: Peter Jones <pjones@redhat.com> - 9-6
changelog:
  - Rebuild to make some dependencies versioned, in order to make TPS's really
    broken builder setup work.
    Related: rhbz#1380825


author: Stephen Warren <s-t-rhbugzilla@wwwdotorg.org> - 2002_04_11-6
changelog:
  - Rework the spec file formatting to match templates from rpmdev
  - Be explicit about file attributes, just in case


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 4.0.0-1
changelog:
  - Remove gawk-3.1.8-syntax.patch, gawk-3.1.8-double-free-wstptr.patch
  - Update to upstream 4.0.0 (#717885)


author: Martin Bříza <mbriza@redhat.com> - 4.0.1-1
changelog:
  - Update to upstream 4.0.1 (#808005)
  - Corrected Source0 link to .tar.gz extension as not all releases are available as .tar.bz2
  - Resolves #724817 - gawk-4.0.0 regression in '\' escape handling in gsub()
  - Resolves #820550 - gawk: getline in BEGIN skips 2 lines


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-6
changelog:
  - temporarily revert PR middle-end/58956 to avoid libstdc++
    miscompilation on i?86 (PR middle-end/59470)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-7
changelog:
  - update from the 4.8 branch
    - PRs libgomp/59467, rtl-optimization/58295, target/56807,
  	testsuite/59442
    - fix LRA coalescing for real (PR middle-end/59470)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-10
changelog:
  - update from the 4.8 branch (#1052892)
    - PRs ada/55946, ada/59772, c++/56060, c++/58954, c++/59255, c++/59730,
  	fortran/57042, fortran/58998, fortran/59493, fortran/59612,
  	fortran/59654, ipa/59610, middle-end/59584, pch/59436,
  	rtl-optimization/54300, rtl-optimization/58668,
  	rtl-optimization/59137, rtl-optimization/59647,
  	rtl-optimization/59724, target/57386, target/59587, target/59625,
  	target/59652, testsuite/58630, tree-optimization/54570,
  	tree-optimization/59125, tree-optimization/59362,
  	tree-optimization/59715, tree-optimization/59745
  - default to -march=z196 instead of -march=z10 on s390/s390x (#1052890)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-12
changelog:
  - update from the 4.8 branch (#1052892)
    - PRs c++/59838, debug/54694, fortran/34547, fortran/58410,
  	middle-end/59827, middle-end/59860, target/58139, target/59142,
  	target/59695, target/59794, target/59826, target/59839
  - fix handling of initialized vars with flexible array members
    (#1035413, PR middle-end/28865)


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-13
changelog:
  - when removing -Wall from CXXFLAGS, if -Werror=format-security
    is present, add -Wformat to it, so that GCC builds on F21


author: Jakub Jelinek <jakub@redhat.com> 4.8.2-15
changelog:
  - fix exception spec instantiation ICE (#1067398, PR c++/60046)
  - fix pch on aarch64 (#1058991, PR pch/60010)
  - configure with --enable-gnu-indirect-function on architectures
    and distros that support it and don't support it by default
    yet (#1067245)
  - fix vector permutation handling on i?86/x86_64 (PR target/57896)
  - fix __atomic_compare_exchange_* not to store into *expected
    on success (PR c++/60272)
  - fix -march=native on VMs where saving/restoring of YMM state
    is not supported, yet CPU supports f16c (PR driver/60233)
  - add ref7.C testcase (PR c++/60274)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-1
changelog:
  - update from the 4.8 branch (#1230103)
    - GCC 4.8.5 release
    - fix -imacros handling (#1004526, PR c/57653)
    - fix up IPA type handling (#1217267, PRs ipa/63551, ipa/64153)
    - add PowerPC analyze swaps optimization pass (#1208103, #1200336)
    - fix PowerPC vsx_extract_<mode>* patterns (#1206341)
    - fix PowerPC -mcrypto handling (#1200335)
    - Power8 unaligned vectorization improvements (#1199221, PR target/65456)
    - PRs ada/47500, ada/63225, bootstrap/64213, c++/56710, c++/58624,
  	c++/63415, c++/63455, c++/64251, c++/64297, c++/64487, c++/65721,
  	c++/65727, c/52769, c/61553, c/64766, debug/63342, debug/65549,
  	fortran/56674, fortran/56867, fortran/57023, fortran/58813,
  	fortran/59016, fortran/59024, fortran/59488, fortran/60898,
  	fortran/61138, fortran/61407, fortran/63733, fortran/63744,
  	fortran/63938, fortran/64244, fortran/64528, fortran/65024,
  	gcov-profile/64634, inline-asm/63282, ipa/59626, ipa/63838,
  	libfortran/63589, libgfortran/59513, libgfortran/60956, libgomp/61200,
  	libstdc++/57440, libstdc++/59603, libstdc++/61947, libstdc++/63449,
  	libstdc++/63840, libstdc++/65279, libstdc++/65543, lto/65015,
  	lto/65193, middle-end/43631, middle-end/56917, middle-end/57748,
  	middle-end/58624, middle-end/59990, middle-end/63608,
  	middle-end/63665, middle-end/63704, middle-end/64067,
  	middle-end/64111, middle-end/64199, middle-end/64225,
  	middle-end/65409, middle-end/65680, middle-end/66133,
  	middle-end/66251, pch/65550, preprocessor/60436,
  	rtl-optimization/61058, rtl-optimization/63475,
  	rtl-optimization/63483, rtl-optimization/63659,
  	rtl-optimization/64037, rtl-optimization/64557, sanitizer/64265,
  	target/49423, target/52941, target/53988, target/55351, target/56846,
  	target/59593, target/60111, target/61413, target/62218, target/62642,
  	target/63335, target/63428, target/63673, target/63947, target/64113,
  	target/64115, target/64304, target/64358, target/64387, target/64409,
  	target/64452, target/64453, target/64479, target/64513, target/64579,
  	target/64580, target/64795, target/64882, target/64979, target/65138,
  	target/65163, target/65196, target/65286, target/65368, target/65787,
  	target/65849, target/66140, target/66148, target/66215, target/66275,
  	target/66470, target/66474, tree-optimization/59124,
  	tree-optimization/60656, tree-optimization/61634,
  	tree-optimization/61686, tree-optimization/61969,
  	tree-optimization/62031, tree-optimization/62167,
  	tree-optimization/63375, tree-optimization/63379,
  	tree-optimization/63551, tree-optimization/63593,
  	tree-optimization/63605, tree-optimization/63841,
  	tree-optimization/63844, tree-optimization/64269,
  	tree-optimization/64277, tree-optimization/64493,
  	tree-optimization/64495, tree-optimization/64563,
  	tree-optimization/65063, tree-optimization/65388,
  	tree-optimization/65518, tree-optimization/66123,
  	tree-optimization/66233, tree-optimization/66251,
  	tree-optimization/66272


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-3
changelog:
  - backport aarch64 crc enablement - -mcpu=generic+crc (#1179935)
  - rebuild against fixed binutils to fix up systemtap markers on aarch64
    (#1238462)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-5
changelog:
  - fix up libitm HTM fastpath (#1180633)
  - on ppc64le default to -mcpu=power8 instead of -mcpu=power7 (#1213268)
  - fix up size in .debug_pubnames (#1278872)
  - turn powerpc* HTM insns into memory barriers (#1282755, PR target/67281)
  - make sure to handle __builtin_alloca_with_align like alloca in
    -fstack-protector* (#1289022, PR tree-optimization/68680)
  - improve DW_AT_abstract_origin of DW_TAG_GNU_call_site on s390 with -fPIC
    (#1312436)
  - fix up libstdc++ pretty-printers (#1076690, PR libstdc++/53477)
  - don't pass explicit --oformat option to ld on powerpc* (#1296211)
  - backport Intel Memory Protection Keys ISA support - -mpku (#1304449)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-6
changelog:
  - backport s390 z13 support (#1182152)
  - fix up -fsanitize=address on powerpc64 with 46-bit virtual address space
    (#1312850)
  - throw exception on std::random_device::_M_getval() failure (#1262846,
    PR libstdc++/65142, CVE-2015-5276)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-8
changelog:
  - fix a bug in C++ ref-to-ptr conversion (#1344807)
  - fix combiner handling of jumps on aarch64 (#1344672,
    PR rtl-optimization/52714)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-9
changelog:
  - backport OpenMP 4.5 support to libgomp (library only; #1357060,
    PRs libgomp/68579, libgomp/64625)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-11
changelog:
  - on aarch64 emit scheduling barriers before stack deallocation in
    function epilogues (#1362635, PR target/63293)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-12
changelog:
  - fix up std::rethrow_exception (#1375711, PR libstdc++/62258)
  - use _Unwind_GetIPInfo in __gcc_personality_v0 (#1387402, PR libgcc/78064)
  - fix vec_vsx_ld/st on ppc64le (#1389801, PR target/72863, PR target/78084)
  - fix ICE in gfc_compare_derived_types (#1369183)
  - fix EH from C++ thunks (#1427412, PR ipa/68184)
  - on ppc64{,le} emit nop after recursive call if the current function
    is replaceable (#1420723, PR target/79439)
  - on aarch64 with -frounding-math use fnmul only with -(a*b) and not
    with (-a)*b (#1418446, PR target/66731)
  - constrain std::valarray functions and operators (#1416214,
    PR libstdc++/69116)
  - fix gimplification of aggregate assignments when lhs is used
    (#1396298, PR middle-end/72747, PR c/78408)
  - fix aarch64 TLS with -mcmodel=large (#1389276, PR target/78796)
  - fix aarch64 reloading of floating point constants into general purpose
    registers (#1349067, PR target/70549)
  - fix DW_AT_decl_line on DW_TAG_enumeration_type for C enumeration
    definitions following forward declarations (#1423460, PR c/79969)


author: Jakub Jelinek <jakub@redhat.com> 4.8.5-13
changelog:
  - add -mstack-protector-guard={tls,global}, -mstack-protector-guard-reg=
    and -mstack-protector-guard-offset= options on ppc* (#1415952,
    PR target/78875)


author: Marek Polacek <polacek@redhat.com> 4.8.5-20
changelog:
  - handle exceptions in basic_istream::sentry (#1469384)
  - don't run pr63354.c on ppc (#1468546)
  - ensure proxy privatization safety (#1491395)
  - fix incorrect codegen from rdseed intrinsic use (#1482762, CVE-2017-11671)
  - on aarch64, remove libatomic.so (#1465510)


author: Marek Polacek <polacek@redhat.com> 4.8.5-21
changelog:
  - fix 27_io/basic_fstream/53984.cc
  - fix for classes with bases with mutable members (PR c++/77375)
  - fix handling side-effects of parameters (PR c/77767)
  - fix combine's make_extraction (PR rtl-optimization/78378)
  - fix gimplification of const var initialization from COND_EXPR (PR c++/80129)
  - fix -A / -B to A / B folding (PR middle-end/80362)
  - fix comparison of decimal float zeroes (PR middle-end/80692)
  - fix __mulv[dt]i3 and expand_mul_overflow (PR target/82274)


author: Jeff Law <law@redhat.com> 4.8.5-24
changelog:
  - Sync gcc48-rh1469697-13 patch to upstream (#1469697)
  - Avoid probing in the red zone for noreturn functions (#1507980, #1469697)
  - Avoid infinite loop if probing interval is less than guard size (#1469697)
  - Fix debug information for large probing interval on aarch64 (#1469697)
  - Fix ICE on ppc port with large probing interval (#1469697)

  - rebuild to remove static relocations not known to older linkers (#1508968)


author: Jeff Law <law@redhat.com> 4.8.5-26
changelog:
  - Avoid red zone probing for zero residual dynamic allocation (#1469697)
  - Avoid bogus CFIs for probes in noreturn fucntions on x86/x86_64 (#1469697)


author: Marek Polacek <polacek@redhat.com> 4.8.5-28
changelog:
  - Minor testsuite fixes to clean up test results (#1469697)
  - retpoline support for spectre mitigation (#1535655)


author: Marek Polacek <polacek@redhat.com> 4.8.5-31
changelog:
  - backport s390 -mpic-data-is-text-relative feature (#1555397)
  - fix crash when write follows large read (#1463706)
  - fix emit_move_insn ICE (#1565536)
  - add missing rs6000-cpus.def (#1512202)


author: Marek Polacek <polacek@redhat.com> 4.8.5-34
changelog:
  - fix infinite looping in -fipa-cp-clone (#1546372)
  - don't look for vsld gcc.target/powerpc/pr72717.c


author: Marek Polacek <polacek@redhat.com> 4.8.5-38
changelog:
  - fix mode mismatch in prepare_cmp_insn (#1641329, PR target/63442)
  - allow libitm to use HTM (#1659698)
  - fix up memset handling in DSE (#1640805, PR rtl-optimization/69891)
  - fix bits/bytes confusion in set_noop_p (#1594975, PR rtl-optimization/68814)
  - enable initializing statics with COMPOUND_LITERAL_EXPR in C99
    (#1672652, PR c/63567)
  - fix PIC_OFFSET_TABLE_REGNUM (#1614326)
  - quash spurious -Wmissing-field-initializers warnings (#1633716, PR c/60784)
  - fix ICE with alias template (#1648161, PR c++/53658)


author: Marek Polacek <polacek@redhat.com> 4.8.5-43
changelog:
  - fix wrong code emitted for movv1qi on s390x (#1784759)
  - fix wrong code with EH due to a bug in LRA (#1800526)


author: Honza Horak <hhorak@redhat.com> - 2.0.35-19
changelog:
  - Spec file cleanup
  - Compile and run test suite during build
  - Using chrpath to get rid of --rpath in gd-progs


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.6.1-107.el7
changelog:
  - Fix backport of default signal handlers for spawned processes
    (RH BZ 1473411, found by Michal Kolar).


author: Keith Seitz <keiths@redhat.com> - 7.6.120.el7
changelog:
  - Don't classify struct members as filenames (numerous, RH BZ 1815690)
  - Fix commas in source paths bugs (Keith Seitz, RH BZ 1779246)


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.6.1-84.el7
changelog:
  - Add MPX instructions decoding (Intel, binutils RH BZ was 1138642).
  - Add clflushopt instruction decode (Intel, RH BZ 1262471).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.6.1-85.el7
changelog:
  - Add --with buildisa, remove %{?_isa} from BuildRequires (RH BZ 1286777):
    https://github.com/msimacek/koschei/issues/54


author: Honza Horak <hhorak@redhat.com> - 1.9.1-1
changelog:
  - Updated to new upstream release 1.9.1
  - Dropped -filestruct, -ndbmlock and -fhs patches, they are not 
    needed anymore and GDBM_NOLOCK is used always
  - Run testsuite


author: Honza Horak <hhorak@redhat.com> - 1.10-1
changelog:
  - Updated to new upstream release 1.10
  - Dropped -shortread patch, which has been already applied by upstream
  - Disable large file support, that is enabled by default since 1.9, 
    but not compatible with db files created using gdbm-1.8.3 and lower
  - License change to GPLv3+
  - Add doc files THANKS AUTHORS NOTE-WARNING
  - Changed text in NOTE-WARNING to correspond with build settings


author: Ray Strode <rstrode@redhat.com> - 3.14.2-18
changelog:
  - Fix unlock with XDMCP
    Resolves: #1315342
  - Inform remote display about session exiting when using
    XDMCP
    Resolves: #1313059


author: Ray Strode <rstrode@redhat.com> - 3.22.3-4
changelog:
  - Drop reference to wayland in config file
  - use autosetup to simplify spec maintenance
    Related: #1386862


author: Ray Strode <rstrode@redhat.com> 3.22.3-8
changelog:
  - Reap transient login screens when they are no longer needed
  - Jump to login screen if we end up on a blank VT
    Resolves: #1301028


author: Ray Strode <rstrode@redhat.com> - 3.22.3-10
changelog:
  - Add patches to try to maintain some semblance of compatibility
    when live upgrading between 7.3 and 7.4
    Related: #1448786


author: Ray Strode <rstrode@redhat.com> - 3.26.1-1
changelog:
  - Update to 3.26.1
    Resolves: #1489359
    Related:  #1481740
  - Enable wayland support
    Resolves: #1481740
  - Fix bogus wtmp entries
    Resolves: #1391156


author: Ray Strode <rstrode@redhat.com> - 3.26.2.1-1
changelog:
  - Update to 3.26.2.1
    Integrates a lot of the downstream patches
    Related: #1481740
  - Fixes race condition introduced by list display patch
    Related: #1413900


author: Ray Strode <rstrode@redhat.com> - 3.28.2-15
changelog:
  - sync AllowMultipleSessionsPerUser patch from 7.6 branch
    Resolves: #1664353
  - Create dconf dirs by default
    Resolves: #1664284


author: Ray Strode <rstrode@redhat.com> 3.8.4-18
changelog:
  - Make sure pam_gnome_keyring gets notified when the password is changed
    in the middle of first login.
    Resolves: #1075714


author: Ray Strode <rstrode@redhat.com> 3.8.4-26
changelog:
  - Adjust path setting logic one more time to preserve
    /sbin and /bin ordering
    Related: #1080153
    Resolves: 1091053


author: Ray Strode <rstrode@redhat.com> - 3.14.3-17
changelog:
  - Fix close after save functionality when closing window
    with unsaved documents
    Resolves: #1247999


author: Nils Philippsen <nils@redhat.com> - 0.2.0-11
changelog:
  - replace lua-5.2 patch by upstream commit
  - fix buffer overflow in and add plausibility checks to ppm-load op
    (CVE-2012-4433)
  - fix multi-lib issue in generated documentation


author: Paul Howarth <paul@city-fan.org> - 2.2.1-2
changelog:
  - Split patch for upstream issue #26 into separate patches for upstream changes
    and effect of running autotools


author: Paul Howarth <paul@city-fan.org> - 2.2.2-1
changelog:
  - Update to 2.2.2
    - geoipupdate now calls fsync on the database directory after a rename to
      make it durable in the event of a crash
  - Update autotools patch


author: Paul Howarth <paul@city-fan.org> - 2.3.1-1
changelog:
  - Update to 2.3.1
    - geoipupdate now uses TCP keep-alive when compiled with cURL 7.25 or
      greater
    - Previously, on an invalid gzip file, geoipupdate would output binary data
      to stderr; it now displays an appropriate error message
    - Install README, ChangeLog, GeoIP.conf.default etc. into docdir (GH#33)
    - $(sysconfdir) is now created if it doesn't exist (GH#33)
    - The sample config file is now usable (GH#33)


author: Paul Howarth <paul@city-fan.org> - 2.4.0-1
changelog:
  - Update to 2.4.0
    - geoipupdate now checks that the database directory is writable: if it is
      not, it reports the problem and aborts
    - geoipupdate now acquires a lock when starting up to ensure only one
      instance may run at a time: a new option, 'LockFile', exists to set the
      file to use as a lock ('.geoipupdate.lock' in the database directory by
      default)
    - geoipupdate now prints out additional information from the server when a
      download request results in something other than HTTP status 2xx; this
      provides more information when the API does not respond with a database
      file
    - ${datarootdir}/GeoIP is now created on 'make install' (GH#29)
    - Previously, a variable named 'ERROR' was used, which caused issues building
      on Windows (GH#36)
  - Drop EL-5 support
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section
    - noarch subpackages always available now
    - libcurl-devel always available now


author: Paul Howarth <paul@city-fan.org> - 2.5.0-1
changelog:
  - Update to 2.5.0
    - Replace use of strnlen() due to lack of universal availability (GH#71)
    - Document the 'LockFile' option in the 'GeoIP.conf' man page (GH#64)
    - Remove unused base64 library (GH#68)
    - Add the new configuration option 'PreserveFileTimes'; if set, the
      downloaded files will get the same modification times as their original on
      the server (default is '0') (GH#63)
    - Use the correct types when calling 'curl_easy_setopt()'; this fixes
      warnings generated by libcurl's 'typecheck-gcc.h' (GH#61)
    - In 'GeoIP.conf', the 'UserId' option was renamed to 'AccountID' and the
      'ProductIds' option was renamed to 'EditionIDs'; the old options will
      continue to work, but upgrading to the new names is recommended for
      forward compatibility


author: Michal Ruprich <mruprich@redhat.com> - 20180605-1
changelog:
  - Resolves: #1643472 - Add geolite2 package
  - Lowering the NVR due to the package version in el8. Higher NVR could make problems during migration from el7 to el8


author: Jens Petersen <petersen@redhat.com> - 0.18.1.1-13
changelog:
  - base package now provides bundled(gnulib) to make it clear that
    gettext is built with bundled gnulib (#821757)


author: Pavel Raiskup <praiskup@redhat.com> - 0.19.8.1-7
changelog:
  - really remove Requires: git from gettext-devel (rhbz#1161284)
  - make the BuildRequires unconditional (rhbz#1416691)


author: Andrew Price <anprice@redhat.com> - 3.1.10-1
changelog:
  - Rebase to new upstream version 3.1.10
    Resolves: rhbz#1348601
    Resolves: rhbz#1356685
    Resolves: rhbz#1382087
    Resolves: rhbz#1405163
    Resolves: rhbz#1430399
  - Make dependency on libuuid explicit


author: Andrew Price <anprice@redhat.com> - 3.1.10-3
changelog:
  - libgfs2: Issue one write per rgrp when creating them
  - mkfs.gfs2: Fix resource group alignment issue
  - mkfs.gfs2: Free unnecessary cached pages, disable readahead
    Resolves: rhbz#1440269


author: Andrew Price <anprice@redhat.com> - 3.1.10-5
changelog:
  - Update URL in spec file
    Resolves: rhbz#1501738
  - fsck.gfs2: Make -p, -n and -y conflicting options
    Resolves: rhbz#1507091


author: Andrew Price <anprice@redhat.com> - 3.1.10-9
changelog:
  - fsck.gfs2: Don't check fs formats we don't recognise
  - libgfs2: Fix pointer cast byte order issue
    Resolves: rhbz#1616389


author: Andrew Price <anprice@redhat.com> - 3.1.10-10
changelog:
  - libgfs2: Use sizeof for 'reserved' fields in ondisk.c
  - fsck.gfs2: Disambiguate 'check_data'
  - gfs2-utils: Accept a char* instead of a buffer head in gfs2_check_meta
  - fsck.gfs2: Disambiguate check_metalist
  - fsck.gfs2: Fix segfault in build_and_check_metalist
  - fsck.gfs2: Retain context for indirect pointers in ->check_metalist
  - fsck.gfs2: Clear bad indirect block pointers when bitmap meets expectations
    Resolves: rhbz#1487726


author: Andrew Price <anprice@redhat.com> - 3.1.10-11
changelog:
  - gfs2_jadd: Handle out-of-space issues
  - gfs2_jadd: error handling overhaul
    Resolves: rhbz#1837640


author: Andrew Price <anprice@redhat.com> - 3.1.8-4
changelog:
  - fsck.gfs2: Change duptree structure to have generic flags
  - fsck.gfs2: Detect, fix and clone duplicate block refs within a dinode
    Resolves: rhbz#1236669


author: Andrew Price <anprice@redhat.com> - 3.1.8-5
changelog:
  - gfs2-utils: Fix hang on withdraw (4 patches)
  - Include new withdraw helper scripts in files section
    Resolves: rhbz#1225634


author: Andrew Price <anprice@redhat.com> - 3.1.9-1
changelog:
  - Rebase to new upstream release 3.1.9
    Resolves: rhbz#1271674
    Resolves: rhbz#1162819
    Resolves: rhbz#1196321
    Resolves: rhbz#1202814
    Resolves: rhbz#1251036
    Resolves: rhbz#1257625
    Resolves: rhbz#1268045
    Resolves: rhbz#1283866
    Resolves: rhbz#1332728


author: Andrew Price <anprice@redhat.com> - 3.1.9-2
changelog:
  - fsck.gfs2: "undo" functions can stop too early on duplicates
    Resolves: rhbz#1348703
  - fsck.gfs2: link count checking wrong inode's formal inode number
    Resolves: rhbz#1350597
  - fsck.gfs2: check formal inode number when links go from 1 to 2
    Resolves: rhbz#1350600


author: Andrew Price <anprice@redhat.com> - 3.1.6-3
changelog:
  - fsck.gfs2: Add the ability to detect journal inode indirect block corruption
    Resolves: rhbz#990683
  - gfs2_grow: Don't try to open an empty string
    Resolves: rhbz#991204


author: Andrew Price <anprice@redhat.com> - 3.1.6-5
changelog:
  - gfs2-utils tests: Switch to autotest
    Resolves: rhbz#1000066
  - fsck.gfs2: Allocate enough space for the block map (2 patches)
    Resolves: rhbz#1001583


author: Andrew Price <anprice@redhat.com> - 3.1.6-10
changelog:
  - libgfs2: Add lgfs2_open_mnt* functions
  - Switch is_pathname_mounted callers to lgfs2_open_mnt*
  - libgfs2: Remove is_pathname_mounted
    Resolves: rhbz#991204


author: Andrew Price <anprice@redhat.com> - 3.1.6-13
changelog:
  - gfs2_edit: Convert fssize to bytes before reporting fs size
  - mkfs.gfs2 tests: Enable debug output
    Resolves: rhbz#1059443
  - libgfs2: Superblock building and writing improvements
  - gfs2-utils: Ensure sb_uuid uses are guarded
  - libgfs2: Add support for new leaf hint fields
    Resolves: rhbz#1063842


author: Andrew Price <anprice@redhat.com> - 3.1.7-6
changelog:
  - fsck.gfs2: fix broken i_goal values in inodes
  - gfs2_convert: use correct i_goal values instead of zeros for inodes
  - tests: test for incorrect inode i_goal values
  - fsck.gfs2: Reprocess nodes if anything changed - addendum 1 of 2
  - fsck.gfs2: addendum to fix broken i_goal values in inodes - addendum 2 of 2
    Resolves: rhbz#1178604


author: Andrew Price <anprice@redhat.com> - 3.1.8-1
changelog:
  - Rebase to new upstream version 3.1.8
    Resolves: rhbz#1184482
    Resolves: rhbz#1153316
    Resolves: rhbz#1154726
    Resolves: rhbz#1162216
    Resolves: rhbz#1165285
    Resolves: rhbz#1186515
    Resolves: rhbz#1186847
    Resolves: rhbz#1194446
    Resolves: rhbz#1195394


author: Tim Waugh <twaugh@redhat.com> 9.07-10
changelog:
  - Added in missing part of gs_sprintf backport: add in the header to
    stdio_.h. Without this there are problems with va_args on some
    platforms (bug #979681).


author: Tim Waugh <twaugh@redhat.com> 9.07-18
changelog:
  - Applied patch from upstream to fix memory handling issue that could
    lead to crashes (bug #1105519).


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-19
changelog:
  - Import LCMS2 2.6 rebase changes into ghostscript (bug #959351)
  - Fix hanging of ghostscript when converting PDF -> PNG (bug #1302121)
  - Do not SIGSEGV after icc_profile error, report error instead (bug #1243784)
  - Fix the color printing on HP InkJet printers (bug #1225858)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-21
changelog:
  - Added security fixes for:
    - CVE-2013-5653 (bug #1380327)
    - CVE-2016-7977 (bug #1380415)
    - CVE-2016-7978 (bug #1382300)
    - CVE-2016-7979 (bug #1382305)
    - CVE-2016-8602 (bug #1383940)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-25
changelog:
  - Added security fix for CVE-2017-7207 (bug #1434353)
  - Added explicit requirement for lcms2 version we are build with (bug #1436273)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-29
changelog:
  - Fix rare Segmentation fault when converting PDF to PNG (bug #1473337)
  - Raise the default VMThreshold from 1Mb to 8Mb (bug #1479852)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-31
changelog:
  - Added security fixes for:
    - CVE-2018-16509 (bug #1621158)
    - CVE-2018-15910 (bug #1621160)
    - CVE-2018-16542 (bug #1621382)


author: Martin Osvald <mosvald@redhat.com> - 9.07-32
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621385 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1649722 - CVE-2018-16539 ghostscript: incorrect access checking
    in temp file handling to disclose contents of files (699658) 
  - Resolves: #1621162 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621384 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)
  - Resolves: #1652902 - CVE-2018-16863 ghostscript: incomplete fix for
    CVE-2018-16509
  - Resolves: #1654045 ghostscript update breaks xdvi (gs: Error: /undefined in flushpage)
  - Resolves: #1651150 - CVE-2018-15911 ghostscript: uninitialized memory
    access in the aesdecode operator (699665)
  - Resolves: #1650061 - CVE-2018-16802 ghostscript: Incorrect "restoration of
    privilege" checking when running out of stack during exception handling
  - Resolves: #1652936 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c
  - Resolves: #1654622 - CVE-2018-16541 ghostscript: incorrect free logic in
    pagedevice replacement (699664)
  - Resolves: #1650211 - CVE-2018-17183 ghostscript: User-writable error
    exception table
  - Resolves: #1645517 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1648892 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1643117 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1655939 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)
  - Resolves: #1657694 - ghostscript: Regression: Warning: Dropping incorrect
    smooth shading object (Error: /rangecheck in --run--)
  - Resolves: #1661210 pdf2ps reports an error when reading from stdin
  - Resolves: #1657334 - CVE-2018-16540 ghostscript: use-after-free in
    copydevice handling (699661)
  - Resolves: #1660570 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660829 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661279 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)
  - Resolves: #1667443 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata


author: Martin Osvald <mosvald@redhat.com> - 9.25-1
changelog:
  - Rebase to latest upstream version (bug #1636115)
  - Resolves: #1673399 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - Resolves: #1678172 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1680026 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - fix for pdf2dsc regression added to allow fix for CVE-2019-3839


author: Tim Waugh <twaugh@redhat.com> 5.50-22
changelog:
  - Further changes from package review (bug #225794):
    - Don't use umask in scriptlet.
    - Don't use 'which' in scriptlet.


author: Robert Scheck <robert@fedoraproject.org> 4.1.6-2
changelog:
  - Solved multilib problems with documentation (#465208, #474538)
  - Removed static library from giflib-devel package (#225796 #c1)


author: Nils Philippsen <nils@redhat.com> - 2.0.2-0.2
changelog:
  - don't require gimptool file, but gimp-devel-tools package for building
  - merge review (#225797)
    - don't require /usr/share/gimp/2.0 directory, but specific minimum gimp
      version
    - work around problematic gimpdatadir macro definition if gimptool is not
      available


author: Nils Philippsen <nils@redhat.com> - 2.8.0-1
changelog:
  - version 2.8.0
  - add po files missing in tarball
  - add new build requirements: dblatex, graphviz, pngnq, pngcrush
  - fix file list generation


author: Nils Philippsen <nils@redhat.com> - 2.8.1-1
changelog:
  - version 2.8.1
  - reenable parallel building
  - add Brazilian Portuguese translation
  - remove (empty) translations: Finnish, Hungarian, Lithuanian, Polish
  - fix translation that makes xml2po.py/libxml2 crash


author: Petr Stodulka <pstodulk@redhat.com> -1.8.3.1-9
changelog:
  - add control of GSSAPI credential delegation to enable HTTP(S)-SSO
    authentication
    Resolves: #1369173


author: Petr Stodulka <pstodulk@redhat.com> - 1.8.3.1-13
changelog:
  - fall back to Basic auth if Negotiate fails
    Resolves: #1490998
  - handle request-pull when multiple tags point to the same commit
    Resolves: #1192146


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-14
changelog:
  - Backport fix for CVE-2018-11235
  - Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-15
changelog:
  - move instaweb to separate git-instaweb subpackage.
  	Resolves: #1213059
  - move gnome-keyring to a separate git-gnome-keyring subpackage.
  	Resolves: #1284081


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-16
changelog:
  - Remove EL-5 settings and old Fedora conditionals.
    Taken from fedora commits 903d8f35ed8ae16bece8ae8033f3d3926cc97595 and
    2c6eff99d7b50b87e8a1fe2e4a0489dfd90659b8.
  - Fix builds using '--without docs'
  - Change git-instaweb default from lighttpd(not available in rhel7) to
    apache2.
  - Add requires for git-{instaweb,gnome-keyring} to pull them, when
    installing git-all.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-17
changelog:
  - Correctly return an error from fsck on encountering a .gitmodules symlink.
    This was broken in the debian 2.1.x backport and found by covscan.
    Fix the test to catch this.
  - Correct a typo in changelog.


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-19
changelog:
  - Fix httpd modules path to be independent from system architecture.
  Upstream commit: 1976311aa285549599e5a451d7ad72b55a2b60e2
  Resolves: #1213059


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-20
changelog:
  - Fix CVE-2018-17456: arbitrary code execution via .gitmodules
    Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Todd Zullinger <tmz@pobox.com> - 1.8.1.4-2
changelog:
  - Update asciidoc requirements, drop unsupported ASCIIDOC7
  - Define GNU_ROFF to force ASCII apostrophes in manpages (so copy/paste works)
  - Install tcsh completion (requires manual setup by users)
  - Clean up dist conditionals, don't pretend to support EL-4 builds
  - Use prebuilt documentation on EL-5, where asciidoc is too old
  - Respect gitexecdir variable in git-subtree install


author: Todd Zullinger <tmz@pobox.com> - 1.8.2-2
changelog:
  - Require perl(Term::ReadKey) for git add --interactive (#928328)
  - Drop DESTDIR from python instlibdir
  - Fix bogus changelog dates


author: Yanko Kaneti <yaneti@declera.com> - 1.1-5.20130122
changelog:
  - Newer upstream snapshot. Minor upstream rearrangement.
  - Remove checkout script from sources and add to git.
  - Try to actually use the bundled mathml2. Fix warnings.


author: Kalev Lember <kalevlember@gmail.com> - 3.14.2-2
changelog:
  - Revise the summary for consistency with the parallel installable
    glade2/glade3 packages (#882557)


author: Kalev Lember <kalevlember@gmail.com> - 2:3.8.2-1
changelog:
  - Revert back to gtk2-based 3.8.2 -- following upstream, the gtk3
    version is now in 'glade' package (#731227)


author: Mikolaj Izdebski <mizdebsk@redhat.com> 2.2.1-4
changelog:
  - Change OSGi Bundle-SymbolicName to better match Eclipse needs
  - Update URL
  - Resolves: rhbz#868169


author: Colin Walters <walters@redhat.com> - 2.36.3-5
changelog:
  - Backport patch to fix gnome-shell lockups
    Resolves: #1030601
  - Backport patch to fix vmtoolsd hangs
    Resolves: #1063789


author: Richard Hughes <rhughes@redhat.com> - 2.42.2-2
changelog:
  - Update to 2.42.2
  - [walters] Switch to autosetup -Sgit for less painful patch management
  - [walters] Actually forward port patches
  - Resolves: #1203755


author: Colin Walters <walters@redhat.com> - 2.46.2-3
changelog:
  - Rebase to 2.46.2
  - Backport two additional notable+applicable patches from upstream
    branch
  - Resolves: #1305515


author: Colin Walters <walters@verbum.org> - 2.54.1-3
changelog:
  - Backport patch to fix invocations of /bin/gdbus-codegen
  - Related: #1481386
    See also bug 1507661


author: Carlos O'Donell <carlso@redhat.com> - 2.17-146
changelog:
  - s390: Restore signal mask on setcontext/swapcontext (#1249114).
  - s390: Fix backtrace in the presence of makecontext (#1249115).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-188
changelog:
  - Improve exp() and pow() performance in libm (#1409611)
  - Add optimized strcmp and strncmp for IBM POWER9 hardware (#1320947)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-190
changelog:
  - Add transparent lock elision for default POSIX mutexes on
    Intel hardware with support for Intel TSX (#841653).
  - Update dynamic loader trampoline for Intel Skylake server (#1421155).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-191
changelog:
  - Add transparent lock elision for default POSIX mutexes on
    IBM POWER hardware with support for IBM POWER HTM (#731835).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-192
changelog:
  - Exclude lock elision support for older Intel hardware with
    Intel TSX that has hardware errata (#841653).


author: Florian Weimer <fweimer@redhat.com> - 2.17-215
changelog:
  - CVE-2017-15670: glob: Fix one-byte overflow with GLOB_TILDE (#1504809)
  - CVE-2017-15804: glob: Fix buffer overflow in GLOB_TILDE unescaping (#1504809)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-221
changelog:
  - CVE-2018-1000001: Fix realpath() buffer underflow (#1534635)
  - i386: Fix unwinding for 32-bit C++ application (#1529982)
  - Reduce thread and dynamic loader stack usage (#1527904)
  - x86-64: Use XSAVE/XSAVEC more often during lazy symbol binding (#1528418)


author: Carlos O'Donell <carlos@redhat.com> 2.17-256
changelog:
  - CVE-2017-16997: Correctly handle DT_RPATH (#1540480).
  - Correctly process "$ORIGIN" element in DT_RPATH or DT_NEEDED (#1447808).


author: Carlos O'Donell <carlos@redhat.com> - 2.17-258
changelog:
  - Fix dynamic string token substitution in DT_RPATH etc. (#1447808, #1540480)
  - Additional robust mutex fixes (#1401665)


author: Patsy Franklin <pfrankli@redhat.com> - 2.17-260
changelog:
  - Update glibc-rh1560641.patch to initialize pad outside
    the conditional eliminating an uninitialized byte warning from
    valgrind. (#1560641)


author: Patsy Griffin <pfrankli@redhat.com> - 2.17-297
changelog:
  - Add compiler barriers around modifications of the robust mutex list
    for pthread_mutex_trylock. (#1672771)


author: Patsy Griffin <pfrankli@redhat.com> - 2.17-299
changelog:
  - Update glibc headers for Linux 4.0, 4.1 definitions and 
    Linux 4.2 netinet/in.h values. (#1579451)


author: Arjun Shankar <arjun@redhat.com> - 2.17-308
changelog:
  - CVE-2019-19126: rtld: Check __libc_enable_secure before honoring
    LD_PREFER_MAP_32BIT_EXEC (#1775599)


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-45
changelog:
  - Revert to flushing buffer for ftell if output buffer does not have sufficient
    space for conversion (#1048036).
  - Use first name entry for address in /etc/hosts as the canonical name in
    getaddrinfo (#1047983).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.17-53
changelog:
  - Fix offset caching for streams and use it for ftell (#1074410).
  - Change offset in fdopen only if setting O_APPEND (#1074410).
  - Fix up return codes for tests in tst-ftell-active-handler (#1074410).


author: Joonas Sarajärvi <muep@iki.fi> - 0.9.5.2-3
changelog:
  - Reduce test array size to avoid memory allocation failure in tests
  - Resolve a number of aliasing warnings
  - Disable the packing test


author: Milind Changire <mchangir@redhat.com> - 3.12.2-8
changelog:
  - fixes bugs bz#1466129 bz#1475779 bz#1523216 bz#1535281 bz#1546941 
    bz#1550315 bz#1550991 bz#1553677 bz#1554291 bz#1559452 bz#1560955 bz#1562744 
    bz#1563692 bz#1565962 bz#1567110 bz#1569457


author: Milind Changire <mchangir@redhat.com> - 3.12.2-9
changelog:
  - fixes bugs bz#1546717 bz#1557551 bz#1558948 bz#1561999 bz#1563804 
    bz#1565015 bz#1565119 bz#1565399 bz#1565577 bz#1567100 bz#1567899 bz#1568374 
    bz#1568969 bz#1569490 bz#1570514 bz#1570541 bz#1570582 bz#1571645 bz#1572087 
    bz#1572585 bz#1575895


author: Milind Changire <mchangir@redhat.com> - 3.12.2-10
changelog:
  - fixes bugs bz#1488120 bz#1565577 bz#1568297 bz#1570586 bz#1572043 
    bz#1572075 bz#1575840 bz#1575877


author: Milind Changire <mchangir@redhat.com> - 3.12.2-13
changelog:
  - fixes bugs bz#1493085 bz#1518710 bz#1554255 bz#1558948 bz#1558989 
    bz#1559452 bz#1567001 bz#1569312 bz#1569951 bz#1575539 bz#1575557 bz#1577051 
    bz#1580120 bz#1581184 bz#1581553 bz#1581647 bz#1582119 bz#1582129 bz#1582417 
    bz#1583047 bz#1588408 bz#1592666 bz#1594658


author: Milind Changire <mchangir@redhat.com> - 3.12.2-14
changelog:
  - fixes bugs bz#1547903 bz#1566336 bz#1568896 bz#1578716 bz#1581047 
    bz#1581231 bz#1582066 bz#1593865 bz#1597506 bz#1597511 bz#1597654 bz#1597768 
    bz#1598105 bz#1598356 bz#1599037 bz#1599823 bz#1600057 bz#1601314


author: Milind Changire <mchangir@redhat.com> - 3.12.2-16
changelog:
  - fixes bugs bz#1569657 bz#1608352 bz#1609163 bz#1609724 bz#1610825 
    bz#1611151 bz#1612098 bz#1615338 bz#1615440


author: Milind Changire <mchangir@redhat.com> - 3.12.2-41
changelog:
  - fixes bugs bz#1390151 bz#1410145 bz#1429190 bz#1510752 bz#1511779 
    bz#1570958 bz#1574490 bz#1595246 bz#1618669 bz#1661393 bz#1668989 bz#1669020


author: Ravishankar N<ranaraya@redhat.com> - 3.4.0.52rhs-1
changelog:
  - fixes bugs in guota, gNFS, glusterd, afr etc.
    1024371, 1024316, 1021776, 1043535, 1019908, 965400, 1020816


author: Arumugam Balamurugan <barumuga@redhat.com> - 3.4.0.53rhs-1
changelog:
  - fixes bug 916857 1005663 1032034 1046294 1046318 1042830 1045313
    1046571 1046604 1045991 1022822 1031687 1045374 972021


author: Milind Changire <mchangir@redhat.com> - 3.7.9-2
changelog:
  - fixes bugs bz#1321509 bz#1322765 bz#1314724 bz#1242358 bz#1317790 
    bz#1314391 bz#1318428 bz#1298724 bz#1318170 bz#1283957 bz#1302355 bz#1318427 
    bz#1325750 bz#1309437 bz#1317940 bz#1302688 bz#1320412 bz#1289439 bz#1294062 
    bz#1300875 bz#1305456 bz#1115367 bz#1118770 bz#1314373 bz#1314421 bz#1294790 
    bz#1317908 bz#1323119 bz#1248998 bz#1231150 bz#1311686 bz#1321544 bz#1298955 
    bz#1292034 bz#1319406 bz#1303591 bz#1279628


author: Milind Changire <mchangir@redhat.com> - 3.7.9-3
changelog:
  - fixes bugs bz#1325975 bz#1311839 bz#1321556 bz#1286911 bz#1323042 
    bz#1298724 bz#1327165 bz#1101702 bz#1326498 bz#1326663 bz#1328397 bz#1330881 
    bz#1331376 bz#1330901 bz#1326248 bz#1324338 bz#1115367 bz#1308837 bz#1322695 
    bz#1322247 bz#1329895 bz#1327552 bz#1118770


author: Milind Changire <mchangir@redhat.com> - 3.7.9-4
changelog:
  - fixes bugs bz#1097555 bz#1322306 bz#1327195 bz#1324820 bz#1306194 
    bz#1298724 bz#1299737 bz#1330385 bz#1258875 bz#1283957 bz#1311362 bz#1321550 
    bz#1332199 bz#1329514 bz#1224180 bz#1313370 bz#1328194 bz#1323424 bz#1332957 
    bz#1294755 bz#1328411 bz#1327751 bz#1332077 bz#1328721 bz#1330365


author: Milind Changire <mchangir@redhat.com> - 3.7.9-5
changelog:
  - fixes bugs bz#1261838 bz#1324820 bz#1325760 bz#1328194 bz#1331260 
    bz#1332949 bz#1333668 bz#1334234 bz#1334668 bz#1334985 bz#1335082 bz#1335114 
    bz#1335364 bz#1335437 bz#1335505 bz#1335826


author: Milind Changire <mchangir@redhat.com> - 3.7.9-7
changelog:
  - fixes bugs bz#1286582 bz#1330997 bz#1334092 bz#1337384 bz#1337649 
    bz#1339090 bz#1339163 bz#1339208 bz#1340085 bz#1340383


author: Milind Changire <mchangir@redhat.com> - 3.8.4-8
changelog:
  - fixes bugs bz#1393694 bz#1397450 bz#1398188 bz#1399100 bz#1400365 
    bz#1401380 bz#1401806 bz#1401817


author: Milind Changire <mchangir@redhat.com> - 3.8.4-9
changelog:
  - fixes bugs bz#1400057 bz#1400068 bz#1400093 bz#1400599 bz#1402774 
    bz#1403120 bz#1403587 bz#1403770 bz#1403840 bz#1404996 bz#1405299


author: Milind Changire <mchangir@redhat.com> - 3.8.4-10
changelog:
  - fixes bugs bz#1393316 bz#1398311 bz#1398798 bz#1403672 bz#1404110 
    bz#1404633 bz#1404982 bz#1405000 bz#1406025 bz#1406401


author: Milind Changire <mchangir@redhat.com> - 3.8.4-11
changelog:
  - fixes bugs bz#1393316 bz#1404989 bz#1405000 bz#1408112 bz#1408413 
    bz#1408426 bz#1408836 bz#1409472 bz#1409782 bz#1409808


author: Milind Changire <mchangir@redhat.com> - 3.8.4-14
changelog:
  - fixes bugs bz#1408576 bz#1408705 bz#1409563 bz#1411270 bz#1413513 
    bz#1414247 bz#1414663 bz#1415583 bz#1417955 bz#1418011


author: Milind Changire <mchangir@redhat.com> - 3.8.4-15
changelog:
  - fixes bugs bz#1205162 bz#1315544 bz#1403180 bz#1409135 bz#1415101 
    bz#1417177 bz#1418901 bz#1420635 bz#1422431


author: Milind Changire <mchangir@redhat.com> - 3.8.4-45
changelog:
  - fixes bugs bz#1475326 bz#1475331 bz#1475333 bz#1475334 bz#1475721 
    bz#1482994 bz#1486115 bz#1488018 bz#1488020 bz#1488860


author: Milind Changire <mchangir@redhat.com> - 6.0-2
changelog:
  - fixes bugs bz#1471742 bz#1652461 bz#1671862 bz#1676495 bz#1691620 
    bz#1696334 bz#1696903 bz#1697820 bz#1698436 bz#1698728 bz#1699709 bz#1699835 
    bz#1702240


author: Rinku Kothiya <rkothiya@redhat.com> - 6.0-3
changelog:
  - fixes bugs bz#1583585 bz#1671862 bz#1702686 bz#1703434 bz#1703753 
    bz#1703897 bz#1704562 bz#1704769 bz#1704851 bz#1706683 bz#1706776 bz#1706893


author: Rinku Kothiya <rkothiya@redhat.com> - 6.0-4
changelog:
  - fixes bugs bz#1480907 bz#1702298 bz#1703455 bz#1704181 bz#1707246
    bz#1708067 bz#1708116 bz#1708121 bz#1709087 bz#1711249 bz#1711296 
    bz#1714078 bz#1714124 bz#1716385 bz#1716626 bz#1716821 bz#1716865 bz#1717927


author: Sunil Kumar Acharya <sheggodu@redhat.com> - 6.0-5
changelog:
  - fixes bugs bz#1573077 bz#1694595 bz#1703434 bz#1714536 bz#1714588 
    bz#1715407 bz#1715438 bz#1705018


author: Sunil Kumar Acharya <sheggodu@redhat.com> - 6.0-6
changelog:
  - fixes bugs bz#1668001 bz#1708043 bz#1708183 bz#1710701 
    bz#1719640 bz#1720079 bz#1720248 bz#1720318 bz#1720461


author: Sunil Kumar Acharya <sheggodu@redhat.com> - 6.0-7
changelog:
  - fixes bugs bz#1573077 bz#1600918 bz#1703423 bz#1704207 bz#1708064
    bz#1709301 bz#1713664 bz#1716760 bz#1717784 bz#1720163 bz#1720192
    bz#1720551 bz#1721351 bz#1721357 bz#1721477 bz#1722131 bz#1722331
    bz#1722509 bz#1722801 bz#1720248


author: Sunil Kumar Acharya <sheggodu@redhat.com> - 6.0-8
changelog:
  - fixes bugs bz#1698435 bz#1712591 bz#1715447 bz#1720488 bz#1722209
    bz#1722512 bz#1724089 bz#1726991 bz#1727785 bz#1729108


author: Sunil Kumar Acharya <sheggodu@redhat.com> - 6.0-12
changelog:
  - fixes bugs bz#1730914 bz#1731448 bz#1732770 bz#1732792 bz#1733531 
    bz#1734305 bz#1734534 bz#1734734 bz#1735514 bz#1737705 bz#1732774
    bz#1732793


author: Rinku Kothiya <rkothiya@redhat.com> - 6.0-23
changelog:
  - fixes bugs bz#1344758 bz#1599802 bz#1685406 bz#1686800 bz#1724021 
    bz#1726058 bz#1727755 bz#1731513 bz#1741193 bz#1758923 bz#1761326 bz#1761486 
    bz#1762180 bz#1764095 bz#1766640


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1:5.1.0-1
changelog:
  - rebase to 5.1.0, de-ansi patch no longer applicable
  - upstream dropped libmp.so (bsdmp-like interface)
  - silenced bogus date in changelog


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 1:6.0.0-13
changelog:
  - Explicitly added '-g' option into CFLAGS & CXXFLAGS to correctly build .debug_info for i386 (bug #1413034)
  - Added a workaround to correctly add hardening flags during build process (bug #1406689)


author: Jakub Filak <jfilak@redhat.com> 0.3.0-1
changelog:
  - Do not include url files twice
  - Get rid of Stock Items usage
  - Do not remove invalid problems while sorting the list
  - Check if X display can be opened
  - Fix a condition in the source changed notification handler
  - Update Translations
  - Skip inotify events for sub folders in dump location watcher
  - Use GLib.io_add_watch() instead of IOChanell.add_watch()
  - Fix a typo in macro name
  - Remove shebang from non-executable scripts
  - Remember missing elements and load them only once
  - Download more problem elements in a single D-Bus call
  - Improve data caching
  - Display two sets of problems (My/System)
  - Fix typo in dbus error message
  - Don't crash if a new directory problem is invalid
  - Resolves: #956912, #973125, #967499


author: Jakub Filak <jfilak@redhat.com> 0.3.1-1
changelog:
  - Improve user experience
  - Make About dialog transient for the main window
  - Add AppData file
  - Ship the 256x256 icon in the right place
  - Recover from fork errors
  - Add ABRT configure application menu
  - Use absolute path in python shebang
  - Recover from invalid time stamp values
  - Use wrapped text for the bug report link
  - Resolves: #994749, #995337, #995868, #1005472


author: Jakub Filak <jfilak@redhat.com> 0.3.4-1
changelog:
  - Do not use deprecated GObject API
  - Make gnome-abrt compatible with Python GObject < 3.7.2
  - Do not fail if there is no Problem D-Bus service
  - Make all labels selectable
  - Run xdg-open for problem directory nonblocking
  - Fix translations (rhbz#1044241)
  - Make problem list resizable
  - Make info about Reported state of problem more clear
  - Remove message about missing Bugzilla ticket
  - Fix a bug in SIGCHLD handler causing 100% CPU usage
  - Show "yes" in Reported field only if no URL is available
  - Load only the most recent reported to value
  - Check if Application has valid name in filter fn
  - Fix issues found by new pylint
  - Related: #1044241
  - Resolves: #1044569


author: Jakub Filak <jfilak@redhat.com> - 0.3.4-3
changelog:
  - Select multiple records to delete in gnome-abrt
  - Do not crash when a FileIcon can't be loaded
  - Resolves: #1048120, #1054089


author: Jakub Filak <jfilak@redhat.com> - 0.3.4-7
changelog:
  - Translation updates
  - Do not crash in case of a DBus timeout
  - Do not crash when testing availability of XServer
  - Resolves: #1178712, #1175662


author: Ernestas Kulik <ekulik@redhat.com> - 0.3.4-9
changelog:
  - Add patch to work around https://bugzilla.redhat.com/show_bug.cgi?id=1679314
  - Use 
  %setup       -q




  /usr/bin/cat /builddir/build/SOURCES/0001-Do-not-crash-when-a-FileIcon-cant-be-loaded.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0001-Do-not-crash-when-a-FileIcon-cant-be-loaded.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0002-Enable-multiple-problems-selection.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0002-Enable-multiple-problems-selection.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0003-Update-translations.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0003-Update-translations.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0004-Initialize-gnome_abrt-module-before-importing-its-su.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0004-Initialize-gnome_abrt-module-before-importing-its-su.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0005-Translation-updates.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0005-Translation-updates.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0006-Pull-the-newest-rhel7-translations.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0006-Pull-the-newest-rhel7-translations.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0007-Move-from-transifex-to-zanata.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0007-Move-from-transifex-to-zanata.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0008-Add-gettext-mappings-to-the-zanata-config.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0008-Add-gettext-mappings-to-the-zanata-config.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0009-translations-update-zanata-configuration.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0009-translations-update-zanata-configuration.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0010-Test-availability-of-XServer-in-C-wrappers.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0010-Test-availability-of-XServer-in-C-wrappers.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0011-Do-not-crash-in-case-of-a-DBus-timeout.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0011-Do-not-crash-in-case-of-a-DBus-timeout.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0012-Mark-Search-place-holder-text-for-translations.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0012-Mark-Search-place-holder-text-for-translations.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0013-Translation-updates.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0013-Translation-updates.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0014-Translation-updates.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0014-Translation-updates.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/0015-views-Allow-reporting-non-reportable-problems.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m 0015-views-Allow-reporting-non-reportable-problems.patch --author "rpm-build <rpm-build>"

  /usr/bin/cat /builddir/build/SOURCES/gnome-abrt-0.3.4_dont_suggest_reporting_to_bugzilla.patch | 
  /usr/bin/git apply --index  -
  /usr/bin/git commit -q -m gnome-abrt-0.3.4_dont_suggest_reporting_to_bugzilla.patch --author "rpm-build <rpm-build>"


author: Bastien Nocera <bnocera@redhat.com> - 1:3.28.1-1
changelog:
  + gnome-bluetooth-3.28.1-1
  - Work-around bluez bug that would leave adapters on Discoverable
    when exiting
  - Resolves: #1567381


author: Kalev Lember <kalevlember@gmail.com> - 1:3.7.4-2
changelog:
  - Spec file cleanup
  - Drop the desktop-notification-daemon requires now that the applet is gone
  - Fix the build with gcc 4.8
  - Move the libgnome-bluetooth-applet.so symlink to the -devel package


author: Zeeshan Ali <zeenix@redhat.com> - 3.8.3-11
changelog:
  - Don't hang on failure to handle a URL (related: #1046251).
  - Handle paths as well (related: #1046251).
  - Handle local paths to remote files (related: #1046251).


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.5-1
changelog:
  - Update to 3.28.5
  - Fix the libgovirt requirement
  - Revert to using Python 2 and Tracker 1.0
  - Resolves: #1567399


author: Christophe Fergeau <cfergeau@redhat.com> 3.8.2-3
changelog:
  - Readd ExclusiveArch as Boxes is not really functional on non-x86
    arch even if it can be built. Also, libvirt-daemon-kvm is not
    available on every arch, causing rhbz#962325


author: Christophe Fergeau <cfergeau@redhat.com> 3.8.2-4
changelog:
  - ... and remove again the ExclusiveArch on fedora. If libvirt-daemon-qemu
    is available, this means we can create (very slow) x86 boxes regardless
    of the arch


author: Zeeshan Ali <zeenix@redhat.com> - 3.8.3-4
changelog:
  - Remove media from correct box (related: #846408).
  - Remove existing transition before adding new one (related: #1015079).


author: Zeeshan Ali <zeenix@redhat.com> - 3.8.3-8
changelog:
  - Don't register for 'x-content/bootable-media' (related: #1072611).
  - Ignore CDROM devices (related: #1072611).
  - Ignore non-readable devices (related: #1043892)


author: Zeeshan Ali <zeenix@redhat.com> - 3.8.2-7
changelog:
  - Add missing resource files (related: #1028079).
  - Don't ignore removal of src/resources.c (related: #1028079).


author: Richard Hughes <rhughes@redhat.com> - 3.8.2-3
changelog:
  - Do not build the clutter support to allow us to drop two deps
    now unsuitable for RHEL.
  - Resolves: #1025270


author: Debarshi Ray <rishi@fedoraproject.org> - 3.8.5-8
changelog:
  - Fix the patch to preview encrypted PDFs
  - Fix the patch to protect against spurious view-as signals
    Resolves: #959175


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-3
changelog:
  - Disable the print button in the selection toolbar when printing isn't
    supported
    Resolves: #1438362


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-6
changelog:
  - Adjust the LOKDocView detection to work with GJS 1.48.0
  - Suppress WARNINGs from GJS 1.50.0 by using var instead of let/const for
    exported symbols
    Resolves: #1517704


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-8
changelog:
  - Initialize the getting started PDF only when presenting a UI, and before any
    SPARQL has been submitted
  - Suppress WARNINGs from GJS 1.50.0 by using var instead of let/const for
    exported symbols
  - Use the standard dialect of String.prototype.replace
    Resolves: #1517770


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.1-1
changelog:
  - Update to 3.28.1
  - Rebased downstream patches
  - Revert to using Python 2 and Tracker 1.0
  - Resolves: #1568171


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.2-1
changelog:
  - Update to 3.28.2
  - Rebased downstream patches
  - Fix crash on right-click on local collection
    Resolves: #1611565


author: Zeeshan Ali <zeenix@redhat.com> - 3.8.2-8
changelog:
  - Remove patch 'daemon: Exit gnome-keyring-daemon when the DBus connection
    closes' (related: rhbz#1030671).


author: Florian Müllner <fmuellner@redhat.com> - 3.6.0-2
changelog:
  - Use gnome-applications.menu instead of applications-gnome.menu,
    in order to be able to use XDG_MENU_PREFIX instead of a downstream
    patch to gnome-shell


author: Debarshi Ray <rishi@fedoraproject.org> - 3.14.4-2
changelog:
  - Use newer WebKit
  - Refresh the credentials during startup and network changes
  Resolves: #1174600, #1189888


author: Debarshi Ray <rishi@fedoraproject.org> - 3.14.5-3
changelog:
  - Don't remove Telepathy accounts or expire Kerberos credentials when stopping
    goa-daemon
  Resolves: #1267534


author: Debarshi Ray <rishi@fedoraproject.org> - 3.14.5-5
changelog:
  - Ensure that temporary accounts are really removed from the keyring and
    avoid a WARNING
  Resolves: #1261940


author: Ray Strode <rstrode@redhat.com> 3.8.5-2
changelog:
  - Fix kerberos crash when user manually erases stored credentials with seahorse
    Resolves: #1027413


author: Richard Hughes <rhughes@redhat.com> - 3.14.3-3
changelog:
  - Re-apply the fix "Change the UI policy to show the comps tree" as it was
    lost in the rebase process.
  - Resolves: #1174550


author: Richard Hughes <rhughes@redhat.com> - 3.14.3-6
changelog:
  - Create a -common subpackage and make the "parent" package depend on all
    the split out applications. This fixes upgrades from old versions.
  - Resolves: #1290868


author: Richard Hughes <rhughes@redhat.com> - 3.8.2-2
changelog:
  - Ignore package progress updates when the transaction is being simulated which
    fixes the 100% CPU issue when trying to update a large number of packages.
  - Resolves: #969852


author: Richard Hughes <rhughes@redhat.com> - 3.8.2-3
changelog:
  - Show the update and installer items in a KDE desktop as RHEL does not
    ship Apper.
  - Resolves: #1033672


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.28.1-6
changelog:
  - Fix missing deps in -gnome and -bonobo subpkg (#689836).
    gnome-python2-gnome should "Requires: gnome-python2-bonobo"
    gnome-python2-bonobo should "Requires: gnome-python2-canvas"


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.28.1-7
changelog:
  - Drop unused/ancient -capplet subpackage definition remains.
  - Add %?_isa to all explicit dependencies on package names.
  - Make pygtk2 dependency arch-specific (#749835).


author: Colin Walters <walters@verbum.org> - 2.28.1-12
changelog:
  - Drop requires on bonobo-activation, since it is the same as libbonobo,
    but that package dropped the provides.


author: Ray Strode <rstrode@redhat.com> - 3.26.1-1
changelog:
  - add wayland session file
    Resolves: #1482140
  - update to 3.26.1 to work with wayland sessions
    Resolves: 1504156


author: Ray Strode <rstrode@redhat.com> 3.26.1-8
changelog:
  - New sed incantation is still overzealous.  Rework how
    gnome-wayland session file is generated.
    Resolves: #1510391


author: Ray Strode <rstrode@redhat.com> - 3.28.1-5
changelog:
  - Fix gnome-disk-utility timeout at startup
    Resolves: #1593215
  - add back session properties icons
    Related: #1568620


author: Bastien Nocera <bnocera@redhat.com> - 3.22.2-1
changelog:
  + gnome-settings-daemon-3.22.2-1
  - Update to 3.22.2
  - Fixes bugs in custom keyboard shortcuts handling and a smartcard
    regression
  Resolves: #1425487


author: Ray Strode <rstrode@redhat.com> - 3.26.2-7
changelog:
  - Fix logic error in password expiration notification bubble
    Resolves: #1530659
    Related: 1314443


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-9
changelog:
  + gnome-settings-daemon-3.26.2-9
  - Revert automatic suspend after inactivity, it was rejected
  - Related: #1449171


author: Owen Taylor <otaylor@redhat.com> - 3.14.4-49
changelog:
  - Fix bug where maximized windows would flicker to the wrong size when
    restarting the shell (on stereo enable or otherwise)
    Resolves: #1306802


author: Ray Strode <rstrode@redhat.com> - 3.22.3-14
changelog:
  - fix unlock after upgrade
    Related: #1448786
  - switch from setup to autosetup -S git for easier patch maintenance


author: Florian Müllner <fmuellner@redhat.com> - 3.28.2-2
changelog:
  - Update rebased downstream patches
    Related: #1568624
  - Revert port to python3 of some utility tools
    Resolves: #1493526
  - Add tooltips to app names in overview
    Resolves: #1541180


author: Florian Müllner <fmuellner@redhat.com> - 3.26.2-2
changelog:
  - Fix notification legibility in classic mode
    Resolves: #1507457
  - Fix stray icon shadows in classic mode
    Resolves: #1530654


author: Florian Müllner <fmuellner@redhat.com> - 3.28.1-3
changelog:
  - Fix a couple of regressions from the rebase:
    - add back classic overview style
    - update dash-to-dock to a compatible version
    Related: #1569717


author: Florian Müllner <fmuellner@redhat.com> - 3.28.1-7
changelog:
  - Add window-grouper extension
    Resolves: #1355845

  - Add disable-screenshield extension
    Resolves: #1643501


author: Florian Müllner <fmuellner@redhat.com> - 3.28.1-13
changelog:
  - Adjust dash-to-dock for classic backports
    Resolves: #1805920
  - Fix inconsistent state in window-list prefs dialog
    Resolves: #1613835
  - Add accessible name to status icons
    Resolves: #1600999


author: Florian Müllner <fmuellner@redhat.com> - 3.8.4-2
changelog:
  - Backport some classic-mode improvements from 3.10 cycle:
    - context menu in window list (close, minimize, maximize)
    - use same order for favorites in applications menu as in dash


author: Kalev Lember <klember@redhat.com> - 3.14.7-1
changelog:
  - Update to 3.14.7
  - Show installation progress when installing apps
  - Fix incomplete Japanese translations
  - Show a new notification when security updates remain unapplied
  - Resolves: #1237181, #1055643, #1136954


author: Richard Hughes <rhughes@redhat.com> - 3.22.7-3
changelog:
  - Never show 'Startup Applications' in the search results
  - Note: the other issue shown in the bug is likely a dupe of #1445651
  - Resolves: #1481145


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.2-2
changelog:
  - Backport fix for client-side memory error (GNOME/gnome-terminal#1)
  - Bump BuildRequires versions
  - Drop the dark theme override
  - Rebase and restore the scroll speed patches
  - Rebase and restore the patch to allow old ISO 8895 charsets
  - Restore the GConf migration tool
  - Resolves: #1568632


author: Milan Crha <mcrha@redhat.com> - 3.28.1-6
changelog:
  - Resolves: #1460768 (Cannot hide desktop icons in classic mode)
  - Resolves: #1607839 (Invisible panel is made visible on click between Setting and Toggle button)


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 3.8.1-2
changelog:
  - Drop gnome-tweak-tool-3.8.0-shell_themes.patch patch, since theme search is
    fixed with GS user theme extension 3.8.4


author: Rui Matos <rmatos@redhat.com> - 3.8.1-3
changelog:
  - Resolves: rhbz#998547 - Descriptions in drop-down lists don't fit in window
  - Resolves: rhbz#1014796 - Search does not work in gnome-tweak-tool


author: Rui Matos <rmatos@redhat.com> - 3.8.1-4
changelog:
  - Resolves: rhbz#1017208 - Restart button in gnome-tweak-tool does not restart gnome-shell
  - Resolves: rhbz#1016144 - User should not change state of Classic Mode extensions in gnome-tweak-tool


author: Rui Matos <rmatos@redhat.com> - 3.8.1-6
changelog:
  - Resolves: rhbz#1036226 - Search part of words does not work in gnome-tweak-tool
  - Resolves: rhbz#1037620 - Default/Document font set to italic shows normal font
  - Resolves: rhbz#1038003 - Some shortcuts for changing layout does not work
  - Resolves: rhbz#1038116 - "Use keyboard LED to show alternative layout" option does not light up selected LED
  - Resolves: rhbz#1037831 - Extension installed via website is shown in gnome-tweak-tool in wrong order in the real time


author: Rui Matos <rmatos@redhat.com> - 3.8.1-7
changelog:
  - Resolves: rhbz#1001511 - Power Management: suspend when laptop lid close should be easily configurable
  - Add an upstream patch to fix intltool and gettext brokenness


author: Hans de Goede <hdegoede@redhat.com> - 0.4.0-4
changelog:
  - Drop Requires for gstreamer-plugins, as we may be used with both
    gstreamer-0.10 and 1.0. Instead apps using gnome-video-effects should add
    the necessary Requires themselves


author: Peter Jones <pjones@redhat.com> - 3.0.2-2
changelog:
  - Fix .spec mismerge from upstream that causes ia32 to build.
    Related: rhbz#1190191
    Related: rhbz#1115843
    Related: rhbz#1100048


author: Peter Jones <pjones@redhat.com> - 3.0.5-1
changelog:
  - Update to 3.0.5
  - Re-enable ia32 builds for the most hilarious changelog series...
    Resolves: rhbz#1310782


author: Peter Jones <pjones@redhat.com> - 3.0.5-3
changelog:
  - Include ia32 bits in the x86_64 packages instead of making a separate
    32-bit package
    Resolves: rhbz#1310782


author: Peter Jones <pjones@redhat.com> - 3.0.5-6
changelog:
  - Also build the ia32 bits in a separate 32-bit package for other consumers.
    Related: rhbz#1310782


author: Peter Jones <pjones@redhat.com> - 3.0.5-8
changelog:
  - Nerf the timestamps on our .o files while building, because RHEL's ar(1) is
    horrible and silently ignores the 'D' option.  It's fine, I probably didn't
    put it there for any reason.
    Related: rhbz#1310782


author: Peter Jones <pjones@redhat.com> - 3.0.5-9
changelog:
  - One more attempt at nerfing timestamps.  It's surprising how broken this
    can be.

    "ar rDv" works just fine, but
    /usr/lib/rpm/redhat/brp-strip-static-archive is calling ""/usr/bin/strip -p" -g
    $for_each.a", and it's rewriting our binary from ts/uid/gid of 0/0/0 to
    $epoch/$UID/$GID.  Awesomely /usr/bin/strip it seems to have 3 modes of
    operation:
    -U: the default, which adds $epoch/$UID/$GID to your binary archive
        instead of just removing stuff.  Clearly the Principle of Least
        Surprise is strong here.
    -p: preserve the timestamp from the original .a, but add UID and GID,
        because this is 1980 and people use ar(1) for archiving stuff they
        might want that out of.
    -D: Condescend at you in a command line error and explain that -D both
        is and is not a valid option:
          /usr/bin/strip: invalid option -- 'D'
          Usage: /usr/bin/strip <option(s)> in-file(s)
          Removes symbols and sections from files
          The options are:
          ...
          -D --enable-deterministic-archives
                      Produce deterministic output when stripping archives
        So I agree that it's invalid, but I think we may be pronouncing that
        second vowel differently.  They say in-VAL-id, I say IN-vuh-lid.

    Nobody should ever have to run "strace -ttt -v -f -o make.strace make
    all", just to discover the problem isn't even in there.
    Related: rhbz#1310782


author: Peter Jones <pjones@redhat.com> - 3.0.5-9
changelog:
  - Just don't build the .i686 package at all.  After a scratch build, it's
    clear that "strip -p" is not good enough, because our different builders
    have non-matching UIDs for the build process, and -p adds uid/gid to the
    archive.  So there's no way to fix the multiarch conflict here without
    either fixing that or fixing strip(1) with:
    https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=patch;h=7a093a78
    We don't strictly need the .i686 package anyway, since we've moved to
    making the dependent binaries all build the ia32 bits on x86_64 for
    other reasons.  Related: rhbz#1310782


author: Peter Jones <pjones@redhat.com> - 3.0.5-9
changelog:
  - One more attempt at nerfing timestamps.  It's surprising how broken this
    can be.

    "ar rDv" works just fine, but
    /usr/lib/rpm/redhat/brp-strip-static-archive is calling "%{__strip} -g
    $for_each.a", and it's rewriting our binary from ts/uid/gid of 0/0/0 to
    $epoch/$UID/$GID.  Awesomely /usr/bin/strip it seems to have 3 modes of
    operation:
    -U: the default, which adds $epoch/$UID/$GID to your binary archive
        instead of just removing stuff.  Clearly the Principle of Least
        Surprise is strong here.
    -p: preserve the timestamp from the original .a, but add UID and GID,
        because this is 1980 and people use ar(1) for archiving stuff they
        might want that out of.
    -D: Condescend at you in a command line error and explain that -D both
        is and is not a valid option:
          /usr/bin/strip: invalid option -- 'D'
          Usage: /usr/bin/strip <option(s)> in-file(s)
          Removes symbols and sections from files
          The options are:
          ...
          -D --enable-deterministic-archives
                      Produce deterministic output when stripping archives
        So I agree that it's invalid, but I think we may be pronouncing that
        second vowel differently.  They say in-VAL-id, I say IN-vuh-lid.

    Nobody should ever have to run "strace -ttt -v -f -o make.strace make
    all", just to discover the problem isn't even in there.
    Related: rhbz#1310782


author: Peter Jones <pjones@redhat.com> - 3.0u-0.1
changelog:
  - Update to 3.0u
    Related: rhbz#996863
  - Split out subpackages so -devel can be multilib
  - Fix path in apps subpackage to vary by distro.


author: David Walluck <dwalluck@redhat.com> 0:1.0.13-3
changelog:
  - fix maven depmap install
  - add compat symlinks for javadoc
  - add depmap entry for urbanophile:java-getopt


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.0.13-7
changelog:
  - Install license file with javadoc package
  - Add missing R: java, jpackage-utils
  - Convert versioned names to versionless
  - Add rpm bug workaround
  - Update to current packaging guidelines


author: Tomáš Mráz <tmraz@redhat.com> - 2.0.22-4
changelog:
  - allow import of RSA-E and RSA-S keys (patch by Marcel Kolaja) (#1233182)
  - do not abort when missing hash algorithm in FIPS mode (#1078962)


author: Peter Schiffer <pschiffe@redhat.com> 4.6.1-1
changelog:
  - resolves: #861849
    updated to 4.6.1
  - cleaned .spec file
  - resolves: #759964
    fixed sigsegv
  - resolves: #812225
    fixed sigsegv
  - fixed requires/buildrequires
  - added tex(pdftex.map) and libjpeg-turbo-devel buildrequires


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 4.6.2-1
changelog:
  - Rebase to 4.6.2
  - Added explicit build dependency on ImageMagick. It somehow disappeared from emacs dependencies.
  - Patched gnuplot.texi, new latex refused to compile it.


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-4
changelog:
  - reverted change to use the p11-kit certificate storage (#1110750)
  - added functions to test DH/ECDH in FIPS-140-2 mode and fixed
    RSA key generation (#1110696)
  - added manual dependencies on libtasn1 3.8 as well as p11-kit 0.20.7
  - fixed SHA224 in SSSE3 optimized code
  - fixed issue with handshake buffer resets (#1153106)
  - fixed issue in RSA key generation with specific seeds in FIPS140-2 mode


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-9
changelog:
  - Amended fix for FIPS enforcement issue (#1163848)
  - Fixed issue with applications that close all file descriptors (#1165047)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-11
changelog:
  - Applied fix for urandom FD in FIPS140 mode (#1165047)
  - Applied fix for FIPS140-2 related regression (#1110696)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-13
changelog:
  - Corrected reseed and respect of max_number_of_bits_per_request in 
    FIPS140-2 mode. Also enhanced the initial tests. (#1228199)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.24-1
changelog:
  - Addressed issue with DSA public keys smaller than 2^1024 (#1238279)
  - Addressed two-byte buffer overflow in the DTLS-0.9 protocol (#1209365)
  - When writing certificates to smart cards write the CKA_ISSUER and
    CKA_SERIAL_NUMBER fields to allow NSS reading them (#1272179)
  - Use the shared system certificate store (#1110750)
  - Address MD5 transcript collision attacks in TLS key exchange (#1289888, 
    CVE-2015-7575)
  - Allow hashing data over 2^32 bytes (#1306953)
  - Ensure written PKCS#11 public keys are not marked as private (#1339453)
  - Ensure secure_getenv() is called on all uses of environment variables
    (#1344591).
  - Fix issues related to PKCS #11 private key listing on certain HSMs
    (#1351389)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-7
changelog:
  - Address interoperability issue with 3.5.x (#1388932)
  - Reject CAs which are both trusted and blacklisted in trust module (#1375303)
  - Added new functions to set issuer and subject ID in certificates (#1378373)
  - Reject connections with less than 1024-bit DH parameters (#1335931)
  - Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
  - Mention limitations of certtool in manpage (#1375463)
  - Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
  - Do not link directly to trousers but instead use dlopen (#1379739)
  - Fix incorrect OCSP validation (#1377569)
  - Added support for pin-value in PKCS#11 URIs (#1379283)
  - Added the --id option to p11tool (#1399232)
  - Improved sanity checks in RSA key generation (#1444780)
  - Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
    CVE-2017-7869


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-9
changelog:
  - Address crash in OCSP status request extension, by eliminating the
    unneeded parsing (CVE-2017-7507, #1455828)


author: Anderson Sasaki <ansasaki@redhat.com> 3.3.29-8
changelog:
  - Backported --sni-hostname option which allows overriding the hostname
    advertised to the peer (#1444792)
  - Improved counter-measures in TLS CBC record padding for lucky13 attack
    (CVE-2018-10844, #1589704, CVE-2018-10845, #1589707)
  - Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
    (CVE-2018-10846, #1589708)
  - Address p11tool issue in object deletion in batch mode (#1375307)
  - Backport PKCS#11 tests from master branch. Some tests were disabled due to
    unsupported features in 3.3.x (--load-pubkey and --test-sign options, ECC key
    generation without login, and certificates do not inherit ID from the private
    key)
  - p11tool explicitly marks certificates and public keys as NOT private objects
    and private keys as private objects
  - Enlarge buffer size to support resumption with large keys (#1542461)
  - Legacy HMAC-SHA384 cipher suites were disabled by default
  - Added DSA key generation to p11tool (#1464896)
  - Address session renegotiation issue using client certificate (#1434091)
  - Address issue when importing private keys into Atos HSM (#1460125)


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.4.2-2
changelog:
  - update to 1.4.2 (iterative build)
  - emacs and vim subpackages obsoleted as they're no longer provided


author: Jakub Čajka <jcajka@redhat.com> - 1.6.2-1
changelog:
  - rebase to 1.6.2
  - added aarch64 build
  - fix CVE-2016-3959
  - Resolves: rhbz#1292956, rhbz#1330711, rhbz#1330040


author: Jakub Čajka <jcajka@redhat.com> - 1.8.3-1
changelog:
  - bump to 1.8.3
  - fix CVE-2017-8932
  - Resolves: rhbz#1452616, rhbz#1452241, rhbz#1457169, rhbz#1448346


author: Jakub Čajka <jcajka@redhat.com> - 1.9.1-1
changelog:
  - Rebase to 1.9.1
  - fix CVE-2017-15041 and CVE-2017-15042
  - Resolves: rhbz#1500591, rhbz#1499827, rhbz#1500587, rhbz#1448494


author: jchaloup <jchaloup@redhat.com> - 1-5
changelog:
  - Update the spec file for RHEL
  - Remove devel subpackage
  - Bundle github.com/russross/blackfriday and github.com/shurcooL/sanitized_anchor_name into tarball
  - Use bundled dependencies to build md2man
    resolves: #1211312


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.0.4-4
changelog:
  - Resolves: #1344553 - build only for go_arches
  - update ambiguous changelog in previous entry
  - update go_arches definition


author: Lokesh Mandvekar <lsm5@redhat.com> git708054d-12
changelog:
  - debuginfo not generated, was empty to begin with
  - devel package buildrequires golang
  - package owns all directories in import_path


author: Lokesh Mandvekar <lsm5@redhat.com> 0-0.23.git
changelog:
  - Resolves: rhbz#1108722 - update for docker-1.0.0
  - Resolves: rhbz#1110491 - make exclusivearch for x86_64 since golang only available for x86_64
  - go test disabled


author: Lokesh Mandvekar <lsm5@redhat.com> 0-0.13.git
changelog:
  - update to commit 136d54f81f (required for docker 1.0
  https://github.com/dotcloud/docker/issues/5908 )


author: Lokesh Mandvekar <lsm5@fedoraproject.org> 0-0.12.git
changelog:
  - Resolves: rhbz#1108720 - update for docker 1.0.0
  - Resolves: rhbz#1110512 - restrict arch to x86_64


author: Lokesh Mandvekar <lsm5@redhat.com> 0-0.19.git98c7b80
changelog:
  -  Add pty_unsupported.go file in order to allow projects to import the
  package and still compile on other os/arch


author: Mike FABIAN <mfabian@redhat.com> - 20170827-1
changelog:
  - Update to upstream snapshot tarball
  - Update color emoji font to version 2.001, new design.
  - Contains the new emoji added in Unicode 10.0.0.


author: Mike FABIAN <mfabian@redhat.com> - 20170828-1
changelog:
  - Update to upstream snapshot tarball
  - split black-and-white and color fonts into different sub-packages.


author: Peter Oliver <rpm@mavit.org.uk> - 20170928-2
changelog:
  - Prefer zopflipng to optipng, since it should yield smaller files.
  - Use the font we built, rather than the one included with the source.


author: Mike FABIAN <mfabian@redhat.com> - 20180508-1
changelog:
  - Update to upstream snapshot tarball (color emoji font version 2.011)
  - Add patch to build all country flags (Resolves: rhbz#1574195)


author: Pravin Satpute <psatpute@redhat.com> - 20130807-1
changelog:
  - Resolves: rh#1023312 Upstream new release of 20130807 tarball.
  - Packages unhinted upstream tarball.
  - This pulled fonts for number of missing Unicode scripts in Fedora


author: Pravin Satpute <psatpute@redhat.com> - 20141001-1
changelog:
  - Google stops release tarball. Zip file derived from git Download zip.
  - 45 new packages added as follows.
  - kufi-arabic-fonts, naskh-arabic-fonts, naskh-arabic-ui-fonts, sans-balinese-fonts, 
  - sans-bamum-fonts, sans-batak-fonts, sans-buginese-fonts, sans-buhid-fonts, 
  - sans-canadian-aboriginal-fonts, sans-cham-fonts, sans-cuneiform-fonts, sans-cypriot-fonts, 
  - sans-gothic-fonts, sans-gurmukhi-fonts, sans-gurmukhi-ui-fonts, 
  - sans-inscriptional-pahlavi-fonts, sans-inscriptional-parthian-fonts, sans-javanese-fonts, 
  - sans-lepcha-fonts, sans-limbu-fonts, sans-linearb-fonts, sans-mongolian-fonts, 
  - sans-myanmar-fonts, sans-myanmar-ui-fonts, sans-new-tai-lue-fonts, sans-ogham-fonts, 
  - sans-ol-chiki-fonts, sans-old-italic-fonts, sans-old-persian-fonts, sans-phags-pa-fonts, 
  - sans-rejang-fonts, sans-runic-fonts, sans-samaritan-fonts, sans-saurashtra-fonts, 
  - sans-sinhala-fonts, sans-sundanese-fonts, sans-syloti-nagri-fonts, sans-syriac-eastern-fonts, 
  - sans-syriac-estrangela-fonts, sans-syriac-western-fonts, sans-tagbanwa-fonts, 
  - sans-tai-le-fonts, sans-tifinagh-fonts, sans-yi-fonts
  - Resolves #1148413


author: Jens Petersen <petersen@redhat.com> - 20141117-1
changelog:
  - update to latest git (aae16d0cd626)
  - package Japanese, Korean, and CJK fonts
  - add Thaana font
  - add common subpackage for license and doc files
  - order spec subpackages lexically


author: Jens Petersen <petersen@redhat.com> - 20141117-2
changelog:
  - move cjk fonts fontconfig priority from 65-0 to 66
  - generate the appinfo metainfo for the subpackages
  - use a single for-loop to install the font config and appdata files
  - move parent appinfo metainfo to common (Parag Nemade)


author: Pravin Satpute <petersen@redhat.com> - 20141117-5
changelog:
  - Resolves: #1269444: including CJK subpackage
  - Rebase from Fedora 22 - 20141117-5 SRPM
  - improve generated font subpackage descriptions
  - it is Hanunoo not Hanuno!
  - specify font filenames more precisely


author: Alexey Berezhok <aberezhok@cloudlinux.com>, Mikhail Zhbankov <mzhbankov@cloudlinux.com> 1.1-12
changelog:
  - MYSQLG-105: cl-MySQL57-5.7.11-1 requirements are broken on CL6.i386
  - MYSQLG-97: Add support by governor MySQL 5.7
  - MYSQLG-103: fix dbctl list output for read and write limits
  - MYSQLG-98: Make /dev/shm/governor_bad_users_list unreadable for users
  - MYSQLG-104: fix governor restart on CL7 under systemd
  - MYSQLG-108: Fix dbctl set command bug


author: Alexey Berezhok <aberezhok@cloudlinux.com> 1.1-18
changelog:
  - MYSQLG-134: Check if mysql is not in yum exclude list
  - MYSQLG-140: Spelling error in mysqlgovernor.py script output


author: Alexey Berezhok <aberezhok@cloudlinux.com> 1.1-19
changelog:
  - MYSQLG-136: Add new behaviour for MySQL LVE enter for preventing crash MySQL on lve destroy
  - MYSQLG-149: investigate the possibility to avoid httpd checks during "mysqlgovernor.py --dbupdate"


author: Alexey Berezhok <aberezhok@cloudlinux.com> 1.1-20
changelog:
  - MYSQLG-152: Use default values for "script" parameters in governor's config in case when script="". Now governor report about error and stop to work.


author: Alexey Berezhok <aberezhok@cloudlinux.com> 1.1-21
changelog:
  - MYSQLG-154: Fix ""dbctl list"" show io limits equals to default when they are less then 1mb/s
  - MYSQLG-159: add ability to specify units for io limits
  - MYSQLG-157: Need to review the algoritm of set LVE=3 limits on MySQL install/update


author: Eugen Vodilov <evodilov@cloudlinux.com> 1.2-25
changelog:
  - MYSQLG-204: Perfomance fix for statistic enabled servers
  - Fix build dependency on CL7 (broken glib-2.0 dependency to pcre-devel)


author: Alexey Berezhok <aberezhok@cloudlinux.com> 1.2-26
changelog:
  - MYSQLG-216: the cPanel's Service Manager stucks on the governor restart
  - MYSQLG-217: The Governor is not starting with " Can't load mysql functions" error


author: Daria Kavchuk <dkavchuk@cloudlinux.com> 1.2-29
changelog:
  - MYSQLG-220: Fix restore of MariaDB and MySQL 5.7 official packages after governor deletion on cPanel


author: Daria Kavchuk <dkavchuk@cloudlinux.com> 1.2-36
changelog:
  - mariadb103 support
  - MYSQLG-269: warnings in case of downgrade or switching mysql|mariadb
  - MYSQLG-259: added 'assumeyes' for all yum commands


author:
  Aleksandr Povalyaev <apovalyaev@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com>, Daria Kavchuk <dkavchuk@cloudlinux.com> 1.2-37

changelog:
  - mysql80, libmysqlclient.so.21 support
  - MYSQLG-297, MySQLG-301: old auth procedure for mysql80
  - MYSQLG-293: Added logrotate config for governor-mysql
  - MYSQLG-306: fix error logging from --dbupdate
  - MYSQLG-300: cagefs force-update after governor installation and delete procedure
  - MYSQLG-302: Investigate why db_governor fails with error "Can't init BAD list"
  - MYSQLG-326: Wrong handling of SQL line while logging slow mysql query


author:
  Aleksandr Povalyaev <apovalyaev@cloudlinux.com>, Daria Kavchuk <dkavchuk@cloudlinux.com>, Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.2-38

changelog:
  - MYSQLG-364: added returning a non-zero value in case of error
  - MYSQLG-368: fix current packages download procedure for DirectAdmin
  - MYSQLG-366: download official mysql/mariadb packages on cPanel
  - MYSQLG-365: db_governor service enabled for CloudLinux 7
  - MYSQLG-363: added daemon-reload in postun scriptlet
  - MYSQLG-361: added return codes for errors during installation
  - MYSQLG-311: copyright updated
  - MYSQLG-338: fix memory leak with init_lve/exit_lve
  - MYSQLG-344: prevent reseting of max_user_connections when unfreezing
  - MYSQLG-346: option for update credentials added
  - MYSQLG-319: warn user about disable of protectbase plugin


author: Daria Kavchuk <dkavchuk@cloudlinux.com> 1.2-41
changelog:
  - MYSQLG-383: added command execution timeout
  - MYSQLG-329: full mariadb103 support for cPanel
  - MYSQLG-379: fixed exceptions flow in dbgovernor_map py files
  - MYSQLG-382: fixed dbgovernor_map for Plesk
  - MYSQLG-373: updated governor removal for cPanel


author: Daria Kavchuk <dkavchuk@cloudlinux.com> 1.2-42
changelog:
  - MYSQLG-387: fix --delete procedure
  - MYSQLG-385: process CpuserNotInMap exception while dbgovernor_map


author: Miroslav Rezanina <mrezanin@redhat.com> 2.4-2
changelog:
  - gperf-allow-customizing-trace-filename.patch [bz#1232702]
  - Resolves: bz#1232702
    (gperftools: tcmalloc debug version uses hard-coded path /tmp/google.alloc)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.4-8.el7
changelog:
  - gp-Use-initial-exec-tls-for-libunwind-s-recursion-flag.patch [bz#1339710]
  - Resolves: bz#1339710
    (initalization of 'recursive' tls variable in libunwind stack capturer occasionally triggers deadlock in ceph)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.4-8.el7
changelog:
  - Rebase to 2.6.1 [bz#1431240]
  - Removed libunwind usage [bz#1467203]
  - Resolves: bz#1431240 
    (gperftools fails to build on s390x, lacks s390x support)
  - Resolves: bz#1467203
    (Please, remove libunwind from the gperftools-libs (and 389-ds-base) requirements)


author: Simon Lukasik <slukasik@redhat.com> - 1.3.0-6
changelog:
  - Resolve multilib conflict of gpgme-config (#341351)
  - Resolve multilib conflict of gpgme.h (#341351)


author: Tomas Mraz <tmraz@redhat.com> - 1.3.2-1
changelog:
  - new upstream version
  - re-enable gpg tests (original patch by John Morris <john@zultron.com>)
  - quiet configure warning 'could not find g13'
  - there is no libgpgme-pth anymore


author: Jaromir Capik <jcapik@redhat.com> - 1.20.6-29
changelog:
  - Removing OPTFLAGS
  - Introducing full RELRO
  - Missing header dir in Makefile.in / depend
  - Fixing UsrMove for i686 (mv -f says 'directory not empty')


author: Jiri Kucera <jkucera@redhat.com> - 1.20.7-6
changelog:
  - Remove old scriptlets
    Enable PIE and RELRO
    ./autogen.sh runs too early
    Resolves: #1092527, #1095444


author: Parag Nemade <paragn AT fedoraproject DOT org> - 1.2.0-2
changelog:
  - revert the wrongly committed f18 spec to f19
  - spec file cleanup
  - thanks to jnovy for finding me minimum texlive BR
  - partial multilib fix for manual.html


author: Parag Nemade <paragn AT fedoraproject DOT org> - 1.2.0-4
changelog:
  - Drop refman.pdf as its same as manual.html
  - patch install path for cmake files as they are arch dependent


author: Till Maas <opensource@till.name> - 1.2.4-4
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Caolán McNamara <caolanm@redhat.com> - 1.3.10-1
changelog:
  - Resolves: rhbz#1472290
    CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774
    CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-13
changelog:
  - Fixed multilib conflicts
    Rewrote lefty IO lib to use getaddrinfo instead of gethostbyname
    (by lefty-getaddrinfo patch)
    Resolves: rhbz#881173


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.30.1-17
changelog:
  - Prevent possible buffer overflow in yyerror()
    Resolves: CVE-2014-1235
  - Fix possible buffer overflow problem in chkNum of scanner
    Resolves: CVE-2014-1236


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.13-1
changelog:
  - New version
    Resolves: rhbz#837749
  - Fixed -i option
    Resolves: rhbz#828844
  - Added virtual provide and FPC ticket link for bundled gnulib
    Resolves: rhbz#821759


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14-4
changelog:
  - Added group-separator, no-group-separator options decription
  - Aligned output of built-in help
  - Defuzzified gnulib-tests-rm-f patch


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-2
changelog:
  - Fixed invalid UTF-8 byte sequence error in PCRE mode
    (by pcre-backported-fixes patch)
    Resolves: rhbz#1217080
  - Fixed buffer overrun for grep -F
    Resolves: CVE-2015-1345
  - Fixed \w and \W behaviour in multibyte locales
    Resolves: rhbz#1159012
  - Documented --fixed-regexp option
    Resolves: rhbz#1103259
  - Updated pcre buildrequires to require pcre-devel >= 7.8-7
    Related: rhbz#1217080


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-3
changelog:
  - Speedup DFA for long patterns and fixed begline/endline matching
    Resolves: rhbz#1413029
  - Added support for GREP_LEGACY_EGREP_FGREP_PS environmental variable which
    controls how egrep, fgrep show in ps output
    Resolves: rhbz#1297441


author: Bastien Nocera <bnocera@redhat.com> 0.2.14-6
changelog:
  - Enable a number of missing plugins
  Related: #1184200
  - Disable blip.tv plugin as service has now closed
  - Add patch to downgrade the gom requirements
  - Port back local-metadata plugin to libmediaart-1.0


author: Bastien Nocera <bnocera@redhat.com> - 0.3.4-3
changelog:
  - Fix size reporting in Apple Trailers source
  - Add compatibility layer to allow building with lua 5.1
  Resolves: #1477129


author: Jan Vcelak <jvcelak@redhat.com> 1.21-9
changelog:
  - older security fixes (#709415, #720060):
    + CVE-2009-5044: insecure temporary file handling in pdfroff
    + CVE-2009-5080: improper handling of failed attempts to create temporary directories in eqn2graph/pic2graph/grap2graph
    + CVE-2009-5081: roff2.pl and groffer.pl use easy-to-guess temporary file names


author: Jan Vcelak <jvcelak@redhat.com> 1.22.1-1
changelog:
  - new upstream release (#890973)
    + various fixes in manual pages
    + various fixes and improvements in macros
    + new gropdf driver for generating PDF files
  - fix: backslash-period escape does not work (#682857)
  - fix: groff ftbfs - patch does not apply (#885225)


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.8.9-2
changelog:
  - Remove bundled JARs and classes
  - Add workaround for rhbz#971483
  - Add Public Domain to licenses
  - Install ASL 2.0 license text, resolves: rhbz#858257


author: Peter Jones <pjones@redhat.com> - 2.02-0.2.3
changelog:
  - Don't emit "Booting <foo>" message.
    Resolves: rhbz#1023142
  - Don't require a password for booting, only for editing entries.
    Resolves: rhbz#1030176
  - Several network fixes from IBM
    Resolves: rhbz#1056324
  - Support NVMe device names
    Resolves: rhbz#1019660
  - Make control keys work on UEFI systems.
    Resolves: rhbz#1056035


author: Peter Jones <pjones@redhat.com> - 2.02-0.2.5
changelog:
  - Add man pages for common grub utilities.
    Resolves: rhbz#948847
  - Fix shift key behavior on UEFI.
    Resolves: rhbz#1068215


author: Peter Jones <pjones@redhat.com> - 2.02-0.35
changelog:
  - Don't use legacy methods to make device node variables.
    Resolves: rhbz#1279599
  - Don't pad initramfs with zeros
    Resolves: rhbz#1219864


author: Peter Jones <pjones@redhat.com> - 2.02-0.36
changelog:
  - Better support for EFI network booting with dhcpv6.
    Resolves: rhbz#1154226
  - Back out a duplicate change resulting in some EFI network firmware drivers
    not working properly.
    Related: rhbz#1273974
    Related: rhbz#1277599
    Related: rhbz#1298765


author: rmarshall@redhat.com - 2.02-0.37
changelog:
  - Update fix for rhbz#1212114 to reflect the move to handling this case
    in anaconda.
    Related: rhbz#1315468
    Resolves: rhbz#1261926
  - Add grub2-get-kernel-settings to allow grub2-mkconfig to take grubby
    configuration changes into account.
    Resolves: rhbz#1226325


author: rmarshall@redhat.com - 2.02-0.39
changelog:
  - Fix all issues discovered during coverity scan. 
    Related: rhbz#1154226
  - Fix a couple compiler and CLANG issues discovered during coverity scan.
    Related: rhbz#1154226
  - Fix the last few CLANG issues and a deadcode issue discovered by the
    coverity scan.
    Related: rhbz#1154226


author: Peter Jones <pjones@redhat.com>
changelog:
  - Remove our patch to force a paricular uefi network interface
    Related: rhbz#1273974
    Related: rhbz#1277599
    Related: rhbz#1298765
  - Update some more coverity issues
    Related: rhbz#1226325
    Related: rhbz#1154226


author: Peter Jones <pjones@redhat.com> - 2.02-0.44
changelog:
  - Work around tftp servers that don't work with multiple consecutive slashes in
    file paths.
    Resolves: rhbz#1217243


author: Peter Jones <pjones@redhat.com> - 2.02-0.54
changelog:
  - Make grub2-pc, grub2-ppc64le, etc, also have an Obsoletes for the old grub2
    packages.  Hoping this will solve Jira RCM-14929.
    Related: rhbz#1437450


author: Peter Jones <pjones@redhat.com> - 2.02-0.57
changelog:
  - Make "grub2" require the grub2-efi-... package on arches where there's no
    legacy build.
    Related: rhbz#1440787


author: Peter Jones <pjones@redhat.com> - 2.02-0.58
changelog:
  - Add Aarch64 FDT #address-cells and #size-cells support
    Resolves: rhbz#1436745
  - Fix ppc64 "grub2.chrp" to be "grub.chrp"
    Resolves: rhbz#1442970


author: Peter Jones <pjones@redhat.com> - 2.02-0.60
changelog:
  - Fix ppc64 deciding /boot/efi might somehow be the CHRP partition if it
    exists.  This is also why the bug we fixed in 0.59 showed up at all.
    Resolves: rhbz#1443809
    Resolves: rhbz#1442970
  - Fix a regexp problem where rpm spec parser un-escapes things that
    don't need escaping, which causes our s/-mcpu=power8/-mcpu=power6/
    to fail.
    Related: rhbz#1443809


author: Peter Jones <pjones@redhat.com> - 2.02-0.61
changelog:
  - Fix some minor ia32 booting bugs
    Related: rhbz#1310763
    Related: rhbz#1411748
    Related: rhbz#1300009
  - Add support for non-Ethernet network cards
    Related: rhbz#1232432
  - Add support for http booting
    Resolves: rhbz#1232432
  - Fix efi module subpackage obsoletes/provides
    Resolves: rhbz#1447723
  - Make ppc modules subpackages use different directories on the filesystem.
    Resolves: rhbz#1455243


author: Peter Jones <pjones@redhat.com> - 2.02-0.66
changelog:
  - Fix EFI UGA driver when the framebuffer is above 4G
    Resolves: rhbz#1457988
  - Handle XFS filesystems with sparse inodes
    Resolves: rhbz#1402716
  - Support HTTP booting
    Resolves: rhbz#1490981


author: Peter Jones <pjones@redhat.com> - 2.02-0.67
changelog:
  - Make the permissions on /boot/efi/... match the filesystem's requirements.
    Resolves: rhbz#1496952


author: Peter Jones <pjones@redhat.com> - 2.02-0.68
changelog:
  - More work on /boot/efi/... permissions
    Resolves: rhbz#1496952
  - Rework grubenv symlinks and handle them on upgrades
    Resolves: rhbz#1497918
  - Make grub2-setpassword -o work
    Resolves: rhbz#1512749


author: Peter Jones <pjones@redhat.com> - 2.02-0.71
changelog:
  - The change from 2.02-0.65.el7_4.2 never made it onto the main branch,
    so one more build to avoid the regression.
    Related: rhbz#1340893


author: Peter Jones <pjones@redhat.com> - 2.02-0.74
changelog:
  - Fix symlink issues with grubenv
    Resolves: rhbz#1602773
    Related: rhbz#1497918
  - Make the common subpackage only build on x86_64 to avoid timestamp
    mismatches.
    Related: rhbz#1602773
    Related: rhbz#1497918


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.78
changelog:
  - Prevent errors from diskfilter scan of removable drives
    Resolves: rhbz#1446418
  - Avoid grub2-efi package to overwrite existing /boot/grub2/grubenv file
    Resolves: rhbz#1497918
  - Remove glibc32 and glibc-static(x86-32) BuildRequires
    Resolves: rhbz#1614259


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.79
changelog:
  - Ignore the modification time when doing RPM verification of /boot/efi files
    Resolves: rhbz#1496952


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.82
changelog:
  - Prepend prefix when HTTP path is relative
  - efi/http: Export {fw,http}_path variables to make them global
  - efi/http: Enclose literal IPv6 addresses in square brackets
  - efi/net: Allow to specify a port number in addresses
  - efi/ip4_config: Improve check to detect literal IPv6 addresses
  - efi/net: Print a debug message if parsing the address fails


author: Peter Jones <pjones@redhat.com> - 2.02-0.86
changelog:
  - Fix several CVEs:
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 8.28-8
changelog:
  - Fix crash when config file doesn't match command line.
    Related: rhbz#1070646
  - Make crashes work with abrt better.
    Resolves: rhbz#1070646


author: Peter Jones <pjones@redhat.com> - 8.28-10
changelog:
  - Use the correct load commands for aarch64 efi.
    Resolves: rhbz#1081269
  - Support "devicetree" directive in grub2.
    Resolves: rhbz#1063534
  - Explain the default bootloaders and configuration paths slightly better
    in the manual.
    Resolves: rhbz#1001664
  - Conditionally create debug entries when installing kernels.
    Resolves: rhbz#957681
  - Make sure --banner from the command line is used correctly.
    Resolves: rhbz#1032048


author: Peter Jones <pjones@redhat.com> - 8.28-11
changelog:
  - Fix a memory corruption issue we're hitting on s390/s390x
    Resolves: rhbz#1152152
  - Don't use spaces on zipl platforms to describe debugging entries
    Related: rhbz#1152152


author: Peter Jones <pjones@redhat.com> - 8.28-12
changelog:
  - Do a better job recognizing "title" and "default" position and formatting
    on extlinux
    Resolves: rhbz#1200045
  - Do a better job recognizing stanza names and defaults on grub1 and grub2
    Related: rhbz#1142545
  - (reordered some patches to match the ordering in master)
    Related: rhbz#1200045
    Related: rhbz#1142545
  - Add test suite coverage and minor fixes related to zipl and
    --default-{kernel,index,title}
    Related: rhbz#1184014
  - Use systemd debug options that work on RHEL 7
    Resolves: rhbz#1212128


author: Peter Jones <pjones@redhat.com> - 8.28-14
changelog:
  - Handle "set variable" commands separately from other parsing in grubby's
    GetNextLine()
    Resolves: rhbz#1152550


author: Peter Jones <pjones@redhat.com> - 8.28-17
changelog:
  - Fix the ordering of creating the debug entries, so they don't get picked
    when we're choosing kernel command line defaults on upgrades.
    Related: rhbz#1212128


author: rmarshall@redhat.com - 8.28-18
changelog:
  - Patched new-kernel-pkg so that kernel installations when MAKEDEBUG is
    set would put the debugging entries after the non-debugging entries.
    Resolves: #1285601
  - Re-numbered the last set of patches to go with the flow. No actual
    changes to the patches; just a git mv to rename.
  - Re-organized and updated the grubby man page contents to include some
    features that were not documented as well as correct typos and
    re-write some entries for better clarity.
    Resolves: #1232168


author: rmarshall@redhat.com - 8.28-21
changelog:
  - Resolve issues with the recent grubby logic patches that
    appeared on the ppc platform. Fix a problem that occurred
    on systems where no kernel update had ever been installed.
    Resolves: rhbz#1285601
  - Specify the actual prune_debug file in sources.
    Resolves: rhbz#1285601


author: rmarshall@redhat.com - 8.28-23
changelog:
  - Fixes --info flag on s390/s390x.
    Related: rhbz#1285601
  - Fixes --set-default-index on s390/s390x.
    Related: rhbz#1285601
  - Allows prune_debug to run on s390/s390x.
    Resolves: rhbz#1285601


author: Peter Jones <pjones@redhat.com> - 8.28-24
changelog:
  - Ensure "grubby --default-title" takes the bootloader selection into
    account
    Resolves: rhbz#1340893


author: Peter Jones <pjones@redhat.com> - 8.28-25
changelog:
  - Ensure /etc/sysconfig/kernel has a stable mode, now that rpm handles ghost
    files differently.
    Resolves: rhbz#1584313


author: Javier Martinez Canillas <javierm@redhat.com> - 8.28-26
changelog:
  - Exclude building on i686
    Related: rhbz#1476273
  - Fix grubby removing wrong kernel command line parameter
    Resolves: rhbz#1476273
  - Improve man page for --info option (jstodola)
    Resolves: rhbz#1651673
  - Print default image even if isn't a suitable one
    Resolves: rhbz#1323842


author: Peter Jones <pjones@redhat.com> - 8.27-1
changelog:
  - Make grubby understand grub's "saved_entry" system
    Resolves: rhbz#808021
  - BuildRequire grub2 on appropriate platforms, for the test suite.
    Related: rhbz#808021


author: d.marlin <dmarlin@redhat.com>
changelog:
  - Only set RPM_OPT_FLAGS if undefined to avoid overwriting 
    the platform defaults.
    Resolves: rhbz#1023793


author: Yanko Kaneti <yaneti@declera.com> - 1.0.0-2
changelog:
  - Initial spec for review - 0.98.0-0.1.a648648
  - Additional patch + references + using %autopatch - 0.98.0-0.2.a648648
  - Update to 1.0.0. drop upstreamed paches - 1.0.0-1
  - Own some more directories as per review (#1167482) - 1.0.0-2


author: Guenther Deschner <gdeschner@redhat.com> 0.2.3-8
changelog:
  - Fix default proxymech documentation and fix LOCAL_FIRST implementation
  - resolves: https://fedorahosted.org/gss-proxy/ticket/105


author: Guenther Deschner <gdeschner@redhat.com> 0.3.0-0
changelog:
  - New upstream release 0.3.0:
    * Add support for impersonation (depends on s4u2self/s4u2proxy on the KDC)
    * Add support for new rpc.gssd mode of operation that forks and changes uid
    * Add 2 new options allow_any_uid and cred_usage


author: Guenther Deschner <gdeschner@redhat.com> 0.3.0-3
changelog:
  - Fix flags handling in gss_init_sec_context()
  - resolves: https://fedorahosted.org/gss-proxy/ticket/106
  - resolves: #1031713
  - Fix OID handling in gss_inquire_cred_by_mech()
  - resolves: https://fedorahosted.org/gss-proxy/ticket/107
  - resolves: #1031712
  - Fix continuation processing for not yet fully established contexts.
  - resolves: https://fedorahosted.org/gss-proxy/ticket/108
  - resolves: #1031711
  - Add flags filtering and flags enforcing.
  - resolves: https://fedorahosted.org/gss-proxy/ticket/109
  - resolves: #1031710


author: Guenther Deschner <gdeschner@redhat.com> 0.3.0-4
changelog:
  - Use secure_getenv
  - resolves: https://fedorahosted.org/gss-proxy/ticket/110
  - resolves: #1032684
  - Use strerror_r instead of strerror
  - resolves: https://fedorahosted.org/gss-proxy/ticket/111
  - resolves: #1033350


author: Roland Mainz <rmainz@redhat.com> 0.4.1-3
changelog:
  - Bug #1213852 ("[gssproxy] NFS clients cannot mount with
    sec=krb5 if the NFS server is running gssproxy") was
    fixed by the rebase to 0.4.1 in bug ("[RFE] Rebase
    gssproxy to the latest to match expectations of other
    projects").
    Note that the same bug was also fixed in the kernel with
    "9507271 svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT
    decoding failures" (see
    https://bugzilla.redhat.com/show_bug.cgi?id=1213852#c2
    and RH Bug #1120860 ("[NFS] NFS clients cannot mount with
    sec=krb5 if the NFS server is running gssproxy")) to
    handle various corner cases not covered by gssproxy,
    for example individual krb5 ticket fields exceeding
    the kernel's buffer size.


author: Roland Mainz <rmainz@redhat.com> 0.4.1-6
changelog:
  - Remove extra whitespaces from #1208640/#1194299 patches
  - spec file cleanup
  related: #1208640 #1194299


author: Robbie Harwood <rharwood@redhat.com> 0.6.2-1
changelog:
  - Rebase to latest version since we have krb5-1.15
  - Resolves: #1379836
  - Resolves: #1344518
  - Resolves: #1366782
  - Resolves: #1379005
  - Resolves: #1379482
  - Resolves: #1379616
  - Resolves: #1380490
  - Resolves: #1378600
  - Resolves: #1285012
  - Resolves: #1333813


author: Colin Walters <walters@verbum.org> 0.10.23-17
changelog:
  - Hack the gtk-doc to remove plugin docs that are not shipped
  - Drop mythtv, opencv sources that are no longer buildable


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-21
changelog:
  - Remove insecure NSF plugin
  - vmncdec: Sanity-check width/height before using it
  Resolves: rhbz#1400839


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-22
changelog:
  - h264parse: Ensure codec_data has the required size when reading number of SPS
  Resolves: rhbz#1400839


author: Hans de Goede <hdegoede@redhat.com> 0.10.31-2
changelog:
  - v4l2src: Cherry pick some patches from upstream hopefully fixing #815581
  - v4l2src: Deal with uvc cams which report duplicate framerates, such as
    on the Thinkpad x121e (rhbz#815134, gnome#677516)


author: Hans de Goede <hdegoede@redhat.com> - 0.10.31-3
changelog:
  - v4l2: Don't probe UVC devices for being interlaced, this saves seconds when
    starting a pipeline with a v4l2 element (rhbz#797188, gnome#677722)


author: Wim Taymans <wtaymans@redhat.com> - 1.4.5-6
changelog:
  - Fix h264 and h265 buffer size checks
  - Fix mpegts pat parsing and add more size checks
  Resolves: rhbz#1400898


author: Daniel P. Berrange <berrange@redhat.com> - 0.7.0-1
changelog:
  - Update to 0.7.0 release (rhbz #1416783)
  - Release held keys when loosing focus (rhbz #921008)
  - Avoid warnings when disconnecting (rhbz #1126825)
  - Workaround to avoid hang connecting to SPICE guest (rhbz #921330)
  - CVE-2017-5884 - fix bounds checking for RRE, hextile and
    copyrect encodings (rhbz #1425367)
  - CVE-2017-5885 - fix color map index bounds checking (rhbz #1425367)


author: Daniel P. Berrange <berrange@redhat.com> - 0.7.0-2
changelog:
  - Fix reserved data size (rhbz #1416783)
  - Fix inverted args in tests (rhbz #1416783)	  
  - Avoid sign extension problems (rhbz #1416783)
  - Fix crash with opening via GSocketAddress (rhbz #1416783)
  - Fix crash & error reporting during connection timeout (rhbz #1441120)
  - Fix incompatibility with libvncserver websockets (rhbz #921330)


author: Matthias Clasen <mclasen@redhat.com> - 3.8.4-5
changelog:
  - Avoid losing -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic
  - Related: #881175


author: Milan Crha <mcrha@redhat.com> - 4.8.5-2
changelog:
  - Add patch for RH bug #1255831 (Crash under html_text_get_link_at_offset())
  - Add patch for RH bug #1255826 (Images are not displayed in gtkhtml-editor-test)


author: Kalev Lember <kalevlember@gmail.com> - 2.24.2-1
changelog:
  - Update to 2.24.2
  - Removed mm-common buildrequire which is no longer needed for tarball builds
  - Cleaned up the spec file for modern rpmbuild


author: Matthew Barnes <mbarnes@redhat.com> - 2.0.16-1.fc13
changelog:
  - Update to 2.0.16
  - No need to run libtoolize and autoreconf.
  - Remove language comparison patch (fixed upstream).


author: Miroslav Lichvar <mlichvar@redhat.com> - 5:2.0.9-3
changelog:
  - drop renaming to guile2
  - fix multilib conflicts
  - fix post scriptlet to not remove files on upgrade
  - remove obsolete code from slib trigger
  - fix weekdays in changelog


author: Peter Robinson <pbrobinson@fedoraproject.org> 0.10.2-1
changelog:
  - 0.10.2 release
  - http://ftp.gnome.org/pub/GNOME/sources/gupnp-dlna/0.10/gupnp-dlna-0.10.2.news

   * Wed Apr 10 2013 Peter Robinson <pbrobinson@fedoraproject.org> 0.10.1-1
  - 0.10.1 release
  - http://ftp.gnome.org/pub/GNOME/sources/gupnp-dlna/0.10/gupnp-dlna-0.10.1.news


author: Tim Waugh <twaugh@redhat.com> 5.2.9-5
changelog:
  - Added IEEE 1284 Device IDs for Samsung ML-1450 (bug #844687) and
    Canon ML280 series (bug #848093).


author: Jiri Popelka <jpopelka@redhat.com> 5.2.9-8
changelog:
  - Added IEEE 1284 Device ID for Kyocera FS-1118MFP (bug #782379).
  - Use arch-specific dependency when requiring base package.


author: Tim Waugh <twaugh@redhat.com> - 5.2.9-17
changelog:
  - More fixes for bug #948967:
    - Supply man page for gutenprint-foomaticupdate.
    - Link to cups-genppd(8) man page from cups-genppd.5.2(8).


author: Ondrej Holy <oholy@redhat.com> - 1.22.4-1
changelog:
  - Update to 1.22.4
  - Remove obsolete upstream patches
  - Add translations updates from upstream
  - Resolves: #1174716


author: Ondrej Holy <oholy@redhat.com> - 1.30.3-1
changelog:
  - Update to 1.30.3
  - Disable nfs support (#1387270)
  - Revert desktop database scriplets
  - Resolves: #1386993, #1399343, #1306146, #1259746, #1344317


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-2
changelog:
  - Prevent spawning new daemons if outgoing operation exists (#1632960)
  - CVE-2019-3827: Prevent access if any authentication agent isn't available (#1673887)


author: Michal Luscon <mluscon@redhat.com> 1.5-1
changelog:
  - New upstream version
  - Removed gzip-1.3.9-stderr.patch
  - Removed gzip-1.3.10-zgreppipe.patch
  - Removed gzip-1.3.13-noemptysuffix.patch


author: Petr Stodulka <pstodulk@redhat.com> - 1.5-8
changelog:
  - Gzip overwrite existing files when user choose "no" on yes/no question.
    It's due to wrong dupicit declaration of yesno() function in gzip.h
    which is compiled wrong with -O2 option.
    Resolves: rhbz#1201689


author: Jakub Martisko <jamartis@redhat.com> - 1.5-10
changelog:
  - doc change: missing grep options are now mentioned in the zgrep 
    man pages/help message
    Resolves: #1437002


author: Robin Lee <cheeselee@fedoraproject.org> - 1.4.22-1
changelog:
  - Update to 1.4.22 (CVE-2012-2942, #824544)
  - Use linux2628 build target
  - No separate x86_64 build target for halog
  - halog build honors rpmbuild optflags
  - Specfile cleanup


author: Ryan O'Hara <rohara@redhat.com> - 1.4.23-1
changelog:
  - Update to 1.4.23 (CVE-2013-1912, #947697)
  - Drop supplementary groups after setuid/setgid (#894626)


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-11
changelog:
  - don't use mmap(2) to avoid failures on i386 with 1GB files and larger (#672917)
  - fix package URL (#676962)


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-12
changelog:
  - fix possible buffer overflows, integer overflows (CVE-2011-3630 CVE-2011-3631 CVE-2011-3632)
  - update man page


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0-14
changelog:
  - do not allow to hardlink files across filesystems by default (#786719)
    (use -f option to override)


author: Jan Silhan <jsilhan@redhat.com> - 0.5.3-2
changelog:
  - bumped release to be greater than f21 release
  - Add Peter to Authors (Peter Hjalmarsson)
  - Add support for armv6hl (Peter Hjalmarsson)


author: Michal Luscon <mluscon@redhat.com> 0.5.4-1
changelog:
  - setup tito to bump version in VERSION.cmake (Michal Luscon)
  - initialize to use tito (Michal Luscon)
  - prepare repo for tito build system (Michal Luscon)
  - New version 0.5.4 (Michal Luscon)
  - goal: implement methods for optional installation (RhBug:1167881) (Michal Luscon)
  - setup tito to bump version in VERSION.cmake (Michal Luscon)
  - initialize to use tito (Michal Luscon)
  - prepare repo for tito build system (Michal Luscon)
  - New version 0.5.4 (Michal Luscon)
  - goal: implement methods for optional installation (RhBug:1167881) (Michal Luscon)


author: Michal Luscon <mluscon@redhat.com> 0.5.5-1
changelog:
  - get rid of yum references (Jan Silhan)
  - sack: force recomputing excludes (Jan Silhan)
  - doc: cosmetic: made Sack headline more readable (Jan Silhan)
  - doc: sack: warning about using excludes, includes, disabling and enabling
    repos (Jan Silhan)
  - cosmetic: removed commented code (Jan Silhan)
  - sack: calls reinitiate provides after changing considered map (RhBug:1099342)
    (Jan Silhan)
  - fixed memleak from d8f2ca7 (Jan Silhan)
  - doc: add to CMDLINE_REPO_NAME and SYSTEM_REPO_NAME the Python API reference
    manual. (Radek Holy)
  - doc: add Repo to the Python API reference manual. (Radek Holy)
  - updated load_test_repo() to be able to load non-standard system repo (Michael
    Mraka)
  - python tests for goal.run(verify=True) (Michael Mraka)
  - test for HY_VERIFY flag (Michael Mraka)
  - introduced verify option for goal.run() (Michael Mraka)
  - AUTHORS: fixed name (Michael Mraka)
  - AUTHORS: added 3 Michaels (Jan Silhan)
  - Build for x86_64, correction for C++ (Michal Ruprich)


author: Michal Luscon <mluscon@redhat.com> 0.5.7-1
changelog:
  - spec: add a %{snapshot} macro for easier snapshot building (Radek Holy)
  - doc: sack: deep copy added to warning section (Jan Silhan)
  - doc: sack: warning about multiple Sack usage (Jan Silhan)
  - doc: sack: len(sack) -> method __len__ (Jan Silhan)
  - Package.files returns list of Unicode objects (Jan Silhan)


author: Jan Silhan <jsilhan@redhat.com> 0.5.8-1
changelog:
  - added implicit-function-declaration compile flag (Jan Silhan)
  - subject: Fix compiler warning introduced by previous commit (Colin Walters)
  - python: Verify that nosetest actually ran any tests (Colin Walters)
  - AUTHORS: updated (Jan Silhan)
  - subject: Remove internal header includes from public header (Colin Walters)
  - maintain result map in query (RhBug:1049205) (Jan Silhan)
  - AUTHORS: updated (Jan Silhan)
  - package: Don't assume the same pool in hy_package_cmp() (Matthew Barnes)


author: Jan Silhan <jsilhan@redhat.com> 0.5.8-2
changelog:
  - tito: change vesiontagger to releasetagger (Jan Silhan)
  - don't require python3 in rhel (Jan Silhan)


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.6-8
changelog:
  - Add missing barriers in cache initialization
  - Simplify shared lib extraction, resolves: CVE-2013-2035


author: Orion Poplawski <orion@cora.nwra.com> 1.8.12-5
changelog:
  - Use parallel make
  - Limit number of processors to 4 in parallel tests to avoid mpich issue with
    oversubscription


author: Orion Poplawski <orion@cora.nwra.com> - 1.8.12-6
changelog:
  - Add patch to add ppc64le to config.guess (bug #1080122)
  - Add patch to fix long double conversions on ppc64le (bug #1078173)
  - Run autoreconf for patches and to remove rpaths


author: Nalin Dahyabhai <nalin@fedoraproject.org> - 3.1.0-18
changelog:
  - adjust buildroot location (guidelines)
  - disable static libraries (guidelines)
  - tweak default payload attributes (guidelines)


author: Nalin Dahyabhai <nalin@fedoraproject.org> - 3.1.0-19
changelog:
  - fix the release number noted for the previous changelog entry (#225884)
  - remove unapplied "classes" patch (#225884)


author: Nalin Dahyabhai <nalin@fedoraproject.org> - 3.2.1-1
changelog:
  - update to 3.2.1
    - merged all patches or equivalents
    - re-merged hesinfo, so we obsolete it now
    - adds a pkgconfig configuration file for libhesiod
  - correct inconsistent changelog dates, assuming day-of-week is correct
  - add build requirement on libidn-devel
  - package the license


author: Ville Skyttä <ville.skytta@iki.fi> - 1.2.13-2
changelog:
  - Bring back config patch to fix -debuginfo, it hasn't been upstreamed yet.
  - Drop empty TODO from docs.


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.8-1
changelog:
  - New upstream version 1.3.8.
  - Fixes handling of keys which use ri-records, for both reading and
    writing (RHBZ#717583, RHBZ#987463).
  - Remove upstream patch.
  - Rebase dirs patch against new upstream sources.
  - Rebase ruby patch against new upstream sources.
  - Modernize the RPM spec file.
  - Fix .gitignore.


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.7
changelog:
  - Fix: "Argument list too long" when using virt-v2v on Windows guest
    with French copy of Citrix installed
    related: rhbz#1145056


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.8
changelog:
  - Tolerate corruption in some hives
    resolves: rhbz#1423436
  - Switch to using git to manage patches.


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.7-6
changelog:
  - Fix for latest Ruby in Rawhide.  Fixes build failure identified
    by mass rebuild yesterday.
  - Do not ignore error from running autoreconf.


author: Nalin Dahyabhai <nalin@redhat.com> 0.9.12-1
changelog:
  - fix regression of #512275 -- we looked for prelink, but didn't record
    its location properly (#559458)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.9.13-1
changelog:
  - treat unexpected command-line arguments as an error to avoid setting
    incorrect expectations, and warn when a check file doesn't appear to
    contain anything for us to check (#1016706)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.9.13-4
changelog:
  - only BuildRequire: prelink on the arches on which we know it runs (currently
    %{ix86}, x86_64, ppc, ppc64, s390, s390x), so that it can be built on the
    rest (#1061889)


author: Jiri Popelka <jpopelka@redhat.com> - 3.11-3
changelog:
  - remove some rh-specific bits from rh.patch as they are no longer valid (#881913)
  - remove outdated de & pt man pages
  - /usr move: use _bindir macro


author: Jiri Popelka <jpopelka@redhat.com> - 3.13.6-1
changelog:
  - 3.13.6
  - hplip-ipp-accessors.patch merged upstream
  - /etc/cron.daily/hplip_cron -> /usr/share/hplip/hplip_clean.sh


author: Tim Waugh <twaugh@redhat.com> - 3.13.7-2
changelog:
  - Applied patch to avoid unix-process authorization subject when using
    polkit as it is racy (CVE-2013-4325).


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.15.9-2
changelog:
  - 1069619 - Rebase to version 3.15.9 extension - solving bug 1346196 (/usr/lib/cups/filter/hpps uses python -B which is unknown), which is duplicate of bug 1202451


author: Lyude Paul <cpaul@redhat.com> - 1.0.0-7
changelog:
  - Initial port from Fedora to RHEL 7.3
  - Add patch for building with gcc4
  - Call autoreconf before starting build
  Resolves: rhbz#1311004


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1:1.8.1.3-14
changelog:
  - Remove dependency on initscripts
  - Add After=network.target to systemd service
  - Resolves: rhbz#1283893, rhbz#1269717


author: Petr Pisar <ppisar@redhat.com> - 1.0-0.1.b6
changelog:
  - 1.0b6 bump (CVE-2009-5067, bug #530403)
  - Fix regression from upstream 1.0b5..1.0b6
  - Fix spelling
  - Default attributes for xhtml2ps %files
  - Replace libpaper dependency with paperconf binary to make rpmlint happy


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1480321


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1479471


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-6
changelog:
  - Resolves: rhbz#1666381 - CVE-2018-12121 http-parser: nodejs: Denial of
                             Service with large HTTP headers [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-7
changelog:
  - Resolves: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                             allowed for spaces inside Content-Length header
                             values [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-8
changelog:
  - Backport needed test fixes
  - Related: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                            allowed for spaces inside Content-Length header
                            values [rhel-7]


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 4.2.1-2
changelog:
  - Install NOTICE.txt file
  - Fix javadir directory ownership
  - Fix directory permissions
  - Preserve timestamps
  - Replace add_to_maven_depmap with add_maven_depmap


author: Joe Orton <jorton@redhat.com> - 2.4.6-13
changelog:
  - mod_ssl: sanity-check use of "SSLCompression" (#1036666)
  - mod_proxy_http: fix brigade memory usage (#1040447)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-17
changelog:
  - mod_dav: add security fix for CVE-2013-6438 (#1077907)
  - mod_log_config: add security fix for CVE-2014-0098 (#1077907)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-36
changelog:
  - Revert fix for #1162152, it is not needed in RHEL7
  - mod_proxy_ajp: fix settings ProxyPass parameters for AJP backends (#1242416)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-37
changelog:
  - core: fix chunk header parsing defect (CVE-2015-3183)
  - core: replace of ap_some_auth_required with ap_some_authn_required
    and ap_force_authn hook (CVE-2015-3185)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-41
changelog:
  - mod_cache: merge r->err_headers_out into r->headers when the response
    is cached for the first time (#1264989)
  - mod_ssl: Do not send SSL warning when SNI hostname is not found as per
    RFC 6066 (#1298148)
  - mod_proxy_fcgi: Ignore body data from backend for 304 responses (#1263038)
  - fix apache user creation when apache group already exists (#1299889)
  - fix apache user creation when USERGROUPS_ENAB is set to 'no' (#1288757)
  - mod_proxy: fix slow response time for reponses with error status code
    when using ProxyErrorOverride (#1283653)
  - mod_ldap: Respect LDAPConnectionPoolTTL for authn connections (#1300149)
  - mod_ssl: use "localhost" in the dummy SSL cert for long FQDNs (#1240495)
  - rotatelogs: improve support for localtime (#1244545)
  - ab: fix read failure when targeting SSL server (#1255331)
  - mod_log_debug: fix LogMessage example in documentation (#1279465)
  - mod_authz_dbd, mod_authn_dbd, mod_session_dbd, mod_rewrite: Fix lifetime
    of DB lookup entries independently of the selected DB engine (#1287844)
  - mod_ssl: fix hardware crypto support with custom DH parms (#1291865)
  - mod_proxy_fcgi: fix SCRIPT_FILENAME when a balancer is used (#1302797)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-59
changelog:
  - Resolves: #1378946 - Backport of apache bug 55910: Continuation lines
    are broken during buffer resize


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-60
changelog:
  - Resolves: #1414258 - Crash during restart or at startup in mod_ssl,
    in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-61
changelog:
  - Related: #1414258 - Crash during restart or at startup in mod_ssl,
    in certinfo_free() function registered by ssl_stapling_ex_init()


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-62
changelog:
  - Resolves: #1397241 - Backport Apache Bug 53098 - mod_proxy_ajp:
    patch to set worker secret passed to tomcat


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-64
changelog:
  - Resolves: #1442872 - apache user is not created during httpd installation
    when apache group already exist with GID other than 48


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-67.2
changelog:
  - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
    authentication bypass
  - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
  - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
  - Resolves: #1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread
  - Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
    in mod_auth_digest


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-73
changelog:
  - Resolves: #1499253 - ProxyRemote with HTTPS backend sends requests
    with absoluteURI instead of abs_path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-74
changelog:
  - Resolves: #1430640 - "ProxyAddHeaders Off" does not become effective
    when it's defined outside <Proxy> setting


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-75
changelog:
  - Resolves: #1448892 - Cannot override LD_LIBARY_PATH in Apache HTTPD
    using SetEnv or PassEnv. Needs documentation.


author: Lubos Uhliarik <luhliari@redhat.com>
changelog:
  - Resolves: #1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation
    in mod_auth_digest
  - Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control
    bypass due to race condition
  - Resolves: #1696096 - CVE-2019-0220 httpd: URL normalization inconsistency


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-91
changelog:
  - Resolves: #1630886 - scriptlet can fail if hostname is not installed
  - Resolves: #1565465 - CVE-2017-15710 httpd: Out of bound write in
    mod_authnz_ldap when using too small Accept-Language values
  - Resolves: #1568298 - CVE-2018-1301 httpd: Out of bounds access after
    failure in reading the HTTP request
  - Resolves: #1673457 - Apache child process crashes because ScriptAliasMatch
    directive
  - Resolves: #1633152 - mod_session missing apr-util-openssl
  - Resolves: #1649470 - httpd response contains garbage in Content-Type header
  - Resolves: #1724034 - Unexpected OCSP in proxy SSL connection


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
  - Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
    newline in the file name
  - Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
  - Resolves: #1724879 - httpd terminates all SSL connections using an abortive
    shutdown
  - Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
  - Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
    mod_cache_socache can allow a remote attacker to cause a denial of service
  - Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
    mod_session can allow a remote user to modify session data for CGI applications


author: Pavel Alexeev <Pahan@Hubbitus.info> - 2.4.7.01.1
changelog:
  - Owesome! Httpd 2.4.7 pushed. It shoud not require any hack anymore.
  - Major update to 2.4.7-01.
  - Apache from 2.4 version have modularity structure, so many changes:
  	- Mpm may be build without apache source tree!
  	- Exclude apache sources, turn mpm-itk tarball into regular source0.
  	- So drop all black magic!
  	- Instal it as module, retire separate systemd service files and related stuff.
  	- Rewrite README.Fedora.


author: Pavel Alexeev <Pahan@Hubbitus.info> - 2.4.7.01-5
changelog:
  - Fix build issue on EL7 (rhbz# 1188159). Big thanks to Athmane Madjoudj <athmane@fedoraproject.org> for the work.


author: Pavel Alexeev <Pahan@Hubbitus.info> - 2.4.7.04-1
changelog:
  - Update to version 2.4.7-04 to solve problem https://lists.err.no/pipermail/mpm-itk/2015-September/000925.html. By mail request of Marco Matarazzo.


author: Jan Kaluza <jkaluza@redhat.com> - 1.1-7
changelog:
  - Obsolete all versions of httpd24-apr and httpd24-apr-util on RHEL7 (#1218271)
  - Do not mention RHSCL version in README and man page (#1219112)
  - Fix bad man page syntax (#1219511)


author: Jan Kaluza <jkaluza@redhat.com> - 1.4.6-2
changelog:
  - initial spec rewrite for scl build
  - fix strict-aliasing gcc warning
  - remove unused SHA384 and SHA512 code
  - update license


author: Kamil Dudka <kdudka@redhat.com> 7.46.0-1
changelog:
  - disable silent builds (suggested by Paul Howarth)
  - use default port numbers when running the upstream test-suite
  - install zsh completion script
  - new upstream release


author: Joe Orton <jorton@redhat.com> - 2.4.25-5
changelog:
  - mod_proxy_fcgi: revert to pre-2.4.23 SCRIPT_FILENAME mangling (#1414037)
  - mod_proxy: fix regression in per-dir ProxyPass (#1417482)


author: Joe Orton <jorton@redhat.com> - 2.4.25-9
changelog:
  - link only httpd, not support/* against -lselinux -lsystemd (#1433474)
  - don't enable SO_REUSEPORT in default configuration (#1432249)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.27-7
changelog:
  - Related: #1487164 - apache user is not created during httpd
    installation when apache group already exist with GID other than 48


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.34-5
changelog:
  - Resolves: #1640722 - mod_md is missing in httpd24-httpd
  - Resolves: #1635838 - CVE-2018-11763 httpd24-httpd: httpd:
    DoS for HTTP/2 connections by continuous SETTINGS


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.34-7
changelog:
  - Resolves: #1646937 - Unable to start httpd
  - Resolves: #1638711 - comments should be allowed at the end of Allow from
    statements


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.34-7.1
changelog:
  - Resolves: #1695428 - CVE-2019-0211 httpd24-httpd: httpd: privilege escalation
    from modules scripts


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-16
changelog:
  - MODLS-403: Check for Cloudlinux added to liblsapi
  - MODLS-434: Handler value was dropped after update
  - MODLS-435: Conflict with mpm_itk added to EA4 mod_lsapi
  - MODLS-433: New mechanism lsapi and web-interface of cPanel
  - Added /opt/cloudlinux as safe path
  - Fix httpd24 CL7 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-17
changelog:
  - MODLS-443: Hotfix: add setup-light command for cleaning all garbage in htaccess wich bring by previous versions
  - MODLS-442: Configure uninstall/update mod_lsapi with Plesk panel
  - MODLS-440: looking for user.ini in home dir
  - MODLS-400: DA script changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-20
changelog:
  - MODLS-445: CRIU messaging changed
  - MODLS-456: Added handlers for php 7.2 for cPanel EA4 and Plesk


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-21
changelog:
  - MODLS-452: Fix destroying of starter mutex on worker and event MPMs
  - MODLS-457: PWD var added into safe environment as cwd of backend process
  - MODLS-464: Max size of response header package fixed
  - MODLS-463: Add application/x-httpd-ea-php72___lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp and application/x-httpd-ea-php72-lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp
  - MODLS-460: Add ability to set lsapi_backend_children manually


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-22
changelog:
  - MODLS-466: lsapi_backend_semtimedwait option switched on by default
  - MODLS-466: lsapi-cache service improved
  - MODLS-466: lsapi-cache service for CL6 implemented
  - MODLS-468: criu messaging changed
  - MODLS-476: Add corresponding to criu messages into sulsphp_log
  - MODLS-475: Cleanup criu images on dump error
  - AAP-189: ea-apache24-mod_suphp-0.7.2-21 package installation flush php handlers to suphp
  - MODLS-470: Reset all criu images on update criu-lve and alt-phpXY


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-23
changelog:
  - MODLS-479: Make correct output of the totBytesRead and bodyLen values
  - MODLS-478: Prefix lsapi errors with timestamps
  - MODLS-472: unlimit core file size when BACKEND_COREDUMP on


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-24
changelog:
  - MODLS-483: Fix premature mutex destroying on MPM Event
  - MODLS-482: Refactor CRIU patch for PHP
  - MODLS-472: unlimit core file size on CL6


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-25
changelog:
  - MODLS-494: implement ~/mod_lsapi_reset_me flag for removing all CRUI images for all domains of user
  - dependency from alt-libxml2 removed from ea-apache24-mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-29
changelog:
  - MODLS-538: Alignment issue fixed
  - MODLS-531: Added check if criu images exist on restore request
  - MODLS-532: lsapi_disable_reject_mode option is added
  - MODLS-528: reopen sulsphp_log to exclude too big FD number for criu
  - MODLS-520: Added new lsapi_avoid_zombies config
  - MODLS-491: Avoid worker's child to accept the connection
  - MODLS-491: Avoid reading/writing stale data from/to the lsphp socket
  - MODLS-527: starter logic is improved
  - MODLS-525: httpd criu dumper permissions changed
  - MODLS-519: Option to disable PWD var added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-30

changelog:
  - MODLS-551: statistics for Plesk via API only; structure reinvented for EA4
  - MODLS-549: Added dump configs lsapi_criu, lsapi_with_connection_pool, lsapi_per_user
  - MODLS-549: mod_lsapi stat for EA4 (v.1)
  - MODLS-441: http_keep_http200 option added
  - MODLS-533: Hook for Plesk update added
  - MODLS-548: Suppress unrelevant warning messages on Apache restart


changelog:
  - switch_mod_lsapi --stat option added
  - MODLS-560: Installation of mod_lsapi package on DA added

author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-31


author:
  Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-33

changelog:
  - MODLS-590: Fixed stack overflow lscapi_do_request
  - MODLS-582: Update Copyright for mod_lsapi project
  - MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
  - MODLS-584: semtimedwait improvement
  - MODLS-580: stat support added for DA without mod_lsapi rpm
  - MODLS-481: fix stuck when bodyLen is wrong
  - MODLS-579: Remove LVE support from cpanel mod_lsapi
  - Fix exception in case if there are no liblsapi installed
  - MODLS-576: added absolute path for service util


author:
  Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-34

changelog:
  - MODLS-608: removed non-ascii symbol in copyright
  - MODLS-606: Fix lsapi_poll_timeout functionality
  - MODLS-600: fix mod_lsapi removal sets handler to none
  - MODLS-571: add support for httpd24-mod_lsapi usage statistics
  - MODLS-598: Fix permissions on config files
  - MODLS-587, MODLS-594: selector usage statistics added
  - MODLS-588: cpanel_mod_lsapi: put all of liblsapi's files into /opt/cpanel/ea-liblsapi/


author: Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-35
changelog:
  - Fixed statistics exceptions flow
  - MODLS-615: ea-apache24-mod_lsapi epoch bumped
  - MODLS-615: liblsapi confilct with ea-liblsapi added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-36
changelog:
  - MODLS-618: liblsapi vs ea-liblsapi conflict fixed
  - MODLS-619: Requires tag added for python related pkgs


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-37
changelog:
  - MODLS-616: Ensure existence of directory for lsapi sockets in /var/run
  - MODLS-621: Add a configuration option (lsapi_use_req_hostname) that controls how virtualhost name is picked
  - AAP-253: spec and cmake files redesigned for new httpd24 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-38
changelog:
  - MODLS-577: Log changed for errors produced by http filter
  - AAP-243: Sentry: create a mechanism to save errors from mod_lsapi
  - MODLS-644: added ea-php73 lsapi handler
  - Added troubleshooting link into log for rejected request


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-39

changelog:
  - MODLS-638: Clearing of systemd cgroup for lsphp added
  - MODLS-638: MODLS-481 reverted
  - MODLS-641: Build scripts redesigned
  - MODLS-654: CMakeCache deleted on make clean
  - AAP-243: Disable lsapi_sentry by default
  - MODLS-653: DA spec file added
  - MODLS-655: fix unexpected statistics output


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-40
changelog:
  - MODLS-661: Make possibility criu work on CL7h
  - MODLS-638: During graceful restart lsphp process are killed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-42
changelog:
  - MODLS-679: fixed race condition is dump req info
  - MODLS-674: liblsapi receive response header interface redesigned
  - MODLS-670: ElasticAPM support redesigned
  - MODLS-665: added sulsphp_log logfile location directive
  - MODLS-656: unifying form of errors for sentry


author: Leonid Kanter <lkanter@cloudlinux.com> - 0.7.2-1
changelog:
  - update to with-setid-mode="owner"
  - handle update of packages built with --with-setid-mode="owner" (dkasyanov@)


author: Caolán McNamara <caolanm@redhat.com> - 1.3.2-6
changelog:
  - Resolves: rhbz#573516 have hunspell require hunspell-en to ensure
    at least one dictionary exists


author: Caolan McNamara <caolanm@redhat.com> - 2.4-0.4.20070901
changelog:
  - it_IT_README.1st says GPLv2+, but it_IT_README.txt says GPLv3+ -> 
    change license field to GPLv3+


author: Parag <pnemade AT redhat DOT com> - 20080425-7
changelog:
  - Resolves:rh#959987: Error message: “0 is wrong flag id” occurs when using hunspell-ne
  - Resolves:rh#967638: ne_NP.dic contains both CRLF and LF line terminators


author: Parag Nemade <pnemade AT redhat.com> - 0.2.1-2
changelog:
  - Resolves: rh#571710: Fix license tag in spec file with new upstream release
  - Removed CREDITS file as upstream provides now README and LICENSE files.


author: Parag <pnemade@redhat.com> - 0.20050929-3
changelog:
  - Use aspell source instead to pull source as BR:aspell-te
  - Resolves:rh#511262 buildrequires aspell-te


author: Michal Minar <miminar@redhat.com> 0.247-1
changelog:
  - Moved blacklist.conf from /etc/modprobe.d to /usr/lib/modprobe.d.
  - Renamed it to dist-blacklist.conf.
  - Data files update


author: Michal Minar <miminar@redhat.com> 0.252-7.1
changelog:
  - Bumped release to reflect rhel version.
  - Fixed bogus dates in changelog.
  - Generate and install hwdb.d/* files.


author: Michal Minar <miminar@redhat.com> 0.252-8.1
changelog:
  - Updated pci, usb and vendor ids.
  - Resolves: rhbz#1236458
  - Resolves: rhbz#1256004
  - Resolves: rhbz#1266217
  - Resolves: rhbz#1271797


author: Michal Minar <miminar@redhat.com> 0.252-8.2
changelog:
  - Updated pci, usb and vendor ids.
  - Resolves: rhbz#1292382
  - Resolves: rhbz#1291614
  - Resolves: rhbz#1324198


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.252-8.5
changelog:
  - Updated pci, usb and vendor ids
    Resolves: #1386133 #1424763
  - Removed module nx_crypto from blacklist on PowerPCs
    Resolves: #1264326


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.252-8.9
changelog:
  - Updated pci, usb, vendor ids and hwdb files
    Resolves: #1560493
  - Blacklisted sha{256,512}-mb modules
    Resolves: #1562114


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 0.252-9.5
changelog:
  - Fix URL for downloading hwdb files
  - Updated pci, usb, vendor ids and hwdb files
    Resolves: #1721908


author: Jay Fenlason <fenlason@redhat.com> - 1.7-1.1
changelog:
  - Remove build dependencies on libXNVCtrl-devel and w3m because RHEL
    does not have them (w3m is available on x86_64, but not s390).
    Resolves: rhbz978752


author: Jay Fenlason <fenlason@redhat.com> - 1.7-1.2
changelog:
  - Split out lstopo into a -gui subpackage, so the hwloc base package
    does not pull in all of X.
    Resolves: rhbz910165


author: Don Zickus <dzickus@redhat.com> - 1.7-4
changelog:
  - Fix dangling symlink for hwloc-ls manpage
    Resolves: rhbz1081236
    Add desktop entry for lstopo
    Resolves: rhbz1229313


author: Michal Schmidt <mschmidt@redhat.com> - 1.11.8-4
changelog:
  - Rebase to 1.11.8.
  - Deal with rpaths using the method from Packaging Guidelines.
  - BuildRequire rdma-core-devel on s390(x).
  - Fix scriptlets related to hwloc-dump-hwdata.service.
  - Configure with /run as runstatedir.
  - Spec file cleanup.
  - Related: rhbz1482585


author: Tomas Hozza <thozza@redhat.com> - 0-0.20.20130826git
changelog:
  - Build daemons only for x86_64 architecture (#1010220)
  - Bump release to 20 to prevent RHEL6 -> RHEL7 update path issues


author: Tomas Hozza <thozza@redhat.com> - 0-0.21.20130826git
changelog:
  - Use 'hypervkvpd' directory in libexec for KVP daemon scripts (#1010280)
  - daemons are now WantedBy multi-user.target instead of basic.target (#1010284)


author: Matej Muzila <mmuzila@redhat.com> - 0-0.25.20141008git
changelog:
  - Daemons updated to the last git snapshot
  - Use kernel-headers instead of kernel-devel to build
  - Added Hyper-V fcopy daemon as hypervfcopyd subpackage


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.26.20150402git
changelog:
  - 2015-04-02 git snapshot
  - VSS: skip all readonly-mounted filesystems (#1160584)
  - VSS: support partitions mounted several times (#1169724)


author: Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.30.20161211git
changelog:
  - Use '-gt' instead of '>' to do the right comparison (#1414822)
  - hyperv-tools subpackage added (#1378710)
  - Update to upstream v4.9 (#1406397)


author: 2018 Vitaly Kuznetsov <vkuznets@redhat.com> - 0-0.33.20180415git
changelog:
  - Update to upstream v4.17-rc1, drop no longer needed bondvf.sh script
  - Fix KVP with SR-IOV (#1567022)


author: Caolán McNamara <caolanm@redhat.com> - 2.8.3-4
changelog:
  - Resolves: rhbz#813481 x86_64 valgrind spews, see rhbz#813780
  - Related: rhbz#813481 dump valgrind failure log


author: Jaromir Capik <jcapik@redhat.com> - 3.1.0-5
changelog:
  - Introducing man pages for binaries in the eepromer subpackage
  - Introducing -r switch in the i2cset help


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.1.0-11
changelog:
  - 1071397 - Load i2c-dev module when i2cdetect is executed
  - 1195285 - Ship modprobe.d files in /usr/lib/modprobe.d


author: Doug Ledford <dledford@redhat.com> - 1.0.5-2
changelog:
  - Don't install the address file or config file, the config file isn't
    strictly needed and defaults will be used if it isn't installed, but
    with the address file we specifically need to build one based upon
    the machine where the program is installed, a default file is not only
    not helpful, but it messes up the daemon.
  - Related: bz700285


author: Doug Ledford <dledford@redhat.com> - 1.0.5-3
changelog:
  - Until the next upstream release, the pid file is in a wonky location.
    Make the init script know about that location so we can stop properly.
  - Resolves: bz808599


author: Michal Schmidt <mschmidt@redhat.com> - 1.0.10-0.1.20150717git825da3ccd2
changelog:
  - Update to pre-release git snapshot of 1.0.10.
  - Adds libibacmp shared library.
  - Rebase coverity patch.
  - Minor spec file cleanup.
  - Resolves: bz1169952


author: Michal Schmidt <mschmidt@redhat.com> - 1.0.10-0.3.20150717git825da3ccd2
changelog:
  - Put libibacmp.so in the main package, it's needed at runtime.
  - No need to run ldconfig, the .so is not in the linker path.
  - Filter the plugin from RPM provides.
  - Related: bz1169952


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-6
changelog:
  - Resolves: #1051389, #1051391, #1051408, #1051397, #1051398, #1051415,
                Updated ibus-HEAD.patch for upstream
  - Resolves: #1050813
    Deleted notify-python in Requires


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-12
changelog:
  - Resolves: #1183909 - programs using "PreeditType: OverTheSpot" is stalled
  - Resolves: #1191825 - gtk2's immodules.cache won't be updated in some cases


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.3-1
changelog:
  - Bumped to 1.5.3
  - Deleted ibus-xx-g-s-disable-preedit.patch as EOL.
  - Deleted ibus-gjs as EOL.
  - Removed imsettings-gnome, im-chooser, libgnomekbd dependencies.


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.4-1
changelog:
  - Resolves Bug 842856 - ibus-chewing 1.4.3-1 not built with $RPM_OPT_FLAGS
  - Resolves Bug 1027030 - CVE-2013-4509 ibus-chewing: ibus: visible 
    password entry flaw [fedora-all]
    Thanks czchen for the GitHub pull request 39.
  - Added translations: fr_FR, ja_JP, ko_KR
  - Adopt cmake-fedora-1.2.0


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.4-7
changelog:
  - Target "translation" is built separately with all, 
    in order to tame multiple job make.
  - Resolves Bug 1013977 - ibus-chewing needs to have ibus write-cache --system in %post and %postun
  - Resolves Bug 1027031 - CVE-2013-4509 ibus-chewing: ibus: visible password entry flaw [rhel-7.0]
  - Resolves Bug 1028911 - [zh_TW]'Chinese<->English' switch does not work when clicking on the Chewing menu list.
  - Resolves Bug 1045868 - ibus-chewing *again* not built with $RPM_OPT_FLAGS
  - Option "Sync between caps lock and IM":
    + Default of  is changed to "disable",  because the previous default
      "keyboard" cause bug 1028911 for GNOME Shell.
    + Now Sync from "input method" can control Caps LED in GNOME shell.
  - Translation added: de_DE, es_ES, it_IT, pt_BR, uk_UA
  - Set environment IBUS_CHEWING_LOGFILE for ibus-chewing log.


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.4-9
changelog:
  - Resolves Bug 1119963 - Slow focus change with ibus-chewing
  - Resolves Bug 1062133 - ibus-chewing may not handle key event after focus change
  - Resolves Bug 1073797 - Cannot identify input mode for Chinese IME (ibus-chewing)


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.2-1
changelog:
  - Fixed GitHub issue #7: highlighted text be cut after switch back to pure ibus
    by merging pull request #24 from buganini
  - Fixed GitHub issue #20: Shift key will send duplicated strings
    by merging pull request #22 from buganini
  - Fixed GitHub issue #21: somethings wrong with cmake
  - Fixed GitHub issue #25: Weird symbol when input with somethings highlighted
    by merging pull request #26 from buganini
  - Fixed GitHub issue #27: Local path committed into tree
  - Fixed: Bug 713033 -  [zh_TW] ibus-chewing problem
  - Fixed: Bug 745371 -  ibus-chewing: mode confusion In Temporary English mode and Chinese mode later on
  - Fixed: Google Issue 1172: [ibus-chewing] move elf file to standard directory.
  - Fixed: Google Issue 1426: ibus-chewing-1.3.10 installs directory /gconf to root filesystem
  - Fixed: Google Issue 1428: ibus-chewing-1.3.10 fails to save it's settings
  - Fixed: Google Issue 1481: Some characters are missing when a long string in preedit buffer.
  - Fixed: Google Issue 1490: Cannot change INSTAL prefix for ibus-chewing-1.4.0


author: Ding-Yi Chen <dchen at redhat.com> - 1.4.3-1
changelog:
  - Fixed GitHub issue #30: Rework decorate_preedit
    by merging pull request #30 from buganini
  - Fixed GitHub issue #31: Properly refresh property
    by merging pull request #31 from buganini


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-3
changelog:
  - Remove have_bridge_hotkey and need_pygobject3 macros which does no
    longer make sense after F17
  - Add ibus-hangul-dconf-prefix.patch
  - Fix bug 909509 - Hangul Keybaord doesn't be changed in IBusHangul Setup


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-7
changelog:
  - Invoke ibus-setup-hangul with the absolute path.
  - Fix bug 1012732 - Click ibus hangul setup on gnome-shell top bar's
    ibus -> No Response


author: Daiki Ueno <dueno@redhat.com> - 1.4.2-10
changelog:
  - Add ibus-hangul-hangul-toggle.patch
  - Fix bug 1071351 - Cannot switch English input mode and Hangul
    (Korean) input mode by Hangul key


author: Daiki Ueno <dueno@redhat.com> - 1.5.18-6
changelog:
  - add ibus-kkc-16th-candidate.patch (Closes: #1251882)
  - add ibus-kkc-page-settings.patch (Closes: #1251891)
  - add ibus-kkc-ignore-annotations.patch (Closes: #1251896)


author: Peng Wu <pwu@redhat.com> - 1.6.91-4
changelog:
  - Resolves: rhbz#1068338, rhbz#1068448
  - Add patch ibus-libpinyin-update-gnome-shell-indicatior.patch
  - Add patch ibus-libpinyin-drop-xdg-depends.patch


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-3
changelog:
  - Add ibus-m17n-fix-mtext-config.patch
  - Fix bug 836397 - [abrt] ibus-m17n-1.3.3-11.fc17: mtext_data: Process
    /usr/libexec/ibus-setup-m17n was killed by signal 11 (SIGSEGV)


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-4
changelog:
  - Add ibus-m17n-translit-layout.patch
  - Fix bug 847495 - For non-US keyboard layout Ibus-m17n adds English
    (US) to the list of input methods and other input methods use US
    layout
  - Require eekboard-service instead of eekboard
  - Fix bug 847500 - Don't install Eekboard by default in the desktop spin


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-6
changelog:
  - Add ibus-m17n-desktop-file.patch
    Fix bug 860955 - ibus-m17n setup is not enabled in
    gnome-control-center region, .desktop file is missing


author: Daiki Ueno <deno@redhat.com> - 1.3.4-8
changelog:
  - Update ibus-m17n-HEAD.patch to the latest upstream master
  - Remove unnecessary and not upstreamable patches
  - Use gtk3 always
  - Fix bug 912592 - ibus-m17n should use default keyboard in most cases


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-9
changelog:
  - Update ibus-m17n-xkb-options.patch to set XKB option for Inscript2
  - Fix bug 957993 - ibus-m17n doesn't automatically map Alt_R to AltGr
    when Inscript2 maps are used


author: Daiki Ueno <dueno@redhat.com> - 1.3.4-10
changelog:
  - Add ibus-m17n-fix-data-location.patch
  - Fix bug 962144 [abrt] ibus-m17n-1.3.4-9.fc19:
    setup_dialog_load_config: Process /usr/libexec/ibus-setup-m17n was
    killed by signal 11 (SIGSEGV)


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20120907-2
changelog:
  - Resolves: #856320
  - Improve check whether a phrase is simplified or traditional Chinese
    The improvement is to ignore all non-Han characters when
    doing the check.
    This is to avoid classifying a simplified Chinese string as
    traditional just because it happens to include some non-Chinese
    characters, for example box drawing characters, which cannot be
    converted to gb2312 but happen to be convertible to big5hkscs.
    This fixes the problem in the emoji-table input method that most
    phrases cannot be input at all.


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20120907-3
changelog:
  - Resolves: #856903
  - Fix ipa-x-sampa table and phrases containing spaces in emoji-table
    Currently there is a regular expression which filters out several
    lines defining valid phrases. The emoji-table for example has phrases
    containing spaces which are currently filtered out and the ipa-x-sampa
    table has trailing comments which are filtered out as well.


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20121113-1
changelog:
  - update to latest upstream 1.4.99.20121113 from Caius ‘kaio’ Chance’s repository, using rel20121101 git tag
  - remove ibus-table-1.4.99.20120907-improve-chinese-category-check.patch (included upstream)
  - remove fix-ipa-x-sampa-table-and-phrases-containing-spaces.patch (included upstream)
  - Fix marking of translatable strings for gettext
  - update zh_??.po files
  - Add German translation
  - Do not fail if the ~/.ibus/byo-tables/ directory does not exist


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20130108-1
changelog:
  - update to latest upstream 1.4.99.20130108 from Caius ‘kaio’ Chance’s repository, 1.5.0 branch
  - includes port to GObjectIntrospection now


author: Mike FABIAN <mfabian@redhat.com> - 1.4.99.20130110-1
changelog:
  - Resolves: #513901 ibus-table setup does not store config settings
  - update to latest upstream 1.4.99.20130110 from Caius ‘kaio’ Chance’s repository, 1.5.0 branch
  - When detecting the Chinese mode from the environment, also check LC_ALL
  - Fix typo in self._chinese_mode variable (The typo broke the SC/TC property)
  - Make cursor in lookup table always visible (became invisible after the port to GObjectIntrospection)
  - apply changes in values of dconf keys immediately


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0-1
changelog:
  - update to latest upstream 1.5.0  from Caius ‘kaio’ Chance’s repository
  - add patches for better simplified/traditional Chinese detection
  - Resolves: #857967 - simplified/traditional Chinese detection in ibus-table does not work well


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0-2
changelog:
  - Resolves: #911487 - Non-Chinese tables from the ibus-table-other package do not work
  - Add auto_select functionality to select the first phrase when typing.
    Useful for Cyrillic transliteration
  - Update cmode property in chinese mode only
  - Fall back to auto_select = False if neither dconf nor the table
    have a value for auto_select
  - Preedit needs to be updated on page-up and page-down


author: Mike FABIAN <mfabian@redhat.com> - 1.5.0-5
changelog:
  - Resolves: rhbz#1049760 - [ALL LANG] Traceback produced when run ibus-table-createdb from terminal.
  - When tabcreatedb.py is called without any options, print a usage message. Do not just show a cryptic backtrace.


author: Ding-Yi Chen <dchen@redhat.com> - 1.3.0.20101206-1
changelog:
  - New tables which was not include in original:
    + array30, array30-big, wubi-haifeng
  - Table removed from original version because of license issues:
    + zhengma, ziranma
  - Add package review ID
  - Add build tag for el6


author: Ding-Yi Chen <dchen@redhat.com> - 1.3.0.20110114-1
changelog:
  - Fix Bug 667877: ibus-table-yinma and ibus-table-xingma have been obsoleted.
  - Now depends on cmake-fedora


author: Ding-Yi Chen <dchen@redhat.com> - 1.3.4-1
changelog:
  - Fixed Bug 715707 - FTBFS ibus-table-chinese-1.3.0.20110114-2.fc15
  - Fixed Bug 629212 - bad candidate orders in ibus-table-quick
  - Merged patch from sagara @ github, which address IBus issue 787
  - Make it compatible with cmake-fedora-0.7.994
  - Move the cmake policies to the front
  - Suppress the misleading warning from rpm -V


author: Ding-Yi Chen <dchen@redhat.com> - 1.4.0-1
changelog:
  - Table build scripts has been refactored.
  - cmake-fedora is added as submodule.
  - Fixed Bug 855250 - Change the default filtering for Quick and Cangjie by
    merging maxiaojun's repository
  - Fixed Google Issue 1405: failed to build ibus-table-chinese due to missing db files


author: Ding-Yi Chen <dchen@redhat.com> - 1.4.5-1
changelog:
  - Table build scripts has been refactored.
  - cmake-fedora is added as submodule.
  - Fixed Bug 855250 - Change the default filtering for Quick and Cangjie by
    merging maxiaojun's repository
  - Fixed Google Issue 1405: failed to build ibus-table-chinese due to missing db files
  - Fixed Google issue 1507: Add CJKV Extension C/D support for Array30
  - Merge GitHub Pull request 3: Added the inter punct
  - Merge GitHub Pull request 4: Give Cangjie and Quick users 9 candidates per page


author: Ding-Yi Chen <dchen@redhat.com> - 1.4.6-1
changelog:
  - Fixed IBus Google issue 1126: An error in ChineseTableLicenseAuditing
  - Complete LICENSE tag for all of the tables.


author: Mike FABIAN <mfabian@redhat.com> - 1.0.0-1
changelog:
  - Update to 1.0.0 upstream version
  - Remove mudb and use “Write-Ahead Logging”
  - Introduce an environment variable IBUS_TYPING_BOOSTER_DEBUG_LEVEL for debugging
  - Speed up converting an old database to the current format
  - Make prediction more intelligent by using context of up to 2 previous words
  - Automatically remove whitespace between the last word and a punctuation character ending a sentence


author: Mike FABIAN <mfabian@redhat.com> - 1.0.3-1
changelog:
  - Update to 1.0.3 upstream version
  - Don’t output page_size in “/usr/libexec/ibus-engine-typing-booster --xml” (Resolves: rhbz#975449 - ibus-daemon prints warnings because “/usr/libexec/ibus-engine-typing-booster --xml” prints the invalid element “page_size”)
  - Use ~/.local/share/ibus-typing-booster/ to store user data and log files (Resolves: rhbz#949035 - don't use a hidden directory under .local/share)


author: Mike FABIAN <mfabian@redhat.com> - 1.1.0-1
changelog:
  - Update to 1.1.0 upstream version
  - Add a commit=True parameter to check_phrase_and_update_frequency()
  - Fix that the page_size is shown as 0 in the setup tool if it has not been set before
  - Do not use AUTOINCREMENT
  - Make it possible to exit the setup tool by typing Control-C in the terminal
  - Add feature to read a text file for training the user database
  - Update German translations and .pot file
  - Fix error when the hunspell dictionary for an engine is missing


author: Mike FABIAN <mfabian@redhat.com> - 1.2.0-1
changelog:
  - Update to 1.2.0 upstream version
  - Make TAB when used to enable/disable the lookup table work as a toogle
  - Create a VIEW for “LIKE input_phrase%” in select_words() and use that
    in the following SELECT statements (Makes candidate calculation more
    than 10 times faster)


author: Mike FABIAN <mfabian@redhat.com> - 1.2.1-1
changelog:
  - Update to 1.2.1 upstream version
  - Pop up a message box when a file has been read to train the database, indicating success or failure (Resolves: rhbz#979933)
  - Update German translation
  - Ignore most punctuation characters and mathematical symbols when tokenizing (Resolves: rhbz#979939)


author: Mike FABIAN <mfabian@redhat.com> - 1.2.2-1
changelog:
  - Update to 1.2.2 upstream version
  - Commit immediately when certain punctuation characters are typed and transliteration is not used (Resolves: rhbz#981179)
  - Add an option to try completion only when a minimum number of characters has been typed


author: Mike FABIAN <mfabian@redhat.com> - 1.2.3-1
changelog:
  - Update to 1.2.3 upstream version
  - Fix exception handling when trying to install a rpm package (Resolves: rhbz#986178)


author: Jay Fenlason <fenlason@redhat.com> 1.5.7-8
changelog:
  - Add the -output patch to have programs use /var/cache/ibutils
    instead of /tmp
    Resolves: bz958569


author: Doug Ledford <dledford@redhat.com> - 1.5.7-12
changelog:
  - Change ExclusiveArch to ExcludeArch instead so we don't have
    the same problem again in the future
  - Update to the git repo tarball that we shipped in rhel6.6
  - Related: bz1123998


author: Nicolas Chauvet <kwizart@gmail.com> - 1.3.0-1
changelog:
  - Rename to icc-profiles-openicc
  - Add scriptlet for icons directory
  - Use absolute path for update-mime-database
  - Drop README
  - Add directory ownership


author: Ville Skyttä <ville.skytta@iki.fi> - 1.3.1-5
changelog:
  - Resolves: rhbz#875496
  - Build with $RPM_LD_FLAGS and %{_smp_mflags}.
  - Run unit tests during build.


author: Jiri Vanek <jvanek@redhat.com> 1.3.2-0
changelog:
  - Updated to latest ustream release of 1.3 branch - 1.3.2
   - Security Updates
    - CVE-2013-1927, RH884705: fixed gifar vulnerability
    - CVE-2013-1926, RH916774: Class-loader incorrectly shared for applets with same relative-path.
   - Common
    - Added new option in itw-settings which allows users to set JVM arguments when plugin is initialized.
   - NetX
    - PR580: http://www.horaoficial.cl/ loads improperly
   - Plugin
     PR1260: IcedTea-Web should not rely on GTK
     PR1157: Applets can hang browser after fatal exception
  - Removed upstreamed patch to remove GTK dependency
    - icedtea-web-pr1260-remove-gtk-dep.patch


author: Jiri Vanek <jvanek@redhat.com> 1.4-0
changelog:
  - Updated to 1.4
  - See announcement for detail
   - http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-May/023195.html
  - commented out check - some junit4  incompatibility


author: Jiri Vanek <jvanek@redhat.com> 1.4-1
changelog:
  - Adapted to latest openjdk changes
  - added build requires for autoconf and automake
  - minor clean up


author: Jiri Vanek <jvanek@redhat.com> 1.4.1-0
changelog:
  - updated to 1.4.1
  - add icedtea-web man page (resolves 948443)
  - removed upstreamed  patch1 b25-appContextFix.patch
  - removed upstreamed  patch2 rhino-pac-permissions.patch
  - make check enabled again
  - should be build for non-standart archs !-)
  - removed unused multilib arches (yupii!)
  - Resolves: rhbz#1009820


author: Jiri Vanek <jvanek@redhat.com> 1.6.0-1
changelog:
  - update to upstream 1.6
  - made to use jdk8 (rh1184970)
  - it will be necessary for 1.6.1 anyway (rh1233687)
  - Resolves: rhbz#1217153


author: Jiri Vanek <jvanek@redhat.com> 1.6.1-1
changelog:
  - updated to upstream release 1.6.1
  - metadata xml files enhanced for javaws
  - forced to use jdk8 by default
  - Resolves: rhbz#1217153


author: Jiri Vanek <jvanek@redhat.com> 1.6.1-4
changelog:
  - added and and applied patch2 fileLogInitializationError-1.6.patch to prevent 
  consequences 1268909
  - Resolves: rhbz#1217153


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. %add_maven_depmap need tobe fixed)
  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-3
changelog:
  - added --family to make it part of javas alternatives alignment
  - java-javaver-openjdk collected into preffered_java 
  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.7-1
changelog:
  - updated to itw 1.7 and sync from fedora
  - added forgotten slaves of itweb-settings policyeditor
  - Own %{_datadir}/%{name} dir
  - Mark non-English man pages with %lang
  - Install COPYING as %license
  - last three by Ville Skytta <ville.skytta@iki.fi> via 1481270
  - for sake of rpms added patch0, bashCompDirHardcodedAgain.patch to hardcode bashcompletion dir
  - removed maven macros in favour of manual handling (bug)
  - Resolves: rhbz#1475411


author: Jiri Vanek <jvanek@redhat.com> 1.7.2-16
changelog:
  - added patch1, patch4 and patch11 to fix CVE-2019-10182
  - added patch2 to fix CVE-2019-10181
  - added patch3 and patch33 to fix CVE-2019-10185
  - Resolves: rhbz#1724958 
  - Resolves: rhbz#1725928 
  - Resolves: rhbz#1724989


author: Martin Gieseking <martin.gieseking@uos.de> 0.30.0-1
changelog:
  - updated to release 0.30.0
  - dropped patch as it has been applied upstream
  - removed old buildroot stuff


author: Richard W.M. Jones <rjones@redhat.com> - 0.31.3-1
changelog:
  - Rebase to upstream version 0.31.3.
  - This version includes multiple security fixes
    CVE-2017-5208, CVE-2017-5333, CVE-2017-5332, CVE-2017-6009,
    CVE-2017-6010, CVE-2017-6011
    resolves: rhbz#1430610


author: Eike Rathke <erack@redhat.com> - 50.1.2-6
changelog:
  - Resolves: rhbz#966141 various flaws in Layout Engine font processing
  - Resolves: rhbz#966077 aarch64 support for icu-config.sh wrapper


author: Mike FABIAN <mfabian@redhat.com> - 50.2-1
changelog:
  - Update to 50.2 maintenance release including support for new Japanese era Reiwa (令和).
  - Resolves: rhbz#1677092


author: Mike FABIAN <mfabian@redhat.com> - 50.2-2
changelog:
  - Fix rpmdiff failure: File /usr/src/debug/icu/source/i18n/unicode/selfmt.h
    relaxed permissions from 0644 to 0755 on all architectures
  - Related: rhbz#1677092


author: Rex Dieter <rdieter@fedoraproject.org> - 1.0.2-2
changelog:
  - libIlmThread missing -pthread linkage (#661115)
  - %install: INSTALL="install -p"
  - -devel: tighten dep using %?_isa


author: Rex Dieter <rdieter@fedoraproject.org> - 1.0.3-3
changelog:
  - IlmBase.pc: +Requires.private: gl glu
  - -devel: drop hard-coded libGL/pkgconfig deps, let rpm autodetect now


author: Akira TAGOH <tagoh@redhat.com> - 1.6.2-1
changelog:
  - New upstream release.
  - the spec file cleanup.
  - Correct License field
  - Add Provides: bundled(egglib) to im-chooser-common since
    it actually contains things in libimchooseui.so.0


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release.
    - Add a link to the log file in the error dialog (#950488)
    - Fix a crash issue (#859624)


author: Akira TAGOH <tagoh@redhat.com> - 1.6.4-6
changelog:
  - Bring up gnome-control-center region if current desktop is GNOME.
  - Hide application from menu. (#1657016)


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.0-1
changelog:
  - New upstream release
  - Remove libtool files
  - Run ldconfig after un/installation to update *.so files
  - Add -devel subpackage to handle include files and examples


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> - 1.1-1
changelog:
  - New upstream release
  - Adjusted docbook xsl path to match the correct stylesheet
  - Remove only *.la files, considering there aren't any *.a files


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-10
changelog:
  - Fix a regression imsettings can't detect GNOME running caused by GNOME rebase. (#1533772)
  - Fix unbound variable issue (#1533050)


author: Akira TAGOH <tagoh@redhat.com> - 1.6.3-11
changelog:
  - Don't set environment variables on GNOME. (#1673284)
  - Fix another unbound variable issue (#1533050)


author: Doug Ledford <dledford@redhat.com> - 1.5.5-1.el6
changelog:
  - Update and rebuild against latest opensm (which was needed for latest
    ibutils, which was needed for licensing issues resolved in new upstream
    tarball, which was needed for pkgwrangler review)
  - Related: bz555835


author: Doug Ledford <dledford@redhat.com> - 1.5.8-1.el6
changelog:
  - Update to latest upstream version
  - Make build work on i686 arch
  - Modify perfquery to be able to loop through all HCAs in a single host
  - Resolves: bz593767
  - Related: bz725016


author: Doug Ledford <dledford@redhat.com> - 1.5.12-1
changelog:
  - Update to latest upstream release
  - Initial Fedora import
  - Add devel and devel static packages (review item)
  - Make etc file config(noreplace) (review item)
  - Remove no longer support scripts (review item)


author: Doug Ledford <dledford@redhat.com> - 1.6.2-1
changelog:
  - Update to latest upstream release (resolves bz998816)
  - Revive all_hcas patch (otherwise would be a regression)
  - Fix ibnodes -h output (another regression, bz1054545)
  - Resolves: bz998816, bz1054545


author: Michal Schmidt <mschmidt@redhat.com> - 1.6.5-1
changelog:
  - Update to latest upstream release. Adds rdma-ndd daemon.
  - Rebase patches, cherry-pick fixes from upstream git.
  - Enable build on s390(x).
  - Fixed bogus changelog dates.
  - Add Conflicts with old rdma. It needs to be aware of rdma-ndd.
  - Resolves: bz1169968


author: Honggang Li <honli@redhat.com> - 1.6.7-1
changelog:
  - Rebase to latest upstream release 1.6.7.
  - Remove patches merged into upstream release.
  - Remove sub-package rdma-ndd as it merged into rdma-core.
  - Resolves: bz1382809


author: Jay Fenlason <fenlason@redhat.com> - 1.13-2
changelog:
  - Use macros for lib and include directories, and include dist tag in
    release field.
  - Corrected License field.
  - Corrected Requires lines for libuuid.
  - Add Exclusive-arch x86_64
    Related: rhbz570274


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Include the -execstack patch to get libinfinipath.so correctly
    labeled as not executing the stack.
    Resolves: rhbz612936


author: Jay Fenlason <fenlason@redhat.com> 3.1-1
changelog:
  - Upgrade to new upstream version.
  - add the -edata patch to handle the type-change of the edata sypmbol
    from 'A' to 'D'.


author: jay Fenlason <fenlason@redhat.com> 3.1-2.r364.1140_open
changelog:
  - Pull in upstream patch to close
    Resolves: rhbz907730 - [RHEL-7.0] libpsm_infinipath.so: undefined reference to knem_open_device


author: Jay Fenlason <fenlason@redhat.com> 3.1-3.r364.1140_open
changelog:
  - Fix the path to the udev file to close
    Resolves: rhbz1034508 - [RHEL-7.0] /dev/ipath* permissions are wrong


author: Jay Fenlason <fenlason@redhat.com> -3.2-2_ga8c3e3e_open.2
changelog:
  - Update the -build patch and this spec file so the library is built
    with the standard optimization and security flags.
    Resolves: rhbz1070814


author: Honggang Li <honli@redhat.com> - 3.3-22_g4abbc60_open.1
changelog:
  - Rebase to latest upstream release.
  - Link against system libuuid library.
  - Spec file cleanup.
  - Related: bz1272022


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.9.6-1
changelog:
  - Ignore .po and generated files in po/ (dshea)
    Related: rhbz#1040240
  - Mark title strings in the initial-setup hub as translatable (dshea)
    Resolves: rhbz#1040240
  - Reword the EULA spokes' status messages (vpodzime)
    Resolves: rhbz#1039672
  - Cancel formatting of EULA when putting it into the text buffer (vpodzime)
    Resolves: rhbz#1039675


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.3.9.9-1
changelog:
  - Try to quit plymouth before running our X server instance
    Resolves: rhbz#1058329
  - Get rid of the empty debuginfo package
    Related: rhbz#1057590


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.12-1
changelog:
  - Set initial-setup translation domain for the hub and EULA spoke (mkolman)
    Resolves: rhbz#1040240


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.28-1
changelog:
  - Run the TUI service before hvc0.service (#1209731) (mmatsuya)
    Resolves: rhbz#1209731
  - Don't create /etc/sysconfig/initial-setup on s390 (#1181209) (mkolman)
    Related: rhbz#1181209
  - Setup the locale before starting the UI (dshea)
    Resolves: rhbz#1198642


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.30-1
changelog:
  - Only root should be able to read the initial-setup-ks.cfg file (#1264336) (mkolman)
    Resolves: rhbz#1264336


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.31-1
changelog:
  - Makefile improvements (#1249598) (mkolman)
    Related: rhbz#1249598
  - Make Initial Setup startup more robust (#1249598) (mkolman)
    Resolves: rhbz#1249598
  - Move the s390 profile scripts to a subfolder (#1249598) (mkolman)
    Realeted: rhbz#1249598
  - Improve log messages for kickstart parsing error (#1249598) (mkolman)
    Related: rhbz#1249598
  - Make sure full screen is used & window header bar is hidden (#1290321) (mkolman)
    Resolves: rhbz#1290321
  - Use blank title for the Initial Setup window (#1310179) (mkolman)
    Resolves: rhbz#1310179


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.32-1
changelog:
  - Fix reconfiguration service name (mkolman)
    Related: rhbz#1257624
  - Fix installation path for a reconfiguration related script (mkolman)
    Related: rhbz#1257624
  - Use the environs flag when setting the environment (mkolman)
    Related: rhbz#1270354
  - Some typo fixes and logging improvements (mkolman)
    Related: rhbz#1257624
  - Add a systemd service that enables Initial Setup if /.unconfigured exists (#1257624) (mkolman)
    Resolves: rhbz#1257624
  - Initialize Thread Manager as early as possible (#1249598) (mkolman)
    Related: rhbz#1249598
  - Adapt to addon execute() signature change (mkolman)
    Related: rhbz#1288636
  - Suppress an error message about missing initial-setup-graphical.unit (#1249598) (mkolman)
    Related: rhbz#1249598


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.34-1
changelog:
  - Suppress logging to stdout when TUI is started by s390 startup scripts (mkolman)
    Related: rhbz#1366776
  - Fix path to TUI executable in the s390 startup scripts (#1366776) (mkolman)
    Resolves: rhbz#1366776
  - Canonicalize symlinks returned by readlink (mkolman)
    Related: rhbz#1360343


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.35-1
changelog:
  - Change how Initial Setup reconfig mode is started (#1342536) (mkolman)
    Related: rhbz#1342536
  - Add systemd scriptlets for initial-setup-reconfigure.service (#1342536) (mkolman)
    Related: rhbz#1342536


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.39-1
changelog:
  - Run GUI on the s390 if possible (#1378082) (mkolman)
    Resolves: rhbz#1378082
  - Make it possible to set stdout log verbosity level (mkolman)
    Related: rhbz#1378082
  - Make it possible to show window header (mkolman)
    Related: rhbz#1378082


author: Martin Kolman <mkolman@redhat.com> - 0.3.9.42-1
changelog:
  - Use constant+offset when turning systemd console logging on/off (#1479787) (mkolman)
    Resolves: rhbz#1479787


author: Lukas Nykryn <lnykryn@redhat.com> - 9.49.7-1
changelog:
  - readonly-root: Add /var/log/audit/audit.log to rwtab (#1026815)
  - brandot: fix posssible segfault (#1024922)


author: Václav Pavlín <vpavlin@redhat.com> - 9.49.8-1
changelog:
  - service: suggest using systemctl if unknown action is used (#1029350)
  - rename_device: remove comments and trailing whitespaces (#1027945)
  - readonly-root: restore selinux context after bind mount (#1029342)


author: Václav Pavlín <vpavlin@redhat.com> - 9.49.11-1
changelog:
  - Revert: provide KVM guest count and limit info message (#1014731)
  - add C implementation of reverted patch


author: Lukas Nykryn <lnykryn@redhat.com> - 9.49.12-1
changelog:
  - use iw instead of iwconfig and friends (#915343)
  - don't care about rc.local anymore (#1034156)
  - udev-kvm-check: simplify reading of threshold (#1031568)
  - brandbot: read only first line (#1031490)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.13-1
changelog:
  - delete IPX support
  - update ifup/ifdown NetworkManager interaction (#1036701, #1061810)
  - set shmmax and shmall defaults to match rhel6 values (#1056547)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.14-1
changelog:
  - update ifup/ifdown NetworkManager interaction (#1036701, #1061810)
  - service: fix action matching
  - service: add condrestart to allowed commands (#1069222)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.49.31-1
changelog:
  - ipv6: wait for all global IPv6 addresses to leave the "tentative" state
  - source_config: tell NetworkManger to load ifcfg file even for NM_CONTROLLED=no
  - ifup-aliases: inherit ARPCHECK from parent device
  - rhel-dmesg: don't start in containers
  - ifup-eth: fix typo in error message (#1038776)
  - sysctl.conf: steal comments about /usr,/etc,... from fedora's sysctl.conf
  - rwtab: /var/lib/nfs needs to copy the files
  - functions: improve killing loops
  - ipcalc: detect invalid mask
  - ifup: set valid_lft and preferred_lft to forever for static ip
  - service: use systemd mangle for given service
  - ifup-post: check resolve.conf also with DNS2
  - ifdown-post: remove resolv.conf only in specific cases
  - spec: ghost /var/log/dmesg
  - network-functions: is_available_wait should wait even in the case that is_available returns 2
  - autorelabel: turn quota off before relabeling
  - autorelabel: call dracut-initramfs-restore before forced reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.38-1
changelog:
  - ifdown-eth: we need to flush global scope as well
  - killproc/status: add missing '-b <binary>' option
  - specfile: mark 'rwtab' and 'statetab' as config files
  - spec: we need newer lvm
  - rwtab: add /var/lib/systemd/timers
  - ifup-eth: remove quote marks
  - 9.70-sync: Move everything to github
  - 9.70-sync: rwtab updated
  - 9.70-sync: service file updated
  - 9.70-sync: syconfig.txt updated
  - 9.70-sync: systemd/rhel-import-state updated
  - 9.70-sync: sysconfig/network-scripts/* updated - part 2
  - 9.70-sync: sysconfig/network-scripts/* updated - part 1
  - 9.70-sync: rc.d/init.d/network updated
  - 9.70-sync: rc.d/init.d/netconsole updated
  - 9.70-sync: rc.d/init.d/functions updated
  - 9.70-sync: ipv6-6to4.howto example updated
  - 9.70-sync: examples/networking/ifcfg-bridge updated
  - network: load NetworkManager connection via dbus
  - network: check for running NetworkManager via dbus


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.39-1
changelog:
  - sysconfig.txt: mention previously introduced NO_DHCP_HOSTNAME option
  - DHCP_FQDN and DHCP_SEND_HOSTNAME introduced
  - re-add missing $HOSTNAME initialization
  - ifup: add support for VLAN_EGRESS_PRIORITY_MAP
  - rhel-autorelabel: synchronize cached writes before reboot


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.40-1
changelog:
  - require 'redhat-release' instead of /etc/system-release & conflict with older versions
  - ifup-post: always update 'nameserver' & 'search' entries in /etc/resolv.conf
  - systemd/system: symlinks for initscripts' services removed
  - *.old extension added to list of ignored files
  - ifup-eth: wait for STP to complete setup on bridge if $DELAY is not set
  - init.d/functions: convert2sec() function added
  - init.d/functions: is_true() & is_false() extended by ON/OFF support
  - usleep(1) calls replaced with sleep(1) calls
  - network-scripts: DBus calls forwarded to /dev/null
  - network-scripts: firewall-cmd replaced with DBus calls
  - ARPUDATE option introduced


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.41-1
changelog:
  - ifdown-post: fix logical error in commit 5d61564
  - network-functions: use POSIX forwarding instead of bash-ism


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.42-1
changelog:
  - rhel-autorelabel: set UEFI boot order (BootNext) same as BootCurrent
  - network-functions: use tr to upper case strings rather than awk
  - sysconfig/readonly-root: Clarify the usage of readonly-root
  - network-functions: add error messages for bonding installation
  - sysctl.conf.s390: drop SHMALL and SHMMAX
  - network.service: 'reload' removed
  - rhel-readonly.service: target name for random seed fixed
  - init.d/functions: fix sourcing for ksh


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.45-1
changelog:
  - network: parsing of /proc/mounts returned (bug #1572659)
  - netconsole: LSB header added (bug #1508489)
  - ifdown-eth: no longer needed 'pidof -x dhclient' condition removed (bug #1559384)


author: Jan Macku <jamacku@redhat.com> - 9.49.48-1
changelog:
  - network: don't fail with IFDOWN_ON_SHUTDOWN (bug #1693977)
  - Configure autorelabel service to output to journal and to console if set (bug #1634661)
  - Fix changelog typo


author: Jan Macku <jamacku@redhat.com> - 9.49.49-1
changelog:
  - ifup-eth: Check that device name is set (bug #1741830)
  - Add option for IPv6 GRE tunnel (bug #1691552)


author: Alon Levy <alevy@redhat.com>
changelog:
  - Update to 0.50.0
  - Drop patch carried for bz#568845 (schemas-merge) per last comment
    in that bug.


author: Jon Ciesla <limburgher@gmail.com> - 0.50.2-1
changelog:
  - Latest stable release.
  - Merge review BZ 225902 fixes:
  - Removed Obsoletes/Provides for xml-i18n-tools.
  - Swapped gettext/gettext-devel Requires, BuildRequires.
  - Added %check section.


author: Parag Nemade <pnemade AT redhat DOT com>- 1.3.13-4
changelog:
  - Resolves:rh#799568 - iok crashed while selecting 'xkb-Malayalam (enhanced Inscript with Rupee Sign)'


author: Andrew Price <anprice@redhat.com> - 0.0-1.20130117git26d4e95
changelog:
  - Further improve the versioning
  - Preserve timestamp on man page
  - Remove BuildRoot, the clean and defattr sections and don't clean buildroot
  - Install to DESTDIR
  - Update Source and add a comment on how the tarball was generated
  - Use _smp_mflags in build
  - Thanks to Eduardo Echeverria for reviewing the package


author: Andrew Price <anprice@redhat.com> - 1.0-4
changelog:
  - Fix a label overflow in plot_io
    Resolves: rhbz#1004820
  - Add bounds checking in find_step
    Resolves: rhbz#1004882
  - Fix processing of trace filenames containing spaces
    Resolves: rhbz#1004865


author: Andrew Price <anprice@redhat.com> - 1.0-6
changelog:
  - Add Requires: librsvg2-tools to enable video generation
  - Merge trace dumping functions into one
  - Check program exit code properly
  - Fix up directory trace processing
    Resolves: rhbz#1004865


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-20
changelog:
  - trustdomain-find with pkey-only fails (#1068611)
  - Invalid credential cache in trust-add (#1069182)
  - ipa-replica-install prints unexpected error (#1069722)
  - Too big font in input fields in details facet in Firefox (#1069720)
  - trust-add for POSIX AD does not fetch trustdomains (#1070925)
  - Misleading trust-add error message in some cases (#1070926)
  - Access is not rejected for disabled domain (#1070924)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-22
changelog:
  - ipa-replica-install never checks for 7389 port (#1075165)
  - Non-terminated string may be passed to LDAP search (#1075091)
  - ipa-sam may fail to translate group SID into GID (#1073829)
  - Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-26
changelog:
  - When IdM server trusts multiple AD forests, IPA client returns invalid group
    membership info (#1079498)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-28
changelog:
  - ipa-client-automount fails with incompatibility error when installed against
    older IPA server (#1083108)


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2.1
changelog:
  - Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
  - Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
  - Related: #1356134 'kinit -E' does not work for IPA user


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-3
changelog:
  - Resolves: #1296140 Remove redhat-access-plugin-ipa support
    - Obsolete and conflict redhat-access-plugin-ipa
  - Resolves: #1351119 Multiple issues while uninstalling ipa-server
    - server uninstall fails to remove krb principals
  - Resolves: #1351758 ipa commands not showing expected error messages
    - frontend: copy command arguments to output params on client
    - Show full error message for selinuxusermap-add-hostgroup
  - Resolves: #1352883 Traceback on adding default automember group and hostgroup
    set
    - allow 'value' output param in commands without primary key
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - schema: Fix subtopic -> topic mapping
  - Resolves: #1354348 ipa trustconfig-show throws internal error.
    - allow 'value' output param in commands without primary key
  - Resolves: #1354381 ipa trust-add with raw option gives internal error.
    - trust-add: handle `--all/--raw` options properly
  - Resolves: #1354493 Replica install fails with old IPA master
    - DNS install: Ensure that DNS servers container exists
  - Resolves: #1354628 ipa hostgroup-add-member does not return error message
    when adding itself as member
    - frontend: copy command arguments to output params on client
  - Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
    - messages: specify message type for ResultFormattingError
  - Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
    secret key
    - expose `--secret` option in radiusproxy-* commands
    - prevent search for RADIUS proxy servers by secret
  - Resolves: #1356099 Bug in the ipapwd plugin
    - Heap corruption in ipapwd plugin
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
  - Resolves: #1356964 Renaming a user removes all of his principal aliases
    - Preserve user principal aliases during rename operation


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-4
changelog:
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - harden the check for trust namespace overlap in new principals
  - Resolves: #1351142 CLI is not using session cookies for communication with
    IPA API
    - Fix session cookies
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - help: Add dnsserver commands to help topic 'dns'
  - Resolves: #1354406 host-del updatedns options complains about missing ptr
    record for host
    - Host-del: fix behavior of --updatedns and PTR records
  - Resolves: #1355718 ipa-replica-manage man page example output differs actual
    command output
    - Minor fix in ipa-replica-manage MAN page
  - Resolves: #1358229 Traceback message should be fixed, seen while editing
    winsync migrated user information in Default trust view.
    - baseldap: Fix MidairCollision instantiation during entry modification
  - Resolves: #1358849 CA replica install logs to wrong log file
    - unite log file name of ipa-ca-install
  - Resolves: #1359130 ipa-server-install command fails to install IPA server.
    - DNS Locations: fix update-system-records unpacking error
  - Resolves: #1359237 AVC on dirsrv config caused by IPA installer
    - Use copy when replacing files to keep SELinux context
  - Resolves: #1359692 ipa-client-install join fail with traceback against
    RHEL-6.8 ipa-server
    - compat: fix ping call
  - Resolves: #1359738 ipa-replica-install --domain=<IPA primary domain> option
    does not work
    - replica-install: Fix --domain
  - Resolves: #1360778 Vault commands are available in CLI even when the server
    does not support them
    - Revert "Enable vault-* commands on client"
    - client: fix hiding of commands which lack server support
  - Related: #1281704 Rebase to softhsm 2.1.0
    - Remove the workaround for softhsm bug #1293340
  - Related: #1298288 [RFE] Improve performance in large environments.
    - Create indexes for krbCanonicalName attribute


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-5
changelog:
  - Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
    - Do not initialize API in ipa-client-automount uninstall
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - idrange: fix unassigned global variable
  - Resolves: #1360792 Migrating users doesn't update krbCanonicalName
    - re-set canonical principal name on migrated users
  - Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
    and 'bool' objects
    - Fix ipa hbactest output
  - Resolves: #1362260 ipa vault-mod no longer allows defining salt
    - vault: add missing salt option to vault_mod
  - Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
    public key
    - vault: Catch correct exception in decrypt
  - Resolves: #1362537 ipa-server-install fails to create symlink from
    /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
    - Correct path to HTTPD's systemd service directory
  - Resolves: #1363756 Increase length of passwords generated by installer
    - Increase default length of auto generated passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-6
changelog:
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
    - Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
  - Resolves: #1341249 Subsequent external CA installation fails
    - install: fix external CA cert validation
  - Resolves: #1353831 ipa-server-install fails in container because of
    hostnamectl set-hostname
    - server-install: Fix --hostname option to always override api.env values
    - install: Call hostnamectl set-hostname only if --hostname option is used
  - Resolves: #1356091 ipa-cacert-manage --help and man differ
    - Improvements for the ipa-cacert-manage man and help
  - Resolves: #1360631 ipa-backup is not keeping the
    /etc/tmpfiles.d/dirsrv-<instance>.conf
    - ipa-backup: backup /etc/tmpfiles.d/dirsrv-<instance>.conf
  - Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
    file is needed
    - Update ipa-replica-install documentation
  - Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
    not rpm-require it
    - client: RPM require initscripts to get *-domainname.service
  - Resolves: #1364197 caacl: error when instantiating rules with service
    principals
    - caacl: fix regression in rule instantiation
  - Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
    - parameters: move the `confirm` kwarg to Param
  - Resolves: #1364464 Topology graph: ca and domain adders shows question marks
    instead of plus icon
    - Fix unicode characters in ca and domain adders
  - Resolves: #1365083 Incomplete output returned for command ipa vault-add
    - client: add missing output params to client-side commands
  - Resolves: #1365526 build fails during "make check"
    - ipa-kdb: Fix unit test after packaging changes in krb5


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-7
changelog:
  - Resolves: #1361119 UPN-based search for AD users does not match an entry in
    slapi-nis map cache
    - support multiple uid values in schema compatibility tree


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-8
changelog:
  - Resolves: #1298288 [RFE] Improve performance in large environments.
    - cert: speed up cert-find
  - Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
    authentication
    - service: add flag to allow S4U2Self
    - Add 'trusted to auth as user' checkbox
    - Added new authentication method
  - Resolves: #1353881 ipa-replica-install suggests about
    non-existent --force-ntpd option
    - Don't show --force-ntpd option in replica install
  - Resolves: #1354441 DNS forwarder check is too strict: unable to add
    sub-domain to already-broken domain
    - DNS: allow to add forward zone to already broken sub-domain
  - Resolves: #1356146 performance regression in CLI help
    - schema: Speed up schema cache
    - frontend: Change doc, summary, topic and NO_CLI to class properties
    - schema: Introduce schema cache format
    - schema: Generate bits for help load them on request
    - help: Do not create instances to get information about commands and topics
    - schema cache: Do not reset ServerInfo dirty flag
    - schema cache: Do not read fingerprint and format from cache
    - Access data for help separately
    - frontent: Add summary class property to CommandOverride
    - schema cache: Read server info only once
    - schema cache: Store API schema cache in memory
    - client: Do not create instance just to check isinstance
    - schema cache: Read schema instead of rewriting it when SchemaUpToDate
  - Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
    - server install: do not prompt for cert file PIN repeatedly
  - Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
    cache directory: [Errno 13] Permission denied: '/home/test_user'
    - schema: Speed up schema cache
  - Resolves: #1366604 `cert-find` crashes on invalid certificate data
    - cert: do not crash on invalid data in cert-find
  - Resolves: #1366612 Middle replica uninstallation in line topology works
    without '--ignore-topology-disconnect'
    - Fail on topology disconnect/last role removal
  - Resolves: #1366626 caacl-add-service: incorrect error message when service
    does not exists
    - Fix ipa-caalc-add-service error message
  - Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
    does not happen to run during dnf upgrade
    - DNS server upgrade: do not fail when DNS server did not respond
  - Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
    with CA
    - Add warning about only one existing CA server
    - Set servers list as default facet in topology facet group
  - Resolves: #1367773 thin client ignores locale change
    - schema check: Check current client language against cached one


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-9
changelog:
  - Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
    - Fix ipa-server-install in pure IPv6 environment
  - Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
    reachable via the forest root
    - trust: make sure ID range is created for the child domain even if it exists
    - ipa-kdb: simplify trusted domain parent search
  - Resolves: #1335567 Update Warning in IdM Web UI API browser
    - WebUI: add API browser is tech preview warning
  - Resolves: #1348560 Mulitple domain Active Directory Trust conflict
    - ipaserver/dcerpc: reformat to make the code closer to pep8
    - trust: automatically resolve DNS trust conflicts for triangle trusts
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)
  - Resolves: #1353936 custodia.conf and server.keys file is world-readable.
    - Remove Custodia server keys from LDAP
    - Secure permissions of Custodia server.keys
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
    - custodia: include known CA certs in the PKCS#12 file for Dogtag
    - custodia: force reconnect before retrieving CA certs from LDAP
  - Resolves: #1362333 ipa vault container owner cannot add vault
    - Fix: container owner should be able to add vault
  - Resolves: #1365546 External trust with root domain is transitive
    - trust: make sure external trust topology is correctly rendered
  - Resolves: #1365572 IPA server broken after upgrade
    - Require pki-core-10.3.3-7
  - Resolves: #1367864 Server assumes latest version of command instead of
    version 1 for old / 3rd party clients
    - rpcserver: assume version 1 for unversioned command calls
    - rpcserver: fix crash in XML-RPC system commands
  - Resolves: #1367773 thin client ignores locale change
    - schema cache: Fallback to 'en_us' when locale is not available
  - Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
    - Fail on topology disconnect/last role removal
  - Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
    - otptoken, permission: Convert custom type parameters on server
  - Resolves: #1369414 ipa server-del fails with Python stack trace
    - Handled empty hostname in server-del command
  - Resolves: #1369761 ipa-server must depend on a version of httpd that support
    mod_proxy with UDS
    - Require httpd 2.4.6-31 with mod_proxy Unix socket support
  - Resolves: #1370512 Received ACIError instead of DuplicatedError in
    stageuser_tests
    - Raise DuplicatedEnrty error when user exists in delete_container
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add missing param values to cert-find output
  - Renamed patch 1011 to 0100, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-10
changelog:
  - Resolves: #1355753 adding two way non transitive(external) trust displays
    internal error on the console
    - Always fetch forest info from root DCs when establishing two-way trust
    - factor out `populate_remote_domain` method into module-level function
    - Always fetch forest info from root DCs when establishing one-way trust
  - Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
    after `ipa-replica-install`
    - Track lightweight CAs on replica installation
  - Resolves: #1357488 ipa command stuck forever on higher versioned client with
    lower versioned server
    - compat: Save server's API version in for pre-schema servers
    - compat: Fix ping command call
    - schema cache: Store and check info for pre-schema servers
  - Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
    - Fix man page ipa-replica-manage: remove duplicate -c option
      from --no-lookup
  - Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
    when revoking certificate
    - cert: include CA name in cert command output
    - WebUI add support for sub-CAs while revoking certificates
  - Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
    - Add support for additional options taken from table facet
    - WebUI: Fix showing certificates issued by sub-CA
  - Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
    internactively
    - dns: normalize record type read interactively in dnsrecord_add
    - dns: prompt for missing record parts in CLI
    - dns: fix crash in interactive mode against old servers
  - Resolves: #1370519 Certificate revocation in service-del and host-del isn't
    aware of Sub CAs
    - cert: fix cert-find --certificate when the cert is not in LDAP
    - Make host/service cert revocation aware of lightweight CAs
  - Resolves: #1371901 Use OAEP padding with custodia
    - Use RSA-OAEP instead of RSA PKCS#1 v1.5
  - Resolves: #1371915 When establishing external two-way trust, forest root
    Administrator account is used to fetch domain info
    - do not use trusted forest name to construct domain admin principal
  - Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
    certificate request
    - Fix CA ACL Check on SubjectAltNames
  - Resolves: #1373272 CLI always sends default command version
    - cli: use full name when executing a command
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix ipa-certupdate for CA-less installation
  - Resolves: #1373540 client-install with IPv6 address fails on link-local
    address (always)
    - Fix parse errors with link-local addresses


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-11
changelog:
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix regression introduced in ipa-certupdate


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-12
changelog:
  - Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
  - Resolves: #1375269 ipa trust-fetch-domains throws internal error


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-12.el7
changelog:
  - Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
    - python2-ipalib: add missing python dependency
    - installer service: fix typo in service entry
    - upgrade: add missing suffix to http instance
  - Resolves: #1444791 Update man page of ipa-kra-install 
    - ipa-kra-install manpage: document domain-level 1
  - Resolves: #1441493 ipa cert-show raises stack traces when
    --certificate-out=/tmp 
    - cert-show: writable files does not mean dirs 
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - Bump version of ipa.conf file
  - Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
    - Turn on NSSOCSP check in mod_nss conf
  - Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
    template on
    - renew agent: respect CA renewal master setting
    - server upgrade: always fix certmonger tracking request
    - cainstance: use correct profile for lightweight CA certificates
    - renew agent: allow reusing existing certs
    - renew agent: always export CSR on IPA CA certificate renewal
    - renew agent: get rid of virtual profiles
    - ipa-cacert-manage: add --external-ca-type
  - Resolves: #1441593 error adding authenticator indicators to host 
    - Fixing adding authenticator indicators to host
  - Resolves: #1449525 Set directory ownership in spec file 
    - Added plugins directory to ipaclient subpackages
    - ipaclient: fix missing RPM ownership
  - Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
    - otptoken-add-yubikey: When --digits not provided use default value


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-13.el7
changelog:
  - Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
    error observed during ipa upgrade with latest package. 
    - ipa-server-install: fix uninstall
  - Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
    replica 
    - ca install: merge duplicated code for DM password
    - installutils: add DM password validator
    - ca, kra install: validate DM password


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-14.el7
changelog:
  - Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to 
    handle PKINIT certificates/anchors
    - certdb: add named trust flag constants
    - certdb, certs: make trust flags argument mandatory
    - certdb: use custom object for trust flags
    - install: trust IPA CA for PKINIT
    - client install: fix client PKINIT configuration
    - install: introduce generic Kerberos Augeas lens
    - server install: fix KDC PKINIT configuration
    - ipapython.ipautil.run: Add option to set umask before executing command
    - certs: do not export keys world-readable in install_key_from_p12
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
    - replica install: respect --pkinit-cert-file
    - cacert manage: support PKINIT
    - server certinstall: support PKINIT
  - Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
    option
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
  - Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
    decommissioned
    - ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname 
  - Resolves: #1451712 KRA installation fails on server that was originally
    installed as CA-less
    - ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
  - Resolves: #1441499 ipa cert-show does not raise error if no file name
    specified
    - ca/cert-show: check certificate_out in options
  - Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
    - Remove pkinit-anonymous command
  - Resolves: #1449523 Provide an API command to retrieve PKINIT status
    in the FreeIPA topology
    - Allow for multivalued server attributes
    - Refactor the role/attribute member reporting code
    - Add an attribute reporting client PKINIT-capable servers
    - Add the list of PKINIT servers as a virtual attribute to global config
    - Add `pkinit-status` command
    - test_serverroles: Get rid of MockLDAP and use ldap2 instead
  - Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
    - Fix rare race condition with missing ccache file
  - Resolves: #1455045 Simple service uninstallers must be able to handle
    missing service files gracefully
    - only stop/disable simple service if it is installed
  - Resolves: #1455541 after upgrade login from web ui breaks
    - krb5: make sure KDC certificate is readable
  - Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
    command "ipa cert-request --add" after upgrade
    - Change python-cryptography to python2-cryptography


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-15.el7
changelog:
  - Resolves: #1442233 IPA client commands fail when pointing to replica 
    - httpinstance: wait until the service entry is replicated
  - Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
    not indexed
    - Fix index definition for ipaAnchorUUID
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Avoid possible endless recursion in RPC call
    - rpc: preparations for recursion fix
    - rpc: avoid possible recursion in create_connection
  - Resolves: #1446087 services entries missing krbCanonicalName attribute.
    - Changing cert-find to do not use only primary key to search in LDAP.
  - Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
    - ipa-kdb: reload certificate mapping rules periodically
  - Resolves: #1455541 after upgrade login from web ui breaks
    - kdc.key should not be visible to all 
  - Resolves: #1435606 Add pkinit_indicator option to KDC configuration
    - ipa-kdb: add pkinit authentication indicator in case of a successful
      certauth
  - Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
    issuance when ipa-ca records are not resolvable
    - Turn off OCSP check
  - Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
    server_del - TypeError: 'NoneType' object is not iterable
    - fix incorrect suffix handling in topology checks


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-16.el7
changelog:
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Only warn when specified server IP addresses don't match intf
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Bump version of python-gssapi
  - Resolves: #1457942 certauth: use canonical principal for lookups
    - ipa-kdb: use canonical principal in certauth plugin
  - Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
    breaking older clients
    - Add code to be able to set default kinit lifetime
    - Revert setting sessionMaxAge for old clients


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-17.el7
changelog:
  - Resolve: #1455946 Provide a tooling automating the configuration 
    of Smart Card authentication on a FreeIPA master
    - server certinstall: update KDC master entry
    - pkinit manage: introduce ipa-pkinit-manage
    - server upgrade: do not enable PKINIT by default
    - Extend the advice printing code by some useful abstractions
    - Prepare advise plugin for smart card auth configuration
  - Resolve: #1461053 allow to modify list of UPNs of a trusted forest
    - trust-mod: allow modifying list of UPNs of a trusted forest
    - WebUI: add support for changing trust UPN suffixes


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-18.el7
changelog:
  - Resolves: #1449189 ipa-kra-install timeouts on replica
    - kra: promote: Get ticket before calling custodia


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash() 
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces 
    - Fix local IP address validation 
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1470125 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469978 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 4.5.0-21.el7.cloudlinux
changelog:
  - Remove freeipa-3.3.3-cloudlinux-branding.patch
  - Add cloudlinux to ipaplatform
  - Replaced an images for rebrandig to cloudlinux


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-1.el7
changelog:
  - Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
    buildroot
  - Resolves: #1470177 - Rebase IPA to latest 4.5.x version
  - Resolves: #1398594 ipa topologysuffix-verify should only warn about 
    maximum number of replication agreements. 
  - Resolves: #1404236 Web UI: Change "Host Based" and "Role Based" 
    to "Host-Based" and "Role-Based" 
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install
    setup fails when dirsrv is not running
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr 
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI 
    accepts negative values
  - Resolves: #1458169 --force-join option is not mentioned in 
    ipa-replica-install man page 
  - Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case 
  - Resolves: #1478322 user-show command fails when sizelimit is configured 
    to number <= number of entity which is user member of 
  - Resolves: #1496775 Enterprise principals should be able to trigger
    a refresh of the trusted domain data in the KDC
  - Resolves: #1502533 Changing cert-find to go through the proxy 
    instead of using the port 8080
  - Resolves: #1502663 pkinit-status command fails after an upgrade from
    a pre-4.5 IPA
  - Resolves: #1498168 Error when trying to modify a PTR record
  - Resolves: #1457876 ipa-backup fails silently
  - Resolves: #1493531 In case full PKINIT configuration is failing during 
    server/replica install the error message should be more meaningful.
  - Resolves: #1449985 Suggest CA installation command in KRA installation
    warning


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.4-2.el7
changelog:
  - Resolves: #1461177 ipa-otptoken-import  - XML file is missing PBKDF2
    parameters!
  - Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
    search in cn=ad, cn=trusts,dc=example,dc=com
  - Resolves: #1467887 iommu platform support for ipxe
  - Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic key for
    host
  - Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
    4.5
  - Resolves: #1480102 ipa-server-upgrade failes with "This entry already
    exists"
  - Resolves: #1482802 Unable to set ca renewal master on replica
  - Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
  - Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
  - Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
    to self-signed CA
  - Resolves: #1469246 Replica install fails to configure IPA-specific
    temporary files/directories
  - Resolves: #1469480 bind package is not automatically updated during
    ipa-server upgrade process
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
    installs only)
  - Resolves: #1477703 IPA upgrade fails for latest ipa package


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-3.el7
changelog:
  - Drop workaround for building on AArch64 (#1482244)
  - Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-4.el7
changelog:
  - Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
    - ldap: limit the retro changelog to dns subtree
  - Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
    of "CA:FALSE" IPA CA CSR
    - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1493145 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
    - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
    - ds: ignore time skew during initial replication step
    - ipa-replica-manage: implicitly ignore initial time skew in force-sync 
  - Resolves: #1500218 Replica installation at domain-level 0 fails against
    upgraded ipa-server
    - Fix ipa-replica-conncheck when called with --principal
  - Resolves: #1506188 server-del doesn't remove dns-server configuration
    from ldap


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.5.4-5.el7
changelog:
  - Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
  - Resolves: #1378892 host-find slowness caused by missing host attributes in index


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-7.el7
changelog:
  - Resolves: #1421869 Unable to re-add broken AD trust - Unexpected Information received
    - adtrust: filter out subdomains when defining our topology to AD
  - Resolves: #1486286 IPA failing to authenticate via password+OTP on RHEL7.4 with fips enabled
    - Don't allow OTP or RADIUS in FIPS mode
  - Resolves: #1494226 IPA User Details not being displayed in WebUI
    - Fix cert-find for CA-less installations
  - Resolves: #1498387 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
    - 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
  - Resolves: #1503022 ipa-getkeytab man page should have more details about consequences of krb5 key renewal
    - ipa-getkeytab man page: add more details about the -r option
  - Resolves: #1509288 IPA trust-add internal error (expected security.dom_sid got None)
    - ipaserver/plugins/trust.py; fix some indenting issues
    - trust: detect and error out when non-AD trust with IPA domain name exists
    - ipaserver/plugins/trust.py: pep8 compliance
  - Resolves: #1511019 ipa-restore broken with python2
    - Fix ipa-restore (python2)
  - Resolves: #1511607 ipa-backup does not backup Custodia keys and files
    - Backup ipa-custodia conf and keys
  - Resolves: #1512482 kra install fails after ipa cert renewed
    - Don't use admin cert during KRA installation
    - Prevent set_directive from clobbering other keys
    - pep8: reduce line lengths in CAInstance.__enable_crl_publish
    - installutils: refactor set_directive
    - Add tests for installutils.set_directive
    - Add safe DirectiveSetter context manager
    - Old pylint doesn't support bad python3 option
  - Resolves: #1514163 CA less IPA install with external certificates fails on RHEL 7 in FIPS mode
    - Fix ca less IPA install on fips mode


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-8.el7
changelog:
  - Resolves: #1477531 Incorrect attribute level rights (ipaallowedtoperform) of service object
    - WebUI: make keytab tables on service and host pages writable
  - Resolves: #1529444 ObjectclassViolation seen while adding idview with domain-resolution-order option
    - Idviews: fix objectclass violation on idview-add
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr
    - Fixing the cert-request comparing whole email address case-sensitively.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-9.el7
changelog:
  - Resolves: #1458169 --force-join option is not mentioned in ipa-replica-install man page
    - Add --force-join into ipa-replica-install manpage
  - Resolves: #1457876 ipa-backup fails silently
    - Changed ownership of ldiffile to DS_USER
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install setup fails when dirsrv is not running
    - Checks if Dir Server is installed and running before IPA installation
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI accepts negative values
    - WebUI: Add positive number validator
    - WebUI: change validator of page size settings
    - WebUI: fix jslint error


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.2
changelog:
  - Resolves: #1565633 nsds5ReplicaReleaseTimeout should be set by default
    - Add nsds5ReplicaReleaseTimeout to replica config
    - Fix upgrade (update_replica_config) in single master mode
  - Resolves: #1577108 Improve Custodia client and key distribution handling
    - Use single Custodia instance in installers
  - Resolves: #1577805 4.5.0 -> 4.5.4 upgrade breaks in ipa-server-upgrade: No such file or directory: '/var/lib/pki/pki-tomcat/conf/ca/CS.cfg'
    - Don't try to backup CS.cfg during upgrade if CA is not configured


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-1.el7
changelog:
  - Resolves: #1561581  Rebase IPA to latest 4.6.x version
  - Resolves: #1234219 [WebUI] Error message could be better while adding idrange with untrusted domain name.
  - Resolves: #1274488 ipa-client-install should use previously entered username when performing setup validation
  - Resolves: #1289487 Priority field missing in Password Policy detail tab
  - Resolves: #1339129 ipa vault-archive overwrites an existing value without warning
  - Resolves: #1368345 Replace ERROR: cannot connect to 'http://localhost:8888/ipa/json': [Errno 111] Connection refused with 'IPA is not configured on this system'
  - Resolves: #1424735 While performing ipa-server-upgrade, sssd goes offline and stalls the upgrade process
  - Resolves: #1427105 RFE - Option to add custom OID or display name in IPA Cert
  - Resolves: #1434924 ipa-restore fails when umask is set to 0027
  - Resolves: #1441262 ipa group-del gives ipa: ERROR: Insufficient access: but still deletes group
  - Resolves: #1452081 Suggest user to install libyubikey package instead of traceback
  - Resolves: #1458183 Users can delete their last active OTP token
  - Resolves: #1478366 Crash noticed during IPA upgrade process due to ipa package
  - Resolves: #1480502 ipa server uninstall with -v option displays "IOError: [Errno 9] Bad file descriptor Logged from file ipautil.py, line 442"
  - Resolves: #1481936 Limit number of times the DNS response for the ipa-server A and AAAA records are done during uninstallation.
  - Resolves: #1483139 ipa-restore command doesn't exit with failure if wrong directory manager's password is provided
  - Resolves: #1485429 domain resolution order field in Identity->ID Views->Settings tab missing in WebUI
  - Resolves: #1485851 ipa param-find: command displays internal error
  - Resolves: #1494198 ipa-replica-manage re-initialize TypeError: 'NoneType' object does not support item assignment
  - Resolves: #1504565 API schema generated by server doesn't follow language requested by client.
  - Resolves: #1505925 kdc segfault in openldap libs when ipa-server is installed and custom pkinit is configured
  - Resolves: #1506709 ipa trust-add - Filter out overlapping namespace domains automatically
  - Resolves: #1513041 ipa-restore does not enable/start oddjobd
  - Resolves: #1515314 ipa-replica-install fails with PIN error [ CA-less environment ]
  - Resolves: #1515374 Custodia keys are not removed on uninstall
  - Resolves: #1518932 The Issuer DN field in IPA is not updating properly
  - Resolves: #1519723 admins group is not including all permissions of Role "User Administrator"
  - Resolves: #1527020 nsslapd-sasl-max-buffer-size is hardcoded to '2097152' during install even if another value was provided in an LDIF ( --dirsrv-config-file )
  - Resolves: #1534726 IPA 'Generate OTP' option in web gui does not show OTP code when no reverse zone is managed
  - Resolves: #1547641 ipa: Please log something after restarting the KDC
  - Resolves: #1547995 CRL url on replicas gets incorrectly redirected
  - Resolves: #1549187 IdM servers:/usr/share/ipa/html/ca.crt does not include the complete chain
  - Resolves: #1553594 ldappasswd cause the IPA embedded Directory server to SIGSEGV
  - Resolves: #1568748 Allow hosts to delete their own services
  - Resolves: #1576133 Radius Proxy OTP Auth in IPA is not failing over to the second server in a radius-proxy
  - Resolves: #1577108 Improve Custodia client and key distribution handling


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-2.el7
changelog:
  - Resolves: #1594142 SRV lookup doesn't correctly sort results
    - Sort and shuffle SRV record by priority and weight
  - Resolves: #1594141 Replication races in DogtagInstance.setup_admin
    - Fix replication races in Dogtag admin code
    - Use common replication wait timeout of 5min
    - Improve and fix timeout bug in wait_for_entry()
  - Resolves: #1591824 Installation of replica against a specific master
    - Always set ca_host when installing replica
  - Resolves: #1591647 Increase WSGI worker process count
    - Increase WSGI process count to 5 on 64bit
  - Resolves: #1394034 Custom SELinux User Map order is changed after updating IPA
    - Use replace instead of add to set new default ipaSELinuxUserMapOrder
  - Resolves: #1381535 ipa config-mod returns "Configured size limit exceeded"
    - ipaserver config plugin: Increase search records minimum limit


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.4-3.el7
changelog:
  - Resolves: #1603514 Replica install fails with "Certificate issuance failed (CA_REJECTED)" - ACIError


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-4.el7
changelog:
  - Resolves: #1600525 ipa-client-install --uninstall fails to uninstall client.
    - ipa client uninstall: clean the state store when restoring hostname
  - Resolves: #1598117 client uninstall fails when installed using non-existing hostname
    - ipa client uninstall: clean the state store when restoring hostname
  - Resolves: #1596168 ipa help topics displays 'ipa: ERROR: an internal error has occurred'
    - Fix regression: Handle unicode where str is expected
  - Resolves: #1591824 Installation of replica against a specific master
    - Query for server role IPA master
    - Only create DNS SRV records for ready server
    - Delay enabling services until end of installer
    - replicainstall: DS SSL replica install pick right certmonger host
    - Fix CA topology warning
    - Fix race condition in get_locations_records()
    - Fix DNSSEC install regression
    - Handle races in replica config
  - Resolves: #1591647 Increase WSGI worker process count
    - Use 4 WSGI workers on 64bit systems
  - Resolves: #1565633 nsds5ReplicaReleaseTimeout should be set by default.
    - Tune DS replication settings
  - Resolves: #1607616 Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
    - Removing filesystem encoding check
  - Resolves: #1598044  plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
    - Removing filesystem encoding check


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-5.el7
changelog:
  - Resolves: #1607616 Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
    - Removing filesystem encoding check
  - Resolves: #1598044  plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
    - Removing filesystem encoding check


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-6.el7
changelog:
  - Resolves: #1590647 ldapmodify userPassword reflects on krblastpwdchange on RHEL6 but not RHEL7
    - In IPA 4.4 when updating userpassword with ldapmodify does not update krbPasswordExpiration nor krbLastPwdChange
  - Resolves: #1600074 ipa-server-upgrade displays 'DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated'
    - Re-open the ldif file to prevent error message
  - Resolves: #1608783 ipa trust-add fails in FIPS mode.
    - Move fips_enabled to a common library to share across different plugins
    - ipasam: do not use RC4 in FIPS mode


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-7.el7
changelog:
  - Resolves: #1609882 ipaserver/plugins/cert.py: Add reason to raise of errors.NotFound
    - ipaserver/plugins/cert.py: Added reason to raise of errors.NotFound
  - Resolves: #1598662 Replica installation fails with connection refused error
    - Do not set ca_host when --setup-ca is used
  - Resolves: #1577108 Improve Custodia client and key distribution handling
    - Fix KRA replica installation from CA master
  - Resolves: #1515314 ipa-replica-install fails with PIN error [ CA-less environment ]
    - Fix ipa-replica-install when key not protected by PIN
  - Resolves: #1480502 ipa server uninstall with -v option displays "IOError: [Errno 9] Bad file descriptor Logged from file ipautil.py, line 442"
    - uninstall -v: remove Tracebacks
  - Resolves: #1368345 Replace ERROR: cannot connect to 'http://localhost:8888/ipa/json': [Errno 111] Connection refused with 'IPA is not configured on this system'
    - ipa commands: print 'IPA is not configured' when ipa is not setup
    - Disable message about log in ipa-backup if IPA is not configured
  - Resolves: #1591824 Installation of replica against a specific master
    - Do not set ca_host when --setup-ca is used
  - Resolves: #1594141 Replication races in DogtagInstance.setup_admin
    - Catch ACIError instead of invalid credentials
  - Resolves: #1623112  ipa-replica-install defines nsds5replicabinddngroup before the group contains the DN of the replication manager
    - DS replication settings: fix regression with <3.3 master
  - Resolves: #1623113 Replica install: certmonger sometimes fails
    - Wait for client certificates
    - Auto-retry failed certmonger requests


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-8.el7
changelog:
  - Resolves #1508498 Authn/TOTP defined users periodically prompt for just password credentials to access resources
    - Clear next field when returnining list elements in queue.c
    - Add cmocka unit tests for ipa otpd queue code
  - Resolves #1622168 ipa-otpd: fix potential double-free and infinite loop in queue code
    - Clear next field when returnining list elements in queue.c
    - Add cmocka unit tests for ipa otpd queue code
  - Resolves #1603444 ipa-server-install script is failing when using the "--no-dnssec-validation" parameter combined with the "--forwarder"
    - ipa-server-install: do not perform forwarder validation with --no-dnssec-validation


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-9.el7
changelog:
  - Resolves: #1624755 Re-installing replica on the same system displays 'WARNING: cannot check if port 443 is already configured'
    - ipa-replica-install: properly use the file store
  - Resolves: #1623486 PKINIT configuration did not succeed message is received during Replica-install
    - ipa-replica-install: fix pkinit setup
  - Related: #1624289 AVC denials noticed during test execution for SUB-CA test-suite in FIPS mode
    - Update minimum selinux-policy to 3.13.1-224


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7
changelog:
  - Resolves: 1630361 PKINIT fails in FIPS mode
    - Ensure that public cert and CA bundle are readable
    - Always make ipa.p11-kit world-readable
    - Make /etc/httpd/alias world readable & executable
    - Fix permission of public files in upgrader


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-1.el7
changelog:
  - Resolves: 1677197 Rebase IPA to latest 4.6.x version
  - Resolves: 1690037[RFE] Add utility to promote CA replica to CRL master
  - Resolves: 1689585 Cannot install ipa-server on rhel7.7
  - Resolves: 1672184 Fix compile issue with new 389-ds
  - Resolves: 1672180 pki spawn fails for IPA replica install from RHEL6 IPA master
  - Resolves: 1669012 host_del and host_disable fails, ra.find() search for every certificates instead of the host's certificate by subject
  - Resolves: 1658701 ipa-replica-install fails migrating RHEL 6 to 7
  - Resolves: 1651834 searching for ipa users by certificate fails
  - Resolves: 1644874 IPA Upgrade failed with "unable to convert the attribute u'cACertificate;binary'"
  - Resolves: 1638545 ipa-advise command points to old URL's.
  - Resolves: 1637717 RFE: Validation and better error messages when novajoin fails because of SSL errors
  - Resolves: 1599939 'ipa vault-retrieve' is failing with "ipa: ERROR: an internal error has occurred"
  - Resolves: 1593454 In IPA WebUI, a warning appears in the background(warning message behind the dialog box).
  - Resolves: 1586268 [RFE] Red Hat Identity Manager IP SANs
  - Resolves: 1579037 Adding 3rd Party CAs to IPA results in SmartCard preparation script failure
  - Resolves: 1577967 Users with user creation/modification privileges fail to add the "--radius-username" option when creating users
  - Resolves: 1572674 ipa-cacert-manage cannot import PKCS#7 files
  - Resolves: 1562422 [RFE] Allow IPA Services to Start After the IPA Backup Has Completed
  - Resolves: 1562396 IPA numeric username breaks sudo and getent
  - Resolves: 1533228 The ipa-replica-install command failed, exception: ValidationError: invalid 'dnszoneidnsname': only master zones can contain records
  - Resolves: 1497334 ipa-server-install should prevent installations with single label domains
  - Resolves: 1493541 ipa-pkinit-manage reports a switch from local pkinit to full pkinit configuration was successful although it was not.
  - Resolves: 1485217 [RFE] Warn or adjust umask if it is too restrictive to break installation
  - Resolves: 1428690 ipa-backup does not create log file at /var/log/
  - Resolves: 1408439 ipa idoverrideuser-find view --anchor fails to return output
  - Resolves: 1390757 automember-rebuild crashes
  - Resolves: 1376024 During one step replica install the command accepts both OTP and Admin password simultaneously
  - Resolves: 1245626 ipa-client-install modifies /etc/openldap/ldap.conf in a way which is unhandy for openldap-clients


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-2.el7
changelog:
  - Resolves: 1691334 New defect found in ipa-4.6.5-1.el7
    - Coverity: fix issue in ipa_extdom_extop.c
  - Resolves: 1666843 ipa-replica-manage force-sync --from keeps prompting "No status yet"
    - ipa-replica-manage: fix force-sync
  - Resolves: 1594245 [RFE] sysadm_r should be included in default SELinux user map order
    - Add sysadm_r to default SELinux user map order
  - Resolves: 1527215 RFE: ipa client should setup openldap for GSSAPI
    - RFE: ipa client should setup openldap for GSSAPI
  - Resolves: 1518939 RFE: Extend IPA to support unadvertised replicas
    - Unify and simplify LDAP service discovery
    - Use api.env.container_masters
    - Consolidate container_masters queries
    - Add hidden replica feature
    - ipatests: Exercise hidden replica feature
    - Simplify and improve tests
    - Implement server-state --state=enabled/hidden
    - Consider hidden servers as role provider
    - Improve config-show to show hidden servers
    - More test fixes
    - Don't allow to hide last server for a role
    - Synchronize hidden state from IPA master role
    - Test replica installation from hidden replica
    - Add design draft
    - Don't fail if config-show does not return servers
  - Resolves: 1517886 double ca acl provoke console error.
    - Add uniqueness constraint on CA ACL name
  - Resolves: 1498110 Using --auto-reverse and --allow-zone-overlap does not skip zone overlap check
    - Extend CALessBase::installer_server to accept extra_args
    - Skip zone overlap check with auto-reverse
  - Resolves: 1496963 [RFE] Provide an option to include FQDN in IDM topology graph
    - Web UI (topology graph): Show FQDN for nodes if they have no common DNS zone
  - Resolves: 1345975 [RFE] Support One-Way Trust authenticated by trust secret
    - Replace hard-coded paths with path constants
    - Support Samba 4.9
    - Add design page for one-way trust to AD with shared secret
    - trust: allow trust agents to read POSIX identities of trust
    - trusts: add support for one-way shared secret trust
    - upgrade: upgrade existing trust agreements to new layout
    - upgrade: add trust upgrade to actual upgrade code
  - Resolves: 1690191 [RFE] Offline Certificate Renewal System
    - Extract ca_renewal cert update subroutine
    - cainstance: add function to determine ca_renewal nickname
    - constants: add ca_renewal container
    - Add ipa-cert-fix tool
    - ipa-cert-fix: add man page
    - ipa-cert-fix: use customary exit statuses
  - Resolves: 1631826 Create a warning that SSSD needs restart after idrange-mod
    - Show a notification that sssd needs restarting after idrange-mod


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-3.el7
changelog:
  - Resolves: 1694623 ipa-kra-install failing with invalid 'role_servrole': must be Unicode text error
    - ipa-setup-kra: fix python2 parameter
  - Resolves: 1694596 ipa-server-upgrade fails with ConversionError: invalid 'cn': must be Unicode text
    - ipa-server-upgrade: fix add_systemd_user_hbac


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-4.el7
changelog:
  - Resolves: 1686302 ipa trust fetch-domains, server parameter ignored
    - oddjob: allow to pass options to trust-fetch-domains
  - Resolves: 1695481 ipa trust-add failing with CIFS server communication error
    - adtrust: define Guests mapping after creating cifs/ principal
    - net groupmap: force using empty config when mapping Guests


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-5.el7
changelog:
  - Resolves: 1697242 Communication with oddjob helper fails
    - Bypass D-BUS interface definition deficiences for trust-fetch-domains


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-7.el7
changelog:
  - Resolves: 1704227 - Wrong logic in ipactl restart leads to start instead of restart pki-tomcatd
    - ipactl restart: fix wrong logic when checking service list


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-8.el7
changelog:
  - Resolves: 1702651 - Command ipa conole is broken
    - ipa console: catch proper exception when history file can not be open
  - Resolves: 1704796 - Wrong CA replication topology created with two replicas
    - replica install: acknowledge ca_host override
  - Resolves: 1708873 - Unable to upgrade ipa data: IPA version error: data needs to be upgraded (expected version '4.7.90.pre1-3.fc30', current version '4.7.2-8.fc30')
    - upgrade: adtrust - catch empty result when retrieving list of trusts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-9.el7
changelog:
  - Resolves: 1712794 - ERROR: invalid 'PKINIT enabled server': all masters must have IPA master role enabled
    - Consider configured servers as valid


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-10.el7
changelog:
  - Resolves: 1723473 - ipa upgrade fails with trust entry already exists
    - adtrust upgrade: fix wrong primary principal name


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7
changelog:
  - Resolves: 1723473 - ipa upgrade fails with trust entry already exists
    - adtrust upgrade: fix wrong primary principal name, part 2
  - Resolves: 1686302 - ipa trust fetch-domains, server parameter ignored
    - trust-fetch-domains: make sure we use right KDC when --server is specified


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-1.el7
changelog:
  - Resolves: 1733075 - Rebase IPA to latest 4.6.x version
  - Resolves: 1512952 - cert renewal is failing when ipa ca cert is renewed from self-signed > external ca > self-sign
  - Resolves: 1544470 - cn=cacert could show expired certificate
  - Resolves: 1581583 - Error message should be more useful while ipa-backup fails for insufficient space
  - Resolves: 1632351 - remove "last init status" from ipa-replica-manage list <node> if it's None.
  - Resolves: 1691939 - False error is shown when options are added to an existing sudo rule using 'sudooption'
  - Resolves: 1695685 - IPA Web UI is slow to display user details page
  - Resolves: 1702426 - ipa-server-common expected file permissions in package don't match runtime permissions
  - Resolves: 1711172 - Removing TLSv1.0, TLSv1.1 from nss.conf
  - Resolves: 1714076 - Issue with adding multiple RHEL 7 IPA replica to RHEL 6 IPA master
  - Resolves: 1714921 - x509.Name -> ipapython.dn.DN does not handle multi-valued RDNs
  - Resolves: 1720952 - Cannot modify TTL with ipa dnsrecord-mod --ttl alone on command line
  - Resolves: 1721550 - Staged user is not being recognized if the user entry doesn't have an objectClass "posixaccount"
  - Resolves: 1727304 - Restrict cipher lists used by openssl connections
  - Resolves: 1733209 - ipa-client-automount needs option to specify domain
  - Resolves: 1733265 - IPA webgui incorrectly display number of entries in ID views


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.6-3.el7
changelog:
  - Resolves: 1717008 - User incorrectly added to negative cache when backend is reconnecting to IPA service / timed out: error code 32 'No such object'


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.6-4.el7
changelog:
  - Resolves: 1744926 - rebuild against Samba 4.10 to solve undefined symbol: DEBUGLEVEL_CLASS
  - Backport patches to compile against Samba 4.10
  - Fix Python 2 compatibility in adtrustinstance


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-5.el7
changelog:
  - Resolves: #1749788 - ipa host-find --pkey-only includes SSH keys in output
    - Don't return SSH keys with ipa host-find --pkey-only
  - Resolves: #1745108 - Bug 1497334 invalidating single-label domains introduces regression of usage for customers
    - check for single-label domains only during server install
  - Resolves: #1583950 - IPA: IDM drops all custom attributes when moving account from preserved to stage
    - user-stage: transfer all attributes from preserved to stage user
    - xmlrpc test: add test for preserved > stage user


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-6.el7
changelog:
  - Resolves: #1752005 - Keyrings should not be used in containerized environment
    - Don't configure KEYRING ccache in containers
  - Resolves: #1751951 - When master's IP address does not resolve to its name, ipa-replica-install fails
    - Add container environment check to replicainstall
  - Resolves: #1750700 - when migrating trusted domain object structure, add default access control definitions, if they were missing in old trust objects
    - add default access control when migrating trust objects
    - adtrust: add default read_keys permission for TDO objects
    - Disable deprecated-lambda check in adtrust upgrade code


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-7.el7
changelog:
  - Resolves: #1754494 - ipa-replica-install does not enforce --server option
    - replica install: enforce --server arg
  - Resolves: #1729638 - ipa_kdb: assertion failure from NULL lcontext pointer to ldap_get_values_len()
    - Fix segfault in ipadb_parse_ldap_entry()
    - Log INFO message when LDAP connection fails on startup
    - Fix NULL pointer dereference in maybe_require_preauth()
  - Resolves: #1636765 - ipa-restore set wrong file permissions and ownership for /var/log/dirsrv/slapd- directory
    - ipa-restore: Restore ownership and perms on 389-ds log directory


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-8.el7
changelog:
  - Resolves: #1755223 - Sub-CA key replication failure
    - Handle missing LWCA certificate or chain
    - Fix CustodiaClient ccache handling
    - CustodiaClient: use ldapi when ldap_uri not specified
    - CustodiaClient: fix IPASecStore config on ipa-4-7
    - Bump krb5 min version


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-9.el7
changelog:
  - Resolves: #1762317 - ipa-backup command is failing on rhel-7.8
    -  ipa-backup: fix python2 issue with os.mkdir


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-10.el7
changelog:
  - Resolves: #1728123 - EMBARGOED CVE-2019-10195 ipa: FreeIPA: batch API logging user passwords to /var/log/httpd/error_log [rhel-7]
    - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
  - Resolves: #1773550 - IPA upgrade fails for latest ipa package when adtrust is installed
    - Do not run trust upgrade code if master lacks Samba bindings
  - Resolves: #1767302 - EMBARGOED CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf() [rhel-7.8]
    - Make sure to have storage space for tag


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-11.el7
changelog:
  - Resolves: #1778777 - After upgrade AD Trust Agents were removed from LDAP
    - trust upgrade: ensure that host is member of adtrust agents


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-12.el7
changelog:
  - Resolves: #1754902 - Running ipa-server-install fails when RHEL 7.7 packages are installed on RHEL 7.6
  - Resolves: #1404770 - ID Views: do not allow custom Views for the masters
    - idviews: prevent applying to a master
  - Resolves: #1801791 - Compatibility Schema difference in functionality for systems following RHEL 7.5 -> 7.6 upgrade path as opposed to new RHEL 7.6 systems
    - install/updates: move external members past schema compat update
  - Resolves: #1795890 - ipa-pkinit-manage enable fails on replica if it doesn't host the CA
    - pkinit setup: fix regression on master install
    - pkinit enable: use local dogtag only if host has CA
  - Resolves: #1788907 - Renewed certs are not picked up by IPA CAs
    - Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
  - Resolves: #1780548 - Man page ipa-cacert-manage does not display correctly on RHEL
    - ipa-cacert-manage man page: fix indentation
  - Resolves: #1782587 - add "systemctl restart sssd" to warning message when adding trust agents to replicas
    - adtrust.py: mention restarting sssd when adding trust agents
  - Resolves: #1771356 - Default client configuration breaks ssh in FIPS mode
    - Use default ssh host key algorithms
  - Resolves: #1755535 - ipa-advise on a RHEL7 IdM server is not able to generate a configuration script for a RHEL8 IdM client
    - smartcard: make the ipa-advise script compatible with authselect/authconfig
  - Resolves: #1758406 - KRA authentication fails when IPA CA has custom Subject DN
    - upgrade: fix ipakra people entry 'description' attribute
    - krainstance: set correct issuer DN in uid=ipakra entry
  - Resolves: #1756568 - ipa-server-certinstall man page does not match built-in help
    - ipa-server-certinstall manpage: add missing options
  - Resolves: #1206690 - UPG not being enforced properly
    - ipa user_add: do not check group if UPG is disabled
  - Resolves: #1811982 - CVE-2018-14042 ipa: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip.
  - Resolves: #1811978 - CVE-2018-14040 ipa: bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
  - Resolves: #1811972 - CVE-2016-10735 ipa: bootstrap: XSS in the data-target attribute
  - Resolves: #1811969 -CVE-2018-20676 ipa: bootstrap: XSS in the tooltip data-viewport attribute
  - Resolves: #1811966 - CVE-2018-20677 ipa: bootstrap: XSS in the affix configuration target property
  - Resolves: #1811962 - CVE-2019-8331 ipa: bootstrap: XSS in the tooltip or popover data-template attribute
    - Web UI: Upgrade Bootstrap version 3.3.7 -> 3.4.1
  - Resolves: #1769791 - Invisible part of notification area in Web UI intercepts clicks of some page elements
    - WebUI: Fix notification area layout
  - Resolves: #1545755 - ipa-replica-prepare should not update pki admin password
    - Fix indentation levels
    - ipa-pwd-extop: use SLAPI_BIND_TARGET_SDN
    - ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
    - Don't save password history on non-Kerberos accounts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-1.el7
changelog:
  - Resolves: #1819725 - Rebase IPA to latest 4.6.x version
  - Resolves: #1817927 - host-add --password logs cleartext userpassword to Apache error log
  - Resolves: #1817923 - IPA upgrade is failing with error "Failed to get request: bus, object_path and dbus_interface must not be None."
  - Resolves: #1817922 - covscan memory leaks report
  - Resolves: #1817919 - Enable compat tree to provide information about AD users and groups on trust agents
  - Resolves: #1817918 - Secure tomcat AJP connector
  - Resolves: #1817886 - ipa group-add-member: prevent adding IPA objects as external members
  - Resolves: #1788718 - ipa-server-install incorrectly setting slew mode (-x) when setting up ntpd


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-2.el7
changelog:
  - Resolves: #1802408 CVE-2020-1722 ipa: No password length restriction leads to denial of service
    - Add interactive prompt for the LDAP bind password to ipa-getkeytab
    - CVE-2020-1722: prevent use of too long passwords


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-3.el7
changelog:
  - Resolves: #1834385 Man page syntax issue detected by rpminspect
    - Man pages: fix syntax issues
  - Resolves: #1829787 ipa service-del deletes the required principal when specified in lower/upper case
    - Make check_required_principal() case-insensitive
  - Resolves: #1825829 ipa-advise on a RHEL7 IdM server generate a configuration script for client having hardcoded python3
    - ipa-advise: fallback to /usr/libexec/platform-python if python3 not found
  - Resolves: #1812020 CVE-2015-9251 ipa: js-jquery: Cross-site scripting via cross-domain ajax requests
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1
  - Resolves: #1713487 CVE-2019-11358 ipa: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-4.el7
changelog:
  - Resolves: #1842950 ipa-adtrust-install fails when replica is offline
    - ipa-adtrust-install: avoid failure when replica is offline
  - Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
    - WebUI: Apply jQuery patch to fix htmlPrefilter issue


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7
changelog:
  - Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp
    -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset


author: Michal Ruprich <mruprich@redhat.com> - 3.1.7-1
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding latest version before including iperf3 in RHEL-7


author: Michal Ruprich - 3.1.7-2
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding requires to spec file for devel package


author: Boris Ranto <branto@redhat.com> - 0:1.8.15-7
changelog:
  - New release (0:1.8.15-7)
  - ID:437 - sel: Fix "sel time set <time>"
  - ID 408 - fix sel list last X listing


author: Josef Ridky <jridky@redhat.com> - 0:1.8.18-3
changelog:
  - Fix issues with warning: dereferencing type-punned pointer 
    will break strict-aliasing rules from RPMDiff


author: Petr Šabata <contyk@redhat.com> - 3.10.0-6
changelog:
  - Fix lnstat -i (#1024426)
  - Support IPv6 peer addresses (#1017228)
  - Add the replace command to bridge fdb (#1024697)
  - Document link type vlan (#979326)


author: Phil Sutter <psutter@redhat.com> [3.10.0-65.el7]
changelog:
  - man: ip, ip-link: Fix ip option location (Phil Sutter) [1251186]
  - ip: enable configuring multicast group autojoin (Phil Sutter) [1333513]
  - ss: Fix accidental state filter override (Phil Sutter) [1318005]
  - ss: Drop silly assignment (Phil Sutter) [1318005]
  - ss: Fix wrong filter behaviour (Phil Sutter) [1318005]


author: Phil Sutter <psutter@redhat.com> [3.10.0-66.el7]
changelog:
  - ip-link: Support printing VF trust setting (Phil Sutter) [1302119]
  - iplink: Support VF Trust (Phil Sutter) [1302119]
  - add new IFLA_VF_TRUST netlink attribute (Phil Sutter) [1302119]
  - ipaddress: Allow listing addresses by type (Phil Sutter) [1341343]
  - man ip-link: Small example of 'ip link show master' (Phil Sutter) [1341343]
  - ip link: Show devices by type (Phil Sutter) [1341343]
  - ip link: Allow to filter devices by master dev (Phil Sutter) [1341343]


author: Phil Sutter <psutter@redhat.com> [3.10.0-67.el7]
changelog:
  - geneve: fix IPv6 remote address reporting (Phil Sutter) [1339178]
  - geneve: add support to set flow label (Phil Sutter) [1339178]
  - geneve: Add support for configuring UDP checksums. (Phil Sutter) [1339178]
  - geneve: add support for lwt tunnel creation and dst port selection (Phil Sutter) [1339178]
  - geneve: add support for IPv6 link partners (Phil Sutter) [1339178]
  - iplink_geneve: add tos configuration at link creation (Phil Sutter) [1339178]
  - iplink_geneve: add ttl configuration at link creation (Phil Sutter) [1339178]
  - iproute2: update ip-link.8 for geneve tunnels (Phil Sutter) [1339178]
  - iproute2: GENEVE support (Phil Sutter) [1339178]
  - man: ip-address, ip-link: Document 'type' quirk (Phil Sutter) [1341343]
  - man: ip-link.8: Fix 'ip link delete' description (Phil Sutter) [1341343]


author: Phil Sutter <psutter@redhat.com> [3.10.0-68.el7]
changelog:
  - devlink: add manpage for shared buffer (Phil Sutter) [1342515]
  - devlink: implement shared buffer occupancy control (Phil Sutter) [1342515]
  - devlink: implement shared buffer support (Phil Sutter) [1342515]
  - devlink: allow to parse both devlink and port handle in the same time (Phil Sutter) [1342515]
  - devlink: introduce dump filtering function (Phil Sutter) [1342515]
  - devlink: split dl_argv_parse_put to parse and put parts (Phil Sutter) [1342515]
  - devlink: introduce helper to print out nice names (ifnames) (Phil Sutter) [1342515]
  - devlink: introduce pr_out_port_handle helper (Phil Sutter) [1342515]
  - list: add list_add_tail helper (Phil Sutter) [1342515]
  - list: add list_for_each_entry_reverse macro (Phil Sutter) [1342515]
  - devlink: fix "devlink port" help message (Phil Sutter) [1342515]
  - devlink: ignore build result (Phil Sutter) [1342515]
  - add devlink tool (Phil Sutter) [1342515]
  - include: add linked list implementation from kernel (Phil Sutter) [1342515]
  - configure: cleanup (Phil Sutter) [1342515]
  - configure: Check for libmnl (Phil Sutter) [1342515]
  - configure: Add check for the doc tools (Phil Sutter) [1342515]
  - add if_macsec header (Davide Caratti) [1300765]
  - RH-INTERNAL: update kernel headers to v4.6.0 (Davide Caratti) [1300765]
  - utils: fix hex digits parsing in hexstring_a2n() (Davide Caratti) [1300765]
  - ip: add MACsec support (Davide Caratti) [1300765]
  - utils: provide get_hex to read a hex digit from a char (Davide Caratti) [1300765]
  - utils: add get_be{16, 32, 64}, use them where possible (Davide Caratti) [1300765]
  - utils: make hexstring_a2n provide the number of hex digits parsed (Davide Caratti) [1300765]
  - lib/ll_addr: improve ll_addr_n2a() a bit (Davide Caratti) [1300765]
  - iproute2: arpd: use ll_addr_a2n and ll_addr_n2a (Davide Caratti) [1300765]
  - iproute2: utils: change hexstring_n2a and hexstring_a2n to do not work with ":" (Davide Caratti) [1300765]


author: Phil Sutter <psutter@redhat.com> [3.10.0-69.el7]
changelog:
  - ip-address.8: Document autojoin flag (Phil Sutter) [1333513]
  - ip-link.8: Fix font choices (Phil Sutter) [1269528]
  - ip-link: fix man page warnings (Phil Sutter) [1269528]
  - vxlan: fix help and man text (Phil Sutter) [1269528]
  - ip-link: fix unterminated string in manpage (Phil Sutter) [1269528]
  - ip-link.8: Add slave type option descriptions (Phil Sutter) [1269528]
  - ip-link.8: Place 'ip link set' warning more prominently (Phil Sutter) [1269528]
  - ip-link.8: Extend type list in synopsis (Phil Sutter) [1269528]
  - man ip-link: Remove extra GROUP explanation (Phil Sutter) [1269528]
  - man ip-link: Add short description about 'group' (Phil Sutter) [1269528]
  - man ip-link: Add deleting links by group (Phil Sutter) [1269528]
  - iplink: bond_slave: Add missing help functions (Phil Sutter) [1269528]
  - iplink: List valid 'type' argument in ip link help text (Phil Sutter) [1269528]
  - ip link: Add group in usage() for 'ip link delete' (Phil Sutter) [1269528]
  - iproute: constify rtattr_cmp (Phil Sutter) [1348133]
  - ip route: restore route entries in correct order (Phil Sutter) [1348133]


author: Phil Sutter <psutter@redhat.com> [3.10.0-70.el7]
changelog:
  - man: ip-link: Document query_rss option (Phil Sutter) [1264146]
  - Document VF link state control in the ip-link man page (Phil Sutter) [1264146]
  - ipneigh: List all nud states in help output (Phil Sutter) [1276661]
  - iproute2: ip-route.8.in: Add expires option for ip route (Phil Sutter) [1357020]
  - ip route: timeout for routes has to be set in seconds (Phil Sutter) [1357020]
  - route: allow routes to be configured with expire values (Phil Sutter) [1357020]


author: Phil Sutter <psutter@redhat.com> [3.10.0-71.el7]
changelog:
  - ip: add paren to silence warning (Phil Sutter) [1340914]
  - Fix MAC address length check (Jakub Sitnicki) [1253767 1271580]
  - iplink: Check address length via netlink (Jakub Sitnicki) [1253767 1271580]
  - iplink: Add missing variable initialization (Jakub Sitnicki) [1253767 1271580]
  - ip link: Fix crash on older kernels when show VF dev (Jakub Sitnicki) [1340914]
  - ip link: Remove unnecessary device checking (Jakub Sitnicki) [1340914]
  - ip: check for missing dev arg when doing VF rate (Jakub Sitnicki) [1340914]
  - Add support to configure SR-IOV VF minimum and maximum Tx rate through ip tool (Jakub Sitnicki) [1340914]


author: Phil Sutter <psutter@redhat.com> [3.10.0-72.el7]
changelog:
  - macsec: cipher and icvlen can be set separately (Davide Caratti) [1354408]
  - ip {link,address}: add 'macsec' item to TYPE list (Davide Caratti) [1354702]
  - man: macsec: fix macsec related typos (Davide Caratti) [1354702 1354319]
  - Revert "Allow specifying bridge port STP state by name rather than number." (Phil Sutter) [1288042]
  - Revert "fix ip -force -batch to continue on errors" (Phil Sutter) [1288042]
  - Revert "ip: fix exit code for addrlabel" (Phil Sutter) [1288042]
  - Revert "link dump filter" (Phil Sutter) [1288042]
  - Revert "ip: return correct exit code on route failure" (Phil Sutter) [1288042]
  - Revert "ip: fix exit code for rule failures" (Phil Sutter) [1288042]
  - man: ip-link: Drop fou and gue related documentation (Phil Sutter) [1013584]
  - man: ip-link, ip-address: Drop references to ipvlan (Phil Sutter) [1013584]
  - doc, man: ip-rule: Remove incorrect statement about rule 0 (Phil Sutter) [1362561]


author: Phil Sutter <psutter@redhat.com> [3.10.0-73.el7]
changelog:
  - ip-link: add missing {min,max}_tx_rate to help text (Phil Sutter) [1340914]
  - man: ip-link.8: Document missing geneve options (Phil Sutter) [1339178]
  - iproute.spec: Fix for missing cbq.8 man page (Phil Sutter) [1362551]


author: Phil Sutter <psutter@redhat.com> [3.10.0-77.el7]
changelog:
  - change of rtnetlink to use RTN_F_OFFLOAD (Phil Sutter) [1417289]
  - bridge: add support for the multicast flood flag (Phil Sutter) [1417289]
  - RH-INTERNAL: Update kernel headers to v4.10.0 (Phil Sutter) [1417289]
  - bridge: man: fix STP LISTENING description (Phil Sutter) [1417289]
  - bridge: man: fix BPUD typo (Phil Sutter) [1417289]
  - bridge: man: fix "brige" typo (Phil Sutter) [1417289]
  - bridge: vlan: fix a few "fdb" typos in vlan doc (Phil Sutter) [1417289]
  - bridge: vlan: add support to filter by vlan id (Phil Sutter) [1417289]
  - bridge: mdb: add support to filter by vlan id (Phil Sutter) [1417289]
  - bridge: fdb: add support to filter by vlan id (Phil Sutter) [1417289]
  - bridge: code cleanup (Phil Sutter) [1417289]
  - bridge: mdb: add support for extended router port information (Phil Sutter) [1417289]
  - bridge: mdb: add support for offloaded mdb entries (Phil Sutter) [1417289]
  - bridge: mdb: add user-space support for extended attributes (Phil Sutter) [1417289]
  - iplink: bridge: remove unnecessary returns (Phil Sutter) [1417289]
  - bridge: add support for dynamic fdb entries (Phil Sutter) [1417289]
  - iplink: bridge_slave: export read-only values (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_STARTUP_QUERY_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERY_RESPONSE_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERY_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERIER_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_MEMBERSHIP_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_LAST_MEMBER_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_STARTUP_QUERY_CNT (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_LAST_MEMBER_CNT (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_HASH_MAX (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_HASH_ELASTICITY (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERIER (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERY_USE_IFADDR (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_SNOOPING (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_ROUTER (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_VLAN_DEFAULT_PVID (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_GROUP_ADDR (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_GROUP_FWD_MASK (Phil Sutter) [1417289]
  - iplink: bridge: export read-only timers (Phil Sutter) [1417289]
  - iplink: bridge: export root_(port|path_cost), topology_change and change_detected (Phil Sutter) [1417289]
  - iplink: bridge: export bridge_id and designated_root (Phil Sutter) [1417289]
  - bridge: support for static fdb entries (Phil Sutter) [1417289]
  - bridge.8: minor formatting cleanup (Phil Sutter) [1417289]
  - bridge.8: document fdb replace command (Phil Sutter) [1417289]
  - bridge: fdb: minor syntax fix in help text (Phil Sutter) [1417289]
  - bridge: add calls to fflush in fdb and mdb print functions (Phil Sutter) [1417289]
  - ip, bridge: document -timestamp option (Phil Sutter) [1417289]
  - bridge: add batch command support (Phil Sutter) [1417289]
  - iplink: Add support for IFLA_BR_VLAN_PROTOCOL attribute (Phil Sutter) [1417289]
  - iplink: add support for IFLA_BR_VLAN_FILTERING attribute (Phil Sutter) [1417289]
  - bridge: mdb: add deleted when monitoring delmdb event (Phil Sutter) [1417289]
  - bridge: mdb: add support for vlans (Phil Sutter) [1417289]
  - ip link: proto_down config and display. (Phil Sutter) [1417289]
  - bridge: mdb: add support for router add/del notifications monitoring (Phil Sutter) [1417289]
  - ip: fix all the checkpatch warnings (Phil Sutter) [1417289]
  - iproute2: ipa: show switch id (Phil Sutter) [1417289]
  - ip: return correct exit code on route failure (Phil Sutter) [1417289]
  - iproute2: unify naming for entries offloaded to hardware (Phil Sutter) [1417289]
  - route: label externally offloaded routes (Phil Sutter) [1417289]
  - fix ip -force -batch to continue on errors (Phil Sutter) [1417289]
  - bridge link: add support to specify master (Phil Sutter) [1417289]
  - Allow specifying bridge port STP state by name rather than number. (Phil Sutter) [1417289]
  - iproute2: bridge vlan show new option to print ranges (Phil Sutter) [1417289]
  - iproute2: bridge: support vlan range adds (Phil Sutter) [1417289]
  - bridge/link: add learning_sync policy flag (Phil Sutter) [1417289]
  - bridge link: add option 'self' (Phil Sutter) [1417289]
  - bridge/fdb: add flag/indication for FDB entry synced from offload device (Phil Sutter) [1417289]
  - bridge/fdb: fix statistics output spacing (Phil Sutter) [1417289]
  - iproute2 bridge: bring to above par with brctl show macs (Phil Sutter) [1417289]
  - link dump filter (Phil Sutter) [1417289]
  - bridge: Make filter_index match in signedness (Phil Sutter) [1417289]
  - bridge: Add learning and flood support (Phil Sutter) [1417289]
  - iproute2: ipa: show port id (Phil Sutter) [1417289]
  - bridge: fix reporting of IPv6 addresses (Phil Sutter) [1417289]
  - iplink: bridge_slave: add support for IFLA_BRPORT_PROXYARP_WIFI (Phil Sutter) [1374360]
  - iplink: bridge_slave: add support for IFLA_BRPORT_PROXYARP (Phil Sutter) [1374360]
  - Revert "man: ip-link: Remove bits about proxy_arp and proxy_arp_wifi" (Phil Sutter) [1374360]


author: Phil Sutter <psutter@redhat.com> [3.10.0-78.el7]
changelog:
  - ip-address: Support filtering by slave type, too (Phil Sutter) [1375434]
  - tc: don't accept qdisc 'handle' greater than ffff (Davide Caratti) [1375393]
  - macsec: show usage even if the module is not available (Timothy Redaelli) [1367071]
  - libgenl: introduce genl_init_handle (Timothy Redaelli) [1367071]
  - tc: flower: Fix parsing ip address (Phil Sutter) [1422629]
  - tc: flower: support masked ICMP code and type match (Phil Sutter) [1422629]
  - tc: flower: provide generic masked u8 print helper (Phil Sutter) [1422629]
  - tc: flower: provide generic masked u8 parser helper (Phil Sutter) [1422629]
  - tc: flower: Update documentation to indicate ARP takes IPv4 prefixes (Phil Sutter) [1422629]
  - tc: flower: use correct type when calling flower_icmp_attr_type (Phil Sutter) [1422629]
  - f_flower: don't set TCA_FLOWER_KEY_ETH_TYPE for "protocol all" (Phil Sutter) [1422629]
  - tc: flower: Refactor matching flags to be more user friendly (Phil Sutter) [1422629]
  - tc: flower: Support matching ARP (Phil Sutter) [1422629]
  - kernel headers update (Phil Sutter) [1422629]
  - tc: flower: Fix incorrect error msg about eth type (Phil Sutter) [1422629]
  - tc: flower: Add missing err check when parsing flower options (Phil Sutter) [1422629]
  - tc: flower: Fix flower output for src and dst ports (Phil Sutter) [1422629]
  - tc: flower: Update dest UDP port documentation (Phil Sutter) [1422629]
  - tc: flower: support matching flags (Phil Sutter) [1422629]
  - tc/cls_flower: Add to the usage encapsulation dest UDP port (Phil Sutter) [1422629]
  - tc: flower: Allow *_mac options to accept a mask (Phil Sutter) [1422629]
  - tc: flower: document that *_ip parameters take a PREFIX as an argument. (Phil Sutter) [1422629]
  - tc: flower: Fix typo and style in flower man page (Phil Sutter) [1422629]
  - tc/cls_flower: Add dest UDP port to tunnel params (Phil Sutter) [1422629]
  - tc: flower: support matching on ICMP type and code (Phil Sutter) [1422629]
  - tc: flower: introduce enum flower_endpoint (Phil Sutter) [1422629]
  - tc: flower: make use of flower_port_attr_type() safe and silent (Phil Sutter) [1422629]
  - tc: flower: correct name of ip_proto parameter to flower_parse_port() (Phil Sutter) [1422629]
  - tc: flower: document SCTP ip_proto (Phil Sutter) [1422629]
  - tc: flower: remove references to eth_type in manpage (Phil Sutter) [1422629]
  - tc/cls_flower: Classify packet in ip tunnels (Phil Sutter) [1422629]
  - libnetlink: Introduce rta_getattr_be*() (Phil Sutter) [1422629]
  - tc: flower: Support matching on SCTP ports (Phil Sutter) [1422629]
  - tc: flower: Fix usage message (Phil Sutter) [1422629]
  - tc: flower checkpatch cleanups (Phil Sutter) [1422629]
  - tc: flower: Introduce vlan support (Phil Sutter) [1422629]
  - tc: flower: Add skip_{hw|sw} support (Phil Sutter) [1422629]
  - utils: add get_be{16, 32, 64}, use them where possible (Phil Sutter) [1422629]
  - lib/utils: introduce rt_addr_n2a_rta() (Phil Sutter) [1422629]
  - utils: make rt_addr_n2a() non-reentrant by default (Phil Sutter) [1422629]
  - make format_host non-reentrant by default (Phil Sutter) [1422629]
  - tc: flower no need to specify the ethertype (Phil Sutter) [1422629]
  - ip6tunnel: print local/remote addresses like iptunnel does (Phil Sutter) [1422629]
  - tc: ship filter man pages and refer to them in tc.8 (Phil Sutter) [1422629]
  - tc: add a man page for flower filter (Phil Sutter) [1422629]
  - tc: improve filter help texts a bit (Phil Sutter) [1422629]
  - tc: add support for Flower classifier (Phil Sutter) [1422629]
  - ip: make -resolve addr to print names rather than addresses (Phil Sutter) [1422629]


author: Phil Sutter <psutter@redhat.com> [3.10.0-80.el7]
changelog:
  - tc: m_xt: Drop needless parentheses from #if checks (Phil Sutter) [1326726]
  - tc: m_xt: Fix segfault with iptables-1.6.0 (Phil Sutter) [1326726]
  - m_xt: whitespace cleanup (Phil Sutter) [1326726]
  - tc: m_xt: Introduce get_xtables_target_opts() (Phil Sutter) [1326726]
  - tc: m_xt: Simplify argc adjusting in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of iargc variable in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of rargc in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Drop unused variable fw in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of one indentation level in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Fix indenting (Phil Sutter) [1326726]
  - tc: m_xt: Fix segfault when adding multiple actions at once (Phil Sutter) [1326726]
  - tc: m_xt: Prevent segfault with standard targets (Phil Sutter) [1326726]
  - man: update doc after support of ESN and anti-replay window (Phil Sutter) [1425059]
  - xfrm: add support of ESN and anti-replay window (Phil Sutter) [1425059]


author: Phil Sutter <psutter@redhat.com> [3.10.0-81.el7]
changelog:
  - man: ip-link: Specify min/max values for bridge slave priority and cost (Phil Sutter) [1374360]
  - man: ip-link.8: document bridge options (Phil Sutter) [1373869]


author: Ivan Vecera <ivecera@redhat.com> [3.10.0-84.el7]
changelog:
  - tc: Add support for the matchall traffic classifier. (Ivan Vecera) [1435624]
  - tc: man: Add man entry for the matchall classifier. (Ivan Vecera) [1435624]
  - tc: add missing limits.h header (Ivan Vecera) [1435624]
  - tc: man: matchall: Fix example indentation (Ivan Vecera) [1435624]
  - tc: matchall: Print skip flags when dumping a filter (Ivan Vecera) [1435624]
  - tc, clsact: add clsact frontend (Ivan Vecera) [1435624]


author: Eric Garver <egarver@redhat.com> [3.10.0-86.el7]
changelog:
  - Revert "ip-route man: add usage and description for lwtunnel encap attributes" (Eric Garver) [1459975]
  - Revert "lwtunnel: implement support for ip6 encap" (Eric Garver) [1459975]
  - Revert "lwtunnel: fix argument parsing" (Eric Garver) [1459975]
  - Revert "lwtunnel: Add encapsulation support to ip route" (Eric Garver) [1459975]


author: Sabrina Dubroca <sdubroca@redhat.com> [3.10.0-87.el7]
changelog:
  - devlink: Add e-switch support (Sabrina Dubroca) [1459772]
  - devlink: whitespace cleanup (Sabrina Dubroca) [1459772]
  - devlink: Convert conditional in dl_argv_handle_port() to switch() (Sabrina Dubroca) [1459772]
  - devlink: write usage help messages to stderr (Sabrina Dubroca) [1459772]
  - devlink: Add usage help for eswitch subcommand (Sabrina Dubroca) [1459772]
  - devlink: Call dl_free in early exit case (Sabrina Dubroca) [1459772]


author: Phil Sutter <psutter@redhat.com> [4.11.0-5.el7]
changelog:
  - ip neigh: allow flush FAILED neighbour entry (Matteo Croce) [1469945]
  - tc: fix typo in manpage (Phil Sutter) [1417162]
  - link_gre6: really support encaplimit option (Phil Sutter) [1459600]
  - tc: m_xt: Prevent a segfault in libipt (Phil Sutter) [1465599]


author: Phil Sutter <psutter@redhat.com> [4.11.0-6.el7]
changelog:
  - link_gre6: Fix for changing tclass/flowlabel (Phil Sutter) [1487486]
  - utils: return default family when rtm_family is not RTNL_FAMILY_IPMR/IP6MR (Stefano Brivio) [1475762]
  - netns: avoid directory traversal (Phil Sutter) [1468529]
  - Disable -fexceptions CFLAG passed by build system (Phil Sutter) [1418715]


author: Phil Sutter <psutter@redhat.com> [4.11.0-9.el7]
changelog:
  - lib/libnetlink: update rtnl_talk to support malloc buff at run time (Hangbin Liu) [1380803]
  - lib/libnetlink: re malloc buff if size is not enough (Hangbin Liu) [1380803]
  - iplink: double the buffer size also in iplink_get() (Hangbin Liu) [1380803]
  - iplink: check for message truncation in iplink_get() (Hangbin Liu) [1380803]
  - iproute: Add support for extended ack to rtnl_talk (Hangbin Liu) [1380803]
  - libnetlink: drop unused parameter to rtnl_dump_done (Hangbin Liu) [1380803]
  - netlink: Change rtnl_dump_done to always show error (Hangbin Liu) [1380803]


author: Phil Sutter <psutter@redhat.com> [4.11.0-10.el7]
changelog:
  - tc: flower: add support for matching on ip tos and ttl (Kamal Heib) [1456539]
  - iplink: Update usage in help message (Kamal Heib) [1456539]
  - tc: flower: add support for tcp flags (Kamal Heib) [1456539]
  - devlink: Add option to set and show eswitch encapsulation support (Kamal Heib) [1456539]
  - pedit: Introduce ipv6 support (Kamal Heib) [1456539]
  - pedit: Check for extended capability in protocol parser (Kamal Heib) [1456539]
  - pedit: Do not allow using retain for too big fields (Kamal Heib) [1456539]
  - pedit: Fix a typo in warning (Kamal Heib) [1456539]
  - tc: Reflect HW offload status (Kamal Heib) [1456539]
  - devlink: Add support for pipeline debug (dpipe) (Kamal Heib) [1456539]
  - devlink: Change netlink attribute validation (Kamal Heib) [1456539]
  - Update linux headers (Phil Sutter) [1456539]


author: Phil Sutter <psutter@redhat.com> [4.11.0-11.el7]
changelog:
  - ss: add AF_VSOCK support (Stefano Brivio) [1472759]
  - ss: allow AF_FAMILY constants >32 (Stefano Brivio) [1472759]
  - uapi: add include linux/vm_sockets_diag.h (Stefano Brivio) [1472759]
  - iproute: build more easily on Android (Phil Sutter) [1472759]


author: Phil Sutter <psutter@redhat.com> [4.11.0-12.el7]
changelog:
  - man: tc-csum.8: Fix inconsistency in example description (Phil Sutter) [1417162]
  - link_gre6: Detect invalid encaplimit values (Phil Sutter) [1459600]


author: Phil Sutter <psutter@redhat.com> [4.11.0-15.el7]
changelog:
  - tc/act_tunnel_key: Enable setup of tos and ttl (Phil Sutter) [1641909]
  - tc/flower: Add match on encapsulating tos/ttl (Phil Sutter) [1641909]
  - Update kernel headers (Phil Sutter)
  - tc: include stdint.h explicitly for UINT16_MAX (Phil Sutter) [1641909]
  - tc: m_tunnel_key: Allow key-less tunnels (Phil Sutter) [1658506]
  - tc: m_tunnel_key: reformat the usage text (Phil Sutter) [1658506]


author: Phil Sutter <psutter@redhat.com> [4.11.0-16.el7]
changelog:
  - ip-route: Fix nexthop encap parsing (Phil Sutter) [1624656]
  - man: ip-route.8: Document nexthop limit (Phil Sutter) [1624656]
  - ip-route: Fix segfault with many nexthops (Phil Sutter) [1624656]
  - iproute: Abort if nexthop cannot be parsed (Phil Sutter) [1624656]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-19.el7]
changelog:
  - rdma: add infrastructure for RDMA tool (Andrea Claudi) [1642479 1641914]
  - rdma: Add MR resource tracking information (Andrea Claudi) [1642479 1641914]
  - json_writer: add new json handlers (null, float with format, lluint, hu) (Andrea Claudi) [1642479 1641914]
  - lib: make resolve_hosts variable common (Andrea Claudi) [1642479 1641914]
  - utils: Move BIT macro to common header (Andrea Claudi) [1642479 1641914]
  - tc: flower: Add support for QinQ (Andrea Claudi) [1642347]
  - man: tc-vlan.8: Fix for incorrect example (Andrea Claudi) [1593630]
  - man: ip-route.8: ssthresh parameter is NUMBER (Andrea Claudi) [1593628]
  - devlink: Add param command support (Andrea Claudi) [1644731]
  - devlink: Update man pages and add resource man (Andrea Claudi) [1644731]
  - devlink: Add support for hot reload (Andrea Claudi) [1644731]
  - devlink: Add support for devlink resource abstraction (Andrea Claudi) [1644731]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-21.el7]
changelog:
  - Check user supplied interface name lengths (Andrea Claudi) [1465646]
  - tc: flower: No need to cache indev arg (Andrea Claudi) [1465646]
  - ip{6, }tunnel: Avoid copying user-supplied interface name around (Andrea Claudi) [1465646]
  - utils: strlcpy() and strlcat() don't clobber dst (Andrea Claudi) [1465646]
  - lnstat_util: Make sure buffer is NUL-terminated (Andrea Claudi) [1465646]
  - tc_util: No need to terminate an snprintf'ed buffer (Andrea Claudi) [1465646]
  - ipxfrm: Replace STRBUF_CAT macro with strlcat() (Andrea Claudi) [1465646]
  - Convert harmful calls to strncpy() to strlcpy() (Andrea Claudi) [1465646]
  - Convert the obvious cases to strlcpy() (Andrea Claudi) [1465646]
  - utils: Implement strlcpy() and strlcat() (Andrea Claudi) [1465646]
  - lib/libnetlink: Don't pass NULL parameter to memcpy() (Andrea Claudi) [1465646]
  - lib/fs: Fix and simplify make_path() (Andrea Claudi) [1465646]
  - lib/bpf: Check return value of write() (Andrea Claudi) [1465646]
  - netem/maketable: Check return value of fscanf() (Andrea Claudi) [1465646]
  - ss: Make sure scanned index value to unix_state_map is sane (Andrea Claudi) [1465646]
  - ss: Make struct tcpstat fields 'timer' and 'timeout' unsigned (Andrea Claudi) [1465646]
  - lib/ll_map: Choose size of new cache items at run-time (Andrea Claudi) [1465646]
  - tc/m_xt: Fix for potential string buffer overflows (Andrea Claudi) [1465646]
  - lnstat_util: Simplify alloc_and_open() a bit (Andrea Claudi) [1465646]
  - lib/inet_proto: Review inet_proto_{a2n,n2a}() (Andrea Claudi) [1465646]
  - lib/fs: Fix format string in find_fs_mount() (Andrea Claudi) [1465646]
  - ipntable: Avoid memory allocation for filter.name (Andrea Claudi) [1465646]
  - tipc/bearer: Prevent NULL pointer dereference (Andrea Claudi) [1465646]
  - tc/tc_filter: Make sure filter name is not empty (Andrea Claudi) [1465646]
  - tc/q_netem: Don't dereference possibly NULL pointer (Andrea Claudi) [1465646]
  - ifstat, nstat: Check fdopen() return value (Andrea Claudi) [1465646]
  - lib/bpf: Don't leak fp in bpf_find_mntpt() (Andrea Claudi) [1465646]
  - devlink: Check return code of strslashrsplit() (Andrea Claudi) [1465646]
  - iplink_vrf: Complain if main table is not found (Andrea Claudi) [1465646]
  - iproute: Check mark value input (Andrea Claudi) [1465646]
  - tc/q_multiq: Don't pass garbage in TCA_OPTIONS (Andrea Claudi) [1465646]
  - netem/maketable: Check return value of fstat() (Andrea Claudi) [1465646]
  - ss: Use C99 initializer in netlink_show_one() (Andrea Claudi) [1465646]
  - ipmaddr: Avoid accessing uninitialized data (Andrea Claudi) [1465646]
  - iplink_can: Prevent overstepping array bounds (Andrea Claudi) [1465646]
  - ipaddress: Avoid accessing uninitialized variable lcl (Andrea Claudi) [1465646]
  - tc/m_gact: Drop dead code (Andrea Claudi) [1465646]
  - ss: Drop useless assignment (Andrea Claudi) [1465646]
  - ss: Skip useless check in parse_hostcond() (Andrea Claudi) [1465646]
  - lib/rt_names: Drop dead code in rtnl_rttable_n2a() (Andrea Claudi) [1465646]
  - iproute: Fix for missing 'Oifs:' display (Andrea Claudi) [1465646]
  - ipntable: No need to check and assign to parms_rta (Andrea Claudi) [1465646]
  - devlink: No need for this self-assignment (Andrea Claudi) [1465646]
  - tipc/bearer: Fix resource leak in error path (Andrea Claudi) [1465646]
  - ss: Fix potential memleak in unix_stats_print() (Andrea Claudi) [1465646]
  - ifstat: Fix memleak in dump_kern_db() for json output (Andrea Claudi) [1465646]
  - ifstat: Fix memleak in error case (Andrea Claudi) [1465646]
  - ipvrf: Fix error path of vrf_switch() (Andrea Claudi) [1465646]
  - tc/em_ipset: Don't leak sockfd on error path (Andrea Claudi) [1465646]
  - ss: Don't leak fd in tcp_show_netlink_file() (Andrea Claudi) [1465646]
  - iproute_lwtunnel: csum_mode value checking was ineffective (Andrea Claudi) [1465646]
  - iproute_lwtunnel: Argument to strerror must be positive (Andrea Claudi) [1465646]
  - tipc/node: Fix socket fd check in cmd_node_get_addr() (Andrea Claudi) [1465646]
  - ifcfg: Quote left-hand side of [ ] expression (Andrea Claudi) [1465646]
  - examples: Some shell fixes to cbq.init (Andrea Claudi) [1465646]
  - ip-address: Use correct max attribute value in print_vf_stats64() (Andrea Claudi) [1679749]
  - ss: enclose IPv6 address in brackets (Andrea Claudi) [1588122]
  - tc: f_flower: Add support for matching first frag packets (Andrea Claudi) [1559814]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-23.el7]
changelog:
  - tc_util: Silence spurious compiler warning (Andrea Claudi) [1714660]
  - gre6: add collect metadata support (Andrea Claudi) [1714660]
  - tc: m_tunnel_key: add csum/nocsum option (Andrea Claudi) [1714660]
  - m_mirred: don't bail if the control action is missing (Andrea Claudi) [1714660]
  - tc: fix parsing of the control action (Andrea Claudi) [1714660]
  - tc: util: Don't call NEXT_ARG_FWD() in __parse_action_control() (Andrea Claudi) [1714660]
  - tc: don't print error message on miss when parsing action with default (Andrea Claudi) [1714660]
  - tc: gact: fix control action parsing (Andrea Claudi) [1714660]
  - tc/actions: introduce support for goto chain action (Andrea Claudi) [1714660]
  - tc: actions: add helpers to parse and print control actions (Andrea Claudi) [1714660]
  - tc_filter: add support for chain index (Andrea Claudi) [1714660]
  - gre/gre6: allow clearing {,i,o}{key,seq,csum} flags (Andrea Claudi) [1714660]
  - man: ip link: document GRE tunnels (Andrea Claudi) [1714660]
  - ip/tunnel: Use tnl_parse_key() to parse tunnel key (Andrea Claudi) [1714660]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-25.el7]
changelog:
  - tc: implement ingress/egress block index attributes for qdiscs (Andrea Claudi) [1721291]
  - tc: introduce support for block-handle for filter operations (Andrea Claudi) [1721291]
  - tc_filter: resolve device name before parsing filter (Andrea Claudi) [1721291]
  - tc: introduce tc_qdisc_block_exists helper (Andrea Claudi) [1721291]


author: Andrea Claudi <aclaudi@redhat.com> [4.11.0-27.el7]
changelog:
  - ss: fix NULL pointer access when parsing unix sockets with oldformat (Andrea Claudi) [1795891]
  - tc_util: Add support for showing TCA_STATS_BASIC_HW statistics (Andrea Claudi) [1637437]
  - Update kernel headers (Andrea Claudi) [1637437]
  - uapi: update bpf headers (Andrea Claudi) [1637437]
  - Update kernel headers (Andrea Claudi) [1637437]
  - man: Clarify idleslope calculation for tc-cbs (Andrea Claudi) [1557461]
  - man: Add initial manpage for tc-cbs(8) (Andrea Claudi) [1557461]
  - tc: Add support for the CBS qdisc (Andrea Claudi) [1557461]
  - nstat: print useful error messages in abort() cases (Andrea Claudi) [1792908]


author: Jakub Čajka <jcajka@redhat.com> - 2.4.2-1
changelog:
  - Resolves: #1088562 - [7.1 FEAT] iprutils package update - ppc64
  - Resolves: #1044679 - iprutils should use systemd
  - Resolves: #1092519 - iprutils - PIE and RELRO check


author: Jakub Čajka <jcajka@redhat.com> - 2.4.8-1
changelog:
  - Resolves: #1182038 - [7.2 FEAT] iprutils package update - ppc64/ppc64le
  - Resolves: #1183460 - RHEL7.1 BE: iprutils: Set known zeroed after format


author: Sinny Kumari <skumari@redhat.com> - 2.4.11.1-1
changelog:
  - Resolves: #1274367 - [7.3 FEAT] iprutils package update
  - Resolves: #1297921 - IPR: Raid migration fails to kick while executing through command line


author: Sinny Kumari <skumari@redhat.com> - 2.4.12.1-1
changelog:
  - Resolves: #1364131 - Integrate various important bug fixes for iprutils in
    RHEL7.3 by updating iprutils to 2.4.12


author: Sinny Kumari <skumari@redhat.com> - 2.4.16.1-1
changelog:
  - Resolves: #1587834 - vpdupdate takes over an hour on system with 104 drive
  - Resolves: #1521052 - iprutils package update for POWER
  - Resolves: #1547891 - iprconfig unable to Download microcode on all applicable devices
  - Resolves: #1576013 - iprconfig tools shows wrong error message, while creating raid using RI SSDs and normal SSDs


author: Mathieu Bridon <bochecha@fedoraproject.org> - 6.11-1
changelog:
  - New upstream release.
  - Removed our patch, it has been integrated upstream. As such, we also don't
    need to re-run autoreconf any more.


author: Mathieu Bridon <bochecha@fedoraproject.org> - 6.14-1
changelog:
  - New upstream release.
  - Fix scriptlets, ldconfig is needed for the libs subpackage, not the main one.


author: Thomas Woerner <twoerner@redhat.com> - 6.19-5
changelog:
  - New service sub package to provide the ipset service (RHBZ#1136257)
    Service and start-stop script from F-24
  - Fixed ipset package summary (RHBZ#1195171)
    Spec file derived from F-24


author: Thomas Woerner <twoerner@redhat.com> - 6.19-6
changelog:
  - Use /etc/sysconfig/ipset-config in service as EnvironmentFile (RHBZ#1136257)
  - Use /etc/sysconfig/ipset for data as in RHEL-6 (RHBZ#1136257)
  - No save on reload, but legacy save action (RHBZ#1136257)


author: Thomas Woerner <twoerner@redhat.com> - 6.29-1
changelog:
  - Rebase to 6.29 (RHBZ#1351299)
  - Fixes:
    - Backport ipset capability to run in namespaces (RHBZ#1226051)
    - Fix service save with empty ipset list and existing ipset save file
      (RHBZ#1377621)
    - Fix internal error at printing to output buffer (RHBZ#1395865)


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-1
changelog:
  - Rebase to 6.38 (RHBZ#1557600):
    - hash:ipmac type support added to ipset, userspace part (Tomasz Chilinski)
  - Refactor /etc/sysconfig/ipset.start-stop
  - Fixes:
    - IPSet Service Monolithic Operation (RHBZ#1440741)
    - "systemctl start ipset" doesn't handle existing ipset's having counters
      (RHBZ#1502212)


author: Stefano Brivio <sbrivio@redhat.com> - 7.1-1
changelog:
  - Rebase to 7.1 (RHBZ#1649080):
    - Add compatibility support for strscpy()
    - Correct the manpage about the sort option
    - Add missing functions to libipset.map
    - configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
    - Implement sorting for hash types in the ipset tool
    - Fix to list/save into file specified by option (reported by Isaac Good)
    - Introduction of new commands and protocol version 7, updated kernel include files
    - Add compatibility support for async in pernet_operations
    - Use more robust awk patterns to check for backward compatibility
    - Prepare the ipset tool to handle multiple protocol version
    - Fix warning message handlin
    - Correct to test null valued entry in hash:net6,port,net6 test
    - Library reworked to support embedding ipset completely
    - Add compatibility to support kvcalloc()
    - Validate string type attributes in attr2data() (Stefano Brivio)
    - manpage: Add comment about matching on destination MAC address (Stefano Brivio)
      (RHBZ#1649079)
    - Add compatibility to support is_zero_ether_addr()
    - Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649073)
    - Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649073)
    - Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649073)
    - tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio) 
  - Fixes:
    - Fix all shellcheck warnings in init script (RHBZ#1649073)
    - Make error reporting consistent, introduce different severities (RHBZ#1649877)
    - While restoring, on invalid entries, remove them and retry (RHBZ#1650297)
    - Fix covscan SC2166 warning in init script (RHBZ#1649073)
    - Hardcode triggerin, triggerun versions for ipset-service (RHBZ#1646666)


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-6
changelog:
  - Removed gpg key check during build RHBZ#1248529
  - Fixed the license tag to include external code RHBZ#1248538
  - Use full path url RHBZ#1251149


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-7
changelog:
  - Added dependency on python-requests for client RHBZ#1254644
  - Fixed possible XSS flaws CVE-2015-5215, CVE-2015-5216
  - Fixed permission check CVE-2015-5217


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-8
changelog:
  - Moved ipsilon-client-install man page to client subpackage RHBZ#1255103
  - Backported patch to count IPA as login plugin RHBZ#1256517
  - Backported patch to log error if nameid is invalid RHBZ#1256520
  - Backported patch to add city attribute RHBZ#1257213


author: Patrick Uiterwijk <puiterwijk@redhat.com> - 1.0.0-9
changelog:
  - Backport database keys patch RHBZ#1252392
  - Backport SAML path check patch RHBZ#1253821
  - Backport database cleanup RHBZ#1256518


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-9
changelog:
  - fixed missing system hang at shutdown if root device is network based
    (RHBZ#1007934)
  - Fixed iptables-save man page completely wrong (RHBZ#1054871)
  - Fixed missing reload action for iptables service (RHBZ#1066007)
  - Fixed regressions from RHEL-6 iptables services (RHBZ#1067670)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-14
changelog:
  - Add cgroup support (RHBZ#1058660)
  - Add wait seonds support for commands (RHBZ#1156411)
  - Add dhcpv6-client in default IPv6 firewall rules (RHBZ#1169036)
  - Add message for init script error returns (RHBZ#1200415)
  - Use flock for wait option (RHBZ#1202435)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
  - Fix important coverity findings: missing include for flock and use bash for
    init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
  - Fixed init script not to fail on missing restorecon (RHBZ#1246380)
  - Adapted man page snipplet for TRACE to use proper logging backend names
    (RHBZ#1261238)
  - Warn about use of DROP in nat table (RHBZ#1298879)
  - Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
  - Add support for --wait options to restore commands (RHBZ#1438597)
  - Do not set changed flag for rule check operations with module targets
    (RHBZ#1438597)
  - Add version option to restore commands (RHBZ#1438597)


author: Phil Sutter - 1.4.21-20
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1486803)
  - Don't restart services upon upgrade (RHBZ#1380141)


author: Phil Sutter - 1.4.21-25
changelog:
  - Fix for stopping iptables and ip6tables at the same time (RHBZ#1560012)
  - Propagate errors on service stop (RHBZ#1560012)


author: Phil Sutter - 1.4.21-27
changelog:
  - libxt_tcpmss: Detect invalid ranges (RHBZ#1128510)
  - ip(6)tables-save/restore: Exit if invalid option was given (RHBZ#1465078)
  - ip(6)tables-save/restore: Require value to -W option (RHBZ#1465078)
  - ip(6)tables-save/restore: Don't accept -W without -w (RHBZ#1465078)
  - Ignore security table when setting policies (RHBZ#1494012)
  - Fix spec file changing SRPM content (RHBZ#1531290)


author: Phil Sutter - 1.4.21-29
changelog:
  - Do not attempt to unload any modules when stopping the firewall (RHBZ#1520534)
  - Fix for covscan warnings (RHBZ#1525980)


author: Phil Sutter <psutter@redhat.com> - 1.4.21-31
changelog:
  - Fix iptables-restore with empty comment in rule (RHBZ#1668475)
  - Fix parsing and printing of -m ipvs --vproto option (RHBZ#1679726)
  - Fix for wrong location of devgroup definition file (RHBZ#1657075)
  - Fix for non-numeric devgroup name output (RHBZ#1657075)
  - Reject negative realm values (RHBZ#1657075)


author: Phil Sutter <psutter@redhat.com> - 1.4.21-34
changelog:
  - Fix iptables-restore for rules with '-' and 't' in comments (RHBZ#1749700)
  - Make services start before network-pre.target is reached (RHBZ#1736765)


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-6
changelog:
  - fix 1283773 - segfault in rate_add_rate

    Jun 17 2014 Alejandro Pérez  <aeperezt@fedoraproject.org>
    fix 1109768 bad configuration logrotate
    Mar 02 2014 Alejandro Pérez  <aeperezt@fedoraproject.org>
    fix bug 1020552 - rpm report /var/lock/ipraf-ng is missing
    added missing file iptraf-nf-tmpfiles.conf
    Dec 03 2013 Nikola Pajkovsky <npajkovs@redhat.com>
    Fedora start using -Werror=format-security and iptraf-ng had some
    parts where error compilation was trigged.
    202b2e7b27a1 Makefile: add -Werror=format-security
    Resolved: #1037133


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-7
changelog:
  - Fixes error in patch Patch03 - this fixes 1283773 and 1539081
    1501821 - Upstream moved to https://github.com/iptraf-ng/iptraf-ng/
    1020552, 1372679 - fix missing /var/lock/iptraf-ng file
    Add BuildRequires:  gcc to spec file.
    1109768 - bad configuration logrotate


author: Jan Synáček <jsynacek@redhat.com> - 20121125-2
changelog:
  - Comment patches and cleanup
  - Update ifaddrs patch
  - Call usage() before limiting capabilities
  - Correct ifaddrs patch
  - Drop corr_type patch (gcc 4.4 build hack)
  - Fix missing end tags in sgml documentation


author: Jan Synáček <jsynacek@redhat.com> - 20121207-1
changelog:
  - Update to iputils-s20121207 (#884983) - fixes a ping segfault introduced
    by the previous update
  - Update ninfod-minor patch
  - Renumber patches
  - Fix -F switch (flowlabel patch)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-7
changelog:
  - ping hung when it cannot receive echo reply (#1362463)
  - arping documentation inconsistency (#1351704)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-9
changelog:
  - IPv4 vs IPv6 inconsistency on return value of ping (#1362388)
  - ping6 does not use device specified with -I parameter (#1371824, #1424965)
  - double cap_free call in ping_common.c (#1410114)
  - ping assumes EACCESS errors are due to broadcast addresses (#1387315)
  - ping -t with multicast address without effect on ppc64 (#1373333)
  - arping -c <n> does not exit when the device is deleted (#1387542)


author: Jan Synáček <jsynacek@redhat.com> - 20121221-7
changelog:
  - ping returns odd results with options inet6 in resolv.conf (#1210331)
  - count of "back" is not correct in tracepath (#1208372)


author: Matthias Saou <http://freshrpms.net/> 1.26-2
changelog:
  - Backport the init script from RHEL6, which contains lots of changes to make
    it behave simlarly to the iptables init script (#593276).


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-4.gitc4bce43
changelog:
  - ipxe-Use-next-server-from-filename-s-settings-block.patch [bz#1062644]
  - Resolves: bz#1062644
    (pxe boot fails if next-server details come from a different dhcp server)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-5.gitc4bce43.el7
changelog:
  - ipxe-Enable-infrastructure-to-specify-an-autoboot-device-.patch [bz#1031518]
  - ipxe-Allow-prefix-to-specify-a-PCI-autoboot-device-locati.patch [bz#1031518]
  - ipxe-Store-boot-bus-dev.fn-address-as-autoboot-device-loc.patch [bz#1031518]
  - ipxe-Ignore-PCI-autoboot-device-location-if-set-to-00-00..patch [bz#1031518]
  - ipxe-Revert-Remove-2-second-startup-wait.patch [bz#857123]
  - ipxe-Allow-ROM-banner-timeout-to-be-configured-independen.patch [bz#857123]
  - ipxe-Customize-ROM-banner-timeout.patch [bz#857123]
  - Resolves: bz#1031518
    (iPXE does not honor specified boot device)
  - Resolves: bz#857123
    (Guests never get an iPXE prompt)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-6.gitc4bce43.el7
changelog:
  - ipxe-import-EfiRom-from-edk2-BaseTools-RHEL-only.patch [bz#1084561]
  - ipxe-add-custom-Makefile-for-EfiRom-RHEL-only.patch [bz#1084561]
  - ipxe-redhat-build-and-install-combined-legacy-UEFI-roms-f.patch [bz#1084561]
  - Resolves: bz#1084561
    (RFE: ship UEFI drivers for ipxe in RHEL-7.y)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-2.git6366fa7a.el7
changelog:
  - ipxe-Enable-IPv6-protocol-in-non-QEMU-builds.patch [bz#1350167]
  - Resolves: bz#1350167
    (ipxe: enable IPV6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-3.git6366fa7a.el7
changelog:
  - ipxe-Add-pci_find_next_capability.patch [bz#1242850]
  - ipxe-Add-virtio-1.0-constants-and-data-structures.patch [bz#1242850]
  - ipxe-Add-virtio-1.0-PCI-support.patch [bz#1242850]
  - ipxe-Add-virtio-net-1.0-support.patch [bz#1242850]
  - ipxe-Renumber-virtio_pci_region-flags.patch [bz#1242850]
  - ipxe-Fix-virtio-pci-logging.patch [bz#1242850]
  - Resolves: bz#1242850
    (Ipxe can not recognize "network device" when enable virtio-1 of virtio-net-pci)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-4.git6366fa7a.el7
changelog:
  - ipxe-Send-TCP-keepalives-on-idle-established-connections.patch [bz#1322056]
  - ipxe-enable-e1000e-rom.patch [bz#1361534]
  - Resolves: bz#1322056
    (ipxe freeze during HTTP download with last RPM)
  - Resolves: bz#1361534
    (RFE: Integrate e1000e implementation in downstream QEMU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-5.git6366fa7a.el7
changelog:
  - ipxe-Strip-802.1Q-VLAN-0-priority-tags.patch [bz#1316329]
  - Resolves: bz#1316329
    ([RFE] Properly Handle 8021.Q VID 0 Frames, as new vlan model in linux kernel does.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170123-1.git4e85b27.el7_4.1
changelog:
  - ipxe-Support-VIRTIO_NET_F_IOMMU_PLATFORM.patch [bz#1481180]
  - Resolves: bz#1481180
    (iommu platform support for ipxe [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20170123-2.git4e85b27.el7
changelog:
  - ipxe-Support-VIRTIO_NET_F_IOMMU_PLATFORM.patch [bz#1467887]
  - Resolves: bz#1467887
    (iommu platform support for ipxe)


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.6-5
changelog:
  - Fixed irqbalance web adresses in spec (bz1060810)
  - Default hintpolicy adjusted (bz1060814)
  - Missing autogen.sh call fixed


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.7-2
changelog:
  - fixed unused variable revealed by covscan
  - fixed ignored pid argument (#1155632)
  - warning when irqbalance started under non-root (#1155799)
  - more robust signal handling (#1158937)
  - fixed hostname in manpage (#1162251)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.8.15-8
changelog:
  - Fixed crash that can occur if term is resized during irssi init
    (init-resize-crash-fix patch)
    Resolves: rhbz#796457


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-11
changelog:
  - iscsi boot related fixes
    make sure iscsid gets started if there are any boot sessions running
    add reload target to fix double session problem when restarting from NM
    don't rely on session list passed from initrd, never got fully implemented
    remove patches related to running iscsid from initrd, possible to revisit later


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-16
changelog:
  - fix iscsiuio socket activation
  - have systemd start socket units on iscsiadm use, if not already listening


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-19
changelog:
  - 1007388 fixes for iscsiadm to support qla4xxx
  - refresh boot session info patches to final version from upstream,
    fixes context issues with later patches
  - 1006156, 1006161 Add/Update entries in chap table through Open-iSCSI
  - 948134 extend support to set additional parameters for network configuration
  - 1049710 update open-iscsi to support host statistics
  - 1043019 iscsiuio fix for arp cache flush issue
  - 1059332 Fix broken discovery sessions over iser
  - 1017393 split out iscsiuio into a seperate sub-package


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-20
changelog:
  - 1049710 host0 being treated as an invalid in the host stats command
  - 1015563 revert change to return code when calling login_portal for sessions
    that already exist, as it impacts users scripting around iscsiadm


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-21
changelog:
  - 1069825
  - boot session handling improvements
  - Fix iscsi-mark-root for changed iscsiadm output
  - Make sure iscsiuio is running for boot session recovery when using the
    bnx2i transport by forcing iscsiuio.service start
  - Make NM dispatch triggered re-check for autostart sessions async
  - Accept exit code 21, no records, from iscsiadm as success in
    iscsi.service


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-29
changelog:
  - 1166713 1187792 add missing ExecStart, only newer systemd lets that be optional for oneshot services


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-32
changelog:
  - 1235684 apply safe_logout setting to flashnode sessions as well
    but only when logging out by session id, not by flashnode index


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-34
changelog:
  - 1322000 ensure TCP abort on session failure to prevent data corruption with link flap
  - 1294964, 1265073, 1213569 iscsiuio update, fix small ARP table issue
  - 1309488 remove broken sysfs cache code to speed up login of many sessions
  - 1330348 sync with upstream Open-iSCSI for minor fixes


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-6
changelog:
  - 1507945 force start iscsiuio for boot session recovery with qedi
  - 1457359 start systemd socket listeners, otherwise if iscsid is started
    directly iscsiuio doesn't activate as expected


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-12
changelog:
  - 1389071 handle newer ISCSI_ERR_NOP_TIMEDOUT code from the kernel
  - 1624670 Login negotiation failed due to CHAP_N values do not match
            (rec update race condition)


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-17
changelog:
  - 1518367 boot from iSCSI not establishing all sessions persistently
  - 1667965 A manual restart of iscsi.service modifies records node.startup value


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-18
changelog:
  - 1809945 backport new CHAP modes for FIPS environments (SHA1 and SHA256 only, no SHA3 in OpenSSL-1.0.2)


author: Than Ngo <than@redhat.com> - 3.2-94
changelog:
  - Resolves: bz#1060370
    update patch to handle all cases by recursing through fmtmsg
    instead of vfmtmsg directly which depends on va_list type.


author: Chris Leech <cleech@redhat.com> - 0.93-4
changelog:
  - set hardened build flag, required for long running processes (isnsd)
  - patch makefile to actually use LDFLAGS


author: Brian C. Lane <bcl@redhat.com> 1.0.9-1
changelog:
  - Add python-isomd5sum package with python bindings
  - Add callback and interrupt support to the python library
  - Add RPM_OPT_FLAGS to CFLAGS and update makefile to use CFLAGS from environment


author: Brian C. Lane <bcl@redhat.com> 1.0.10-1
changelog:
  - Fix for gcc type-punned and sizeof pointer warnings. (bcl)
  - Add exit code 2 for user abort (#907600) (bcl)
  - Cleanup TABs and update Copyrights (bcl)
  - Standardize *FLAGS in Makefile (ryan)


author: Tatyana Nikolova <tatyana.e.nikolova@intel.com> - 1.0.3rc1
changelog:
  - Adding iwpmd.conf file to enable changing the size
    of the netlink socket receive buffer
  - Including a fix for failing to send netlink messages


author: Tatyana Nikolova <tatyana.e.nikolova@intel.com> - 1.0.3
changelog:
  - Fix for the init script to enable the service to start automatically
    after boot on SLES11 SP4
  - Releasing libiwpm-1.0.3 to be included in OFED-3.18-1


author: Dave Anderson <anderson@redhat.com> - 01.00.00.2113-1
changelog:
  - Copied upstream v01.00.00.2113.tar.gz into ixpdimm_sw-01.00.00.2113.tar.gz
    and did an rhpkg new-sources to replace the mismatched checksum version 
    included in the Fedora src.rpm
  - Resolves: rhbz#1270993


author: Eric Sandeen <sandeen@redhat.com> - 01.00.00.2111-1
changelog:
  - Downgrade to v01.00.00.2113 to satisfy existing RHEL7 deps
  - Add explicit inter-package dependencies
  - Resolves: rhbz#1270993


author: Michal Srb <msrb@redhat.com> - 1.2-0.11.20100217cvs
changelog:
  - Install license in javadoc package (Resolves: #888420)
  - Removed dependency on jai-imageio-core from javadoc package (Resolves: #888423)


author: Michal Srb <msrb@redhat.com> - 0:1.1.2-13
changelog:
  - Prevent XXE and RCE in JSTL XML tags
  - Apply correction for previous CVE-2015-0254 patch (prevent XXE in <x:transform>)
  - Resolves: CVE-2015-0254


author: Marek Goldmann <mgoldman@redhat.com> - 1.4-1
changelog:
  - Upstream release 1.4
  - Fixing "archiver requires 'AM_PROG_AR' in 'configure.ac'" error
  - FTBFS: config.status: error: cannot find input file: `Makefile.in' RHBZ#858377


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.4-8
changelog:
  - Install attached artifacts for proper classifier provides
  - Enable aarch64 support
  - Resolves: rhbz#1028551


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.0-7
changelog:
  - Install COPYING file with javadoc package
  - Update to current packaging guidelines
  - Remove rpm bug workaround


author: Mat Booth <fedora@matbooth.co.uk> - 1.4-1
changelog:
  - Update to latest upstream version.
  - Drop no longer needed patches.
  - Drop unneeded BR/R on gnu-regexp.


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-18
changelog:
  - CVE-2011-4516, CVE-2011-4517 jasper: heap buffer overflow flaws
    lead to arbitrary code execution (CERT VU#887409) (#765660)
  - Fixed problems found by static analysis of code (#761440)
  - spec file modernized


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-27
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171211)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-28
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173569)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173569)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-29
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183674)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183682)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-30
changelog:
  - Multiple security fixes (fixed by thoger):
    CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089
    CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692
    CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262
    CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391
    CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583
    CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
  - Fix implicit declaration warning caused by security fixes above


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-59.1.10.3
changelog:
  - updated to icedtea6 1.10.3
  - http://blog.fuseyism.com/index.php/2011/07/21/icedtea6-1103-released/


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-60.1.10.4
changelog:
  - updated to icedtea6 1.10.4
  - Security fixes
    - S7000600, CVE-2011-3547: InputStream skip() information leak
    - S7019773, CVE-2011-3548: mutable static AWTKeyStroke.ctor
    - S7023640, CVE-2011-3551: Java2D TransformHelper integer overflow
    - S7032417, CVE-2011-3552: excessive default UDP socket limit under SecurityManager
    - S7046823, CVE-2011-3544: missing SecurityManager checks in scripting engine
    - S7055902, CVE-2011-3521: IIOP deserialization code execution
    - S7057857, CVE-2011-3554: insufficient pack200 JAR files uncompress error checks
    - S7064341, CVE-2011-3389: HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)
    - S7070134, CVE-2011-3558: HotSpot crashes with sigsegv from PorterStemmer
    - S7077466, CVE-2011-3556: RMI DGC server remote code execution
    - S7083012, CVE-2011-3557: RMI registry privileged code execution
    - S7096936, CVE-2011-3560: missing checkSetFactory calls in HttpsURLConnection
  - Bug fixes
    - RH727195 : Japanese font mappings are broken
  - Backports
    - S6826104, RH730015: Getting a NullPointer exception when clicked on Application & Toolkit Modal dialog
  - Zero/Shark
    - PR690: Shark fails to JIT using hs20.
    - PR696: Zero fails to handle fast_aldc and fast_aldc_w in hs20.


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-60.1.10.4
changelog:
  - omajid have added Patch6 as (probably temporally) solution for S7103224 for buildability on newest glibc libraries.


author: Deepak Bhole <dbhole@redhat.com> - 1:1.6.0.0-1.64.1.11.12
changelog:
  - Removed the temporary libffi-compat-5 requirement
  - Updated BR to java6-1.6.0-devel
  - Build with OpenJDK6 specifically


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-1.66.1.13.0
changelog:
  - updated to icedtea 1.13
  - updated to openjdk-6-src-b28-04_oct_2013
  - added --disable-lcms2 configure switch to fix tck
  - removed upstreamed patch7,java-1.6.0-openjdk-jstack.patch
  - removed patch100: 8000791-regression-fix.patch
  - added patch7 1.13_fixes.patch to fix 1.13 build issues
  - adapted patch0 java-1.6.0-openjdk-optflags.patch
  - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
  - removed useless runtests parts
  - included also java.security.old files
  - added:
     - Patch103 type_hsx23_patch3.patch
     - Patch104 type_hsx23_patch4.patch
   -to fix zero type error
   -aplied everywhere, as should go upstream
  - Resolves: rhbz#1018679


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-3.1.13.0
changelog:
  - updated to icedtea 1.13.1
   - http://blog.fuseyism.com/index.php/2014/01/23/security-icedtea-1-12-8-1-13-1-for-openjdk-6-released/
  - updated to jdk6, b30,  21_jan_2014
   - https://openjdk6.java.net/OpenJDK6-B30-Changes.html
  - adapted patch7 1.13_fixes.patch
  - pre 2011 changelog moved to (till now  wrong) pre-2009-spec-changelog (rh1043611)
  - added --disable-system-lcms to configure options to pass build
  - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
  - removed upstreamed  patch103 type_hsx23_patch3.patch
  - Resolves: rhbz#1053279


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.1
changelog:
  - Update to IcedTea 1.13.12 & OpenJDK 6 b40.
  - Separate SystemTap option from bootstrap options.
  - Depend on mailcap for /etc/mime.types (PR2800)
  - Use configure macro and disable long-running JTreg & SystemTap tests from make check
  - Remove redundant patch-ecj target invocation for bootstrap build.
  - Add check section to run the new tests introduced in 1.13.12.
  - Fix context for rpath patch following PR3140.
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.2
changelog:
  - Require mailcap at build time as well, so configure finds /etc/mime.types
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.3
changelog:
  - Separate bootstrap option as it should not be tied to the JDK used.
  - Enable bootstrapping on JIT architectures going forward.
  - Temporarily enable bootstrapping on all architectures to work around RH1334465/PR2956.
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.5
changelog:
  - Non-JIT architectures have not been bootstrapping, due to RPM reading commented macros
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.8
changelog:
  - Set install directories in configure so that @prefix@ is substituted correctly in tapset
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.9
changelog:
  - Require a JDK with RH1334465/PR2956 fixed and turn off bootstrapping for Zero architectures.
  - Resolves: rhbz#1350047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Update to IcedTea 1.13.13 & OpenJDK 6 b41.
  - Fix context for rpath patch following PR3213.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.1
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (PR2938, PR2939, PR3012, PR3013 and PR1437) applied upstream.
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.2
changelog:
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.3
changelog:
  - Add additional changes to 8162344 to fix issues which only show up on a full build.
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.4
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Use readlink rather than a wildcard to resolve the system JDK directory
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.5
changelog:
  - Change to disable RC4 did not add MD5 checksum of previous java.security file from 2016/01
  - Resolves: rhbz#1350042


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.111-2.6.7.6
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.7
changelog:
  - Rebuild java-1.7.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372747)
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.0
changelog:
  - Bump to 2.6.8 and u121b00.
  - Drop patches (S7081817, S8140344, S8145017 and S8162344) applied upstream.
  - Update md5sum list with checksum for the new java.security file.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.1
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Update md5sum list with checksum for the new java.security file.
  - Add blacklisted.certs to installation file list.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.2
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Update jstack tapset to handle AArch64
  - Handle unsupported architectures by calling the error function rather than a parse failure
  - ABS_JAVA_HOME_DIR is no longer used in the updated tapsets
  - Resolves: rhbz#1373986


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.3
changelog:
  - Backport "8173783: IllegalArgumentException: jdk.tls.namedGroups"
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1422738


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.1
changelog:
  - Bump to 2.6.10 and u141b00.
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Update md5sum list with checksum for the new java.security file.
  - Drop 8173783 backport which is now applied upstream.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.3
changelog:
  - Add support for using RSAandMGF1 with the SHA hash algorithms in the PKCS11 provider 
  - Resolves: rhbz#1273760


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.4
changelog:
  - Fix merge error with "native2ascii changes file permissions of input file"
  - Resolves: rhbz#1446700


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.141-2.6.10.5
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - aligned with this change, applied repackReproduciblePolycies.sh
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.151-2.6.11.1
changelog:
  - Bump to 2.6.11 and u151b00.
  - Update java-access-bridge-security.patch to apply against 2.6.11.
  - Drop 7177216 merge fix which is applied upstream.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Fix missing return statement in hotspot/src/cpu/aarch64/vm/c1_LIRAssembler_aarch64.cpp.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Fix missing return statement in hotspot/src/os_cpu/linux_aarch64/vm/os_linux_aarch64.cpp
  - Temporarily add -Wno-error=return-type so we can catch them all.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Extend pr3393-rh1273760.patch so Token.getMechanismInfo can handle CK_MECHANISM
  - Fix missing return statement in hotspot/src/cpu/aarch64/vm/vm_version_aarch64.cpp
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Update to new tarball with AArch64 return value fixes, dropping local patch.
  - Drop -Wno-error=return-type now they appear to be fixed.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.1
changelog:
  - Spoke too soon... fix missing return statement in src/os_cpu/linux_zero/vm/os_linux_zero.cpp (non-LP64 only)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.2
changelog:
  - Rebuild with RPM optimisation flags disabled due to issues on x86 multilib
  - Resolves: rhbz#1528233


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.11
changelog:
  - jsa files changed to 444 to pass rpm verification
  - Add reg-ex for filtering private libraries' provides/requires.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.11
changelog:
  - Cleanup RH1566890 patch and differentiate from java-1.8.0-openjdk version.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.191-2.6.15.1
changelog:
  - Bump to 2.6.15 and u191b00.
  - Drop PR3608/RH1566890/CVE-2018-3639 patch now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.16.1
changelog:
  - Bump to 2.6.16 and u201b00.
  - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.17pre01.0
changelog:
  - Bump to 2.6.17pre01.
  - Add support for icedtea_snapshot so we can build pre-releases.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Bump to 2.6.17.
  - Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after 8211883
  - Regenerate pr3393-rh1273760-support_rsaandmgf1_with_sha_in_pkcs11.patch against current sources
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.2
changelog:
  - Synchronise Requires with java-1.8.0-openjdk
  - Replace liblcms.so and libsctp.so in _privatelibs with libjavalcms.so and libjavasctp.so
  - Add libjavagtk.so and libmawt.so to _privatelibs
  - Remove duplicate fontconfig build requirement
  - Remove unneeded Requires for fontconfig, lcms2 and libjpeg (all dynamically linked against)
  - Add _isa to NSS requirements
  - Move policytool desktop file and man page to java-1.7.0-openjdk where the binary is
  - Resolves: rhbz#1608957


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.231-2.6.19.1
changelog:
  - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
  - Fix fsg.sh to fail if patching fails.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.1
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Drop JDK-8226318/RH1738637 which is now included upstream.
  - Resolves: rhbz#1753423


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.3.2.fel7
changelog:
  - added and applied patch121, FixPPC64StackOverflow.patch
  - all redundant ppc64 strings replaced by power64 macro
  - Resolves:rhbz#1018680


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.3.3.fel7
changelog:
  - just bumped release, need to confirm, that   patch121, FixPPC64StackOverflow.patch
    really works
  - Resolves:rhbz#1018680


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.3.4.fel7
changelog:
  - Removed obsoletes for java-1.6.0-openjdk* ,  until decided its presence in el7
  - Resolves:rhbz#1018680


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.4.0.el7
changelog:
  - updated to security icedtea 2.4.4
   - icedtea_version set to 2.4.4
   - updatever bumped to       51
   - release reset to 0
  - sync with fedora
   - added and applied patch411 1029588.patch (rh 1029588)
   - added aand applied patch410, 1015432 (rh 1015432)
   - and so removed patch121 FixPPC64StackOverflow.patch
  - added patch412 zero-x32.diff to try to fix zero builds build
  - Resolves: rhbz#1053280


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.5.0.el7
changelog:
  - updated to icedtea 2.4.5 + sync with f21
   - http://blog.fuseyism.com/index.php/2014/01/29/icedtea-2-4-5-released/
  - removed buildRequires: pulseaudio >= 0.9.11, as not neccessary
   -  but kept libs-devel)
  - removed upstreamed or unwonted patches (thanx to gnu_andrew to pointing them out)
   - patch410 1015432.patch (upstreamed)
   - patch411 1029588.patch
   - patch412 zero-x32.diff
   - patch104 java-1.7.0-ppc-zero-jdk.patch
   - patch105 java-1.7.0-ppc-zero-hotspot.patch
  - patch402 gstackbounds.patch and patch403 PStack-808293.patch applied always
   (again thanx to gnu_andrew)
  - merged other gnu_andrew's changes
   - FT2_CFLAGS and FT2_LIBS hardoced values replaced by correct pkg-config calls 
   - buildver bumbed to 31
  - added build requires  nss-devel
  - removed build requires mercurial
  - added JRE_RELEASE_VERSION and ALT_PARALLEL_COMPILE_JOBS into make call
  - Related: rhbz1038092


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-9.b15
changelog:
  - Update to aarch64-jdk8u101-b15.
  - Rebase SystemTap tarball on IcedTea 3.1.0 versions so as to avoid patching.
  - Drop additional hunk for 8147771 which is now applied upstream.
  - Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
  - Update to aarch64-jdk8u102-b14.
  - Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
  - Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
  - Move 8158260 to 8u112 section following its backport to 8u.
  - Resolves: rhbz#1359857


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - @prefix@ in tapsetfiles substitued by prefix as necessary to work with systemtap3 (rhbz1371005)
  - Resolves: rhbz#1295754


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-3.b14
changelog:
  - Rebuild java-1.8.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372750)
  - Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-4.b14
changelog:
  - Runtime native library requirements need to match the architecture of the JDK
  - Resolves: rhbz#1375224


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
  - Update to aarch64-jdk8u111-b14.
  - Add latest md5sum for java.security file due to jar signing property addition.
  - Drop S8157306 and the CORBA typo fix, both of which appear upstream in u111.
  - Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
  - Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-6.b12
changelog:
  - Update to aarch64-jdk8u131-b12 and aarch64-shenandoah-jdk8u131-b12 for AArch64 8168699 fix
  - Resolves: rhbz#1443417


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-8.b12
changelog:
  - Restore cacerts symlink as some broken apps hardcode the path (see RH1448802)
  - Resolves: rhbz#1319875


author: Zhengyu Gu <zgu@redhat.com> - 1:1.8.0.131-10.b12
changelog:
  - Added 8181055-pr3394-rh1448880.patch to fix a corner case of previous change
  - Resolves: rhbz#1448880


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-11.b12
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-12.b12
changelog:
  - Add backports from 8u152 (8179084/RH1455694, 8181419/RH1463144, 8175887) ahead of July CPU.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b15
changelog:
  - Update to aarch64-jdk8u141-b15 and aarch64-shenandoah-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-2.b16
changelog:
  - Update to aarch64-jdk8u141-b16 and aarch64-shenandoah-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-0.b12
changelog:
  - Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
  - Remove upstreamed patches for 8181055/PR3394/RH1448880,
  -  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
  -  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
  -  8181810/PR3466/RH1498319.
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Cleanup from previous commit.
  - Remove unused upstream patch 8167200.hotspotAarch64.patch.
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-7.b10
changelog:
  - Bump release number to be greater than RHEL 7.6 package to allow build with .el7 suffix
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
  - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
  - Update to aarch64-shenandoah-jdk8u181-b15.
  - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
  - Move buildver to where it should be in the OpenJDK version.
  - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
  - Update pr3539-rh1548475.patch to apply after 8187045.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
  - Update to aarch64-shenandoah-jdk8u181-b16.
  - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
  - Resolves: rhbz#1633822


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b10.
  - Drop 8146115/PR3508/RH1463098 applied upstream.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
  - Don't perform a bootcycle build for the debug variant build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Provide Javadoc debug subpackages for now, but populate them from the normal build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Use normal_suffix for Javadoc zip filename to copy, as there is is no debug version.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b04.
  - Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b08-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b08.
  - Adjust PR3083/RH134640 to apply after JDK-8182999
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-1
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b09.
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-3
changelog:
  - Mark net.properties as a config file (based on Fedora patch by James Cassell)
  - Resolves: rhbz#1710928


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-4
changelog:
  - Update generate_source_tarball.sh script to use the PR3756 patch and retain the secp256k1 curve.
  - Regenerate source tarball using the updated script and add the -'4curve' suffix.
  - Resolves: rhbz#1746874


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-5
changelog:
  - Replace JDK-8231991 backport with upstream version and include JDK-8234107 fixup.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b05.
  - Attempt to fix Shenandoah formatting failures on S390, introduced by JDK-8232102.
  - Revise b05 snapshot to include JDK-8236178.
  - Add additional Shenandoah formatting fixes revealed by successful -Wno-error=format run
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b07.
  - Switch to GA mode for final release.
  - Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b08.
  - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions.
  - Fix paths in jdk8231991-mouse_wheel_focus.patch after git apply --stat complaints.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b01.
  - Switch to EA mode.
  - Adjust JDK-8199936/PR3533 patch following JDK-8227397 configure change
  - Remove local copies of JDK-8231991 & JDK-8234107 as replaced by upstream versions.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b03.
  - Adjust PR2974/RH1337583 & PR3083/RH1346460 following context changes in JDK-8230978
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-3
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.4.ea
changelog:
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.5.ea
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Introduce jfr_arches for architectures which support JFR.
  - Introduce sa_arches for architectures which support the serviceability agent.
  - Introduce share_arches for architectures which support class sharing (-Xshare:dump).
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-1
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u265-b01.
  - Update release notes for 8u265 release.
  - Resolves: rhbz#1860456


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.265.b01-1
changelog:
  - ASSEMBLY_EXCEPTION LICENSE THIRD_PARTY_README moved to fully versioned dirs
  - Resolves: rhbz#1861222


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.22-6
changelog:
  - Add patch, JDK-8210416-RHBZ-1624122-fdlibm-opt-fix.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, JDK-8210425-RHBZ-1624122-sharedRuntimeTrig-opt-fix.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, JDK-8210647-RHBZ-1624122-libsaproc-opt-fix.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, JDK-8210703-RHBZ-1624122-vmStructs-opt-fix.patch, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - No longer filter -O flags from C flags coming from
    redhat-rpm-config.
  - Resolves: RHBZ#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-5
changelog:
  - Add patch, RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch,
    so as to disable dsin/dcos math intrinsics on aarch64. Work-around for
    JDK-8210461.
  - Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-6
changelog:
  - Add patch, RHBZ-1630996-JDK-8210858-workaround-disable-aarch64-intrinsic-log.patch,
    so as to disable log math intrinsic on aarch64. Work-around for
    JDK-8210858
  - Resolves: rhbz#1570856


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.28-8
changelog:
  - removed version less provides
  - javadocdir moved to arched dir as it is no longer noarch
  - Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-9
changelog:
  - Rework changes from 1:11.0.ea.22-6. RHBZ#1632174 supercedes
    RHBZ-1624122.
  - Add patch, JDK-8210416-RHBZ-1632174-fdlibm-opt-fix.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, JDK-8210425-RHBZ-1632174-sharedRuntimeTrig-opt-fix.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, JDK-8210647-RHBZ-1632174-libsaproc-opt-fix.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, JDK-8210761-RHBZ-1632174-libjsig-opt-fix.patch, so as to
    optimize compilation of libjsig.
  - Add patch, JDK-8210703-RHBZ-1632174-vmStructs-opt-fix.patch, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - Reinstate filtering of opt flags coming from redhat-rpm-config.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.0.28-1
changelog:
  - Identify as GA version and no longer as early access (EA).
  - JDK 11 has been released for GA on 2018-09-25.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.4.11-0
changelog:
  - Update to shenandoah-jdk-11.0.4+11 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-1
changelog:
  - Update to shenandoah-jdk-11.0.6+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-3
changelog:
  - Add JDK-8237396 backport to resolve Shenandoah TCK breakage in traversal mode.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.7.10-5
changelog:
  - Update to shenandoah-jdk-11.0.7+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.4-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+4 (EA)
  - Require tzdata 2020a due to resource changes in JDK-8243541
  - Resolves: rhbz#1838811


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.8.5-0.2.ea
changelog:
  - Disable stripping of debug symbols for static libraries part of
    the -static-libs sub-package.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.7-0.2.ea
changelog:
  - java-11-openjdk doesn't have a JRE tree, so don't try and copy alt-java there...
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.9-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+9 (EA)
  - Update release notes for 11.0.8 release.
  - This tarball is embargoed until 2020-07-14 @ 1pm PT.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-1
changelog:
  - Update to shenandoah-jdk-11.0.8+10 (GA)
  - Switch to GA mode for final release.
  - Update release notes with last minute fix (JDK-8248505).
  - This tarball is embargoed until 2020-07-14 @ 1pm PT.
  - Resolves: rhbz#1838811


author: Jaromir Capik <jcapik@redhat.com> 0:5.0-6
changelog:
  - Fixing #835786 - javacc: Invalid upstream URL
  - Minor spec file changes according to the latest guidelines


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 3.3.1-2
changelog:
  - Remove workaround for guice-no_aop
  - Remove fedora-review subpackage
  - Resolves: rhbz#1016667
  - Related: rhbz#1015158


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.1.3-7
changelog:
  - Remove unneeded dependency from POM: maven-cobertura-plugin
  - Remove unneeded dependency from POM: maven-findbugs-plugin
  - Resolves: rhbz#880692


author: Jiri Popelka <jpopelka@redhat.com> - 2.0-5
changelog:
  - Moving from rpmfusion-free to Fedora because it will be free of known patents
    in all countries from 2012-04-04 onwards
  - Changed license from GPL to GPLv2+ and included up-to-date license file


author: Pierre-Yves Chibon <pingou@pingoured.fr> - 0.7-1
changelog:
  - Update to 0.7
  - Fix BR to not require maven2
  - Fix BR for new package name
  - Adjust spec to new guidelines


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 3.0.0-1
changelog:
  - New upstream release
  - Updated no_pprof patch to match new release
  - Updated s390 patch to match new relase
  - Added make check
  - Added new script jemalloc.sh
  - Added a patch for atomic operations on epel5/ppc


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 3.5.1-1
changelog:
  - New upstream release
  - Updated nopprof patch to match new release
  - Fixed a few bogus changelog entries


author: Michal Srb <msrb@redhat.com> - 9.0.0-2
changelog:
  - Replace tomcat libs with glassfish libs
  - Add ability to build package without service files
  - Remove unneeded ecj custom depmap


author: Michal Srb <msrb@redhat.com> - 9.0.3-4
changelog:
  - Add missing BR: maven-plugin-build-helper
  - Add MIT license text
  - Don't install CDDL license
  - More specific explanation why tests are disabled


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 9.0.3-6
changelog:
  - Clean unused conditional code
  - Remove unused system-related code
  - Remove jetty binary package
  - Install license files with jetty-util package


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.0-3
changelog:
  - Change remote-resources version compare from > to >=
  - Removed generation of javadocs (wasn't working anyway)


author: Ville Skyttä <ville.skytta@iki.fi> - 20091111-6
changelog:
  - Address more comments/TODO's from #655601:
  - Patch test suite generation to use Xalan.
  - Include license texts in jing-javadoc.
  - Make datatype-sample buildable out of the box, drop prebuilt jar.


author: Ville Skyttä <ville.skytta@iki.fi> - 20091111-10
changelog:
  - Tweak java-devel build dep for buildability without Java 1.6.
  - Fix build classpath with recent TestNG.


author: Jan Pokorný <jpokorny@redhat.com> - 20091111-14
changelog:
  - Resync with recent spec file changes in Fedora by Ville Skyttä:
  - BuildRequire ant instead of -trax (non-EL).
  - Depend on headless JRE where available.
  - Fix build (#1048867) and depend on headless JRE on EL7


author: Chris Spike <spike@fedoraproject.org> 2.1-1.tzdata2012g
changelog:
  - Updated to 2.1
  - New tzdata (2012g)
  - Updated spec file according to latest java packaging guidelines


author: Parag <pnemade AT redhat DOT com> - 0.003-13
changelog:
  - Resolves:rh#847621 - better enabling autohinting by default
  - Resolves:rh#847623 - fontconfig file isn't shipped in rpm
  - Resolves:rh#847627 - Malformed fontconfig config file


author: Colin Walters <walters@verbum.org> - 1:1.8.5-6
changelog:
  - Include mozjs185.pc, clean up build
  - Based on work from Christopher Aillon <caillon@redhat.com>
  - Switch to using make install DESTDIR=, instead of hardcoding build rules.
  - Add DESTDIR= patch from GNOME 3.2 jhbuild
  - Make mozjs185 the canonical target for both libmozjs and libmozjs185.


author: Pavel Alexeev <Pahan@Hubbitus.info> - 1:1.8.5-11
changelog:
  - Thanks to Ville Skyttä (bz#875343) build against libedit instead of readline
  	what simplify licensing apparently without any loss of functionality


author: Krzysztof Daniel <kdaniel@redhat.com> 0:0.1.46-2
changelog:
  - Updated MANIFEST.MF to match the actual upstream version.
  - Added plugin.properties to get proper vendor name in Eclipse.


author: Sebastien Willmann <sebastien.willmann@gmail.com> - 0.6.0-0.3.rc2
changelog:
  - Removed static package
  - Preserving timestamp on installed files
  - Added guard grep to the sed expression
  - Removed duplicated doc files
  - Removed dependency on pkgconfig
  - Changed base package group


author: Björn Esser <fedora@besser82.io> - 0.10.5-1
changelog:
  - Update to version 0.10.5
  - Use %license and %doc properly
  - Add generated CMake-target
  - Move %check after %install
  - Remove Group-tag, needed for el <= 5, only
  - Drop Patch0, not needed anymore
  - Disabled Werror
  - Add disttag
  - Use cmake instead of scons


author: Michal Srb <msrb@redhat.com> - 0-0.14.20090319svn
changelog:
  - Install license file with javadoc subpackage (Resolves: rhbz#975411)
  - Add file containing link to CC-BY license text


author: Juan Hernandez <juan.hernandez@redhat.com> 1.1.1-1
changelog:
  - Adapted (mostly copied, in fact) from the corresponding package from Mageia
    (http://www.mageia.org) with support from Gil Cattaneo <puntogil@libero.it>.


author: Christina Fu <cfu@redhat.com> - 4.2.6-23
changelog:
  - Bugzilla Bug #797351 - JSS - HSM token name was mistaken for manufacturer
    identifier (cfu)
  - Bugzilla Bug #804840 - [RFE] ECC encryption keys cannot be archived
    ECC phase2 work - support for ECC encryption key archival and recovery (cfu)
  - Bugzilla Bug #783007 - Un-deprecate previously deprecated methods in
    JSS 4.2.6 . . . (mharmsen)
  - Dogtag TRAC Task #109 (https://fedorahosted.org/pki/ticket/109) - add
    benign JNI jar file symbolic link from JNI libdir to JNI jar file (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.2.6-24
changelog:
  - Bugzilla Bug #783007 - Un-deprecate previously deprecated methods in
    JSS 4.2.6 . . . BadPaddingException (mharmsen)


author: Christina Fu <cfu@redhat.com> - 4.2.6-35
changelog:
  - Bugzilla Bug #1040640 - Incorrect OIDs for SHA2 algorithms
    (cfu for jnimeh@gmail.com)
  - Bugzilla Bug #1133718 - Key strength validation is not performed for RC4
    algorithm (nkinder)
  - Bugzilla Bug #816396 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 via NSS through JSS (cfu)


author: Christina Fu <cfu@redhat.com> - 4.2.6-40
changelog:
  - Bugzilla 1074208 - pass up exact JSS certificate validation errors from NSS
    (edewata)
  - Bugzilla 1331596 - Key archival fails when KRA is configured with lunasa.
    (cfu)
  - PKI ticket 801 - Merge pki-symkey into jss (phase 1)
    (jmagne)


author: Christina Fu <cfu@redhat.com> - 4.2.6-42
changelog:
  - Sync up patches from both Fedora and RHEL; adding one patch
    (cfu, edewata, mharmsen) from RHEL:
  - Bugzilla Bug #1289799 - JSS build failure on F23 and Rawhide (edewata)


author: Elio Maldonado <emaldona@redhat.com> - 4.4.0-1
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - ## JSS 4.4.0 includes the following patches ported from downstream:
  - Mozilla Bugzilla #507536 - Add IPv6 functionality to JSS
  - Mozilla Bugzilla #1307872 - Expose NSS calls for OCSP settings
  - Mozilla Bugzilla #1307882 - RFE ecc - add ecc curve name support in JSS and
    CS interface
  - Mozilla Bugzilla #1307993 - Expose updated certificate verification function
    in JSS
  - Mozilla Bugzilla #1308000 - Incorrect socket accept error message due to bad
    pointer arithmetic
  - Mozilla Bugzilla #1308001 - Verification should fail when a revoked
    certificate is added
  - Mozilla Bugzilla #1308004 - Warnings should be cleaned up in JSS build
  - Mozilla Bugzilla #1308006 - DRM failed to recovery keys when in FIPS mode
    (HSM + NSS)
  - Mozilla Bugzilla #1308008 - Defects revealed by Coverity scan
  - Mozilla Bugzilla #1308009 - Add support for PKCS5v2; support for secure PKCS12
  - Mozilla Bugzilla #1308012 - DRM: during archiving and recovering, wrapping
    unwrapping keys should be done in the token
  - Mozilla Bugzilla #1308013 - JSS - HSM token name was mistaken for
    manufacturer identifier
  - Mozilla Bugzilla #1308017 - Un-deprecate previously deprecated methods in
    JSS 4.2.6
  - Mozilla Bugzilla #1308019 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 via NSS through JSS
  - Mozilla Bugzilla #1308026 - JSS certificate validation does not pass up exact
    error from NSS
  - Mozilla Bugzilla #1308027 - Merge pki-symkey into jss
  - Mozilla Bugzilla #1308029 - Resolve Javadoc build issues
  - Mozilla Bugzilla #1308047 - support ECC encryption key archival and recovery
  - Mozilla Bugzilla #1313122 - Remove bypass tests as latest NSS has removed
    PKCS#11 bypass support
  - Mozilla Bugzilla #1328675 - Simple problem unwrapping AES sym keys on token
  - Mozilla Bugzilla #1345174 - Cannot create system certs when using LunaSA HSM
    in FIPS Mode and ECC algorithms
  - Mozilla Bugzilla #1345613 - expose AES KeyWrap and add some useful OID
    functions
  - Mozilla Bugzilla #1346410 - Load JSS libraries appropriately
  - ## JSS 4.4.0 includes the following changes for building and testing:
  - Mozilla Bugzilla #1331765 - Simplify JSS Makefile build and test
  - Mozilla Bugzilla #1346420 - Document steps required to use the proper
    libjss4.so when running certain HMAC Algorithms tests


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-4
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - Updated build requirements for NSPR
  - Updated build and runtime requirements for NSS
  - ## 'jss-post-rebase.patch' resolves the following issues ported from
    - Mozilla Bugzilla #1337092 - CMC conformance update: Implement required ASN.1
    code for RFC5272+ (cfu)
  - Mozilla Bugzilla #1347394 - Eclipse project files for JSS (edewata)
  - Mozilla Bugzilla #1347429 - Deprecated SSL 3.0 cipher names in SSLSocket
    class. (edewata)
  - Mozilla Bugzilla #1348856 - SSL alert callback (edewata)
  - Mozilla Bugzilla #1349278 - SSL cipher enumeration (edewata)
  - Mozilla Bugzilla #1349349 - Problem with Password.readPasswordFromConsole().
    (edewata)
  - Mozilla Bugzilla #1349831 - Revise top-level README file (mharmsen)
  - Mozilla Bugzilla #1349836 - Changes to JSS Version Block (mharmsen)
  - Mozilla Bugzilla #1350130 - Missing
    CryptoManager.verifyCertificateNowCUNative() implementation. (emaldona)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-5
changelog:
  - Mozilla Bugzilla #1355268 - JSS 4.4 is incompatible with versions of
    idm-console-framework < 1.1.17-4
  - Red Hat Bugzilla #1435076 - Remove unused legacy lines from JSS spec files


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-6
changelog:
  - Mozilla Bugzilla #1352476 - RFE: Document on the README how to create a
    release tag (mharmsen)
  - Mozilla Bugzilla #1355358 - CryptoStore: add methods for importing and
    exporting EncryptedPrivateKeyInfo (ftweedal)
  - Mozilla Bugzilla #1359731 - CryptoStore.importPrivateKey enhancements
    (ftweedal)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-7
changelog:
  - Bump NSS dependencies from 4.28.3 to 4.28.4-6 to pick-up fix in
    Mozilla Bugzilla #1360207 - Fix incorrect if (ss->...) in SSL_ReconfigFD


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-8
changelog:
  - Bugzilla #1488846 - Fix HmacTest code for AES encrypt/unwrap [rhel-7.4.z]
    (jmagne)
  - Bugzilla #1490494 - PKCS12: (JSS) upgrade to at least AES and SHA2 (FIPS)
    [RHEL-7.4.z] (ftweedal)
  - Bugzilla #1490740 - PK11Store.getEncryptedPrivateKeyInfo() segfault if
    export fails [rhel-7.4.z] (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-9
changelog:
  - Bugzilla #1505690 - new JSS failures: HMAC Unwrap and KeyWrapping
    FIPSMODE [rhel-7.4.z] (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-10
changelog:
  - Bugzilla #1506710 - JSS throws ObjectNotFoundException without message
    (edewata)
  - Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
    producing signatures (especially for EC) (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-11
changelog:
  - Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
    producing signatures (especially for EC) (cfu,dstutzman)
  - Bugzilla #1533667 - Add: standard algorithm names for all ECC signature
    types (cfu,dstutzman)
  - Bugzilla #1534761 - SignerInfo class inserts wrong version # into the
    resulting structure (cfu,dstutzman)


author: Christina Fu <cfu@redhat.com> - 4.2.6-42
changelog:
  - Sync up patches from both Fedora and RHEL; adding two patches
    (cfu, edewata, mharmsen) from RHEL:
  - Bugzilla Bug #1238450 - UnsatisfiedLinkError on Windows (cfu)
  - make it compile on Windows platforms (cfu for nhosoi)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-3
changelog:
  - Bugzilla #1534772 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
    decode/encode process alters original data (cfu)
  - Bugzilla #1554056 - JSS: Add support for TLS_*_SHA384 ciphers (cfu)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.7-2
changelog:
  - Bugzilla #1747967 - CVE 2019-14823 jss: OCSP policy "Leaf and Chain" implicitly trusts the root certificate


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.7-3
changelog:
  - Bugzilla #1710105 - JSS: add RSA PSS support (jmagne)
  - Bugzilla #1796642 - JSS -- remove hardcoded native library
    /usr/lib{64}/jss/libjss4.so (ascheel)


author: Chris Spike <chris.spike@arcor.de> 2:1.0-0.8.20100930svn1125
changelog:
  - Updated to latest upstream svn revision
  - Installed pom.xml
  - Added 'net.sf.jtidy:jtidy' to maven depmap
  - Added 'jtidy:jtidy' to maven depmap


author: Michal Srb <msrb@redhat.com> - 0:4.10-7
changelog:
  - Build-time dependency perl-MD5 replaced with perl(Digest::MD5)
  - Description cleanup (Resolves: #888389)


author: Michal Srb <msrb@redhat.com> - 0:4.11-7
changelog:
  - Drop "-SNAPSHOT" from version ID
  - See: https://lists.fedoraproject.org/pipermail/java-devel/2013-August/004923.html


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-1
changelog:
  - Update to kbd-1.15.5 (removed kbd-1.15-resizecon-x86_64.patch,
    kbd-1.15-defkeymap.patch, kbd-1.15.3-fix-es-translation.patch,
    kbd-1.15.3-loadkeys-d.patch)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-3
changelog:
  - Include xkb layouts from xkeyboard-config converted to console keymaps
  - Add version to vlock provides
    Resolves: #902564


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-8
changelog:
  - Fix vlock doesn't perform PAM account management or credential reinitialization
    Resolves: #1032140


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-14
changelog:
  - Replace CtrlL_Lock with Caps_Lock in generated us.map
    Resolves: #1441411
  - Improve man pages and usage messages quality and consistency
    Resolves: #949015


author: Rex Dieter <rdieter@fedoraproject.org> 0.5.3-5
changelog:
  - kcm-gtk : "GTK+ Appearance" in systemsettings->lost and found (#628381)
  - Requires: kdebase-runtime


author: Kevin Kofler <Kevin@tigcc.ticalc.org> 0.5.3-8
changelog:
  - add support for GTK+ 3 (backported from upstream bzr gtk3 branch)
  - drop ancient Fedora < 13 env_script conditional, now always in kde-settings


author: Rex Dieter <rdieter@fedoraproject.org>
changelog:
  - 0.5.3-10
  - update kcm_category patch
  - kubuntu_01_xsettings_kipc.patch
  - drop old Obsoletes: gtk-qt-engine


author: Ryan Rix <ry@n.rix.si> - 0.3.1-3
changelog:
  - Update the category to adhere to new SC 4.5 systemsettings layout. Will now
    appear under the "input devices" section.


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 0.3.1-6
changelog:
  - Merge bugfixes from Kubuntu, fixes circular scrolling and more (#633353)
  - Drop default kcmtouchpadrc, use driver defaults (#611611)
  - Make the Scrolling tab use a vertical scrollbar if needed (#600121)


author: Jan Grulich <jgrulich@redhat.com> 0.9.0.8-2
changelog:
  - remove mobile-broadband-mobile-provider-devel as BR
  - add ModemManager as runtime dependency
  - add mobile-broadband-mobile-provider as runtime dependency


author: Jan Grulich <jgrulich@redhat.com> - 4.10.5-10
changelog:
  - Avoid duplicates in solid device automounter kcm
    Resolves: bz#1084191
  - Enable automount overrides even when automatic mounting is disabled
    Resolves: bz#1084497


author: Jan Grulich <jgrulich@redhat.com> - 19-23.9
changelog:
  - Check if we have write access to home directory before creating default folders
    Resolves: bz#1579764


author: Jan Grulich <jgrulich@redhat.com> - 19-23.11
changelog:
  - Do not fail when HOME is defined as multiwords
    Resolves: bz#1786089

  - Do not fail when prelink is not installed or disabled
    Resolves: bz#1732607


author: Jan Grulich <jgrulich@redhat.com> - 19-23.11
changelog:
  - Do not fail when prelink is not installed or disabled (fixed syntax
    error in previous patch)
    Resolves: bz#1732607


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-8
changelog:
  - Powerdevil: do not notify about a non existent action
    Resolves: bz#1289149
  - Plasma taskmanager: close context menu when task is closed
    Resolves: bz#1262603


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-10
changelog:
  - Fix grouping of tasks in taskmanager applet
    Resolves: bz#1348917
  - Fix unlocking of kscreenlocker, unlock it just once
    Resolves: bz#1333441


author: Jan Grulich <jgrulich@redhat.com> - 4.11-19-13
changelog:
  - Sanitise notification HTML
    Resolves: bz#1568853

  - Increase cpu buffer size in ksysguard
    Resolves: bz#1611762


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-14
changelog:
  - Do not show disabled buttons in Plastik decoration theme
    Resolves: bz#1677641

  - Taskmanager: dismiss group when application is closed and there is enough space
    Resolve: bz#1698048


author: Than Ngo <than@redhat.com> - 4.10.5-20
changelog:
  - Resolves: bz#1040678 - cannot assign custom keyboard shortcut for Show Desktop Grid
  - Resolves: bz#1090492 - changing calendar settings does not appear in plasmoid until month changed
  - Resolves: bz#1109936 - incorrect dispaly corner detection with multiple displays


author: Daniel Vrátil <dvratil@redhat.com> - 4.10.5-21
changelog:
  - Resolves: bz#1090492 - changing calendar settings does not appear in plasmoid until month changed (fixed patch)
  - Resolves: bz#1109936 - incorrect dispaly corner detection with multiple displays (fixed patch)


author: Rex Dieter <rdieter@fedoraproject.org> - 6:4.10.3-2
changelog:
  - pull in a few upstream fixes, including a couple minor security issues
  - Crash in DialogShadows::Private::freeX11Pixmaps() (kde#319137)


author: Martin Briza <mbriza@redhat.com> - 4.10.5-3
changelog:
  - make kpac_dhcp_helper full relro
  - set the variables in the generated cmake files to contain both 64b and 32b paths
  - hide "command not found" for one pkg-config invocation in the spec
  - fix macro expansion in the spec changelog
  - Resolves: #884052


author: Martin Briza <mbriza@redhat.com> - 4.10.5-4
changelog:
  - use a better way to figure out if lib or lib64 should be used
  - use -fno-strict-aliasing for type punned source files
  - Resolves: #884052


author: Jan Grulich <jgrulich@redhat.com> - 6:4.14.8-9
changelog:
  - Do not fork konsole process when opening terminal from apps using dolphin-part
    Resolves: bz#1710362


author: Jan Grulich <jgrulich@redhat.com> - 6:4.14.8-6
changelog:
  - KAuth: verify that whoever is calling us is actually who he says he is (CVE-2017-8422)
    Resolves: CVE-2017-8422


author: Ryan O'Hara <rohara@redhat.com> - 1.2.7-3
changelog:
  - Update spec file.
  - Add option to prevent respawn of child processes.
  - Remove duplicate command-line option code.
  - Use popt to generate usage message.
  - Fix pointer arithmetic for VRRP packets.
  - Fix comparison of primary IP address.
  - Fix loading of SSL certificate.
  - Fix typo in error message.
  - Update FSF address in GPLv2 license.
  - Remove debug message from if_get_by_ifname.


author: Jarod Wilson <jarod@redhat.com> [3.10.0-114.el7]
changelog:
  - [net] netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (Jiri Pirko) [1077351] {CVE-2014-2523}
  - [net] ipv6: don't set DST_NOCOUNT for remotely added routes (Jiri Pirko) [1075060] {CVE-2014-2309}
  - [net] skbuff: skb_segment: orphan frags before copying ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] skbuff: skb_segment: s/fskb/list_skb/ ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] skbuff: skb_segment: s/skb/head_skb/ ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] skbuff: skb_segment: s/skb_frag/frag/ ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] skbuff: skb_segment: s/frag/nskb_frag/ ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] use kfree_skb_list() helper ("Michael S. Tsirkin") [1056934] {CVE-2014-0131}
  - [net] veth: fix veth vlan features (Flavio Leitner) [1076077]
  - [net] sunrpc/xprtrdma: add separate Kconfig options for NFSoRDMA client and server support (Jeff Layton) [1077957]
  - [virt] kvm/x86: emulate MOVAPD (Igor Mammedov) [1052090]
  - [virt] kvm/x86: emulate MOVAPS (Igor Mammedov) [1052090]
  - [mm] x86: Wrong page freed on preallocate_pmds() failure exit (Larry Woodman) [1073641]
  - [mm] x86: do not leak page->ptl for pmd page tables (Larry Woodman) [1073641]
  - [virt] kvm/x86: fix emulator buffer overflow (Andrew Jones) [1071836] {CVE-2014-0049}
  - [virt] hyperv: Change the receive buffer size for legacy hosts (Jason Wang) [1075279]
  - [x86] quirks: Update DH8900CC Unsupported Device ID (Prarit Bhargava) [1076137]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-115.el7]
changelog:
  - [block] free q->flush_rq in blk_init_allocated_queue error paths (Mike Snitzer) [1078522]
  - [x86] fpu: Clear exceptions in AMD FXSAVE workaround (Phillip Lougher) [1053596] {CVE-2014-1438}
  - [mm] page_alloc: spill to remote nodes before waking kswapd (Johannes Weiner) [1076546]
  - [mm] vmscan: do not swap anon pages just because free+file is low (Johannes Weiner) [1076546]
  - [fs] sunrpc: Ensure call_connect_status() deals correctly with SOFTCONN tasks (Steve Dickson) [1071532]
  - [fs] nfs: Ensure we respect soft mount timeouts during trunking discovery (Steve Dickson) [1071532]
  - [fs] nfs: Schedule recovery if nfs40_walk_client_list() is interrupted (Steve Dickson) [1071532]
  - [fs] sunrpc: Ensure that call_bind times out correctly (Steve Dickson) [1071532]
  - [fs] sunrpc: Ensure that call_connect times out correctly (Steve Dickson) [1071532]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-116.el7]
changelog:
  - [s390] qeth: postpone freeing of qdio memory (Hendrik Brueckner) [1077650]
  - [kernel] rh_taint: Remove taint and update unsupported hardware message (Prarit Bhargava) [1076974]
  - [fs] proc/vmcore: continue vmcore initialization if PT_NOTE is found empty (Chao WANG) [1077535]
  - [net] ipv6: ip6_append_data_mtu do not handle the mtu of the second fragment properly (Jiri Pirko) [1079873]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-117.el7]
changelog:
  - [md] dm-thin: fix dangling bio in process_deferred_bios error path (Mike Snitzer) [1081781]
  - [md] dm: take care to copy the space map roots before locking the superblock (Mike Snitzer) [1081781]
  - [md] dm-transaction-manager: fix corruption due to non-atomic transaction commit (Mike Snitzer) [1081781]
  - [md] dm-era: fixes for issues identified upstream (Mike Snitzer) [1081781]
  - [md] dm-cache: remove remainder of distinct discard block size (Mike Snitzer) [1062679]
  - [md] dm-cache: prevent corruption caused by discard_block_size > cache_block_size (Mike Snitzer) [1062679]
  - [ipc] change kern_ipc_perm.deleted type to bool (Phillip Lougher) [1043807] {CVE-2013-7026}
  - [ipc] introduce ipc_valid_object() helper to sort out IPC_RMID races (Phillip Lougher) [1043807] {CVE-2013-7026}
  - [ipc] shm: fix shm_file deletion races (Phillip Lougher) [1043807] {CVE-2013-7026}
  - [drm] udl: take reference to device struct for dma-bufs (Dave Airlie) [1077774]
  - [security] keys: Allow special keys (eg. DNS results) to be invalidated by CAP_SYS_ADMIN (David Howells) [1074240]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-118.el7]
changelog:
  - [wireless] ath9k: Fix LNA gpio for AR9485 (John Green) [1082017]
  - [infiniband] core: Don't resolve passive side RoCE L2 address in cma req handler (Amir Vadai) [1075852]
  - [fs] xfs: fix buffer use after free on IO error (Eric Sandeen) [924301]
  - [scsi] be2iscsi: Bump the driver version (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix DMA Out of SW-IOMMU space error (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix scsi_cmnd leakage in driver (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix the session cleanup when reboot/shutdown happens (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix doorbell format for EQ/CQ/RQ s per SLI spec (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix port speed typo in driver (Rob Evers) [1052416]
  - [scsi] be2iscsi: Fix handling timed out MBX completion from FW (Rob Evers) [1052416]
  - [fs] nfs: Fix a use-after-free problem in open() (Steve Dickson) [1062809]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-119.el7]
changelog:
  - [net] bonding: remove bond_resend_igmp_join_requests read_unlock leftover (Veaceslav Falico) [1080924]
  - [ethernet] mlx4: Support shutdown() interface (Amir Vadai) [1046216]
  - [zram] fix invalid memory access (Jerome Marchand) [1081936]
  - [zram] protect zram_reset_device() call (Jerome Marchand) [1081936]
  - [zram] remove zram_sysfs file (Jerome Marchand) [1081936]
  - [zram] use atomic64_xxx() to replace zram_stat64_xxx() (Jerome Marchand) [1081936]
  - [zram] optimize memory operations with clear_page()/copy_page() (Jerome Marchand) [1081936]
  - [zram] kill unused zram_get_num_devices() (Jerome Marchand) [1081936]
  - [zram] simplify and optimize dev_to_zram() (Jerome Marchand) [1081936]
  - [kernel] futex: revert back to the explicit waiter counting code (Larry Woodman) [1081100]
  - [kernel] audit: Allow login in non-init namespaces (Richard Guy Briggs) [1082597]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-120.el7]
changelog:
  - [net] netfilter: fix panic when oom during rule replacement (Florian Westphal) [985657]
  - [net] netfilter: x_tables: fix ordering of jumpstack allocation and table update (Florian Westphal) [985657]
  - [virt] kvm/ioapic: try to recover if pending_eoi goes out of range (Paolo Bonzini) [1036478]
  - [virt] kvm/ioapic: fix assignment of ioapic->rtc_status.pending_eoi (Paolo Bonzini) [1036478 1081590] {CVE-2014-0155}
  - [virt] kvm/ioapic: reinject pending interrupts on KVM_SET_IRQCHIP (Paolo Bonzini) [1036478]
  - [virt] kvm/ioapic: extract body of kvm_ioapic_set_irq (Paolo Bonzini) [1036478]
  - [virt] kvm/ioapic: clear IRR for edge-triggered interrupts at delivery (Paolo Bonzini) [1036478]
  - [virt] kvm/ioapic: merge ioapic_deliver into ioapic_service (Paolo Bonzini) [1036478]
  - [virt] kvm: ignore ioapic polarity (Paolo Bonzini) [1036478]
  - [core] device: Create 'device_driver_rh' KABI shadowing structure (Myron Stowe) [1083692]
  - [core] device: Create 'device_rh' KABI shadowing structure (Myron Stowe) [1083692]
  - [scsi] Reserve space in structures for future XCOPY support (Ewan Milne) [1080430]
  - [fs] xfs: fix bad hash ordering (Brian Foster) [1083206]
  - [fs] xfs: always do log forces via the workqueue (Brian Foster) [1052004]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-121.el7]
changelog:
  - [virt] vhost/net: fix total length when packets are too short ("Michael S. Tsirkin") [1064446] {CVE-2014-0077}
  - [virt] vhost/net: validate vhost_get_vq_desc return value ("Michael S. Tsirkin") [1070940] {CVE-2014-0055}


author: Jarod Wilson <jarod@redhat.com> [3.10.0-122.el7]
changelog:
  - [security] device_cgroup: check if exception removal is allowed (Aristeu Rozanski) [1086057]
  - [security] device_cgroup: rework device access check and rule checking (Aristeu Rozanski) [1086057]
  - [fs] autofs: fix lockref lookup (Ian Kent) [1083815]
  - [mei] me: do not load the driver if the FW doesn't support MEI interface (Prarit Bhargava) [1082789]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-123.el7]
changelog:
  - [mm] rmap: try_to_unmap_cluster() should lock_page() before mlocking (Larry Woodman) [1078349] {CVE-2014-3122}
  - [mm] huge_memory: Fix cpuset cgroups so all pages for a task remain on correct node (Larry Woodman) [1076613]
  - [mm] mprotect: fix oops in change_pmd_range called from task_numa_work (Rik van Riel) [1085050]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.1.2.el7]
changelog:
  - [tty] n_tty: Fix n_tty_write crash when echoing in raw mode (Aristeu Rozanski) [1094241 1094242] {CVE-2014-0196}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-123.2.1.el7]
changelog:
  - [net] filter: prevent nla extensions to peek beyond the end of the message (Jiri Benc) [1096780 1096781] {CVE-2014-3144 CVE-2014-3145}
  - [block] floppy: don't write kernel-only members to FDRAWCMD ioctl output (Denys Vlasenko) [1094316 1094318] {CVE-2014-1737 CVE-2014-1738}
  - [block] floppy: ignore kernel-only members in FDRAWCMD ioctl input (Denys Vlasenko) [1094316 1094318] {CVE-2014-1737 CVE-2014-1738}
  - [net] core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors (Jiri Pirko) [1091345 1079014] {CVE-2014-2568}
  - [net] ipv4: current group_info should be put after using (Jiri Benc) [1087415 1087416] {CVE-2014-2851}
  - [fs] dcache: make prepend_name() work correctly when called with negative *buflen (Mikulas Patocka) [1099048 1092746]
  - [fs] dcache: __dentry_path() fixes (Mikulas Patocka) [1099048 1092746]
  - [fs] dcache: prepend_path() needs to reinitialize dentry/vfsmount/mnt on restarts (Mikulas Patocka) [1099048 1092746]
  - [target] tcm_fc: Fix use-after-free of ft_tpg (Andy Grover) [1088110 1071340]
  - [s390] af_iucv: wrong mapping of sent and confirmed skbs (Hendrik Brueckner) [1103064 1098513]
  - [s390] kernel: avoid page table walk on user space access (Hendrik Brueckner) [1103062 1097687]
  - [s390] crypto: fix aes, des ctr mode concurrency finding (Hendrik Brueckner) [1103060 1097686]
  - [net] openvswitch: fix a possible deadlock and lockdep warning (Flavio Leitner) [1103318 1094867]
  - [mm] filemap: update find_get_pages_tag() to deal with shadow entries (Johannes Weiner) [1103065 1091795]
  - [mm] page-writeback: fix divide by zero in pos_ratio_polynom (Rik van Riel) [1103067 1091784]
  - [mm] page-writeback: add strictlimit feature (Rik van Riel) [1103067 1091784]
  - [fs] xfs: log vector rounding leaks log space (Brian Foster) [1103059 1091136]
  - [fs] xfs: truncate_setsize should be outside transactions (Brian Foster) [1103059 1091136]
  - [fs] gfs2: Fix uninitialized VFS inode in gfs2_create_inode (Abhijith Das) [1097407 1087995]
  - [kernel] futex: Fix pthread_cond_broadcast() to wake up all threads (Larry Woodman) [1103066 1084757]
  - [net] ip: generate unique IP identificator if local fragmentation is allowed (Jiri Pirko) [1090490 1076106]
  - [kernel] cputime: Fix jiffies based cputime assumption on steal accounting (Frederic Weisbecker) [1090974 1047732]
  - [kernel] cputime: Bring cputime -> nsecs conversion (Frederic Weisbecker) [1090974 1047732]
  - [kernel] cputime: Default implementation of nsecs -> cputime conversion (Frederic Weisbecker) [1090974 1047732]
  - [x86] irq, pic: Probe for legacy PIC and set legacy_pic appropriately (Vivek Goyal) [1094973 1037957]
  - [virt] hyperv/vmbus: Negotiate version 3.0 when running on ws2012r2 hosts (Vivek Goyal) [1094973 1037957]


